Reset the admin password

Because password reset requires a logged-in admin, recovering the admin account is done by resetting the user Secret in Kubernetes.

There is no self-service “forgot password” flow in v1.

How Admin credentials are stored

Local users are stored as Kubernetes Secrets named falkordb-user-<sanitized-email> in the admin server namespace. The email is lowercased and any character outside a-z0-9- is replaced with - (for example admin@example.com becomes falkordb-user-admin-example-com). Each Secret has a user key containing a base64-encoded JSON document with a bcrypt password hash. Note: re-running helm upgrade with a new adminServer.bootstrap.adminUser.password does not reset the password — the chart preserves an existing user Secret. You must patch the Secret directly.

Reset the password in the Kubernetes Secret

Find the admin user Secret:

kubectl -n falkordb-system get secrets -l app.kubernetes.io/component=user

Generate a bcrypt hash for the new password:

htpasswd -bnBC 10 "" 'NewTempPassword123!' | tr -d ':\n'

Or with Node.js:

node -e "console.log(require('bcryptjs').hashSync(process.argv[1], 10))" 'NewTempPassword123!'

Patch the user JSON in the Secret with the new hash and force a password change on next login:

SECRET=falkordb-user-admin-example-com
NS=falkordb-system
HASH='$2y$10$...'

kubectl -n "$NS" get secret "$SECRET" -o jsonpath='{.data.user}' | base64 -d \
  | jq --arg hash "$HASH" '.password = $hash | .mustChangePassword = true | .updatedAt = (now | todate)' \
  | base64 \
  | xargs -I{} kubectl -n "$NS" patch secret "$SECRET" -p '{"data":{"user":"{}"}}'

If local logins are disabled (DISABLE_LOCAL_AUTH=true on the admin server), re-enable local auth temporarily via adminServer.env before resetting, then disable it again afterwards.

Resetting other users’ passwords

If an admin can log in, reset other users’ passwords through the product instead of touching Secrets:

Admin UI: open Users, select the user, select Reset Password, and share the temporary password through a secure channel. Requires users:update permission.

CLI:

falkordb-admin users reset-password user@example.com

API:

curl -f -X POST "http://localhost:3000/api/users/user%40example.com/reset-password" \
	-H 'Content-Type: application/json' \
	-b cookies.txt \
	-d '{}'

In all cases the server generates a random temporary password, sets mustChangePassword: true, and returns it in the response:

{
  "message": "Password reset successfully",
  "tempPassword": "<generated>"
}

Notes

Resets performed through the API are recorded in the audit log as user.password_change. Direct Secret edits are not audited, so record them in your change management process.
Bootstrap values reference: adminServer.bootstrap.adminUser.* in Helm values.

Get started

Install

Authentication

Deploy databases

Operations

Upgrade and uninstall

Troubleshooting

How Admin credentials are stored

Reset the password in the Kubernetes Secret

Resetting other users’ passwords

Notes

​How Admin credentials are stored

​Reset the password in the Kubernetes Secret

​Resetting other users’ passwords

​Notes

How Admin credentials are stored

Reset the password in the Kubernetes Secret

Resetting other users’ passwords

Notes