Manage the Universal Forwarder admin password

Set up the admin password for the Universal Forwarder, then rotate it as needed for stateless or durable storage modes.

The chart manages the admin password through a Kubernetes Secret by default. You can customize the Secret key, provide your own Secret, or rotate the password later for stateless or durable storage modes.

Set up the admin password

The chart manages the admin password through a Kubernetes Secret unless you override it.

  1. Chart-managed Secret (default).

    CODE 
    helm install my-uf ./helm-chart/splunk-universalforwarder \
  --set splunkConfig.forwardServer=indexer.example.com:9997 \
  --set splunkConfig.password=MySecurePassword1 \
  --set splunkConfig.splunkGeneralTerms=<value-from-splunk-general-terms-acceptance-page>

    The chart creates a Secret with two keys:

    • password: the plaintext password, b64-encoded
    • default.yml: the Ansible config blob that includes splunk.password

    Both are consumed at startup. The UF sets the admin password declaratively through the Splunk REST API (SPLUNK_DECLARATIVE_ADMIN_PASSWORD=true).

    Important: The chart fails at render time if splunkConfig.password="changeme" and no existingSecret is provided. This prevents the most common misconfiguration where the default password leaves remote login turned off.

  2. Custom Secret key. If your Secret stores the password under a key other than password, set splunkConfig.passwordKey:

    CODE 
    --set splunkConfig.passwordKey=splunk-admin-password

    The chart's SPLUNK_PASSWORD environment variable and the secretKeyRef use this key name.

  3. Bring your own Secret. Use splunkConfig.existingSecret to skip chart-managed Secret creation and provide your own.

    Create the Secret manually.

    CODE 
    kubectl create secret generic my-uf-secret \
  --namespace my-namespace \
  --from-literal=password=MySecurePassword1 \
  --from-literal=default.yml='splunk:
  password: "MySecurePassword1"
  forward_servers:
    - indexer.example.com
  s2s_port: "9997"
  kvstore:
    disabled: 1
'

    Reference the Secret when you install the chart.

    CODE 
    helm install my-uf ./helm-chart/splunk-universalforwarder \
  --set splunkConfig.forwardServer=indexer.example.com:9997 \
  --set splunkConfig.existingSecret=my-uf-secret \
  --set splunkConfig.splunkGeneralTerms=<value-from-splunk-general-terms-acceptance-page>

    The chart skips Secret creation entirely and mounts the named Secret. It also skips the password validation guard when existingSecret is set.

Rotate the password

How you rotate the admin password depends on the storage mode.

  1. Stateless mode (storage.emptyDir: true, the default). The pod restarts from scratch and picks up the new password automatically.

    Upgrade the release with the new password value.

    CODE 
    helm upgrade my-uf ./helm-chart/splunk-universalforwarder \
  --namespace my-namespace \
  --set splunkConfig.forwardServer=indexer.example.com:9997 \
  --set splunkConfig.password=NewSecurePassword1 \
  --set splunkConfig.splunkGeneralTerms=<value-from-splunk-general-terms-acceptance-page>

    The pod restarts and the Universal Forwarder authenticates with the new password.

  2. Durable mode (storage.emptyDir: false). Password rotation requires removing the old PVCs so Splunk reinitializes with the new credential, because the old passwd hash is stored on the PVC.

    Uninstall the release. Helm deletes the durable-mode PVCs automatically.

    CODE 
    helm uninstall my-uf --namespace my-namespace

    Wait for the PVCs to finish terminating before reinstalling.

    CODE 
    kubectl wait --for=delete \
  pvc/my-uf-splunk-universalforwarder-etc \
  pvc/my-uf-splunk-universalforwarder-var \
  --timeout=10m \
  --namespace my-namespace

    Confirm that neither PVC is returned.

    CODE 
    kubectl get pvc \
  my-uf-splunk-universalforwarder-etc \
  my-uf-splunk-universalforwarder-var \
  --ignore-not-found \
  --namespace my-namespace

    Reinstall the chart with the new password.

    CODE 
    helm install my-uf ./helm-chart/splunk-universalforwarder \
  --namespace my-namespace \
  --set storage.emptyDir=false \
  --set updateStrategy.type=Recreate \
  --set splunkConfig.forwardServer=indexer.example.com:9997 \
  --set splunkConfig.password=NewSecurePassword1 \
  --set splunkConfig.splunkGeneralTerms=<value-from-splunk-general-terms-acceptance-page>

    Splunk reinitializes on the newly created PVCs and the Universal Forwarder authenticates with the new password.