How to automate initial cmkadmin password change non-interactively in Checkmk 2.4

Troubleshooting
,
1

Hi Checkmk Community,

We are building an automated deployment pipeline (via Ansible) for Checkmk 2.4.0 (2.4.0p35.cre). As part of our automated site provisioning process, we need to set or update the cmkadmin user password during deployment without manual intervention.

Because this is running in an automated pipeline, we cannot interactively log in or type passwords into interactive prompts.

Approaches We Have Tried & Issues Encountered:

  1. cmk-passwd cmkadmin via stdio / piping (printf ... | cmk-passwd)

    • Result: Fails because cmk-passwd uses Python’s getpass module, which expects an interactive TTY and ignores stdin input.

  2. Standard htpasswd binary (htpasswd -b /omd/sites/<site>/etc/htpasswd cmkadmin <pass>)

    • Result: Updates the htpasswd file, but Checkmk 2.4 does not accept the new credentials upon Web UI login. Checkmk 2.4 caches authentication state in /var/check_mk/web/cmkadmin/ (cached_profile.mk, last_pw_change.mk, etc.), causing logins to fail or become locked out (num_failed_logins.mk).

  3. REST API Endpoint (/check_mk/api/1.0/objects/user_config/cmkadmin)

    • Result: On freshly deployed poller sites, the default automation credentials or secrets are either not initialized or unavailable, making API authentication impossible prior to initial configuration.

  4. Direct Python module invocation (cmk.cmkpasswd)

    • Result: Invoking _run_cmkpasswd via python script updates /etc/htpasswd, but the session cache state in Checkmk 2.4 remains out of sync unless manual cache purging and site restarts occur.

Questions for the Developers / Community:

  1. Is there an official, supported CLI command or flag in Checkmk 2.4 to change a user password non-interactively? (e.g., passing the password via an environment variable, parameter, or config file).

  2. What is the recommended best practice for bootstrapping cmkadmin credentials during automated CI/CD / Ansible provisioning?

  3. Which specific user session/cache files need to be updated or cleared alongside /etc/htpasswd to ensure Checkmk 2.4 recognizes password changes without requiring a GUI login first?

Any guidance or recommended CLI workaround for pipeline deployment would be greatly appreciated!

2

Specify --admin-password=… when running omd create.

3

tried with this but it is not allowing to login via password defined via admin-password command, but it was access via “cmkadmin with password: icjp3TqslDty”

_______________
root@user1:~# omd create test --admin-password=“test@12234”
Adding /opt/omd/sites/test/tmp to /etc/fstab.
Creating temporary filesystem /omd/sites/test/tmp…OK
Updating core configuration…
Generating configuration for core (type nagios)…
Precompiling host checks…OK
Executing post-create script “01_create-sample-config.py”…OK
Executing post-create script “02_cmk-compute-api-spec”…OK
Executing post-create script “03_message-broker-certs”…OK
Restarting Apache…OK
Created new site test with version 2.4.0p21.cre.

The site can be started with omd start test.
The default web UI is available at http://user1/test/

The admin user for the web applications is cmkadmin with password: icjp3TqslDty
For command line administration of the site, log in with ‘omd su test’.
After logging in, you can change the password for cmkadmin with ‘cmk-passwd cmkadmin’.
_______________

4

I assume, the position of the argument matters:

omd create --admin-password='test@1234' test

Thanks, @kdeutsch , I have to switch to the markdown editor. WYSIWYG does weird things.

5 
omd create --admin-password 'test@1234' test