OPENSEARCH_INITIAL_ADMIN_PASSWORD -> what happens when you have more defined?

OpenSearch
, ,
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
“version” : {
“distribution” : “opensearch”,
“number” : “3.1.0”,
“build_type” : “deb”,
“build_hash” : “8ff7c6ee924a49f0f59f80a6e1c73073c8904214”,
“build_date” : “2025-06-21T08:05:38.757936053Z”,
“build_snapshot” : false,
“lucene_version” : “10.2.1”,
“minimum_wire_compatibility_version” : “2.19.0”,
“minimum_index_compatibility_version” : “2.0.0”
}

Describe the issue:
The question is, if I install all my nodes using the available debian packages, the documentation states that I must provide and OPENSEARCH_INITIAL_ADMIN_PASSWORD during the installation of the package. When I started the installation, I assumed that this needs to be different on all nodes, but now I realise that if this is the case, it is ambiguous which admin password will be used for the cluster. I successfully query the cluster with the admin password of the dedicated manager node, but it would be nice if this ambiguity could be removed.

If all the nodes were installed with an opensearch configuration with different admin passwords, which one will be the master admin password for the cluster?

Configuration:
Following guide Debian - OpenSearch Documentation

# x64
sudo env OPENSEARCH_INITIAL_ADMIN_PASSWORD=<custom-admin-password> dpkg -i opensearch-3.1.0-linux-x64.deb

The admin password is custom for all created nodes in the cluster: one for manager, one for cooridinator, one for each data nodes.

Thanks for your consideration and answers in advance.

2

@MrSecurityMindset There should only be one OPENSEARCH_INITIAL_ADMIN_PASSWORD for the entire cluster. This configuration is inserted into the internal_users.yml file under admin user. And the same configuration is uploaded to the opensearch-security index which is then used to authorize the incoming requests. Therefore if multiple OPENSEARCH_INITIAL_ADMIN_PASSWORD are provided, only one will be used as admin. I think whichever nodes gets initialised first.