# Update Security Configuration on Kubernetes **URL:** \ **Category:** Security\ **Tags:** configure\ **Created:** [October 21, 2026, 6:09am UTC](https://forum.opensearch.org/t/update-security-configuration-on-kubernetes/28356 "2026-10-21T06:09:57Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![awiechers](https://avatars.discourse-cdn.com/v4/letter/a/90ced4/32.png) [@awiechers](https://forum.opensearch.org/u/awiechers)\ **Post date:** [October 21, 2026, 6:09am UTC](https://forum.opensearch.org/t/update-security-configuration-on-kubernetes/28356/1 "2026-10-21T06:09:57Z")
**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser): OpenSearch 3.9.0 Debian Bookworm k3s 1.34.3 **Describe the issue:** I’m evaluating OpenSearch on Kubernetes. I’m deploying a 3-node stateful set with LDAP integration via manifests (no operator). My understanding is that for subsequent changes to the security configuration I would need to run `securityadmin.sh` to make OpenSearch pick up the changes. I tried running the following command against one of the nodes ```auto kubectl exec -it -n opensearch opensearch-master-0 -- /usr/share/opensearch/plugins/opensearch-security/tools/securityadmin.sh -cd "/usr/share/opensearch/config/opensearch-security" -icl -key "/usr/share/opensearch/config/kirk-key.pem" -cert "/usr/share/opensearch/config/kirk.pem" -cacert "/usr/share/opensearch/config/root-ca.pem" -nhnv ``` which apparently succeeds: ```auto Security Admin v7 Will connect to localhost:9200 ... done Connected as "CN=kirk,OU=client,O=client,L=test,C=de" OpenSearch Version: 3.9.0 Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ... Clustername: opensearch Clusterstate: Green Number of nodes: 3 Number of data nodes: 3 .opendistro_security index already exists, so we do not need to create one. Populate config from /usr/share/opensearch/config/opensearch-security/ Will update '/config' with /usr/share/opensearch/config/opensearch-security/config.yml SUCC: Configuration for 'config' created or updated Will update '/roles' with /usr/share/opensearch/config/opensearch-security/roles.yml SUCC: Configuration for 'roles' created or updated Will update '/rolesmapping' with /usr/share/opensearch/config/opensearch-security/roles_mapping.yml SUCC: Configuration for 'rolesmapping' created or updated Will update '/internalusers' with /usr/share/opensearch/config/opensearch-security/internal_users.yml SUCC: Configuration for 'internalusers' created or updated Will update '/actiongroups' with /usr/share/opensearch/config/opensearch-security/action_groups.yml SUCC: Configuration for 'actiongroups' created or updated Will update '/tenants' with /usr/share/opensearch/config/opensearch-security/tenants.yml SUCC: Configuration for 'tenants' created or updated Will update '/nodesdn' with /usr/share/opensearch/config/opensearch-security/nodes_dn.yml SUCC: Configuration for 'nodesdn' created or updated Will update '/audit' with /usr/share/opensearch/config/opensearch-security/audit.yml SUCC: Configuration for 'audit' created or updated Will update '/allowlist' with /usr/share/opensearch/config/opensearch-security/allowlist.yml SUCC: Configuration for 'allowlist' created or updated SUCC: Expected 9 config types for node {"updated_config_types":["allowlist","tenants","rolesmapping","nodesdn","audit","roles","actiongroups","config","internalusers"],"updated_config_size":9,"message":null} is 9 (["allowlist","tenants","rolesmapping","nodesdn","audit","roles","actiongroups","config","internalusers"]) due to: null SUCC: Expected 9 config types for node {"updated_config_types":["allowlist","tenants","rolesmapping","nodesdn","audit","roles","actiongroups","config","internalusers"],"updated_config_size":9,"message":null} is 9 (["allowlist","tenants","rolesmapping","nodesdn","audit","roles","actiongroups","config","internalusers"]) due to: null SUCC: Expected 9 config types for node {"updated_config_types":["allowlist","tenants","rolesmapping","nodesdn","audit","roles","actiongroups","config","internalusers"],"updated_config_size":9,"message":null} is 9 (["allowlist","tenants","rolesmapping","nodesdn","audit","roles","actiongroups","config","internalusers"]) due to: null Done with success ``` Does this (running the command on just one of the nodes) suffice? Or would I have to run it on every node? ---
**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\ **Post date:** [October 21, 2026, 6:57am UTC](https://forum.opensearch.org/t/update-security-configuration-on-kubernetes/28356/2 "2026-10-21T06:57:52Z")
Hi @awiechers. Welcome to the forum. Running securityadmin.sh against one of the OpenSearch nodes is sufficient. OpenSearch security plugin stores its configuration in a single index that is accessible by all nodes in the same cluster. You don’t need to run it on all nodes individually. ---
**Author:** ![awiechers](https://avatars.discourse-cdn.com/v4/letter/a/90ced4/32.png) [@awiechers](https://forum.opensearch.org/u/awiechers)\ **Post date:** [October 21, 2026, 7:09am UTC](https://forum.opensearch.org/t/update-security-configuration-on-kubernetes/28356/3 "2026-10-21T07:09:53Z")
Got it. Thanks for the confirmation.