In VCF 9.1, password and credential management is a fleet level task that you drive mainly from VCF Operations. Fleet Management now holds the password dashboard next to certificates and the software depot, and it gives you an at a glance view of account status, coverage and alerts across every VCF Instance. Some credential actions still run from SDDC Manager, so this guide shows which console owns each action, walks the click by click flow for updating, remediating and rotating passwords, and covers password policies and scheduled rotation.

Rotate passwords on a regular cadence, when an administrator leaves your organization, or when a security policy calls for a fresh secret. This part assumes you already run VCF 9.1. If you have not upgraded yet, finish the upgrade to VCF 9.1 first, and read the Part 1 overview of the operating model to see where password management sits in the fleet. For TLS certificates rather than account passwords, use Part 5 on certificate rotation.

Password management model in VCF 9.1

VCF 9.1 offers three password actions, and each one solves a different problem. In these actions, the server is the component where the account lives, and the client is the component that uses the account to connect. Pick the action that matches your situation, then run it from the console that owns it. The table below maps each action to its purpose and console.

A design difference shapes how you work. VCF Operations does not keep a copy of an account password in a local vault, so changing a password where the account resides does not break its ability to push that password to the client. SDDC Manager does keep a copy in an internal vault, which is why an out of band change on a component causes a mismatch that you fix with Remediate. Broadcom recommends VCF Operations as the primary tool, and you reach for SDDC Manager when you need bulk rotation, scheduled rotation, or the credential API.

Prerequisites

Confirm the items below before you change any credential. A component that is unreachable or out of sync is the most common reason a password action fails part way through.

Step 1, Review password status and alerts

Start in VCF Operations and read the current state, so you know which accounts are expiring, out of sync, or already compliant. Console for this step: VCF Operations.

1. Open a browser to https://<vcf_operations_fqdn> and sign in with a user assigned the Administrator role.
2. In the navigation pane, click Fleet Management, then click Passwords.
3. Read the dashboard summary for account status, component coverage and any password alert.
4. Use the Filters control to slice the list by component type, status, or VCF Instance.
5. Note any account marked as expiring or out of sync, so you can plan which action to run.

Step 2, Create a password policy

A password policy defines length, complexity, expiration, account lockout, change interval and history for managed accounts. Create it once in VCF Operations, then reuse it across scopes. Console for this step: VCF Operations.

1. In Fleet Management, click Passwords, then open the Password Policies area.
2. Click Add Policy and give the policy a clear name such as fleet-baseline.
3. Set Password Length and complexity to match your security standard.
4. Set Password Expiration and Account Lockout values for failed sign in attempts.
5. Set the Password History count and the minimum change interval.
6. Click Save to store the policy so it is ready to assign.

Step 3, Assign and apply the password policy

Assign the policy to a scope so VCF Operations can check compliance and remediate settings that drift. Each fleet object can have one active policy, and an instance level policy takes precedence over a fleet level one. Console for this step: VCF Operations.

1. Open the Password Policies area and select the policy you created.
2. Click Assign, then choose a scope of VCF Fleet, VCF Management, or a named VCF Instance.
3. Review the components the assignment covers on the confirmation panel.
4. Click Apply and wait for VCF Operations to report the policy as active.
5. Confirm the compliance column shows the covered components as compliant.

Step 4, Update a password from VCF Operations

Use Update when you want to set a specific value, for example to match a value held in an external vault. VCF Operations changes the password on both the server and the client in one action. Console for this step: VCF Operations.

1. On the Passwords page, filter to the component, then select the account row.
2. Click the three dot menu for that account, then select Update Password.
3. Type the new value in New Password, then retype it in Confirm Password.
4. Click Update to apply the value on the server and the client.
5. Watch the task status and confirm the account returns to a healthy state.

Step 5, Remediate a password after an out of band change

Use Remediate when someone changed an account directly on a component and VCF now flags it as out of sync. This action applies the known value on the client so inter component communication is restored. Console for this step: VCF Operations.

1. On the Passwords page, filter by status to find accounts marked out of sync.
2. Select the affected account row, then click its three dot menu.
3. Select Remediate Password.
4. Enter the current password now set on the server, then click Remediate.
5. Confirm the account status clears once the client is resynced.

Step 6, Rotate passwords from SDDC Manager

Use Rotate when you want VCF to generate a new random password with no user input, and when you need to change many accounts at once. Rotation runs from SDDC Manager. Console for this step: SDDC Manager.

1. Open a browser to https://<sddc_manager_fqdn> and sign in with an account that has the ADMIN role.
2. In the navigation pane, click Security, then click Password Management.
3. Select a component from the resource list, for example vCenter or NSX Manager.
4. Select the accounts to change, then click Rotate.
5. Confirm the rotation and monitor progress in the SDDC Manager Tasks panel.
6. Wait for the task to finish, then return to VCF Operations and confirm the account shows healthy.

Step 7, Schedule automatic password rotation

Scheduled rotation refreshes credentials before they expire, without a manual task each cycle. Configure the rotation interval in SDDC Manager. Console for this step: SDDC Manager.

1. In SDDC Manager, click Security, then click Password Management.
2. Open the Settings tab for password rotation.
3. Set the Rotation Interval in days for the core components you want covered.
4. Enable auto rotation for those components, then click Save.
5. Confirm the schedule appears and note the next rotation date for each component.

Optional, integrate an external credential vault with CyberArk

This is an optional capability, useful only when your organization stores secrets in an enterprise vault. VCF Operations 9.1 adds a CyberArk integration through a marketplace plugin, so VCF retrieves credentials from the vault rather than holding them. Console for this step: VCF Operations.

1. In VCF Operations, open the Marketplace and install the CyberArk plugin.
2. Open the plugin configuration and enter your CyberArk vault endpoint and API credentials.
3. Map the VCF accounts you want managed to their vault entries.
4. Save the integration and run a test retrieval to confirm VCF can read a credential.

Optional, manage credentials with the SDDC Manager API

For scripted rotation across many accounts, use the SDDC Manager credentials API. Request a token, then submit a credentials update with an operation type of ROTATE. Replace the host name, account values and identifiers with your own.

curl -k -X POST https://sddc-manager.example.com/v1/tokens \\
  -H 'Content-Type: application/json' \\
  -d '{"username":"admin@local","password":"YourAdminPassword"}'

curl -k -X PATCH https://sddc-manager.example.com/v1/credentials \\
  -H 'Authorization: Bearer ACCESS_TOKEN' \\
  -H 'Content-Type: application/json' \\
  -d '{"operationType":"ROTATE","elements":[{"resourceName":"vcenter-mgmt.example.com","credentials":[{"credentialType":"SSH","username":"root"}]}]}'

The PATCH call returns a task identifier. Poll /v1/credentials/tasks/{id} until the state reports as successful, then confirm the account in VCF Operations.

Verify the credential change

Confirm each change two ways. First, read the account status in VCF Operations. Second, prove the new secret works against the component itself.

1. In Fleet Management, open Passwords and confirm the account shows a healthy status with no alert.
2. Confirm the last changed date reflects the action you just ran.
3. For an SSH account, sign in to the component with the new password to prove it is live.
4. For a policy assignment, confirm the covered components report as compliant.

A quick way to prove an SSH account works is a single connection test from a workstation. Replace the user and host with your own values.

ssh root@vcenter-mgmt.example.com 'echo credential check ok'

Common errors and fixes

For context on where fleet credential management fits inside the wider platform, the VCF 9.1 deployment guide covers the initial appliance setup that produced these accounts.

Common questions

Can I rotate passwords from VCF Operations
Not yet. VCF Operations does Update and Remediate and creates password policies, while auto generated Rotate and scheduled rotation run from SDDC Manager. Use each console for the action it owns.

What is the difference between Update and Rotate
Update sets a value you type, which is handy when syncing with an external vault. Rotate sets a random value that VCF generates, with no user input, and can cover many accounts at once.

Why does an account show out of sync
Someone changed the password directly on the component, so SDDC Manager holds a stale copy. Run Remediate and provide the current value to bring the client back in line.

How often should I rotate credentials
Match your organization security standard. A common practice is a scheduled interval such as 90 days for core accounts, plus an immediate change whenever an administrator leaves.

References

• Managing Passwords for VMware Cloud Foundation Components, Broadcom TechDocs
• Update Passwords for VMware Cloud Foundation Components, Broadcom TechDocs
• Using SDDC Manager to Manage Passwords, Broadcom TechDocs
• Managing Password Rotation in VMware Cloud Foundation 9.x, Broadcom KB

About The Author

Dr. Pranay Jha

Dr. Pranay Jha is a Cloud and AI Consultant with 18+ years of experience in hybrid cloud, virtualization, and enterprise infrastructure transformation. He specializes in VMware technologies, multi-cloud strategy, and Generative AI solutions. He holds a PhD in Computer Applications with research focused on Cloud and AI, has published multiple research papers, and has been a VMware vExpert since 2016 and a VMUG Community Leader.

See author's posts