<p>I am unable to change the password of an existing user from MongoDB deployed on k8s, unless I am deleting the database and then recreating it again with the new password.</p>
<p>How can I change the password using the yaml for the mongo stateful object without deleting the db?</p>
<pre><code>apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: mongo-db-statefulset
  namespace: development
spec:
  serviceName: mongo-svc
  replicas: 1
  selector:
    matchLabels:
      component: mongo
  template:
    metadata:
      labels:
        component: mongo
    spec:
      terminationGracePeriodSeconds: 10
      containers:
        - name: mongo
          image: mongo:4.0.4
          volumeMounts:
            - mountPath: /data/db
              name: volume 
          ports:
            - containerPort: 27017
          env:
            - name: MONGO_INITDB_ROOT_USERNAME
              value: admin
            - name: MONGO_INITDB_ROOT_PASSWORD
             # from secrets
              value: password
            - name: MONGO_INITDB_DATABASE
              value: admin
      volumes:
        - name: volume
          persistentVolumeClaim:
            claimName: database-persistent-volume-claim
</code></pre>

<p>If I understand your issue correctly:</p>
<ul>
<li>You have secret with your password as environment variable, and pod has access to the secret data through a Volume</li>
<li>You changed the secret password, but it's not getting picked up by a pod without a restart.</li>
</ul>
<p>According to <a href="https://kubernetes.io/docs/concepts/configuration/secret/#environment-variables-are-not-updated-after-a-secret-update" rel="nofollow noreferrer">documentation</a>:</p>
<blockquote>
<p>Environment variables are not updated after a secret update, so if If a container already consumes a Secret in an environment variable, a Secret update will not be seen by the container unless it is restarted. There are third party solutions for triggering restarts when secrets change.</p>
</blockquote>
<p>This is a known <a href="https://stackoverflow.com/questions/37317003/restart-pods-when-configmap-updates-in-kubernetes">issue</a>. You can read more about it in this <a href="https://github.com/kubernetes/kubernetes/issues/22368" rel="nofollow noreferrer">github issue</a>.</p>
<hr />
<p>So after you change the secret password you have to restart your pod to update this value, you don't have to delete it.</p>
<hr />
<p>As mentioned in documentation there are third party tools for triggering restart when secrets change, one of them is <a href="https://github.com/stakater/Reloader" rel="nofollow noreferrer">Reloader</a>.</p>
<blockquote>
<p>Reloader can watch changes in ConfigMap and Secret and do rolling upgrades on Pods with their associated DeploymentConfigs, Deployments, Daemonsets and Statefulsets.</p>
</blockquote>
<hr />
<p>The quick way to restart deployment would be to use <a href="https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands#-em-restart-em-" rel="nofollow noreferrer">kubectl rollout restart</a>, which performs a step by step shutdown and restarts each container in your deployment or statefulset.</p>
<p>If you change the password in your secret and use kubectl rollout restart
the new password should work.</p>
