diff --git a/sysinv/sysinv/sysinv/sysinv/conductor/kube_app.py b/sysinv/sysinv/sysinv/sysinv/conductor/kube_app.py
index 36a4d45f87..751318c2a1 100644
--- a/sysinv/sysinv/sysinv/sysinv/conductor/kube_app.py
+++ b/sysinv/sysinv/sysinv/sysinv/conductor/kube_app.py
@@ -707,7 +707,6 @@ class AppOperator(object):
 
         start = time.time()
         try:
-            local_registry_auth = cutils.get_local_docker_registry_auth()
             with self._lock:
                 self._docker._retrieve_specified_registries()
         except Exception as e:
@@ -719,7 +718,7 @@ class AppOperator(object):
             pool = greenpool.GreenPool(size=threads)
             for tag, success in pool.imap(
                     functools.partial(self._docker.download_an_image,
-                                      app.name, local_registry_auth),
+                                      app.name),
                     images_to_download):
                 if success:
                     continue
@@ -2926,7 +2925,7 @@ class DockerHelper(object):
             # Failed to get a docker client
             LOG.error("Failed to stop Armada service : %s " % e)
 
-    def download_an_image(self, app_name, local_registry_auth, img_tag):
+    def download_an_image(self, app_name, img_tag):
 
         rc = True
 
@@ -2939,6 +2938,7 @@ class DockerHelper(object):
 
                 LOG.info("Image %s download started from local registry" % img_tag)
                 client = docker.APIClient(timeout=INSTALLATION_TIMEOUT)
+                local_registry_auth = cutils.get_local_docker_registry_auth()
                 auth = '{0}:{1}'.format(local_registry_auth['username'],
                                         local_registry_auth['password'])
                 subprocess.check_call(["crictl", "pull", "--creds", auth, img_tag])
@@ -2961,6 +2961,9 @@ class DockerHelper(object):
                 try:
                     # Tag and push the image to the local registry
                     client.tag(target_img_tag, img_tag)
+                    # admin password may be changed by openstack client cmd in parallel.
+                    # So we cannot cache auth info, need refresh it each time.
+                    local_registry_auth = cutils.get_local_docker_registry_auth()
                     client.push(img_tag, auth_config=local_registry_auth)
                 except Exception as e:
                     rc = False
diff --git a/sysinv/sysinv/sysinv/sysinv/conductor/manager.py b/sysinv/sysinv/sysinv/sysinv/conductor/manager.py
index c0b0476383..a14b82c07c 100644
--- a/sysinv/sysinv/sysinv/sysinv/conductor/manager.py
+++ b/sysinv/sysinv/sysinv/sysinv/conductor/manager.py
@@ -5344,13 +5344,11 @@ class ConductorManager(service.PeriodicService):
                          "Upgrade in progress."
                          % image_versions.TILLER_IMAGE_VERSION)
                 download_image = running_image_name + ":" + image_versions.TILLER_IMAGE_VERSION
-                local_registry_auth = cutils.get_local_docker_registry_auth()
                 self._docker._retrieve_specified_registries()
 
                 # download the image
                 try:
                     img_tag, ret = self._docker.download_an_image("helm",
-                                                                  local_registry_auth,
                                                                   download_image)
                     if not ret:
                         raise Exception