diff --git a/etc/openstack_deploy/user_secrets.yml b/etc/openstack_deploy/user_secrets.yml
index 434f4c1cfc..7366f5a353 100644
--- a/etc/openstack_deploy/user_secrets.yml
+++ b/etc/openstack_deploy/user_secrets.yml
@@ -29,6 +29,7 @@ memcached_encryption_key:
 ## Galera Options
 galera_root_password:
 galera_mariadb_backups_password:
+galera_monitoring_user_password:
 
 ## Keystone Options
 keystone_container_mysql_password:
diff --git a/releasenotes/notes/galera_monitoring_user_password-ac8b1c1ef7644e73.yaml b/releasenotes/notes/galera_monitoring_user_password-ac8b1c1ef7644e73.yaml
new file mode 100644
index 0000000000..850a3e7ab0
--- /dev/null
+++ b/releasenotes/notes/galera_monitoring_user_password-ac8b1c1ef7644e73.yaml
@@ -0,0 +1,9 @@
+---
+upgrade:
+  - |
+    During upgrade password for ``galera_monitoring_user_password`` will be
+    generated and set while running galera-server role.
+    In case any third-party software relies on this user, it should be updated
+    to use password. You can also override variable to
+    ``galera_monitoring_user_password: ""`` to not use password for auth and
+    preserve previous behaviour.