Setting a password for the default user causes queries on replicated tables to fail

I recently installed the ClickHouse server chart (v0.3.9 – app version 25.3.6.10034) with Keeper and clickhouse-operator.

My setup creates a cluster for our Sentry replicated data with one shard and three replicas. However, when I set a password for the default user, I can no longer execute queries successfully.

On one replica, I connect to the database using:

clickhouse-client --host 127.0.0.1 --user default --password <password>

Then I run a query such as:

SELECT group, migration_id, status FROM migrations_dist FINAL WHERE group IN ('system', 'events', 'transactions', 'discover', 'outcomes', 'metrics', 'sessions', 'querylog', 'profiles', 'functions', 'replays', 'generic_metrics', 'test_migration', 'search_issues', 'spans', 'events_analytics_platform', 'group_attributes', 'profile_chunks', 'cdc');

A wrong password error for the default user is thrown:

Received exception from server (version 25.3.6):
Code: 516. DB::Exception: Received from clickhouse-clickhouse-server:9000. 
DB::Exception: Received from localhost:9000. 
DB::Exception: default: Authentication failed: password is incorrect, or there is no user with such name.

However, when I remove the password, I can execute the query without any problem. I assume that the installation does not create a password configuration file for the default user (for example, at /etc/clickhouse-server/users.d/default-password.xml), which causes the query to fail.

The same behavior occurs when I access the database using a different user:

clickhouse-client --host 127.0.0.1 --user sentry --password <password>

In this case, a wrong password error for the default user is still thrown.

Start with the Helm chart configuration for the default and sentry users, Keeper, and the clickhouse-operator setup described in the issue; inspect how authentication settings reach the server, including the mentioned users.d/default-password.xml path. Reproduce the commands against a three-replica cluster and run the replicated-table query. Done means authenticated queries no longer produce a default-user password error.