You need to login to the root account of the SDDC Manager Controller VM to run password management CLI commands.

When the hardware for a rack is imaged, a random password is generated for the root account of the SDDC Manager Controller VM. That generated password is obtained at the end of the imaging process. After the bring-up process was completed on the first rack, you should have changed this password as described in the VMware Cloud Foundation Overview and Bring-Up Guide. You must retain this password.

Password rotation does not change the password of the SDDC Manager Controller VM's root account, and the lookup command does not report this password.