diff --git a/pkg/asset/cluster/cluster.go b/pkg/asset/cluster/cluster.go
index e6f59043535..47458a3aa6e 100644
--- a/pkg/asset/cluster/cluster.go
+++ b/pkg/asset/cluster/cluster.go
@@ -15,11 +15,6 @@ import (
 	"github.com/openshift/installer/pkg/terraform"
 )
 
-var (
-	// kubeadminPasswordPath is the path where kubeadmin user password is stored.
-	kubeadminPasswordPath = filepath.Join("auth", "kubeadmin-password")
-)
-
 // Cluster uses the terraform executable to launch a cluster
 // with the given terraform tfvar and generated templates.
 type Cluster struct {
@@ -53,8 +48,7 @@ func (c *Cluster) Generate(parents asset.Parents) (err error) {
 	clusterID := &installconfig.ClusterID{}
 	installConfig := &installconfig.InstallConfig{}
 	terraformVariables := &TerraformVariables{}
-	kubeadminPassword := &password.KubeadminPassword{}
-	parents.Get(clusterID, installConfig, terraformVariables, kubeadminPassword)
+	parents.Get(clusterID, installConfig, terraformVariables)
 
 	if installConfig.Config.Platform.None != nil {
 		return errors.New("cluster cannot be created with platform set to 'none'")
@@ -75,13 +69,6 @@ func (c *Cluster) Generate(parents asset.Parents) (err error) {
 		extraArgs = append(extraArgs, fmt.Sprintf("-var-file=%s", filepath.Join(tmpDir, file.Filename)))
 	}
 
-	c.FileList = []*asset.File{
-		{
-			Filename: kubeadminPasswordPath,
-			Data:     []byte(kubeadminPassword.Password),
-		},
-	}
-
 	logrus.Infof("Creating infrastructure resources...")
 	stateFile, err := terraform.Apply(tmpDir, installConfig.Config.Platform.Name(), extraArgs...)
 	if err != nil {
diff --git a/pkg/asset/password/password.go b/pkg/asset/password/password.go
index bba669e1a3e..e3f468404e4 100644
--- a/pkg/asset/password/password.go
+++ b/pkg/asset/password/password.go
@@ -3,18 +3,25 @@ package password
 import (
 	"crypto/rand"
 	"math/big"
+	"path/filepath"
 
 	"github.com/openshift/installer/pkg/asset"
 	"golang.org/x/crypto/bcrypt"
 )
 
+var (
+	// kubeadminPasswordPath is the path where kubeadmin user password is stored.
+	kubeadminPasswordPath = filepath.Join("auth", "kubeadmin-password")
+)
+
 // KubeadminPassword is the asset for the kubeadmin user password
 type KubeadminPassword struct {
 	Password     string
 	PasswordHash []byte
+	File         *asset.File
 }
 
-var _ asset.Asset = (*KubeadminPassword)(nil)
+var _ asset.WritableAsset = (*KubeadminPassword)(nil)
 
 // Dependencies returns no dependencies.
 func (a *KubeadminPassword) Dependencies() []asset.Asset {
@@ -70,6 +77,12 @@ func (a *KubeadminPassword) generateRandomPasswordHash(length int) error {
 		return err
 	}
 	a.PasswordHash = bytes
+
+	a.File = &asset.File{
+		Filename: kubeadminPasswordPath,
+		Data:     []byte(a.Password),
+	}
+
 	return nil
 }
 
@@ -77,3 +90,13 @@ func (a *KubeadminPassword) generateRandomPasswordHash(length int) error {
 func (a *KubeadminPassword) Name() string {
 	return "Kubeadmin Password"
 }
+
+// Files returns the password file.
+func (a *KubeadminPassword) Files() []*asset.File {
+	return []*asset.File{a.File}
+}
+
+// Load returns false as the password file is read-only.
+func (a *KubeadminPassword) Load(f asset.FileFetcher) (found bool, err error) {
+	return false, nil
+}
diff --git a/pkg/asset/targets/targets.go b/pkg/asset/targets/targets.go
index a91db2e95b4..938047ba220 100644
--- a/pkg/asset/targets/targets.go
+++ b/pkg/asset/targets/targets.go
@@ -9,6 +9,7 @@ import (
 	"github.com/openshift/installer/pkg/asset/kubeconfig"
 	"github.com/openshift/installer/pkg/asset/machines"
 	"github.com/openshift/installer/pkg/asset/manifests"
+	"github.com/openshift/installer/pkg/asset/password"
 	"github.com/openshift/installer/pkg/asset/templates/content/bootkube"
 	"github.com/openshift/installer/pkg/asset/templates/content/openshift"
 	"github.com/openshift/installer/pkg/asset/tls"
@@ -62,6 +63,7 @@ var (
 	Cluster = []asset.WritableAsset{
 		&cluster.TerraformVariables{},
 		&kubeconfig.AdminClient{},
+		&password.KubeadminPassword{},
 		&tls.JournalCertKey{},
 		&cluster.Metadata{},
 		&cluster.Cluster{},