diff --git a/docs/metallb.md b/docs/metallb.md
index 984cd9bfabd539752219e2343211c0c9f729100e..71fabde47c0acc95d367508af9dffcd773e1d889 100644
--- a/docs/metallb.md
+++ b/docs/metallb.md
@@ -54,6 +54,19 @@ metallb_peers:
     my_asn: 4200000000
 ```
 
+Some upstream BGP peers may require password authentication:
+
+```yaml
+metallb_protocol: bgp
+metallb_ip_range:
+  - 10.5.0.0/16
+metallb_peers:
+  - peer_address: 192.0.2.1
+    peer_asn: 64512
+    my_asn: 4200000000
+    password: "changeme"
+```
+
 When using calico >= 3.18 you can replace MetalLB speaker by calico Service LoadBalancer IP advertisement.
 See [calico service IPs advertisement documentation](https://docs.projectcalico.org/archive/v3.18/networking/advertise-service-ips#advertise-service-load-balancer-ip-addresses).
 In this scenarion you should disable the MetalLB speaker and configure the `calico_advertise_service_loadbalancer_ips` to match your `metallb_ip_range`
diff --git a/roles/kubernetes-apps/metallb/templates/metallb-config.yml.j2 b/roles/kubernetes-apps/metallb/templates/metallb-config.yml.j2
index abfcb92b877c21e04f6271d863d23d26b8292763..9bd7538716d27c696f0dc9ecf561e4fdd199caaf 100644
--- a/roles/kubernetes-apps/metallb/templates/metallb-config.yml.j2
+++ b/roles/kubernetes-apps/metallb/templates/metallb-config.yml.j2
@@ -12,6 +12,9 @@ data:
     - peer-address: {{ peer.peer_address }}
       peer-asn: {{ peer.peer_asn }}
       my-asn: {{ peer.my_asn }}
+{% if peer.password is defined %}
+      password: "{{ peer.password }}"
+{% endif %}
 {% if peer.source_address is defined %}
       source-address: {{ peer.source_address }}
 {% endif %}