{"record":{"id":"33f321b4ba463e28","repo":"testcontainers/testcontainers-java","slug":"username-elastic-is-reserved-for-internal-use-by","errorCode":null,"errorMessage":"Username 'elastic' is reserved for internal use by Elasticsearch","messagePattern":"Username 'elastic' is reserved for internal use by Elasticsearch","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"modules/elasticsearch/src/main/java/org/testcontainers/elasticsearch/KibanaContainer.java","lineNumber":212,"sourceCode":"     * @return this container instance\n     * @throws IllegalStateException if a service account token is already configured\n     * @throws IllegalArgumentException if credentials are invalid\n     */\n    public KibanaContainer withKibanaUsernameAndPassword(String username, String password) {\n        if (elasticsearchServiceAccountToken != null) {\n            throw new IllegalStateException(\n                \"Conflicting Elasticsearch credentials: provide either a service account token \" +\n                \"or a username/password pair, not both.\"\n            );\n        }\n        if (StringUtils.isAnyBlank(username, password)) {\n            throw new IllegalArgumentException(\"Kibana credentials cannot be blank\");\n        }\n        if (!username.equals(username.trim()) || !password.equals(password.trim())) {\n            throw new IllegalArgumentException(\"Kibana credentials cannot have leading or trailing whitespace\");\n        }\n        if (\"elastic\".equals(username)) {\n            throw new IllegalArgumentException(\"Username 'elastic' is reserved for internal use by Elasticsearch\");\n        }\n\n        this.elasticsearchUsername = username;\n        this.elasticsearchPassword = password;\n        return this;\n    }\n\n    /**\n     * Configures a service account token for Elasticsearch authentication.\n     *\n     * @param token the service account token\n     * @return this container instance\n     * @throws IllegalStateException if username/password credentials are already configured\n     * @throws IllegalArgumentException if token is blank\n     */\n    public KibanaContainer withElasticsearchServiceAccountToken(String token) {\n        if (elasticsearchUsername != null) {\n            throw new IllegalStateException(","sourceCodeStart":194,"sourceCodeEnd":230,"githubUrl":"https://github.com/testcontainers/testcontainers-java/blob/8e549514e3f01c57d70546fbb8599d138f3903e5/modules/elasticsearch/src/main/java/org/testcontainers/elasticsearch/KibanaContainer.java#L194-L230","documentation":"The 'elastic' superuser is reserved by Elasticsearch for internal use, and using it for Kibana's service account is bad practice and typically fails (elastic's password is the bootstrap password managed by Elasticsearch). withKibanaUsernameAndPassword rejects username 'elastic' with IllegalArgumentException to steer users toward a dedicated service account.","triggerScenarios":"Calling withKibanaUsernameAndPassword(\"elastic\", somePassword) — any casing-sensitive exact match on 'elastic'.","commonSituations":"Reusing the bootstrap/admin username out of habit; copying connection strings where the username happens to be 'elastic'.","solutions":["Create a dedicated service account (e.g. 'kibana_system' or a custom service token) and use its credentials.","If on managed mode, use withKibanaSystemPassword(...) which configures the kibana_system user's password on the ES container.","Pass a non-reserved username to withKibanaUsernameAndPassword."],"exampleFix":"// before\nkibana.withKibanaUsernameAndPassword(\"elastic\", esPassword); // throws\n// after\nkibana.withKibanaSystemPassword(kibanaPassword); // sets password for kibana_system on the managed ES container","handlingStrategy":"validation","validationCode":"if (\"elastic\".equals(username)) throw new IllegalArgumentException(\"Use a dedicated kibana service account instead of 'elastic'\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never reuse the 'elastic' superuser for Kibana.","Prefer withKibanaSystemPassword(...) in managed mode.","Provision a dedicated service account or service token for Kibana.","Code-review credential constants in test base classes."],"tags":["kibana","elasticsearch","validation","reserved-username","credentials"],"backgroundTag":"invalid-argument-value","analyzedSha":"8e549514e3f01c57d70546fbb8599d138f3903e5","analyzedAt":"2026-09-12T14:56:41.227Z","contentChangedAt":"2026-09-12T14:56:41.227Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}