{"record":{"id":"5f511c384f3c3a15","repo":"testcontainers/testcontainers-java","slug":"kibana-encryption-key-must-be-at-least-32-characters-long","errorCode":null,"errorMessage":"Kibana encryption key must be at least 32 characters long","messagePattern":"Kibana encryption key must be at least 32 characters long","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"modules/elasticsearch/src/main/java/org/testcontainers/elasticsearch/KibanaContainer.java","lineNumber":129,"sourceCode":"        dockerImageName.assertCompatibleWith(DEFAULT_IMAGE_NAME);\n        this.encryptionKey = stableConfigKey(dockerImageName);\n\n        withExposedPorts(KIBANA_DEFAULT_PORT);\n        //we have to explicitly set wait the strategy later on in configure, once we know the security configuration\n        setWaitStrategy(null);\n    }\n\n    /**\n     * Sets the encryption key used for Kibana's encrypted saved objects.\n     * The key must be at least 32 characters. When not set, a deterministic default derived from\n     * the image name is used, which is required for {@link #withReuse(boolean)} to work correctly.\n     *\n     * @param encryptionKey the encryption key\n     * @return this container instance\n     */\n    public KibanaContainer withEncryptionKey(String encryptionKey) {\n        if (encryptionKey == null || encryptionKey.length() < 32) {\n            throw new IllegalArgumentException(\"Kibana encryption key must be at least 32 characters long\");\n        }\n        this.encryptionKey = encryptionKey;\n        return this;\n    }\n\n    /**\n     * Enables or disables container reuse across JVM runs.\n     *\n     * <p><b>Supported in external mode only.</b> When Kibana is configured via\n     * {@link #withElasticsearchUrl(String)}, the container configuration is fully deterministic\n     * and TC can reliably locate the running container on subsequent runs.\n     *\n     * <p>Reuse is <b>not supported in managed mode</b> (i.e. when this container was created with\n     * an {@link ElasticsearchContainer}). Managed mode introduces several non-deterministic inputs\n     * into the container hash on every run (ad-hoc network ID, random network alias, fresh service\n     * account token), so TC always sees a different hash and starts a fresh container instead of\n     * reusing the existing one. This is a framework-level characteristic that affects any container\n     * connected via {@code withNetwork()} — not specific to {@code KibanaContainer}.","sourceCodeStart":111,"sourceCodeEnd":147,"githubUrl":"https://github.com/testcontainers/testcontainers-java/blob/8e549514e3f01c57d70546fbb8599d138f3903e5/modules/elasticsearch/src/main/java/org/testcontainers/elasticsearch/KibanaContainer.java#L111-L147","documentation":"KibanaContainer.withEncryptionKey(String) validates that the provided Kibana encryption key is non-null and at least 32 characters long, because Kibana requires xpack.encryptedSavedObjects.encryptionKey keys of adequate length. Keys shorter than 32 characters would cause Kibana to fail at startup, so the library rejects them eagerly with IllegalArgumentException.","triggerScenarios":"Calling withEncryptionKey with null or with any string shorter than 32 characters.","commonSituations":"Hardcoding short placeholder keys in tests; truncating a generated key; copying an example key from documentation that is shorter than required.","solutions":["Provide a key of at least 32 characters, e.g. a 64-char hex string.","Generate one with a random generator (e.g. openssl rand -hex 32) and share it across tests that need stable encrypted saved objects.","Omit withEncryptionKey if you don't need encrypted saved objects and the library default suffices."],"exampleFix":"// before\n.withEncryptionKey(\"short-key\")\n// after\n.withEncryptionKey(\"6f4c2a9d8b1e7f3a5c0d9e8b7a6f5e4d3c2b1a0987654321abcdef0123456789\")","handlingStrategy":"validation","validationCode":"if (key == null || key.length() < 32) throw new IllegalArgumentException(\"Kibana encryption key must be at least 32 chars\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Generate keys with openssl rand -hex 32.","Keep the key in a shared test constant/fixture so all tests use a valid one.","Never use short documentation placeholders as keys."],"tags":["elasticsearch","kibana","validation","encryption-key"],"backgroundTag":"invalid-argument-value","analyzedSha":"8e549514e3f01c57d70546fbb8599d138f3903e5","analyzedAt":"2026-09-12T14:56:41.227Z","contentChangedAt":"2026-09-12T14:56:41.227Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}