testcontainers/testcontainers-java · error · IllegalArgumentException

Username 'elastic' is reserved for internal use by…

Error message

Username 'elastic' is reserved for internal use by Elasticsearch

What it means

The 'elastic' superuser is reserved by Elasticsearch for internal use, and using it for Kibana's service account is bad practice and typically fails (elastic's password is the bootstrap password managed by Elasticsearch). withKibanaUsernameAndPassword rejects username 'elastic' with IllegalArgumentException to steer users toward a dedicated service account.

Solutions

  1. Create a dedicated service account (e.g. 'kibana_system' or a custom service token) and use its credentials.
  2. If on managed mode, use withKibanaSystemPassword(...) which configures the kibana_system user's password on the ES container.
  3. Pass a non-reserved username to withKibanaUsernameAndPassword.

Example fix

// before
kibana.withKibanaUsernameAndPassword("elastic", esPassword); // throws
// after
kibana.withKibanaSystemPassword(kibanaPassword); // sets password for kibana_system on the managed ES container
Defensive patterns

Strategy: validation

Validate before calling

if ("elastic".equals(username)) throw new IllegalArgumentException("Use a dedicated kibana service account instead of 'elastic'");

Prevention

When it happens

Trigger: Calling withKibanaUsernameAndPassword("elastic", somePassword) — any casing-sensitive exact match on 'elastic'.

Common situations: Reusing the bootstrap/admin username out of habit; copying connection strings where the username happens to be 'elastic'.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

AI-assisted analysis of testcontainers/testcontainers-java@8e549514e3 (2026-09-12). Data as JSON: /api/errors/33f321b4ba463e28. Report an issue: GitHub.

Appendix: source

Thrown at modules/elasticsearch/src/main/java/org/testcontainers/elasticsearch/KibanaContainer.java:212

     * @return this container instance
     * @throws IllegalStateException if a service account token is already configured
     * @throws IllegalArgumentException if credentials are invalid
     */
    public KibanaContainer withKibanaUsernameAndPassword(String username, String password) {
        if (elasticsearchServiceAccountToken != null) {
            throw new IllegalStateException(
                "Conflicting Elasticsearch credentials: provide either a service account token " +
                "or a username/password pair, not both."
            );
        }
        if (StringUtils.isAnyBlank(username, password)) {
            throw new IllegalArgumentException("Kibana credentials cannot be blank");
        }
        if (!username.equals(username.trim()) || !password.equals(password.trim())) {
            throw new IllegalArgumentException("Kibana credentials cannot have leading or trailing whitespace");
        }
        if ("elastic".equals(username)) {
            throw new IllegalArgumentException("Username 'elastic' is reserved for internal use by Elasticsearch");
        }

        this.elasticsearchUsername = username;
        this.elasticsearchPassword = password;
        return this;
    }

    /**
     * Configures a service account token for Elasticsearch authentication.
     *
     * @param token the service account token
     * @return this container instance
     * @throws IllegalStateException if username/password credentials are already configured
     * @throws IllegalArgumentException if token is blank
     */
    public KibanaContainer withElasticsearchServiceAccountToken(String token) {
        if (elasticsearchUsername != null) {
            throw new IllegalStateException(

View on GitHub (pinned to 8e549514e3)