# Cannot create Elasticsearch users with ECK

**URL:** <https://discuss.elastic.co/t/cannot-create-elasticsearch-users-with-eck/236377>\
**Category:** Elastic Cloud on Kubernetes (ECK)\
**Created:** [June 9, 2020, 3:34pm UTC](https://discuss.elastic.co/t/cannot-create-elasticsearch-users-with-eck/236377 "2020-06-09T15:34:34Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![maxdanilov](https://avatars.discourse-cdn.com/v4/letter/m/85e7bf/32.png) [@maxdanilov](https://discuss.elastic.co/u/maxdanilov)\
**Post date:** [June 9, 2020, 3:34pm UTC](https://discuss.elastic.co/t/cannot-create-elasticsearch-users-with-eck/236377/1 "2020-06-09T15:34:34Z")

</div>

I'm following this tutorial: [https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-users-and-roles.html](https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-users-and-roles.html) to set up users in Elasticsearch programmatically.

I have eck 1.1.2 installed in the cluster, Elasticsearch and Kibana 7.7.1

Here are my steps:

- Generated `filerealm` with:

```auto
mkdir filerealm
touch filerealm/users filerealm/users_roles

docker run \
    -v ${PWD}/filerealm:/usr/share/elasticsearch/config \
    docker.elastic.co/elasticsearch/elasticsearch:7.7.1 \
    bin/elasticsearch-users useradd test.user10 -p mypassword -r monitoring_user

docker run \
    -v ${PWD}/filerealm:/usr/share/elasticsearch/config \
    docker.elastic.co/elasticsearch/elasticsearch:7.7.1 \
    bin/elasticsearch-users useradd test.user11 -p mypassword -r monitoring_user

```

- Created a secret with it:  
`kubectl create secret generic my-file-realm-secret --from-file filerealm`

- Manifest to create Elasticsearch:

```auto
apiVersion: elasticsearch.k8s.elastic.co/v1
kind: Elasticsearch
metadata:
  name: es-test
spec:
  auth:
    fileRealm:
    - secretName: my-file-realm-secret
  http:
    tls:
      selfSignedCertificate:
        disabled: true
  nodeSets:
  - config:
      node.data: true
      node.ingest: true
      node.master: true
      node.store.allow_mmap: false
    count: 2
    name: default    
    volumeClaimTemplates:
    - metadata:
        name: elasticsearch-data
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: 5Gi
        storageClassName: standard
  version: 7.7.1

```

- and Kibana:

```auto
apiVersion: kibana.k8s.elastic.co/v1
kind: Kibana
metadata:
  name: es-test
spec:
  count: 2
  elasticsearchRef:
    name: es-test
  http:
    tls:
      selfSignedCertificate:
        disabled: true
  config:
      elasticsearch.requestHeadersWhitelist: [es-security-runas-user, authorization]
      xpack.monitoring.elasticsearch.requestHeadersWhitelist: [es-security-runas-user, authorization, Authorization]
  version: 7.7.1

```

However, when I login into Kibana (with automatically created `elastic` user), I don't see any users listed at `https://<Kibana-URL>/app/kibana#/management/security/users`

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/b/ab2283f4dd3ce6c24e9a49deebf8d2b19036a02b.png)

When I jump into a ES container and check the file realm content, the users (`test.user10` and `test.user11`) are there:

```auto
# cat /mnt/elastic-internal/xpack-file-realm/users
elastic-internal-probe:$2a$10$wUYK52XN4slvIGfL0a8/hOlaUPVXHRnKr0aEZzCuYiOF.k2GPAkQK
elastic-internal:$2a$10$v7tAzMI3jPQEzfyARPbjcecE0MPDg1cc6zhK1i3560Fy0CMIM6D6u
elastic:$2a$10$ZmBcRqF6FeGGN1d0cYCCreQI/nOP75iK4NKedF9tOON1Mdo7mLl22
es-test-es-test-kibana-user:$2a$10$bljDQaLWwXyeXwCWELe.deS1k4O1VX6BuaLZkpryA.6sO3I64YPF6
test.user10:$2a$10$Py6mQp/JqniA0uiuzSeg5ekL4PpVL1jiOgVNtlJHLRTPOSGQLNhOy
test.user11:$2a$10$hIFINTQPGclCEUxncufADOLqTtXzP/5tvTco7rRYYQdcFBayoEh1m

```

There's no error messages coming from the eck operator, ES or Kibana.

Am I missing something?  
Do I need to configure ES to use the file realm somehow?

---

<div class="post-metadata">

**Author:** ![Anya\_Sabo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anya_sabo/32/49903_2.png) [@Anya\_Sabo](https://discuss.elastic.co/u/Anya_Sabo)\
**Post date:** [June 9, 2020, 3:54pm UTC](https://discuss.elastic.co/t/cannot-create-elasticsearch-users-with-eck/236377/2 "2020-06-09T15:54:20Z")

</div>

Can you log in with the users? You cannot view or manage them via Kibana [as described in the docs](https://www.elastic.co/guide/en/elasticsearch/reference/current/file-realm.html). It may be worth linking to them from the ECK documentation though since you are not the first person to raise this question.

---

<div class="post-metadata">

**Author:** ![maxdanilov](https://avatars.discourse-cdn.com/v4/letter/m/85e7bf/32.png) [@maxdanilov](https://discuss.elastic.co/u/maxdanilov)\
**Post date:** [June 9, 2020, 3:59pm UTC](https://discuss.elastic.co/t/cannot-create-elasticsearch-users-with-eck/236377/3 "2020-06-09T15:59:32Z")

</div>

Ah, great point, I haven't noticed that part in the docs about not being able to manage users via Kibana UI.

I was able to log in with Kibana UI for a programmatically created user that has a `kibana_admin` role.

Thank you @Anya_Sabo!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 4, 2022, 8:01am UTC](https://discuss.elastic.co/t/cannot-create-elasticsearch-users-with-eck/236377/4 "2022-11-04T08:01:47Z")

</div>