Cannot login to web console, but can you use user for the broker

[lambou123]

Describe the bug

I have this broker config

apiVersion: broker.amq.io/v1beta1
kind: ActiveMQArtemis
metadata:
  name: artemis-broker
  namespace: activemq-artemis-operator
spec:
  deploymentPlan:
    size: 3
    requireLogin: true
    persistenceEnabled: true
    messageMigration: false
    podSecurityContext:
      fsGroup: 0
  acceptors:
    - name: artemis
      bindToAllInterfaces: true
      protocols: all
      port: 61616
      sslEnabled: false
    - name: amqp
      bindToAllInterfaces: true
      protocols: amqp
      port: 5672
      sslEnabled: false
    - name: stomp
      bindToAllInterfaces: true
      protocols: stomp
      port: 61613
      sslEnabled: false
    - name: hornetq
      bindToAllInterfaces: true
      protocols: hornetq,stomp
      port: 5445
      sslEnabled: false
    - name: mqtt
      bindToAllInterfaces: true
      protocols: amqp
      port: 1883
      sslEnabled: false

and this secret:

apiVersion: v1
metadata:
  name: artemis-broker-credentials-secret
  namespace: activemq-artemis-operator
kind: Secret
type: Opaque
stringData:
  AMQ_USER: admin
  AMQ_PASSWORD: adminPassword
  AMQ_CLUSTER_USER: cluster
  AMQ_CLUSTER_PASSWORD: clusterPassword

I can access the broker via cli with my credentials:
kubectl exec artemis-broker-ss-1 -n activemq-artemis-operator -- amq-broker/bin/artemis producer --user admin --password adminPassword --url tcp://artemis-broker-ss-1:61616 --message-count=100

But i cannot access the web console with the credentials of AMQ_USER or AMQ_CLUSTER_USER via localhost:8161.

• How can i configure the credentials for the webconsole to login?

Tip

Vote this issue reacting with 👍 or 👎

[brusdev]

The secret artemis-broker-credentials-secret must have the same namespace of the artemis-broker ActiveMQArtemis CR.

[lambou123]

Hi, thanks for your answer. It's running in the same namespace. just took the config from the docs and forgot to update the namespace.

I could login via the users artemis and cluster. We have the problem at the moment that sometimes logins is successful, but sometimes we are forwarded back to the login screen. It looks like there's a cookie problem.

Do you have any idea what can be the cause for forwarding back to the login screen?
What is the difference between AMQ_USER and AMQ_CLUSTER_USER?

In the web console of my firefox I found these errors:

The resource from “http://artemis-instance:8161/console/login” was blocked due to MIME type (“text/html”) mismatch (X-Content-Type-Options: nosniff).
Uncaught (in promise) Error: User needs to have logged in to use Jolokia service
initJolokiaUrl http://artmis-instance:8161/console/static/js/4240.290c305b.chunk.js:2
o http://artemis-instance:8161/console/static/js/4240.290c305b.chunk.js:2
[hawtio-auth] Failed to fetch user: 403 Forbidden

I also have this secret configured. Do i need this secret as well? :

apiVersion: v1
data:
  jokolikaPassword: my-test-password
  jokolikaUser: my-test-user
kind: Secret
metadata:
  name: broker-jolokia-secret
  namespace: activemq-artemis-operator
type: Opaque

Can this be also the problem that it's not configured as ssl endpoint?

[brusdev]

You can't login to muliple broker web consoles from the same browser at the same time when the web console url share the same hostname because the cookie session id is tied to the hostname.

[lambou123]

Now I understand the behavior.

My problem is now that I don't know how to set the console to 0.0.0.0, because I want to access the console without ingress and
setting console to 0.0.0.0 gives me the error that the console is already bound to the headless service.
java.io.IOException: Failed to bind to artems-broker-ss-2.artemis-broker-hdls-svc.msg.svc.cluster.local/9.9.10.9:8161

So I also cannot define a manual service1 with port 8161 to broker1 to access the console of broker1.

apiVersion: broker.amq.io/v1beta1
kind: ActiveMQArtemis
metadata:
  name: artemis-broker
  namespace: activemq-artemis-operator
spec:
  deploymentPlan:
    size: 3
    requireLogin: true
    persistenceEnabled: true
    messageMigration: false
    podSecurityContext:
      fsGroup: 0
  acceptors:
    - name: artemis
      bindToAllInterfaces: true
      protocols: all
      port: 61616
      sslEnabled: false
    - name: amqp
      bindToAllInterfaces: true
      protocols: amqp
      port: 5672
      sslEnabled: false
    - name: stomp
      bindToAllInterfaces: true
      protocols: stomp
      port: 61613
      sslEnabled: false
    - name: hornetq
      bindToAllInterfaces: true
      protocols: hornetq,stomp
      port: 5445
      sslEnabled: false
    - name: mqtt
      bindToAllInterfaces: true
      protocols: amqp
      port: 1883
      sslEnabled: false
  env:
  - name: JAVA_ARGS_APPEND
    value: -Dwebconfig.bindings.artemis.uri=http://0.0.0.0:8161

[brusdev]

My problem is now that I don't know how to set the console to 0.0.0.0, because I want to access the console without ingress

How do you want access the console?

setting console to 0.0.0.0 gives me the error that the console is already bound to the headless service.
java.io.IOException: Failed to bind to artems-broker-ss-2.artemis-broker-hdls-svc.msg.svc.cluster.local/9.9.10.9:8161

Your ActiveMQ Artemis CR works with ActiveMQ Artemis 2.40.0 I don't see java.io.IOException: Failed to bind ... in the broker pods.

So I also cannot define a manual service1 with port 8161 to broker1 to access the console of broker1.

Why can't you define a manual service1?

[lambou123]

Hey,
this setting is working for me

apiVersion: broker.amq.io/v1beta1
kind: ActiveMQArtemis
metadata:
  name: artemis-broker
  namespace: activemq-artemis-operator
spec:
  acceptors:
  - bindToAllInterfaces: true
    name: artemis
    port: 61616
    protocols: all
    sslEnabled: false
  - bindToAllInterfaces: true
    name: amqp
    port: 5672
    protocols: amqp
    sslEnabled: false
  - bindToAllInterfaces: true
    name: stomp
    port: 61613
    protocols: stomp
    sslEnabled: false
  - bindToAllInterfaces: true
    name: hornetq
    port: 5445
    protocols: hornetq,stomp
    sslEnabled: false
  - bindToAllInterfaces: true
    name: mqtt
    port: 1883
    protocols: amqp
    sslEnabled: false
  addressSettings:
    addressSetting:
    - autoCreateJmsQueues: true
      autoCreateQueues: true
  console:
    expose: true
    exposeMode: ingress
    ingressHost: $(CR_NAME)-$(ITEM_NAME)-$(BROKER_ORDINAL).$(INGRESS_DOMAIN)
    sslEnabled: true
    sslSecret: my-secret
  deploymentPlan:
    messageMigration: false
    persistenceEnabled: true
    podSecurityContext:
      fsGroup: 0
    requireLogin: false
    size: 3
    storage:
      size: 10Gi
  ingressDomain: my-domain.com
  resourceTemplates:
  - patch:
      kind: StatefulSet
      spec:
        template:
          spec:
            containers:
            - command:
              - /bin/bash
              - -c
              - export STATEFUL_SET_ORDINAL=${HOSTNAME##*-}; export JDK_JAVA_OPTIONS=${JDK_JAVA_OPTIONS//\$\{STATEFUL_SET_ORDINAL\}/${HOSTNAME##*-}};
                export FQ_HOST_NAME="0.0.0.0"; export JAVA_ARGS_APPEND=$( echo ${JAVA_ARGS_APPEND}
                | sed "s/FQ_HOST_NAME/${FQ_HOST_NAME}/"); exec /opt/amq/bin/launch.sh
              - start
              name: broker-container
              securityContext:
                runAsNonRoot: true
    selector:
      kind: StatefulSet
status:
  conditions:
  - lastTransitionTime: "2025-05-09T14:48:09Z"
    message: ""
    observedGeneration: 20
    reason: ValidationSucceded
    status: "True"
    type: Valid
  - lastTransitionTime: "2025-05-06T08:36:47Z"
    message: unexpected end of JSON input
    reason: UnableToRetrieveStatus
    status: Unknown
    type: BrokerPropertiesApplied
  - lastTransitionTime: "2025-05-21T07:23:26Z"
    message: ""
    reason: AllPodsReady
    status: "True"
    type: Deployed
  - lastTransitionTime: "2025-05-21T07:23:26Z"
    message: ""
    reason: ResourceReady
    status: "True"
    type: Ready
  - lastTransitionTime: "2025-05-06T08:38:08Z"
    message: unexpected end of JSON input
    reason: UnableToRetrieveStatus
    status: Unknown
    type: BrokerVersionAligned
  deploymentPlanSize: 3
  podStatus:
    ready:
    - artemis-broker-ss-0
    - artemis-broker-ss-1
    - artemis-broker-ss-2
  scaleLabelSelector: ActiveMQArtemis=artemis-broker,application=broker-app
  upgrade:
    majorUpdates: true
    minorUpdates: true
    patchUpdates: true
    securityUpdates: true
  version:
    brokerVersion: 2.40.0
    image: quay.io/arkmq-org/activemq-artemis-broker-kubernetes@sha256:a4a0d0453f0761b9e114d0d4cc7c14091a2a9c30790f18ffa6bf1e365d5083fe
    initImage: quay.io/arkmq-org/activemq-artemis-broker-init@sha256:f2c853ff91809282c04d5b1381ceae366518bf07b16649a61aa6c60c47f10714

Now I can use port forwarding to the service to access the console via https://localhost:8161/console
I needed to

set export FQ_HOST_NAME="0.0.0.0"

because before that port forwarding was not working. If I go now into the pod and execute curl -ik https://localhost:8161/console i got status code 302, but this works for me only if I expose the console. The ingress is not working, throws 500 and the secretname is missing.
It might helpful for you. I don't need the ingress, but without expose=true, the console is not working for me.

apiVersion: v1
kind: Service
metadata:
  name: artemis-broker-wconsj-2-svc
  namespace: activemq-artemis-operator
spec:
  ports:
  - name: wconsj
    port: 8161
    protocol: TCP
    targetPort: 8161
  - name: wconsj-2
    port: 8162
    protocol: TCP
    targetPort: 8161
  selector:
    ActiveMQArtemis: artemis-broker
    application: broker-app
    statefulset.kubernetes.io/pod-name: artemis-broker-ss-2
  type: ClusterIP
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: artemis-broker-wconsj-2-svc-ing
  namespace: activemq-artemis-operator
spec:
  ingressClassName: nginx
  rules:
  - host: artemis-broker-wconsj-2.my-domain.com
    http:
      paths:
      - backend:
          service:
            name: artemis-broker-wconsj-2-svc
            port:
              name: wconsj-2
        path: /
        pathType: Prefix
  tls:
  - hosts:
    - artemis-broker-wconsj-2.my-domain.com

In the logs i got this message. Is there an error in my config or can i ignore this, because my ActiveMQArtemis is in ready state?

2025-05-21T08:05:50.043247428Z     /opt/app-root/src/go/pkg/mod/github.com/go-logr/[email protected]/logr.go:299
2025-05-21T08:05:50.043251558Z github.com/arkmq-org/activemq-artemis-operator/controllers.(*ActiveMQArtemisReconcilerImpl).checkStatus
2025-05-21T08:05:50.043253724Z     /opt/app-root/src/controllers/activemqartemis_reconciler.go:3387
2025-05-21T08:05:50.043256154Z github.com/arkmq-org/activemq-artemis-operator/controllers.(*ActiveMQArtemisReconcilerImpl).AssertBrokerImageVersion
2025-05-21T08:05:50.043258536Z     /opt/app-root/src/controllers/activemqartemis_reconciler.go:3336
2025-05-21T08:05:50.043260676Z github.com/arkmq-org/activemq-artemis-operator/controllers.(*ActiveMQArtemisReconcilerImpl).ProcessBrokerStatus
2025-05-21T08:05:50.043262874Z     /opt/app-root/src/controllers/activemqartemis_reconciler.go:3153
2025-05-21T08:05:50.043265032Z github.com/arkmq-org/activemq-artemis-operator/controllers.(*ActiveMQArtemisReconciler).Reconcile
2025-05-21T08:05:50.043267598Z     /opt/app-root/src/controllers/activemqartemis_controller.go:184
2025-05-21T08:05:50.043269792Z sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile
2025-05-21T08:05:50.043271848Z     /opt/app-root/src/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:119
2025-05-21T08:05:50.043274291Z sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler
2025-05-21T08:05:50.043276335Z     /opt/app-root/src/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:316
2025-05-21T08:05:50.043278477Z sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
2025-05-21T08:05:50.043280619Z     /opt/app-root/src/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:266
2025-05-21T08:05:50.043282623Z sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
2025-05-21T08:05:50.043284727Z     /opt/app-root/src/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:227
2025-05-21T08:05:50.043375893Z 2025-05-21T08:05:50.043Z    ERROR    unable to unmarshall broker status    {"ActiveMQArtemis Name": "artemis-broker", "json": "", "error": "unexpected end of JSON input"}

[brusdev]

The Ingress artemis-broker-wconsj-2-svc-ing created by the operator doesn't include the secretname because it uses SSL Passthrough. I guess your Ingress is not working and throws 500 because you the SSL Passthrough feature is not enabled in your Kubernetes cluster, , for further details see https://kubernetes.github.io/ingress-nginx/user-guide/tls/#ssl-passthrough

You can also set an environment variable by using the spec.env field, for further details see https://github.com/arkmq-org/activemq-artemis-operator/blob/main/docs/help/operator.md#setting--environment-variables, i.e.

apiVersion: broker.amq.io/v1beta1
kind: ActiveMQArtemis
metadata:
  name: artemis-broker
spec:
  env:
    - name: 'FQ_HOST_NAME'
      value: '0.0.0.0'

Why do you need to set the env FQ_HOST_NAME?

[lambou123]

Thanks for your message. With these settings. it's working -:)

  env:
   - name: 'FQ_HOST_NAME'
     value: '0.0.0.0'
   - name: JAVA_ARGS_APPEND
     value: -Dwebconfig.bindings.artemis.uri=http://0.0.0.0:8161