Upgrade from 0.9.0 to 0.10.0 causing 401 when accessing

[sebastiangaiser]

Describe the bug
I upgraded from 0.9.0 to 0.10.0. Since then, I only get a 502 by our ingress controller (nginx). When having a look to the logs I get a 401 by the api container:

console-ui   ▲ Next.js 14.2.33                                                                                                                                                                                                                                                                                       
console-ui   - Local:        http://localhost:3000                                                                                                                                                                                                                                                                   
console-api INFO exec -a "java" java -Dquarkus.http.host=0.0.0.0 -Djava.util.logging.manager=org.jboss.logmanager.LogManager -cp "." -jar /deployments/quarkus-run.jar                                                                                                                                               
console-ui   - Network:      http://0.0.0.0:3000                                                                                                                                                                                                                                                                     
console-api INFO running in /deployments                                                                                                                                                                                                                                                                             
console-ui                                                                                                                                                                                                                                                                                                           
console-ui  ✓ Starting...                                                                                                                                                                                                                                                                                            
console-ui  ✓ Ready in 77ms                                                                                                                                                                                                                                                                                          
console-api __  ____  __  _____   ___  __ ____  ______                                                                                                                                                                                                                                                               
console-api  --/ __ \/ / / / _ | / _ \/ //_/ / / / __/                                                                                                                                                                                                                                                               
console-api  -/ /_/ / /_/ / __ |/ , _/ ,< / /_/ /\ \                                                                                                                                                                                                                                                                 
console-api --\___\_\____/_/ |_/_/|_/_/|_|\____/___/                                                                                                                                                                                                                                                                 
console-api 2025-10-30 14:16:26,582 INFO  [com.git.str.con.api.sup.fac.ConsoleConfigFactory] (main) Loading console configuration from file:/deployments/console-config.yaml                                                                                                                                         
console-api 2025-10-30 14:16:26,748 WARN  [io.fab.kub.cli.dsl.int.VersionUsageUtils] (main) The client is using resource type 'kafkas' with unstable version 'v1beta2'                                                                                                                                               
console-api 2025-10-30 14:16:27,121 WARN  [io.fab.kub.cli.dsl.int.VersionUsageUtils] (main) The client is using resource type 'kafkanodepools' with unstable version 'v1beta2'                                                                                                                                       
console-api 2025-10-30 14:16:27,143 WARN  [io.fab.kub.cli.dsl.int.VersionUsageUtils] (main) The client is using resource type 'kafkatopics' with unstable version 'v1beta2'                                                                                                                                          
console-api 2025-10-30 14:16:27,192 INFO  [com.git.str.con.LoggingConfigWatcher] (main) No log config files set to monitor                                                                                                                                                                                           
console-api 2025-10-30 14:16:27,223 INFO  [io.quarkus] (main) console-api 0.10.0 on JVM (powered by Quarkus 3.20.3) started in 2.459s. Listening on: http://0.0.0.0:8080                                                                                                                                             
console-api 2025-10-30 14:16:27,223 INFO  [io.quarkus] (main) Profile build activated.                                                                                                                                                                                                                               
console-api 2025-10-30 14:16:27,223 INFO  [io.quarkus] (main) Installed features: [cache, cdi, hibernate-validator, kubernetes-client, micrometer, oidc, oidc-client, rest, rest-client, rest-client-jackson, rest-jackson, security, smallrye-context-propagation, smallrye-health, smallrye-openapi, swagger-ui, ve
console-ui {"level":30,"time":1761833792413,"env":"production","module":"utils","msg":"console configuration loaded from /deployments/console-config.yaml"}                                                                                                                                                          
console-ui {"level":50,"time":1761833792541,"env":"production","module":"next-auth","0":{"error":{"name":"OAuthCallbackError","message":""},"providerId":"oidc"},"msg":"OAUTH_CALLBACK_ERROR"}                                                                                                                       
console-api 2025-10-30 14:16:33,432 WARN  [com.git.str.con.api.sup.TrustStoreSupport] (vert.x-eventloop-thread-1) No truststore found for bucket 'oidc-provider:auth-server'                                                                                                                                         
console-api 2025-10-30 14:16:33,561 INFO  [io.qua.htt.access-log] (vert.x-eventloop-thread-1) - 127.0.0.1 - "GET /api/kafkas?fields%5Bkafkas%5D=name%2Cnamespace%2CkafkaVersion&page%5Bsize%5D=20&sort=name HTTP/1.1" 401 143ms 172                                                                                  
console-ui {"level":30,"time":1761833793563,"env":"production","module":"api","errors":[{"title":"Not Authenticated","detail":"Authentication credentials missing or invalid","id":"783375d4-b61f-4c57-86ea-334e244a19cd","status":"401","code":"4011"}],"msg":"fetch http://127.0.0.1:8080/api/kafkas?fields%5Bkafka
console-ui ReferenceError: window is not defined                                                                                                                                                                                                                                                                     
console-ui     at /app/.next/server/chunks/4119.js:1:16532                                                                                                                                                                                                                                                           
console-ui     at d (/app/.next/server/chunks/4119.js:1:56446)                                                                                                                                                                                                                                                       
console-ui     at Generator.<anonymous> (/app/.next/server/chunks/4119.js:1:56237)                                                                                                                                                                                                                                   
console-ui     at Generator.next (/app/.next/server/chunks/4119.js:1:56805)                                                                                                                                                                                                                                          
console-ui     at t (/app/.next/server/chunks/4119.js:1:51078)                                                                                                                                                                                                                                                       
console-ui     at u (/app/.next/server/chunks/4119.js:1:51288)                                                                                                                                                                                                                                                       
console-ui     at /app/.next/server/chunks/4119.js:1:51347                                                                                                                                                                                                                                                           
console-ui     at new Promise (<anonymous>)                                                                                                                                                                                                                                                                          
console-ui     at /app/.next/server/chunks/4119.js:1:51229                                                                                                                                                                                                                                                           
console-ui     at I (/app/.next/server/chunks/4119.js:1:17302)                                                                                                                                                                                                                                                       
console-ui {"level":50,"time":1761833796134,"env":"production","module":"next-auth","0":{"error":{"name":"OAuthCallbackError","message":""},"providerId":"oidc"},"msg":"OAUTH_CALLBACK_ERROR"}                                                                                                                       
console-api 2025-10-30 14:16:36,614 INFO  [io.qua.htt.access-log] (vert.x-eventloop-thread-1) - 127.0.0.1 - "GET /api/kafkas?fields%5Bkafkas%5D=name%2Cnamespace%2CkafkaVersion&page%5Bsize%5D=20&sort=name HTTP/1.1" 401 1ms 172                                                                                    
console-ui {"level":30,"time":1761833796618,"env":"production","module":"api","errors":[{"title":"Not Authenticated","detail":"Authentication credentials missing or invalid","id":"aa499bbf-5451-4280-9a5d-6f4f51293fdb","status":"401","code":"4011"}],"msg":"fetch http://127.0.0.1:8080/api/kafkas?fields%5Bkafka
console-ui ReferenceError: window is not defined                                                                                                                                                                                                                                                                     
console-ui     at /app/.next/server/chunks/4119.js:1:16532                                                                                                                                                                                                                                                           
console-ui     at d (/app/.next/server/chunks/4119.js:1:56446)                                                                                                                                                                                                                                                       
console-ui     at Generator.<anonymous> (/app/.next/server/chunks/4119.js:1:56237)                                                                                                                                                                                                                                   
console-ui     at Generator.next (/app/.next/server/chunks/4119.js:1:56805)                                                                                                                                                                                                                                          
console-ui     at t (/app/.next/server/chunks/4119.js:1:51078)                                                                                                                                                                                                                                                       
console-ui     at u (/app/.next/server/chunks/4119.js:1:51288)                                                                                                                                                                                                                                                       
console-ui     at /app/.next/server/chunks/4119.js:1:51347                                                                                                                                                                                                                                                           
console-ui     at new Promise (<anonymous>)                                                                                                                                                                                                                                                                          
console-ui     at /app/.next/server/chunks/4119.js:1:51229                                                                                                                                                                                                                                                           
console-ui     at t.signOut (/app/.next/server/chunks/4119.js:1:10937)

To Reproduce
Steps to reproduce the behavior:

1. Upgrade from 0.9.0 to 0.10.0

Expected behavior
A clear and concise description of what you expected to happen.

Screenshots
If applicable, add screenshots to help explain your problem.

Desktop (please complete the following information):

• OS: Linux
• Browser Chromium
• Version 141.0.7390.122

Additional context
I also integrated the changes from 287801d into my config but rolling them back does not have any effect.

Used images:

quay.io/streamshub/console-api:0.10.0@sha256:96844bedcdd5c01d2c2e888b058793a2735d5ec591c21090bbd054edc2602447
quay.io/streamshub/console-ui:0.10.0@sha256:b06077d15d687a0e61ec86e6a4ab8f60b8a0ff81f156d4a033e0410afbb604b1
or
quay.io/streamshub/console-ui:0.10.1-snapshot@sha256:29338b16b3fb1d4e4a06f90489339f4d27e8dac88b7640b3a98675f185ad79ba

[MikeEdgar]

@sebastiangaiser please try release 0.10.1 at your leisure. It should resolve the error messages you see in the UI logs when the API response with 401. If you still see 502s from your gateway, we'll need to keep digging for a solution on that.

[sebastiangaiser]

Hey, now I get an endless loading white page. That are my logs:

console-api INFO exec -a "java" java -Dquarkus.http.host=0.0.0.0 -Djava.util.logging.manager=org.jboss.logmanager.LogManager -cp "." -jar /deployments/quarkus-run.jar                                                                                                                                                
console-api INFO running in /deployments                                                                                                                                                                                                                                                                              
console-api __  ____  __  _____   ___  __ ____  ______                                                                                                                                                                                                                                                                
console-api  --/ __ \/ / / / _ | / _ \/ //_/ / / / __/                                                                                                                                                                                                                                                                
console-api  -/ /_/ / /_/ / __ |/ , _/ ,< / /_/ /\ \                                                                                                                                                                                                                                                                  
console-api --\___\_\____/_/ |_/_/|_/_/|_|\____/___/                                                                                                                                                                                                                                                                  
console-api 2025-11-04 17:15:37,857 INFO  [com.git.str.con.api.sup.fac.ConsoleConfigFactory] (main) Loading console configuration from file:/deployments/console-config.yaml                                                                                                                                          
console-api 2025-11-04 17:15:38,534 INFO  [com.git.str.con.LoggingConfigWatcher] (main) No log config files set to monitor                                                                                                                                                                                            
console-api 2025-11-04 17:15:38,571 INFO  [io.quarkus] (main) console-api 0.10.1 on JVM (powered by Quarkus 3.20.3) started in 2.412s. Listening on: http://0.0.0.0:8080                                                                                                                                              
console-api 2025-11-04 17:15:38,572 INFO  [io.quarkus] (main) Profile prod activated.                                                                                                                                                                                                                                 
console-api 2025-11-04 17:15:38,572 INFO  [io.quarkus] (main) Installed features: [cache, cdi, hibernate-validator, kubernetes-client, micrometer, oidc, oidc-client, rest, rest-client, rest-client-jackson, rest-jackson, security, smallrye-context-propagation, smallrye-health, smallrye-openapi, swagger-ui, ver
console-ui   ▲ Next.js 14.2.33                                                                                                                                                                                                                                                                                        
console-ui   - Local:        http://localhost:3000                                                                                                                                                                                                                                                                    
console-ui   - Network:      http://0.0.0.0:3000                                                                                                                                                                                                                                                                      
console-ui                                                                                                                                                                                                                                                                                                            
console-ui  ✓ Starting...                                                                                                                                                                                                                                                                                             
console-ui  ✓ Ready in 69ms                                                                                                                                                                                                                                                                                           
console-ui {"level":30,"time":1762276546436,"env":"production","module":"utils","msg":"console configuration loaded from /deployments/console-config.yaml"}                                                                                                                                                           
console-ui {"level":50,"time":1762276556107,"env":"production","module":"next-auth","0":{"error":{"name":"OAuthCallbackError","message":""},"providerId":"oidc"},"msg":"OAUTH_CALLBACK_ERROR"}                                                                                                                        
console-ui {"level":50,"time":1762276563636,"env":"production","module":"next-auth","0":{"error":{"name":"OAuthCallbackError","message":""},"providerId":"oidc"},"msg":"OAUTH_CALLBACK_ERROR"}                                                                                                                        
console-ui {"level":50,"time":1762276571086,"env":"production","module":"next-auth","0":{"error":{"name":"OAuthCallbackError","message":""},"providerId":"oidc"},"msg":"OAUTH_CALLBACK_ERROR"}                                                                                                                        
console-ui {"level":50,"time":1762276578732,"env":"production","module":"next-auth","0":{"error":{"name":"OAuthCallbackError","message":""},"providerId":"oidc"},"msg":"OAUTH_CALLBACK_ERROR"}                                                                                                                        
console-ui {"level":50,"time":1762276586250,"env":"production","module":"next-auth","0":{"error":{"name":"OAuthCallbackError","message":""},"providerId":"oidc"},"msg":"OAUTH_CALLBACK_ERROR"}                                                                                                                        
console-ui {"level":50,"time":1762276593883,"env":"production","module":"next-auth","0":{"error":{"name":"OAuthCallbackError","message":""},"providerId":"oidc"},"msg":"OAUTH_CALLBACK_ERROR"}                                                                                                                        
console-ui {"level":50,"time":1762276601521,"env":"production","module":"next-auth","0":{"error":{"name":"OAuthCallbackError","message":""},"providerId":"oidc"},"msg":"OAUTH_CALLBACK_ERROR"}                                                                                                                        
console-ui {"level":50,"time":1762276609068,"env":"production","module":"next-auth","0":{"error":{"name":"OAuthCallbackError","message":""},"providerId":"oidc"},"msg":"OAUTH_CALLBACK_ERROR"}                                                                                                                        
console-ui {"level":50,"time":1762276616673,"env":"production","module":"next-auth","0":{"error":{"name":"OAuthCallbackError","message":""},"providerId":"oidc"},"msg":"OAUTH_CALLBACK_ERROR"}                                                                                                                        
console-ui {"level":50,"time":1762276622006,"env":"production","module":"next-auth","0":{"error":{"name":"OAuthCallbackError","message":""},"providerId":"oidc"},"msg":"OAUTH_CALLBACK_ERROR"}                                                                                                                        
console-ui {"level":50,"time":1762276629545,"env":"production","module":"next-auth","0":{"error":{"name":"OAuthCallbackError","message":""},"providerId":"oidc"},"msg":"OAUTH_CALLBACK_ERROR"}                                                                                                                        
console-ui {"level":50,"time":1762276637056,"env":"production","module":"next-auth","0":{"error":{"name":"OAuthCallbackError","message":""},"providerId":"oidc"},"msg":"OAUTH_CALLBACK_ERROR"}                                                                                                                        
console-ui {"level":50,"time":1762276644720,"env":"production","module":"next-auth","0":{"error":{"name":"OAuthCallbackError","message":""},"providerId":"oidc"},"msg":"OAUTH_CALLBACK_ERROR"}

Is there a guide for configuring the OIDC client in Keycloak?

[sebastiangaiser]

After a restart I get the 502 again with this log:

console-api INFO exec -a "java" java -Dquarkus.http.host=0.0.0.0 -Djava.util.logging.manager=org.jboss.logmanager.LogManager -cp "." -jar /deployments/quarkus-run.jar                                                                                                                                                
console-api INFO running in /deployments                                                                                                                                                                                                                                                                              
console-api __  ____  __  _____   ___  __ ____  ______                                                                                                                                                                                                                                                                
console-api  --/ __ \/ / / / _ | / _ \/ //_/ / / / __/                                                                                                                                                                                                                                                                
console-api  -/ /_/ / /_/ / __ |/ , _/ ,< / /_/ /\ \                                                                                                                                                                                                                                                                  
console-api --\___\_\____/_/ |_/_/|_/_/|_|\____/___/                                                                                                                                                                                                                                                                  
console-ui   ▲ Next.js 14.2.33                                                                                                                                                                                                                                                                                        
console-ui   - Local:        http://localhost:3000                                                                                                                                                                                                                                                                    
console-ui   - Network:      http://0.0.0.0:3000                                                                                                                                                                                                                                                                      
console-api 2025-11-04 17:28:50,856 INFO  [com.git.str.con.api.sup.fac.ConsoleConfigFactory] (main) Loading console configuration from file:/deployments/console-config.yaml                                                                                                                                          
console-ui                                                                                                                                                                                                                                                                                                            
console-ui  ✓ Starting...                                                                                                                                                                                                                                                                                             
console-api 2025-11-04 17:28:51,523 INFO  [com.git.str.con.LoggingConfigWatcher] (main) No log config files set to monitor                                                                                                                                                                                            
console-api 2025-11-04 17:28:51,557 INFO  [io.quarkus] (main) console-api 0.10.1 on JVM (powered by Quarkus 3.20.3) started in 2.388s. Listening on: http://0.0.0.0:8080                                                                                                                                              
console-api 2025-11-04 17:28:51,558 INFO  [io.quarkus] (main) Profile prod activated.                                                                                                                                                                                                                                 
console-api 2025-11-04 17:28:51,558 INFO  [io.quarkus] (main) Installed features: [cache, cdi, hibernate-validator, kubernetes-client, micrometer, oidc, oidc-client, rest, rest-client, rest-client-jackson, rest-jackson, security, smallrye-context-propagation, smallrye-health, smallrye-openapi, swagger-ui, ver
x[]                                                                                                                                                                                                                                                                                                                   
console-ui  ✓ Ready in 69ms                                                                                                                                                                                                                                                                                           
console-ui {"level":30,"time":1762277335785,"env":"production","module":"utils","msg":"console configuration loaded from /deployments/console-config.yaml"}                                                                                                                                                           
console-api 2025-11-04 17:29:09,847 WARN  [com.git.str.con.api.sup.TrustStoreSupport] (vert.x-eventloop-thread-1) No truststore found for bucket 'oidc-provider:auth-server'                                                                                                                                          
console-api 2025-11-04 17:29:10,009 INFO  [io.qua.htt.access-log] (vert.x-eventloop-thread-1) - 127.0.0.1 - "GET /api/kafkas?fields%5Bkafkas%5D=name%2Cnamespace%2CkafkaVersion&page%5Bsize%5D=20&sort=name HTTP/1.1" 401 181ms 172                                                                                   
console-ui {"level":30,"time":1762277350009,"env":"production","module":"api","errors":[{"title":"Not Authenticated","detail":"Authentication credentials missing or invalid","id":"ec7af16b-ae45-4933-b4f9-e1329ec5d103","status":"401","code":"4011"}],"msg":"fetch http://127.0.0.1:8080/api/kafkas?fields%5Bkafkas
%5D=name%2Cnamespace%2CkafkaVersion&page%5Bsize%5D=20&sort=name response"}                                                                                                                                                                                                                                            
console-ui {"level":50,"time":1762277364473,"env":"production","module":"next-auth","0":{"error":{"name":"OAuthCallbackError","message":""},"providerId":"oidc"},"msg":"OAUTH_CALLBACK_ERROR"}                                                                                                                        
console-api 2025-11-04 17:29:32,391 INFO  [io.qua.htt.access-log] (vert.x-eventloop-thread-4) - 127.0.0.1 - "GET /api/kafkas?fields%5Bkafkas%5D=name%2Cnamespace%2CkafkaVersion&page%5Bsize%5D=20&sort=name HTTP/1.1" 401 1ms 172                                                                                     
console-ui {"level":30,"time":1762277372393,"env":"production","module":"api","errors":[{"title":"Not Authenticated","detail":"Authentication credentials missing or invalid","id":"448958f7-fe76-4b93-9cc8-e9aa7df65f62","status":"401","code":"4011"}],"msg":"fetch http://127.0.0.1:8080/api/kafkas?fields%5Bkafkas
%5D=name%2Cnamespace%2CkafkaVersion&page%5Bsize%5D=20&sort=name response"}

Used images:

quay.io/streamshub/console-api:0.10.1@sha256:3ee98ea6ec07360455c792b95e806f9d510d8e57b591363d7c2138f3478d181f
quay.io/streamshub/console-ui:0.10.1@sha256:65983f7d0f2e68229bb9889f6379a4fa10ee17362c843b317fc7fde7e3e47938

[MikeEdgar]

Do you ever get forwarded to the Keycloak login screen?

[MikeEdgar]

Also, are you able to share your Keycloak client configuration? It can be exported in the Keycloak Web UI to a JSON file which should not include anything sensitive - but if it does you can remove it before sharing.

[MikeEdgar]

@sebastiangaiser can you also check your Keycloak logs for any clues when this happens?

[sebastiangaiser]

I requested the configuration from another team, so this will need some more time, sorry.
But I have another fear, what is the timeout for the OIDC, e.g. Keycloak is answering very slowly. Could this be related?

[MikeEdgar]

But I have another fear, what is the timeout for the OIDC, e.g. Keycloak is answering very slowly. Could this be related?

Possibly - how long does Keycloak take to answer a call to https://${keycloak-domain}/realms/${realm-name}/.well-known/openid-configuration ? If you do not see a redirect to the login page at all, that may be an issue. Especially if it takes longer than nginx is configured to time out.

[sebastiangaiser]

The configuration:

{
  "clientId": "my-clientid",
  "name": "my-name",
  "description": "XXX",
  "rootUrl": "https://kafka-console.example.com",
  "adminUrl": "https://kafka-console.example.com",
  "baseUrl": "",
  "surrogateAuthRequired": false,
  "enabled": true,
  "alwaysDisplayInConsole": false,
  "clientAuthenticatorType": "client-secret",
  "secret": "XXXXXXXXXXXX",
  "redirectUris": [
    "https://kafka-console.example.com/api/auth/callback/oidc"
  ],
  "webOrigins": [
    "https://kafka-console.example.com"
  ],
  "notBefore": 0,
  "bearerOnly": false,
  "consentRequired": false,
  "standardFlowEnabled": true,
  "implicitFlowEnabled": false,
  "directAccessGrantsEnabled": false,
  "serviceAccountsEnabled": false,
  "publicClient": false,
  "frontchannelLogout": true,
  "protocol": "openid-connect",
  "attributes": {
    "realm_client": "false",
    "oidc.ciba.grant.enabled": "false",
    "client.secret.creation.time": "11111111",
    "backchannel.logout.session.required": "true",
    "standard.token.exchange.enabled": "false",
    "frontchannel.logout.session.required": "true",
    "oauth2.device.authorization.grant.enabled": "false",
    "display.on.consent.screen": "false",
    "backchannel.logout.revoke.offline.tokens": "false"
  },
  "authenticationFlowBindingOverrides": {},
  "fullScopeAllowed": false,
  "nodeReRegistrationTimeout": -1,
  "protocolMappers": [
    {
      "name": "username",
      "protocol": "openid-connect",
      "protocolMapper": "oidc-usermodel-attribute-mapper",
      "consentRequired": false,
      "config": {
        "introspection.token.claim": "true",
        "userinfo.token.claim": "true",
        "user.attribute": "username",
        "id.token.claim": "true",
        "access.token.claim": "true",
        "claim.name": "preferred_username",
        "jsonType.label": "String"
      }
    },
    {
      "name": "groups",
      "protocol": "openid-connect",
      "protocolMapper": "oidc-usermodel-realm-role-mapper",
      "consentRequired": false,
      "config": {
        "introspection.token.claim": "true",
        "multivalued": "true",
        "user.attribute": "foo",
        "id.token.claim": "true",
        "access.token.claim": "true",
        "claim.name": "groups",
        "jsonType.label": "String"
      }
    }
  ],
  "defaultClientScopes": [
    "web-origins",
    "acr",
    "roles",
    "basic"
  ],
  "optionalClientScopes": [
    "address",
    "phone",
    "profile",
    "offline_access",
    "microprofile-jwt",
    "email"
  ],
  "access": {
    "view": true,
    "configure": true,
    "manage": true
  }
}

[sebastiangaiser]

Finally had the time to test it again, sorry for the delay.
I opened the console in an incognito window and got forwarded to Keycloak. After login I get a spinner resulting in a 502 Bad Gateway from nginx. That the log from the container:

strimzi-stack-console-796db5686-t7pvc console-api INFO exec -a "java" java -Dquarkus.http.host=0.0.0.0 -Djava.util.logging.manager=org.jboss.logmanager.LogManager -cp "." -jar /deployments/quarkus-run.jar                                                                                                          
strimzi-stack-console-796db5686-t7pvc console-ui   ▲ Next.js 14.2.33                                                                                                                                                                                                                                                  
strimzi-stack-console-796db5686-t7pvc console-ui   - Local:        http://localhost:3000                                                                                                                                                                                                                              
strimzi-stack-console-796db5686-t7pvc console-api INFO running in /deployments                                                                                                                                                                                                                                        
strimzi-stack-console-796db5686-t7pvc console-ui   - Network:      http://0.0.0.0:3000                                                                                                                                                                                                                                
strimzi-stack-console-796db5686-t7pvc console-ui                                                                                                                                                                                                                                                                      
strimzi-stack-console-796db5686-t7pvc console-api __  ____  __  _____   ___  __ ____  ______                                                                                                                                                                                                                          
strimzi-stack-console-796db5686-t7pvc console-ui  ✓ Starting...                                                                                                                                                                                                                                                       
strimzi-stack-console-796db5686-t7pvc console-ui  ✓ Ready in 75ms                                                                                                                                                                                                                                                     
strimzi-stack-console-796db5686-t7pvc console-ui {"level":30,"time":1762522815297,"env":"production","module":"utils","msg":"console configuration loaded from /deployments/console-config.yaml"}                                                                                                                     
strimzi-stack-console-796db5686-t7pvc console-api  --/ __ \/ / / / _ | / _ \/ //_/ / / / __/                                                                                                                                                                                                                          
strimzi-stack-console-796db5686-t7pvc console-api  -/ /_/ / /_/ / __ |/ , _/ ,< / /_/ /\ \                                                                                                                                                                                                                            
strimzi-stack-console-796db5686-t7pvc console-api --\___\_\____/_/ |_/_/|_/_/|_|\____/___/                                                                                                                                                                                                                            
strimzi-stack-console-796db5686-t7pvc console-api 2025-11-07 13:39:59,000 INFO  [com.git.str.con.api.sup.fac.ConsoleConfigFactory] (main) Loading console configuration from file:/deployments/console-config.yaml                                                                                                    
strimzi-stack-console-796db5686-t7pvc console-api 2025-11-07 13:39:59,615 INFO  [com.git.str.con.LoggingConfigWatcher] (main) No log config files set to monitor                                                                                                                                                      
strimzi-stack-console-796db5686-t7pvc console-ui {"level":50,"time":1762522843825,"env":"production","module":"next-auth","0":{"error":{"name":"OAuthCallbackError","message":""},"providerId":"oidc"},"msg":"OAUTH_CALLBACK_ERROR"}                                                                                  
strimzi-stack-console-796db5686-t7pvc console-api 2025-11-07 13:39:59,637 INFO  [io.quarkus] (main) console-api 0.10.1 on JVM (powered by Quarkus 3.20.3) started in 2.380s. Listening on: http://0.0.0.0:8080                                                                                                        
strimzi-stack-console-796db5686-t7pvc console-api 2025-11-07 13:39:59,637 INFO  [io.quarkus] (main) Profile prod activated.                                                                                                                                                                                           
strimzi-stack-console-796db5686-t7pvc console-api 2025-11-07 13:39:59,637 INFO  [io.quarkus] (main) Installed features: [cache, cdi, hibernate-validator, kubernetes-client, micrometer, oidc, oidc-client, rest, rest-client, rest-client-jackson, rest-jackson, security, smallrye-context-propagation, smallrye-hea
th, smallrye-openapi, swagger-ui, vertx[]                                                                                                                                                                                                                                                                             
strimzi-stack-console-796db5686-t7pvc console-api 2025-11-07 13:41:21,121 WARN  [com.git.str.con.api.sup.TrustStoreSupport] (vert.x-eventloop-thread-1) No truststore found for bucket 'oidc-provider:auth-server'                                                                                                    
strimzi-stack-console-796db5686-t7pvc console-api 2025-11-07 13:41:21,250 INFO  [io.qua.htt.access-log] (vert.x-eventloop-thread-1) - 127.0.0.1 - "GET /api/kafkas?fields%5Bkafkas%5D=name%2Cnamespace%2CkafkaVersion&page%5Bsize%5D=20&sort=name HTTP/1.1" 401 145ms 172                                             
strimzi-stack-console-796db5686-t7pvc console-ui {"level":50,"time":1762522851464,"env":"production","module":"next-auth","0":{"error":{"name":"OAuthCallbackError","message":""},"providerId":"oidc"},"msg":"OAUTH_CALLBACK_ERROR"}                                                                                  
strimzi-stack-console-796db5686-t7pvc console-ui {"level":50,"time":1762522858949,"env":"production","module":"next-auth","0":{"error":{"name":"OAuthCallbackError","message":""},"providerId":"oidc"},"msg":"OAUTH_CALLBACK_ERROR"}                                                                                  
strimzi-stack-console-796db5686-t7pvc console-ui {"level":50,"time":1762522866465,"env":"production","module":"next-auth","0":{"error":{"name":"OAuthCallbackError","message":""},"providerId":"oidc"},"msg":"OAUTH_CALLBACK_ERROR"}                                                                                  
strimzi-stack-console-796db5686-t7pvc console-ui {"level":50,"time":1762522873563,"env":"production","module":"next-auth","0":{"error":{"name":"OAuthCallbackError","message":""},"providerId":"oidc"},"msg":"OAUTH_CALLBACK_ERROR"}                                                                                  
strimzi-stack-console-796db5686-t7pvc console-api 2025-11-07 13:41:43,849 INFO  [io.qua.htt.access-log] (vert.x-eventloop-thread-4) - 127.0.0.1 - "GET /api/kafkas?fields%5Bkafkas%5D=name%2Cnamespace%2CkafkaVersion&page%5Bsize%5D=20&sort=name HTTP/1.1" 401 1ms 172                                               
strimzi-stack-console-796db5686-t7pvc console-api 2025-11-07 13:44:46,574 INFO  [io.qua.htt.access-log] (vert.x-eventloop-thread-0) - 127.0.0.1 - "GET /api/kafkas?fields%5Bkafkas%5D=name%2Cnamespace%2CkafkaVersion&page%5Bsize%5D=20&sort=name HTTP/1.1" 401 1ms 172                                               
strimzi-stack-console-796db5686-t7pvc console-ui {"level":30,"time":1762522881253,"env":"production","module":"api","errors":[{"title":"Not Authenticated","detail":"Authentication credentials missing or invalid","id":"9c7c3774-3a00-44d8-adca-f978d85848e9","status":"401","code":"4011"}],"msg":"fetch http://127
.0.0.1:8080/api/kafkas?fields%5Bkafkas%5D=name%2Cnamespace%2CkafkaVersion&page%5Bsize%5D=20&sort=name response"}                                                                                                                                                                                                      
strimzi-stack-console-796db5686-t7pvc console-ui {"level":50,"time":1762522892693,"env":"production","module":"next-auth","0":{"error":{"name":"OAuthCallbackError","message":""},"providerId":"oidc"},"msg":"OAUTH_CALLBACK_ERROR"}                                                                                  
strimzi-stack-console-796db5686-t7pvc console-ui {"level":30,"time":1762522903852,"env":"production","module":"api","errors":[{"title":"Not Authenticated","detail":"Authentication credentials missing or invalid","id":"0ebaa41a-521e-4805-b17c-b18e3043f714","status":"401","code":"4011"}],"msg":"fetch http://127
.0.0.1:8080/api/kafkas?fields%5Bkafkas%5D=name%2Cnamespace%2CkafkaVersion&page%5Bsize%5D=20&sort=name response"}                                                                                                                                                                                                      
strimzi-stack-console-796db5686-t7pvc console-ui {"level":50,"time":1762523001578,"env":"production","module":"next-auth","0":{"error":{"name":"OAuthCallbackError","message":""},"providerId":"oidc"},"msg":"OAUTH_CALLBACK_ERROR"}                                                                                  
strimzi-stack-console-796db5686-t7pvc console-ui {"level":50,"time":1762523009470,"env":"production","module":"next-auth","0":{"error":{"name":"OAuthCallbackError","message":""},"providerId":"oidc"},"msg":"OAUTH_CALLBACK_ERROR"}                                                                                  
strimzi-stack-console-796db5686-t7pvc console-ui {"level":50,"time":1762523017143,"env":"production","module":"next-auth","0":{"error":{"name":"OAuthCallbackError","message":""},"providerId":"oidc"},"msg":"OAUTH_CALLBACK_ERROR"}                                                                                  
strimzi-stack-console-796db5686-t7pvc console-ui {"level":50,"time":1762523024962,"env":"production","module":"next-auth","0":{"error":{"name":"OAuthCallbackError","message":""},"providerId":"oidc"},"msg":"OAUTH_CALLBACK_ERROR"}                                                                                  
strimzi-stack-console-796db5686-t7pvc console-ui {"level":50,"time":1762523032410,"env":"production","module":"next-auth","0":{"error":{"name":"OAuthCallbackError","message":""},"providerId":"oidc"},"msg":"OAUTH_CALLBACK_ERROR"}                                                                                  
strimzi-stack-console-796db5686-t7pvc console-ui {"level":50,"time":1762523039852,"env":"production","module":"next-auth","0":{"error":{"name":"OAuthCallbackError","message":""},"providerId":"oidc"},"msg":"OAUTH_CALLBACK_ERROR"}                                                                                  
strimzi-stack-console-796db5686-t7pvc console-ui {"level":30,"time":1762523086576,"env":"production","module":"api","errors":[{"title":"Not Authenticated","detail":"Authentication credentials missing or invalid","id":"20512dcb-886c-46b8-82a6-1e14a0c4ac55","status":"401","code":"4011"}],"msg":"fetch http://127
.0.0.1:8080/api/kafkas?fields%5Bkafkas%5D=name%2Cnamespace%2CkafkaVersion&page%5Bsize%5D=20&sort=name response"} 

[MikeEdgar]

There's a chance we could get more information about why the API server is responding with 401 once you've logged in. Can you try setting this environment variable on for the API?

This can be done via the Console CR under .spec.containers.api.spec.env[]

spec:
  containers:
    api:
      spec:
        env:
        - name: QUARKUS_LOG_CATEGORY__COM_GITHUB_STREAMSHUB_CONSOLE_API_SECURITY_CONSOLEAUTHENTICATIONMECHANISM__LEVEL
          value: DEBUG

[MikeEdgar]

Something else I see is that there is no groups claim listed in either the optional or default claims for your client. If you are not using that claim, also make sure that you are providing the scopes your client needs in the .spec.security.oidc section.

spec:
  security:
    oidc:
      ...
      # This is the default/implied list, modify as needed
      scopes: "openid email profile groups"
      ...