kubectl logs apigee-cassandra-2 -n apigee -f
INFO 00:44:36 Starting listening for CQL clients on /10.0.2.12:9042 (encrypted)...
INFO 00:44:36 Binding thrift service to /10.0.2.12:9160
INFO 00:44:36 enabling encrypted thrift connections between client and server
INFO 00:44:36 Listening for thrift clients...
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-27。"],[[["\u003cp\u003eApigee hybrid uses Cassandra as its backend datastore, and TLS encryption is enabled by default for all communications between Cassandra nodes and clients.\u003c/p\u003e\n"],["\u003cp\u003eAuthentication for Cassandra can be configured using username/password combinations directly in the \u003ccode\u003eoverrides.yaml\u003c/code\u003e file or by storing them in a Kubernetes Secret.\u003c/p\u003e\n"],["\u003cp\u003eThere are six distinct Cassandra users: DML, DDL, Admin, the default \u003ccode\u003ecassandra\u003c/code\u003e user, JMX, and Jolokia, each designed for different types of interactions with the Cassandra cluster.\u003c/p\u003e\n"],["\u003cp\u003eThe default \u003ccode\u003ecassandra\u003c/code\u003e user, acting as a superuser, is crucial for the \u003ccode\u003eapigee-cassandra-user-setup\u003c/code\u003e job during initial installations, upgrades, and region expansions but its password should be changed post-setup for security.\u003c/p\u003e\n"],["\u003cp\u003eIt is strongly recommended to change the default passwords for all Cassandra users in the \u003ccode\u003eoverrides.yaml\u003c/code\u003e during the initial setup, and usernames must be lowercase without special characters.\u003c/p\u003e\n"]]],[],null,["# Configuring authentication for Cassandra\n\n| You are currently viewing version 1.10 of the Apigee hybrid documentation. **This version is end of life.** You should upgrade to a newer version. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\n\nThis topic explains how to configure authentication for communication between\nCassandra nodes and between clients and Cassandra nodes.\n\nHow to configure authentication for Cassandra in the runtime plane\n------------------------------------------------------------------\n\n\nCassandra provides secure communication between a client machine and a database\ncluster and between nodes within a cluster. Enabling encryption ensures that data\nin flight is not compromised and is transferred securely. In Apigee hybrid, TLS is\nenabled by default for any communication between Cassandra nodes and between clients and\nCassandra nodes.\n\n\nYou can configure the authentication using username/password combinations either\nplaced directly in the overrides file or added to a Kubernetes Secret, as explained in this topic.\n\nAbout Cassandra user authentication\n-----------------------------------\n\n\nThe hybrid platform uses Cassandra as the backend datastore for runtime\nplane data. By default, any of the client communications to Cassandra\nrequire authentication. There are multiple client users that communicate\nwith Cassandra. Default passwords are provided for these users. See\n[Changing\nthe default passwords in the overrides file](#changing-the-default-passwords-in-the-overrides-file) for the steps required\nto change the default passwords.\n\nThese users,\nincluding a default user, are described below:\n\n1. **DML User**: Used by the client communication to read and write data to Cassandra (KMS, KVM, Cache and Quota).\n2. **DDL User:** Used by MART for any of the data definition tasks like keyspace creation, update, and deletion.\n3. **Admin User:** Used for any administrative activities performed on cassandra cluster.\n4. **Default Cassandra user:** Cassandra creates a default user when Authentication is enabled and the username is `cassandra`\n5. **JMX User:** Used to authenticate and communicate with the Cassandra JMX interface.\n6. **Jolokia User:** Used to authenticate and communicate with the Cassandra JMX API.\n\nAbout the default Cassandra user\n--------------------------------\n\n\nWhen Apigee hybrid cluster is created and Cassandra authentication is enabled, the initial user account is the default Cassandra user, identified by the username `cassandra`. The default `cassandra` user functions as a superuser, responsible for tasks such as adding user roles and modifying the database schema.\n\n\nThe Apigee hybrid `apigee-cassandra-user-setup` job utilizes the default `cassandra` user to establish new roles and update the password associated with this default user. The execution of the `apigee-cassandra-user-setup` job occurs during the initial installation of an Apigee hybrid instance, subsequent instance upgrades, and the provisioning of a new instance as part of region expansion.\n\n\nWhen the Apigee hybrid `apigee-cassandra-user-setup` job is executed, the job needs the ability to update and modify database level configurations either as part of a fresh install or an upgrade. The default `cassandra` user is the only user guaranteed to be present when the `apigee-cassandra-user-setup` job is setting up the new Cassandra pods. Without a known user with superuser access, the Apigee hybrid upgrades and region expansions would not function properly.\n\n\nThe default `cassandra` user password is changed after initial use as part of additional security measures. This means even if the default `cassandra` user is still enabled, the new password must be known to use the default `cassandra` user. The default `cassandra` user is not used by any other components except `apigee-cassandra-user-setup` job as part of the new install and region expansion.\n\nChanging the default passwords in the overrides file\n----------------------------------------------------\n\n\nAs a security best practice, we recommend you change the default passwords for Cassandra. You can do so in the\n`overrides.yaml` file. Add the following configuration, change the default\npasswords as you wish, and apply the change to\nyour cluster.\n| **Note:** You can only change these defaults at the time of initial setup. Password rotation or change after hybrid setup is not possible.\nAll the usernames must be in lowercase and no special characters are allowed. \n\n```actionscript-3\ncassandra:\n auth:\n default: ## the password for the new default user (static username: cassandra)\n password: \"\u003cvar translate=\"no\"\u003eNEW_PASSWORD\u003c/var\u003e\"\n admin: ## the password for the admin user (static username: admin_user)\n password: \"\u003cvar translate=\"no\"\u003eNEW_PASSWORD\u003c/var\u003e\"\n ddl: ## the password for the DDL User (static username: ddl_user)\n password: \"\u003cvar translate=\"no\"\u003eNEW_PASSWORD\u003c/var\u003e\"\n dml: ## the password for the DML User (static username: dml_user)\n password: \"\u003cvar translate=\"no\"\u003eNEW_PASSWORD\u003c/var\u003e\"\n jmx:\n username: \"jmxuser\" ## the username for the JMX User\n password: \"\u003cvar translate=\"no\"\u003eNEW_PASSWORD\u003c/var\u003e\" ## the password for the JMX User\n jolokia:\n username: \"jolokiauser\" ## the username to access jolokia interface\n password: \"\u003cvar translate=\"no\"\u003eNEW_PASSWORD\u003c/var\u003e\" ## the password for jolokia user\n```\n\n\nNote the following:\n\n- Certificate Authority (CA) rotation is not supported.\n- A server certificate which is generated with passphrase is not supported.\n\nSetting usernames and passwords in a Kubernetes Secret\n------------------------------------------------------\n\n\nThis section\nexplains how to configure Cassandra to use Kubernetes Secrets for authentication.\n\n### Create the Secret\n\n\nUse the following template to configure the Kubernetes Secret. Save the template\nto a YAML file and edit the required attributes, for example `my-secret.yaml`.\nNote that if you use this option, you must provide the usernames with each password. \n\n```actionscript-3\napiVersion: v1\nkind: Secret\nmetadata:\n name: SECRET_NAME\n namespace: APIGEE_NAMESPACE\ntype: Opaque\ndata:\n default.password: DEFAULT_PASSWORD #base64-encoded string\n admin.user: ADMIN_USERNAME #base64-encoded string\n admin.password: ADMIN_PASSWORD #base64-encoded string\n dml.user: DML_USERNAME #base64-encoded string\n dml.password: DML_PASSWORD #base64-encoded string\n ddl.user: DDL_USERNAME #base64-encoded string\n ddl.password: DDL_PASSWORD #base64-encoded string\n jmx.user: JMX_USERNAME #base64-encoded string\n jmx.password: JMX_PASSWORD #base64-encoded string\n jolokia.user: JOLOKIA_USERNAME #base64-encoded string\n jolokia.password: JOLOKIA_PASSWORD #base64-encoded string\n \n```\n\n\nWhere \u003cvar translate=\"no\"\u003eSECRET_NAME\u003c/var\u003e is the name you choose for the Secret, \u003cvar translate=\"no\"\u003eAPIGEE_NAMESPACE\u003c/var\u003e\nis the namespace where the Apigee pods are deployed (default is `apigee`),\nand each \u003cvar translate=\"no\"\u003e_USERNAME\u003c/var\u003e and \u003cvar translate=\"no\"\u003e_PASSWORD\u003c/var\u003e are the usernames and passwords for each\nuser. Note that the username and password must be Base64-encoded.\n\n\nApply the Secret to the cluster. For example: \n\n```\nkubectl apply -f SECRET_FILE\n```\n\n\nAdd the Secret to your overrides file: \n\n```actionscript-3\ncassandra:\n auth:\n secret: SECRET_NAME\n```\n\n\nApply the updated Cassandra override to the cluster: \n\n```\n$APIGEECTL_HOME/apigeectl apply -f overrides/overrides.yaml --datastore\n```\n\nCheck the Cassandra logs\n------------------------\n\n\nCheck the logs as soon as Cassandra starts up. The log below shows you that the\nCassandra client connections are encrypted. \n\n```\nkubectl logs apigee-cassandra-2 -n apigee -f\n\nINFO 00:44:36 Starting listening for CQL clients on /10.0.2.12:9042 (encrypted)...\nINFO 00:44:36 Binding thrift service to /10.0.2.12:9160\nINFO 00:44:36 enabling encrypted thrift connections between client and server\nINFO 00:44:36 Listening for thrift clients...\n```"]]
