kubectl logs apigee-cassandra-2 -n apigee -f
INFO 00:44:36 Starting listening for CQL clients on /10.0.2.12:9042 (encrypted)...
INFO 00:44:36 Binding thrift service to /10.0.2.12:9160
INFO 00:44:36 enabling encrypted thrift connections between client and server
INFO 00:44:36 Listening for thrift clients...
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-27。"],[[["\u003cp\u003eApigee hybrid uses Cassandra as its backend datastore, and by default, all client communications to Cassandra require authentication, with TLS encryption enabled for secure data transfer between nodes and clients.\u003c/p\u003e\n"],["\u003cp\u003eCassandra authentication can be configured using username/password combinations directly in the overrides file or through a Kubernetes Secret, offering flexibility in managing credentials.\u003c/p\u003e\n"],["\u003cp\u003eSeveral default users are provided for specific functions like reading/writing data (DML), data definition tasks (DDL), administrative tasks, JMX, and Jolokia interface access, each with their own dedicated purpose.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003ecassandra\u003c/code\u003e default user is created when authentication is enabled and functions as a superuser during initial installation, upgrades, and region expansions, and while its password should be changed immediately, it is not used by any other hybrid components except for the setup job.\u003c/p\u003e\n"],["\u003cp\u003eDefault passwords for Cassandra users can be changed in the \u003ccode\u003eoverrides.yaml\u003c/code\u003e file during the initial setup, and the use of Kubernetes Secrets allows for external management of usernames and passwords, which should be Base64-encoded.\u003c/p\u003e\n"]]],[],null,["# Configuring authentication for Cassandra\n\n| You are currently viewing version 1.11 of the Apigee hybrid documentation. **This version is end of life.** You should upgrade to a newer version. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\n\nThis topic explains how to configure authentication for communication between\nCassandra nodes and between clients and Cassandra nodes.\n\nHow to configure authentication for Cassandra in the runtime plane\n------------------------------------------------------------------\n\n\nCassandra provides secure communication between a client machine and a database\ncluster and between nodes within a cluster. Enabling encryption ensures that data\nin flight is not compromised and is transferred securely. In Apigee hybrid, TLS is\nenabled by default for any communication between Cassandra nodes and between clients and\nCassandra nodes.\n\n\nYou can configure the authentication using username/password combinations either\nplaced directly in the overrides file or added to a Kubernetes Secret, as explained in this topic.\n\nAbout Cassandra user authentication\n-----------------------------------\n\n\nThe hybrid platform uses Cassandra as the backend datastore for runtime\nplane data. By default, any of the client communications to Cassandra\nrequire authentication. There are multiple client users that communicate\nwith Cassandra. Default passwords are provided for these users. See\n[Changing\nthe default passwords in the overrides file](#changing-the-default-passwords-in-the-overrides-file) for the steps required\nto change the default passwords.\n\nThese users,\nincluding a default user, are described below:\n\n1. **DML User**: Used by the client to read and write data to Cassandra (KMS, KVM, Cache and Quota).\n2. **DDL User:** Used by MART for any of the data definition tasks like keyspace creation, update, and deletion.\n3. **Admin User:** Used for any administrative activities performed on cassandra cluster.\n4. **Default Cassandra user:** Cassandra creates a default user when Authentication is enabled and the username is `cassandra`\n5. **JMX User:** Used to authenticate and communicate with the Cassandra JMX interface.\n6. **Jolokia User:** Used to authenticate and communicate with the Cassandra JMX API.\n\nAbout the default Cassandra user\n--------------------------------\n\n\nWhen Apigee hybrid cluster is created and Cassandra authentication is enabled, the initial user account is the default Cassandra user, identified by the username `cassandra`. The default `cassandra` user functions as a superuser, responsible for tasks such as adding user roles and modifying the database schema.\n\n\nThe Apigee hybrid `apigee-cassandra-user-setup` job utilizes the default `cassandra` user to establish new roles and update the password associated with this default user. The execution of the `apigee-cassandra-user-setup` job occurs during the initial installation of an Apigee hybrid instance, subsequent instance upgrades, and the provisioning of a new instance as part of region expansion.\n\n\nWhen the Apigee hybrid `apigee-cassandra-user-setup` job is executed, the job needs the ability to update and modify database level configurations either as part of a fresh install or an upgrade. The default `cassandra` user is the only user guaranteed to be present when the `apigee-cassandra-user-setup` job is setting up the new Cassandra pods. Without a known user with superuser access, the Apigee hybrid upgrades and region expansions would not function properly.\n\n\nThe default `cassandra` user password is changed after initial use as part of additional security measures. This means even if the default `cassandra` user is still enabled, the new password must be known to use the default `cassandra` user. The default `cassandra` user is not used by any other components except `apigee-cassandra-user-setup` job as part of the new install and region expansion.\n\nChanging the default passwords in the overrides file\n----------------------------------------------------\n\n\nAs a security best practice, we recommend changing the default passwords for Cassandra. You can do so in the\n`overrides.yaml` file. Add the following configuration, change the default\npasswords as you wish, and apply the change to your cluster. See\n[`cassandra`](/apigee/docs/hybrid/v1.11/config-prop-ref#cassandra). You can view the default passwords\nin your `values.yaml` file.\n| **Note:** You can only change these defaults at the time of initial setup. Password rotation or change after hybrid setup is not possible.\nAll the usernames must be in lowercase and no special characters are allowed. \n\n```actionscript-3\ncassandra:\n auth:\n default: ## the password for the new default user (static username: cassandra)\n password: \"\u003cvar translate=\"no\"\u003eNEW_PASSWORD\u003c/var\u003e\"\n admin: ## the password for the admin user (static username: admin_user)\n password: \"\u003cvar translate=\"no\"\u003eNEW_PASSWORD\u003c/var\u003e\"\n ddl: ## the password for the DDL User (static username: ddl_user)\n password: \"\u003cvar translate=\"no\"\u003eNEW_PASSWORD\u003c/var\u003e\"\n dml: ## the password for the DML User (static username: dml_user)\n password: \"\u003cvar translate=\"no\"\u003eNEW_PASSWORD\u003c/var\u003e\"\n jmx:\n username: \"jmxuser\" ## the username for the JMX User\n password: \"\u003cvar translate=\"no\"\u003eNEW_PASSWORD\u003c/var\u003e\" ## the password for the JMX User\n jolokia:\n username: \"jolokiauser\" ## the username to access jolokia interface\n password: \"\u003cvar translate=\"no\"\u003eNEW_PASSWORD\u003c/var\u003e\" ## the password for jolokia user\n```\n\n\nNote the following:\n\n- Certificate Authority (CA) rotation is not supported.\n- A server certificate which is generated with passphrase is not supported.\n\nSetting usernames and passwords in a Kubernetes Secret\n------------------------------------------------------\n\n\nThis section\nexplains how to configure Cassandra to use Kubernetes Secrets for authentication.\n\n### Create the Secret\n\n\nUse the following template to configure the Kubernetes Secret. Save the template\nto a YAML file and edit the required attributes, for example `my-secret.yaml`.\nNote that if you use this option, you must provide the usernames with each password. \n\n```actionscript-3\napiVersion: v1\nkind: Secret\nmetadata:\n name: SECRET_NAME\n namespace: APIGEE_NAMESPACE\ntype: Opaque\ndata:\n default.password: DEFAULT_PASSWORD #base64-encoded string\n admin.user: ADMIN_USERNAME #base64-encoded string\n admin.password: ADMIN_PASSWORD #base64-encoded string\n dml.user: DML_USERNAME #base64-encoded string\n dml.password: DML_PASSWORD #base64-encoded string\n ddl.user: DDL_USERNAME #base64-encoded string\n ddl.password: DDL_PASSWORD #base64-encoded string\n jmx.user: JMX_USERNAME #base64-encoded string\n jmx.password: JMX_PASSWORD #base64-encoded string\n jolokia.user: JOLOKIA_USERNAME #base64-encoded string\n jolokia.password: JOLOKIA_PASSWORD #base64-encoded string\n \n```\n\n\nWhere \u003cvar translate=\"no\"\u003eSECRET_NAME\u003c/var\u003e is the name you choose for the Secret, \u003cvar translate=\"no\"\u003eAPIGEE_NAMESPACE\u003c/var\u003e\nis the namespace where the Apigee pods are deployed (default is `apigee`),\nand each \u003cvar translate=\"no\"\u003e_USERNAME\u003c/var\u003e and \u003cvar translate=\"no\"\u003e_PASSWORD\u003c/var\u003e are the usernames and passwords for each\nuser. Note that the username and password must be Base64-encoded.\n\n\nApply the Secret to the cluster. For example: \n\n```\nkubectl apply -f SECRET_FILE\n```\n\n\nAdd the Secret to your overrides file: \n\n```actionscript-3\ncassandra:\n auth:\n secret: SECRET_NAME\n```\n\n\nApply the updated Cassandra override to the cluster:\n\n### Helm\n\n```\nhelm upgrade datastore apigee-datastore/ \\\n--namespace apigee \\\n--atomic \\\n-f OVERRIDES_FILE.yaml\n```\n| **Note:** If you see an error saying `Error: UPGRADE FAILED: \"datastore\" has no deployed releases`, replace `upgrade` with `install` and try the command again.\n\n### `apigeectl`\n\n```\n$APIGEECTL_HOME/apigeectl apply -f OVERRIDES_FILE.yaml --datastore\n```\n\nCheck the Cassandra logs\n------------------------\n\n\nCheck the logs as soon as Cassandra starts up. The log below shows you that the\nCassandra client connections are encrypted. \n\n```\nkubectl logs apigee-cassandra-2 -n apigee -f\n\nINFO 00:44:36 Starting listening for CQL clients on /10.0.2.12:9042 (encrypted)...\nINFO 00:44:36 Binding thrift service to /10.0.2.12:9160\nINFO 00:44:36 enabling encrypted thrift connections between client and server\nINFO 00:44:36 Listening for thrift clients...\n```"]]
