kubectl logs apigee-cassandra-2 -n apigee -f
INFO 00:44:36 Starting listening for CQL clients on /10.0.2.12:9042 (encrypted)...
INFO 00:44:36 Binding thrift service to /10.0.2.12:9160
INFO 00:44:36 enabling encrypted thrift connections between client and server
INFO 00:44:36 Listening for thrift clients...
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-21。"],[[["\u003cp\u003eThis documentation covers how to configure authentication for communication between Cassandra nodes and between clients and Cassandra nodes in Apigee hybrid, where TLS is enabled by default.\u003c/p\u003e\n"],["\u003cp\u003eApigee hybrid uses Cassandra as its backend datastore, and client communications to Cassandra require authentication, utilizing three main user types: DML, DDL, and Admin.\u003c/p\u003e\n"],["\u003cp\u003eYou can change the default passwords for Cassandra users by modifying the \u003ccode\u003eoverrides.yaml\u003c/code\u003e file, ensuring all usernames are lowercase and contain no special characters.\u003c/p\u003e\n"],["\u003cp\u003eAlternatively, you can configure Cassandra authentication using Kubernetes Secrets, which involves creating a Secret with Base64-encoded usernames and passwords, and then referencing it in your \u003ccode\u003eoverrides.yaml\u003c/code\u003e file.\u003c/p\u003e\n"],["\u003cp\u003eThe Cassandra logs can be checked to verify that the Cassandra client connections are encrypted, showing that secure communication is properly configured.\u003c/p\u003e\n"]]],[],null,["# Configuring TLS for Cassandra\n\n| You are currently viewing version 1.3 of the Apigee hybrid documentation. **This version is end of life.** You should upgrade to a newer version. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\n\nThis topic explains how to configure authentication for communication between\nCassandra nodes and between clients and Cassandra nodes.\n\nHow to configure TLS for Cassandra in the runtime plane\n-------------------------------------------------------\n\n\nCassandra provides secure communication between a client machine and a database\ncluster and between nodes within a cluster. Enabling encryption ensures that data\nin flight is not compromised and is transferred securely. In Apigee hybrid, TLS is\nenabled by default for any communication between Cassandra nodes and between clients and\nCassandra nodes.\n\n\nYou can configure the authentication using username/password combinations either\nplaced directly in the overrides file or added to a Kubernetes Secret, as explained in this topic.\n\nAbout Cassandra user authentication\n-----------------------------------\n\n\nThe hybrid platform uses Cassandra as the backend datastore for runtime\nplane data. By default, any of the client communications to Cassandra\nrequires authentication. There are three users used by clients that communicate\nwith Cassandra. Default passwords are provided for these users, and you are not\nrequired to change them.\n\nThese users,\nincluding a default user, are described below:\n\n- **DML User**: Used by the client communication to read and write data to Cassandra (KMS, KVM, Cahce and Quota).\n- **DDL User:** Used by MART for any of the data definition tasks like keyspace creation, update, and deletion.\n- **Admin User:** Used for any administrative activities performed on cassandra cluster.\n- **Default Cassandra user:** Cassandra creates a default user when Authentication is enabled and the username is `cassandra`\n\nChanging the default passwords in the overrides file\n----------------------------------------------------\n\n\nApigee hybrid provides default passwords for the Cassandra users. If you want to change\nthe default user passwords, you can do so in the\n`overrides.yaml` file. Add the following configuration, change the default\npasswords (\"iloveapis123\") as you wish, and apply the change to\nyour cluster.\nAll the usernames must be in lowercase and no special characters are allowed. \n\n```actionscript-3\ncassandra:\n auth:\n default: ## the password for the new default user (static username: cassandra)\n password: \"iloveapis123\"\n admin: ## the password for the admin user (static username: admin_user)\n password: \"iloveapis123\"\n ddl: ## the password for the DDL User (static username: ddl_user)\n password: \"iloveapis123\"\n dml: ## the password for the DML User (static username: dml_user)\n password: \"iloveapis123\"\n```\n\n\nNote the following:\n\n- Certificate Authority (CA) rotation is not supported.\n- A server certificate which is generated with passphrase is not supported.\n\nSetting usernames and passwords in a Kubernetes Secret\n------------------------------------------------------\n\n\nThis section\nexplains how to configure Cassandra to use Kubernetes Secrets for authentication.\n\n### Create the Secret\n\n\nUse the following template to configure the Kubernetes Secret. Save the template\nto a file and edit the required attributes. Note that if you use this option, you\nmust provide the usernames with each password. \n\n```actionscript-3\napiVersion: v1\nkind: Secret\nmetadata:\n name: $SECRET_NAME\n namespace: $APIGEE_NAMESPACE\ntype: Opaque\ndata:\n default.password: $PASSWORD #base64-encoded string\n admin.user: $USERNAME #base64-encoded string\n admin.password: $PASSWORD #base64-encoded string\n dml.user: $USERNAME #base64-encoded string\n dml.password: $PASSWORD #base64-encoded string\n ddl.user: $USERNAME #base64-encoded string\n ddl.password: $PASSWORD #base64-encoded string\n```\n\n\nWhere \u003cvar translate=\"no\"\u003e$SECRET_NAME\u003c/var\u003e is the name you choose for the Secret, \u003cvar translate=\"no\"\u003e$APIGEE_NAMESPACE\u003c/var\u003e\nis the namespace where the Apigee pods are deployed (default is `apigee`), and \u003cvar translate=\"no\"\u003e$USERNAME\u003c/var\u003e\nand \u003cvar translate=\"no\"\u003e$PASSWORD\u003c/var\u003e are the usernames and passwords for each user. Note that the\nusername and password must be Base64-encoded.\n\n\nApply the Secret to the cluster. For example: \n\n```\nkubectl apply -f $SECRET_FILE\n```\n\n\nAdd the Secret to your overrides file: \n\n```actionscript-3\ncassandra:\n auth:\n secret: $SECRET_NAME\n```\n\n\nApply the updated Cassandra override to the cluster: \n\n```\n$APIGEECTL_HOME/apigeectl apply -f overrides/overrides.yaml -c cassandra\n```\n\nCheck the Cassandra logs\n------------------------\n\n\nCheck the logs as soon as the Cassandra starts up. The log below shows you that the\nCassandra client connections are encrypted. \n\n```\nkubectl logs apigee-cassandra-2 -n apigee -f\n\nINFO 00:44:36 Starting listening for CQL clients on /10.0.2.12:9042 (encrypted)...\nINFO 00:44:36 Binding thrift service to /10.0.2.12:9160\nINFO 00:44:36 enabling encrypted thrift connections between client and server\nINFO 00:44:36 Listening for thrift clients...\n```"]]
