Risoluzione dei problemi relativi alla rotazione delle credenziali di Cassandra
Mantieni tutto organizzato con le raccolte
Salva e classifica i contenuti in base alle tue preferenze.
Stai visualizzando la documentazione di Apigee e Apigee hybrid.
Non esiste documentazione equivalente di
Apigee Edge per questo argomento.
Sintomo
Durante la rotazione delle credenziali Cassandra multiregione in Apigee Hybrid, dopo la rotazione della prima regione, le rotazioni nelle regioni successive non riescono e gli errori vengono registrati nei log del pod di rotazione delle chiavi.
Messaggio di errore
Nei log viene visualizzato quanto segue:
failed to run secret rotation: failed to create new users: failed to create new users
Soluzione alternativa per il problema noto 397693324
Diagnosi
La risorsa SecretRotation indica un errore nel campo Status:
I log del pod del job di rotazione dei secret contengono il seguente errore:
failed to run secret rotation: failed to create new users: failed to create new users
I log del pod create-new-users-job contengono il seguente errore:
Error creating clients with updated password: gocql: unable to create session: unable to discover protocol version: Provided username cassandra and/or password are incorrect
Risoluzione
Segui questi passaggi.
In ogni regione, tranne nella prima, aggiorna la password predefinita dell'utente Cassandra (cassandra)
con il nuovo valore ruotato nell'Secretvecchio.
Continua con la normale procedura di rotazione e dovrebbe andare a buon fine.
Deve raccogliere informazioni di diagnostica
Se il problema persiste anche dopo aver seguito le istruzioni riportate sopra,
raccogli le seguenti informazioni di diagnostica e poi contatta l'assistenza clienti Google Cloud:
Oltre ai dati usuali che ti potrebbe essere chiesto di fornire, raccogli i log da tutti i pod di rotazione delle chiavi segrete.
[[["Facile da capire","easyToUnderstand","thumb-up"],["Il problema è stato risolto","solvedMyProblem","thumb-up"],["Altra","otherUp","thumb-up"]],[["Difficile da capire","hardToUnderstand","thumb-down"],["Informazioni o codice di esempio errati","incorrectInformationOrSampleCode","thumb-down"],["Mancano le informazioni o gli esempi di cui ho bisogno","missingTheInformationSamplesINeed","thumb-down"],["Problema di traduzione","translationIssue","thumb-down"],["Altra","otherDown","thumb-down"]],["Ultimo aggiornamento 2025-09-04 UTC."],[[["\u003cp\u003eThis document addresses a specific issue encountered during multi-region Cassandra credential rotation in Apigee hybrid, exclusively.\u003c/p\u003e\n"],["\u003cp\u003eThe problem occurs after the first region's rotation, causing subsequent region rotations to fail, indicated by an error message: \u003ccode\u003efailed to run secret rotation: failed to create new users: failed to create new users\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eThe root cause is identified by error messages in both \u003ccode\u003eSecretRotation\u003c/code\u003e resource status and \u003ccode\u003ecreate-new-users-job\u003c/code\u003e pod logs, signaling incorrect username and/or password issues.\u003c/p\u003e\n"],["\u003cp\u003eThe resolution involves updating the default Cassandra user's password in the old \u003ccode\u003eSecret\u003c/code\u003e to match the new rotated value in every region except the first, and then reapplying that updated secret.\u003c/p\u003e\n"],["\u003cp\u003eIf the problem persists after the resolution steps, users should gather logs from all secret rotation pods and contact Google Cloud Customer Care for further assistance.\u003c/p\u003e\n"]]],[],null,["# Troubleshooting Cassandra credential rotation\n\n*You're viewing **Apigee** and **Apigee hybrid** documentation.\nThere is no equivalent\n[Apigee Edge](https://docs.apigee.com/api-platform/get-started/get-started) documentation for this topic.*\n| **Note:** This document is applicable for Apigee hybrid users only.\n\nSymptom\n-------\n\n\nDuring multi-region Cassandra credential rotation in Apigee hybrid, after the first region is\nrotated, rotations in subsequent regions fail and errors are logged in the secret rotation pod logs.\n\nError message\n-------------\n\nYou see the following in the logs: \n\n```text\nfailed to run secret rotation: failed to create new users: failed to create new users\n```\n\nWorkaround for Known Issue 397693324\n------------------------------------\n\n### Diagnosis\n\n\nThe `SecretRotation` resource indicates a failure in the `Status` field: \n\n```actionscript-3\nStatus:\n Message: initiated automated rollback\n State: error\n```\n\n\nThe secret rotation job pod logs contain the following error: \n\n```text\nfailed to run secret rotation: failed to create new users: failed to create new users\n```\n\n\nThe `create-new-users-job` pod logs contain the following error: \n\n```text\nError creating clients with updated password: gocql: unable to create session: unable to discover protocol version: Provided username cassandra and/or password are incorrect\n```\n\n### Resolution\n\n\nPerform the following steps.\n\n1.\n In every region except the first, update the default Cassandra user (`cassandra`)\n password to the **new** rotated value in the **old** `Secret`.\n\n ```actionscript-3\n apiVersion: v1\n kind: Secret\n metadata:\n name: OLD_SECRET_NAME # oldSecretRef\n namespace: APIGEE_NAMESPACE\n type: Opaque\n data:\n default.password: NEW_DEFAULT_PASSWORD #base64-encoded string\n admin.user: OLD_ADMIN_USERNAME #base64-encoded string\n admin.password: OLD_ADMIN_PASSWORD #base64-encoded string\n dml.user: OLD_DML_USERNAME #base64-encoded string\n dml.password: OLD_DML_PASSWORD #base64-encoded string\n ddl.user: OLD_DDL_USERNAME #base64-encoded string\n ddl.password: OLD_DDL_PASSWORD #base64-encoded string\n jmx.user: OLD_JMX_USERNAME #base64-encoded string\n jmx.password: OLD_JMX_PASSWORD #base64-encoded string\n jolokia.user: OLD_JOLOKIA_USERNAME #base64-encoded string\n jolokia.password: OLD_JOLOKIA_PASSWORD #base64-encoded string\n \n ```\n2.\n Apply the updated `Secret`:\n\n ```scdoc\n kubectl apply -f OLD_SECRET_FILE\n ```\n3.\n Continue with the normal rotation process and it should succeed.\n\nMust gather diagnostic information\n----------------------------------\n\n\nIf the problem persists even after following the above instructions,\ngather the following diagnostic information and then contact [Google Cloud Customer Care](https://cloud.google.com/support-hub/):\n\n-\n In addition to the usual data you might be asked to provide, collect the\n logs from all the secret rotation pods."]]
