Solucionar problemas de rotación de credenciales de Cassandra
Organízate con las colecciones
Guarda y clasifica el contenido según tus preferencias.
Estás consultando la documentación de Apigee y Apigee Hybrid.
No hay documentación equivalente de
Apigee Edge sobre este tema.
Síntoma
Durante la rotación de credenciales de Cassandra multirregión en Apigee hybrid, después de que se rote la primera región, las rotaciones en las regiones posteriores fallan y se registran errores en los registros del pod de rotación de secretos.
Mensaje de error
En los registros, se muestra lo siguiente:
failed to run secret rotation: failed to create new users: failed to create new users
Solución alternativa para el problema conocido 397693324
Diagnóstico
El recurso SecretRotation indica un fallo en el campo Status:
Los registros del pod del trabajo de rotación de secretos contienen el siguiente error:
failed to run secret rotation: failed to create new users: failed to create new users
Los registros del pod create-new-users-job contienen el siguiente error:
Error creating clients with updated password: gocql: unable to create session: unable to discover protocol version: Provided username cassandra and/or password are incorrect
Resolución
Sigue estos pasos.
En todas las regiones, excepto en la primera, actualiza la contraseña predeterminada del usuario de Cassandra (cassandra)
con el nuevo valor rotado en el antiguoSecret.
Continúa con el proceso de rotación normal y debería completarse correctamente.
Debe recoger información de diagnóstico
Si el problema persiste incluso después de seguir las instrucciones anteriores, recoge la siguiente información de diagnóstico y ponte en contacto con el equipo de Asistencia de Google Cloud:
Además de los datos habituales que se te pueden pedir, recoge los registros de todos los pods de rotación de secretos.
[[["Es fácil de entender","easyToUnderstand","thumb-up"],["Me ofreció una solución al problema","solvedMyProblem","thumb-up"],["Otro","otherUp","thumb-up"]],[["Es difícil de entender","hardToUnderstand","thumb-down"],["La información o el código de muestra no son correctos","incorrectInformationOrSampleCode","thumb-down"],["Me faltan las muestras o la información que necesito","missingTheInformationSamplesINeed","thumb-down"],["Problema de traducción","translationIssue","thumb-down"],["Otro","otherDown","thumb-down"]],["Última actualización: 2025-08-21 (UTC)."],[[["\u003cp\u003eThis document addresses a specific issue encountered during multi-region Cassandra credential rotation in Apigee hybrid, exclusively.\u003c/p\u003e\n"],["\u003cp\u003eThe problem occurs after the first region's rotation, causing subsequent region rotations to fail, indicated by an error message: \u003ccode\u003efailed to run secret rotation: failed to create new users: failed to create new users\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eThe root cause is identified by error messages in both \u003ccode\u003eSecretRotation\u003c/code\u003e resource status and \u003ccode\u003ecreate-new-users-job\u003c/code\u003e pod logs, signaling incorrect username and/or password issues.\u003c/p\u003e\n"],["\u003cp\u003eThe resolution involves updating the default Cassandra user's password in the old \u003ccode\u003eSecret\u003c/code\u003e to match the new rotated value in every region except the first, and then reapplying that updated secret.\u003c/p\u003e\n"],["\u003cp\u003eIf the problem persists after the resolution steps, users should gather logs from all secret rotation pods and contact Google Cloud Customer Care for further assistance.\u003c/p\u003e\n"]]],[],null,["# Troubleshooting Cassandra credential rotation\n\n*You're viewing **Apigee** and **Apigee hybrid** documentation.\nThere is no equivalent\n[Apigee Edge](https://docs.apigee.com/api-platform/get-started/get-started) documentation for this topic.*\n| **Note:** This document is applicable for Apigee hybrid users only.\n\nSymptom\n-------\n\n\nDuring multi-region Cassandra credential rotation in Apigee hybrid, after the first region is\nrotated, rotations in subsequent regions fail and errors are logged in the secret rotation pod logs.\n\nError message\n-------------\n\nYou see the following in the logs: \n\n```text\nfailed to run secret rotation: failed to create new users: failed to create new users\n```\n\nWorkaround for Known Issue 397693324\n------------------------------------\n\n### Diagnosis\n\n\nThe `SecretRotation` resource indicates a failure in the `Status` field: \n\n```actionscript-3\nStatus:\n Message: initiated automated rollback\n State: error\n```\n\n\nThe secret rotation job pod logs contain the following error: \n\n```text\nfailed to run secret rotation: failed to create new users: failed to create new users\n```\n\n\nThe `create-new-users-job` pod logs contain the following error: \n\n```text\nError creating clients with updated password: gocql: unable to create session: unable to discover protocol version: Provided username cassandra and/or password are incorrect\n```\n\n### Resolution\n\n\nPerform the following steps.\n\n1.\n In every region except the first, update the default Cassandra user (`cassandra`)\n password to the **new** rotated value in the **old** `Secret`.\n\n ```actionscript-3\n apiVersion: v1\n kind: Secret\n metadata:\n name: OLD_SECRET_NAME # oldSecretRef\n namespace: APIGEE_NAMESPACE\n type: Opaque\n data:\n default.password: NEW_DEFAULT_PASSWORD #base64-encoded string\n admin.user: OLD_ADMIN_USERNAME #base64-encoded string\n admin.password: OLD_ADMIN_PASSWORD #base64-encoded string\n dml.user: OLD_DML_USERNAME #base64-encoded string\n dml.password: OLD_DML_PASSWORD #base64-encoded string\n ddl.user: OLD_DDL_USERNAME #base64-encoded string\n ddl.password: OLD_DDL_PASSWORD #base64-encoded string\n jmx.user: OLD_JMX_USERNAME #base64-encoded string\n jmx.password: OLD_JMX_PASSWORD #base64-encoded string\n jolokia.user: OLD_JOLOKIA_USERNAME #base64-encoded string\n jolokia.password: OLD_JOLOKIA_PASSWORD #base64-encoded string\n \n ```\n2.\n Apply the updated `Secret`:\n\n ```scdoc\n kubectl apply -f OLD_SECRET_FILE\n ```\n3.\n Continue with the normal rotation process and it should succeed.\n\nMust gather diagnostic information\n----------------------------------\n\n\nIf the problem persists even after following the above instructions,\ngather the following diagnostic information and then contact [Google Cloud Customer Care](https://cloud.google.com/support-hub/):\n\n-\n In addition to the usual data you might be asked to provide, collect the\n logs from all the secret rotation pods."]]
