Durante a rotação de credenciais do Cassandra em várias regiões no Apigee hybrid, após a rotação da primeira região, as rotações nas regiões subsequentes falham e são registados erros nos registos do pod de rotação de segredos.
Mensagem de erro
Vê o seguinte nos registos:
failed to run secret rotation: failed to create new users: failed to create new users
Solução alternativa para o problema conhecido 397693324
Diagnóstico
O recurso SecretRotation indica uma falha no campo Status:
Os registos do pod da tarefa de rotação de segredos contêm o seguinte erro:
failed to run secret rotation: failed to create new users: failed to create new users
Os registos do pod create-new-users-job contêm o seguinte erro:
Error creating clients with updated password: gocql: unable to create session: unable to discover protocol version: Provided username cassandra and/or password are incorrect
Resolução
Execute os seguintes passos.
Em todas as regiões, exceto na primeira, atualize a palavra-passe do utilizador predefinido do Cassandra (cassandra)
para o valor rotativo novo no valor antigoSecret.
Continue com o processo de rotação normal e este deve ser bem-sucedido.
Tem de recolher informações de diagnóstico
Se o problema persistir mesmo depois de seguir as instruções acima,
reúna as seguintes informações de diagnóstico e, em seguida, contacte o apoio ao cliente do Google Cloud:
Além dos dados habituais que lhe podem ser pedidos, recolha os registos de todos os pods de rotação de segredos.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-08-21 UTC."],[[["\u003cp\u003eThis document addresses a specific issue encountered during multi-region Cassandra credential rotation in Apigee hybrid, exclusively.\u003c/p\u003e\n"],["\u003cp\u003eThe problem occurs after the first region's rotation, causing subsequent region rotations to fail, indicated by an error message: \u003ccode\u003efailed to run secret rotation: failed to create new users: failed to create new users\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eThe root cause is identified by error messages in both \u003ccode\u003eSecretRotation\u003c/code\u003e resource status and \u003ccode\u003ecreate-new-users-job\u003c/code\u003e pod logs, signaling incorrect username and/or password issues.\u003c/p\u003e\n"],["\u003cp\u003eThe resolution involves updating the default Cassandra user's password in the old \u003ccode\u003eSecret\u003c/code\u003e to match the new rotated value in every region except the first, and then reapplying that updated secret.\u003c/p\u003e\n"],["\u003cp\u003eIf the problem persists after the resolution steps, users should gather logs from all secret rotation pods and contact Google Cloud Customer Care for further assistance.\u003c/p\u003e\n"]]],[],null,["# Troubleshooting Cassandra credential rotation\n\n*You're viewing **Apigee** and **Apigee hybrid** documentation.\nThere is no equivalent\n[Apigee Edge](https://docs.apigee.com/api-platform/get-started/get-started) documentation for this topic.*\n| **Note:** This document is applicable for Apigee hybrid users only.\n\nSymptom\n-------\n\n\nDuring multi-region Cassandra credential rotation in Apigee hybrid, after the first region is\nrotated, rotations in subsequent regions fail and errors are logged in the secret rotation pod logs.\n\nError message\n-------------\n\nYou see the following in the logs: \n\n```text\nfailed to run secret rotation: failed to create new users: failed to create new users\n```\n\nWorkaround for Known Issue 397693324\n------------------------------------\n\n### Diagnosis\n\n\nThe `SecretRotation` resource indicates a failure in the `Status` field: \n\n```actionscript-3\nStatus:\n Message: initiated automated rollback\n State: error\n```\n\n\nThe secret rotation job pod logs contain the following error: \n\n```text\nfailed to run secret rotation: failed to create new users: failed to create new users\n```\n\n\nThe `create-new-users-job` pod logs contain the following error: \n\n```text\nError creating clients with updated password: gocql: unable to create session: unable to discover protocol version: Provided username cassandra and/or password are incorrect\n```\n\n### Resolution\n\n\nPerform the following steps.\n\n1.\n In every region except the first, update the default Cassandra user (`cassandra`)\n password to the **new** rotated value in the **old** `Secret`.\n\n ```actionscript-3\n apiVersion: v1\n kind: Secret\n metadata:\n name: OLD_SECRET_NAME # oldSecretRef\n namespace: APIGEE_NAMESPACE\n type: Opaque\n data:\n default.password: NEW_DEFAULT_PASSWORD #base64-encoded string\n admin.user: OLD_ADMIN_USERNAME #base64-encoded string\n admin.password: OLD_ADMIN_PASSWORD #base64-encoded string\n dml.user: OLD_DML_USERNAME #base64-encoded string\n dml.password: OLD_DML_PASSWORD #base64-encoded string\n ddl.user: OLD_DDL_USERNAME #base64-encoded string\n ddl.password: OLD_DDL_PASSWORD #base64-encoded string\n jmx.user: OLD_JMX_USERNAME #base64-encoded string\n jmx.password: OLD_JMX_PASSWORD #base64-encoded string\n jolokia.user: OLD_JOLOKIA_USERNAME #base64-encoded string\n jolokia.password: OLD_JOLOKIA_PASSWORD #base64-encoded string\n \n ```\n2.\n Apply the updated `Secret`:\n\n ```scdoc\n kubectl apply -f OLD_SECRET_FILE\n ```\n3.\n Continue with the normal rotation process and it should succeed.\n\nMust gather diagnostic information\n----------------------------------\n\n\nIf the problem persists even after following the above instructions,\ngather the following diagnostic information and then contact [Google Cloud Customer Care](https://cloud.google.com/support-hub/):\n\n-\n In addition to the usual data you might be asked to provide, collect the\n logs from all the secret rotation pods."]]
