Configuring authentication for Cassandra

You are currently viewing version 1.10 of the Apigee hybrid documentation. For more information, see Supported versions.

Version 1.10 

   Supported versions:

• v1.13 (latest)                        
• v1.12                         
• v1.11                         
• List of supported versions

   Unsupported versions:

• v1.10                                      
• v1.9                                         
• v1.8                                         
• v1.7                                         
• v1.6                                         
• v1.5                                         
• v1.4                                         
• v1.3                                         
• v1.2                                         
• v1.1                                         

This topic explains how to configure authentication for communication between Cassandra nodes and between clients and Cassandra nodes.

How to configure authentication for Cassandra in the runtime plane

Cassandra provides secure communication between a client machine and a database cluster and between nodes within a cluster. Enabling encryption ensures that data in flight is not compromised and is transferred securely. In Apigee hybrid, TLS is enabled by default for any communication between Cassandra nodes and between clients and Cassandra nodes.

You can configure the authentication using username/password combinations either placed directly in the overrides file or added to a Kubernetes Secret, as explained in this topic.

About Cassandra user authentication

The hybrid platform uses Cassandra as the backend datastore for runtime plane data. By default, any of the client communications to Cassandra require authentication. There are multiple client users that communicate with Cassandra. Default passwords are provided for these users. See Changing the default passwords in the overrides file for the steps required to change the default passwords.

These users, including a default user, are described below:

1. DML User: Used by the client communication to read and write data to Cassandra (KMS, KVM, Cache and Quota).
2. DDL User: Used by MART for any of the data definition tasks like keyspace creation, update, and deletion.
3. Admin User: Used for any administrative activities performed on cassandra cluster.
4. Default Cassandra user: Cassandra creates a default user when Authentication is enabled and the username is cassandra
5. JMX User: Used to authenticate and communicate with the Cassandra JMX interface.
6. Jolokia User: Used to authenticate and communicate with the Cassandra JMX API.

About the default Cassandra user

When Apigee hybrid cluster is created and Cassandra authentication is enabled, the initial user account is the default Cassandra user, identified by the username cassandra. The default cassandra user functions as a superuser, responsible for tasks such as adding user roles and modifying the database schema.

The Apigee hybrid apigee-cassandra-user-setup job utilizes the default cassandra user to establish new roles and update the password associated with this default user. The execution of the apigee-cassandra-user-setup job occurs during the initial installation of an Apigee hybrid instance, subsequent instance upgrades, and the provisioning of a new instance as part of region expansion.

When the Apigee hybrid apigee-cassandra-user-setup job is executed, the job needs the ability to update and modify database level configurations either as part of a fresh install or an upgrade. The default cassandra user is the only user guaranteed to be present when the apigee-cassandra-user-setup job is setting up the new Cassandra pods. Without a known user with superuser access, the Apigee hybrid upgrades and region expansions would not function properly.

The default cassandra user password is changed after initial use as part of additional security measures. This means even if the default cassandra user is still enabled, the new password must be known to use the default cassandra user. The default cassandra user is not used by any other components except apigee-cassandra-user-setup job as part of the new install and region expansion.

Changing the default passwords in the overrides file

As a security best practice, we recommend you change the default passwords for Cassandra. You can do so in the overrides.yaml file. Add the following configuration, change the default passwords as you wish, and apply the change to your cluster.

Note: You can only change these defaults at the time of initial setup. Password rotation or change after hybrid setup is not possible.

All the usernames must be in lowercase and no special characters are allowed.

cassandra:
   auth:
     default:  ## the password for the new default user (static username: cassandra)
       password: "NEW_PASSWORD"
     admin: ## the password for the admin user (static username: admin_user)
       password: "NEW_PASSWORD"
     ddl: ## the password for the DDL User (static username: ddl_user)
       password: "NEW_PASSWORD"
     dml: ## the password for the DML User (static username: dml_user)
       password: "NEW_PASSWORD"
     jmx:
       username: "jmxuser" ## the username for the JMX User
       password: "NEW_PASSWORD" ## the password for the JMX User
     jolokia:
       username: "jolokiauser" ## the username to access jolokia interface
       password: "NEW_PASSWORD" ## the password for jolokia user

Note the following:

• Certificate Authority (CA) rotation is not supported.
• A server certificate which is generated with passphrase is not supported.

Setting usernames and passwords in a Kubernetes Secret

This section explains how to configure Cassandra to use Kubernetes Secrets for authentication.

Create the Secret

Use the following template to configure the Kubernetes Secret. Save the template to a YAML file and edit the required attributes, for example my-secret.yaml. Note that if you use this option, you must provide the usernames with each password.

apiVersion: v1
kind: Secret
metadata:
  name: SECRET_NAME
  namespace: APIGEE_NAMESPACE
type: Opaque
data:
  default.password: DEFAULT_PASSWORD   #base64-encoded string
  admin.user: ADMIN_USERNAME   #base64-encoded string
  admin.password: ADMIN_PASSWORD   #base64-encoded string
  dml.user: DML_USERNAME   #base64-encoded string
  dml.password: DML_PASSWORD   #base64-encoded string
  ddl.user: DDL_USERNAME   #base64-encoded string
  ddl.password: DDL_PASSWORD   #base64-encoded string
  jmx.user: JMX_USERNAME   #base64-encoded string
  jmx.password: JMX_PASSWORD   #base64-encoded string
  jolokia.user: JOLOKIA_USERNAME   #base64-encoded string
  jolokia.password: JOLOKIA_PASSWORD   #base64-encoded string
  

Where SECRET_NAME is the name you choose for the Secret, APIGEE_NAMESPACE is the namespace where the Apigee pods are deployed (default is apigee), and each _USERNAME and _PASSWORD are the usernames and passwords for each user. Note that the username and password must be Base64-encoded.

Apply the Secret to the cluster. For example:

kubectl apply -f SECRET_FILE

Add the Secret to your overrides file:

cassandra:
  auth:
    secret: SECRET_NAME

Apply the updated Cassandra override to the cluster:

$APIGEECTL_HOME/apigeectl apply -f overrides/overrides.yaml --datastore

Check the Cassandra logs

Check the logs as soon as Cassandra starts up. The log below shows you that the Cassandra client connections are encrypted.

kubectl logs apigee-cassandra-2 -n apigee -f

INFO  00:44:36 Starting listening for CQL clients on /10.0.2.12:9042 (encrypted)...
INFO  00:44:36 Binding thrift service to /10.0.2.12:9160
INFO  00:44:36 enabling encrypted thrift connections between client and server
INFO  00:44:36 Listening for thrift clients...