This topic explains how to configure authentication for communication between Cassandra nodes and between clients and Cassandra nodes.
How to configure authentication for Cassandra in the runtime plane
Cassandra provides secure communication between a client machine and a database cluster and between nodes within a cluster. Enabling encryption ensures that data in flight is not compromised and is transferred securely. In Apigee hybrid, TLS is enabled by default for any communication between Cassandra nodes and between clients and Cassandra nodes.
You can configure the authentication using username/password combinations either placed directly in the overrides file or added to a Kubernetes Secret, as explained in this topic.
About Cassandra user authentication
The hybrid platform uses Cassandra as the backend datastore for runtime plane data. By default, any of the client communications to Cassandra require authentication. There are multiple client users that communicate with Cassandra. Default passwords are provided for these users. See Changing the default passwords in the overrides file for the steps required to change the default passwords.
These users, including a default user, are described below:
- DML User: Used by the client to read and write data to Cassandra (KMS, KVM, Cache and Quota).
- DDL User: Used by MART for any of the data definition tasks like keyspace creation, update, and deletion.
- Admin User: Used for any administrative activities performed on cassandra cluster.
- Default Cassandra user: Cassandra creates a default user when
Authentication is enabled and the username is
cassandra
- JMX User: Used to authenticate and communicate with the Cassandra JMX interface.
- Jolokia User: Used to authenticate and communicate with the Cassandra JMX API.
About the default Cassandra user
When Apigee hybrid cluster is created and Cassandra authentication is enabled, the initial user account is the default Cassandra user, identified by the username cassandra
. The default cassandra
user functions as a superuser, responsible for tasks such as adding user roles and modifying the database schema.
The Apigee hybrid apigee-cassandra-user-setup
job utilizes the default cassandra
user to establish new roles and update the password associated with this default user. The execution of the apigee-cassandra-user-setup
job occurs during the initial installation of an Apigee hybrid instance, subsequent instance upgrades, and the provisioning of a new instance as part of region expansion.
When the Apigee hybrid apigee-cassandra-user-setup
job is executed, the job needs the ability to update and modify database level configurations either as part of a fresh install or an upgrade. The default cassandra
user is the only user guaranteed to be present when the apigee-cassandra-user-setup
job is setting up the new Cassandra pods. Without a known user with superuser access, the Apigee hybrid upgrades and region expansions would not function properly.
The default cassandra
user password is changed after initial use as part of additional security measures. This means even if the default cassandra
user is still enabled, the new password must be known to use the default cassandra
user. The default cassandra
user is not used by any other components except apigee-cassandra-user-setup
job as part of the new install and region expansion.
Changing the default passwords in the overrides file
As a security best practice, we recommend changing the default passwords for Cassandra. You can do so in the
overrides.yaml
file. Add the following configuration, change the default
passwords as you wish, and apply the change to your cluster. See
cassandra
. You can view the default passwords
in your values.yaml
file.
cassandra: auth: default: ## the password for the new default user (static username: cassandra) password: "NEW_PASSWORD" admin: ## the password for the admin user (static username: admin_user) password: "NEW_PASSWORD" ddl: ## the password for the DDL User (static username: ddl_user) password: "NEW_PASSWORD" dml: ## the password for the DML User (static username: dml_user) password: "NEW_PASSWORD" jmx: username: "jmxuser" ## the username for the JMX User password: "NEW_PASSWORD" ## the password for the JMX User jolokia: username: "jolokiauser" ## the username to access jolokia interface password: "NEW_PASSWORD" ## the password for jolokia user
Note the following:
- Certificate Authority (CA) rotation is not supported.
- A server certificate which is generated with passphrase is not supported.
Setting usernames and passwords in a Kubernetes Secret
This section explains how to configure Cassandra to use Kubernetes Secrets for authentication.
Create the Secret
Use the following template to configure the Kubernetes Secret. Save the template
to a YAML file and edit the required attributes, for example my-secret.yaml
.
Note that if you use this option, you must provide the usernames with each password.
apiVersion: v1 kind: Secret metadata: name: SECRET_NAME namespace: APIGEE_NAMESPACE type: Opaque data: default.password: DEFAULT_PASSWORD #base64-encoded string admin.user: ADMIN_USERNAME #base64-encoded string admin.password: ADMIN_PASSWORD #base64-encoded string dml.user: DML_USERNAME #base64-encoded string dml.password: DML_PASSWORD #base64-encoded string ddl.user: DDL_USERNAME #base64-encoded string ddl.password: DDL_PASSWORD #base64-encoded string jmx.user: JMX_USERNAME #base64-encoded string jmx.password: JMX_PASSWORD #base64-encoded string jolokia.user: JOLOKIA_USERNAME #base64-encoded string jolokia.password: JOLOKIA_PASSWORD #base64-encoded string
Where SECRET_NAME is the name you choose for the Secret, APIGEE_NAMESPACE
is the namespace where the Apigee pods are deployed (default is apigee
),
and each _USERNAME and _PASSWORD are the usernames and passwords for each
user. Note that the username and password must be Base64-encoded.
Apply the Secret to the cluster. For example:
kubectl apply -f SECRET_FILE
Add the Secret to your overrides file:
cassandra: auth: secret: SECRET_NAME
Apply the updated Cassandra override to the cluster:
Helm
helm upgrade datastore apigee-datastore/ \ --namespace apigee \ --atomic \ -f OVERRIDES_FILE.yaml
apigeectl
$APIGEECTL_HOME/apigeectl apply -f OVERRIDES_FILE.yaml --datastore
Check the Cassandra logs
Check the logs as soon as Cassandra starts up. The log below shows you that the Cassandra client connections are encrypted.
kubectl logs apigee-cassandra-2 -n apigee -f INFO 00:44:36 Starting listening for CQL clients on /10.0.2.12:9042 (encrypted)... INFO 00:44:36 Binding thrift service to /10.0.2.12:9160 INFO 00:44:36 enabling encrypted thrift connections between client and server INFO 00:44:36 Listening for thrift clients...