Configuring TLS for Cassandra

You are currently viewing version 1.2 of the Apigee hybrid documentation. This version is end of life. You should upgrade to a newer version. For more information, see Supported versions.

Version 1.2 (unsupported)

   Supported versions:

• v1.13 (latest)                        
• v1.12                         
• v1.11                         
• List of supported versions

   Unsupported versions:

• v1.10                                      
• v1.9                                         
• v1.8                                         
• v1.7                                         
• v1.6                                         
• v1.5                                         
• v1.4                                         
• v1.3                                         
• v1.2                                         
• v1.1                                         

How to configure TLS for Cassandra in the runtime plane

Cassandra provides secure communication between a client machine and a database cluster and between nodes within a cluster. Enabling encryption ensures that data in flight is not compromised and is transferred securely. In Apigee hybrid, TLS is enabled by default for any communication between Cassandra nodes and between clients and Cassandra nodes.

About Cassandra user authentication

The hybrid platform uses Cassandra as the backend datastore for runtime plane data. By default, any of the client communications to Cassandra requires authentication. There are three users used by clients that communicate with Cassandra. Default passwords are provided for these users, and you are not required to change them.

These users, including a default user, are described below:

• DML User: Used by the client communication to read and write data to Cassandra (KMS, KVM, Cahce and Quota).
• DDL User: Used by MART for any of the data definition tasks like keyspace creation, update, and deletion.
• Admin User: Used for any administrative activities performed on cassandra cluster.
• Default Cassandra user: Cassandra creates a default user when Authentication is enabled and the username is cassandra

Changing the default passwords

Apigee hybrid provides default passwords for the Cassandra users. If you want to change the default user passwords, you can do so in the overrides.yaml file. Add the following configuration, change the default passwords ("iloveapis123") as you wish, and apply the change to your cluster.

All the usernames must be in lowercase.

cassandra:
   auth:
     default:  ## the password for the new default user (static username: cassandra)
       password: "iloveapis123"
     admin: ## the password for the admin user (static username: admin_user)
       password: "iloveapis123"
     ddl: ## the password for the DDL User (static username: ddl_user)
       password: "iloveapis123"
     dml: ## the password for the DML User (static username: dml_user)
       password: "iloveapis123"

Note the following:

• Certificate Authority (CA) rotation is not supported.
• A server certificate which is generated with passphrase is not supported.

Check the Cassandra logs

Check the logs as soon as the Cassandra starts up. The log below shows you that the Cassandra client connections are encrypted.

kubectl logs apigee-cassandra-2 -n apigee -f

INFO  00:44:36 Starting listening for CQL clients on /10.0.2.12:9042 (encrypted)...
INFO  00:44:36 Binding thrift service to /10.0.2.12:9160
INFO  00:44:36 enabling encrypted thrift connections between client and server
INFO  00:44:36 Listening for thrift clients...