Configuring TLS for Cassandra

You are currently viewing version 1.4 of the Apigee hybrid documentation. This version is end of life. You should upgrade to a newer version. For more information, see Supported versions.

Version 1.4 (unsupported)

   Supported versions:

• v1.13 (latest)                        
• v1.12                         
• v1.11                         
• List of supported versions

   Unsupported versions:

• v1.10                                      
• v1.9                                         
• v1.8                                         
• v1.7                                         
• v1.6                                         
• v1.5                                         
• v1.4                                         
• v1.3                                         
• v1.2                                         
• v1.1                                         

This topic explains how to configure authentication for communication between Cassandra nodes and between clients and Cassandra nodes.

How to configure TLS for Cassandra in the runtime plane

Cassandra provides secure communication between a client machine and a database cluster and between nodes within a cluster. Enabling encryption ensures that data in flight is not compromised and is transferred securely. In Apigee hybrid, TLS is enabled by default for any communication between Cassandra nodes and between clients and Cassandra nodes.

You can configure the authentication using username/password combinations either placed directly in the overrides file or added to a Kubernetes Secret, as explained in this topic.

About Cassandra user authentication

The hybrid platform uses Cassandra as the backend datastore for runtime plane data. By default, any of the client communications to Cassandra requires authentication. There are three users used by clients that communicate with Cassandra. Default passwords are provided for these users, and you are not required to change them.

These users, including a default user, are described below:

• DML User: Used by the client communication to read and write data to Cassandra (KMS, KVM, Cache and Quota).
• DDL User: Used by MART for any of the data definition tasks like keyspace creation, update, and deletion.
• Admin User: Used for any administrative activities performed on cassandra cluster.
• Default Cassandra user: Cassandra creates a default user when Authentication is enabled and the username is cassandra
• JMX User: Used to authenticate and communicate with the Cassandra JMX interface.
• Jolokia User: Used to authenticate and communicate with the Cassandra JMX API.

Changing the default passwords in the overrides file

Apigee hybrid provides default passwords for the Cassandra users. If you want to change the default user passwords, you can do so in the overrides.yaml file. Add the following configuration, change the default passwords ("iloveapis123") as you wish, and apply the change to your cluster.

Note: You can only change these defaults at the time of initial setup. Password rotation or change after hybrid setup is not possible.

All the usernames must be in lowercase and no special characters are allowed.

cassandra:
   auth:
     default:  ## the password for the new default user (static username: cassandra)
       password: "iloveapis123"
     admin: ## the password for the admin user (static username: admin_user)
       password: "iloveapis123"
     ddl: ## the password for the DDL User (static username: ddl_user)
       password: "iloveapis123"
     dml: ## the password for the DML User (static username: dml_user)
       password: "iloveapis123"
     jmx:
       username: "jmxuser" ## the username for the JMX User
       password: "iloveapis123" ## the password for the JMX User
     jolokia:
       username: "jolokiauser" ## the username to access jolokia interface
       password: "iloveapis123" ## the password for jolokia user

Note the following:

• Certificate Authority (CA) rotation is not supported.
• A server certificate which is generated with passphrase is not supported.

Setting usernames and passwords in a Kubernetes Secret

This section explains how to configure Cassandra to use Kubernetes Secrets for authentication.

Create the Secret

Use the following template to configure the Kubernetes Secret. Save the template to a file and edit the required attributes. Note that if you use this option, you must provide the usernames with each password.

apiVersion: v1
kind: Secret
metadata:
  name: $SECRET_NAME
  namespace: $APIGEE_NAMESPACE
type: Opaque
data:
  default.password: $PASSWORD   #base64-encoded string
  admin.user: $USERNAME   #base64-encoded string
  admin.password: $PASSWORD   #base64-encoded string
  dml.user: $USERNAME   #base64-encoded string
  dml.password: $PASSWORD   #base64-encoded string
  ddl.user: $USERNAME   #base64-encoded string
  ddl.password: $PASSWORD   #base64-encoded string
  jmx.user: $USERNAME   #base64-encoded string
  jmx.password: $PASSWORD   #base64-encoded string
  jolokia.user: $USERNAME   #base64-encoded string
  jolokia.password: $PASSWORD   #base64-encoded string
  

Where $SECRET_NAME is the name you choose for the Secret, $APIGEE_NAMESPACE is the namespace where the Apigee pods are deployed (default is apigee), and $USERNAME and $PASSWORD are the usernames and passwords for each user. Note that the username and password must be Base64-encoded.

Apply the Secret to the cluster. For example:

kubectl apply -f $SECRET_FILE

Add the Secret to your overrides file:

cassandra:
  auth:
    secret: $SECRET_NAME

Apply the updated Cassandra override to the cluster:

$APIGEECTL_HOME/apigeectl apply -f overrides/overrides.yaml --datastore

Check the Cassandra logs

Check the logs as soon as Cassandra starts up. The log below shows you that the Cassandra client connections are encrypted.

kubectl logs apigee-cassandra-2 -n apigee -f

INFO  00:44:36 Starting listening for CQL clients on /10.0.2.12:9042 (encrypted)...
INFO  00:44:36 Binding thrift service to /10.0.2.12:9160
INFO  00:44:36 enabling encrypted thrift connections between client and server
INFO  00:44:36 Listening for thrift clients...