kubectl logs apigee-cassandra-2 -n apigee -f
INFO 00:44:36 Starting listening for CQL clients on /10.0.2.12:9042 (encrypted)...
INFO 00:44:36 Binding thrift service to /10.0.2.12:9160
INFO 00:44:36 enabling encrypted thrift connections between client and server
INFO 00:44:36 Listening for thrift clients...
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-08-18 (世界標準時間)。"],[[["\u003cp\u003eApigee hybrid uses Cassandra as its backend datastore, and TLS encryption is enabled by default for all communications between Cassandra nodes and clients to ensure data security.\u003c/p\u003e\n"],["\u003cp\u003eCassandra authentication can be configured using username/password combinations directly in the \u003ccode\u003eoverrides.yaml\u003c/code\u003e file or within a Kubernetes Secret, although default passwords are provided for the various users, including DML, DDL, Admin, Default, JMX, and Jolokia users.\u003c/p\u003e\n"],["\u003cp\u003eYou can modify the default passwords for Cassandra users in the \u003ccode\u003eoverrides.yaml\u003c/code\u003e file during the initial setup, but subsequent password rotation or changes are not supported.\u003c/p\u003e\n"],["\u003cp\u003eTo use Kubernetes Secrets for authentication, you must provide Base64-encoded usernames and passwords in a specific Secret template, then reference the Secret in your \u003ccode\u003eoverrides.yaml\u003c/code\u003e file.\u003c/p\u003e\n"],["\u003cp\u003eThe Cassandra logs can be used to verify that client connections are encrypted, confirming the secure setup of Cassandra.\u003c/p\u003e\n"]]],[],null,["# Configuring TLS for Cassandra\n\n| You are currently viewing version 1.4 of the Apigee hybrid documentation. **This version is end of life.** You should upgrade to a newer version. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\n\nThis topic explains how to configure authentication for communication between\nCassandra nodes and between clients and Cassandra nodes.\n\nHow to configure TLS for Cassandra in the runtime plane\n-------------------------------------------------------\n\n\nCassandra provides secure communication between a client machine and a database\ncluster and between nodes within a cluster. Enabling encryption ensures that data\nin flight is not compromised and is transferred securely. In Apigee hybrid, TLS is\nenabled by default for any communication between Cassandra nodes and between clients and\nCassandra nodes.\n\n\nYou can configure the authentication using username/password combinations either\nplaced directly in the overrides file or added to a Kubernetes Secret, as explained in this topic.\n\nAbout Cassandra user authentication\n-----------------------------------\n\n\nThe hybrid platform uses Cassandra as the backend datastore for runtime\nplane data. By default, any of the client communications to Cassandra\nrequires authentication. There are three users used by clients that communicate\nwith Cassandra. Default passwords are provided for these users, and you are not\nrequired to change them.\n\nThese users,\nincluding a default user, are described below:\n\n- **DML User**: Used by the client communication to read and write data to Cassandra (KMS, KVM, Cache and Quota).\n- **DDL User:** Used by MART for any of the data definition tasks like keyspace creation, update, and deletion.\n- **Admin User:** Used for any administrative activities performed on cassandra cluster.\n- **Default Cassandra user:** Cassandra creates a default user when Authentication is enabled and the username is `cassandra`\n- **JMX User:** Used to authenticate and communicate with the Cassandra JMX interface.\n- **Jolokia User:** Used to authenticate and communicate with the Cassandra JMX API.\n\nChanging the default passwords in the overrides file\n----------------------------------------------------\n\n\nApigee hybrid provides default passwords for the Cassandra users. If you want to change\nthe default user passwords, you can do so in the\n`overrides.yaml` file. Add the following configuration, change the default\npasswords (\"iloveapis123\") as you wish, and apply the change to\nyour cluster.\n| **Note:** You can only change these defaults at the time of initial setup. Password rotation or change after hybrid setup is not possible.\nAll the usernames must be in lowercase and no special characters are allowed. \n\n```actionscript-3\ncassandra:\n auth:\n default: ## the password for the new default user (static username: cassandra)\n password: \"iloveapis123\"\n admin: ## the password for the admin user (static username: admin_user)\n password: \"iloveapis123\"\n ddl: ## the password for the DDL User (static username: ddl_user)\n password: \"iloveapis123\"\n dml: ## the password for the DML User (static username: dml_user)\n password: \"iloveapis123\"\n jmx:\n username: \"jmxuser\" ## the username for the JMX User\n password: \"iloveapis123\" ## the password for the JMX User\n jolokia:\n username: \"jolokiauser\" ## the username to access jolokia interface\n password: \"iloveapis123\" ## the password for jolokia user\n```\n\n\nNote the following:\n\n- Certificate Authority (CA) rotation is not supported.\n- A server certificate which is generated with passphrase is not supported.\n\nSetting usernames and passwords in a Kubernetes Secret\n------------------------------------------------------\n\n\nThis section\nexplains how to configure Cassandra to use Kubernetes Secrets for authentication.\n\n### Create the Secret\n\n\nUse the following template to configure the Kubernetes Secret. Save the template\nto a file and edit the required attributes. Note that if you use this option, you\nmust provide the usernames with each password. \n\n```actionscript-3\napiVersion: v1\nkind: Secret\nmetadata:\n name: $SECRET_NAME\n namespace: $APIGEE_NAMESPACE\ntype: Opaque\ndata:\n default.password: $PASSWORD #base64-encoded string\n admin.user: $USERNAME #base64-encoded string\n admin.password: $PASSWORD #base64-encoded string\n dml.user: $USERNAME #base64-encoded string\n dml.password: $PASSWORD #base64-encoded string\n ddl.user: $USERNAME #base64-encoded string\n ddl.password: $PASSWORD #base64-encoded string\n jmx.user: $USERNAME #base64-encoded string\n jmx.password: $PASSWORD #base64-encoded string\n jolokia.user: $USERNAME #base64-encoded string\n jolokia.password: $PASSWORD #base64-encoded string\n \n```\n\n\nWhere \u003cvar translate=\"no\"\u003e$SECRET_NAME\u003c/var\u003e is the name you choose for the Secret, \u003cvar translate=\"no\"\u003e$APIGEE_NAMESPACE\u003c/var\u003e\nis the namespace where the Apigee pods are deployed (default is `apigee`), and \u003cvar translate=\"no\"\u003e$USERNAME\u003c/var\u003e\nand \u003cvar translate=\"no\"\u003e$PASSWORD\u003c/var\u003e are the usernames and passwords for each user. Note that the\nusername and password must be Base64-encoded.\n\n\nApply the Secret to the cluster. For example: \n\n```\nkubectl apply -f $SECRET_FILE\n```\n\n\nAdd the Secret to your overrides file: \n\n```actionscript-3\ncassandra:\n auth:\n secret: $SECRET_NAME\n```\n\n\nApply the updated Cassandra override to the cluster: \n\n```\n$APIGEECTL_HOME/apigeectl apply -f overrides/overrides.yaml --datastore\n```\n\nCheck the Cassandra logs\n------------------------\n\n\nCheck the logs as soon as Cassandra starts up. The log below shows you that the\nCassandra client connections are encrypted. \n\n```\nkubectl logs apigee-cassandra-2 -n apigee -f\n\nINFO 00:44:36 Starting listening for CQL clients on /10.0.2.12:9042 (encrypted)...\nINFO 00:44:36 Binding thrift service to /10.0.2.12:9160\nINFO 00:44:36 enabling encrypted thrift connections between client and server\nINFO 00:44:36 Listening for thrift clients...\n```"]]
