The KUDO Cassandra operator supports Cassandra’s native transport encryption mechanism. The service provides automation and orchestration to simplify the use of these important features. For more information on Apache Cassandra’s security, read the security section of official Apache Cassandra documentation.

By default, KUDO Cassandra nodes use the plaintext protocol for its Node-to-node and Client-to-node communication. It is recommended to enable the TLS encryption, to secure the communication between nodes and client.

Create the TLS certificate to be used for Cassandra TLS encryptions

openssl req -x509 -newkey rsa:4096 -sha256 -nodes -keyout tls.key -out tls.crt -subj "/CN=CassandraCA" -days 365

Create a kubernetes TLS secret using the certificate created in previous step

kubectl create secret tls cassandra-tls -n kudo-cassandra --cert=tls.crt --key=tls.key

⚠️ Make sure to create the certificate in the same namespace where the KUDO Cassandra is being installed.

kubectl kudo install cassandra \
    --instance=cassandra \
    --namespace=kudo-cassandra \
    -p TRANSPORT_ENCRYPTION_ENABLED=true \
    -p TLS_SECRET_NAME=cassandra-tls

kubectl kudo install cassandra \
    --instance=cassandra \
    --namespace=kudo-cassandra \
    -p TRANSPORT_ENCRYPTION_ENABLED=true \
    -p TRANSPORT_ENCRYPTION_CLIENT_ENABLED=true \
    -p TLS_SECRET_NAME=cassandra-tls

The operator also allows you to allow plaintext communication along with encrypted traffic in Client-to-node communication.

kubectl kudo install cassandra \
    --instance=cassandra \
    --namespace=kudo-cassandra \
    -p TRANSPORT_ENCRYPTION_ENABLED=true \
    -p TRANSPORT_ENCRYPTION_CLIENT_ENABLED=true \
    -p TRANSPORT_ENCRYPTION_CLIENT_ALLOW_PLAINTEXT=true \
    -p TLS_SECRET_NAME=cassandra-tls

By default, KUDO Cassandra nodes only allow JMX connections from localhost. To enable remote JMX with encryption set JMX_LOCAL_ONLY to false.

kubectl kudo install cassandra \
    --instance=cassandra \
    --namespace=kudo-cassandra \
    -p TLS_SECRET_NAME=cassandra-tls \
    -p JMX_LOCAL_ONLY=false

Check out the parameters reference for a complete list of all configurable settings available for KUDO Cassandra security.

The KUDO Cassandra operator can be configured to authenticate and authorize access to the Cassandra cluster. The AUTHENTICATOR parameter sets the authenticator, the AUTHORIZER parameter sets the authorizer.

Some functionality of the operator use nodetool, thus these calls need to be authenticated as well. With enabled password authentication, create a secret that contains the credentials of the user the operator should use and set the AUTHENTICATION_SECRET_NAME parameter accordingly.

Here's an example of a secret that uses the default cassandra/cassandra credentials:

apiVersion: v1
kind: Secret
metadata:
  name: cassandra-credential
type: Opaque
data:
  username: Y2Fzc2FuZHJh
  password: Y2Fzc2FuZHJh

Reference this when installing the Cassandra operator with authentication.

kubectl kudo install cassandra \
    --instance=cassandra \
    --namespace=kudo-cassandra \
    -p AUTHENTICATOR=PasswordAuthenticator \
    -p AUTHENTICATION_SECRET_NAME=cassandra-credential