Cassandra K8s: Security: TLS, authentication, and authorization

This domain tests three separate controls: encrypting traffic, proving identity, and limiting what an authenticated role can do.

Core rules

• Internode TLS protects gossip and streaming; client TLS protects CQL and can require client certificates.
• Certificates need SANs for Service DNS names and Pod DNS names, and they expire.
• PasswordAuthenticator handles authentication; CassandraAuthorizer handles permissions.
• system_auth must have RF greater than 1 in a multi-node cluster and be repaired.
• The operator's superuser credentials belong in a Secret, not in a manifest or shell history.

Worked example

Client encryption is enabled with require_client_auth: true. The server keystore holds its certificate and key; the truststore holds the CA that signed client certificates. A client that trusts the server but presents no certificate fails the handshake, even though its truststore is correct. Separately, a new role is created with CREATE ROLE app WITH PASSWORD ... and granted SELECT on the keyspace, not SUPERUSER. If system_auth is RF 1 and its only replica is lost, logins can fail across the cluster.

Traps

• Leaving system_auth at RF 1 and never running repair.
• Using the default superuser for application traffic.
• Issuing certificates without the Service or Pod DNS SANs.
• Enabling client TLS but forgetting to distribute the client keystore.