<p>How can I configure internode encryption (i.e., TLS) for Cassandra in K8ssandra?</p>

John Sanda
<p>K8ssandra 1.4.0 included some changes that should make it possible to configure TLS. For reference this is the <a href="https://github.com/k8ssandra/k8ssandra-operator/issues/235" rel="nofollow noreferrer">ticket</a>, and this is the corresponding <a href="https://github.com/k8ssandra/k8ssandra/pull/1180" rel="nofollow noreferrer">PR</a>.</p>
<p>There is chart property, <code>cassandraYamlConfigMap</code>, with which you can specify a ConfigMap that contains your custom <code>cassandra.yaml</code>. The properties that you supply will be merged with those generated by k8ssandra with yours taking precedence.</p>
<p>Note that your <code>cassandra.yaml</code> does not need to be a complete config file. It is sufficient to specify only the properties you are interested in since it will get merged with the based configuration file generated by K8ssandra.</p>
<p>There are some additional properties required for internode and client encryption because you need to specify the keystore and truststore secrets so that volume mounts can be created. Note that you need to create the keystore and truststore secrets in advance.</p>
<p>See the inline docs for the new chart properties <a href="https://github.com/k8ssandra/k8ssandra/blob/v1.4.1/charts/k8ssandra/values.yaml#L138" rel="nofollow noreferrer">here</a>.</p>
<p>Here is an example chart properties file that demonstrates the new properties:</p>
<pre class="lang-yaml prettyprint-override"><code>cassandra:
  version: 4.0.1
  cassandraYamlConfigMap: cassandra-config
  encryption:
    keystoreSecret: keystore
    keystoreMountPath: /mnt/keystore
    truststoreSecret: truststore
    truststoreMountPath: /mnt/truststore
  heap:
    size: 512M
  datacenters:
  - name: dc1
    size: 1
</code></pre>
<p>There are a couple things to note about the charts properties. First, <code>keystoreSecret</code> and <code>truststoreSecret</code> refer to secrets that should live in the same namespace in which k8ssandra is installed. The user should create those secrets before installing (or upgrading k8ssandra).</p>
<p>Secondly, <code>keystoreMountPath</code> and <code>truststoreMountPath</code> specify where those secrets should be mounted in the Cassandra pods. These properties must be specified and must match what is specified in <code>cassandra.yaml</code>.</p>
<p>Here is an example of a ConfigMap that contains my custom cassandra.yaml:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: ConfigMap
metadata:
  name: cassandra-config
data:
  cassandra.yaml: |-
    server_encryption_options:
      internode_encryption: all
      keystore: /mnt/keystore/keystore.jks
      keystore_password: cassandra
      truststore: /mnt/truststore/truststore.jks
      truststore_password: cassandra
</code></pre>
<p>K8ssandra uses <a href="https://github.com/k8ssandra/cass-operator" rel="nofollow noreferrer">Cass Operator</a> to manage Cassandra. With that in mind I recommend the following for further reading:</p>
<ul>
<li>This <a href="https://thelastpickle.com/blog/2021/10/28/cassandra-certificate-management-part_2-cert-manager-and-k8s.html" rel="nofollow noreferrer">article</a> covers configuring TLS for a cass-operator managed cluster using cert-manager.</li>
<li>This <a href="https://github.com/k8ssandra/cass-operator/issues/217#issuecomment-949779469" rel="nofollow noreferrer">ticket</a> provides a detailed explanation of how Cass Operator configure internode encryption.</li>
</ul>
