<p>i am new to kubernetes/helm.
I'm trying to configure encryption TLS/SSL for Cassandra in K8ssandra?
I've seen this example but can't get any further.
Click <a href="https://stackoverflow.com/questions/70610253/configuring-internode-encryption-tls-in-k8ssandra" title="stackoverflow">here</a>!</p>
<p>I perform the following steps as described in this tutorial
Click <a href="https://docs-v2.k8ssandra.io/install/local/single-cluster-helm/" rel="nofollow noreferrer" title="k8ssandra.io">here</a>!</p>
<pre><code>helm repo add k8ssandra https://helm.k8ssandra.io/stable
helm repo update
</code></pre>
<pre><code>cd ~/github
git clone https://github.com/k8ssandra/k8ssandra-operator.git
cd k8ssandra-operator
</code></pre>
<pre><code>scripts/setup-kind-multicluster.sh --clusters 1 --kind-worker-nodes 4
</code></pre>
<pre><code>helm repo add jetstack https://charts.jetstack.io
helm repo update
kubectl config use-context kind-k8ssandra-0
</code></pre>
<pre><code>helm install cert-manager jetstack/cert-manager \
     --namespace cert-manager --create-namespace --set installCRDs=true
</code></pre>
<pre><code>helm install k8ssandra-operator k8ssandra/k8ssandra-operator -n k8ssandra-operator --create-namespace
</code></pre>
<pre><code>cat &lt;&lt;EOF | kubectl -n k8ssandra-operator apply -f -
    apiVersion: k8ssandra.io/v1alpha1
    kind: K8ssandraCluster
    metadata:
      name: demo
    spec:
      cassandra:
    serverVersion: &quot;4.0.1&quot;
    datacenters:
      - metadata:
          name: dc1
        size: 3
        storageConfig:
          cassandraDataVolumeClaimSpec:
            storageClassName: standard
            accessModes:
              - ReadWriteOnce
            resources:
              requests:
                storage: 5Gi
        config:
          jvmOptions:
            heapSize: 512M
        stargate:
          size: 1
          heapSize: 256M
EOF
</code></pre>
<pre><code>CASS_USERNAME=$(kubectl get secret demo-superuser -n k8ssandra-operator -o=jsonpath='{.data.username}' | base64 --decode)
echo $CASS_USERNAME


CASS_PASSWORD=$(kubectl get secret demo-superuser -n k8ssandra-operator -o=jsonpath='{.data.password}' | base64 --decode)
echo $CASS_PASSWORD
</code></pre>
<pre><code>kubectl exec -it demo-dc1-default-sts-0 -n k8ssandra-operator -c cassandra -- nodetool -u $CASS_USERNAME -pw $CASS_PASSWORD status
kubectl exec -it demo-dc1-default-sts-0 -n k8ssandra-operator -c cassandra -- cqlsh -u $CASS_USERNAME -p $CASS_PASSWORD -e &quot;CREATE KEYSPACE test WITH replication = {'class': 'SimpleStrategy', 'replication_factor': 3};&quot;

kubectl exec -it demo-dc1-default-sts-0 -n k8ssandra-operator -c cassandra -- cqlsh -u $CASS_USERNAME -p $CASS_PASSWORD -e &quot;insert into test.users (email, name, state) values ('john@gamil.com', 'John Smith', 'NC');&quot;
kubectl exec -it demo-dc1-default-sts-0 -n k8ssandra-operator -c cassandra -- cqlsh -u $CASS_USERNAME -p $CASS_PASSWORD -e &quot;insert into test.users (email, name, state) values ('joe@gamil.com', 'Joe Jones', 'VA');&quot;
kubectl exec -it demo-dc1-default-sts-0 -n k8ssandra-operator -c cassandra -- cqlsh -u $CASS_USERNAME -p $CASS_PASSWORD -e &quot;insert into test.users (email, name, state) values ('sue@help.com', 'Sue Sas', 'CA');&quot;
kubectl exec -it demo-dc1-default-sts-0 -n k8ssandra-operator -c cassandra -- cqlsh -u $CASS_USERNAME -p $CASS_PASSWORD -e &quot;insert into test.users (email, name, state) values ('tom@yes.com', 'Tom and Jerry', 'NV');&quot;
</code></pre>
<p>The files truststore.jks and keystore.jks are stored locally on the pc under the ./mnt/keystore/... and  ./mnt/truststore/... directory.
Here i create the secrets keystoreSecret and truststoreSecret.</p>
<pre><code>kubectl create secret generic keystore --from-file=./mnt/keystore/keystore.jks -n k8ssandra-operator  
kubectl create secret generic truststore --from-file=./mnt/truststore/truststore.jks -n k8ssandra-operator  
</code></pre>
<p>Now I have run the above examples.
This is the value.yaml</p>
<pre><code>cassandra:
  version: 4.0.1
  cassandraYamlConfigMap: cassandra-config
  encryption:
    keystoreSecret: keystore
    keystoreMountPath: /mnt/keystore
    truststoreSecret: truststore
    truststoreMountPath: /mnt/truststore
  heap:
    size: 512M
  datacenters:
  - name: dc1
    size: 1
</code></pre>
<p>I'm trying to run this example as follows.</p>
<pre><code>helm upgrade  k8ssandra-operator k8ssandra/k8ssandra-operator -n k8ssandra-operator  -f  value.yaml
</code></pre>
<p>Now I'm trying to run the configmap file.
config-file.yaml</p>
<pre><code>apiVersion: v1
kind: ConfigMap
metadata:
  name: cassandra-config
data:
  cassandra.yaml: |-
    server_encryption_options:
      internode_encryption: all
      keystore: /mnt/keystore/keystore.jks
      keystore_password: cassandra
      truststore: /mnt/truststore/truststore.jks
      truststore_password: cassandra
</code></pre>
<pre><code>kubectl apply -f config-file.yaml -n k8ssandra-operator
</code></pre>
<p>i can switch to cassandra bash without any problems</p>
<pre><code>kubectl exec -it demo-dc1-default-sts-0 -n k8ssandra-operator -- /bin/bash
</code></pre>
<p>In cassandra bash environment i can't find truststore and keystore files under /mnt/truststore/truststore.jks and /mnt/keystore/keystore.jks directories.</p>
<p>I'm trying to log into cassandra with ssl but I can't.</p>
<pre><code>cassandra@demo-dc1-default-sts-0:/$ cqlsh --ssl -u demo-superuser -p JKv59QPynp3s0qGSf1DZ demo-dc1-stargate-service
Validation is enabled; SSL transport factory requires a valid certfile to be specified. Please provide path to the certfile in [ssl] section as 'certfile' option in /home/cassandra/.cassandra/cqlshrc (or use [certfiles] section) or set SSL_CERTFILE environment variable.
</code></pre>

Jennifer Schuhmacher
<p>Have you checked <a href="https://docs-v2.k8ssandra.io/tasks/secure/encryption/" rel="nofollow noreferrer">this doc</a>?
It applies to k8ssandra-operator (considered K8ssandra v2), while the links you found apply to K8ssandra v1 (where everything was helm charts).</p>
<p>Let me know if that works for you.</p>
