Configure the security keyspaces replication factors

Security keyspaces facilitate authentication and authorization, but the default replication factor (RF) for these keyspaces is 1. Alter replication properties for these keyspaces to prevent lockouts and failures when nodes are unresponsive, and to avoid data loss if a node cannot be recovered.

Warnings about security keyspace replication

Increase the RF for system keyspaces before enabling DSE authentication.

The default cassandra role executes all requests with QUORUM and it can fail with an RF of 1. Other roles use a consistency level of LOCAL_ONE, but you must use the cassandra role to create your first non-default superuser role.
Every time you add or remove a datacenter, you must manually reconfigure the RF for the security keyspaces.
Never set the RF greater than the number of nodes in the datacenter.

Recommended replication configuration

Security tables are relatively small.

For multi-node clusters in production environments, change the replication class to NetworkTopologyStrategy, and set the RF to 3 or 5 per datacenter. A larger RF might be necessary depending on your cluster’s size and failure tolerance.

Alter the replication properties for the following security keyspaces:

system_auth: Required for each log in and for every action that affects a database object.

When a LOGIN occurs, the role’s credentials and permissions are cached. To adjust the cache interval, edit the security properties in cassandra.yaml.

If this keyspace is unavailable, LOGIN and other authenticated actions can fail. If this keyspace exists only on a node in another datacenter, LOGIN and other authenticated actions can experience delays that lead to failures.
dse_security: Required for each log in and for related database services. Contains DSE Analytics (Apache Spark™), DSE Client digest tokens, and other Kerberos related data. Less critical for pure database activities.
dse_leases: Required for managing leases related to DSE Analytics security options. Only set the RF in datacenters with DSE Analytics nodes.

Set the replication factor

Change the RF for the system_auth keyspace:

ALTER KEYSPACE system_auth
    WITH REPLICATION= {'class' : 'NetworkTopologyStrategy',
                       'data_center_name' : 3,
                       'data_center_name' : 3};

Change the RF for the dse_security keyspace:

ALTER KEYSPACE dse_security
    WITH REPLICATION= {'class' : 'NetworkTopologyStrategy',
                       'data_center_name' : 3,
                       'data_center_name' : 3};

If DSE Analytics or Spark security options are enabled on the cluster, increase the RF for the dse_leases keyspace for all datacenters with DSE Analytics nodes.

Run full nodetool repair on the security keyspaces:

nodetool repair --full system_auth
nodetool repair --full dse_security
nodetool repair --full dse_leases

Configure the security keyspaces replication factors

Warnings about security keyspace replication

Recommended replication configuration

Set the replication factor

Was this helpful?

Give Feedback