Configure the security keyspaces replication factors

Security keyspaces facilitate authentication and authorization, but the default replication factor for these keyspaces is 1. Alter replication properties for these keyspaces to prevent lockouts and failures when nodes are unresponsive, and to avoid data loss if a node cannot be recovered.

Warnings about security keyspace replication

Increase the replication factor for system keyspaces before enabling HCD authentication.

The default cassandra role executes all requests with QUORUM and it can fail with an RF of 1. Other roles use a consistency level of LOCAL_ONE, but you must use the cassandra role to create your first non-default superuser role.
Every time you add or remove a datacenter, you must manually reconfigure the RF for the security keyspaces.
Never set the replication factor greater than the number of nodes in the datacenter.

Recommended replication configuration

Security tables are relatively small.

For multi-node clusters in production environments, change the replication class to NetworkTopologyStrategy, and set the replication factor (RF) to 3 or 5 per datacenter. A larger RF might be necessary depending on your cluster’s size and failure tolerance.

Alter the replication properties for the following security keyspaces:

system_auth: Required for each log in and for every action that affects a database object.

When a LOGIN occurs, the role’s credentials and permissions are cached. To adjust the cache interval, edit the security properties in cassandra.yaml.

If this keyspace is unavailable, LOGIN and other authenticated actions can fail. If this keyspace exists only on a node in another datacenter, LOGIN and other authenticated actions can experience delays that lead to failures.
hcd_security: Required for each log in and for related database services. Less critical for pure database activities.

Set the replication factor

Change the RF for the system_auth keyspace:

ALTER KEYSPACE system_auth
    WITH REPLICATION= {'class' : 'NetworkTopologyStrategy',
                       'data_center_name' : 3,
                       'data_center_name' : 3};

Change the RF for the hcd_security keyspace:

ALTER KEYSPACE hcd_security
    WITH REPLICATION= {'class' : 'NetworkTopologyStrategy',
                       'data_center_name' : 3,
                       'data_center_name' : 3};

Run full nodetool repair on the security keyspaces:

nodetool repair --full system_auth
nodetool repair --full hcd_security

Configure the security keyspaces replication factors

Warnings about security keyspace replication

Recommended replication configuration

Set the replication factor

Was this helpful?

Give Feedback