dse.yaml configuration file

Security and authentication options

Authentication options

# authentication_options:
              #    enabled: false
              #    default_scheme: internal
              #    other_schemes:
              #      - ldap
              #      - kerberos
              #    scheme_permissions: false
              #    transitional_mode: disabled
              #    allow_digest_with_kerberos: true
              #    plain_text_without_ssl: warn          

authentication_options

Options for the DseAuthenticator to authenticate users when the authenticator option in cassandra.yaml is set to com.datastax.bdp.cassandra.auth.DseAuthenticator. Authenticators other than DseAuthenticator are not supported.

enabled

Enables user authentication.

• true - The DseAuthenticator authenticates users.
• false - The DseAuthenticator does not authenticate users and allows all connections.

When not set, the default is false.

Default: commented out false

default_scheme

Sets the first scheme to validate a user against when the driver does not request a specific scheme.

• internal - Plain text authentication using the internal password authentication.
• ldap - Plain text authentication using pass-through LDAP authentication.
• kerberos - GSSAPI authentication using the Kerberos authenticator.

Default: commented out (internal)

other_schemes

List of schemes that are also checked if validation against the first scheme fails and no scheme was specified by the driver. Same scheme names as default_scheme.

scheme_permissions

Whether roles need to have permission granted to them in order to use specific authentication schemes. These permissions can be granted only when the DseAuthorizer is used. Set to one of the following values:

• true - Use multiple schemes for authentication. Every role requires permissions to a scheme in order to be assigned.
• false - Do not use multiple schemes for authentication. Prevents unintentional role assignment that might occur if user or group names overlap in the authentication service.

Tip: See .

When not set, the default is false.

Default: commented out (false)

allow_digest_with_kerberos

Controls whether DIGEST-MD5 authentication is also allowed with Kerberos. The DIGEST-MD5 mechanism is not directly associated with an authentication scheme, but is used by Kerberos to pass credentials between nodes and jobs.

• true - DIGEST-MD5 authentication is also allowed with Kerberos. In analytics clusters, set to true to use Hadoop inter-node authentication with Hadoop and Spark jobs.
• false - DIGEST-MD5 authentication is not used with Kerberos.

Analytics nodes require true to use internode authentication with Hadoop and Spark jobs. When not set, the default is true.

Default: commented out (true)

plain_text_without_ssl

Controls how the DseAuthenticator responds to plain text authentication requests over unencrypted client connections. Set to one of the following values:

• block - Block the request with an authentication error.
• warn - Log a warning about the request but allow it to continue.
• allow - Allow the request without any warning.

Default: commented out (warn)

transitional_mode

Whether to enable transitional mode for temporary use during authentication setup in an already established environment.

Transitional mode allows access to the database using the anonymous role, which has all permissions except AUTHORIZE.

• disabled - Transitional mode is disabled. All connections must provide valid credentials and map to a login-enabled role.
• permissive - Only super users are authenticated and logged in. All other authentication attempts are logged in as the anonymous user.
• normal - Allow all connections that provide credentials. Maps all authenticated users to their role AND maps all other connections to anonymous.
• strict - Allow only authenticated connections that map to a login-enabled role OR connections that provide a blank username and password as anonymous.

Important: Credentials are required for all connections after authentication is enabled; use a blank username and password to login with anonymous role in transitional mode.

Default: commented out (disabled)

Role management options

#role_management_options:
#    mode: internal
#    stats: false

role_management_options

Options for the DSE Role Manager. To enable role manager, set:

• authorization_options enabled to true
• role_manager in cassandra.yaml to com.datastax.bdp.cassandra.auth.DseRoleManager

Tip: See .

When scheme_permissions is enabled, all roles must have permission to execute on the authentication scheme, see .

mode

Set to one of the following values:

• internal - Scheme that manages roles per individual user in the internal database. Allows nesting roles for permission management.
• ldap - Scheme that assigns roles by looking up the user name in LDAP and mapping the group attribute (ldap_options) to an internal role name. To configure an LDAP scheme, complete the steps in .

Attention: Internal role management allows nesting roles for permission management; when using LDAP mode role, nesting is disabled. Using GRANT role_name TO role_name results in an error.

Default: commented out (internal)

stats

Set to true, to enable logging of DSE role creation and modification events in the dse_security.role_stats system table. All nodes must have the stats option enabled, and must be restarted for the functionality to take effect.

To query role events:

SELECT * FROM dse_security.role_stats;

 role  | created                         | password_changed
-------+---------------------------------+---------------------------------
 user1 | 2020-04-13 00:44:09.221000+0000 |                            null
 user2 | 2020-04-12 23:49:21.457000+0000 | 2020-04-12 23:49:21.457000+0000

(2 rows)

Default: commented out (false)

Authorization options

#authorization_options: 
#    enabled: false
#    transitional_mode: disabled
#    allow_row_level_security: false

Kerberos options

kerberos_options:
    keytab: resources/dse/conf/dse.keytab
    service_principal: dse/_HOST@REALM
    http_principal: HTTP/_HOST@REALM
    qop: auth

kerberos_options

Options to configure security for a DataStax Enterprise cluster using Kerberos.

keytab

The file path of dse.keytab.

service_principal

The service_principal that the DataStax Enterprise process runs under must use the form dse_user/_HOST@REALM, where:

• dse_user is the name of the user that starts the DataStax Enterprise process.
• _HOST is converted to a reverse DNS lookup of the broadcast address.
• REALM is the name of your Kerberos realm. In the Kerberos principal, REALM must be uppercase.

http_principal

The http_principal is used by the Tomcat application container to run DSE Search. The Tomcat web server uses the GSSAPI mechanism (SPNEGO) to negotiate the GSSAPI security mechanism (Kerberos). Set REALM to the name of your Kerberos realm. In the Kerberos principal, REALM must be uppercase.

qop

A comma-delimited list of Quality of Protection (QOP) values that clients and servers can use for each connection. The client can have multiple QOP values, while the server can have only a single QOP value. The valid values are:

• auth - Authentication only.
• auth-int - Authentication plus integrity protection for all transmitted data.
• auth-conf - Authentication plus integrity protection and encryption of all transmitted data.

  Encryption using auth-conf is separate and independent of whether encryption is done using SSL. If both auth-conf and SSL are enabled, the transmitted data is encrypted twice. DataStax recommends choosing only one method and using it for both encryption and authentication.

LDAP options

# ldap_options:
#     server_host:
#     server_port: 389
#     hostname_verification: false
#     search_dn:
#     search_password:
#     use_ssl: false
#     use_tls: false
#     truststore_path:
#     truststore_password:
#     truststore_type: jks
#     user_search_base:
#     user_search_filter: (uid={0})
#     user_memberof_attribute: memberof
#     group_search_type: directory_search
#     group_search_base:
#     group_search_filter: (uniquemember={0})
#     group_name_attribute: cn
#     credentials_validity_in_ms: 0
#     search_validity_in_seconds: 0
#     connection_pool:
#         max_active: 8
#         max_idle: 8

ldap_options:
    server_host: win2012ad_server.mycompany.lan
    server_port: 389
    search_dn: cn=lookup_user,cn=users,dc=win2012domain,dc=mycompany,dc=lan
    search_password: lookup_user_password
    use_ssl: false
    use_tls: false
    truststore_path:
    truststore_password:
    truststore_type: jks
    #group_search_type: directory_search
    group_search_type: memberof_search
    #group_search_base:
    #group_search_filter:
    group_name_attribute: cn
    user_search_base: cn=users,dc=win2012domain,dc=mycompany,dc=lan
    user_search_filter: (sAMAccountName={0})
    user_memberof_attribute: memberOf
    connection_pool:
        max_active: 8
        max_idle: 8

ldap_options

Options to configure LDAP security. When not set, LDAP authentication is not used.

Default: commented out

server_host

A comma separated list of LDAP server hosts.

Important: Do not use LDAP on the same host (localhost) in production environments. Using LDAP on the same host (localhost) is appropriate only in single node test or development environments.

For information on parameters related to tuning failover performance for multiple LDAP servers, see Tune LDAP failover.

Default: none

server_port

The port on which the LDAP server listens.

• 389 - the default port for unencrypted connections
• 636 - typically used for encrypted connections; the default SSL port for LDAP is 636

Default: commented out (389)

hostname_verification

Enable hostname verification. The following conditions must be met:

• Either use_ssl or use_tls must be set to true.
• A valid truststore with the correct path specified in truststore_path must exist. The truststore must have a certificate entry, trustedCertEntry, including a SAN DNSName entry that matches the hostname of the LDAP server.

Default: false

search_dn

Distinguished name (DN) of an account with read access to the user_search_base and group_search_base. For example:

• OpenLDAP: uid=lookup,ou=users,dc=springsource,dc=com
• Microsoft Active Directory (AD): cn=lookup, cn=users, dc=springsource, dc=com

Warning: Do not create/use an LDAP account or group called cassandra. The DSE database comes with a default login role, cassandra, that has access to all database objects and uses the consistency level QUOROM.

When not set, an anonymous bind is used for the search on the LDAP server.

Default: commented out

search_password

The password of the search_dn account.

Default: commented out

use_ssl

Whether to use an SSL-encrypted connection.

• true - use an SSL-encrypted connection, set server_port to the LDAP port for the server (typically port 636)
• false - do not enable SSL connections to the LDAP server

Default: commented out (false)

use_tls

Whether to enable TLS connections to the LDAP server.

• true - enable TLS connections to the LDAP server, set server_port to the TLS port of the LDAP server.
• false - do not enable TLS connections to the LDAP server

Default: commented out (false)

truststore_path

The path to the truststore for SSL certificates.

Default: commented out

truststore_password

The password to access the trust store.

Default: commented out

truststore_type

The type of truststore.

Default: commented out (jks)

user_search_base

Distinguished name (DN) of the object to start the recursive search for user entries for authentication and role management memberof searches. For example to search all users in example.com, ou=users,dc=example,dc=com.

• For your LDAP domain, set the ou and dc elements. Typically set to ou=users,dc=domain,dc=top_level_domain. For example, ou=users,dc=example,dc=com.
• Active Directory uses a different search base, typically CN=search,CN=Users,DC=ActDir_domname,DC=internal. For example, CN=search,CN=Users,DC=example-sales,DC=internal.

Default: commented out

user_search_filter

Attribute that identifies the user that the search filter uses for looking up user names.

• uid={0} - when using LDAP
• samAccountName={0} - when using AD (Microsoft Active Directory). For example, (sAMAccountName={0})

Default: commented out (uid={0})

user_memberof_attribute

Attribute that contains a list of group names; role manager assigns DSE roles that exactly match any group name in the list. Required when managing roles using group_search_type: memberof_search with LDAP (role_manager.mode:ldap). The directory server must have memberof support, which is a default user attribute in Microsoft Active Directory (AD).

Default: commented out (memberof)

group_search_type

Required when managing roles with LDAP (role_manager.mode: ldap). Define how group membership is determined for a user. Choose from one of the following values:

• directory_search - Filters the results by doing a subtree search of group_search_base to find groups that contain the user name in the attribute defined in the group_search_filter. (Default)
• memberof_search - Recursively search for user entries using the user_search_base and user_search_filter. Get groups from the user attribute defined in user_memberof_attribute. The directory server must have memberof support.

Default: commented out (directory_search)

group_search_base

The unique distinguished name (DN) of the group record from which to start the group membership search on.

Default: commented out

group_search_filter

Set to any valid LDAP filter.

Default: commented out (uniquemember={0})

group_name_attribute

The attribute in the group record that contains the LDAP group name. Role names are case-sensitive and must match exactly on DSE for assignment. Unmatched groups are ignored.

Default: commented out (cn)

credentials_validity_in_ms

The duration period of the credentials cache.

• 0 - disable credentials cache
• duration period in milliseconds - enable a search cache and improve performance by reducing the number of requests that are sent to the internal or LDAP server. See .

When not set, the default is 0 (disabled).

Default: commented out (0)

search_validity_in_seconds

The duration period for the search cache.

• 0 - disable search credentials cache
• duration period in seconds - enables a search cache and improves performance by reducing the number of requests that are sent to the internal or LDAP server

Default: commented out (0, disabled)

connection_pool

The configuration settings for the connection pool for making LDAP requests.

max_active

The maximum number of active connections to the LDAP server.

Default: commented out (8)

max_idle

The maximum number of idle connections in the pool awaiting requests.

Default: commented out (8)

Encrypt sensitive system resources

Options to encrypt sensitive system resources using a local encryption key or a remote KMIP key.

system_info_encryption:
  enabled: false
  cipher_algorithm: AES
  secret_key_strength: 128
  chunk_length_kb: 64
  key_provider: KmipKeyProviderFactory
  kmip_host: kmip_host_name

system_info_encryption

Options to set encryption settings for system resources that might contain sensitive information, including the system.batchlog and system.paxos tables, hint files, and the database commit log.

enabled

Whether to enable encryption of system resources. See .

Note: The system_trace keyspace is NOT encrypted by enabling the system_information_encryption section. In environments that also have tracing enabled, manually configure encryption with compression on the system_trace keyspace. See .

Default: false

cipher_algorithm

The name of the JCE cipher algorithm used to encrypt system resources.

Table 1. Supported cipher algorithms names

cipher_algorithm	secret_key_strength
AES	128, 192, or 256
DES	56
DESede	112 or 168
Blowfish	32-448
RC2	40-128

Default: AES

secret_key_strength

Length of key to use for the system resources. See Supported cipher algorithms names.

Note: DSE uses a matching local key or requests the key type from the KMIP server. For KMIP, if an existing key does not match, the KMIP server automatically generates a new key.

Default: 128

chunk_length_kb

Optional. Size of SSTable chunks when data from the system.batchlog or system.paxos are written to disk.

Note: To encrypt existing data, run nodetool upgradesstables -a system batchlog paxos on all nodes in the cluster.

Default: 64

key_provider

KMIP key provider to enable encrypting sensitive system data with a KMIP key. Comment out if using a local encryption key.

Default: commented out (KmipKeyProviderFactory)

kmip_host

The KMIP key server host. Set to the kmip_group_name that defines the KMIP host in kmip_hosts section. DSE requests a key from the KMIP host and uses the key generated by the KMIP provider.

Default: commented out

Encrypted configuration properties settings

system_key_directory: /etc/dse/conf
config_encryption_active: false
config_encryption_key_name: (key_filename | KMIP_key_URL )

system_key_directory

Path to the directory where local encryption/decryption key files are stored, also called system keys. Distribute the system keys to all nodes in the cluster. Ensure that the DSE account is the folder owner and has read/write/execute (700) permissions.

See .

Note: This directory is not used for KMIP keys.

Default: /etc/dse/conf

config_encryption_active

Whether to enable encryption on sensitive data stored in tables and in configuration files.

• true - enable encryption of configuration property values using the specified config_encryption_key_name. When set to true, the configuration values must be encrypted or commented out. See .
  Restriction: Lifecycle Manager (LCM) is not compatible when config_encryption_active is true in DSE and OpsCenter. For LCM limitations, see .
• false - Do not enable encryption of configuration property values.

Default: false

config_encryption_key_name

Set to the local encryption key filename or KMIP key URL to use for configuration file property value decryption.

Note: Use dsetool dsetool encryptconfigvalue to generate encrypted values for the configuration file properties.

Default: system_key. The default name is not configurable.

KMIP encryption options

kmip_hosts:  
  your_kmip_groupname:
    hosts: kmip1.yourdomain.com, kmip2.yourdomain.com 
    keystore_path: pathto/kmip/keystore.jks
    keystore_type: jks
    keystore_password: password
    truststore_path: pathto/kmip/truststore.jks
    truststore_type: jks
    truststore_password: password
    key_cache_millis: 300000
    timeout: 1000
    protocol: protocol
    cipher_suites: supported_cipher

kmip_hosts

Connection settings for key servers that support the KMIP protocol.

kmip_groupname

A user-defined name for a group of options to configure a KMIP server or servers, key settings, and certificates. Configure options for a kmip_groupname section for each KMIP key server or group of KMIP key servers. Using separate key server configuration settings allows use of different key servers to encrypt table data, and eliminates the need to enter key server configuration information in DDL statements and other configurations. Multiple KMIP hosts are supported.

Default: commented out

hosts

A comma-separated list KMIP hosts (host[:port]) using the FQDN (Fully Qualified Domain Name). DSE queries the host in the listed order, so add KMIP hosts in the intended failover sequence.

For example, if the host list contains kmip1.yourdomain.com, kmip2.yourdomain.com, DSE tries kmip1.yourdomain.com and then kmip2.yourdomain.com.

keystore_path

The path to a Java keystore created from the KMIP agent PEM files.

Default: commented out (/etc/dse/conf/KMIP_keystore.jks)

keystore_type

The type of keystore.

Default: commented out (jks)

keystore_password

The password to access the keystore.

Default: commented out (password)

truststore_path

The path to a Java truststore that was created using the KMIP root certificate.

Default: commented out (/etc/dse/conf/KMIP_truststore.jks)

truststore_type

The type of truststore.

Default: commented out (jks)

truststore_password

The password to access the truststore.

Default: commented out (password)

key_cache_millis

Milliseconds to locally cache the encryption keys that are read from the KMIP hosts. The longer the encryption keys are cached, the fewer requests are made to the KMIP key server, but the longer it takes for changes, like revocation, to propagate to the DataStax Enterprise node. DataStax Enterprise uses concurrent encryption, so multiple threads fetch the secret key from the KMIP key server at the same time. DataStax recommends using the default value.

Default: commented out (300000)

timeout

Socket timeout in milliseconds.

Default: commented out (1000)

protocol

protocol

When not specified, JVM default is used. Example: TLSv1.2

cipher_suites

When not specified, JVM default is used. Examples:

• TLS_RSA_WITH_AES_128_CBC_SHA
• TLS_RSA_WITH_AES_256_CBC_SHA
• TLS_DHE_RSA_WITH_AES_128_CBC_SHA
• TLS_DHE_RSA_WITH_AES_256_CBC_SHA
• TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
• TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA

See cipher_algorithm.

DSE Search index encryption settings

# solr_encryption_options:
#    decryption_cache_offheap_allocation: true
#    decryption_cache_size_in_mb: 256

solr_encryption_options

Settings to tune encryption of search indexes.

decryption_cache_offheap_allocation

Whether to allocate shared DSE Search decryption cache off JVM heap.

• true - allocate shared DSE Search decryption cache off JVM heap
• false - do not allocate shared DSE Search decryption cache off JVM heap

When not set, the default is true.

Default: commented out (true)

decryption_cache_size_in_mb

The maximum size of shared DSE Search decryption cache in megabytes (MB).

Default: commented out (256)

DSE Search options

Scheduler settings for DSE Search indexes

ttl_index_rebuild_options:
    fixed_rate_period: 300
    initial_delay: 20
    max_docs_per_batch: 4096
    thread_pool_size: 1

ttl_index_rebuild_options

Section of options to control the schedulers in charge of querying for and removing expired records, and the execution of the checks.

fix_rate_period

Time interval to check for expired data in seconds.

Default: 300

initial_delay

The number of seconds to delay the first TTL check to speed up start-up time.

Default: 20

max_docs_per_batch

The maximum number of documents to check and delete per batch by the TTL rebuild thread. All documents determined to be expired are deleted from the index during each check, to avoid memory pressure, their unique keys are retrieved and deletes issued in batches.

Default: 4096

thread_pool_size

The maximum number of cores that can execute TTL cleanup concurrently. Set the thread_pool_size to manage system resource consumption and prevent many search cores from executing simultaneous TTL deletes.

Default: 1

Reindexing of bootstrapped data

async_bootstrap_reindex: false

async_bootstrap_reindex

For DSE Search, configure whether to asynchronously reindex bootstrapped data. Default: false

• If enabled, the node joins the ring immediately after bootstrap and reindexing occurs asynchronously. Do not wait for post-bootstrap reindexing so that the node is not marked down. The dsetool ring command can be used to check the status of the reindexing.
• If disabled, the node joins the ring after reindexing the bootstrapped data.

CQL Solr paging

cql_solr_query_paging: off

cql_solr_query_paging

• driver - Respects driver paging settings. Specifies to use Solr pagination (cursors) only when the driver uses pagination. Enabled automatically for DSE SearchAnalytics workloads.
• off - Paging is off. Ignore driver paging settings for CQL queries and use normal Solr paging unless:
  • The current workload is an analytics workload, including SearchAnalytics. SearchAnalytics nodes always use driver paging settings.
  • The cqlsh query parameter paging is set to driver.

    Even when cql_solr_query_paging: off, paging is dynamically enabled with the "paging":"driver" parameter in JSON queries.

When not set, the default is off.

Default: commented out (off)

Solr CQL query option

cql_solr_query_row_timeout: 10000

cql_solr_query_row_timeout

The maximum time in milliseconds to wait for each row to be read from the database during CQL Solr queries.

Default: commented out  (10000 10 seconds)

DSE Search resource upload limit

solr_resource_upload_limit_mb: 10

solr_resource_upload_limit_mb

Option to disable or configure the maximum file size of the search index config or schema. Resource files can be uploaded, but the search index config and schema are stored internally in the database after upload.

• 0 - disable resource uploading
• upload size - The maximum upload size limit in megabytes (MB) for a DSE Search resource file (search index config or schema).

Default: 10

Shard transport options

shard_transport_options:
    netty_client_request_timeout: 60000

DSE Search indexing settings

# back_pressure_threshold_per_core: 1024
# flush_max_time_per_core: 5
# load_max_time_per_core: 5
# enable_index_disk_failure_policy: false
# solr_data_dir: /MyDir
# solr_field_cache_enabled: false
# ram_buffer_heap_space_in_mb: 1024
# ram_buffer_offheap_space_in_mb: 1024

back_pressure_threshold_per_core

The maximum number of queued partitions during search index rebuilding and reindexing. This maximum number safeguards against excessive heap use by the indexing queue. If set lower than the number of threads per core (TPC), not all TPC threads can be actively indexing.

Default: commented out (1024)

flush_max_time_per_core

The maximum time, in minutes, to wait for the flushing of asynchronous index updates that occurs at DSE Search commit time or at flush time. Expert level knowledge is required to change this value. Always set the value reasonably high to ensure flushing completes successfully to fully sync DSE Search indexes with the database data. If the configured value is exceeded, index updates are only partially committed and the commit log is not truncated which can undermine data durability.

Note: When a timeout occurs, it usually means this node is being overloaded and cannot flush in a timely manner. Live indexing increases the time to flush asynchronous index updates.

Default: commented out (5)

load_max_time_per_core

The maximum time, in minutes, to wait for each DSE Search index to load on startup or create/reload operations. This advanced option should be changed only if exceptions happen during search index loading. When not set, the default is 5 minutes.

Default: commented out (5)

enable_index_disk_failure_policy

Whether to apply the configured disk failure policy if IOExceptions occur during index update operations.

• true - apply the configured Cassandra disk failure policy to index write failures
• false - do not apply the disk failure policy

When not set, the default is false.

Default: commented out (false)

solr_data_dir

The directory to store index data. For example:

solr_data_dir: /var/lib/cassandra/solr.data

See Managing the location of DSE Search data.By default, each DSE Search index is saved in solr_data_dir/keyspace_name.table_name, or as specified by the dse.solr.data.dir system property.

Default: commented out

solr_field_cache_enabled

The Apache Lucene® field cache is deprecated. Instead, for fields that are sorted, faceted, or grouped by, set docValues="true" on the field in the search index schema. Then reload the search index and reindex. When not set, the default is false.

Default: commented out (false)

ram_buffer_heap_space_in_mb

Global Lucene RAM buffer usage threshold for heap to force segment flush. Setting too low might induce a state of constant flushing during periods of ongoing write activity. For NRT, forced segment flushes also de-schedule pending auto-soft commits to avoid potentially flushing too many small segments. When not set, the default is 1024.

Default: commented out (1024)

ram_buffer_offheap_space_in_mb

Global Lucene RAM buffer usage threshold for offheap to force segment flush. Setting too low might induce a state of constant flushing during periods of ongoing write activity. For NRT, forced segment flushes also de-schedule pending auto-soft commits to avoid potentially flushing too many small segments. When not set, the default is 1024.

Default: commented out (1024)

Performance Service options

Global Performance Service options

# performance_core_threads: 4
# performance_max_threads: 32
# performance_queue_capacity: 32000

Performance Service options

These settings are used by the Performance Service to configure collection of performance metrics on transactional nodes. Performance metrics are stored in the dse_perf keyspace and can be queried with CQL using any CQL-based utility, such as cqlsh or any application using a CQL driver. To temporarily make changes for diagnostics and testing, use the dsetool perf subcommands.

graph_events

Graph event information.

graph_events:
   ttl_seconds: 600

ttl_seconds

The TTL in milliseconds.

Default: 600

cql_slow_log_options

Options to configure reporting distributed sub-queries for search (query executions on individual shards) that take longer than a specified period of time.

# cql_slow_log_options:
#   enabled: true
#   threshold: 200.0
#   minimum_samples: 100
#   ttl_seconds: 259200
#   skip_writing_to_db: true
#   num_slowest_queries: 5

Tip: See Collecting slow queries.

enabled

Enables (true) or disables (false) log entries for slow queries. When not set, the default is true.

Default: commented out (true)

threshold

The threshold in milliseconds or as a percentile.

• A value greater than 1 is expressed in time and will log queries that take longer than the specified number of milliseconds.
• A value of 0 to 1 is expressed as a percentile and will log queries that exceed this percentile.

Default: commented out (200.0 0.2 seconds)

minimum_samples

The initial number of queries before activating the percentile filter.

Default: commented out (100)

ttl_seconds

Time, in milliseconds, to keep the slow query log entries.

Default: commented out (259200)

skip_writing_to_db

Whether to keep slow queries in-memory only and not write data to database.

• false - write slow queries to the database; the threshold must be >= 2000 ms to prevent a high load on the database
• true - skip writing to database, keep slow queries only in memory

Default: commented out (true)

num_slowest_queries

The number of slow queries to keep in-memory.

Default: commented out (5)

cql_system_info_options

Options to configure collection of system-wide performance information about a cluster.

cql_system_info_options:
    enabled: false
    refresh_rate_ms: 10000

enabled

Whether to collect system-wide performance information about a cluster.

• false - do not collect metrics
• true - enable collection of metrics

Default: false

refresh_rate_ms

The length of the sampling period in milliseconds; the frequency to update the statistics.

Default: 10000 (10 seconds)

resource_level_latency_tracking_options

Options to configure collection of object I/O performance statistics.

resource_level_latency_tracking_options:
    enabled: false
    refresh_rate_ms: 10000

Tip: See Collecting system level diagnostics.

enabled

Whether to collect object I/O performance statistics.

• false - do not collect metrics
• true - enable collection of metrics

Default: false

refresh_rate_ms

The length of the sampling period in milliseconds; the frequency to update the statistics.

Default: 10000 (10 seconds)

db_summary_stats_options

Options to configure collection of summary statistics at the database level.

db_summary_stats_options:
    enabled: false
    refresh_rate_ms: 10000

Tip: See Collecting database summary diagnostics.

enabled

Whether to collect database summary performance information.

• false - do not collect metrics
• true - enable collection of metrics

Default: false

refresh_rate_ms

The length of the sampling period in milliseconds; the frequency to update the statistics.

Default: 10000 (10 seconds)

cluster_summary_stats_options

Options to configure collection of statistics at a cluster-wide level.

cluster_summary_stats_options:
    enabled: false
    refresh_rate_ms: 10000

Tip: See Collecting cluster summary diagnostics.

enabled

Whether to collect statistics at a cluster-wide level.

• false - do not collect metrics
• true - enable collection of metrics

Default: false

refresh_rate_ms

The length of the sampling period in milliseconds; the frequency to update the statistics.

Default: 10000 (10 seconds)

spark_cluster_info_options

Options to configure collection of data associated with Spark cluster and Spark applications.

spark_cluster_info_options:
    enabled: false
    refresh_rate_ms: 10000

Tip: See Monitoring Spark with Spark Performance Objects.

enabled

Whether to collect Spark performance statistics.

• false - do not collect metrics
• true - enable collection of metrics

Default: false

refresh_rate_ms

The length of the sampling period in milliseconds; the frequency to update the statistics.

Default: 10000 (10 seconds)

histogram_data_options

Histogram data for the dropped mutation metrics are stored in the dropped_messages table in the dse_perf keyspace.

histogram_data_options:
    enabled: false
    refresh_rate_ms: 10000
    retention_count: 3

Tip: See Collecting histogram diagnostics.

enabled

• false - do not collect metrics
• true - enable collection of metrics

Default: false

refresh_rate_ms

The length of the sampling period in milliseconds; the frequency to update the statistics.

Default: 10000 (10 seconds)

retention_count

Default: 3

user_level_latency_tracking_options

User-resource latency tracking settings.

user_level_latency_tracking_options:
    enabled: false
    refresh_rate_ms: 10000
    top_stats_limit: 100
    quantiles: false

Tip: See Collecting user activity diagnostics.

enabled

• false - do not collect metrics
• true - enable collection of metrics

Default: false

refresh_rate_ms

The length of the sampling period in milliseconds; the frequency to update the statistics.

Default: 10000 (10 seconds)

top_stats_limit

Limit the number of individual metrics.

Default: 100

quantiles

Default: false

Spark Performance Service options

spark_application_info_options:
    enabled: false
    refresh_rate_ms: 10000
    driver:
        sink: false
        connectorSource: false
        jvmSource: false
        stateSource: false
    executor:
        sink: false
        connectorSource: false
        jvmSource: false

spark_application_info_options

Statistics options.

enabled

• false - do not collect metrics
• true - enable collection of metrics

Default: false

refresh_rate_ms

The length of the sampling period in milliseconds; the frequency to update the statistics.

Default: 10000 (10 seconds)

driver

Options to configure collection of metrics at the Spark Driver.

connectorSource

Whether to collect Spark Cassandra Connector metrics at the Spark Driver.

• false - do not collect metrics
• true - enable collection of metrics

Default: false

jvmSource

Whether to collect JVM heap and garbage collection (GC) metrics from the Spark Driver.

• false - do not collect metrics
• true - enable collection of metrics

Default: false

stateSource

Whether to collect application state metrics at the Spark Driver.

• false - do not collect metrics
• true - enable collection of metrics

Default: false

executor

Options to configure collection of metrics at Spark executors.

sink

Whether to write metrics collected at Spark executors.

• false - do not collect metrics
• true - enable collection of metrics

Default: false

connectorSource

Whether to collect Spark Cassandra Connector metrics at Spark executors.

• false - do not collect metrics
• true - enable collection of metrics

Default: false

jvmSource

Whether to collect JVM heap and GC metrics at Spark executors.

• false - do not collect metrics
• true - enable collection of metrics

Default: false

DSE Analytics options

Spark resource and encryption options

spark_shared_secret_bit_length: 256
spark_security_enabled: false
spark_security_encryption_enabled: false

spark_daemon_readiness_assertion_interval: 1000

resource_manager_options:
   worker_options:
       cores_total: 0.7
       memory_total: 0.6

       workpools:
          - name: alwayson_sql
          cores: 0.25
          memory: 0.25

spark_ui_options:
    encryption: inherit
    encryption_options:
        enabled: false
        keystore: .keystore
        keystore_password: cassandra
        require_client_auth: false
        truststore: .truststore
        truststore_password: cassandra
        # Advanced settings
        # protocol: TLS
        # algorithm: SunX509
        # store_type: JKS
        # cipher_suites: [TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA]

spark_shared_secret_bit_length

The length of a shared secret used to authenticate Spark components and encrypt the connections between them. This value is not the strength of the cipher for encrypting connections. Default: 256

spark_security_enabled

In DSE 6.0.8 and later, when DSE authentication is enabled with authentication_options, Spark security is enabled regardless of this setting.

Enables Spark security based on shared secret infrastructure. Enables mutual authentication and optional encryption between DSE Spark Master and Workers, and of communication channels, except the web UI.

Default: false

spark_security_encryption_enabled

In DSE 6.0.8 and later, when DSE authentication is enabled with authentication_options, Spark security is enabled regardless of this setting.

Enables encryption between DSE Spark Master and Workers, and of communication channels, except the web UI. Uses DIGEST-MD5 SASL-based encryption mechanism. Requires spark_security_enabled: true.

Configure encryption between the Spark processes and DSE with client-to-node encryption in cassandra.yaml.

spark_daemon_readiness_assertion_interval

Time interval, in milliseconds, between subsequent retries by the Spark plugin for Spark Master and Worker readiness to start. Default: 1000

resource_manager_options

DataStax Enterprise can control the memory and cores offered by particular Spark Workers in semi-automatic fashion. You can define the total amount of physical resources available to Spark Workers, and optionally add named work pools with specific resources dedicated to them.

worker_options

If the option is not specified, the default value 0.6 is used. The amount of system resources that are made available to the Spark Worker.

cores_total

The number of total system cores available to Spark. If the option is not specified, the default value 0.7 is used.

Note: For DSE 6.0.11 and later, the SPARK_WORKER_TOTAL_CORES environment variables takes precedence over this setting.

This setting can be the exact number of cores or a decimal of the total system cores. When the value is expressed as a decimal, the available resources are calculated in the following way:

Spark Worker cores = cores_total * total system cores 

The lowest value that you can assign to Spark Worker cores is 1 core. If the results are lower, no exception is thrown and the values are automatically limited.

Note: Setting cores_total or a workpool's cores to 1.0 is a decimal value, meaning 100% of the available cores will be reserved. Setting cores_total or cores to 1 (no decimal point) is an explicit value, and one core will be reserved.

memory_total

The amount of total system memory available to Spark. This setting can be the exact amount of memory or a decimal of the total system memory. When the value is an absolute value, you can use standard suffixes like M for megabyte and G for gigabyte.

When the value is expressed as a decimal, the available resources are calculated in the following way:

Spark Worker memory = memory_total * (total system memory - memory assigned to DataStax Enterprise)

The lowest values that you can assign to Spark Worker memory is 64 MB. If the results are lower, no exception is thrown and the values are automatically limited.

If the option is not specified, the default value 0.6 is used.

Note: For DSE 6.0.11 and later, the SPARK_WORKER_TOTAL_MEMORY environment variables takes precedence over this setting.

workpools

Named work pools that can use a portion of the total resources defined under worker_options. A default work pool named default is used if no work pools are defined in this section. If work pools are defined, the resources allocated to the work pools are taken from the total amount, with the remaining resources available to the default work pool. The total amount of resources defined in the workpools section must not exceed the resources available to Spark in worker_options.

A work pool named alwayson_sql is created by default for AlwaysOn SQL. By default, it is configured to use 25% of the resources available to Spark.

name

The name of the work pool.

cores

The number of system cores to use in this work pool expressed as either an absolute value or a decimal value. This option follows the same rules as cores_total.

memory

The amount of memory to use in this work pool expressed as either an absolute value or a decimal value. This option follows the same rules as memory_total.

spark_ui_options

Specify the source for SSL settings for Spark Master and Spark Worker UIs. The spark_ui_options apply only to Spark daemon UIs, and do not apply to user applications even when the user applications are run in cluster mode.

encryption

• inherit - inherit the SSL settings from the client encryption options.
• custom - use the following encryption_optionsfrom dse.yaml.

Default: inherit

encryption_options

Set encryption options for HTTPS of Spark Master and Worker UI. The spark_encryption_options are not valid for DSE 5.1 and later.

enabled

Whether to enable Spark encryption for Spark client-to-Spark cluster and Spark internode communication.

Default: false

keystore

The keystore for Spark encryption keys.

The relative file path is the base Spark configuration directory that is defined by the SPARK_CONF_DIR environment variable. The default Spark configuration directory is resources/spark/conf.

Default: resources/dse/conf/.ui-keystore

keystore_password

The password to access the key store.

Default: cassandra

require_client_auth

Whether to require truststore for client authentication. When not set, the default is false.

Default: commented out (false)

truststore

The truststore for Spark encryption keys.

The relative file path is the base Spark configuration directory that is defined by the SPARK_CONF_DIR environment variable. The default Spark configuration directory is resources/spark/conf.

Default: commented out (resources/dse/conf/.ui-truststore)

truststore_password

The password to access the truststore.

Default: commented out (cassandra)

protocol

Defines the encryption protocol. The TLS protocol must be supported by JVM and Spark.

Default: commented out (TLS)

algorithm

Defines the key manager algorithm.

Default: commented out (TLSunX509SunX509S)

store_type

Defines the keystore type.

Default: commented out (JKS)

cipher_suites

Defines the cipher suites for Spark encryption:

• TLS_RSA_WITH_AES_128_CBC_SHA
• TLS_RSA_WITH_AES_256_CBC_SHA
• TLS_DHE_RSA_WITH_AES_128_CBC_SHA
• TLS_DHE_RSA_WITH_AES_256_CBC_SHA
• TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
• TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA

Default: commented out

Starting Spark drivers and executors

spark_process_runner:
    runner_type: default
    run_as_runner_options: 
        user_slots:
            - slot1
            - slot2

spark_process_runner:

Options to configure how Spark driver and executor processes are created and managed.

runner_type

• default - Use the default runner type.
• run_as - Use the run_as_runner_options options. See Running Spark processes as separate users.

run_as_runner_options

The slot users for separating Spark processes users from the DSE service user. See Running Spark processes as separate users.

Default: slot1, slot2

AlwaysOn SQL options

Properties to enable and configure AlwaysOn SQL.

# AlwaysOn SQL options
# alwayson_sql_options:
#     enabled: false
#     thrift_port: 10000
#     web_ui_port: 9077
#     reserve_port_wait_time_ms: 100
#     alwayson_sql_status_check_wait_time_ms: 500
#     workpool: alwayson_sql
#     log_dsefs_dir: /spark/log/alwayson_sql
#     auth_user: alwayson_sql
#     runner_max_errors: 10

alwayson_sql_options

The AlwaysOn SQL options enable and configure the server on this node.

enabled

Whether to enable AlwaysOn SQL for this node. The node must be an analytics node. When not set, the default is false.

Default: commented out (false)

thrift_port

The Thrift port on which AlwaysOn SQL listens.

Default: commented out (10000)

web_ui_port

The port on which the AlwaysOn SQL web UI is available.

Default: commented out (9077)

reserve_port_wait_time_ms

The wait time in milliseconds to reserve the thrift_port if it is not available.

Default: commented out (100)

alwayson_sql_status_check_wait_time_ms

The time in milliseconds to wait for a health check status of the AlwaysOn SQL server.

Default: commented out (500)

workpool

The work pool name used by AlwaysOn SQL.

Default: commented out (alwayson_sql)

log_dsefs_dir

Location in DSEFS of the AlwaysOn SQL log files.

Default: commented out (/spark/log/alwayson_sql)

auth_user

The role to use for internal communication by AlwaysOn SQL if authentication is enabled. Custom roles must be created with login=true.

Default: commented out (alwayson_sql)

runner_max_errors

The maximum number of errors that can occur during AlwaysOn SQL service runner thread runs before stopping the service. A service stop requires a manual restart.

Default: commented out (10)

DSE File System (DSEFS) options

dsefs_options:
    enabled: 
    keyspace_name: dsefs
    work_dir: /var/lib/dsefs
    public_port: 5598
    private_port: 5599
    data_directories:
      - dir: /var/lib/dsefs/data
        storage_weight: 1.0
        min_free_space: 5368709120

#     service_startup_timeout_ms: 30000
#     service_close_timeout_ms: 600000
#     server_close_timeout_ms: 2147483647 # Integer.MAX_VALUE
#     compression_frame_max_size: 1048576
#     query_cache_size: 2048
#     query_cache_expire_after_ms: 2000
#     gossip_options:
  #   round_delay_ms: 2000
  #   startup_delay_ms: 5000
  #   shutdown_delay_ms: 10000
# rest_options:
  #   request_timeout_ms: 330000
  #   connection_open_timeout_ms: 55000
  #   client_close_timeout_ms: 60000
  #   server_request_timeout_ms: 300000
  #   idle_connection_timeout_ms: 60000
  #   internode_idle_connection_timeout_ms: 120000
  #   core_max_concurrent_connections_per_host: 8
# transaction_options:
  #   transaction_timeout_ms: 3000
  #   conflict_retry_delay_ms: 200
  #   conflict_retry_count: 40
  #   execution_retry_delay_ms: 1000
  #   execution_retry_count: 3
#     block_allocator_options:
#         overflow_margin_mb: 1024
#         overflow_factor: 1.05

dsefs_options

Enable and configure options for DSEFS.

enabled

Whether to enable DSEFS.

• true - enables DSEFS on this node, regardless of the workload.
• false - disables DSEFS on this node, regardless of the workload.
• blank or commented out (#) - DSEFS will start only if the node is configured to run analytics workloads.

Default: commented out (blank)

keyspace_name

The keyspace where the DSEFS metadata is stored. You can optionally configure multiple DSEFS file systems within a single datacenter by specifying different keyspace names for each cluster.

Default: commented out (dsefs)

work_dir

The local directory for storing the local node metadata, including the node identifier. The volume of data stored in this directory is nominal and does not require configuration for throughput, latency, or capacity. This directory must not be shared by DSEFS nodes.

Default: commented out (/var/lib/dsefs)

public_port

The public port on which DSEFS listens for clients.

Note: DataStax recommends that all nodes in the cluster have the same value. Firewalls must open this port to trusted clients. The service on this port is bound to the native_transport_address.

Default: commented out (5598)

private_port

The private port for DSEFS inter-node communication.

CAUTION: Do not open this port to firewalls; this private port must be not visible from outside of the cluster.

Default: commented out (5599)

data_directories

One or more data locations where the DSEFS data is stored.

- dir

Mandatory attribute to identify the set of directories. DataStax recommends segregating these data directories on physical devices that are different from the devices that are used for DataStax Enterprise. Using multiple directories on JBOD improves performance and capacity.

Default: commented out (/var/lib/dsefs/data)

storage_weight

The weighting factor for this location specifies how much data to place in this directory, relative to other directories in the cluster. This soft constraint determines how DSEFS distributes the data. For example, a directory with a value of 3.0 receives about three times more data than a directory with a value of 1.0.

Default: commented out (1.0)

min_free_space

The reserved space, in bytes, to not use for storing file data blocks. You can use a unit of measure suffix to specify other size units. For example: terabyte (1 TB), gigabyte (10 GB), and megabyte (5000 MB).

Default: commented out (5368709120)

service_startup_timeout_ms

Wait time, in milliseconds, before the DSEFS server times out while waiting for services to bootstrap.

Default: commented out (30000)

service_close_timeout_ms

Wait time, in milliseconds, before the DSEFS server times out while waiting for services to close.

Default: commented out (600000)

server_close_timeout_ms

Wait time, in milliseconds, that the DSEFS server waits during shutdown before closing all pending connections.

Default: commented out (2147483647)

compression_frame_max_size

The maximum accepted size of a compression frame defined during file upload.

Default: commented out (1048576)

query_cache_size

Maximum number of elements in a single DSEFS Server query cache.

Default: commented out (2048)

query_cache_expire_after_ms

The time to retain the DSEFS Server query cache element in cache. The cache element expires when this time is exceeded.

Default: commented out (2000)

gossip options

Options to configure DSEFS gossip rounds.

round_delay_ms

The delay, in milliseconds, between gossip rounds.

Default: commented out (2000)

startup_delay_ms

The delay time, in milliseconds, between registering the location and reading back all other locations from the database.

Default: commented out (5000)

shutdown_delay_ms

The delay time, in milliseconds, between announcing shutdown and shutting down the node.

Default: commented out (30000)

rest_options

Options to configure DSEFS rest times.

request_timeout_ms

The time, in milliseconds, that the client waits for a response that corresponds to a given request.

Default: commented out (330000)

connection_open_timeout_ms

The time, in milliseconds, that the client waits to establish a new connection.

Default: commented out (55000)

client_close_timeout_ms

The time, in milliseconds, that the client waits for pending transfer to complete before closing a connection.

Default: commented out (60000)

server_request_timeout_ms

The time, in milliseconds, to wait for the server rest call to complete.

Default: commented out (300000)

idle_connection_timeout_ms

The time, in milliseconds, for RestClient to wait before closing an idle connection. If RestClient does not close connection after timeout, the connection is closed after 2*idle_connection_timeout_ms.

• time - wait time to close idle connection
• 0 - disable closing idle connections

Default: commented out (60000)

internode_idle_connection_timeout_ms

Wait time, in milliseconds, before closing idle internode connection. The internode connections are primarily used to exchange data during replication. Do not set lower than the default value for heavily utilized DSEFS clusters.

Default: commented out (0) (disabled)

core_max_concurrent_connections_per_host

Maximum number of connections to a given host per single CPU core. DSEFS keeps a connection pool for each CPU core.

Default: 8

transaction_options

Options to configure DSEFS transaction times.

transaction_timeout_ms

Transaction run time, in milliseconds, before the transaction is considered for timeout and rollback.

Default: 3000

conflict_retry_delay_ms

Wait time, in milliseconds, before retrying a transaction that was ended due to a conflict. Default: 200

conflict_retry_count

The number of times to retry a transaction before giving up. Default: 40

execution_retry_delay_ms

Wait time, in milliseconds, before retrying a failed transaction payload execution. Default: 1000

execution_retry_count

The number of payload execution retries before signaling the error to the application. Default: 3

block_allocator_options

Controls how much additional data can be placed on the local coordinator before the local node overflows to the other nodes. The trade-off is between data locality of writes and balancing the cluster. A local node is preferred for a new block allocation, if:

used_size_on_the_local_node < average_used_size_per_node * overflow_factor + overflow_margin

overflow_margin_mb

• margin_size - overflow margin size in megabytes
• 0 - disable block allocation overflow

Default: commented out (1024)

overflow_factor

• factor - overflow factor on an exponential scale
• 1.0 - disable block allocation overflow

Default: commented out (1.05)

DSE Graph options

DSE Graph system-level options

# graph:
    # analytic_evaluation_timeout_in_minutes: 10080
    # realtime_evaluation_timeout_in_seconds: 30
    # schema_agreement_timeout_in_ms: 10000
    # system_evaluation_timeout_in_seconds: 180
    # index_cache_size_in_mb: 128
    # max_query_queue: 10000
    # max_query_threads (no explicit default)
    # max_query_params: 16

graph

These graph options are system-level configuration options and options that are shared between graph instances.

Option names and values expressed in ISO 8601 format used in earlier DSE 5.0 releases are still valid. The ISO 8601 format is deprecated.

analytic_evaluation_timeout_in_minutes

Maximum time to wait for an OLAP analytic (Spark) traversal to evaluate. When not set, the default is 10080 (168 hours).

Default: commented out (10080)

realtime_evaluation_timeout_in_seconds

Maximum time to wait for an OLTP real-time traversal to evaluate. When not set, the default is 30 seconds.

Default: commented out (30)

schema_agreement_timeout_in_ms

Maximum time to wait for the database to agree on schema versions before timing out. When not set, the default is 10000 (10 seconds).

Default: commented out (10000)

system_evaluation_timeout_in_seconds

Maximum time to wait for a graph system-based request to execute, like creating a new graph. When not set, the default is 180 (3 minutes).

Default: commented out (180)

schema_mode

Controls the way that the schemas are handled.

• Production = Schema must be created before data insertion. Schema cannot be changed after data is inserted. Full graph scans are disallowed unless the option graph.allow_scan is changed to TRUE.
• Development = No schema is required to write data to a graph. Schema can be changed after data is inserted. Full graph scans are allowed unless the option graph.allow_scan is changed to FALSE.

When not set, the default is Production. If this option is not present, manually enter it to use Development.

Default: not present

index_cache_size_in_mb

The amount of ram to allocate to the index cache. When not set, the default is 128.

Default: commented out (128)

max_query_queue

The maximum number of CQL queries that can be queued as a result of Gremlin requests. Incoming queries are rejected if the queue size exceeds this setting. When not set, the default is 10000.

Default: commented out (10000)

max_query_threads

The maximum number of threads to use for queries to the database. When this option is not set, the default is calculated:

• If gremlinPool is present and nonzero:

  10 * the gremlinPool setting

• If gremlinPool is not present in this file or set to zero:

  The number of available CPU cores

See gremlinPool.

Default: calculated

max_query_params

The maximum number of parameters that can be passed on a graph query request for TinkerPop drivers and drivers using the Cassandra native protocol. Passing very large numbers of parameters on requests is an anti-pattern, because the script evaluation time increases proportionally. DataStax recommends reducing the number of parameters to speed up script compilation times. Before you increase this value, consider alternate methods for parameterizing scripts, like passing a single map. If the graph query request requires many arguments, pass a list.

Default: commented out (16)

DSE Graph Gremlin Server options

# gremlin_server:
    # port: 8182
    # threadPoolWorker: 2
    # gremlinPool: 0
#     scriptEngines:
#         gremlin-groovy:
#             config:
#                sandbox_enabled: false
#                sandbox_rules:
#                     whitelist_packages:
#                         - package.name
#                     whitelist_types:
#                         - fully.qualified.type.name
#                     whitelist_supers:
#                         - fully.qualified.class.name
#                     blacklist_packages:
#                         - package.name
#                     blacklist_supers:
#                         - fully.qualified.class.name