CODEWITHSUNDEEP
cassandra
patrick
patrick

Reputation: 16979

system_auth replicates without changing replication_factor, so why change it?

I have a PasswordAuthenticator login, user = cassandra, with system_auth RF = 1 and 2 non-seed nodes. When I changed the password, it propagated to the non-seed nodes even though RF = 1. So why change the RF? (The reason I ask is: I noticed if I change it to 3 before the other nodes are up --> I can't login: QUORUM error, so this is a bootstrapping question)

cassandra@cqlsh:system_auth> SELECT * FROM system_schema.keyspaces;

 keyspace_name      | durable_writes | replication
--------------------+----------------+---------------------------------------------------------------------------------------
        system_auth |           True |   {'class': 'org.apache.cassandra.locator.SimpleStrategy', 'replication_factor': '1'}

Upvotes: 1

Views: 162

Answers (1)

Aaron
Aaron

Reputation: 57808

Two problems can happen if you don't change it:

  1. In a multi-node cluster, if the node responsible for your user/role data crashes, you won't be able to log in.
  2. In a multi-DC cluster, if you attempt to connect with your application using a "local" data center, you will only be able to connect to nodes in the DC containing your user/role data. This is because SimpleStrategy is not DC aware. Not changing it will also only store one replica in the cluster, which will only be in a single DC. Login attempts on the other DCs will fail.

In short, I recommend:

  • Never use SimpleStrategy. It's not useful for production MDHA (multi-datacenter high availability), so why build a lower environment with it?
  • Set the RF on system_auth to number of nodes, but no more than 3.
  • Creating an additional super user, and changing the password of the cassandra/cassandra user...never using it again. The cassandra/cassandra user triggers some special things inside of cqlsh to operate at QUORUM, by default. If nodes crash, you don't want the extra problems which that opens the door for.

Here's a related answer, which should help: Replication Factor to use for system_auth

Upvotes: 3

Related Questions