[CASSANDRA-17923] Mixed mode support for internode authentication during TLS upgrades

• Type: New Feature
• Status: Resolved
• Priority: Normal
• Resolution: Fixed
• Fix Version/s: 5.0-alpha1, 5.0
• Component/s: Messaging/Internode
• Change Category: Operability
• Complexity: Normal
• Platform: All

Source Control Link

https://github.com/apache/cassandra/commit/ca75ffe4d09a3e7b26a56345c0bdacaa284eaab7

Test and Documentation Plan

Added test cases to test internode TLS support for scenarios like rolling updates. Also tested this TLS mixed mode operation using CCM locally.

 

https://app.circleci.com/pipelines/github/jyothsnakonisa/cassandra?branch=mixmode-internode-auth https://app.circleci.com/pipelines/github/jyothsnakonisa/cassandra?branch=mixmode-internode-auth

• Assignee: Jyothsna Konisa
• Reporter: Jyothsna Konisa

Authors

Jyothsna Konisa

Reviewers

Jon Meredith, Yifan Cai

• Tester: Jyothsna Konisa
• Created: 26/Sep/22 21:55
• Updated: 12/Sep/23 13:02
• Resolved: 07/Oct/22 22:22

Description

During upgrades from "non-ssl -> ssl" or "ssl-mTLS" the cluster should be able to function in mixed mode with some nodes supporting "non-ssl" authentication and the new nodes supporting "mTLS" authentication. Currently we do not have this supported and because of which upgrades are not possible for upgrading internode authentication strategies.

If a node is configured in optional mode for internode connections, retry with other SSL strategies If the node is not able to connect to other nodes due to authentication problems.