cassandra-hardened

Data

Hardened

Updated 10 hours ago

Cassandra-Hardened Overview

Secure your stack with a CIS-compliant Cassandra-Hardened image freshly-built by Minimus. Minimus images always include the most up-to-date package version for all packages and dependencies.

Use Apache Cassandra to set up a highly scalable, distributed NoSQL database in a containerized environment. Cassandra supports clusters across multiple datacenters with asynchronous masterless replication and provides high availability and low latency with no single point of failure.

About Minimus Hardened Images

Minimus Hardened images provide secure by default configurations that comply with CIS Benchmarks. The CIS Benchmark for Apache Cassandra is a consensus-based security hardening guide that is aligned with industry standards and defines recommended configuration settings, access controls, and operational practices to reduce the attack surface. Review the compliance report to see the special audit report.

Notes:

The image’s default configuration file enforces many CIS hardening controls. Exercise caution when overriding this file, as custom configurations may inadvertently weaken or negate CIS compliance.
Full CIS benchmark compliance requires additional post-deployment runtime validations that are out of scope for Minimus.

Try It Out

Prerequisites

A running Kubernetes cluster (v1.21 or higher is recommended)
kubectl installed and configured

Step 1: Start Cluster

If you have a cluster to work with, skip this step. Otherwise, start a Minikube cluster. Deployment instructions

Step 2: Create Namespace

kubectl create ns cassandra

Step 3: Save Values

Copy cassandra-statefulset.yaml below to your working directory:

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: cassandra
  namespace: cassandra
spec:
  serviceName: cassandra
  replicas: 1
  selector:
    matchLabels:
      app: cassandra
  template:
    metadata:
      labels:
        app: cassandra
    spec:
      containers:
        - name: cassandra
          image: reg.mini.dev/cassandra-hardened
          imagePullPolicy: Always
          ports:
            - containerPort: 9042
              name: cql
            - containerPort: 7000
              name: intra-node
          env:
            - name: MAX_HEAP_SIZE
              value: "512M"
            - name: HEAP_NEWSIZE
              value: "100M"
          readinessProbe:
            exec:
              command:
                - /bin/bash
                - -c
                - nodetool status | grep -E "^UN\s+$(hostname -i)"
            initialDelaySeconds: 60
            periodSeconds: 15
            timeoutSeconds: 10
            failureThreshold: 10
          livenessProbe:
            exec:
              command:
                - /bin/bash
                - -c
                - nodetool status
            initialDelaySeconds: 90
            periodSeconds: 30
            timeoutSeconds: 10
            failureThreshold: 5
          volumeMounts:
            - name: cassandra-data
              mountPath: /var/lib/cassandra/data
  volumeClaimTemplates:
    - metadata:
        name: cassandra-data
      spec:
        accessModes: ["ReadWriteOnce"]
        resources:
          requests:
            storage: 2Gi
---
apiVersion: v1
kind: Service
metadata:
  name: cassandra
  namespace: cassandra
spec:
  clusterIP: None
  selector:
    app: cassandra
  ports:
    - name: cql
      port: 9042
      targetPort: 9042
    - name: intra-node
      port: 7000
      targetPort: 7000

Step 4: Deploy the Image

kubectl apply -n cassandra -f cassandra-statefulset.yaml

Step 5: Change the Password

First, test the server:

kubectl exec -it -n cassandra \
  cassandra-0 -- cqlsh -u cassandra -p cassandra -e "DESCRIBE KEYSPACES;"

You should see a response:

Warning: Using a password on the command line interface can be insecure.
Recommendation: use the credentials file to securely provide the password.


system       system_distributed  system_traces  system_virtual_schema
system_auth  system_schema       system_views

Change the password:

kubectl exec -it -n cassandra cassandra-0 -- \
  cqlsh -u cassandra -p cassandra -e "
  ALTER USER cassandra WITH PASSWORD 'MyStr0ngP@ss!';"

Step 6: Clean Up

Delete the resources:

kubectl delete -n cassandra -f cassandra-statefulset.yaml

Because this is a StatefulSet, Kubernetes intentionally leaves behind the storage volumes (PVCs) to prevent accidental data loss. To view the PVCs:

kubectl get pvc -n cassandra

If you want to delete them all:

kubectl delete pvc --all -n cassandra

Otherwise, you can delete them one-by-one:

kubectl delete pvc <pvc-name> -n cassandra

Finally, delete the namespace:

kubectl delete namespace cassandra

Technical Considerations

The Cassandra-Hardened image provided by Minimus is a slim, security-hardened alternative to the public image from Docker Hub. The images are largely interchangeable, with a few differences as noted below.

Cassandra-Hardened built by Minimus:

The image does not have a default volume. The public image defaults to /var/lib/cassandra.
Drill down on the version specification tab to see the default user, listening ports, entrypoint, volumes, environment variables, etc.

The Payoff

A hardened, minimal image that will remain more secure for the long run and accrue vulnerabilities at a slower rate.

See the risk reduction dashboard for a detailed CVE comparison over the past 30 days.
Review the compliance report to see the default hardening and security configurations for the image.

Terms & Info

Trademark

This catalog is published by Minimus. All product names, logos, and marks, other than those belonging to Minimus, shown are owned by their respective rights holders and appear here only to identify the open source software each image contains. Minimus claims no ownership of those marks and implies no affiliation with, endorsement by, certification by, or sponsorship by any rights holder.

Disclaimer

Images are provided "as-is" without warranty of any kind. "Hardened" refers to the security configuration applied at the time of build and does not constitute a guarantee of ongoing security or absence of vulnerabilities. The free tier is provided without support, SLA, or guaranteed patching timelines. Security updates may be applied to paid subscriptions before or instead of free tier images. By pulling or using any image you agree to our Terms of Use.