Docs / Apache Cassandra

Connect Apache Cassandra

Distributed wide-column store

Cassandra is a distributed wide-column store. climpt connects over CQL with a role that holds SELECT and nothing else. You only need to name one reachable node — the driver discovers the rest of the cluster itself.

Credentials

Host
A contact point — hostname or IP of at least one node, for example cassandra.example.com.
Port
The CQL native transport port, 9042 by default.
Keyspace
The keyspace to query, for example analytics.
Username
The read-only role created below.
Password
That role’s password.

Before you start

Both authentication and authorization must be switched on in cassandra.yaml. With AllowAllAuthenticator in place, grants are not enforced at all.

authenticator: PasswordAuthenticator
authorizer: CassandraAuthorizer

Change the default cassandra/cassandra superuser password if you have not already.

Creating a read-only role

Connect with cqlsh as a superuser.

CREATE ROLE climpt_readonly
WITH PASSWORD = 'strong_password_here'
AND LOGIN = true;

GRANT SELECT ON KEYSPACE analytics TO climpt_readonly;

-- Optional: schema introspection
GRANT DESCRIBE ON ALL KEYSPACES TO climpt_readonly;

Granting SELECT on specific tables rather than the whole keyspace is tighter, if you know which tables you want analysed.

Client encryption

client_encryption_options:
  enabled: true
  keystore: /path/to/keystore.jks
  keystore_password: keystore_pass

Restart Cassandra after changing this, then open port 9042 only to the addresses that need it.

Managed Cassandra

  • DataStax Astra — download the Secure Connect Bundle from the Astra dashboard. TLS is on by default, and user and role management happens in the Astra console rather than in CQL.
  • AWS Keyspaces — connects over TLS on port 9142 with service-specific credentials from IAM, and requires the Starfield digital certificate.

Worth knowing

  • Grant only SELECT. MODIFY, CREATE, ALTER and DROP are all access climpt will not use.
  • Rotating credentials means creating a new role and revoking the old one, rather than changing a password in place.