It is not possible to reconfigure role_name_policy…

Error message

It is not possible to reconfigure role_name_policy guardrail because property 'role_name_policy_reconfiguration_enabled' is set to false.

What it means

RoleNamePolicyGuardrail.reconfigure refuses live reconfiguration when the DatabaseDescriptor property 'role_name_policy_reconfiguration_enabled' is false. Like the password policy guardrail, role naming policy is treated as a security-sensitive setting that must not change at runtime; the request is logged and ignored.

Solutions

Enable role_name_policy_reconfiguration_enabled in cassandra.yaml and restart to permit runtime changes.
Change the role name policy in cassandra.yaml and perform a rolling restart instead.
Exclude role_name_policy from automated runtime reconfiguration flows.

Example fix

// before (cassandra.yaml)
role_name_policy_reconfiguration_enabled: false
// after
role_name_policy_reconfiguration_enabled: true

Defensive patterns

Strategy: validation

Validate before calling

if (!DatabaseDescriptor.isRoleNamePolicyReconfigurationEnabled()) {
    throw new UnsupportedOperationException("role_name_policy_reconfiguration_enabled is false; update cassandra.yaml and restart");
}

Try / catch

try { guardrail.reconfigure(newConfig); }
catch (UnsupportedOperationException e) { /* fall back to yaml + restart flow */ }

Prevention

Do not include role_name_policy in runtime config-push tooling unless the flag is enabled.
Plan role policy changes as restart-required operations.

When it happens

Trigger: Invoking reconfigure() on the role_name_policy guardrail (JMX/config update of guardrails) while role_name_policy_reconfiguration_enabled is set to false in the node configuration.

Common situations: Centralized guardrail-management tooling pushing updates to all guardrails; operators trying to tighten role naming conventions (e.g. regex, prefixes) on a live cluster without a restart.

Related errors

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/ea7d7ef03fec803a. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/db/guardrails/RoleNamePolicyGuardrail.java:48

public class RoleNamePolicyGuardrail extends AbstractCustomGuardrail<String>
{
    private static final Logger logger = LoggerFactory.getLogger(RoleNamePolicyGuardrail.class);

    /**
     * @param configSupplier configuration supplier of the custom guardrail
     */
    public RoleNamePolicyGuardrail(Supplier<CustomGuardrailConfig> configSupplier)
    {
        super("role_name_policy", null, configSupplier, true);
    }

    @Override
    void reconfigure(@Nullable Map<String, Object> newConfig)
    {
        if (!DatabaseDescriptor.isRoleNamePolicyReconfigurationEnabled())
        {
            logger.warn("It is not possible to reconfigure role_name_policy guardrail because " +
                        "property 'role_name_policy_reconfiguration_enabled' is set to false.");
            return;
        }

        super.reconfigure(newConfig);
    }

    @Override
    protected void throwException(String message, String redactedMessage)
    {
        throw new RoleNamePolicyGuardrailException(message, redactedMessage);
    }

    public static class RoleNamePolicyGuardrailException extends GuardrailViolatedException
    {
        public final String redactedMessage;

        RoleNamePolicyGuardrailException(String message, String redactedMessage)

View on GitHub (pinned to 88fd0f6a0e)