{"record":{"id":"01573238ed633432","repo":"t8y2/dbx","slug":"cassandra-secure-connect-bundles-cannot-be-combine","errorCode":null,"errorMessage":"Cassandra secure connect bundles cannot be combined with Kerberos authentication","messagePattern":"Cassandra secure connect bundles cannot be combined with Kerberos authentication","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/cassandra-go/config.go","lineNumber":439,"sourceCode":"\t}\n\tif err := applyLoadBalancingPolicy(cluster, config); err != nil {\n\t\treturn nil, err\n\t}\n\treturn cluster, nil\n}\n\nfunc (config *cassandraConfig) finalize() error {\n\tvar err error\n\tconfig.configFile, err = normalizeLocalFilePath(config.configFile)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"invalid Cassandra configfile: %w\", err)\n\t}\n\tconfig.secureConnectBundle, err = normalizeLocalFilePath(config.secureConnectBundle)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"invalid Cassandra secureconnectbundle: %w\", err)\n\t}\n\tif config.secureConnectBundle != \"\" && config.kerberos.enabled {\n\t\treturn fmt.Errorf(\"Cassandra secure connect bundles cannot be combined with Kerberos authentication\")\n\t}\n\tif config.secureConnectBundle != \"\" && (config.username == \"\" || config.password == \"\") {\n\t\treturn fmt.Errorf(\"Cassandra secure connect bundles require username and password credentials\")\n\t}\n\tif config.kerberos.enabled {\n\t\tif err := config.kerberos.finalize(config.username, config.password); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc splitHosts(raw string) []string {\n\traw = strings.ReplaceAll(raw, \"--\", \",\")\n\tparts := strings.FieldsFunc(raw, func(char rune) bool { return char == ',' || char == ';' })\n\thosts := make([]string, 0, len(parts))\n\tfor _, part := range parts {\n\t\thost := strings.TrimSpace(part)","sourceCodeStart":421,"sourceCodeEnd":457,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/cassandra-go/config.go#L421-L457","documentation":"finalize() enforces mutually exclusive authentication modes: a secure connect bundle (which carries its own connection/security settings) cannot be combined with Kerberos authentication. The library rejects any configuration that sets both.","triggerScenarios":"Setting secureConnectBundle to a non-empty path while kerberos.enabled is true in the Cassandra config processed by parseCassandraConfig.","commonSituations":"Merging config fragments from two clusters — one Astra-based (bundle) and one Kerberized on-prem cluster — into a single config.","solutions":["Remove the secureConnectBundle option if the target cluster uses Kerberos","Disable kerberos.enabled if the target cluster is reached via the secure connect bundle","Split into two agent configurations targeting each cluster separately"],"exampleFix":"// before\nconfig.secureConnectBundle = \"/etc/cassandra/bundle.zip\"\nconfig.kerberos.enabled = true\n// after\nconfig.secureConnectBundle = \"/etc/cassandra/bundle.zip\"\nconfig.kerberos.enabled = false","handlingStrategy":"validation","validationCode":"if bundle != \"\" && kerberosEnabled {\n\treturn errors.New(\"choose either secureConnectBundle or Kerberos, not both\")\n}","typeGuard":null,"tryCatchPattern":"if err := parseCassandraConfig(cfg); err != nil {\n\tif strings.Contains(err.Error(), \"cannot be combined with Kerberos\") {\n\t\t// decide auth mode and reload config\n\t}\n\treturn err\n}","preventionTips":["Pick one auth mode per cluster config","Template configs per environment so Astra and Kerberized cluster settings never merge","Validate auth combinations in CI config linting"],"tags":["cassandra","config","kerberos","validation"],"backgroundTag":"conflicting-config-options","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}