{"record":{"id":"2c86d8dfcc450949","repo":"t8y2/dbx","slug":"cassandra-secure-connect-bundles-require-username","errorCode":null,"errorMessage":"Cassandra secure connect bundles require username and password credentials","messagePattern":"Cassandra secure connect bundles require username and password credentials","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/cassandra-go/config.go","lineNumber":442,"sourceCode":"\t}\n\treturn cluster, nil\n}\n\nfunc (config *cassandraConfig) finalize() error {\n\tvar err error\n\tconfig.configFile, err = normalizeLocalFilePath(config.configFile)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"invalid Cassandra configfile: %w\", err)\n\t}\n\tconfig.secureConnectBundle, err = normalizeLocalFilePath(config.secureConnectBundle)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"invalid Cassandra secureconnectbundle: %w\", err)\n\t}\n\tif config.secureConnectBundle != \"\" && config.kerberos.enabled {\n\t\treturn fmt.Errorf(\"Cassandra secure connect bundles cannot be combined with Kerberos authentication\")\n\t}\n\tif config.secureConnectBundle != \"\" && (config.username == \"\" || config.password == \"\") {\n\t\treturn fmt.Errorf(\"Cassandra secure connect bundles require username and password credentials\")\n\t}\n\tif config.kerberos.enabled {\n\t\tif err := config.kerberos.finalize(config.username, config.password); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc splitHosts(raw string) []string {\n\traw = strings.ReplaceAll(raw, \"--\", \",\")\n\tparts := strings.FieldsFunc(raw, func(char rune) bool { return char == ',' || char == ';' })\n\thosts := make([]string, 0, len(parts))\n\tfor _, part := range parts {\n\t\thost := strings.TrimSpace(part)\n\t\tif host == \"\" {\n\t\t\tcontinue\n\t\t}","sourceCodeStart":424,"sourceCodeEnd":460,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/cassandra-go/config.go#L424-L460","documentation":"finalize() requires that when a secure connect bundle is configured, both username and password credentials are also provided. Bundled connections authenticate with explicit credentials, so missing ones are rejected at config parse time.","triggerScenarios":"secureConnectBundle is set to a non-empty path but username or password is an empty string when finalize() runs via parseCassandraConfig.","commonSituations":"Configuring the bundle path but forgetting the Astra clientId/clientSecret credentials, or credentials supplied only via env vars that are unset in the runtime.","solutions":["Set both username and password alongside secureConnectBundle","Verify the env vars feeding the credentials are actually set in the runtime environment","If the cluster does not need the bundle, remove secureConnectBundle instead"],"exampleFix":"// before\nconfig.secureConnectBundle = \"/etc/cassandra/bundle.zip\" // no credentials\n// after\nconfig.secureConnectBundle = \"/etc/cassandra/bundle.zip\"\nconfig.username = \"token\"\nconfig.password = os.Getenv(\"ASTRA_CLIENT_SECRET\")","handlingStrategy":"validation","validationCode":"if bundle != \"\" && (username == \"\" || password == \"\") {\n\treturn errors.New(\"secureConnectBundle requires username and password\")\n}","typeGuard":null,"tryCatchPattern":"if err := parseCassandraConfig(cfg); err != nil {\n\tif strings.Contains(err.Error(), \"require username and password\") {\n\t\tlog.Fatalf(\"set credentials for bundle auth: %v\", err)\n\t}\n\treturn err\n}","preventionTips":["Always set username (clientId) and password (secret) with Astra bundles","Check required env vars at process startup","Fail fast on empty credentials before connecting"],"tags":["cassandra","config","authentication","credentials"],"backgroundTag":"missing-credentials","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}