{"record":{"id":"8c5641441cd53629","repo":"apache/cassandra","slug":"initializing-with-cluster-metadata-from","errorCode":null,"errorMessage":"Initializing with cluster metadata from: {}","messagePattern":"Initializing with cluster metadata from: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"src/java/org/apache/cassandra/tcm/Startup.java","lineNumber":179,"sourceCode":"                    else\n                    {\n                        // nothing more to do, so just initialize messaging\n                        initMessaging.run();\n                    }\n                }\n                break;\n            case VOTE:\n                logger.info(\"Initializing for discovery\");\n                initializeAsNonCmsNode(wrapProcessor);\n                initializeForDiscovery(initMessaging);\n                break;\n            case UPGRADE:\n                logger.info(\"Initializing from gossip\");\n                initializeFromGossip(wrapProcessor, initMessaging);\n                break;\n            case BOOT_WITH_CLUSTERMETADATA:\n                String fileName = CassandraRelevantProperties.TCM_UNSAFE_BOOT_WITH_CLUSTERMETADATA.getString();\n                logger.warn(\"Initializing with cluster metadata from: {}\", fileName);\n                reinitializeWithClusterMetadata(fileName, wrapProcessor, initMessaging);\n                break;\n        }\n    }\n\n    /**\n     * Make this node the _first_ CMS node.\n     * <p>\n     * (1) Append PreInitialize transformation to local in-memory log.\n     * (1a) Once this enacted and the distributed metadata keyspace is initialized, the PreInitialize transformation\n     * will be inserted into the log table. This is required since as before this point, the keyspace was not availble\n     * or configured with any replication or placements.\n     * (2) Commit Initialize transformation, which holds a complete snapshot of metadata as of now.\n     * Other nodes in the cluster, if there are any, will receive both of these log entries and enact them locally.\n     * <p>\n     * This process is applicable for gossip upgrades as well as regular vote-and-startup process.\n     */\n    public static void initializeAsFirstCMSNode()","sourceCodeStart":161,"sourceCodeEnd":197,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/tcm/Startup.java#L161-L197","documentation":"Startup.initialize logs that the node is initializing cluster metadata from the file named by TCM_UNSAFE_BOOT_WITH_CLUSTERMETADATA when the startup mode resolves to BOOT_WITH_CLUSTERMETADATA. This is an explicitly unsafe, operator-requested bootstrap path: instead of discovering metadata from peers or gossip, the node reinitializes its ClusterMetadata from a serialized file on disk.","triggerScenarios":"Starting Cassandra with the system property cassandra.tcm_unsafe_boot_with_clustermetadata set to a metadata file path, which forces StartupMode.BOOT_WITH_CLUSTERMETADATA and the reinitializeWithClusterMetadata(...) code path.","commonSituations":"Disaster recovery where the whole cluster metadata is lost and operators restore from a captured ClusterMetadata snapshot file; test/lab setups deliberately bypassing CMS bootstrap; misuse of the flag in production configs left over from a recovery drill.","solutions":["Confirm the property cassandra.tcm_unsafe_boot_with_clustermetadata is intentional; remove it for normal startup.","Validate the metadata file matches the cluster (host IDs, tokens) before booting with it.","Ensure all other nodes are stopped or consistent, since unsafe boot can diverge cluster metadata.","Prefer normal CMS discovery or initializeFromGossip when peers are available."],"exampleFix":"// before: cassandra-env.sh\nJVM_OPTS=\"$JVM_OPTS -Dcassandra.tcm_unsafe_boot_with_clustermetadata=/tmp/metadata.bin\"\n// after: remove the flag for normal operation\n# JVM_OPTS=\"$JVM_OPTS -Dcassandra.tcm_unsafe_boot_with_clustermetadata=/tmp/metadata.bin\"","handlingStrategy":"validation","validationCode":"// Refuse unsafe boot unless explicitly authorized\nif (CassandraRelevantProperties.TCM_UNSAFE_BOOT_WITH_CLUSTERMETADATA.isPresent()\n    && !Boolean.parseBoolean(System.getenv(\"ALLOW_UNSAFE_TCM_BOOT\"))) {\n    throw new IllegalStateException(\"TCM_UNSAFE_BOOT_WITH_CLUSTERMETADATA set without ALLOW_UNSAFE_TCM_BOOT\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never leave the unsafe boot property in production cassandra-env.sh.","Keep the metadata file backed up and checksum-verified before booting with it.","Restrict who can modify JVM_OPTS / startup scripts."],"tags":["tcm","startup","unsafe-flag","cluster-metadata"],"backgroundTag":"invalid-config-value","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}