Cassandra secure connect bundles cannot be combined with…

Error message

Cassandra secure connect bundles cannot be combined with Kerberos authentication

What it means

finalize() enforces mutually exclusive authentication modes: a secure connect bundle (which carries its own connection/security settings) cannot be combined with Kerberos authentication. The library rejects any configuration that sets both.

Solutions

Remove the secureConnectBundle option if the target cluster uses Kerberos
Disable kerberos.enabled if the target cluster is reached via the secure connect bundle
Split into two agent configurations targeting each cluster separately

Example fix

// before
config.secureConnectBundle = "/etc/cassandra/bundle.zip"
config.kerberos.enabled = true
// after
config.secureConnectBundle = "/etc/cassandra/bundle.zip"
config.kerberos.enabled = false

Defensive patterns

Strategy: validation

Validate before calling

if bundle != "" && kerberosEnabled {
	return errors.New("choose either secureConnectBundle or Kerberos, not both")
}

Try / catch

if err := parseCassandraConfig(cfg); err != nil {
	if strings.Contains(err.Error(), "cannot be combined with Kerberos") {
		// decide auth mode and reload config
	}
	return err
}

Prevention

Pick one auth mode per cluster config
Template configs per environment so Astra and Kerberized cluster settings never merge
Validate auth combinations in CI config linting

When it happens

Trigger: Setting secureConnectBundle to a non-empty path while kerberos.enabled is true in the Cassandra config processed by parseCassandraConfig.

Common situations: Merging config fragments from two clusters — one Astra-based (bundle) and one Kerberized on-prem cluster — into a single config.

Understand the failure class

Background: Conflicting config options: "cannot be used together" — configuration validation errors across open-source libraries — this error's family across 162 libraries.

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/01573238ed633432. Report an issue: GitHub.

Appendix: source

Thrown at agents/drivers/cassandra-go/config.go:439

	}
	if err := applyLoadBalancingPolicy(cluster, config); err != nil {
		return nil, err
	}
	return cluster, nil
}

func (config *cassandraConfig) finalize() error {
	var err error
	config.configFile, err = normalizeLocalFilePath(config.configFile)
	if err != nil {
		return fmt.Errorf("invalid Cassandra configfile: %w", err)
	}
	config.secureConnectBundle, err = normalizeLocalFilePath(config.secureConnectBundle)
	if err != nil {
		return fmt.Errorf("invalid Cassandra secureconnectbundle: %w", err)
	}
	if config.secureConnectBundle != "" && config.kerberos.enabled {
		return fmt.Errorf("Cassandra secure connect bundles cannot be combined with Kerberos authentication")
	}
	if config.secureConnectBundle != "" && (config.username == "" || config.password == "") {
		return fmt.Errorf("Cassandra secure connect bundles require username and password credentials")
	}
	if config.kerberos.enabled {
		if err := config.kerberos.finalize(config.username, config.password); err != nil {
			return err
		}
	}
	return nil
}

func splitHosts(raw string) []string {
	raw = strings.ReplaceAll(raw, "--", ",")
	parts := strings.FieldsFunc(raw, func(char rune) bool { return char == ',' || char == ';' })
	hosts := make([]string, 0, len(parts))
	for _, part := range parts {
		host := strings.TrimSpace(part)

View on GitHub (pinned to c0390bff16)