t8y2/dbx · error

Cassandra secure connect bundles cannot be combined with Ker

Error message

Cassandra secure connect bundles cannot be combined with Kerberos authentication

What it means

finalize() enforces mutually exclusive authentication modes: a secure connect bundle (which carries its own connection/security settings) cannot be combined with Kerberos authentication. The library rejects any configuration that sets both.

Source

Thrown at agents/drivers/cassandra-go/config.go:439

	}
	if err := applyLoadBalancingPolicy(cluster, config); err != nil {
		return nil, err
	}
	return cluster, nil
}

func (config *cassandraConfig) finalize() error {
	var err error
	config.configFile, err = normalizeLocalFilePath(config.configFile)
	if err != nil {
		return fmt.Errorf("invalid Cassandra configfile: %w", err)
	}
	config.secureConnectBundle, err = normalizeLocalFilePath(config.secureConnectBundle)
	if err != nil {
		return fmt.Errorf("invalid Cassandra secureconnectbundle: %w", err)
	}
	if config.secureConnectBundle != "" && config.kerberos.enabled {
		return fmt.Errorf("Cassandra secure connect bundles cannot be combined with Kerberos authentication")
	}
	if config.secureConnectBundle != "" && (config.username == "" || config.password == "") {
		return fmt.Errorf("Cassandra secure connect bundles require username and password credentials")
	}
	if config.kerberos.enabled {
		if err := config.kerberos.finalize(config.username, config.password); err != nil {
			return err
		}
	}
	return nil
}

func splitHosts(raw string) []string {
	raw = strings.ReplaceAll(raw, "--", ",")
	parts := strings.FieldsFunc(raw, func(char rune) bool { return char == ',' || char == ';' })
	hosts := make([]string, 0, len(parts))
	for _, part := range parts {
		host := strings.TrimSpace(part)

View on GitHub (pinned to c0390bff16)

Solutions

1. Remove the secureConnectBundle option if the target cluster uses Kerberos
2. Disable kerberos.enabled if the target cluster is reached via the secure connect bundle
3. Split into two agent configurations targeting each cluster separately

Example fix

// before
config.secureConnectBundle = "/etc/cassandra/bundle.zip"
config.kerberos.enabled = true
// after
config.secureConnectBundle = "/etc/cassandra/bundle.zip"
config.kerberos.enabled = false

if bundle != "" && kerberosEnabled {
	return errors.New("choose either secureConnectBundle or Kerberos, not both")
}

if err := parseCassandraConfig(cfg); err != nil {
	if strings.Contains(err.Error(), "cannot be combined with Kerberos") {
		// decide auth mode and reload config
	}
	return err
}

When it happens

Trigger: Setting secureConnectBundle to a non-empty path while kerberos.enabled is true in the Cassandra config processed by parseCassandraConfig.

Common situations: Merging config fragments from two clusters — one Astra-based (bundle) and one Kerberized on-prem cluster — into a single config.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• protocolversion must be between 3 and 5
• serialconsistency must be SERIAL or LOCAL_SERIAL
• numconns must be between 1 and 32
• pagesize must be positive
• retries must be between 0 and 1000

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/01573238ed633432. Report an issue: GitHub.