Cassandra secure connect bundles require username and passwo

Error message

Cassandra secure connect bundles require username and password credentials

What it means

finalize() requires that when a secure connect bundle is configured, both username and password credentials are also provided. Bundled connections authenticate with explicit credentials, so missing ones are rejected at config parse time.

Source

Thrown at agents/drivers/cassandra-go/config.go:442

	}
	return cluster, nil
}

func (config *cassandraConfig) finalize() error {
	var err error
	config.configFile, err = normalizeLocalFilePath(config.configFile)
	if err != nil {
		return fmt.Errorf("invalid Cassandra configfile: %w", err)
	}
	config.secureConnectBundle, err = normalizeLocalFilePath(config.secureConnectBundle)
	if err != nil {
		return fmt.Errorf("invalid Cassandra secureconnectbundle: %w", err)
	}
	if config.secureConnectBundle != "" && config.kerberos.enabled {
		return fmt.Errorf("Cassandra secure connect bundles cannot be combined with Kerberos authentication")
	}
	if config.secureConnectBundle != "" && (config.username == "" || config.password == "") {
		return fmt.Errorf("Cassandra secure connect bundles require username and password credentials")
	}
	if config.kerberos.enabled {
		if err := config.kerberos.finalize(config.username, config.password); err != nil {
			return err
		}
	}
	return nil
}

func splitHosts(raw string) []string {
	raw = strings.ReplaceAll(raw, "--", ",")
	parts := strings.FieldsFunc(raw, func(char rune) bool { return char == ',' || char == ';' })
	hosts := make([]string, 0, len(parts))
	for _, part := range parts {
		host := strings.TrimSpace(part)
		if host == "" {
			continue
		}

View on GitHub (pinned to c0390bff16)

Solutions

Set both username and password alongside secureConnectBundle
Verify the env vars feeding the credentials are actually set in the runtime environment
If the cluster does not need the bundle, remove secureConnectBundle instead

Example fix

// before
config.secureConnectBundle = "/etc/cassandra/bundle.zip" // no credentials
// after
config.secureConnectBundle = "/etc/cassandra/bundle.zip"
config.username = "token"
config.password = os.Getenv("ASTRA_CLIENT_SECRET")

Defensive patterns

Strategy: validation

Validate before calling

if bundle != "" && (username == "" || password == "") {
	return errors.New("secureConnectBundle requires username and password")
}

Try / catch

if err := parseCassandraConfig(cfg); err != nil {
	if strings.Contains(err.Error(), "require username and password") {
		log.Fatalf("set credentials for bundle auth: %v", err)
	}
	return err
}

Prevention

Always set username (clientId) and password (secret) with Astra bundles
Check required env vars at process startup
Fail fast on empty credentials before connecting

When it happens

Trigger: secureConnectBundle is set to a non-empty path but username or password is an empty string when finalize() runs via parseCassandraConfig.

Common situations: Configuring the bundle path but forgetting the Astra clientId/clientSecret credentials, or credentials supplied only via env vars that are unset in the runtime.

Related errors

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/2c86d8dfcc450949. Report an issue: GitHub.