t8y2/dbx · error

load Cassandra secure connect bundle: %w

Error message

load Cassandra secure connect bundle: %w

What it means

When a secure connect bundle is configured, clusterConfig calls a bundle loader with the bundle path, credentials, and connect timeout; any failure is wrapped as 'load Cassandra secure connect bundle: ...'. This typically means the bundle file could not be read or unpacked (missing file, bad path, corrupt zip, or permission denied) when building the gocql cluster for DataStax Astra/cloud setups.

Source

Thrown at agents/drivers/cassandra-go/config.go:359

		default:
			return fmt.Errorf("unsupported Cassandra URL parameter: %s", rawKey)
		}
	}
	return nil
}

func (config cassandraConfig) clusterConfig(keyspace string) (*gocql.ClusterConfig, error) {
	var cluster *gocql.ClusterConfig
	var err error
	if config.secureConnectBundle != "" {
		cluster, err = gocqlastra.NewClusterFromBundle(
			config.secureConnectBundle,
			config.username,
			config.password,
			config.connectTimeout,
		)
		if err != nil {
			return nil, fmt.Errorf("load Cassandra secure connect bundle: %w", err)
		}
	} else {
		cluster = gocql.NewCluster(config.hosts...)
		cluster.Port = config.port
		cluster.Dialer = cassandraDialer{
			timeout:    config.connectTimeout,
			keepAlive:  config.keepAlive,
			tcpNoDelay: config.tcpNoDelay,
		}
		cluster.DisableInitialHostLookup = config.disableInitialHostLookup
		cluster.IgnorePeerAddr = config.disableInitialHostLookup
	}
	cluster.Keyspace = strings.TrimSpace(keyspace)
	cluster.Timeout = config.requestTimeout
	cluster.ConnectTimeout = config.connectTimeout
	cluster.WriteTimeout = config.requestTimeout
	cluster.NumConns = config.numConnections
	cluster.PageSize = config.pageSize

View on GitHub (pinned to c0390bff16)

Solutions

1. Verify the secureConnectBundle path exists and is readable by the process (ls -l / test -r)
2. Re-download the secure connect bundle from Astra and confirm the ZIP is not truncated
3. Use an absolute path to the bundle and remount/copy it into the container if missing
4. Confirm username/password passed alongside the bundle are correct and the timeout is not too small

Example fix

// before
config.secureConnectBundle = "secure-connect.zip"
// after
config.secureConnectBundle = "/etc/cassandra/secure-connect-mydb.zip" // absolute, verified readable

func bundleReadable(path string) error {
	f, err := os.Open(path)
	if err != nil { return fmt.Errorf("bundle not readable: %w", err) }
	defer f.Close()
	info, err := f.Stat()
	if err != nil || info.IsDir() || info.Size() < 100 { return errors.New("bundle missing or too small") }
	return nil
}

cluster, err := sessionFor(config)
if err != nil {
	if strings.Contains(err.Error(), "load Cassandra secure connect bundle") {
		return fmt.Errorf("check secureConnectBundle path/permissions and re-download bundle: %w", err)
	}
	return err
}

When it happens

Trigger: sessionFor -> clusterConfig with config.secureConnectBundle set and the loader returning an error: nonexistent path, unreadable file, invalid/corrupt bundle archive, or wrong credentials format inside the bundle metadata.

Common situations: Mounting the Astra secure-connect ZIP at the wrong path in containers; relative vs absolute path confusion after changing working directory; truncated bundle download; stale bundle after rotating Astra databases; file permissions blocking the agent user.

Related errors

• invalid ssl option: %w
• invalid host verification option: %w
• custom Cassandra sslenginefactory is not supported by the na
• invalid Cassandra secureconnectbundle: %w
• invalid Cassandra configfile: %w

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/1e40177bb3b061bb. Report an issue: GitHub.