diff --git a/bitnami/cassandra/5.0/debian-12/Dockerfile b/bitnami/cassandra/5.0/debian-12/Dockerfile index 0eb767246adb..00ac651be04b 100644 --- a/bitnami/cassandra/5.0/debian-12/Dockerfile +++ b/bitnami/cassandra/5.0/debian-12/Dockerfile @@ -8,7 +8,7 @@ ARG JAVA_EXTRA_SECURITY_DIR="/bitnami/java/extra-security" ARG TARGETARCH LABEL org.opencontainers.image.base.name="docker.io/bitnami/minideb:bookworm" \ - org.opencontainers.image.created="2026-06-11T00:51:36Z" \ + org.opencontainers.image.created="2026-06-26T09:21:13Z" \ org.opencontainers.image.description="Application packaged by Broadcom, Inc." \ org.opencontainers.image.documentation="https://github.com/bitnami/containers/tree/main/bitnami/cassandra/README.md" \ org.opencontainers.image.source="https://github.com/bitnami/containers/tree/main/bitnami/cassandra" \ @@ -29,7 +29,7 @@ RUN --mount=type=secret,id=downloads_url,env=SECRET_DOWNLOADS_URL \ DOWNLOADS_URL=${SECRET_DOWNLOADS_URL:-${DOWNLOADS_URL}} ; \ mkdir -p /tmp/bitnami/pkg/cache/ ; cd /tmp/bitnami/pkg/cache/ || exit 1 ; \ COMPONENTS=( \ - "python-3.11.15-15-linux-${OS_ARCH}-debian-12" \ + "python-3.11.15-19-linux-${OS_ARCH}-debian-12" \ "jre-11.0.31-11-1-linux-${OS_ARCH}-debian-12" \ "cassandra-5.0.8-0-linux-${OS_ARCH}-debian-12" \ ) ; \ @@ -55,7 +55,7 @@ RUN /opt/bitnami/scripts/cassandra/postunpack.sh RUN /opt/bitnami/scripts/java/postunpack.sh ENV APP_VERSION="5.0.8" \ BITNAMI_APP_NAME="cassandra" \ - IMAGE_REVISION="6" \ + IMAGE_REVISION="7" \ JAVA_HOME="/opt/bitnami/java" \ PATH="/opt/bitnami/python/bin:/opt/bitnami/java/bin:/opt/bitnami/cassandra/bin:$PATH" diff --git a/bitnami/cassandra/5.0/debian-12/prebuildfs/opt/bitnami/checksums/python-3.11.15-15-linux-amd64-debian-12.tar.gz.sha256 b/bitnami/cassandra/5.0/debian-12/prebuildfs/opt/bitnami/checksums/python-3.11.15-15-linux-amd64-debian-12.tar.gz.sha256 deleted file mode 100644 index bda8dd4d9ee5..000000000000 --- a/bitnami/cassandra/5.0/debian-12/prebuildfs/opt/bitnami/checksums/python-3.11.15-15-linux-amd64-debian-12.tar.gz.sha256 +++ /dev/null @@ -1 +0,0 @@ -37c99da069b5fe3a65a87faba8e81093def8f71fcb63de181ab7f5a1b4a01a97 python-3.11.15-15-linux-amd64-debian-12.tar.gz diff --git a/bitnami/cassandra/5.0/debian-12/prebuildfs/opt/bitnami/checksums/python-3.11.15-15-linux-arm64-debian-12.tar.gz.sha256 b/bitnami/cassandra/5.0/debian-12/prebuildfs/opt/bitnami/checksums/python-3.11.15-15-linux-arm64-debian-12.tar.gz.sha256 deleted file mode 100644 index 5ceb6a92d424..000000000000 --- a/bitnami/cassandra/5.0/debian-12/prebuildfs/opt/bitnami/checksums/python-3.11.15-15-linux-arm64-debian-12.tar.gz.sha256 +++ /dev/null @@ -1 +0,0 @@ -71fc7fb5b14e5e28277e7ff26ed39d8dd287fda0aa0e280187fefcbaadd37e62 python-3.11.15-15-linux-arm64-debian-12.tar.gz diff --git a/bitnami/cassandra/5.0/debian-12/prebuildfs/opt/bitnami/checksums/python-3.11.15-19-linux-amd64-debian-12.tar.gz.sha256 b/bitnami/cassandra/5.0/debian-12/prebuildfs/opt/bitnami/checksums/python-3.11.15-19-linux-amd64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..1d770b18703b --- /dev/null +++ b/bitnami/cassandra/5.0/debian-12/prebuildfs/opt/bitnami/checksums/python-3.11.15-19-linux-amd64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +08ae01112059206035c39a0631c2fe4c570c97271517781bf483b9974534a14e python-3.11.15-19-linux-amd64-debian-12.tar.gz diff --git a/bitnami/cassandra/5.0/debian-12/prebuildfs/opt/bitnami/checksums/python-3.11.15-19-linux-arm64-debian-12.tar.gz.sha256 b/bitnami/cassandra/5.0/debian-12/prebuildfs/opt/bitnami/checksums/python-3.11.15-19-linux-arm64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..be3ecb28b6f4 --- /dev/null +++ b/bitnami/cassandra/5.0/debian-12/prebuildfs/opt/bitnami/checksums/python-3.11.15-19-linux-arm64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +0981711b3797e7bf0b8bde5177b1b98c3db4a89149fe2d3bcedd47b5cd5159bc python-3.11.15-19-linux-arm64-debian-12.tar.gz diff --git a/bitnami/cassandra/5.0/debian-12/prebuildfs/opt/bitnami/scripts/libpersistence.sh b/bitnami/cassandra/5.0/debian-12/prebuildfs/opt/bitnami/scripts/libpersistence.sh index 18445e7d27fa..833ee5ab1d65 100644 --- a/bitnami/cassandra/5.0/debian-12/prebuildfs/opt/bitnami/scripts/libpersistence.sh +++ b/bitnami/cassandra/5.0/debian-12/prebuildfs/opt/bitnami/scripts/libpersistence.sh @@ -39,7 +39,7 @@ persist_app() { fi pushd "$install_dir" >/dev/null || exit local file_to_persist_relative file_to_persist_destination file_to_persist_destination_folder - local -r tmp_file="/tmp/perms.acl" + local -r acl_file="$(mktemp "${TMPDIR:-/tmp}"/acl.XXXXXXXXXX)" for file_to_persist in "${files_to_persist[@]}"; do if [[ ! -f "$file_to_persist" && ! -d "$file_to_persist" ]]; then error "Cannot persist '${file_to_persist}' because it does not exist" @@ -50,22 +50,22 @@ persist_app() { file_to_persist_destination_folder="$(dirname "$file_to_persist_destination")" # Get original permissions for existing files, which will be applied later # Exclude the root directory with 'sed', to avoid issues when copying the entirety of it to a volume - getfacl -R "$file_to_persist_relative" | sed -E '/# file: (\..+|[^.])/,$!d' > "$tmp_file" + getfacl -R "$file_to_persist_relative" | sed -E '/# file: (\..+|[^.])/,$!d' > "$acl_file" # Copy directories to the volume ensure_dir_exists "$file_to_persist_destination_folder" cp -Lr --preserve=links "$file_to_persist_relative" "$file_to_persist_destination_folder" # Restore permissions pushd "$persist_dir" >/dev/null || exit if am_i_root; then - setfacl --restore="$tmp_file" + setfacl --restore="$acl_file" else # When running as non-root, don't change ownership - setfacl --restore=<(grep -E -v '^# (owner|group):' "$tmp_file") + setfacl --restore=<(grep -E -v '^# (owner|group):' "$acl_file") fi popd >/dev/null || exit done popd >/dev/null || exit - rm -f "$tmp_file" + rm -f "$acl_file" # Install the persisted files into the installation directory, via symlinks restore_persisted_app "$@" } diff --git a/bitnami/cassandra/5.0/debian-12/rootfs/opt/bitnami/scripts/cassandra-env.sh b/bitnami/cassandra/5.0/debian-12/rootfs/opt/bitnami/scripts/cassandra-env.sh index c51d2426f56a..a9395d8c7a3a 100644 --- a/bitnami/cassandra/5.0/debian-12/rootfs/opt/bitnami/scripts/cassandra-env.sh +++ b/bitnami/cassandra/5.0/debian-12/rootfs/opt/bitnami/scripts/cassandra-env.sh @@ -35,6 +35,7 @@ cassandra_env_vars=( CASSANDRA_HOST CASSANDRA_INTERNODE_ENCRYPTION CASSANDRA_NUM_TOKENS + CASSANDRA_ISOLATED_SEEDING CASSANDRA_PASSWORD_SEEDER CASSANDRA_SEEDS CASSANDRA_PEERS @@ -149,6 +150,8 @@ export CASSANDRA_INTERNODE_ENCRYPTION="${CASSANDRA_INTERNODE_ENCRYPTION:-none}" export DB_INTERNODE_ENCRYPTION="$CASSANDRA_INTERNODE_ENCRYPTION" export CASSANDRA_NUM_TOKENS="${CASSANDRA_NUM_TOKENS:-256}" export DB_NUM_TOKENS="$CASSANDRA_NUM_TOKENS" +export CASSANDRA_ISOLATED_SEEDING="${CASSANDRA_ISOLATED_SEEDING:-yes}" +export DB_ISOLATED_SEEDING="$CASSANDRA_ISOLATED_SEEDING" export CASSANDRA_PASSWORD_SEEDER="${CASSANDRA_PASSWORD_SEEDER:-no}" export DB_PASSWORD_SEEDER="$CASSANDRA_PASSWORD_SEEDER" export CASSANDRA_SEEDS="${CASSANDRA_SEEDS:-$DB_HOST}" diff --git a/bitnami/cassandra/5.0/debian-12/rootfs/opt/bitnami/scripts/libcassandra.sh b/bitnami/cassandra/5.0/debian-12/rootfs/opt/bitnami/scripts/libcassandra.sh index 9176c22491ba..6d1d96f69e20 100644 --- a/bitnami/cassandra/5.0/debian-12/rootfs/opt/bitnami/scripts/libcassandra.sh +++ b/bitnami/cassandra/5.0/debian-12/rootfs/opt/bitnami/scripts/libcassandra.sh @@ -498,6 +498,10 @@ cassandra_validate() { check_true_false_value DB_SSL_VALIDATE check_true_false_value DB_AUTOMATIC_SSTABLE_UPGRADE + if is_boolean_yes "$DB_CLIENT_ENCRYPTION" && ! is_boolean_yes "$DB_SSL_VALIDATE"; then + warn "Client encryption is enabled but SSL validation is not enabled. This is vulnerable to a man-in-the-middle attack where an attacker can present an arbitrary certificate to the client." + fi + if ((${#DB_PASSWORD} > 512)); then print_validation_error "The password cannot be longer than 512 characters. Set the environment variable DB_PASSWORD with a shorter value" fi @@ -901,7 +905,7 @@ cassandra_initialize() { # Otherwise, cqlsh reconnects to the pod IP (via system.local), blocked by the ensure_superuser_is_created gate. cassandra_start_bg "$DB_FIRST_BOOT_LOG_FILE" "" "" "--broadcast-rpc-address 127.0.0.1" else - cassandra_yaml_set "rpc_address" "127.0.0.1" + is_boolean_yes "$DB_ISOLATED_SEEDING" && cassandra_yaml_set "rpc_address" "127.0.0.1" cassandra_start_bg "$DB_FIRST_BOOT_LOG_FILE" fi if is_boolean_yes "$DB_PASSWORD_SEEDER"; then @@ -926,7 +930,7 @@ cassandra_initialize() { fi cassandra_execute_startup_cql - touch "$CASSANDRA_INIT_SEMAPHORE" + touch "$DB_INIT_SEMAPHORE" else info "Non-seeder node. Waiting for synchronization" wait_for_cql_access "$DB_USER" "$DB_PASSWORD" "127.0.0.1" "$DB_PEER_CQL_MAX_RETRIES" "$DB_PEER_CQL_SLEEP_TIME" @@ -938,7 +942,7 @@ cassandra_initialize() { if is_dir_empty "$DB_DATA_DIR"; then info "Deploying $DB_FLAVOR from scratch" __credential_seeding - elif [[ ! -f "$CASSANDRA_INIT_SEMAPHORE" ]] && is_boolean_yes "$DB_PASSWORD_SEEDER"; then + elif [[ ! -f "$DB_INIT_SEMAPHORE" ]] && is_boolean_yes "$DB_PASSWORD_SEEDER"; then warn "The init semaphore is absent: the seed pod was interrupted between start and credential seeding. Re-running seeding against the persisted data." __credential_seeding else @@ -1287,28 +1291,31 @@ wait_for_peers_ready() { local peer peer_ip for peer in ${peers//,/ }; do - peer_ip="$(dns_lookup "$peer" "v4")" - [[ -z "$peer_ip" ]] && peer_ip="$peer" - info "Waiting for peer $peer to reach Up/Normal (UN) status" + if is_boolean_yes "$DB_ISOLATED_SEEDING"; then + peer_ip="$(dns_lookup "$peer" "v4")" + [[ -z "$peer_ip" ]] && peer_ip="$peer" + # shellcheck disable=SC2329 + check_peer_un() { + # Using legacy RMI URL parsing to avoid URISyntaxException: 'Malformed IPv6 address at index 7: rmi://[127.0.0.1]:7199' error + # https://community.datastax.com/questions/13764/java-version-for-cassandra-3113.html + local -r check_cmd=("nodetool" "-Dcom.sun.jndi.rmiURLParsing=legacy") + local -r check_args=("status" "--port" "$DB_JMX_PORT_NUMBER") + local -r check_regex="UN\s*(${peer}|${peer_ip})" + local output="/dev/null" + if [[ "$BITNAMI_DEBUG" = "true" ]]; then + output="/dev/stdout" + fi - check_peer_un() { - # Using legacy RMI URL parsing to avoid URISyntaxException: 'Malformed IPv6 address at index 7: rmi://[127.0.0.1]:7199' error - # https://community.datastax.com/questions/13764/java-version-for-cassandra-3113.html - local -r check_cmd=("nodetool" "-Dcom.sun.jndi.rmiURLParsing=legacy") - local -r check_args=("status" "--port" "$DB_JMX_PORT_NUMBER") - local -r check_regex="UN\s*(${peer}|${peer_ip})" + "${check_cmd[@]}" "${check_args[@]}" | grep -E "${check_regex}" >"${output}" + } - local output="/dev/null" - if [[ "$BITNAMI_DEBUG" = "true" ]]; then - output="/dev/stdout" + info "Waiting for peer $peer to reach Up/Normal (UN) status" + if ! retry_while check_peer_un "$retries" "$sleep_time"; then + error "Peer $peer did not reach Up/Normal (UN) status" + exit 1 fi - - "${check_cmd[@]}" "${check_args[@]}" | grep -E "${check_regex}" >"${output}" - } - - if ! retry_while check_peer_un "$retries" "$sleep_time"; then - error "Peer $peer did not reach Up/Normal (UN) status" - exit 1 + else + wait_for_cql_access "cassandra" "cassandra" "$peer" "$retries" "$sleep_time" fi done info "All peers reached Up/Normal (UN) status" diff --git a/bitnami/cassandra/README.md b/bitnami/cassandra/README.md index 501e40640186..d9a6a22df44b 100644 --- a/bitnami/cassandra/README.md +++ b/bitnami/cassandra/README.md @@ -100,6 +100,7 @@ The following tables list the main variables you can set. | `CASSANDRA_HOST` | Cassandra host name | `nil` | | `CASSANDRA_INTERNODE_ENCRYPTION` | Internode encryption type | `none` | | `CASSANDRA_NUM_TOKENS` | Number of tokens in cluster connection | `256` | +| `CASSANDRA_ISOLATED_SEEDING` | Perform seeding without exposing RPC endpoint | `yes` | | `CASSANDRA_PASSWORD_SEEDER` | Set node as password seeder in the cluster | `no` | | `CASSANDRA_SEEDS` | List of cluster seeds | `$DB_HOST` | | `CASSANDRA_PEERS` | List of cluster peers | `$DB_SEEDS` |