Cassandra CIDR filtering authorizer (CEP-33)
summary
Adds a CIDR filtering authorizer (CEP-33) to Cassandra that maps named CIDR groups to roles and enforces allow or deny by source IP during authentication, working with password and mTLS auth. Supports wildcard and overlapping CIDRs with a longest‑match algorithm, exposes nodetool commands to create/update/drop/list groups, and emits metrics for access counts and latencies. Default behavior remains permissive so upgrades are safe, superuser filtering is configurable, and measured auth overhead is 1 μs valid / 9 μs invalid, with monitor mode and enforce mode available.
AI-written summary · about
chapters (9)
- 0:00Introduction to CIDR filtering
- 1:55Why CIDR filtering is needed
- 3:00CIDR group definitions and demo setup
- 5:29Role permissions with CIDR groups
- 6:31Monitor and enforce modes
- 7:54Configuration options and limitations
- 8:57Backward compatibility and ntools
- 9:38Metrics and performance impact
- 10:19Summary and Q&A
related talks
41mAdopting Network Policies for Multi-Tenant Environments
35mTurn Your Kubernetes Cluster Into a Castle Using Advanced Cilium Network Policies - Philip Schmid
17mManage Network Filtering at Scale
29mCassandra - an introduction
26mTaking Your Database Beyond the Border of a Single Kubernetes Cluster
25mImproving Bad Partition Handling in Apache Cassandra
43mWho are the people in your neighborhood? Tracking 'Shady' CIDR blocks
36mStories of Cassandra in Adobe Audience Manager