aws keyspaces [do not merge]

build.sbt

@@ -44,7 +44,8 @@ lazy val akkaPersistenceDeps =
     akkaPersistenceQuery,
     akkaClusterShardingTyped,
     akkaPersistenceCassandra,
-    cassandraLauncher
+    cassandraLauncher,
+    keyspacedriver
   )
 
 lazy val akkaHttpDeps =

common/src/main/resources/persistence.conf

@@ -48,27 +48,39 @@ akka {
 datastax-java-driver {
   basic {
       contact-points = ["localhost:9042"]
-      contact-points = [${?CASSANDRA_CLUSTER_HOSTS}":9042"]
+      contact-points = [${?CASSANDRA_CLUSTER_HOSTS}":9142"]
       load-balancing-policy.local-datacenter = ""
       load-balancing-policy.local-datacenter = ${?CASSANDRA_CLUSTER_DC}
+      load-balancing-policy.slow-replica-avoidance = false 
+      request.consistency = LOCAL_QUORUM
+  }
+  profiles {
+     akka-persistence-cassandra-profile {
+       basic {
+	      request.consistency = LOCAL_QUORUM
+        }
+     }
   }
   advanced {
     auth-provider {
-      class = PlainTextAuthProvider
-      username = ""
-      username = ${?CASSANDRA_CLUSTER_USERNAME}
-      password = ""
-      password = ${?CASSANDRA_CLUSTER_PASSWORD}
+      class = software.aws.mcs.auth.SigV4AuthProvider
+      aws-region = us-east-1
     }
     request-tracker {
-      class = RequestLogger
+      classes = [RequestLogger]
       logs {
         slow {
           threshold = 1 second
           enabled = true
         }
       }
     }
+    ssl-engine-factory {
+        class = DefaultSslEngineFactory
+        truststore-path = ${?CASSANDRA_TRUSTSTORE_FILE}
+        truststore-password = ${?CASSANDRA_TRUSTSTORE_PASSWORD}
+        hostname-validation = false
+      }
   }
 }
 

kubernetes/config-maps/cassandra-configmap.yaml

@@ -2,10 +2,9 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: cassandra-configmap
-  annotations:
-    reloader.stakater.com/match: "true"
+  namespace: default
 data:
-  cassandra-hosts: cluster1-dc1-service.cass-operator
-  cassandra-cluster-dc: dc1
+  cassandra-cluster-dc: us-east-1
+  cassandra-hosts-port: cassandra.us-east-1.amazonaws.com:9142
   cassandra-keyspace: hmda2_journal
   cassandra-keyspace-snapshot: hmda2_snapshot

kubernetes/hmda-platform/README.md

@@ -1,24 +1,37 @@
 Pre-requisites
-- [k8ssandra](https://k8ssandra.io/)
+- [AWS Keyspaces](https://docs.aws.amazon.com/keyspaces/latest/devguide/getting-started.ddl.html)
 - [Strimzi](https://strimzi.io/)
-- Create schema for platform
+- Create keyscapes
 ```
-cqlsh -u 
+CREATE KEYSPACE IF NOT EXISTS hmda2_journal
+    WITH replication = {'class': 'SingleRegionStrategy'};
+CREATE KEYSPACE IF NOT EXISTS hmda2_snapshot
+    WITH replication = {'class': 'SingleRegionStrategy'};
+```
+- Create tables (after some modification, not all fields are supported)    
+https://github.com/cfpb/hmda-platform/blob/master/hmda-sql-doc/cassandra-scripts.txt
+```
+cqlsh -u username -p passsword -f ../hmda-sql-doc/cassandra-scripts.txt
 ```
 Install
 - Add Secrets
 ```
-kubectl create secret generic cassandra-credentials --from-literal=cassandra.username=  --from-literal=cassandra.password=
+curl https://certs.secureserver.net/repository/sf-class2-root.crt -O
+openssl x509 -outform der -in sf-class2-root.crt -out temp_file.der
+keytool -import -alias cassandra -keystore cassandra_truststore.jks -file temp_file.der
+...
+Trust this certificate? [no]:  yes
+Certificate was added to keystore
+
+kubectl create secret generic cassandra-truststore --from-file=cassandra_truststore.jks
+kubectl create secret generic cassandra-truststore-password --from-literal=password=XXXX
+kubectl create secret generic cassandra-keyspace-credentials --from-literal=aws-access-key-id=XXXX --from-literal=aws-secret-access-key=XXX
 kubectl create secret generic inst-postgres-credentials --from-literal=username= --from-literal=password= --from-literal=host= --from-literal=url="jdbc:postgresql://postgresql:5432/hmda?user= &password= &sslmode=false"
 ```
 - Add Configmap
 ```
 kubectl apply -f https://github.com/cfpb/hmda-platform/tree/master/kubernetes/config-maps
 ```
-- Create schema for platform
-```
-cqlsh -u username -p passsword -f ../hmda-sql-doc/cassandra-scripts.txt
-```
 
 Update
 ```

kubernetes/hmda-platform/templates/deployment.yaml

@@ -30,13 +30,19 @@ spec:
         - name: tz-config
           hostPath:
             path: /usr/share/zoneinfo/America/New_York
+        - name: cassandra-truststore
+          secret:
+            secretName: cassandra-truststore            
       serviceAccountName: {{ .Values.service.account.name }}
       containers:
       - name: {{ .Chart.Name }}
         image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
         volumeMounts:
           - name: tz-config
             mountPath: /etc/localtime
+          - name: cassandra-truststore
+            readOnly: true
+            mountPath: "/opt/cassandra_truststore"            
         resources:
 {{ toYaml .Values.resources | indent 12 }}
         securityContext:
@@ -149,11 +155,13 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: status.podIP
-        - name: CASSANDRA_CLUSTER_HOSTS
+        - name: CASSANDRA_TRUSTSTORE_FILE
+          value: "/opt/cassandra_truststore/cassandra_truststore.jks"              
+        - name: CASSANDRA_CLUSTER_HOSTS_PORT
           valueFrom:
             configMapKeyRef:
+              key: cassandra-hosts-port
               name: cassandra-configmap
-              key: cassandra-hosts
         - name: CASSANDRA_CLUSTER_DC
           valueFrom:
             configMapKeyRef:
@@ -174,11 +182,26 @@ spec:
             secretKeyRef:
               name: cassandra-credentials
               key: cassandra.username
+        - name: CASSANDRA_TRUSTSTORE_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: cassandra-truststore-password  
         - name: CASSANDRA_CLUSTER_PASSWORD
           valueFrom:
             secretKeyRef:
               name: cassandra-credentials
               key: cassandra.password
+        - name: AWS_ACCESS_KEY_ID
+          valueFrom:
+            secretKeyRef:
+              key: aws-access-key-id
+              name: cassandra-keyspace-credentials
+        - name: AWS_SECRET_ACCESS_KEY
+          valueFrom:        
+            secretKeyRef:
+              key: aws-secret-access-key
+              name: cassandra-keyspace-credentials             
         - name: CASSANDRA_LOG_LEVEL
           value: {{ .Values.logs.cassandra }}
         - name: KEYCLOAK_REALM_URL

project/Dependencies.scala

@@ -49,6 +49,7 @@ object Dependencies {
   lazy val circeParser              = "io.circe"           %% "circe-parser"                        % Version.circe
   lazy val akkaPersistenceCassandra = "com.typesafe.akka"  %% "akka-persistence-cassandra"          % Version.cassandraPluginVersion
   lazy val cassandraLauncher        = "com.typesafe.akka"  %% "akka-persistence-cassandra-launcher" % Version.cassandraPluginVersion
+  lazy val keyspacedriver           = "software.aws.mcs"   % "aws-sigv4-auth-cassandra-java-driver-plugin"  % "4.0.9"
   lazy val slick                    = "com.typesafe.slick" %% "slick"                               % Version.slick
   lazy val slickHikariCP            = "com.typesafe.slick" %% "slick-hikaricp"                      % Version.slick
   lazy val alpakkaSlick             = "com.lightbend.akka" %% "akka-stream-alpakka-slick"           % Version.alpakkaSlick
@@ -86,4 +87,5 @@ object Dependencies {
   // overriding the log4j-slf4j bridge used by spring, transitively brought in by s3mock
   // this is needed because of CVE-2021-44228 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228
   lazy val log4jToSlf4j          = "org.apache.logging.log4j"   % "log4j-to-slf4j"              % Version.log4j % Test
-}
+}
+