Merge branch 'main' into devin/1745492468-add-dev-flag-pr11517

control_plane/src/pageserver.rs

@@ -143,6 +143,8 @@ impl PageServerNode {
             overrides.push(format!("ssl_ca_file='{}'", ssl_ca_file.to_str().unwrap()));
         }
 
+        overrides.push("dev_mode=true".to_owned());
+
         // Apply the user-provided overrides
         overrides.push({
             let mut doc =

control_plane/src/safekeeper.rs

@@ -161,6 +161,7 @@ impl SafekeeperNode {
             listen_http,
             "--availability-zone".to_owned(),
             availability_zone,
+            "--dev".to_owned(),
         ];
         if let Some(pg_tenant_only_port) = self.conf.pg_tenant_only_port {
             let listen_pg_tenant_only = format!("{}:{}", self.listen_addr, pg_tenant_only_port);

docker-compose/docker-compose.yml

@@ -65,6 +65,7 @@ services:
                     --id=$$SAFEKEEPER_ID
                     --broker-endpoint=$$BROKER_ENDPOINT
                     -D /data
+                    --dev
                     --remote-storage=\"{endpoint='http://minio:9000',
                                         bucket_name='neon',
                                         bucket_region='eu-north-1',
@@ -95,6 +96,7 @@ services:
                     --id=$$SAFEKEEPER_ID
                     --broker-endpoint=$$BROKER_ENDPOINT
                     -D /data
+                    --dev
                     --remote-storage=\"{endpoint='http://minio:9000',
                                         bucket_name='neon',
                                         bucket_region='eu-north-1',
@@ -125,6 +127,7 @@ services:
                     --id=$$SAFEKEEPER_ID
                     --broker-endpoint=$$BROKER_ENDPOINT
                     -D /data
+                    --dev
                     --remote-storage=\"{endpoint='http://minio:9000',
                                         bucket_name='neon',
                                         bucket_region='eu-north-1',

docker-compose/pageserver_config/pageserver.toml

@@ -6,3 +6,4 @@ remote_storage={ endpoint='http://minio:9000', bucket_name='neon', bucket_region
 control_plane_api='http://0.0.0.0:6666' # No storage controller in docker compose, specify a junk address
 control_plane_emergency_mode=true
 virtual_file_io_mode="buffered" # the CI runners where we run the docker compose tests have slow disks
+dev_mode=true

pageserver/src/bin/pageserver.rs

@@ -9,7 +9,7 @@ use std::str::FromStr;
 use std::sync::Arc;
 use std::time::Duration;
 
-use anyhow::{Context, anyhow};
+use anyhow::{Context, anyhow, bail};
 use camino::Utf8Path;
 use clap::{Arg, ArgAction, Command};
 use http_utils::tls_certs::ReloadingCertificateResolver;
@@ -102,6 +102,19 @@ fn main() -> anyhow::Result<()> {
 
     let (conf, ignored) = initialize_config(&identity_file_path, &cfg_file_path, &workdir)?;
 
+    if !conf.dev_mode {
+        if [conf.http_auth_type, conf.pg_auth_type, conf.grpc_auth_type].contains(&AuthType::Trust)
+        {
+            bail!(
+                "Pageserver refuses to start with HTTP, PostgreSQL or GRPC API authentication disabled.\n\
+                  Set dev_mode = true in pageserver.toml to allow running without authentication.\n\
+                  This is insecure and should only be used in development environments."
+            );
+        }
+    } else {
+        warn!("Starting in dev mode: this may be an insecure configuration.");
+    }
+
     // Initialize logging.
     //
     // It must be initialized before the custom panic hook is installed below.

safekeeper/src/bin/safekeeper.rs

@@ -353,6 +353,21 @@ async fn main() -> anyhow::Result<()> {
         }
     };
 
+    if !args.dev {
+        let http_auth_enabled = args.http_auth_public_key_path.is_some();
+        let pg_auth_enabled = args.pg_auth_public_key_path.is_some();
+        let pg_tenant_only_auth_enabled = args.pg_tenant_only_auth_public_key_path.is_some();
+        if !http_auth_enabled || !pg_auth_enabled || !pg_tenant_only_auth_enabled {
+            bail!(
+                "Safekeeper refuses to start with HTTP, PostgreSQL, or tenant-only PostgreSQL API authentication disabled.\n\
+                  Run with --dev to allow running without authentication.\n\
+                  This is insecure and should only be used in development environments."
+            );
+        }
+    } else {
+        warn!("Starting in dev mode: this may be an insecure configuration.");
+    }
+
     // Load JWT auth token to connect to other safekeepers for pull_timeline.
     let sk_auth_token = if let Some(auth_token_path) = args.auth_token_path.as_ref() {
         info!("loading JWT token for authentication with safekeepers from {auth_token_path}");

test_runner/fixtures/pageserver/allowed_errors.py

@@ -118,6 +118,8 @@ DEFAULT_PAGESERVER_ALLOWED_ERRORS = (
         if sys.platform != "linux"
         else []
     ),
+    # Tests run in dev mode
+    ".*Starting in dev mode.*",
 )
 
 

test_runner/regress/test_wal_acceptor.py

@@ -1457,6 +1457,7 @@ class SafekeeperEnv:
             str(i),
             "--broker-endpoint",
             self.fake_broker_endpoint,
+            "--dev",
         ]
         log.info(f'Running command "{" ".join(cmd)}"')