feat: Warn when the registry server starts with authentication disabled#6512
feat: Warn when the registry server starts with authentication disabled#6512AgentGymLeader wants to merge 2 commits into
Conversation
|
I like that this keeps the behavior unchanged and only raises operator visibility. One regression I would add is a thin |
|
@suzunn good call — added It calls |
c199704 to
af27181
Compare
|
Hi @suzunn! Thanks for the helpful feedback — I've added the test and rebased onto the latest master. It looks like only the DCO check has run so far. Could you help trigger the CI workflows when you get a chance? Really appreciate your time! 🙏 |
The registry server accepts control-plane writes such as applying feature views, which materialize user-provided transformation code on the registry host. When authentication is disabled (auth type no_auth) it accepts those requests unauthenticated, so it is only safe to run inside a trusted network boundary. Nothing in the startup path signals this today. Add a startup warning emitted when the auth manager type is NONE, plus a unit test covering that the warning fires for NONE and stays silent for an authenticated type. Behavior is otherwise unchanged. Signed-off-by: FugoP <264910004+AgentGymLeader@users.noreply.github.com>
… suzunn) Signed-off-by: FugoP <264910004+AgentGymLeader@users.noreply.github.com>
af27181 to
05c39cf
Compare
|
@suzunn quick heads up, I rebased onto latest master to clear the behind state. Didn't touch any of the reviewed code, it's just replayed onto the new base (only thing that came along is an unrelated upstream UI-build fix). The no_auth start-server test from your earlier suggestion is still there. |
Add a startup warning when the gRPC registry server is launched with authentication disabled (
authtypeno_auth).Why
The registry server accepts control-plane writes such as applying feature views. Materializing those definitions loads user-provided transformation code on the registry host. When authentication is disabled the server accepts these requests unauthenticated, so it is only safe to run inside a trusted network boundary. Today nothing in the startup path signals this to the operator — the only startup logs are info-level TLS/non-TLS messages.
What
_warn_if_auth_disabled(auth_manager_type), which emits a singlelogger.warningwhen the auth manager type isNONE.start_serverright after the auth type is resolved.NONEand stays silent for an authenticated type.Behavior is unchanged; this only adds an operator-facing warning. This is a defense-in-depth / operator-visibility improvement, not a behavior change.