compute_ctl: only try zenith_admin if could not authenticate

[skyzh]

Problem

Fix #6498

Summary of changes

Only re-authenticate with zenith_admin if authentication fails. Otherwise, directly return the error message.

Checklist before requesting a review

• I have performed a self-review of my code.
• If it is a core feature, I have added thorough tests.
• Do we need to implement analytics? if so did you add the relevant metrics to the dashboard?
• If this PR requires public announcement, mark it with /release-notes label and add several sentences in this section.

Checklist before merging

• Do not forget to reformat commit message to not include the above checklist

[Bodobolero]

Looks good to me. I didn't test however that "invalid user" also does return
pub const INVALID_PASSWORD: SqlState = SqlState(Inner::E28P01);

did you use a a project still defined with zenith_admin to test? - or do you want to add a test case to verify the new code works correctly to migrate from zenith_admin to cloud_admin?

[github-actions]

2472 tests run: 2350 passed, 0 failed, 122 skipped (full report)

---

Code coverage* (full report)

• functions: 28.8% (6931 of 24085 functions)
• lines: 47.4% (42553 of 89855 lines)

* collected from Rust tests only

---

_{The comment gets automatically updated with the latest test results
0b202f1 at 2024-03-01T20:24:45.415Z :recycle:}

[skyzh]

@Bodobolero Just manually run some tests.

• Change page server default cloud admin user to zenith_admin. This creates a basebackup with zenith_admin as the admin.
• Start the compute node. It will only proceed to the new role creation when invalid credential is detected.
• Produce some other error type. The compute node will not start and directly exit with a fatal error, which indicates that all errors except authentication error will be rejected and cause startup failure.

The error code for user not found is INVALID_AUTHORIZATION_SPECIFICATION. I added both of INVALID_PASSWORD and INVALID_AUTHORIZATION_SPECIFICATION to the match branch.

[skyzh]

Given the default admin user is hard-coded in pageserver/src/config.rs.

pub const DEFAULT_SUPERUSER: &str = "cloud_admin";

There does not seem to have an easy way of testing it automatically. So I prefer manual testing in this case.

[skyzh]

Also added more error context to hint people reading the log that a re-authentication happened.

[skyzh]

needs someone from the compute team to approve due to code owner setting 😅