Skip to content

2.25.0.0-b236

2.25.0.0-b236: [#24715] YSQL: Always allow local yugabyte connections
@hari90 hari90 tagged this 31 Oct 04:00 
Summary:
Add `local all yugabyte trust` to the hba conf in order to allow local socket connections from the yugabyte user.
This is used by ybc for backup and restores, and pg_upgrade for ysl major upgrades.

yugabyted, and YB-Anywhere set this when clusters are created with authentication enabled.
However it is missing in unit tests and yb-ctl deployments get the same behavior.
Doing this in the core db so that we have a more unified behavior.

Feature is guarded by flag `ysql_trust_local_yugabyte_connections` which is enabled by default.
Jira: DB-13791

Test Plan:
Non secure cluster:

```
$ ./bin/yugabyted start

$ cat ~/var/data/pg_data/ysql_hba.conf
# This is an autogenerated file, do not edit manually!
# Internal configuration:
# local all postgres yb-tserver-key
host all all all trust
local all yugabyte trust

$ ./bin/ysqlsh -t -c "SELECT 1"
        1
$ ./bin/ysqlsh -t -c "SELECT 1" -h 127.0.0.1
        1
$ ./bin/ysqlsh -t -c "SELECT 1" -h 127.0.0.1 -p 5433
        1
$ ./bin/ysqlsh -t -c "SELECT 1" -h /tmp/.yb.127.0.0.1:5433
        1
```

Secure cluster:

```
$ ./bin/yugabyted start --secure

$ cat ~/var/data/pg_data/ysql_hba.conf
# This is an autogenerated file, do not edit manually!
# Internal configuration:
# local all postgres yb-tserver-key
local all yugabyte trust
hostssl all all all md5

$ ./bin/ysqlsh -t -c "SELECT 1"
Password for user yugabyte:
        1
$ ./bin/ysqlsh -t -c "SELECT 1" -h 127.0.0.1
Password for user yugabyte:
        1
$ ./bin/ysqlsh -t -c "SELECT 1" -h 127.0.0.1 -p 5433
Password for user yugabyte:
        1
$ ./bin/ysqlsh -t -c "SELECT 1" -h /tmp/.yb.127.0.0.1:5433
        1
```

Reviewers: fizaa

Reviewed By: fizaa

Subscribers: svc_phabricator, yql, ybase

Differential Revision: https://phorge.dev.yugabyte.com/D39564
Assets 2
Loading