Merge #126587 #134228 #135291 #135337 #135552 #135565

126587: kvpb: removed disused Path field from ExportResp r=dt a=dt

Release note: none.
Epic: none.

134228: rpc: reduce certificate-related allocations during authentication r=mgartner a=mgartner

#### rpc: add authenication benchmark

Release note: None

#### rpc: reduce certificate-related allocations during authentication

This commit avoids certificate-related allocations in the happy path of
authenticating network requests.

Release note: None

#### security: inline getCertificatePrincipals

The `getCertificatePrincipals` function has been inlined into its one
callsite to avoid allocating a slice of the results.

Fixes #133317

Release note: None

135291: logictest: enable local-mixed-24.3 config r=RaduBerinde a=RaduBerinde

#### bootstrap: add 24.3 bootstrap data

Obtained by running (on release-24.3 branch):
```
./dev build sql-bootstrap-data && bin/sql-bootstrap-data
```

Epic: REL-1322
Release note: None

#### logictest: enable local-mixed-24.3 config

Includes a minor fix to the schema changer (thanks Rafi and Annie!).

Fixes #135358

Epic: REL-1322
Release note: None


135337: cli: skip TestTenantZip under deadlock r=dhartunian a=dhartunian

We had some CPU profile failures under deadlock, skipping under that scenario since that's not relevant for this test.

Resolves: #134187

Release note: None

135552: ldapccl: support partial ldap groups mapping on authz r=souravcrl a=souravcrl

fixes #133779
Epic CRDB-33829

Currently, an LDAP user may be configured to be a member of multiple LDAP groups, and when we retrieve the group roles for the user during LDAP authZ we try to find corresponding roles for all the groups being synced and fail the roles grant operation if any of the group roles do not exist on CRDB. This is a problem as not all groups are desired to have corresponding CRDB roles and in such a case a partial roles grant should take place.

Release note(security):  This fix will add support for partial roles from ldap synced group to be mapped to crdb roles and ensure appropriate erroring for undesired behavior.

135565: gcs: remove test that asserts buckets produce not found error r=jeffswenson a=jeffswenson

The behavior of GCS appears to have changed. If a bucket does not exist,
it will return a 403 forbidden. So we can't disambiguate a bucket that
does not exist from a bucket we can't access.

Overall, this is annoying but fine. The main value of not found as a
sentinel error the program can check is it indicates the name is free
and can be used. This property doesn't apply if the bucket does not
exist because CRDB will never create a bucket.

Release Justification: Test only change
Release Note: None
Fixes: #135307
Fixes: #135348
Fixes: #135349
Fixes: #135350
Fixes: #135351
Fixes: #135352

Co-authored-by: David Taylor <[email protected]>
Co-authored-by: Marcus Gartner <[email protected]>
Co-authored-by: Radu Berinde <[email protected]>
Co-authored-by: David Hartunian <[email protected]>
Co-authored-by: souravcrl <[email protected]>
Co-authored-by: Jeff Swenson <[email protected]>

pkg/BUILD.bazel

@@ -61,6 +61,7 @@ ALL_TESTS = [
     "//pkg/ccl/logictestccl/tests/fakedist:fakedist_test",
     "//pkg/ccl/logictestccl/tests/local-legacy-schema-changer:local-legacy-schema-changer_test",
     "//pkg/ccl/logictestccl/tests/local-mixed-24.2:local-mixed-24_2_test",
+    "//pkg/ccl/logictestccl/tests/local-mixed-24.3:local-mixed-24_3_test",
     "//pkg/ccl/logictestccl/tests/local-read-committed:local-read-committed_test",
     "//pkg/ccl/logictestccl/tests/local-repeatable-read:local-repeatable-read_test",
     "//pkg/ccl/logictestccl/tests/local-vec-off:local-vec-off_test",
@@ -486,6 +487,7 @@ ALL_TESTS = [
     "//pkg/sql/logictest/tests/fakedist:fakedist_test",
     "//pkg/sql/logictest/tests/local-legacy-schema-changer:local-legacy-schema-changer_test",
     "//pkg/sql/logictest/tests/local-mixed-24.2:local-mixed-24_2_test",
+    "//pkg/sql/logictest/tests/local-mixed-24.3:local-mixed-24_3_test",
     "//pkg/sql/logictest/tests/local-vec-off:local-vec-off_test",
     "//pkg/sql/logictest/tests/local:local_test",
     "//pkg/sql/logictest/tests/multiregion-9node-3region-3azs:multiregion-9node-3region-3azs_test",
@@ -503,6 +505,7 @@ ALL_TESTS = [
     "//pkg/sql/opt/exec/execbuilder/tests/fakedist:fakedist_test",
     "//pkg/sql/opt/exec/execbuilder/tests/local-legacy-schema-changer:local-legacy-schema-changer_test",
     "//pkg/sql/opt/exec/execbuilder/tests/local-mixed-24.2:local-mixed-24_2_test",
+    "//pkg/sql/opt/exec/execbuilder/tests/local-mixed-24.3:local-mixed-24_3_test",
     "//pkg/sql/opt/exec/execbuilder/tests/local-vec-off:local-vec-off_test",
     "//pkg/sql/opt/exec/execbuilder/tests/local:local_test",
     "//pkg/sql/opt/exec/execbuilder:execbuilder_test",
@@ -605,6 +608,7 @@ ALL_TESTS = [
     "//pkg/sql/sqlitelogictest/tests/fakedist:fakedist_test",
     "//pkg/sql/sqlitelogictest/tests/local-legacy-schema-changer:local-legacy-schema-changer_test",
     "//pkg/sql/sqlitelogictest/tests/local-mixed-24.2:local-mixed-24_2_test",
+    "//pkg/sql/sqlitelogictest/tests/local-mixed-24.3:local-mixed-24_3_test",
     "//pkg/sql/sqlitelogictest/tests/local-read-committed:local-read-committed_test",
     "//pkg/sql/sqlitelogictest/tests/local-repeatable-read:local-repeatable-read_test",
     "//pkg/sql/sqlitelogictest/tests/local-vec-off:local-vec-off_test",
@@ -931,6 +935,7 @@ GO_TARGETS = [
     "//pkg/ccl/logictestccl/tests/fakedist:fakedist_test",
     "//pkg/ccl/logictestccl/tests/local-legacy-schema-changer:local-legacy-schema-changer_test",
     "//pkg/ccl/logictestccl/tests/local-mixed-24.2:local-mixed-24_2_test",
+    "//pkg/ccl/logictestccl/tests/local-mixed-24.3:local-mixed-24_3_test",
     "//pkg/ccl/logictestccl/tests/local-read-committed:local-read-committed_test",
     "//pkg/ccl/logictestccl/tests/local-repeatable-read:local-repeatable-read_test",
     "//pkg/ccl/logictestccl/tests/local-vec-off:local-vec-off_test",
@@ -1962,6 +1967,7 @@ GO_TARGETS = [
     "//pkg/sql/logictest/tests/fakedist:fakedist_test",
     "//pkg/sql/logictest/tests/local-legacy-schema-changer:local-legacy-schema-changer_test",
     "//pkg/sql/logictest/tests/local-mixed-24.2:local-mixed-24_2_test",
+    "//pkg/sql/logictest/tests/local-mixed-24.3:local-mixed-24_3_test",
     "//pkg/sql/logictest/tests/local-vec-off:local-vec-off_test",
     "//pkg/sql/logictest/tests/local:local_test",
     "//pkg/sql/logictest/tests/multiregion-9node-3region-3azs:multiregion-9node-3region-3azs_test",
@@ -1988,6 +1994,7 @@ GO_TARGETS = [
     "//pkg/sql/opt/exec/execbuilder/tests/fakedist:fakedist_test",
     "//pkg/sql/opt/exec/execbuilder/tests/local-legacy-schema-changer:local-legacy-schema-changer_test",
     "//pkg/sql/opt/exec/execbuilder/tests/local-mixed-24.2:local-mixed-24_2_test",
+    "//pkg/sql/opt/exec/execbuilder/tests/local-mixed-24.3:local-mixed-24_3_test",
     "//pkg/sql/opt/exec/execbuilder/tests/local-vec-off:local-vec-off_test",
     "//pkg/sql/opt/exec/execbuilder/tests/local:local_test",
     "//pkg/sql/opt/exec/execbuilder:execbuilder",
@@ -2237,6 +2244,7 @@ GO_TARGETS = [
     "//pkg/sql/sqlitelogictest/tests/fakedist:fakedist_test",
     "//pkg/sql/sqlitelogictest/tests/local-legacy-schema-changer:local-legacy-schema-changer_test",
     "//pkg/sql/sqlitelogictest/tests/local-mixed-24.2:local-mixed-24_2_test",
+    "//pkg/sql/sqlitelogictest/tests/local-mixed-24.3:local-mixed-24_3_test",
     "//pkg/sql/sqlitelogictest/tests/local-read-committed:local-read-committed_test",
     "//pkg/sql/sqlitelogictest/tests/local-repeatable-read:local-repeatable-read_test",
     "//pkg/sql/sqlitelogictest/tests/local-vec-off:local-vec-off_test",

pkg/ccl/backupccl/backup_processor.go

@@ -682,7 +682,6 @@ func runBackupProcessor(
 								// on-disk anywhere yet.
 								metadata: backuppb.BackupManifest_File{
 									Span:                    file.Span,
-									Path:                    file.Path,
 									EntryCounts:             entryCounts,
 									LocalityKV:              destLocalityKV,
 									ApproximatePhysicalSize: uint64(len(file.SST)),

pkg/ccl/ldapccl/authorization_ldap_test.go

@@ -237,8 +237,8 @@ func TestLDAPRolesAreGranted(t *testing.T) {
 	require.True(t, foundSession)
 
 	// Add a group that does not have a corresponding CRDB role, and verify that
-	// the user cannot login.
+	// the user can still login via partial groups mapping.
 	mockLDAP.SetGroups("cn=foo", []string{"cn=foo_parent_2", "cn=nonexistent_role"})
 	_, err = fooDB.Conn(ctx)
-	require.ErrorContains(t, err, "LDAP authorization: error assigning roles to user foo: EnsureUserOnlyBelongsToRoles-grant: role/user \"nonexistent_role\" does not exist")
+	require.NoError(t, err)
 }

pkg/ccl/logictestccl/tests/local-mixed-24.3/BUILD.bazel

@@ -0,0 +1,28 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_test")
+
+go_test(
+    name = "local-mixed-24_3_test",
+    size = "enormous",
+    srcs = ["generated_test.go"],
+    data = [
+        "//c-deps:libgeos",  # keep
+        "//pkg/ccl/logictestccl:testdata",  # keep
+    ],
+    exec_properties = {"test.Pool": "large"},
+    shard_count = 31,
+    tags = ["cpu:1"],
+    deps = [
+        "//pkg/base",
+        "//pkg/build/bazel",
+        "//pkg/ccl",
+        "//pkg/security/securityassets",
+        "//pkg/security/securitytest",
+        "//pkg/server",
+        "//pkg/sql/logictest",
+        "//pkg/testutils/serverutils",
+        "//pkg/testutils/skip",
+        "//pkg/testutils/testcluster",
+        "//pkg/util/leaktest",
+        "//pkg/util/randutil",
+    ],
+)