cli: "no such host" error when starting CRDB on Mac

When CockroachDB is started without `--advertise-addr`,
it fallbacks to `--listen-addr`. If the latter is also
unspecified, it defaults to the `hostname`.

Subsequently, `validateAdvertiseAddr` attempts to
resolve the hostname. If the resolution fails, the server
aborts the startup sequence. This is a safe default because
node discovery is compromised without a functioning DNS.

On Mac, `hostname` is resolved via mDNS / Bonjour.
Unless it's suffixed with `.local`, it doesn't resolve.
An obvious workaround is to add it to /etc/hosts, or to change
it via `sudo hostname $USER.local`.

To make the (DEV) experience on Mac more seamless, this PR
replaces DNS resolution error with a warning. Since we can't
unambiguously determine if the user is running in DEV-mode,
we assume that `--insecure` on Mac implies exactly that.

We also update `roachprod` to explicitly use `--advertised-addr`
with `127.0.0.1`. This also fixes `roachtest` in local mode.

Fixes: #66426
Fixes: #149469
Release note: None

Author: srosenberg

pkg/base/BUILD.bazel

@@ -30,6 +30,8 @@ go_library(
         "//pkg/util",
         "//pkg/util/envutil",
         "//pkg/util/humanizeutil",
+        "//pkg/util/log",
+        "//pkg/util/log/severity",
         "//pkg/util/metric",
         "//pkg/util/mon",
         "//pkg/util/netutil/addr",

pkg/base/addr_validation.go

@@ -10,9 +10,12 @@ import (
 	"fmt"
 	"net"
 	"os"
+	"runtime"
 	"strconv"
 
 	"github.com/cockroachdb/cockroach/pkg/cli/cliflags"
+	"github.com/cockroachdb/cockroach/pkg/util/log"
+	"github.com/cockroachdb/cockroach/pkg/util/log/severity"
 	"github.com/cockroachdb/errors"
 )
 
@@ -32,7 +35,7 @@ import (
 func (cfg *Config) ValidateAddrs(ctx context.Context) error {
 	// Validate the advertise address.
 	advHost, advPort, err := validateAdvertiseAddr(ctx,
-		cfg.AdvertiseAddr, cfg.Addr, "", cliflags.ListenAddr)
+		cfg.AdvertiseAddr, cfg.Addr, "", cliflags.ListenAddr, cfg.Insecure)
 	if err != nil {
 		return invalidFlagErr(err, cliflags.AdvertiseAddr)
 	}
@@ -48,7 +51,7 @@ func (cfg *Config) ValidateAddrs(ctx context.Context) error {
 	// Validate the SQL advertise address. Use the provided advertise
 	// addr as default.
 	advSQLHost, advSQLPort, err := validateAdvertiseAddr(ctx,
-		cfg.SQLAdvertiseAddr, cfg.SQLAddr, advHost, cliflags.ListenSQLAddr)
+		cfg.SQLAdvertiseAddr, cfg.SQLAddr, advHost, cliflags.ListenSQLAddr, cfg.Insecure)
 	if err != nil {
 		return invalidFlagErr(err, cliflags.SQLAdvertiseAddr)
 	}
@@ -64,7 +67,7 @@ func (cfg *Config) ValidateAddrs(ctx context.Context) error {
 	// Validate the HTTP advertise address. Use the provided advertise
 	// addr as default.
 	advHTTPHost, advHTTPPort, err := validateAdvertiseAddr(ctx,
-		cfg.HTTPAdvertiseAddr, cfg.HTTPAddr, advHost, cliflags.ListenHTTPAddr)
+		cfg.HTTPAdvertiseAddr, cfg.HTTPAddr, advHost, cliflags.ListenHTTPAddr, cfg.Insecure)
 	if err != nil {
 		return errors.Wrap(err, "cannot compute public HTTP address")
 	}
@@ -86,7 +89,10 @@ func (cfg *Config) ValidateAddrs(ctx context.Context) error {
 // that if the "host" part is empty, it gets filled in with
 // the configured listen address if any, or the canonical host name.
 func validateAdvertiseAddr(
-	ctx context.Context, advAddr, listenAddr, defaultHost string, listenFlag cliflags.FlagInfo,
+	ctx context.Context,
+	advAddr, listenAddr, defaultHost string,
+	listenFlag cliflags.FlagInfo,
+	insecure bool,
 ) (string, string, error) {
 	listenHost, listenPort, err := getListenAddr(listenAddr, defaultHost)
 	if err != nil {
@@ -132,7 +138,12 @@ func validateAdvertiseAddr(
 			// locally but not elsewhere) but at least it prevents typos.
 			_, err = net.DefaultResolver.LookupIPAddr(ctx, advHost)
 			if err != nil {
-				return "", "", err
+				// Host resolution failed. Don't error out when running on Mac with `--insecure`.
+				if runtime.GOOS == "darwin" && insecure {
+					log.Ops.Shoutf(ctx, severity.WARNING, "Unable to resolve `hostname` due to %v\n", err)
+				} else {
+					return "", "", err
+				}
 			}
 		}
 	}

pkg/roachprod/install/cockroach.go

@@ -1169,7 +1169,7 @@ func (c *SyncedCluster) generateStartArgs(
 	}
 
 	listenHost := ""
-	if c.IsLocal() && runtime.GOOS == "darwin " {
+	if c.IsLocal() && runtime.GOOS == "darwin" {
 		// This avoids annoying firewall prompts on Mac OS X.
 		listenHost = "127.0.0.1"
 	}
@@ -1201,17 +1201,20 @@ func (c *SyncedCluster) generateStartArgs(
 	}
 	args = append(args, fmt.Sprintf("--http-addr=%s:%d", listenHost, desc.Port))
 
+	advertiseHost := ""
 	if !c.IsLocal() {
-		advertiseHost := ""
 		if c.shouldAdvertisePublicIP() {
 			advertiseHost = c.Host(node)
 		} else {
 			advertiseHost = c.VMs[node-1].PrivateIP
 		}
-		args = append(args,
-			fmt.Sprintf("--advertise-addr=%s:%d", advertiseHost, sqlPort),
-		)
+	} else {
+		// N.B. in local mode, fallback to listenHost; per above, it defaults to 127.0.0.1 on macOS.
+		advertiseHost = listenHost
 	}
+	args = append(args,
+		fmt.Sprintf("--advertise-addr=%s:%d", advertiseHost, sqlPort),
+	)
 
 	// --join flags are unsupported/unnecessary in `cockroach start-single-node`.
 	if startOpts.Target == StartDefault && !c.useStartSingleNode() {