Revert "Remove VizierConfig and associated getters/updaters"

Summary:
This reverts commit 0fd40ff3ac3fa0b494a40410b3a0dde93b4f6fa0.
Some clients seem to be relying on these.

Test Plan: N/A clean revert.

Reviewers: michelle, zasgar, nserrino

Reviewed By: nserrino
Signed-off-by: Vihang Mehta <vihang@pixielabs.ai>

Differential Revision: https://phab.corp.pixielabs.ai/D11851

GitOrigin-RevId: 4b1c0130775cc8e5372b5205d153f5231145e433

src/api/proto/cloudpb/cloudapi.proto

@@ -262,12 +262,25 @@ service VizierClusterInfo {
   rpc GetClusterInfo(GetClusterInfoRequest) returns (GetClusterInfoResponse);
   rpc GetClusterConnectionInfo(GetClusterConnectionInfoRequest)
       returns (GetClusterConnectionInfoResponse);
+  rpc UpdateClusterVizierConfig(UpdateClusterVizierConfigRequest)
+      returns (UpdateClusterVizierConfigResponse);
   // This call is made when we want to update or install a Vizier. This call is made when deploying
   // a new Vizier through the CLI or by invoking the "update" command in the CLI.
   rpc UpdateOrInstallCluster(UpdateOrInstallClusterRequest)
       returns (UpdateOrInstallClusterResponse);
 }
 
+message VizierConfig {
+  bool passthrough_enabled = 1;
+  bool auto_update_enabled = 2;
+}
+
+message VizierConfigUpdate {
+  // Deprecated: We no longer let users disable passthrough. This will be removed in a future release.
+  google.protobuf.BoolValue passthrough_enabled = 1;
+  reserved 2;
+}
+
 message GetClusterInfoRequest {
   // Optional. If specified, get cluster info only for the specified cluster.
   px.uuidpb.UUID id = 1 [ (gogoproto.customname) = "ID" ];
@@ -353,6 +366,7 @@ message ClusterInfo {
   px.uuidpb.UUID id = 1 [ (gogoproto.customname) = "ID" ];
   ClusterStatus status = 2;
   int64 lastHeartbeatNs = 3;
+  VizierConfig config = 4;
   // A unique ID for the cluster. This is typically the kube-system namespace UID.
   string cluster_uid = 5 [ (gogoproto.customname) = "ClusterUID" ];
   // The name of the cluster. The return value of "kubectl config current-context".
@@ -389,8 +403,6 @@ message ClusterInfo {
   ClusterStatus previous_status = 15;
   // The time at which this cluster changed statuses to the currents tatus.
   google.protobuf.Timestamp previous_status_time = 16;
-
-  reserved 4;
 }
 
 message GetClusterInfoResponse { repeated ClusterInfo clusters = 1; }
@@ -402,6 +414,13 @@ message GetClusterConnectionInfoResponse {
   reserved 1;
 }
 
+message UpdateClusterVizierConfigRequest {
+  px.uuidpb.UUID id = 1 [ (gogoproto.customname) = "ID" ];
+  VizierConfigUpdate config_update = 2;
+}
+
+message UpdateClusterVizierConfigResponse {}
+
 // VizierDeploymentKeyManager is the service that manages deployment keys.
 service VizierDeploymentKeyManager {
   // Create a new deployment key.

src/api/proto/cloudpb/mock/cloudapi_mock.gen.go

@@ -1098,6 +1098,26 @@ func (mr *MockVizierClusterInfoClientMockRecorder) GetClusterInfo(ctx, in interf
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetClusterInfo", reflect.TypeOf((*MockVizierClusterInfoClient)(nil).GetClusterInfo), varargs...)
 }
 
+// UpdateClusterVizierConfig mocks base method.
+func (m *MockVizierClusterInfoClient) UpdateClusterVizierConfig(ctx context.Context, in *cloudpb.UpdateClusterVizierConfigRequest, opts ...grpc.CallOption) (*cloudpb.UpdateClusterVizierConfigResponse, error) {
+	m.ctrl.T.Helper()
+	varargs := []interface{}{ctx, in}
+	for _, a := range opts {
+		varargs = append(varargs, a)
+	}
+	ret := m.ctrl.Call(m, "UpdateClusterVizierConfig", varargs...)
+	ret0, _ := ret[0].(*cloudpb.UpdateClusterVizierConfigResponse)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// UpdateClusterVizierConfig indicates an expected call of UpdateClusterVizierConfig.
+func (mr *MockVizierClusterInfoClientMockRecorder) UpdateClusterVizierConfig(ctx, in interface{}, opts ...interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	varargs := append([]interface{}{ctx, in}, opts...)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateClusterVizierConfig", reflect.TypeOf((*MockVizierClusterInfoClient)(nil).UpdateClusterVizierConfig), varargs...)
+}
+
 // UpdateOrInstallCluster mocks base method.
 func (m *MockVizierClusterInfoClient) UpdateOrInstallCluster(ctx context.Context, in *cloudpb.UpdateOrInstallClusterRequest, opts ...grpc.CallOption) (*cloudpb.UpdateOrInstallClusterResponse, error) {
 	m.ctrl.T.Helper()
@@ -1186,6 +1206,21 @@ func (mr *MockVizierClusterInfoServerMockRecorder) GetClusterInfo(arg0, arg1 int
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetClusterInfo", reflect.TypeOf((*MockVizierClusterInfoServer)(nil).GetClusterInfo), arg0, arg1)
 }
 
+// UpdateClusterVizierConfig mocks base method.
+func (m *MockVizierClusterInfoServer) UpdateClusterVizierConfig(arg0 context.Context, arg1 *cloudpb.UpdateClusterVizierConfigRequest) (*cloudpb.UpdateClusterVizierConfigResponse, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "UpdateClusterVizierConfig", arg0, arg1)
+	ret0, _ := ret[0].(*cloudpb.UpdateClusterVizierConfigResponse)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// UpdateClusterVizierConfig indicates an expected call of UpdateClusterVizierConfig.
+func (mr *MockVizierClusterInfoServerMockRecorder) UpdateClusterVizierConfig(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateClusterVizierConfig", reflect.TypeOf((*MockVizierClusterInfoServer)(nil).UpdateClusterVizierConfig), arg0, arg1)
+}
+
 // UpdateOrInstallCluster mocks base method.
 func (m *MockVizierClusterInfoServer) UpdateOrInstallCluster(arg0 context.Context, arg1 *cloudpb.UpdateOrInstallClusterRequest) (*cloudpb.UpdateOrInstallClusterResponse, error) {
 	m.ctrl.T.Helper()

src/cloud/api/controllers/vizier_cluster_grpc.go

@@ -189,10 +189,14 @@ func (v *VizierClusterInfo) getClusterInfoForViziers(ctx context.Context, ids []
 		}
 
 		resp.Clusters = append(resp.Clusters, &cloudpb.ClusterInfo{
-			ID:                            vzInfo.VizierID,
-			Status:                        s,
-			StatusMessage:                 vzInfo.StatusMessage,
-			LastHeartbeatNs:               vzInfo.LastHeartbeatNs,
+			ID:              vzInfo.VizierID,
+			Status:          s,
+			StatusMessage:   vzInfo.StatusMessage,
+			LastHeartbeatNs: vzInfo.LastHeartbeatNs,
+			Config: &cloudpb.VizierConfig{
+				PassthroughEnabled: vzInfo.Config.PassthroughEnabled,
+				AutoUpdateEnabled:  vzInfo.Config.AutoUpdateEnabled,
+			},
 			ClusterUID:                    vzInfo.ClusterUID,
 			ClusterName:                   vzInfo.ClusterName,
 			PrettyClusterName:             prettyName,
@@ -235,6 +239,26 @@ func (v *VizierClusterInfo) GetClusterConnectionInfo(ctx context.Context, reques
 	}, nil
 }
 
+// UpdateClusterVizierConfig supports updates of VizierConfig for a cluster
+func (v *VizierClusterInfo) UpdateClusterVizierConfig(ctx context.Context, req *cloudpb.UpdateClusterVizierConfigRequest) (*cloudpb.UpdateClusterVizierConfigResponse, error) {
+	ctx, err := contextWithAuthToken(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	_, err = v.VzMgr.UpdateVizierConfig(ctx, &cvmsgspb.UpdateVizierConfigRequest{
+		VizierID: req.ID,
+		ConfigUpdate: &cvmsgspb.VizierConfigUpdate{
+			PassthroughEnabled: req.ConfigUpdate.PassthroughEnabled,
+		},
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return &cloudpb.UpdateClusterVizierConfigResponse{}, nil
+}
+
 // UpdateOrInstallCluster updates or installs the given vizier cluster to the specified version.
 func (v *VizierClusterInfo) UpdateOrInstallCluster(ctx context.Context, req *cloudpb.UpdateOrInstallClusterRequest) (*cloudpb.UpdateOrInstallClusterResponse, error) {
 	if req.Version == "" {

src/cloud/api/controllers/vizier_cluster_test.go

@@ -120,10 +120,14 @@ func TestVizierClusterInfo_GetClusterInfo(t *testing.T) {
 					Status:          cvmsgspb.VZ_ST_HEALTHY,
 					StatusMessage:   "Everything is running",
 					LastHeartbeatNs: int64(1305646598000000000),
-					VizierVersion:   "1.2.3",
-					ClusterUID:      "a UID",
-					ClusterName:     "gke_pl-dev-infra_us-west1-a_dev-cluster-zasgar-3",
-					ClusterVersion:  "5.6.7",
+					Config: &cvmsgspb.VizierConfig{
+						PassthroughEnabled: false,
+						AutoUpdateEnabled:  true,
+					},
+					VizierVersion:  "1.2.3",
+					ClusterUID:     "a UID",
+					ClusterName:    "gke_pl-dev-infra_us-west1-a_dev-cluster-zasgar-3",
+					ClusterVersion: "5.6.7",
 					ControlPlanePodStatuses: map[string]*cvmsgspb.PodStatus{
 						"vizier-proxy": {
 							Name:   "vizier-proxy",
@@ -201,6 +205,8 @@ func TestVizierClusterInfo_GetClusterInfo(t *testing.T) {
 			assert.Equal(t, cluster.ID, clusterID)
 			assert.Equal(t, cluster.Status, cloudpb.CS_HEALTHY)
 			assert.Equal(t, cluster.LastHeartbeatNs, int64(1305646598000000000))
+			assert.Equal(t, cluster.Config.PassthroughEnabled, false)
+			assert.Equal(t, cluster.Config.AutoUpdateEnabled, true)
 			assert.Equal(t, "1.2.3", cluster.VizierVersion)
 			assert.Equal(t, "a UID", cluster.ClusterUID)
 			assert.Equal(t, "gke_pl-dev-infra_us-west1-a_dev-cluster-zasgar-3", cluster.ClusterName)
@@ -251,9 +257,13 @@ func TestVizierClusterInfo_GetClusterInfoDuplicates(t *testing.T) {
 				VizierIDs: []*uuidpb.UUID{clusterID, clusterID2},
 			}).Return(&vzmgrpb.GetVizierInfosResponse{
 				VizierInfos: []*cvmsgspb.VizierInfo{{
-					VizierID:             clusterID,
-					Status:               cvmsgspb.VZ_ST_HEALTHY,
-					LastHeartbeatNs:      int64(1305646598000000000),
+					VizierID:        clusterID,
+					Status:          cvmsgspb.VZ_ST_HEALTHY,
+					LastHeartbeatNs: int64(1305646598000000000),
+					Config: &cvmsgspb.VizierConfig{
+						PassthroughEnabled: false,
+						AutoUpdateEnabled:  true,
+					},
 					VizierVersion:        "1.2.3",
 					ClusterUID:           "a UID",
 					ClusterName:          "gke_pl-dev-infra_us-west1-a_dev-cluster-zasgar",
@@ -262,9 +272,13 @@ func TestVizierClusterInfo_GetClusterInfoDuplicates(t *testing.T) {
 					NumInstrumentedNodes: 3,
 				},
 					{
-						VizierID:             clusterID,
-						Status:               cvmsgspb.VZ_ST_HEALTHY,
-						LastHeartbeatNs:      int64(1305646598000000000),
+						VizierID:        clusterID,
+						Status:          cvmsgspb.VZ_ST_HEALTHY,
+						LastHeartbeatNs: int64(1305646598000000000),
+						Config: &cvmsgspb.VizierConfig{
+							PassthroughEnabled: false,
+							AutoUpdateEnabled:  true,
+						},
 						VizierVersion:        "1.2.3",
 						ClusterUID:           "a UID2",
 						ClusterName:          "gke_pl-pixies_us-west1-a_dev-cluster-zasgar",
@@ -323,10 +337,14 @@ func TestVizierClusterInfo_GetClusterInfoWithID(t *testing.T) {
 					VizierID:        clusterID,
 					Status:          cvmsgspb.VZ_ST_HEALTHY,
 					LastHeartbeatNs: int64(1305646598000000000),
-					VizierVersion:   "1.2.3",
-					ClusterUID:      "a UID",
-					ClusterName:     "some cluster",
-					ClusterVersion:  "5.6.7",
+					Config: &cvmsgspb.VizierConfig{
+						PassthroughEnabled: false,
+						AutoUpdateEnabled:  true,
+					},
+					VizierVersion:  "1.2.3",
+					ClusterUID:     "a UID",
+					ClusterName:    "some cluster",
+					ClusterVersion: "5.6.7",
 				},
 				},
 			}, nil)
@@ -345,6 +363,61 @@ func TestVizierClusterInfo_GetClusterInfoWithID(t *testing.T) {
 			assert.Equal(t, cluster.ID, clusterID)
 			assert.Equal(t, cluster.Status, cloudpb.CS_HEALTHY)
 			assert.Equal(t, cluster.LastHeartbeatNs, int64(1305646598000000000))
+			assert.Equal(t, cluster.Config.PassthroughEnabled, false)
+			assert.Equal(t, cluster.Config.AutoUpdateEnabled, true)
+		})
+	}
+}
+
+func TestVizierClusterInfo_UpdateClusterVizierConfig(t *testing.T) {
+	tests := []struct {
+		name string
+		ctx  context.Context
+	}{
+		{
+			name: "regular user",
+			ctx:  CreateTestContext(),
+		},
+		{
+			name: "api user",
+			ctx:  CreateAPIUserTestContext(),
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			clusterID := utils.ProtoFromUUIDStrOrNil("7ba7b810-9dad-11d1-80b4-00c04fd430c8")
+			assert.NotNil(t, clusterID)
+
+			ctrl := gomock.NewController(t)
+			defer ctrl.Finish()
+
+			_, mockClients, cleanup := testutils.CreateTestAPIEnv(t)
+			defer cleanup()
+			ctx := test.ctx
+
+			updateReq := &cvmsgspb.UpdateVizierConfigRequest{
+				VizierID: clusterID,
+				ConfigUpdate: &cvmsgspb.VizierConfigUpdate{
+					PassthroughEnabled: &types.BoolValue{Value: true},
+				},
+			}
+
+			mockClients.MockVzMgr.EXPECT().UpdateVizierConfig(gomock.Any(), updateReq).Return(&cvmsgspb.UpdateVizierConfigResponse{}, nil)
+
+			vzClusterInfoServer := &controllers.VizierClusterInfo{
+				VzMgr: mockClients.MockVzMgr,
+			}
+
+			resp, err := vzClusterInfoServer.UpdateClusterVizierConfig(ctx, &cloudpb.UpdateClusterVizierConfigRequest{
+				ID: clusterID,
+				ConfigUpdate: &cloudpb.VizierConfigUpdate{
+					PassthroughEnabled: &types.BoolValue{Value: true},
+				},
+			})
+
+			require.NoError(t, err)
+			assert.NotNil(t, resp)
 		})
 	}
 }

src/cloud/api/ptproxy/request_proxyer.go

@@ -149,6 +149,9 @@ func (p requestProxyer) validateRequestAndFetchCreds(ctx context.Context, debugM
 			}
 		}
 
+		if !resp.Config.PassthroughEnabled {
+			return ErrPassthroughDisabled
+		}
 		return nil
 	})
 

src/cloud/api/ptproxy/vizier_pt_proxy_test.go

@@ -731,6 +731,9 @@ func (v *fakeVzMgr) GetVizierInfo(ctx context.Context, in *uuidpb.UUID, opts ...
 				VizierID:        utils.ProtoFromUUIDStrOrNil("00000000-1111-2222-2222-333333333333"),
 				Status:          cvmsgspb.VZ_ST_HEALTHY,
 				LastHeartbeatNs: 0,
+				Config: &cvmsgspb.VizierConfig{
+					PassthroughEnabled: true,
+				},
 			},
 			nil,
 		},
@@ -739,6 +742,9 @@ func (v *fakeVzMgr) GetVizierInfo(ctx context.Context, in *uuidpb.UUID, opts ...
 				VizierID:        utils.ProtoFromUUIDStrOrNil("10000000-1111-2222-2222-333333333333"),
 				Status:          cvmsgspb.VZ_ST_DISCONNECTED,
 				LastHeartbeatNs: 0,
+				Config: &cvmsgspb.VizierConfig{
+					PassthroughEnabled: true,
+				},
 			},
 			nil,
 		},
@@ -747,6 +753,9 @@ func (v *fakeVzMgr) GetVizierInfo(ctx context.Context, in *uuidpb.UUID, opts ...
 				VizierID:        utils.ProtoFromUUIDStrOrNil("10000000-1111-2222-2222-333333333333"),
 				Status:          cvmsgspb.VZ_ST_UNHEALTHY,
 				LastHeartbeatNs: 0,
+				Config: &cvmsgspb.VizierConfig{
+					PassthroughEnabled: true,
+				},
 			},
 			nil,
 		},
@@ -755,6 +764,9 @@ func (v *fakeVzMgr) GetVizierInfo(ctx context.Context, in *uuidpb.UUID, opts ...
 				VizierID:        utils.ProtoFromUUIDStrOrNil("30000000-1111-2222-2222-333333333333"),
 				Status:          cvmsgspb.VZ_ST_UNHEALTHY,
 				LastHeartbeatNs: 0,
+				Config: &cvmsgspb.VizierConfig{
+					PassthroughEnabled: false,
+				},
 			},
 			nil,
 		},

src/cloud/vzmgr/controllers/server.go

@@ -250,6 +250,8 @@ type VizierInfo struct {
 	ID                            uuid.UUID     `db:"vizier_cluster_id"`
 	Status                        vizierStatus  `db:"status"`
 	LastHeartbeat                 *int64        `db:"last_heartbeat"`
+	PassthroughEnabled            bool          `db:"passthrough_enabled"`
+	AutoUpdateEnabled             bool          `db:"auto_update_enabled"`
 	ClusterUID                    *string       `db:"cluster_uid"`
 	ClusterName                   *string       `db:"cluster_name"`
 	ClusterVersion                *string       `db:"cluster_version"`
@@ -301,9 +303,13 @@ func vizierInfoToProto(vzInfo VizierInfo) *cvmsgspb.VizierInfo {
 	}
 
 	return &cvmsgspb.VizierInfo{
-		VizierID:                      utils.ProtoFromUUID(vzInfo.ID),
-		Status:                        vzInfo.Status.ToProto(),
-		LastHeartbeatNs:               lastHearbeat,
+		VizierID:        utils.ProtoFromUUID(vzInfo.ID),
+		Status:          vzInfo.Status.ToProto(),
+		LastHeartbeatNs: lastHearbeat,
+		Config: &cvmsgspb.VizierConfig{
+			PassthroughEnabled: vzInfo.PassthroughEnabled,
+			AutoUpdateEnabled:  vzInfo.AutoUpdateEnabled,
+		},
 		ClusterUID:                    clusterUID,
 		ClusterName:                   clusterName,
 		ClusterVersion:                clusterVersion,
@@ -337,7 +343,7 @@ func (s *Server) GetVizierInfos(ctx context.Context, req *vzmgrpb.GetVizierInfos
 
 	strQuery := `SELECT i.vizier_cluster_id, c.cluster_uid, c.cluster_name, i.cluster_version, i.vizier_version, c.org_id,
 			  i.status, (EXTRACT(EPOCH FROM age(now(), i.last_heartbeat))*1E9)::bigint as last_heartbeat,
-              i.control_plane_pod_statuses, i.unhealthy_data_plane_pod_statuses,
+              i.passthrough_enabled, i.auto_update_enabled, i.control_plane_pod_statuses, i.unhealthy_data_plane_pod_statuses,
 							i.num_nodes, i.num_instrumented_nodes, i.status_message, i.prev_status, i.prev_status_time
               FROM vizier_cluster_info as i, vizier_cluster as c
               WHERE i.vizier_cluster_id=c.id AND i.vizier_cluster_id IN (?) AND c.org_id='%s'`
@@ -390,7 +396,7 @@ func (s *Server) GetVizierInfo(ctx context.Context, req *uuidpb.UUID) (*cvmsgspb
 
 	query := `SELECT i.vizier_cluster_id, c.cluster_uid, c.cluster_name, i.cluster_version, i.vizier_version,
 			  i.status, (EXTRACT(EPOCH FROM age(now(), i.last_heartbeat))*1E9)::bigint as last_heartbeat,
-              i.control_plane_pod_statuses, i.unhealthy_data_plane_pod_statuses,
+              i.passthrough_enabled, i.auto_update_enabled, i.control_plane_pod_statuses, i.unhealthy_data_plane_pod_statuses,
 							i.num_nodes, i.num_instrumented_nodes, i.status_message, i.prev_status, i.prev_status_time
               from vizier_cluster_info as i, vizier_cluster as c
               WHERE i.vizier_cluster_id=$1 AND i.vizier_cluster_id=c.id`
@@ -420,6 +426,77 @@ func (s *Server) GetVizierInfo(ctx context.Context, req *uuidpb.UUID) (*cvmsgspb
 	return nil, status.Error(codes.NotFound, "vizier not found")
 }
 
+// getVizierConfig returns the current Vizier config.
+// WARNING: This doesn't check validateOrgOwnsCluster since
+// the certmgr usecase cannot get a valid authcontext from the passed in
+// context.
+func (s *Server) getVizierConfig(ctx context.Context, vizierIDPb *uuidpb.UUID) (*cvmsgspb.VizierConfig, error) {
+	vizierID := utils.UUIDFromProtoOrNil(vizierIDPb)
+
+	query := `
+		SELECT passthrough_enabled, auto_update_enabled
+		FROM vizier_cluster_info
+		WHERE vizier_cluster_id = $1`
+	var val struct {
+		PassthroughEnabled bool `db:"passthrough_enabled"`
+		AutoUpdateEnabled  bool `db:"auto_update_enabled"`
+	}
+
+	err := s.db.Get(&val, query, vizierID)
+	if err != nil {
+		if err == sql.ErrNoRows {
+			return nil, status.Error(codes.NotFound, "no such cluster")
+		}
+		return nil, err
+	}
+	return &cvmsgspb.VizierConfig{
+		PassthroughEnabled: val.PassthroughEnabled,
+		AutoUpdateEnabled:  val.AutoUpdateEnabled,
+	}, nil
+}
+
+// UpdateVizierConfig supports updating of the Vizier config.
+func (s *Server) UpdateVizierConfig(ctx context.Context, req *cvmsgspb.UpdateVizierConfigRequest) (*cvmsgspb.UpdateVizierConfigResponse, error) {
+	if err := s.validateOrgOwnsCluster(ctx, req.VizierID); err != nil {
+		return nil, err
+	}
+
+	vizierID := utils.UUIDFromProtoOrNil(req.VizierID)
+
+	if req.ConfigUpdate == nil {
+		return &cvmsgspb.UpdateVizierConfigResponse{}, nil
+	}
+
+	currentConfig, err := s.getVizierConfig(ctx, req.VizierID)
+	if err != nil {
+		return nil, err
+	}
+
+	ptEnabled := currentConfig.PassthroughEnabled
+
+	if req.ConfigUpdate.PassthroughEnabled != nil {
+		if !req.ConfigUpdate.PassthroughEnabled.Value {
+			return nil, status.Error(codes.InvalidArgument, "Deprecated. Disabling passthrough is no longer supported and is being phased out.")
+		}
+		ptEnabled = req.ConfigUpdate.PassthroughEnabled.Value
+	}
+
+	query := `
+    UPDATE vizier_cluster_info
+    SET passthrough_enabled = $1
+    WHERE vizier_cluster_id = $2`
+
+	res, err := s.db.Exec(query, ptEnabled, vizierID)
+	if err != nil {
+		return nil, err
+	}
+	if count, _ := res.RowsAffected(); count == 0 {
+		return nil, status.Error(codes.NotFound, "no such cluster")
+	}
+
+	return &cvmsgspb.UpdateVizierConfigResponse{}, nil
+}
+
 // GetVizierConnectionInfo gets a viziers connection info,
 func (s *Server) GetVizierConnectionInfo(ctx context.Context, req *uuidpb.UUID) (*cvmsgspb.VizierConnectionInfo, error) {
 	if err := s.validateOrgOwnsCluster(ctx, req); err != nil {

src/cloud/vzmgr/controllers/server_test.go

@@ -133,28 +133,28 @@ func mustLoadTestData(db *sqlx.DB) {
 	testPastStatus := "UNHEALTHY"
 
 	insertClusterInfo := `INSERT INTO vizier_cluster_info(vizier_cluster_id, status, jwt_signing_key, last_heartbeat,
-						  vizier_version, cluster_version, control_plane_pod_statuses,
+						  passthrough_enabled, auto_update_enabled, vizier_version, cluster_version, control_plane_pod_statuses,
 							unhealthy_data_plane_pod_statuses, num_nodes, num_instrumented_nodes, status_message,
 							prev_status, prev_status_time)
-						  VALUES($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)`
+						  VALUES($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15)`
 	db.MustExec(insertClusterInfo, "123e4567-e89b-12d3-a456-426655440000", "UNKNOWN",
-		"key0", "2011-05-16 15:36:38", "", "", testPodStatuses, testDataPlanePodStatuses, 10, 8, "",
+		"key0", "2011-05-16 15:36:38", true, false, "", "", testPodStatuses, testDataPlanePodStatuses, 10, 8, "",
 		&testPastStatus, testPastTime)
 	db.MustExec(insertClusterInfo, "123e4567-e89b-12d3-a456-426655440001", "HEALTHY",
 		"\\xc30d04070302c5374a5098262b6d7bd23f01822f741dbebaa680b922b55fd16eb985aeb09505f8fc4a36f0e11ebb8e18f01f684146c761e2234a81e50c21bca2907ea37736f2d9a5834997f4dd9e288c",
-		"2011-05-17 15:36:38", "vzVers", "cVers", "{}", "{}", 12, 9, "This is a test", &testPastStatus, testPastTime)
+		"2011-05-17 15:36:38", false, true, "vzVers", "cVers", "{}", "{}", 12, 9, "This is a test", &testPastStatus, testPastTime)
 	db.MustExec(insertClusterInfo, "123e4567-e89b-12d3-a456-426655440002", "UNHEALTHY", "key2", "2011-05-18 15:36:38",
-		"", "", "{}", "{}", 4, 4, "", nil, nil)
+		true, false, "", "", "{}", "{}", 4, 4, "", nil, nil)
 	db.MustExec(insertClusterInfo, testDisconnectedClusterEmptyUID, "DISCONNECTED", "key3", "2011-05-19 15:36:38",
-		"", "", "{}", "{}", 3, 2, "", nil, nil)
+		false, true, "", "", "{}", "{}", 3, 2, "", nil, nil)
 	db.MustExec(insertClusterInfo, testExistingCluster, "DISCONNECTED", "key3", "2011-05-19 15:36:38",
-		"", "", "{}", "{}", 5, 4, "", nil, nil)
+		false, true, "", "", "{}", "{}", 5, 4, "", nil, nil)
 	db.MustExec(insertClusterInfo, testExistingClusterActive, "UNHEALTHY", "key3", "2011-05-19 15:36:38",
-		"", "", "{}", "{}", 10, 4, "", nil, nil)
+		false, true, "", "", "{}", "{}", 10, 4, "", nil, nil)
 	db.MustExec(insertClusterInfo, "223e4567-e89b-12d3-a456-426655440003", "HEALTHY", "key3", "2011-05-19 15:36:38",
-		"", "", "{}", "{}", 2, 0, "", nil, nil)
+		true, true, "", "", "{}", "{}", 2, 0, "", nil, nil)
 	db.MustExec(insertClusterInfo, "323e4567-e89b-12d3-a456-426655440003", "HEALTHY", "key3", "2011-05-19 15:36:38",
-		"", "", "{}", "{}", 4, 2, "", nil, nil)
+		false, true, "", "", "{}", "{}", 4, 2, "", nil, nil)
 
 	db.MustExec(`UPDATE vizier_cluster SET cluster_name=NULL WHERE id=$1`, testDisconnectedClusterEmptyUID)
 }
@@ -242,6 +242,8 @@ func TestServer_GetVizierInfo(t *testing.T) {
 	assert.Equal(t, resp.VizierID, utils.ProtoFromUUIDStrOrNil("123e4567-e89b-12d3-a456-426655440001"))
 	assert.Equal(t, resp.Status, cvmsgspb.VZ_ST_HEALTHY)
 	assert.Greater(t, resp.LastHeartbeatNs, int64(0))
+	assert.Equal(t, resp.Config.PassthroughEnabled, false)
+	assert.Equal(t, resp.Config.AutoUpdateEnabled, true)
 	assert.Equal(t, "vzVers", resp.VizierVersion)
 	assert.Equal(t, "cVers", resp.ClusterVersion)
 	assert.Equal(t, "healthy_cluster", resp.ClusterName)
@@ -292,6 +294,106 @@ func TestServer_GetVizierInfos(t *testing.T) {
 	assert.Equal(t, "k8sID", resp.VizierInfos[3].ClusterUID)
 }
 
+func TestServer_UpdateVizierConfig(t *testing.T) {
+	mustLoadTestData(db)
+
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	s := controllers.New(db, "test", nil, nil)
+	vzIDpb := utils.ProtoFromUUIDStrOrNil("123e4567-e89b-12d3-a456-426655440001")
+	resp, err := s.UpdateVizierConfig(CreateTestContext(), &cvmsgspb.UpdateVizierConfigRequest{
+		VizierID: vzIDpb,
+		ConfigUpdate: &cvmsgspb.VizierConfigUpdate{
+			PassthroughEnabled: &types.BoolValue{Value: true},
+		},
+	})
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+
+	// Check that the value was actually updated.
+	infoResp, err := s.GetVizierInfo(CreateTestContext(), vzIDpb)
+	require.NoError(t, err)
+	require.NotNil(t, infoResp)
+	assert.Equal(t, infoResp.Config.PassthroughEnabled, true)
+}
+
+func TestServer_UpdateVizierConfig_PassthroughDisable(t *testing.T) {
+	mustLoadTestData(db)
+
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	s := controllers.New(db, "test", nil, nil)
+	vzIDpb := utils.ProtoFromUUIDStrOrNil("123e4567-e89b-12d3-a456-426655440001")
+
+	_, err := s.UpdateVizierConfig(CreateTestContext(), &cvmsgspb.UpdateVizierConfigRequest{
+		VizierID: vzIDpb,
+		ConfigUpdate: &cvmsgspb.VizierConfigUpdate{
+			PassthroughEnabled: &types.BoolValue{Value: false},
+		},
+	})
+	require.NotNil(t, err)
+	assert.Equal(t, status.Code(err), codes.InvalidArgument)
+}
+
+func TestServer_UpdateVizierConfig_PassthroughEnable(t *testing.T) {
+	mustLoadTestData(db)
+
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	s := controllers.New(db, "test", nil, nil)
+	vzIDpb := utils.ProtoFromUUIDStrOrNil("123e4567-e89b-12d3-a456-426655440001")
+
+	_, err := s.UpdateVizierConfig(CreateTestContext(), &cvmsgspb.UpdateVizierConfigRequest{
+		VizierID: vzIDpb,
+		ConfigUpdate: &cvmsgspb.VizierConfigUpdate{
+			PassthroughEnabled: &types.BoolValue{Value: true},
+		},
+	})
+	require.NoError(t, err)
+}
+
+func TestServer_UpdateVizierConfig_WrongOrg(t *testing.T) {
+	mustLoadTestData(db)
+
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	s := controllers.New(db, "test", nil, nil)
+	resp, err := s.UpdateVizierConfig(CreateTestContext(), &cvmsgspb.UpdateVizierConfigRequest{
+		VizierID: utils.ProtoFromUUIDStrOrNil("223e4567-e89b-12d3-a456-426655440003"),
+		ConfigUpdate: &cvmsgspb.VizierConfigUpdate{
+			PassthroughEnabled: &types.BoolValue{Value: true},
+		},
+	})
+	require.Nil(t, resp)
+	require.NotNil(t, err)
+	assert.Equal(t, status.Code(err), codes.NotFound)
+}
+
+func TestServer_UpdateVizierConfig_NoUpdates(t *testing.T) {
+	mustLoadTestData(db)
+
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	s := controllers.New(db, "test", nil, nil)
+	resp, err := s.UpdateVizierConfig(CreateTestContext(), &cvmsgspb.UpdateVizierConfigRequest{
+		VizierID:     utils.ProtoFromUUIDStrOrNil("123e4567-e89b-12d3-a456-426655440001"),
+		ConfigUpdate: &cvmsgspb.VizierConfigUpdate{},
+	})
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+
+	// Check that the value was not updated.
+	infoResp, err := s.GetVizierInfo(CreateTestContext(), utils.ProtoFromUUIDStrOrNil("123e4567-e89b-12d3-a456-426655440001"))
+	require.NoError(t, err)
+	require.NotNil(t, infoResp)
+	assert.Equal(t, infoResp.Config.PassthroughEnabled, false)
+}
+
 func TestServer_GetVizierConnectionInfo(t *testing.T) {
 	mustLoadTestData(db)
 	viper.Set("domain_name", "withpixie.ai")

src/cloud/vzmgr/vzmgrpb/mock/vzmgr_mock.gen.go

@@ -199,6 +199,26 @@ func (mr *MockVZMgrServiceClientMockRecorder) UpdateOrInstallVizier(ctx, in inte
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateOrInstallVizier", reflect.TypeOf((*MockVZMgrServiceClient)(nil).UpdateOrInstallVizier), varargs...)
 }
 
+// UpdateVizierConfig mocks base method.
+func (m *MockVZMgrServiceClient) UpdateVizierConfig(ctx context.Context, in *cvmsgspb.UpdateVizierConfigRequest, opts ...grpc.CallOption) (*cvmsgspb.UpdateVizierConfigResponse, error) {
+	m.ctrl.T.Helper()
+	varargs := []interface{}{ctx, in}
+	for _, a := range opts {
+		varargs = append(varargs, a)
+	}
+	ret := m.ctrl.Call(m, "UpdateVizierConfig", varargs...)
+	ret0, _ := ret[0].(*cvmsgspb.UpdateVizierConfigResponse)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// UpdateVizierConfig indicates an expected call of UpdateVizierConfig.
+func (mr *MockVZMgrServiceClientMockRecorder) UpdateVizierConfig(ctx, in interface{}, opts ...interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	varargs := append([]interface{}{ctx, in}, opts...)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateVizierConfig", reflect.TypeOf((*MockVZMgrServiceClient)(nil).UpdateVizierConfig), varargs...)
+}
+
 // VizierConnected mocks base method.
 func (m *MockVZMgrServiceClient) VizierConnected(ctx context.Context, in *cvmsgspb.RegisterVizierRequest, opts ...grpc.CallOption) (*cvmsgspb.RegisterVizierAck, error) {
 	m.ctrl.T.Helper()
@@ -362,6 +382,21 @@ func (mr *MockVZMgrServiceServerMockRecorder) UpdateOrInstallVizier(arg0, arg1 i
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateOrInstallVizier", reflect.TypeOf((*MockVZMgrServiceServer)(nil).UpdateOrInstallVizier), arg0, arg1)
 }
 
+// UpdateVizierConfig mocks base method.
+func (m *MockVZMgrServiceServer) UpdateVizierConfig(arg0 context.Context, arg1 *cvmsgspb.UpdateVizierConfigRequest) (*cvmsgspb.UpdateVizierConfigResponse, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "UpdateVizierConfig", arg0, arg1)
+	ret0, _ := ret[0].(*cvmsgspb.UpdateVizierConfigResponse)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// UpdateVizierConfig indicates an expected call of UpdateVizierConfig.
+func (mr *MockVZMgrServiceServerMockRecorder) UpdateVizierConfig(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateVizierConfig", reflect.TypeOf((*MockVZMgrServiceServer)(nil).UpdateVizierConfig), arg0, arg1)
+}
+
 // VizierConnected mocks base method.
 func (m *MockVZMgrServiceServer) VizierConnected(arg0 context.Context, arg1 *cvmsgspb.RegisterVizierRequest) (*cvmsgspb.RegisterVizierAck, error) {
 	m.ctrl.T.Helper()

src/cloud/vzmgr/vzmgrpb/service.proto

@@ -38,6 +38,7 @@ service VZMgrService {
   rpc GetVizierInfos(GetVizierInfosRequest) returns (GetVizierInfosResponse);
   // Call to acknowledge connection of a vizier.
   rpc VizierConnected(cvmsgspb.RegisterVizierRequest) returns (cvmsgspb.RegisterVizierAck);
+  rpc UpdateVizierConfig(cvmsgspb.UpdateVizierConfigRequest) returns (cvmsgspb.UpdateVizierConfigResponse);
   // This call is made when we want to update or install a Vizier.
   rpc UpdateOrInstallVizier(cvmsgspb.UpdateOrInstallVizierRequest) returns (cvmsgspb.UpdateOrInstallVizierResponse);
   // Given a VizierID, get the org who owns that vizier. This should be for internal use only.

src/shared/cvmsgspb/cvmsgs.proto

@@ -35,6 +35,7 @@ option go_package = "cvmsgspb";
 import "github.com/gogo/protobuf/gogoproto/gogo.proto";
 import "google/protobuf/any.proto";
 import "google/protobuf/timestamp.proto";
+import "google/protobuf/wrappers.proto";
 import "src/api/proto/uuidpb/uuid.proto";
 import "src/api/proto/vizierpb/vizierapi.proto";
 import "src/shared/k8s/metadatapb/metadata.proto";
@@ -186,6 +187,17 @@ message VizierHeartbeatAck {
   string error_message = 4;
 }
 
+message VizierConfig {
+  bool passthrough_enabled = 1;
+  bool auto_update_enabled = 2;
+}
+
+message VizierConfigUpdate {
+  // Deprecated: We no longer let users disable passthrough. This will be removed in a future release.
+  google.protobuf.BoolValue passthrough_enabled = 1;
+  reserved 2;
+}
+
 message VizierInfo {
   // The ID for this Vizier.
   uuidpb.UUID vizier_id = 1 [
@@ -195,6 +207,7 @@ message VizierInfo {
   VizierStatus status = 2;
   // Time in ns since the last heart beat. Negative number implies heartbeat never received.
   int64 last_heartbeat_ns = 3 [(gogoproto.moretags) = "db:last_heartbeat"];
+  VizierConfig config = 4;
   // A unique ID for the cluster. This is typically the kube-system namespace UID.
   string cluster_uid = 5 [(gogoproto.customname) = "ClusterUID"];
   // The name of the cluster. The return value of "kubectl config current-context".
@@ -219,10 +232,18 @@ message VizierInfo {
   VizierStatus previous_status = 15;
   // The most recent timestamp of the previous Vizier status (if known)
   google.protobuf.Timestamp previous_status_time = 16;
+}
 
-  reserved 4;
+message UpdateVizierConfigRequest {
+  uuidpb.UUID vizier_id = 1 [
+    (gogoproto.customname) = "VizierID",
+    (gogoproto.moretags) = "db:vizier_id"
+  ];
+  VizierConfigUpdate config_update = 2;
 }
 
+message UpdateVizierConfigResponse {}
+
 // UpdateOrInstallVizierRequest is a request to install/update a vizier.
 message UpdateOrInstallVizierRequest {
   // The ID of the vizier to upgrade/install.