From 895068258fa898dc1c6fba26f7b3af6655e052da Mon Sep 17 00:00:00 2001 From: mschwab Date: Fri, 12 Jun 2026 02:41:43 -0700 Subject: [PATCH] fix: disable auth by default for local env MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adding the customizer plugin (36efeb985, side change d6613e3ba) flipped auth.enabled to true in both local configs. With the embedded PDP that requires a built policy.wasm — which 'make bootstrap' / 'nemo setup --start-services' do not build — local startup hit PolicyEngineError (embedded_pdp/engine.py). Revert the default to auth.enabled: false. The customizer does not require auth: secrets CRUD is unauthenticated (same as inference-gateway), the plugin never calls the secrets API directly, and it registers no seed. 'Auth required for local seed' referred to authz role bindings, which only matter once auth is on. Signed-off-by: mschwab --- packages/nmp_platform/config/local.yaml | 2 +- .../src/nmp/platform_runner/config/local.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/packages/nmp_platform/config/local.yaml b/packages/nmp_platform/config/local.yaml index 38558d82cb..7b7542da0c 100644 --- a/packages/nmp_platform/config/local.yaml +++ b/packages/nmp_platform/config/local.yaml @@ -20,7 +20,7 @@ platform: service: {} auth: - enabled: true + enabled: false allow_unsigned_jwt: true # local CLI: nemo auth login --unsigned-token policy_decision_point_provider: embedded policy_decision_point_base_url: "http://localhost:8080" diff --git a/packages/nmp_platform_runner/src/nmp/platform_runner/config/local.yaml b/packages/nmp_platform_runner/src/nmp/platform_runner/config/local.yaml index 3b670b0761..bcb5a60a55 100644 --- a/packages/nmp_platform_runner/src/nmp/platform_runner/config/local.yaml +++ b/packages/nmp_platform_runner/src/nmp/platform_runner/config/local.yaml @@ -7,7 +7,7 @@ platform: service: {} auth: - enabled: true + enabled: false allow_unsigned_jwt: true policy_decision_point_provider: embedded policy_decision_point_base_url: "http://127.0.0.1:8080"