[viethqb]

Summary

This is port 8080 hardening, PR A: Trino identity over plain HTTP. It is the first of two prerequisites for SP2b Task 26 (OPA on by default).

The hole (measured). egret rendered http-server.authentication.allow-insecure-over-http=true on every Trino engine except jwt-mode with TLS. At true, Trino does not authenticate a plain-HTTP request at all, so anything that could reach a coordinator's port 8080 could run as any user.

• This includes egret's pods, the engine namespace and an engine's ingress controller.
• trino --user ann --session-user bob ran as bob with no password, on Ranger and OPA alike.
• An engine with no trinoConfig.auth had no authenticator at all.
• The old comment ("safe because impersonation is delegator-only") was wrong.

The spec is docs/en/specs/2026-11-07-port-8080-hardening-design.md, Part A, and the plan is docs/en/plans/2026-11-07-port-8080-hardening.md, Tasks A1–A6. Part B, a dedicated OPA listener, is a separate PR.

Changes

• Every authenticated engine refuses authentication over plain HTTP. The render is now allow-insecure-over-http=false.
  • A plain-HTTP request without X-Forwarded-Proto: https gets 403.
  • A request with that header but no credential gets 401.
  • egret's monitor (Basic plus the header), delegated queries (HTTPS 8443) and /v1/info probes keep working.
• Every provisioned Trino engine authenticates.
  • A spec without auth is stored and applied as {"password":{}}.
  • egret-monitor is injected for every engine except a true jwt-only coordinator, which is jwt mode with an auth.jwt block. The delegator is injected in impersonate mode.
  • Migration 0215 backfills the stored auth on existing provisioned Trino rows.
• "Re-apply needed".
  • Migration 0215 adds engine_mgmt.engines.applied_security_rev.
  • Every successful Trino apply records TRINO_SECURITY_REV = 1.
  • The engine API gains securityReapplyNeeded, and the engine list shows a "Re-apply needed" badge.
  • jwt-only engines without password users are excluded, because they were already closed.
• Every Trino apply now re-materializes the engine's workspace connections. A newly minted delegator secret is then bound on every apply path (rotate, mechanism switch, catalog attach or detach, restart), not only on PUT.
  • A failure leaves the apply successful but names the engine in the existing "not recorded" note.
  • So a mechanism switch reports that engine and a resend retries.
• monitor_headers branches on is_jwt_only_coordinator(): Bearer only for a real jwt-only engine, Basic plus the header otherwise.
• The opa-e2e harness reaches Trino as egret does.
  • It uses the delegator's Basic credential with X-Forwarded-Proto: https, or the CLI over 8443, impersonating each user.
  • The credential is decrypted from the e2e stack's own DB with the public dev master key, and masked in CI logs. It is e2e-only.
  • The new identity-check.sh asserts 403, 401 and 200 on both engines and fails the job on a regression.
• Docs corrections. "As corrected" notes in the 2026-07-04 and 2026-07-15 specs, and in deploy/trino/etc/README.md and config.properties.

Test plan

• A1 live measurement, on a standalone Trino 483 that mirrors egret's render (scripts/trino-insecure-http/check.sh), with and without an HTTPS listener. Results are in docs/en/plans/2026-11-07-port-8080-hardening-live-result.md, with the raw output alongside.
  • At false: plain HTTP gives 403 "Authentication over HTTP is not enabled"; forwarded HTTPS with no credential gives 401; monitor-pattern Basic gives 200; the delegator impersonating ann gives ann; /v1/info gives 200; the worker registers.
• Unit and DB tests, each with a mutant killed by a failing assertion. Results: egret-provisioner 212, egret-engine-mgmt lib 233 and routes 215/215, egret-metastore lib, and frontend vitest control-plane 568. Covered:
  • the flag render;
  • auth normalisation across 6 spec shapes;
  • the security revision and badge population;
  • the legacy no-auth row re-applied through rotate-secrets, which ends with auth stored, the connection bound to the delegator, and the monitor sending Basic plus the header;
  • the monitor Bearer/Basic choice.
• fmt and clippy -D warnings are clean.
• e2e: the CI opa-e2e job on this PR is the run of record. Locally, Layer 2 passed (501 cases) and the identity check passed, but only on a pre-A2 image with the flag set to false by hand. Building a fresh backend image was not safe with other stacks running.
• Reviews: a task review after every task, a final whole-branch review (opus), and one fix wave with a re-review. The final review found one Important issue, now fixed: a legacy no-auth row re-applied through a non-PUT path got a broken monitor and an unbound connection.

Known follow-ups (not in this PR)

• Provisioned Trino workers have no access control, so the graceful-shutdown preStop (PUT /v1/info/state) gets 403 "Management only resource" at both flag values. This was measured, and graceful shutdown never happens. It is pre-existing.
• StarRocks FE 9030 accepts root with no password when root_password is unset.
• Ingress and kube-proxy behaviour was simulated with the header, not measured against a real ingress controller.
• PR B moves the OPA surface to its own engines-only listener.

Documentation

egret-data/docs#69 covers several pages:

• every Trino engine authenticates;
• the plain-HTTP refusal, as a breaking change for direct http://…:8080 clients without a password;
• the "Re-apply needed" badge;
• an upgrade note;
• KI-355.

Checklist

• Linked to an issue (no tracking issue)
• Tests added or updated
• Docs updated in egret-data/docs
• Commit messages follow Conventional Commits
• No secrets, tokens or real data added

🤖 Generated with Claude Code