[viethqb]

Summary

Package B of the StarRocks follow-ups. This change shows which StarRocks engines egret does not govern or protect, and lets an admin fix them.

• Unbound engines (KI-336).

  • With Ranger on, a StarRocks create now gets a policy profile the way a Trino create does. Add engine has a new Policy profile select, which by default creates a profile named after the engine.
  • An engine with no profile shows Not governed in the list and on its page.

• Legacy engines.

  • A provisioned StarRocks engine shows Security upgrade needed when any of these holds:
    • its FE image is older than egret-starrocks-fe:4.1.7-egret.4 (the image that closes KI-340, KI-345 and the other fork patches);
    • its FE root has no password;
    • its last upgrade did not finish applying.
  • Upgrade security (POST /api/control-plane/engines/{id}/security-upgrade, engine:update) does three things:
    • mints the root password;
    • moves the FE and CN images to the defaults, unless that would downgrade the FE;
    • applies the engine.

  It is idempotent, so pressing it again finishes a partial run.

Spec: docs/en/specs/2026-11-09-starrocks-engine-posture-design.md. Plan: docs/en/plans/2026-11-09-starrocks-engine-posture.md.

Changes

• egret-perm::engine_images:
  • is_patched_starrocks_fe. A ref that carries a digest is judged by the digest alone, which counts a mirrored image. A ref without a digest is judged by its tag.
  • starrocks_fe_upgrade_target, which refuses a downgrade. The frontend copy of this rule is removed.
• KI-336:
  • plan_profile and bind_profile are shared by Trino and StarRocks.
  • PolicyPort::ensure_starrocks_def: a StarRocks profile has no tag service.
  • A create refuses with 409 a named profile of the wrong type, or one another engine binds.
  • The DTO gains notGoverned.
• Engine DTO, list, detail, create and update responses:
  • securityUpgradeNeeded;
  • securityUpgradeReasons (unpatchedImage, noRootPassword, notApplied);
  • securityUpgradeFeImage;
  • securityUpgradeBlockedRelease.
• Migration 0217_engine_security_upgrade_pending.sql: a flag that is set before the upgrade's apply and cleared on a successful apply. The image write is a jsonb_set of the two keys only.
• Provisioner: the {name}-initpwd Job is deleted with Background propagation, and the apply waits (bounded, 30 s) until the old Job is gone. Before, every second apply patched the terminating Job, so the Job vanished and orphan pods piled up. This was found in the live check.
• Frontend:
  • the profile picker;
  • the Not governed and Security upgrade needed badges;
  • the upgrade warning and confirmation dialog;
  • the old metadata-tables warning is hidden while the upgrade warning shows.

Test plan

• Every behaviour change has a test plus a mutant of the change that the test kills, recorded in the task reports.
• cargo fmt, and clippy -D warnings clean.
• egret-perm 28 passed.
• egret-engine-mgmt (DB) 546 passed.
• egret-provisioner 221 passed.
• Frontend: typecheck and lint clean; vitest for control-plane and governance/engines 878/878.
• Live check on kind (StarRocks operator v1.11.6, egret release binary on the host):
  • A legacy engine on official 4.1.6 with a passwordless root showed the badge.
  • After Upgrade security:
    • mysql -uroot with no password got ERROR 1045 and the stored password logged in;
    • the FE ran 4.1.7-egret.4 and the CN ran 4.1.7;
    • the badge was gone.
  • KI-336: a StarRocks create with Ranger on made and bound a profile, and an engine with no profile showed Not governed.
  • The initpwd fix was re-checked with the release binary of this branch: 3 upgrades back to back each left a fresh, non-terminating Job, the last one succeeded, and no new orphan pods were left.
  • Not checked live:
    • the downgrade guard, because Docker Hub has no 4.1.8 or 4.2 tag;
    • egret's own root login, because egret ran on the host and could not resolve the FE's cluster DNS name. The password was read from the Secret egret rendered.

Documentation

egret-data/docs#74 covers:

• the Engine detail page: badge, warning, Upgrade security, Not governed;
• Add engine: the profile picker;
• the upgrade notes;
• known issues: KI-336 fixed, and KI-340/KI-345 point to the upgrade;
• the Engines REST reference;
• four new screenshots.

Checklist

• Linked to an issue (no issue; package B of the StarRocks follow-ups)
• Tests added or updated
• Docs updated in egret-data/docs for any user-visible feature, UI, API or config change
• Commit messages follow Conventional Commits
• No secrets, tokens or real data added

🤖 Generated with Claude Code