[viethqb]

Summary

StarRocks engines get a Query log. egret installs the AuditLoader plugin, which ships in the egret fork image at /opt/egret/auditloader.zip, and it now loads every statement into starrocks_audit_db__.starrocks_audit_tbl__, kept for 30 days. Engine detail gets a Query log tab that reads it.

Design and plan:

• docs/en/specs/2026-11-09-starrocks-audit-platform-design.md, including the rulings of 2026-11-10 and 2026-11-11 and the facts measured on kind;
• docs/en/plans/2026-11-09-starrocks-audit-platform.md.

Changes

Setup (query_log.rs)

• Creates the audit database and table, then the loader user egret_query_log.
  • The user's password is a per-engine system secret (engines.query_log_secret_id). The name is reserved in the username ledger.
  • The loader gets a native grant only when the engine has no policy profile.
• Installs or reinstalls the plugin. SHOW PLUGINS is read by header, and only Status = INSTALLED counts as installed.
• Waits for an alive compute node before creating the table.
• Runs from four places:
  • the post-Ready bootstrap, after the delegation statements;
  • after an apply or Upgrade security, with a bounded retry (5 × 60 s);
  • a boot pass, setup_query_logs;
  • POST /engines/{id}/query-log/setup.
• None of these block the request or boot path.

Ranger (IR infra)

• egret-query-log-loader allows only insert on the table.
• egret-query-log-guard - <chain> rows deny group public, engine admins included, everything on the audit database. The one exception is the loader's insert.
• Convergence is type-aware: these names count only on StarRocks profiles.

Read API

• Four routes: status, list, detail and setup.
• Cursor paging, a range of at most 31 days and filters.
• Every request value reaches SQL only through quote_string or as an egret-formatted value.
• FE errors are always scrubbed.
• Statement text is redacted: exact root and loader passwords plus shape rules.
• egret's own reads carry /* egret-query-log-read */ and are excluded.

Permission

• New engine:audit, required to see statement and errorMessage.
• Migration 0218 grants it to platform roles that hold engine:update.

feConfig

• plugin_enable and plugin_dir are now refused.

Driver

• The root and user StarRocks connections set max_allowed_packet and wait_timeout. The driver therefore no longer sends SELECT @@max_allowed_packet,@@wait_timeout, which used to show up in the log.

Frontend

• A Query log tab, StarRocks only, lazy-loaded. It has:
  • status line and callouts;
  • URL-kept filters;
  • Load more;
  • a side panel.

Test plan

Unit, DB and route tests

• The full egret-engine-mgmt suite: 626/626, with no DB skips.
• The egret-core RBAC tests.
• committed_openapi_json_is_current.
• Frontend: lint, typecheck, npm run build and the bundle tests. The QueryLogTab tests pass 36/36.
• Workspace-wide cargo clippy -D warnings --all-targets and cargo fmt --check are clean.
• Every behaviour change has a mutant that its test kills; these are recorded per task.
• The full frontend suite has one failure. ScheduleDetail "creates an alert through the real body shape" times out, and it fails the same way on main's tree.

Live, against a real FE (tests/query_log_live.rs, opt-in EGRET_TEST_STARROCKS_URL)

• On egret.4, setup reaches Ready, and a second run installs nothing.
• EXECUTE AS rows show the right authorizedUser.
• egret's own reads are absent.
• The official image answers pluginNotShipped, with the table and user created.

Measured on a real FE

• StarRocks itself stores *** for passwords in CREATE/ALTER USER, SET PASSWORD and INSTALL PLUGIN.
• FE errors were pinned verbatim: missing zip, already installed, unknown database and unknown table.
• The FE time zone is UTC.
• The SHOW PLUGINS header was pinned.

Fork e2e with egret's rendered loader and guard policies (egret.4)

• Audit checks: 10/10. The loader still loads.
• Guard checks: 6/6. eve, and a user with an all-access allow, are denied SELECT and DROP TABLE on the audit table.

Live on kind (in-cluster egret built from this branch, Ranger on)

Check	Result
New engine	The tab reaches ready on its own at Running, and delegation statements run first
User / Connected as	Shown correctly. Rows were produced with EXECUTE AS (see below)
A Ranger deny	Shows Failed with INTERNAL_ERR; the audit row stores the error code only
Admin read of the audit table	admin and member-sso are denied. Root is not subject to Ranger
FE pod deleted	The plugin is still INSTALLED (re-extracted from the image) and events resume. About 2 minutes of events are lost, so no plugin_dir move is needed
Legacy 4.1.6 engine	pluginNotShipped; ready 66 s after Upgrade security
egret's own reads	Absent from the list; "Latest event" is stable on reload

Known limit: StarRocks checks SELECT per column, so SELECT count(*) on the audit table gets past the guard. The row count is visible; the contents are not. This is in the spec and the docs.

Found on kind, outside this PR (follow-ups)

1. Under Ranger, an impersonate-mode StarRocks engine cannot run queries through egret: there is no Ranger impersonate rule for the delegator, and the target user is not created.
2. The CN has no MYSQL_PWD, so it crash-loops once the initpwd Job has set root's password.
3. Deleting an engine leaves the initpwd pods and the FE meta PVCs behind.

Documentation

egret-data/docs#75 (Engine detail, Security, Permissions, Upgrade notes, REST API, screenshots).

Checklist

• Linked to an issue
• Tests added or updated (or not applicable)
• Docs updated in egret-data/docs for any user-visible feature, UI, API or config change (or not applicable: internal only)
• Commit messages follow Conventional Commits
• No secrets, tokens or real data added

🤖 Generated with Claude Code