[viethqb]

Summary

Three StarRocks defects found live on kind (package D of the StarRocks follow-ups):

• D1 (KI-356, S1): an impersonation-mode StarRocks engine under Ranger could not run any query through Egret. The delegator had no Ranger right to impersonate, and the members had no StarRocks user.
• D2: the CN had no MYSQL_PWD and crash-looped on a passworded engine.
• D3 (KI-357): deleting an engine left the {name}-initpwd Job pods and the fe-meta PVCs behind. A same-name re-create then kept the old root password, users and catalogs.

No issue; tracked in the StarRocks follow-up programme. Spec: docs/en/specs/2026-11-11-starrocks-delegation-and-lifecycle-design.md. Plan: docs/en/plans/2026-11-11-starrocks-delegation-and-lifecycle.md (both with vi twins).

Changes

• Ranger row: Egret renders an egret-delegator-impersonate row (resource user, isExcludes over root, egret_delegator, egret_query_log) for StarRocks impersonate engines. The OPA decide arm (InfraObject::AnyUserExcept) matches it. The G22 golden gains the row.
• User sync:
  • Egret creates each member's StarRocks user, with an unusable random password, and drops it when access ends. Platform admins are included.
  • The bookkeeping lives in migration 0219_starrocks_users.sql (engine_mgmt.starrocks_users, root reserved in the username ledger, statement-level pg_notify triggers).
  • Sync runs on a LISTEN worker (1 s debounce, Busy retry), on every apply including a PUT that rolls the FE, at boot, and on a 10-minute sweep.
  • Reserved names are refused. A same-name user Egret did not create is left alone and logged.
• Native access control (no profile): per-user GRANT IMPERSONATE ON USER for the delegator, then REVOKE … ON ALL USERS, and a revoke before every drop. The bootstrap no longer grants ON ALL USERS.
• Provisioner: MYSQL_PWD comes from <name>-initpwd-secret on FE and CN (an admin-set value wins). Delete removes the initpwd Job (background propagation) and every fe-meta-<name>-fe-<i> claim. The FE StatefulSet has PVC retention whenDeleted: Delete.
• Create: POST /engines answers 409 engine_metadata_left_over while fe-meta-<name>-fe-0 exists, with the kubectl delete pvc command (502 if the probe cannot read).

Test plan

• Unit and integration: unit and DB tests for every task. Each final-review fix is pinned by a test that failed before it (a_starrocks_update_syncs_the_users_again).
• CI parity, all green locally:
  • cargo fmt --check and workspace clippy -D warnings;
  • the core, perm-ir, policy-api, provisioner, engine-mgmt, auth, perm-compile (harness), perm-eval, policy and ranger-eval suites;
  • goldens (Ranger and EGRET_GOLDEN_MECHANISM=opa), ranger_engine_gate, opa_differential, ranger-eval differential.
• Real FE (ghcr.io/egret-data/egret-starrocks-allin1:4.1.7-egret.4): new tests/starrocks_users_live.rs, gated on EGRET_TEST_STARROCKS_URL, passes in 1.4 s.
  • It covers sync, foreign user, drop and native access control.
  • On native access control: ON ALL USERS is gone, EXECUTE AS a member works, EXECUTE AS root and EXECUTE AS <foreign> are refused.
• Fork plugin: the fork's e2e with the row Egret renders gives 51/51 and 10/10 audit checks. root, egret_query_log and egret_delegator are refused (5204); an ordinary user is allowed.
• Live on kind (Ranger + OIDC, image built from this branch and grep-verified):
  1. Impersonation: member-sso ran SELECT current_user() through Egret and got 'member-sso'@'%', with no user created by hand. Removing them from the workspace dropped the user within about 1 s; re-adding brought it back within 5 s. The delegator is refused EXECUTE AS root and egret_query_log.
  2. CN: MYSQL_PWD comes from the initpwd secret on FE and CN. The CN ran with 0 restarts, was Alive: true, and re-registered after its pod was deleted.
  3. Delete: no pod, Job, PVC or PV was left after about 20 s.
  4. Same-name re-create: the new root password works and the user list is fresh.
  5. Leftover claim: with a leftover fe-meta claim, create gives 409 with the command. After running the command, create succeeds.
• Not covered on kind: native access control on a profile-less engine. Package B binds a profile on every create under Ranger, so it is covered by the real-FE test above.

Documentation

egret-data/docs#76:

• KI-356 and KI-357 are fixed.
• KI-358 (orphan per-user grants, with manual cleanup) and KI-359 (lost CREATE USER reply, with recovery) are new.
• Updated pages: engines and Ranger, workspace databases, engine detail (including the kubectl delete sts cascade note), provision (the 409), upgrade notes, REST reference.

Checklist

• Linked to an issue (none; programme item)
• Tests added or updated (or not applicable)
• Docs updated in egret-data/docs for any user-visible feature, UI, API or config change (or not applicable: internal only)
• Commit messages follow Conventional Commits
• No secrets, tokens or real data added

🤖 Generated with Claude Code