docs: StarRocks engines default to egret-starrocks-fe 4.1.7-egret.3 (platform #827)

platform/control-plane/query-engines/engine-detail.md

@@ -12,7 +12,7 @@ Select an engine in **Control Plane → Engines** to open its page. The tabs dep
 
 The header shows the engine name, its namespace (`egret-engines`), the image, the endpoint, the authentication (*JWT auth*) and the Ranger plugin version, with the type and status badges. The endpoint is the `host:port` a workspace connection to the engine dials, for example `docs-trino-trino.egret-engines.svc:8443` (port 8443 is the HTTPS listener of an engine with JWT delegation). **Open in Engine & policy** opens the engine in Governance, **Restart** restarts the engine, and the **More engine actions** menu (**⋯**) holds **Delete engine**. The tabs are **Overview**, **Catalogs**, **Workspaces**, **Settings** and **Monitor**.
 
-A provisioned StarRocks engine that a policy profile names shows, above the tabs, the warning that official StarRocks images serve the Iceberg metadata tables without asking Ranger and apply no mask or row filter to prepared statements (since platform #822; see [External engine](#overview-1), KI-340 and KI-345). It is not shown while the profile list loads, or to a viewer who cannot read it. It is not shown for a provisioned engine on Egret's patched image `ghcr.io/egret-data/egret-starrocks-fe` (the default for new engines since platform #826), which fixes both holes; an external engine always shows it, because Egret does not know its image.
+A provisioned StarRocks engine that a policy profile names shows, above the tabs, the warning that unless the engine runs `egret-starrocks-fe` `4.1.7-egret.3` or later its StarRocks lets users past the profile: official images serve the Iceberg metadata tables without asking Ranger and apply no mask or row filter to prepared statements, and official and earlier patched images apply none through the HTTP SQL API or Arrow Flight SQL, let anyone read object storage through `FILES()` and let a masked or filtered user store a table's rows in the clear in a materialized view (since platform #822, widened in #826 and #827; see [External engine](#overview-1), KI-340, KI-345 to KI-348). It is not shown while the profile list loads, or to a viewer who cannot read it. It is not shown for a provisioned engine on Egret's patched image `ghcr.io/egret-data/egret-starrocks-fe` `4.1.7-egret.3` or later (the default for new engines since platform #827), which fixes all of them; it is shown for an engine still on `4.1.7-egret.1`; an external engine always shows it, because Egret does not know its image.
 
 ### Overview
 
@@ -119,7 +119,7 @@ The header shows the engine name, its type, an **External** badge and **Open in
 | **Ranger plugin version** | The version you declared. |
 | **Policy profile** | The bound profile, or *None bound. Bind one on the Settings tab.* |
 
-For a StarRocks engine with a bound profile the tab also shows a warning (since platform #822; widened in platform #826): official StarRocks images serve the metadata tables of Iceberg tables (`$files`, `$partitions`, `$snapshots` and the others) without asking Ranger, so anyone who can log in to the engine can read row counts, partition values, data file paths and each column's lowest and highest values for every table of an attached Iceberg catalog, whatever the profile's grants, masks, row filters and classifications say, and apply no mask or row filter to prepared statements such as Data API endpoints with parameters (KI-340, KI-345). Egret's patched image `ghcr.io/egret-data/egret-starrocks-fe` fixes both; run the engine on it. Give StarRocks logins only to people who may see these values, and serve masked or filtered data through Trino. A Trino engine shows no such warning.
+For a StarRocks engine with a bound profile the tab also shows a warning (since platform #822; widened in platform #826 and #827): official StarRocks images serve the metadata tables of Iceberg tables (`$files`, `$partitions`, `$snapshots` and the others) without asking Ranger, so anyone who can log in to the engine can read row counts, partition values, data file paths and each column's lowest and highest values for every table of an attached Iceberg catalog, whatever the profile's grants, masks, row filters and classifications say, and apply no mask or row filter to prepared statements such as Data API endpoints with parameters; official images and Egret's earlier patched images also apply none through the HTTP SQL API or Arrow Flight SQL, let anyone read object storage through `FILES()` and let a masked or filtered user store a table's rows in the clear in a materialized view (KI-340, KI-345 to KI-348). Egret's patched image `ghcr.io/egret-data/egret-starrocks-fe` `4.1.7-egret.3` or later fixes all of them; run the engine on it. Give StarRocks logins only to people who may see these values, and serve masked or filtered data through Trino. A Trino engine shows no such warning.
 
 ![The Overview tab of the external StarRocks engine docs-starrocks with the StarRocks security warning](/img/platform/admin/cp-engine-ext-sr-overview.png)
 

platform/control-plane/query-engines/register-external.md

@@ -44,7 +44,7 @@ Egret proves migrations and explains access only for Trino with plugin 2.5.0 or
 
 *Bind a Trino profile now, or leave it and bind one later from the engine's Settings tab. A profile can belong to one engine.* The list shows **No profile yet**, then each Trino profile, marking those already taken (for example *docs-trino — bound to docs-trino*). A Trino profile with no tag service is listed but cannot be chosen, marked *… — no tag service: give it one on its Advanced tab*, because egret would refuse to bind it. A profile already bound to another engine cannot be chosen again. If binding would make two mask or row-filter rules decide one column differently, egret refuses and changes nothing, and the form says *Nothing was changed. Resolve one of the two, then try again.*
 
-For a StarRocks engine, picking a profile shows a warning under the picker (since platform #822): official StarRocks images serve the metadata tables of Iceberg tables without asking Ranger, so anyone who can log in to the engine can read row counts, partition values, data file paths and column bounds of every table in its Iceberg catalogs, whatever the profile says, and apply no mask or row filter to prepared statements (KI-340, KI-345). Run the external engine on Egret's patched image `ghcr.io/egret-data/egret-starrocks-fe`, which fixes both; the warning stays, because Egret cannot see which image an external engine runs.
+For a StarRocks engine, picking a profile shows a warning under the picker (since platform #822): official StarRocks images serve the metadata tables of Iceberg tables without asking Ranger, so anyone who can log in to the engine can read row counts, partition values, data file paths and column bounds of every table in its Iceberg catalogs, whatever the profile says, and apply no mask or row filter to prepared statements; official images and Egret's earlier patched images also apply none through the HTTP SQL API or Arrow Flight SQL, let anyone read object storage through `FILES()` and let a masked or filtered user store a table's rows in the clear in a materialized view (KI-340, KI-345 to KI-348; widened in platform #827). Run the external engine on Egret's patched image `ghcr.io/egret-data/egret-starrocks-fe` `4.1.7-egret.3` or later, which fixes all of them; the warning stays, because Egret cannot see which image an external engine runs.
 
 ![Register external engine with type StarRocks and a profile picked: the StarRocks security warning under Policy profile](/img/platform/admin/cp-register-sr-warning.png)
 

platform/data-governance/data/masks-and-filters.md

@@ -142,7 +142,7 @@ The local platform admin `admin@egret.local` got the same masked values: platfor
 - A mask on a column whose type the mask cannot apply to can return an error from the engine rather than a masked value.
 - A rule that selects by path is copied to the new name when its table or column is renamed, and the original stays on the old name; a rule that selects by tag follows because classifications do. A rule that selects by a pattern the new name escapes refuses the rename. See [Renames and drops](./grants.md#renames-and-drops).
 - A row filter or custom mask expression that names a renamed column is not rewritten (KI-321).
-- On official StarRocks images, masks and row filters do not reach a table's Iceberg metadata tables (`orders$files`, `orders$partitions`, …), which StarRocks serves to any login without asking Ranger, so column bounds, partition values and counts are readable regardless of rules (KI-340); and they do not apply to prepared statements, so a Data API endpoint with parameters returns rows and values in the clear (KI-345). Egret's patched image `ghcr.io/egret-data/egret-starrocks-fe`, the default for new engines, fixes both; on an official image, do not give StarRocks logins to people who must not see the values.
+- On official StarRocks images, masks and row filters do not reach a table's Iceberg metadata tables (`orders$files`, `orders$partitions`, …), which StarRocks serves to any login without asking Ranger, so column bounds, partition values and counts are readable regardless of rules (KI-340); they do not apply to prepared statements, so a Data API endpoint with parameters returns rows and values in the clear (KI-345); they do not apply to the HTTP SQL API or Arrow Flight SQL (KI-346), nor to `FILES()`, which reads the data files directly (KI-347); and a materialized view stores its rows past its creator's masks and row filters (KI-348). Egret's patched image `ghcr.io/egret-data/egret-starrocks-fe` `4.1.7-egret.3`, the default for new engines, fixes all of them; on an official image, do not give StarRocks logins to people who must not see the values.
 - On Trino, a table's metadata tables (`orders$files`, `orders$partitions`, …) follow its masks, row filters and denies (since platform #821): a person a mask, row filter or deny on the table restricts gets *Access Denied* on every one of them, and a person it exempts or does not restrict reads them as before. A tag rule or clearance does the same for each table that carries the classification. Profiles that egret's permission model does not compile get no such deny (KI-341).
 - On StarRocks, `SELECT *` on an Iceberg table shows the hidden `_file` and `_pos` columns to a user with a row filter (KI-337). List the columns instead.
 

platform/data-governance/engines-and-policy/index.md

@@ -60,7 +60,7 @@ A Trino profile with no tag service cannot be bound to an engine: egret refuses
 
 Select an engine to open its page. The header shows the engine name, its **Type** badge, **Provisioned** or **External**, the bound **Profile**, the **Ranger plugin** version, and **Open in Control plane**. For an external engine a note reads *egret compiles this engine's policies but cannot see whether the external engine downloads them.*
 
-For a StarRocks engine bound to a profile, a warning under the header says that official StarRocks images serve the metadata tables of Iceberg tables (`$files`, `$partitions`, `$snapshots` and the others) without asking Ranger, so anyone who can log in to the engine can read row counts, partition values, data file paths and each column's lowest and highest values for every table of an attached Iceberg catalog, whatever the profile's grants, masks, row filters and classifications say, and apply no mask or row filter to prepared statements (KI-340, KI-345). It advises running the engine on Egret's patched image `ghcr.io/egret-data/egret-starrocks-fe`, or giving StarRocks logins only to people who may see these values and serving masked or filtered data through Trino (since platform #822). With **engine:read**, it is not shown for a provisioned engine on Egret's patched image `ghcr.io/egret-data/egret-starrocks-fe` (the default for new engines since platform #826), which fixes both holes; an external engine always shows it, because Egret does not know its image.
+For a StarRocks engine bound to a profile, a warning under the header says that official StarRocks images serve the metadata tables of Iceberg tables (`$files`, `$partitions`, `$snapshots` and the others) without asking Ranger, so anyone who can log in to the engine can read row counts, partition values, data file paths and each column's lowest and highest values for every table of an attached Iceberg catalog, whatever the profile's grants, masks, row filters and classifications say, and apply no mask or row filter to prepared statements; official images and Egret's earlier patched images also apply none through the HTTP SQL API or Arrow Flight SQL, let anyone read object storage through `FILES()` and let a masked or filtered user store a table's rows in the clear in a materialized view (KI-340, KI-345 to KI-348). It advises running the engine on Egret's patched image `ghcr.io/egret-data/egret-starrocks-fe` `4.1.7-egret.3` or later, or giving StarRocks logins only to people who may see these values and serving masked or filtered data through Trino (since platform #822, widened in #827). With **engine:read**, it is not shown for a provisioned engine on Egret's patched image `ghcr.io/egret-data/egret-starrocks-fe` `4.1.7-egret.3` or later (the default for new engines since platform #827), which fixes all of them; it is shown for an engine still on `4.1.7-egret.1`; an external engine always shows it, because Egret does not know its image.
 
 ![The Governance page of the external StarRocks engine docs-starrocks: the warning that official StarRocks images serve Iceberg metadata tables without asking Ranger and apply no mask or row filter to prepared statements, above the tabs](/img/platform/admin/gov-engine-starrocks-warning.png)
 

platform/deploy-operate/engines-and-ranger.md

@@ -28,7 +28,8 @@ jar out of each.
 | Trino | `trinodb/trino:483` | 2.8.0 |
 | StarRocks | `starrocks/fe-ubuntu:4.1.4` | 2.8.0 |
 | StarRocks | `starrocks/fe-ubuntu:4.1.6` | 2.9.0 |
-| StarRocks | `ghcr.io/egret-data/egret-starrocks-fe:4.1.7-egret.1` (Egret's patched 4.1.7) | 2.9.0 |
+| StarRocks | `ghcr.io/egret-data/egret-starrocks-fe:4.1.7-egret.1` (Egret's patched 4.1.7, first fixes; superseded) | 2.9.0 |
+| StarRocks | `ghcr.io/egret-data/egret-starrocks-fe:4.1.7-egret.3` (Egret's patched 4.1.7) | 2.9.0 |
 
 Plugin 2.5.0 cannot present the engine credential the policy service requires (see [Authentication of the plugin](#authentication-of-the-plugin)), so Egret refuses to create an engine on `trinodb/trino:470` or update one onto it (400), and refuses to register an external engine that declares a plugin older than 2.8.0. An existing Trino 470 engine must move to Trino 483.
 
@@ -45,21 +46,30 @@ get `ERROR 5204`. Grant the view, or the base columns for an `INVOKER` view, to
 
 ## Egret's patched StarRocks image
 
-The official StarRocks images have two holes that no policy Egret compiles can close (KI-340, KI-345):
+The official StarRocks images have holes that no policy Egret compiles can close:
 
 - they serve the metadata tables of Iceberg tables (`orders$files`, `$partitions`, `$snapshots`, …) to any login without
-  asking Ranger, which exposes row counts, partition values, data file paths and each column's lowest and highest value;
+  asking Ranger, which exposes row counts, partition values, data file paths and each column's lowest and highest value
+  (KI-340);
 - they apply no mask and no row filter to prepared statements (`PREPARE`/`EXECUTE`, or the MySQL binary protocol), and
   Egret runs Data API endpoints with parameters on StarRocks that way, so such an endpoint returns every row and column
-  in the clear.
+  in the clear (KI-345);
+- they apply no mask and no row filter to the front end's HTTP SQL API (port 8030, which the StarRocks Ingress exposes)
+  or to Arrow Flight SQL (KI-346);
+- `FILES()` reads and writes object storage with no privilege at all (KI-347);
+- a materialized view stores its base tables' rows past its creator's masks and row filters (KI-348);
+- `SELECT *` under a mask or row filter returns the hidden `_file` and `_pos` columns (KI-337), and `SHOW CREATE CATALOG`
+  shows every catalog's properties to anyone (KI-349).
 
 `ghcr.io/egret-data/egret-starrocks-fe` is the official `starrocks/fe-ubuntu` image of the same release with two front
-end jars rebuilt with the fixes; it ships the official Ranger plugin. The source, the patches and the security test every
+end jars rebuilt with the fixes; it ships the official Ranger plugin. `4.1.7-egret.3` fixes all of the above;
+`4.1.7-egret.1` fixed only the first two. On it, `FILES()` needs the OPERATE privilege on SYSTEM, and creating a
+materialized view over a table where a mask or row filter applies to the creator is refused. The source, the patches and the security test every
 image passes before it is published are at [github.com/egret-data/egret-starrocks](https://github.com/egret-data/egret-starrocks).
 New provisioned engines use it. To move an existing engine onto it, update the engine's `feImage` to
-`ghcr.io/egret-data/egret-starrocks-fe:4.1.7-egret.1@sha256:da948dad19e98a5a43b0073ec48f87c9e7429246ce4581a000c0955c742af250`
+`ghcr.io/egret-data/egret-starrocks-fe:4.1.7-egret.3@sha256:5c74c820f9b741bc8054247f47f3d54dd9e526710b6fc2b5a7873cae6bb2d2b0`
 and its `cnImage` to `starrocks/cn-ubuntu:4.1.7@sha256:39f7320127c9924abb1f1ce0ba0583ab11989cbe5bd1bb6274ada6f89ba5740d`
-(the pods restart; from 4.1.4 or 4.1.6 this is an upgrade). Run an external StarRocks engine on the same image.
+(the pods restart; from 4.1.4 or 4.1.6 this is an upgrade; an engine on `4.1.7-egret.1` moves the same way). Run an external StarRocks engine on the same image.
 
 ## Connect an engine
 

platform/deploy-operate/local.md

@@ -32,7 +32,7 @@ named `egret-dev`.
 | `valkey` | `valkey/valkey:8` | 6399 (to 6379 in the container) | The shared limiter and response cache for the Data API (`data_api.shared_store_url`). The dev server does not need it; `just check` does, for the store tests. No volume: its contents can be rebuilt. |
 | `rustfs` | `rustfs/rustfs:1.0.1` | 9000 (S3 API), 9001 (console) | S3-compatible object storage. Access key `egret`, secret `egretsecret`. It replaced MinIO, whose public images were withdrawn. It must support STS `AssumeRole`, because the embedded catalog vends credentials through it. |
 | `trino` | `trinodb/trino:483` (pinned by digest) | 8090 (HTTP), 8453 (HTTPS) | A development Trino with JWT authentication against Keycloak and a file-based group access control. JWT is only enforced over TLS, so the HTTPS listener uses a self-signed keystore (`deploy/trino/etc/gen-certs.sh` makes it). It ships no catalogs: mount property files into `deploy/trino/catalog`. |
-| `starrocks` | `ghcr.io/egret-data/egret-starrocks-allin1:4.1.7-egret.1` (Egret's patched StarRocks, pinned by digest) | 9030 (MySQL protocol), 8030 (FE HTTP) | A single-container StarRocks. The Ranger plugin configuration (`ranger-starrocks-security.xml`, `ranger-starrocks-audit.xml`) is mounted into the front end. |
+| `starrocks` | `ghcr.io/egret-data/egret-starrocks-allin1:4.1.7-egret.3` (Egret's patched StarRocks, pinned by digest) | 9030 (MySQL protocol), 8030 (FE HTTP) | A single-container StarRocks. The Ranger plugin configuration (`ranger-starrocks-security.xml`, `ranger-starrocks-audit.xml`) is mounted into the front end. |
 | `keycloak` | `quay.io/keycloak/keycloak:26.0` | 8081 | The development identity provider, started with `start-dev --import-realm`. The `egret` realm is imported from `deploy/keycloak/egret-realm.json`. The Keycloak administrator is `admin` / `admin`. |
 | `frontend` | built from `frontend/` (nginx) | 5173 | The production build of the web app, for static smoke tests only. The backend is not containerized in this file, so `/api` does not resolve from it. Use `npm run dev` in `frontend/` for development. |