*: add document for column-level masking policy feature#22613
*: add document for column-level masking policy feature#22613tiancaiamao wants to merge 3 commits intomasterfrom
Conversation
… Grafana This commit addresses issue #21768 by adding a new section to document the default login credentials for TiDB Dashboard and Grafana when using TiUP playground. Changes: - Add 'Access TiDB Dashboard and Grafana' section - Document TiDB Dashboard default credentials (root, empty password) - Document Grafana default credentials (admin/admin) - Add note about using updated root password if changed
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
ti-chi-bot
bot
added
the
missing-translation-status
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request introduces comprehensive documentation for the new column-level masking policy feature in TiDB. This feature is designed to enhance data security and compliance by allowing sensitive data to be masked at the column level, with masking rules configurable based on user roles and privileges. The documentation covers the feature's functionality, management, and various masking options, ensuring users can effectively implement and manage data protection. Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
ti-chi-bot
bot
added
the
size/XXL
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces comprehensive documentation for TiDB's new Column-Level Masking Policy feature, including its overview, required privileges, syntax for creation and management, details on built-in masking functions (MASK_PARTIAL, MASK_FULL, MASK_NULL, MASK_DATE), conditional masking based on user/role, RESTRICT ON semantics, behavior considerations, and MySQL compatibility notes. The review comments suggest improvements to enhance the documentation's clarity, maintain an active voice, and ensure consistent markdown formatting.
|
|
||
| ## Overview | ||
|
|
||
| A masking policy is bound to a table column and evaluated at query result time. The policy uses SQL expressions to determine how to mask the data based on the current user's identity or role. |
There was a problem hiding this comment.
To improve clarity and adhere to the active voice principle, consider rephrasing this sentence to specify that TiDB performs the action.
Repository Style Guide Reference: line 43 (Passive voice overuse)
| A masking policy is bound to a table column and evaluated at query result time. The policy uses SQL expressions to determine how to mask the data based on the current user's identity or role. | |
| TiDB binds a masking policy to a table column and evaluates it at query result time. |
| ## Behavior considerations | ||
|
|
||
| ### At-result masking | ||
|
|
There was a problem hiding this comment.
To maintain an active voice throughout the documentation, specify that TiDB is the agent performing the action.
Repository Style Guide Reference: line 43 (Passive voice overuse)
| TiDB applies masking policies **at result time**, which means: |
| When you drop a column or table that has a masking policy, the policy is automatically removed from the system. When you rename a column or table, the masking policy remains bound to it. | ||
|
|
There was a problem hiding this comment.
To improve clarity and maintain an active voice, specify that TiDB performs these actions and clarify the target of the masking policy when renaming.
Repository Style Guide Reference: line 43 (Passive voice overuse)
| When you drop a column or table that has a masking policy, the policy is automatically removed from the system. When you rename a column or table, the masking policy remains bound to it. | |
| When you drop a column or table that has a masking policy, TiDB automatically removes the policy from the system. When you rename a column or table, the masking policy remains bound to the renamed column or table. |
| - **String** → Returns a string of the same length with all characters replaced by `'X'` | ||
| - **Date/DATETIME/TIMESTAMP** → Returns `1970-01-01` (preserving original type and fractional seconds precision) | ||
| - **Duration** → Returns `00:00:00` | ||
| - **YEAR** → Returns `1970` |
There was a problem hiding this comment.
For better readability and consistent markdown, please rephrase these lines to avoid the non-standard arrow symbol and use a colon instead.
Repository Style Guide Reference: line 34 (Code snippets, command names, options, and paths should be in backticks (`).)
| - **String** → Returns a string of the same length with all characters replaced by `'X'` | |
| - **Date/DATETIME/TIMESTAMP** → Returns `1970-01-01` (preserving original type and fractional seconds precision) | |
| - **Duration** → Returns `00:00:00` | |
| - **YEAR** → Returns `1970` | |
| - **String**: Returns a string of the same length with all characters replaced by `'X'` | |
| - **Date/DATETIME/TIMESTAMP**: Returns `1970-01-01` (preserving original type and fractional seconds precision) | |
| - **Duration**: Returns `00:00:00` | |
| - **YEAR**: Returns `1970` |
| - **Types**: DATE, DATETIME, TIMESTAMP | ||
| - **Placeholders**: The `date_literal` follows format `'YYYY-MM-DD'` where Y/M/D components can be preserved or fixed values for redaction | ||
| - **Time Component**: Hours, minutes, and seconds are reset to `00:00:00` |
There was a problem hiding this comment.
For improved sentence structure and clarity, consider rephrasing this description.
Repository Style Guide Reference: line 15 (Logical flow and sentence structure)
| - **Types**: DATE, DATETIME, TIMESTAMP | |
| - **Placeholders**: The `date_literal` follows format `'YYYY-MM-DD'` where Y/M/D components can be preserved or fixed values for redaction | |
| - **Time Component**: Hours, minutes, and seconds are reset to `00:00:00` | |
| - **Placeholders**: The `date_literal` follows the `'YYYY-MM-DD'` format. Y/M/D components can be preserved or fixed values for redaction | |
| - **Time Component**: Hours, minutes, and seconds are reset to `00:00:00` |
|
@tiancaiamao: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
First-time contributors' checklist
What is changed, added or deleted? (Required)
Which TiDB version(s) do your changes apply to? (Required)
Tips for choosing the affected version(s):
By default, CHOOSE MASTER ONLY so your changes will be applied to the next TiDB major or minor releases. If your PR involves a product feature behavior change or a compatibility change, CHOOSE THE AFFECTED RELEASE BRANCH(ES) AND MASTER.
For details, see tips for choosing the affected versions.
What is the related PR or file link(s)?
Do your changes match any of the following descriptions?