[csuzhangxc]

Historical rule edits on the Prometheus PVC are restored automatically, including edits made before the API was authenticated. DM also leaves unrelated active rules behind on restart.

Install bundled rules on every current TiDB/DM initializer start and clear the dedicated active rules directory, including hidden leftovers. Skip persisted-rule restoration by default without deleting the PVC copy. Permit reviewed customizations only with PROM_RESTORE_RULES=true; reject unknown names, symlink rule files/directories, invalid options and copy failures. This is an explicit administrator trust decision, not a cryptographic provenance claim.

Compatibility: persisted custom rules no longer survive restart automatically. cmd/PERSISTED_RULES.md documents backup/review/promtool validation and the existing Operator spec.initializer.envs opt-in. Existing images and historical version snapshots are not rewritten. Rebuild and deploy the current initializer to obtain this protection.

Validation:

• The new actual-script regression suite fails on the old scripts and passes on the fix (36 TiDB/DM cases across all three current entrypoints).
• Default and trusted restore, unknown files, symlink files/directories, invalid options, removal of foreign active rules, and unchanged PVC data.
• Existing DM generation, missing-rule and datasource escaping regressions pass alongside the new suite with go test -race ./cmd/monitoring.go ./cmd/dm_rules_test.go ./cmd/persisted_rules_test.go.
• Added that explicit-file test command to existing CI because cmd contains multiple independent main programs.
• POSIX shell syntax, diff checks and independent review passed.

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign liubog2008 for approval. For more information see the Code Review Process.
Please ensure that each of them provides their approval before proceeding.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 5 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 979e28cc-4b69-47be-888b-3352e6cd971f

Commits

Reviewing files that changed from the base of the PR and between 06cb1b2 and e566bf3.

Files selected for processing: 6

• .github/workflows/build-security.yaml
• cmd/PERSISTED_RULES.md
• cmd/init.sh
• cmd/persisted_rules_test.go
• monitor-snapshot/master/operator/init.sh
• platform-monitoring/operator/init.sh

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[csuzhangxc]

Superseded by #1245. The replacement preserves automatic current-version rule restoration without a new opt-in, retains filesystem safety checks, and supports reloader privilege reduction with existing initializer images. Verified actual saves, Prometheus reload, persistence and Pod rebuilds.