@Rocky I want to query some configuration values in my prometheus exporter, so that I can monitor some of these. I don't want to grant the OPERATE role to my read-only user though. Is it possible to grant access to a user so that he can issue "ADMIN SHOW FRONTEND CONFIG LIKE 'xxx'" without the whole OPERATE role?

References • sql-reference/information_schema/be_configs.md • administration/management/FE_configuration.md

@Rocky can you expand a little? I want to query some configuration values in my prometheus exporter, so that I can monitor some of these. I don't want to grant the OPERATE role to my read-only user though. Is it possible to grant access to a user so that he can issue "ADMIN SHOW FRONTEND CONFIG LIKE 'xxx'" without the whole OPERATE role?

Currently, it is not possible to grant access to the

ADMIN SHOW FRONTEND CONFIG

command without granting the

OPERATE

privilege at the

SYSTEM

level. In StarRocks' role-based access control (RBAC), this privilege is intentionally broad, covering both the viewing and modification of cluster-wide configurations, as well as replica management. Here is a breakdown of the requirements and available alternatives: 1. Privilege Requirement The command

ADMIN SHOW FRONTEND CONFIG

explicitly requires the

OPERATE

privilege. * Command:

ADMIN SHOW FRONTEND CONFIG [LIKE 'xxx']

* Required Privilege:

SYSTEM

level

OPERATE

. * Scope: There is no granular "read-only configuration" privilege that separates the

SHOW

and

SET

capabilities for FE configurations. 2. Alternative for BE Configurations If you also need to monitor BE configurations, you can use a more standard SQL approach that does not require the

OPERATE

role. StarRocks provides a system view in the `information_schema`:

sql
SELECT * FROM information_schema.be_configs;

This view allows you to query the configuration of all BE nodes using standard

SELECT

privileges. 3. Alternative for Monitoring (FE Metrics) If the values you are looking for are common operational parameters (like memory limits, thread counts, or connection limits), they may already be exported as metrics. * SQL View:

SELECT * FROM information_schema.fe_metrics;

* Prometheus Endpoint: You can scrape

http://<FE_IP>:8030/metrics

directly. This endpoint typically does not require high-level administrative database roles and is the standard way to feed data into a Prometheus exporter. 4. Recommendation for Prometheus Exporter Since you want to avoid granting high-level privileges to a read-only user: * Use the Metrics Endpoint: Check if the configuration values you need are available at the

/metrics

HTTP endpoint. * Sidecar/Script Approach: If you must have specific

fe.conf

values that are not in metrics, consider having your monitoring agent read the

fe.conf

file directly from the filesystem (if it's a local agent) rather than querying it through the SQL interface. * Request Feature: If your use case strictly requires SQL-based read-only access to FE configs, this currently requires the

OPERATE

role. You may want to suggest a more granular privilege or an

information_schema.fe_configs

view in the StarRocks community Slack or GitHub. References • administration/management/FE_configuration.md • sql-reference/sql-statements/cluster-management/config_vars/ADMIN_SHOW_CONFIG.md • sql-reference/information_schema/be_configs.md