Merge #155653 #155657 #155664 #155792

155653: roachtest: run INSPECT as background job and poll for completion r=spilchen a=spilchen

Long-running INSPECT statements (e.g., >3h) have previously failed due to connection resets, despite no server crash. This likely stems from a missed keep-alive or a client timeout, though the exact cause is unclear.

This change updates the roachtest to:
- Run the INSPECT statement as a background job using a short statement_timeout (5s).
- Poll the job table for job completion instead of waiting synchronously.
- Report progress at 10% intervals to improve visibility without overwhelming the logs.

Fixes #155610

Release note: none

Epic: none

155657: sql: admins now have full access to all external connections r=rafiss a=kev-cao

Previously, if a non-admin user were to create an external connection, that connection would not show up in the output of `SHOW EXTERNAL CONNECTIONS` that was run by an admin.

This patch fixes this bug so that admins can now see/use all external connections.

Fixes: #146773

Release note: Admin users now have full access to all external connections.

155664: Update diagram for ALTER EXTERNAL CONNECTION r=kev-cao a=peachdawnleach

docgen: update ALTER EXTERNAL CONNECTION diagram
Epic: none
Release note: none
Release justification: non-production code change

Part of [DOC-13254](https://cockroachlabs.atlassian.net/browse/DOC-13254)

New diagram:
<img width="1023" height="283" alt="Screenshot 2025-10-17 at 7 24 43 PM" src="https://github.com/user-attachments/assets/21975cb9-e9ef-4162-8782-7249436bad05" />


155792: sql: increase timeout in TestIndexBackfillerResumePreservesProgress r=rafiss a=rafiss

This increases all three timeouts in the test from 5 seconds to 30 seconds

Resolves: #155646

Release note: None

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Matt Spilchen <[email protected]>
Co-authored-by: Kevin Cao <[email protected]>
Co-authored-by: Peach Leach <[email protected]>
Co-authored-by: Rafi Shamim <[email protected]>

Author: 5 people

docs/generated/sql/bnf/BUILD.bazel

@@ -25,7 +25,7 @@ FILES = [
     "alter_database_to_schema_stmt",
     "alter_ddl_stmt",
     "alter_default_privileges_stmt",
-    "alter_external_connection_stmt",
+    "alter_external_connection",
     "alter_func_stmt",
     "alter_func_options_stmt",
     "alter_func_rename_stmt",

docs/generated/sql/bnf/alter_external_connection.bnf

@@ -0,0 +1,3 @@
+alter_external_connection_stmt ::=
+	'ALTER' 'EXTERNAL' 'CONNECTION' connection_name 'AS' connection_uri
+	| 'ALTER' 'EXTERNAL' 'CONNECTION' 'IF' 'EXISTS' connection_name 'AS' connection_uri

docs/generated/sql/bnf/alter_external_connection_stmt.bnf

@@ -415,6 +415,12 @@ var specs = []stmtSpec{
 		inline:  []string{"opt_for_roles", "role_or_group_or_user", "name_list", "opt_in_schemas", "schema_name_list", "abbreviated_grant_stmt", "opt_with_grant_option", "target_object_type", "abbreviated_revoke_stmt", "opt_drop_behavior"},
 		nosplit: true,
 	},
+	{
+		name:    "alter_external_connection",
+		stmt:    "alter_external_connection_stmt",
+		replace: map[string]string{"label_spec": "connection_name", "string_or_placeholder": "connection_uri"},
+		unlink:  []string{"connection_name", "connection_uri"},
+	},
 	{
 		name:    "alter_index",
 		stmt:    "alter_index_stmt",

pkg/cmd/docgen/diagrams.go

@@ -21,11 +21,13 @@ import (
 	"github.com/cockroachdb/cockroach/pkg/cmd/roachtest/roachtestutil"
 	"github.com/cockroachdb/cockroach/pkg/cmd/roachtest/spec"
 	"github.com/cockroachdb/cockroach/pkg/cmd/roachtest/test"
+	"github.com/cockroachdb/cockroach/pkg/jobs"
 	"github.com/cockroachdb/cockroach/pkg/roachprod/install"
 	"github.com/cockroachdb/cockroach/pkg/util/timeutil"
 	"github.com/cockroachdb/cockroach/pkg/workload/histogram"
 	"github.com/cockroachdb/cockroach/pkg/workload/histogram/exporter"
 	"github.com/lib/pq"
+	"github.com/stretchr/testify/require"
 )
 
 func registerInspectThoughput(r registry.Registry) {
@@ -34,7 +36,7 @@ func registerInspectThoughput(r registry.Registry) {
 
 	// Long run: 12 nodes × 8 CPUs, 1B rows, 2 index checks (runs INSPECT twice: 1 index, then 2 indexes), ~5 hours (in v25.4)
 	const indexesForLongRun = 2
-	r.Add(makeInspectThroughputTest(r, 12, 8, 1_000_000_000, 8*time.Hour, indexesForLongRun))
+	r.Add(makeInspectThroughputTest(r, 12, 8, 1_000_000_000, 11*time.Hour, indexesForLongRun))
 }
 
 // initInspectHistograms creates a histogram registry with multiple named metrics.
@@ -226,9 +228,7 @@ func makeInspectThroughputTest(
 				before := timeutil.Now()
 
 				inspectSQL := fmt.Sprintf("INSPECT TABLE bulkingest.bulkingest WITH OPTIONS INDEX (%s)", cfg.indexListSQL)
-				if _, err := db.Exec(inspectSQL); err != nil {
-					t.Fatal(err)
-				}
+				jobID := runInspectInBackground(ctx, t, db, inspectSQL)
 
 				// Tick after INSPECT completes to capture elapsed time for this specific metric.
 				tickHistogram(cfg.metricName)
@@ -250,15 +250,9 @@ func makeInspectThroughputTest(
 						0
 					)
 					FROM system.job_info
-					WHERE job_id = (
-						SELECT job_id
-						FROM [SHOW JOBS]
-						WHERE job_type = 'INSPECT'
-						ORDER BY created DESC
-						LIMIT 1
-					)
+					WHERE job_id = $1
 					AND info_key = 'legacy_progress'`
-				err := db.QueryRow(querySQL).Scan(&jobTotalCheckCount)
+				err := db.QueryRow(querySQL, jobID).Scan(&jobTotalCheckCount)
 				if err != nil {
 					t.L().Printf("Warning: failed to query job total check count: %v", err)
 				} else {
@@ -302,3 +296,79 @@ func disableRowCountValidation(t test.Test, db *gosql.DB) {
 		}
 	}
 }
+
+// runInspectInBackground runs an INSPECT command with a short statement timeout,
+// forcing it to run as a background job. It then polls the job until completion,
+// reporting progress at 10% intervals. Returns the job ID.
+func runInspectInBackground(
+	ctx context.Context, t test.Test, db *gosql.DB, inspectSQL string,
+) (jobID int64) {
+	// Set a short statement timeout to force INSPECT to run as a background job.
+	_, err := db.Exec("SET statement_timeout = '5s'")
+	require.NoError(t, err)
+
+	// Reset statement timeout after we're done.
+	defer func() {
+		_, resetErr := db.Exec("RESET statement_timeout")
+		require.NoError(t, resetErr)
+	}()
+
+	_, err = db.Exec(inspectSQL)
+
+	// This may fail if the INSPECT took longer than the statement_timeout to run.
+	// So, we tolerate only statement timeout errors here.
+	if err != nil {
+		require.ErrorContains(t, err, "statement timeout")
+	}
+
+	// Get the INSPECT job ID.
+	getJobIDSQL := `
+		SELECT job_id
+		FROM [SHOW JOBS]
+		WHERE job_type = 'INSPECT'
+		ORDER BY created DESC
+		LIMIT 1`
+	if err := db.QueryRow(getJobIDSQL).Scan(&jobID); err != nil {
+		t.Fatalf("failed to get INSPECT job ID: %v", err)
+	}
+	t.L().Printf("INSPECT job ID: %d", jobID)
+
+	// Poll the job until it completes, reporting progress at 10% intervals.
+	const pollInterval = 5 * time.Second
+	lastReportedThreshold := -1
+	ticker := time.NewTicker(pollInterval)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ctx.Done():
+			t.Fatalf("context canceled while waiting for INSPECT job %d", jobID)
+		case <-ticker.C:
+			var status jobs.State
+			var fractionCompleted float64
+			checkJobSQL := `
+				SELECT status, fraction_completed
+				FROM [SHOW JOBS]
+				WHERE job_id = $1`
+			if err := db.QueryRow(checkJobSQL, jobID).Scan(&status, &fractionCompleted); err != nil {
+				t.Fatalf("failed to query job %d status: %v", jobID, err)
+			}
+
+			// Report progress at 10% thresholds (0%, 10%, 20%, ..., 90%).
+			currentThreshold := int(fractionCompleted * 10)
+			if currentThreshold > lastReportedThreshold && currentThreshold < 10 {
+				t.L().Printf("INSPECT job %d: %d%% complete", jobID, currentThreshold*10)
+				lastReportedThreshold = currentThreshold
+			}
+
+			// Check if job is complete.
+			switch status {
+			case jobs.StateSucceeded:
+				t.L().Printf("INSPECT job %d: 100%% complete (succeeded)", jobID)
+				return jobID
+			case jobs.StateFailed, jobs.StateCanceled:
+				t.Fatalf("INSPECT job %d finished with status: %s", jobID, status)
+			}
+		}
+	}
+}

pkg/cmd/roachtest/tests/inspect_throughput.go

@@ -25,7 +25,7 @@ BNF_SRCS = [
     "//docs/generated/sql/bnf:alter_database_to_schema_stmt.bnf",
     "//docs/generated/sql/bnf:alter_ddl_stmt.bnf",
     "//docs/generated/sql/bnf:alter_default_privileges_stmt.bnf",
-    "//docs/generated/sql/bnf:alter_external_connection_stmt.bnf",
+    "//docs/generated/sql/bnf:alter_external_connection.bnf",
     "//docs/generated/sql/bnf:alter_func_dep_extension_stmt.bnf",
     "//docs/generated/sql/bnf:alter_func_options_stmt.bnf",
     "//docs/generated/sql/bnf:alter_func_owner_stmt.bnf",

pkg/gen/bnf.bzl

@@ -35,7 +35,7 @@ DOCS_SRCS = [
     "//docs/generated/sql/bnf:alter_database_to_schema_stmt.bnf",
     "//docs/generated/sql/bnf:alter_ddl_stmt.bnf",
     "//docs/generated/sql/bnf:alter_default_privileges_stmt.bnf",
-    "//docs/generated/sql/bnf:alter_external_connection_stmt.bnf",
+    "//docs/generated/sql/bnf:alter_external_connection.bnf",
     "//docs/generated/sql/bnf:alter_func_dep_extension_stmt.bnf",
     "//docs/generated/sql/bnf:alter_func_options_stmt.bnf",
     "//docs/generated/sql/bnf:alter_func_owner_stmt.bnf",

pkg/gen/docs.bzl

@@ -743,6 +743,7 @@ go_test(
         "show_cluster_setting_test.go",
         "show_create_all_tables_builtin_test.go",
         "show_create_table_test.go",
+        "show_external_connection_test.go",
         "show_fingerprints_test.go",
         "show_ranges_test.go",
         "show_stats_test.go",

pkg/sql/BUILD.bazel

@@ -668,7 +668,7 @@ func TestIndexBackfillerResumePreservesProgress(t *testing.T) {
 			return err
 		}
 		return nil
-	}, 5*time.Second)
+	}, 30*time.Second)
 
 	ensureJobState := func(targetState string) {
 		testutils.SucceedsWithin(t, func() error {
@@ -682,7 +682,7 @@ func TestIndexBackfillerResumePreservesProgress(t *testing.T) {
 					targetState, jobState)
 			}
 			return nil
-		}, 5*time.Second)
+		}, 30*time.Second)
 	}
 
 	var completedSpans roachpb.SpanGroup
@@ -738,7 +738,7 @@ func TestIndexBackfillerResumePreservesProgress(t *testing.T) {
 			}
 
 			return nil
-		}, 5*time.Second)
+		}, 30*time.Second)
 	}
 
 	for isBlockingBackfillProgress.Load() {

pkg/sql/indexbackfiller_test.go

@@ -0,0 +1,56 @@
+// Copyright 2025 The Cockroach Authors.
+//
+// Use of this software is governed by the CockroachDB Software License
+// included in the /LICENSE file.
+
+package sql
+
+import (
+	"context"
+	"testing"
+
+	"github.com/cockroachdb/cockroach/pkg/base"
+	"github.com/cockroachdb/cockroach/pkg/testutils/serverutils"
+	"github.com/cockroachdb/cockroach/pkg/testutils/sqlutils"
+	"github.com/cockroachdb/cockroach/pkg/util/leaktest"
+	"github.com/cockroachdb/cockroach/pkg/util/log"
+	"github.com/stretchr/testify/require"
+)
+
+func TestAdminShowExternalConnection(t *testing.T) {
+	defer leaktest.AfterTest(t)()
+	defer log.Scope(t).Close(t)
+
+	ctx := context.Background()
+
+	s, db, _ := serverutils.StartServer(t, base.TestServerArgs{})
+	defer s.Stopper().Stop(ctx)
+	srv := s.ApplicationLayer()
+
+	adminDB := sqlutils.MakeSQLRunner(db)
+	const password = "correcthorsebatterystaple"
+	adminDB.Exec(t, "CREATE USER testuser1 WITH PASSWORD $1", password)
+	adminDB.Exec(t, "GRANT SYSTEM EXTERNALCONNECTION TO testuser1")
+
+	nonAdminDB := sqlutils.MakeSQLRunner(srv.SQLConn(
+		t, serverutils.UserPassword("testuser1", password), serverutils.ClientCerts(false),
+	))
+	nonAdminDB.Exec(t, "CREATE EXTERNAL CONNECTION foo AS 'userfile:///'")
+
+	t.Run("non-admin user cannot see other external connections", func(t *testing.T) {
+		_, err := db.Exec("CREATE USER testuser2 WITH PASSWORD $1", password)
+		require.NoError(t, err)
+
+		nonAdminDB2 := sqlutils.MakeSQLRunner(srv.SQLConn(
+			t, serverutils.UserPassword("testuser2", password), serverutils.ClientCerts(false),
+		))
+
+		rows := nonAdminDB2.QueryStr(t, "SHOW EXTERNAL CONNECTIONS")
+		require.Empty(t, rows, "expected no rows for non-admin user without privileges")
+	})
+
+	t.Run("admin user can see all external connections", func(t *testing.T) {
+		rows := adminDB.QueryStr(t, "SHOW EXTERNAL CONNECTIONS")
+		require.Len(t, rows, 1, "expected one row for admin user")
+	})
+}