Antalya 25.8.16: Add guard for local data lakes

[zvonand]

Changelog category (leave one):

• Critical Bug Fix (crash, data loss, RBAC) or LOGICAL_ERROR

Changelog entry (a user-readable short description of the changes that goes to CHANGELOG.md):

Add setting allow_local_data_lakes, turned off by default.

CI/CD Options

Exclude tests:

• Fast test
• Integration Tests
• Stateless tests
• Stateful tests
• Performance tests
• All with ASAN
• All with TSAN
• All with MSAN
• All with UBSAN
• All with Coverage
• All with Aarch64
• All Regression
• Disable CI Cache

Regression jobs to run:

• Fast suites (mostly <1h)
• Aggregate Functions (2h)
• Alter (1.5h)
• Benchmark (30m)
• ClickHouse Keeper (1h)
• Iceberg (2h)
• LDAP (1h)
• Parquet (1.5h)
• RBAC (1.5h)
• SSL Server (1h)
• S3 (2h)
• Tiered Storage (2h)

[github-actions]

Workflow [PR], commit [b649fb6]

[alsugiliazova]

PR #1531 Audit: allow_local_data_lakes Guard

Confirmed Defects

No confirmed defects in reviewed scope.

• The new setting is wired consistently and defaults to secure, fail-closed behavior.
• All implemented local datalake engines and the icebergLocal table function are properly gated by allow_local_data_lakes.
• No concurrency, memory-safety, or partial-update regressions were identified in the added code paths.

[alsugiliazova]

PR #1531 CI Verification Report

CI Results

Analyzed commit: a1c65e77e261b600ac1903f4eb0c8aee11f42ea0 (merge commit)

MasterCI: 86 success, 2 failures, 3 skipped (91 total)

#	Suite	Failing Test	Error	Related to PR	Flakiness (90d)
1	Stateless (amd_debug, AsyncInsert, s3, parallel)	03322_materialized_view_ignore_errors_url	Result differs with reference	No	7 fails / 5 days
2	Stress test (amd_msan)	Cannot start clickhouse-server	test_tiered_watermark table load failure	No	151 fails / 34 days

Both failures are known flaky tests unrelated to the allow_local_data_lakes setting changes.

Check-runs Failures

Check	Status	Related	Pre-existing on Parent
GrypeScanServer (-alpine) / Grype Scan	Fail	No	—
Stress test (amd_msan)	Fail	No	Yes (parent 120dd785 also had stress test failures)
RegressionTestsRelease / Common (swarms)	Fail	No	Yes (parent had swarms Aarch64 failure)

Parent Commit Comparison (120dd785)

Parent had 7 failures including ClickBench, 3 stress tests, 2 regression tests, and LDAP auth — all pre-existing issues on the branch.

PR's Own Integration Tests

All integration tests modified by the PR PASSED across all shards (amd_binary 1-5):

• test_storage_iceberg — 150+ tests across s3/azure/local variants — all OK
• test_storage_delta — 40+ tests — all OK
• test_storage_iceberg_schema_evolution — 80+ tests — all OK
• test_database_iceberg — all OK (including test_cluster_select, test_cluster_joins, test_backup_database)
• test_database_iceberg_nessie_catalog — all OK
• test_database_iceberg_lakekeeper_catalog — all OK

Regression Tests (clickhouse-regression)

129 success, 1 failure (130 total)

Dedicated clickhouse-regression Test

The clickhouse-regression repository contains a dedicated icebergLocal test at iceberg/tests/icebergS3_table_function/iceberg_local.py that tests the icebergLocal() table function including path traversal protection. This test passed.

Conclusion

PR #1531 is verified.