*: Column masking all fixes

[tiancaiamao]

What problem does this PR solve?

Issue Number: close #67042 #67043 #67044 #67045 #67046

Address comment for #66799

Problem Summary:

What changed and how does it work?

Check List

Tests

• Unit test
• Integration test
• Manual test (add detailed scripts or steps below)
• No need to test

  • I checked and no code files have been changed.

Side effects

• Performance regression: Consumes more CPU
• Performance regression: Consumes more Memory
• Breaking backward compatibility

Documentation

• Affects user behaviors
• Contains syntax changes
• Contains variable changes
• Contains experimental features
• Changes MySQL compatibility

Release note

Please refer to Release Notes Language Style Guide to write a quality release note.

None

Summary by CodeRabbit

• New Features

  • Column-level data masking: CREATE/ALTER/DROP MASKING POLICY, AT RESULT masking, SHOW MASKING POLICIES, and masking annotations in SHOW CREATE TABLE

• New Functions

  • Builtins: MASK_FULL, MASK_PARTIAL, MASK_NULL, MASK_DATE

• New Privileges

  • CREATE MASKING POLICY, ALTER MASKING POLICY, DROP MASKING POLICY

• Tooling & Documentation

  • Validation workflow, artifacts/report templates, report generator, orchestration script, and scenario matrices/test plan

• Tests

  • Extensive unit and integration suites for masking semantics, restrictions, persistence, and privileges

• User-facing errors

  • New messages for policy existence and access-denied to masked columns

[lybcodes]

/test pull-unit-test-ddlv1

[tiprow]

@lybcodes: PRs from untrusted users cannot be marked as trusted with /ok-to-test in this repo meaning untrusted PR authors can never trigger tests themselves. Collaborators can still trigger tests on the PR using /test.

Details

In response to this:

/test mysql-test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[tiprow]

@lybcodes: PRs from untrusted users cannot be marked as trusted with /ok-to-test in this repo meaning untrusted PR authors can never trigger tests themselves. Collaborators can still trigger tests on the PR using /test.

Details

In response to this:

/test pull-unit-test-ddlv1

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[tiancaiamao]

/test unit-test

[tiprow]

@tiancaiamao: PRs from untrusted users cannot be marked as trusted with /ok-to-test in this repo meaning untrusted PR authors can never trigger tests themselves. Collaborators can still trigger tests on the PR using /test.

Details

In response to this:

/test unit-test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[tiancaiamao]

/test mysql-test

[tiprow]

@tiancaiamao: PRs from untrusted users cannot be marked as trusted with /ok-to-test in this repo meaning untrusted PR authors can never trigger tests themselves. Collaborators can still trigger tests on the PR using /test.

Details

In response to this:

/test mysql-test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[ti-chi-bot]

[LGTM Timeline notifier]

Timeline:

• 2026-03-17 03:20:42.140729102 +0000 UTC m=+240769.228386629: ☑️ agreed by wjhuang2016.
• 2026-03-18 12:39:31.034644049 +0000 UTC m=+360698.122301587: ☑️ agreed by fzzf678.

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: fzzf678
Once this PR has been reviewed and has the lgtm label, please assign benmeadowcroft, d3hunter, hawkingrei, yujuncen, zanmato1984 for approval. For more information see the Code Review Process.
Please ensure that each of them provides their approval before proceeding.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS
• br/OWNERS
• pkg/ddl/OWNERS
• pkg/domain/OWNERS
• pkg/executor/importer/OWNERS
• pkg/expression/OWNERS
• pkg/infoschema/OWNERS
• pkg/meta/OWNERS
• pkg/parser/OWNERS
• pkg/planner/OWNERS
• pkg/session/OWNERS
• pkg/sessionctx/variable/OWNERS
• pkg/statistics/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[dillon-zheng]

/override idc-jenkins-ci-tidb/unit-test

[ti-chi-bot]

@dillon-zheng: dillon-zheng unauthorized: /override is restricted to Repo administrators, and the following github teams:pingcap/tidb: tidb-maintainers.

Details

In response to this:

/override idc-jenkins-ci-tidb/unit-test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[ti-chi-bot]

/override idc-jenkins-ci-tidb/unit-test

[ti-chi-bot]

@ti-chi-bot: Overrode contexts on behalf of ti-chi-bot: idc-jenkins-ci-tidb/unit-test

Details

In response to this:

/override idc-jenkins-ci-tidb/unit-test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[ti-chi-bot]

/override pull-br-integration-test

[ti-chi-bot]

@ti-chi-bot: Overrode contexts on behalf of ti-chi-bot: pull-br-integration-test

Details

In response to this:

/override pull-br-integration-test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[ti-chi-bot]

/override pull-unit-test-ddlv1

[ti-chi-bot]

@ti-chi-bot: Overrode contexts on behalf of ti-chi-bot: pull-unit-test-ddlv1

Details

In response to this:

/override pull-unit-test-ddlv1

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[ti-chi-bot]

/override pull-unit-test-ddlv1

[ti-chi-bot]

@ti-chi-bot: Overrode contexts on behalf of ti-chi-bot: pull-unit-test-ddlv1

Details

In response to this:

/override pull-unit-test-ddlv1

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.