Repository: pingcap/tidb
File: pkg/objstore/ossstore/store.go (Go)

Code before:

	logger := log.L().With(
		zap.String("bucket", qs.GetBucket()),
		zap.String("prefix", qs.GetPrefix()),
		zap.String("context", "oss"),
	)
	var ossOptFns []func(*oss.Options)
	if qs.ForcePathStyle {
		// in doc of ossutil and the SDK code, it states path-style addressing
		// is allowed, but in "Differences between OSS and S3", it states that
		// "For security reasons, OSS supports only the virtual-hosted style".
		// anyway, we don't support it now.
		logger.Warn("force-path-style is not supported on OSS")
	}

	ossCfg := oss.NewConfig().
		WithRetryer(newRetryer()).
		WithLogLevel(getOSSLogLevel()).
		WithLogPrinter(newLogPrinter(logger))

	// TODO OSS charges for traffic, consider auto use internal endpoint when
	// not specified explicitly and the bucket is in the same region with the
	// client.
	if len(qs.Endpoint) != 0 {
		ossCfg = ossCfg.WithEndpoint(qs.Endpoint)
	}
	var (
		ecsRegionID   string
		credRefresher *credentialRefresher
	)
	if qs.AccessKey != "" && qs.SecretAccessKey != "" {
		ossCfg = ossCfg.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(qs.AccessKey, qs.SecretAccessKey, qs.SessionToken))
	} else {
		var provider providers.CredentialsProvider = providers.NewDefaultCredentialsProvider()
		cred, err := provider.GetCredentials()
		if err != nil {
			return nil, errors.Annotatef(err, "failed to get credentials from default provider")
		}
		// the default provider concatenates the provider names with `/`, see
		// https://github.com/aliyun/credentials-go/blob/7d2a3e68402630904f518531e80b370b3649c6a1/credentials/providers/default.go#L101
		if strings.Contains(cred.ProviderName, ecsRAMRoleProviderName) {
			httpCli := &http.Client{}
			ecsRegionID, err = httputil.GetText(httpCli, regionIDMetaURL)
			if err != nil {
				return nil, errors.Annotatef(err, "failed to get region ID from ECS metadata service")
			}
		}
		if qs.RoleArn != "" {
			var err2 error
			provider, err2 = providers.NewRAMRoleARNCredentialsProviderBuilder().
				WithCredentialsProvider(provider).

Review comment (suggestion):
When a custom endpoint is explicitly provided via qs.Endpoint, the internal endpoint detection logic still runs and may call WithUseInternalEndpoint(true) later at line 188. This could potentially override or conflict with the explicit endpoint setting. Consider skipping the internal endpoint detection when an explicit endpoint is already configured.

Code after:

	logger := log.L().With(
		zap.String("bucket", qs.GetBucket()),
		zap.String("prefix", qs.GetPrefix()),
		zap.String("context", "oss"),
	)
	var ossOptFns []func(*oss.Options)
	if qs.ForcePathStyle {
		// in doc of ossutil and the SDK code, it states path-style addressing
		// is allowed, but in "Differences between OSS and S3", it states that
		// "For security reasons, OSS supports only the virtual-hosted style".
		// anyway, we don't support it now.
		logger.Warn("force-path-style is not supported on OSS")
	}

	ossCfg := oss.NewConfig().
		WithRetryer(newRetryer()).
		WithLogLevel(getOSSLogLevel()).
		WithLogPrinter(newLogPrinter(logger))

	// TODO OSS charges for traffic, consider auto use internal endpoint when
	// not specified explicitly and the bucket is in the same region with the
	// client.
	if len(qs.Endpoint) != 0 {
		ossCfg = ossCfg.WithEndpoint(qs.Endpoint)
	}
	var (
		ecsRegionID   string
		credRefresher *credentialRefresher
	)
	if qs.AccessKey != "" && qs.SecretAccessKey != "" {
		ossCfg = ossCfg.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(qs.AccessKey, qs.SecretAccessKey, qs.SessionToken))
	} else {
		var provider providers.CredentialsProvider = providers.NewDefaultCredentialsProvider()
		cred, err := provider.GetCredentials()
		if err != nil {
			return nil, errors.Annotatef(err, "failed to get credentials from default provider")
		}
		// the default provider concatenates the provider names with `/`, see
		// https://github.com/aliyun/credentials-go/blob/7d2a3e68402630904f518531e80b370b3649c6a1/credentials/providers/default.go#L101
		if strings.Contains(cred.ProviderName, ecsRAMRoleProviderName) {
			httpCli := httputil.NewClient(nil)
			ecsRegionID, err = httputil.GetText(httpCli, regionIDMetaURL)
			if err != nil {
				// shouldn't happen normally, we just successfully got ECS RAM
				// role credentials from the metadata service.
				return nil, errors.Annotatef(err, "failed to get region ID from ECS metadata service")
			}
		}
		if qs.RoleArn != "" {
			var err2 error