opendatahub-io
diff --git a/‎packages/automl/bff/internal/api/s3_handler.go‎
Lines changed: 80 additions & 5 deletions b/‎packages/automl/bff/internal/api/s3_handler.go‎
Lines changed: 80 additions & 5 deletions
@@ -7,11 +7,13 @@ import (
 	"io"
 	"mime"
 	"mime/multipart"
+	"net"
 	"net/http"
 	"path"
 	"regexp"
 	"strconv"
 	"strings"
+	"time"
 
 	"github.com/aws/aws-sdk-go-v2/service/s3/types"
 	"github.com/julienschmidt/httprouter"
@@ -24,6 +26,15 @@ import (
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 )
 
+// s3MetadataTimeout is the deadline for read-only S3 metadata operations
+// (ListObjects, HeadObject, GetCSVSchema, etc.) that should complete quickly.
+// This bounds the response-header phase: if the endpoint accepts the TCP
+// connection but never sends response headers, r.Context() alone won't cancel
+// the call because net/http's WriteTimeout sets a conn deadline, not a context
+// cancellation. File transfers (GetObject, UploadObject) are excluded because
+// legitimate large payloads can exceed any static timeout.
+const s3MetadataTimeout = 15 * time.Second
+
 // resolvedS3 holds a ready-to-use S3 client and the resolved bucket name.
 type resolvedS3 struct {
 	client s3int.S3ClientInterface
@@ -170,6 +181,42 @@ func (app *App) resolveS3Client(w http.ResponseWriter, r *http.Request, secretNa
 	return &resolvedS3{client: s3Client, bucket: bucket}, true
 }
 
+// isS3ConnectivityError checks whether an error is caused by a network-level
+// failure to reach the S3 endpoint (e.g. connection timeout, DNS failure,
+// connection refused, or a metadata timeout deadline). This lets handlers
+// return an actionable 503 instead of a generic 500 when the endpoint is
+// unreachable — common in air-gapped or misconfigured environments.
+func isS3ConnectivityError(err error) bool {
+	if errors.Is(err, context.DeadlineExceeded) {
+		return true
+	}
+	if errors.Is(err, net.ErrClosed) {
+		return true
+	}
+	var netErr net.Error
+	if errors.As(err, &netErr) && netErr.Timeout() {
+		return true
+	}
+	var opErr *net.OpError
+	if errors.As(err, &opErr) && opErr.Op == "dial" {
+		return true
+	}
+	var dnsErr *net.DNSError
+	return errors.As(err, &dnsErr)
+}
+
+// s3ConnectivityErrorMessage returns a user-facing message for S3 connectivity failures.
+func s3ConnectivityErrorMessage(bucket string) string {
+	return fmt.Sprintf(
+		"Unable to connect to the S3 storage endpoint for bucket '%s'. "+
+			"The endpoint may be unreachable from this cluster. "+
+			"If this is a disconnected or air-gapped environment, "+
+			"verify the S3 endpoint URL in the data connection secret "+
+			"points to a storage service accessible within the cluster network.",
+		bucket,
+	)
+}
+
 // GetS3FileHandler retrieves a file from S3 storage.
 // Query parameters:
 //   - secretName (optional): Kubernetes secret with S3 credentials.
@@ -218,6 +265,11 @@ func (app *App) GetS3FileHandler(w http.ResponseWriter, r *http.Request, _ httpr
 			return
 		}
 
+		if isS3ConnectivityError(err) {
+			app.serviceUnavailableResponseWithMessage(w, r, err, s3ConnectivityErrorMessage(s3.bucket))
+			return
+		}
+
 		app.serverErrorResponse(w, r, err)
 		return
 	}
@@ -279,16 +331,21 @@ func (app *App) PostS3FileHandler(w http.ResponseWriter, r *http.Request, _ http
 		return
 	}
 
-	ctx := r.Context()
 	bucket := s3.bucket
-	resolvedKey, err := resolveNonCollidingS3Key(ctx, s3.client, bucket, key, app.effectivePostS3CollisionAttempts())
+	metadataCtx, metadataCancel := context.WithTimeout(r.Context(), s3MetadataTimeout)
+	defer metadataCancel()
+	resolvedKey, err := resolveNonCollidingS3Key(metadataCtx, s3.client, bucket, key, app.effectivePostS3CollisionAttempts())
 	if err != nil {
 		if errors.Is(err, ErrMaxCollisionsExceeded) {
 			app.conflictResponse(w, r,
 				fmt.Sprintf("unable to find unique filename after %d attempts; try a different base name",
 					app.effectivePostS3CollisionAttempts()))
 			return
 		}
+		if isS3ConnectivityError(err) {
+			app.serviceUnavailableResponseWithMessage(w, r, err, s3ConnectivityErrorMessage(bucket))
+			return
+		}
 		app.serverErrorResponse(w, r, fmt.Errorf("error resolving S3 key for upload: %w", err))
 		return
 	}
@@ -356,7 +413,7 @@ func (app *App) PostS3FileHandler(w http.ResponseWriter, r *http.Request, _ http
 	}
 	limitedFile := http.MaxBytesReader(nil, filePart, maxFilePartBytes)
 	defer limitedFile.Close()
-	if err := s3.client.UploadObject(ctx, bucket, resolvedKey, limitedFile, contentType); err != nil {
+	if err := s3.client.UploadObject(r.Context(), bucket, resolvedKey, limitedFile, contentType); err != nil {
 		var maxBytesErr *http.MaxBytesError
 		if errors.As(err, &maxBytesErr) {
 			app.payloadTooLargeResponse(w, r, s3FilePartTooLargeMsg)
@@ -371,6 +428,10 @@ func (app *App) PostS3FileHandler(w http.ResponseWriter, r *http.Request, _ http
 			app.forbiddenResponse(w, r, fmt.Sprintf("access denied uploading to S3 '%s/%s'", bucket, resolvedKey))
 			return
 		}
+		if isS3ConnectivityError(err) {
+			app.serviceUnavailableResponseWithMessage(w, r, err, s3ConnectivityErrorMessage(bucket))
+			return
+		}
 		app.serverErrorResponse(w, r, fmt.Errorf("error uploading file to S3: %w", err))
 		return
 	}
@@ -560,7 +621,9 @@ func (app *App) GetS3FileSchemaHandler(w http.ResponseWriter, r *http.Request, _
 		return
 	}
 
-	ctx := r.Context()
+	ctx, cancel := context.WithTimeout(r.Context(), s3MetadataTimeout)
+	defer cancel()
+
 	schemaResult, err := s3.client.GetCSVSchema(ctx, s3.bucket, key)
 	if err != nil {
 		var noSuchKey *types.NoSuchKey
@@ -595,6 +658,11 @@ func (app *App) GetS3FileSchemaHandler(w http.ResponseWriter, r *http.Request, _
 			return
 		}
 
+		if isS3ConnectivityError(err) {
+			app.serviceUnavailableResponseWithMessage(w, r, err, s3ConnectivityErrorMessage(s3.bucket))
+			return
+		}
+
 		app.serverErrorResponse(w, r, err)
 		return
 	}
@@ -637,7 +705,9 @@ func (app *App) GetS3FilesHandler(w http.ResponseWriter, r *http.Request, _ http
 		return
 	}
 
-	ctx := r.Context()
+	ctx, cancel := context.WithTimeout(r.Context(), s3MetadataTimeout)
+	defer cancel()
+
 	result, err := s3.client.ListObjects(ctx, s3.bucket, s3int.ListObjectsOptions{
 		Path:   params.path,
 		Search: params.search,
@@ -657,6 +727,11 @@ func (app *App) GetS3FilesHandler(w http.ResponseWriter, r *http.Request, _ http
 			return
 		}
 
+		if isS3ConnectivityError(err) {
+			app.serviceUnavailableResponseWithMessage(w, r, err, s3ConnectivityErrorMessage(s3.bucket))
+			return
+		}
+
 		app.serverErrorResponse(w, r, err)
 		return
 	}