NOJIRA-Storage-manager-graceful-signing-degradation - #1149
Merged
pchero merged 3 commits intoJul 30, 2026
Conversation
- bin-storage-manager: Make a missing GOOGLE_APPLICATION_CREDENTIALS non-fatal; NewFileHandler returns a working handler with no signing key instead of killing the service at boot - bin-storage-manager: Keep a configured-but-unreadable/unparsable credential path fatal, so misconfiguration stays loud - bin-storage-manager: Fall back to an unauthenticated storage client only on a keyless deployment, since the same env var is the client's ADC source - bin-storage-manager: Return a structured VoipbinError (UNAVAILABLE / SIGNING_NOT_CONFIGURED) from the signed-URL guard, so callers get a typed 503 instead of an opaque 500 - bin-storage-manager: Treat an empty private key or access id as not configured, not as a signer error - bin-storage-manager: Let file Create tolerate any download-URI failure, persisting an empty URIDownload and NULL TMDownloadExpire instead of failing and orphaning the moved GCS object - bin-storage-manager: Log the not-configured case as a warning and other signing failures as errors across Create, DownloadURIGet and DownloadURIRefresh - bin-storage-manager: Add signing_available gauge and download_uri_failure_total counter so the degraded mode is alertable - bin-storage-manager: Add tests for the keyless constructor, the unauthenticated client fallback, the structured guard error and both Create download-URI outcomes - bin-storage-manager: Update CLAUDE.md, docs/architecture.md, docs/dependencies.md and docs/operations.md for the new degradation behavior - bin-api-manager: Document the SIGNING_NOT_CONFIGURED storage reason in the RST error reference and rebuild the docs
- bin-timeline-manager: Fix migration 000004 failing on every fresh ClickHouse install - a semicolon inside a comment line made golang-migrate's naive x-multi-statement splitting produce a comment-only statement chunk, which ClickHouse rejects with "code: 62, Empty query", crash-looping the service at boot. Reworded the comment and added a warning note. Verified against a fresh ClickHouse 24.8: migrations now complete to version 6, dirty=false
- bin-timeline-manager: Document the one-time recovery for ClickHouse instances left at dirty=1 version=4 by the pre-fix migration 000004 (append-only TinyLog schema_migrations - recovery is an INSERT of a clean version-3 row, verified against golang-migrate v4.19.1's driver source)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Make bin-storage-manager degrade gracefully instead of crash-looping when no usable GCS signing credential is configured, mirroring the transcribe-manager STT fix pattern. Found while bringing the self-hosted sandbox to full service parity (sandbox repo: docs/plans/2026-07-31-sandbox-full-service-parity-design.md, section 2.6): commit 1f90029 made a missing GOOGLE_APPLICATION_CREDENTIALS fatal at boot, killing the whole service for what is genuinely only a signing-capability gap.