# MaxCompute OIDC Transport Compatibility

## Background

Slow Log Explorer requests for the affected AliCloud Premium cluster reach
Clinic Data Service, initialize the MaxCompute project, and acquire or refresh
an Alibaba Cloud OIDC credential. Production logs show the request panics in
`credentials-go` before MaxCompute can execute the query:

```text
interface conversion: http.RoundTripper is *otelhttp.Transport, not *http.Transport
```

Clinic Data Service currently instruments outbound HTTP by replacing the
process-wide `http.DefaultTransport` with `*otelhttp.Transport`.
`github.com/aliyun/credentials-go` clones that global with an unchecked
`http.DefaultTransport.(*http.Transport)` assertion during OIDC acquisition or
refresh. The same assertion remains in the latest upstream release, and the SDK
exposes no public HTTP transport injection point.

## Goal

- Keep `http.DefaultTransport` as a concrete `*http.Transport`, allowing the
  Alibaba Cloud credential provider to clone it safely.
- Preserve OpenTelemetry propagation for Clinic-owned outbound HTTP clients
  that already carry caller context.
- Add a regression test that exercises the public Alibaba OIDC credential path
  against a local STS server after Clinic tracing is initialized.
- Avoid broad MaxCompute panic recovery that would hide the panic without
  restoring query functionality.

## Implementation

1. Instrument `http.DefaultClient.Transport` instead of replacing
   `http.DefaultTransport`.
2. Expose a tracing transport constructor for Clinic-owned clients that create
   private `http.Client` values.
3. Apply it only to Clinic-created production clients that already carry a
   caller context: the internal API client, O11y/BYOC/Top RU/metrics/Loki/TiDB
   management clients, Prometheus transport wrappers, and the AI adapter.
   Preserve each client's existing timeout, redirect, request-context, and
   authentication behavior; only relocate the tracing transport from the
   global default to the client-owned transport. Leave background-only legacy
   and offline clients unchanged to keep the hotfix surface narrow.
4. Add tracing tests that verify:
   - the default transport remains cloneable as `*http.Transport`;
   - OIDC credential acquisition succeeds against a local TLS STS endpoint;
   - the instrumented default client still injects Clinic's `X-Trace-ID`.
5. Add a Clinic internal API client test to ensure its private client preserves
   `X-Trace-ID` propagation after global transport mutation is removed.

## Scope and Deployment

- Go module: `github.com/pingcap-inc/clinic/clinic_data_service`
- Executable: `clinic_data_service/cmd/api`
- Runtime image: `clinic/data-service`
- Clinic CD component and app-delivery application: `clinic-data-service`
- No Clinic UI, public API schema, generated client, database migration, or
  app-delivery configuration change.

## Validation

- `go test ./pkg/tracing ./pkg/clinic-internal-api ./pkg/utils`
- `go test ./pkg/engine ./pkg/service ./pkg/handlers ./pkg/server`
- `go test -race` for tracing and the affected client/service packages.
- `go test ./...` from `clinic_data_service` when dependencies and runtime allow.

After separate authorization to publish and deploy, roll out
`clinic-data-service` to staging first, verify an AliCloud MaxCompute-backed
Slow Log Explorer query, and confirm that credential acquisition or refresh no
longer emits a Gin panic recovery event. Production rollout remains a separate
authorized release action.