[feature](cloud) Add Alibaba Cloud OSS C++ SDK stack - Part 3

[nsivarajan]

What problem does this PR solve?

Issue Number: close #65793

Related PR: part 3 of 4 — PR-1 #61329 | PR-2 #65794 | PR-4 #xxx

Problem Summary:

Doris BE currently accesses OSS through the AWS S3-compatible SDK path. This works for basic AK/SK operations but cannot use ECS instance profile credentials, STS AssumeRole, RRSA, or environment variable providers — all of which require the native Alibaba Cloud OSS C++ SDK.

This PR implements the complete native OSS filesystem stack in BE, routed via a new enable_oss_native_sdk config flag (default false). The existing S3-compatible path is fully preserved and used when the flag is off.

Three routing paths all now emit "provider"="OSS" to BE:

Path	Source	FE class
Catalog / SPI	Thrift property map	OssFileSystemProperties.toBackendKv()
Storage Vault	ObjectStoreInfoPB	OSSConf::get_oss_conf()
S3 TVF / Resource	Thrift property map	OSSProperties.getBackendConfigProperties()

---

Changes

New shared headers (common/cpp/)

• oss_common.h — OSSCredProviderType enum, normalize_oss_endpoint()
• oss_credential_provider.h/cpp — ECSMetadataCredentialsProvider (metadata service, auto-refresh), OSSSTSCredentialProvider (STS AssumeRole, refresh 5 min before expiry), OSSDefaultCredentialsProvider (env → config → ECS chain)

New BE filesystem (be/src/io/fs/)

• oss_v2_obj_storage_client.h/cpp — OSSv2ObjStorageClient : ObjStorageClient; implements all object operations using native OSS SDK
• oss_file_system.h/cpp — OSSFileSystem : RemoteFileSystem; thread-safe client holder with shared_mutex; prefix normalised in create() factory before parent constructor; multipart copy for renames >1 GB
• oss_file_reader.h/cpp — range reads with exponential backoff + jitter on 429/SlowDown errors
• oss_file_writer.h/cpp — multipart upload with async close

New BE utility (be/src/util/)

• oss_util.h/cpp — OSSClientConf, OSSConf, OSSClientFactory singleton; get_oss_conf(ObjectStoreInfoPB) for storage vault path; SDK initialised once via std::call_once

Modified BE files (additive)

• be/src/io/fs/file_system.h — FileSystemType::OSS added to enum
• be/src/util/s3_util.cpp — _create_oss_client() under #ifdef USE_OSS;
  convert_properties_to_s3_conf() detects "provider"="OSS" → ObjStorageType::OSS;
  S3ClientFactory::create() routes to native OSS client when enable_oss_native_sdk=true
• be/src/common/config.h/cpp — enable_oss_native_sdk=false,
  max_oss_client_retry, oss_read_base_wait_time_ms, oss_read_max_wait_time_ms

Modified FE files (additive)

• OSSProperties.java — adds roleArn, externalId; getBackendConfigProperties() emits "provider"="OSS", AWS_ROLE_ARN, AWS_EXTERNAL_ID
• OssFileSystemProperties.java — toBackendKv() adds "provider"="OSS"

Tests

• be/test/util/s3_util_test.cpp — 3 tests under #ifdef USE_OSS: provider detection, case-insensitive "oss", missing provider defaults to AWS
• fe-core/OSSPropertiesTest.java — testBackendConfigIncludesProviderOss(), testBackendConfigForwardsRoleArnAndExternalId()

---

Design decisions

• Additive only — enable_oss_native_sdk=false by default; all existing S3-compatible OSS behaviour is unchanged when off
• Prefix normalisation before constructor — RemoteFileSystem parent reads the prefix in its constructor; normalisation must happen in OSSFileSystem::create() factory before new OSSFileSystem(...) is called
• Thread safety — OssClient is thread-safe; shared_mutex in OSSClientHolder guards client pointer replacement only, not each call
• Credential caching — all three custom providers cache credentials and refresh 5 minutes before expiry to avoid mid-request token expiry

Release note

[be] Add native Alibaba Cloud OSS filesystem (OSSFileSystem, OSSFileReader, OSSFileWriter) using the official OSS C++ SDK. Activated by enable_oss_native_sdk=true in be.conf (default false). Supports ECS instance profile, STS AssumeRole, RRSA, env vars, and static AK/SK. Existing S3-compatible OSS path unchanged when flag is off.

Check List (For Author)

• Test

  • Regression test
  • Unit Test
  • Manual test (add detailed scripts or steps below)
  • No need to test or manual test. Explain why:
    • This is a refactor/code format and no logic has been changed.
    • Previous test can cover this change.
    • No code files have been changed.
    • Other reason

• Behavior changed:

  • No.
  • Yes.

• Does this need documentation?

  • No.
  • Yes.

Check List (For Reviewer who merge this PR)

• Confirm the release note
• Confirm test cases
• Confirm document
• Add branch pick label

[hello-stephen]

Thank you for your contribution to Apache Doris.
Don't know what should be done next? See How to process your PR.

Please clearly describe your PR:

1. What problem was fixed (it's best to include specific error reporting information). How it was fixed.
2. Which behaviors were modified. What was the previous behavior, what is it now, why was it modified, and what possible impacts might there be.
3. What features were added. Why was this function added?
4. Which code was refactored and why was this part of the code refactored?
5. Which functions were optimized and what is the difference before and after the optimization?

[nsivarajan]

run buildall

[hello-stephen]

FE UT Coverage Report

Increment line coverage 77.78% (7/9) 🎉
Increment coverage report
Complete coverage report

[nsivarajan]

run buildall

[hello-stephen]

FE UT Coverage Report

Increment line coverage 77.78% (7/9) 🎉
Increment coverage report
Complete coverage report

[nsivarajan]

run buildall

[nsivarajan]

run compile

[hello-stephen]

BE Regression && UT Coverage Report

Increment line coverage 2.04% (11/538) 🎉

Increment coverage report
Complete coverage report

Category	Coverage
Function Coverage	74.85% (30508/40757)
Line Coverage	59.02% (336328/569869)
Region Coverage	55.68% (282127/506729)
Branch Coverage	57.11% (125404/219577)