Pages presigned URL failure - Customer investigation

Issue Summary

Customer is experiencing intermittent Pages presigned URL failures resulting in 400 Bad Request errors.

Error Details

error.message: "httprange: new resource 400: \"400 Bad Request\""

Affected Component: gitlab-pages

Error Path Example: /advanceddevelopment/sut3/appfw/SutAppFrameworkInstaller/developerGuide/CI-CD System/Access by Browser.html

Root Cause Analysis

This is related to AWS S3 credential refresh timing. The issue occurs when:

1. GitLab Pages cache expires (default: 600 seconds)
2. AWS credentials refresh threshold is too close to cache expiry
3. A presigned URL request arrives during the credential refresh window

See upstream issue: https://gitlab.com/gitlab-org/gitlab/-/issues/553397#note_2735449164

Proposed Solution

Adjust one of the following configurations to prevent the race condition:

Option A: Set aws_credentials_refresh_threshold_seconds to 600 seconds (refresh every 50 minutes instead of 60)

Option B: Adjust gitlabCache.expiry via the GitLab Pages Helm chart configuration

Customer Impact

• Frequency: Intermittent, not reproducible systematically
• Scope: Single user at customer
• Status: Not observed in last 7 days, but has occurred previously

Next Steps

1. Implement one of the proposed solutions
2. Validate no new issues are introduced
3. Deploy to customer environment
4. Monitor for resolution

---

Related Issues:

• Internal tracking: gitlab-com/gl-infra/gitlab-dedicated/team#9954
• Upstream: gitlab-org/gitlab#553397

cc @u_dokmeci