Fix Vault e2e test startup race#4198
Merged
Merged
Conversation
The vault e2e test was flaky because the node container started before vault-adapter was reachable, causing DID creation to time out with "context deadline exceeded" waiting for vault-adapter. Add explicit healthchecks and depends_on: - vault: healthcheck via `vault status` CLI (exits 0 when unsealed) - vault-adapter: depends_on vault (service_healthy); override the image's built-in healthcheck interval for faster e2e startup - node: depends_on vault-adapter (service_healthy) Switch run-test.sh from `--wait vault` to `--wait vault-adapter`, since vault-adapter healthy transitively implies vault healthy. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
stevenvegt
requested review from
gerardsn,
reinkrul and
woutslakhorst
as code owners
April 16, 2026 08:27
Contributor
|
Coverage Impact This PR will not change total coverage. 🚦 See full report on Qlty Cloud »🛟 Help
|
reinkrul
approved these changes
Apr 16, 2026
Some CI runners (e.g. GitHub Actions) don't grant CAP_SETFCAP, so vault's entrypoint fails at startup with: unable to set CAP_SETFCAP effective capability: Operation not permitted SKIP_SETCAP=true tells the vault entrypoint to skip the setcap call on its binary. mlock isn't required for dev mode. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
reinkrul
pushed a commit
that referenced
this pull request
Apr 16, 2026
Probably due to a new version of vault, the e2e test failed. Vault tried to set setcap in vault container for CI compatibility which is not allowed by the CI runner. Created the correct container dependencies and skip the setcap for vault fixed the problem.
1 task
reinkrul
added a commit
that referenced
this pull request
Apr 16, 2026
Probably due to a new version of vault, the e2e test failed. Vault tried to set setcap in vault container for CI compatibility which is not allowed by the CI runner. Created the correct container dependencies and skip the setcap for vault fixed the problem. Co-authored-by: Steven van der Vegt <steven.vandervegt@s-curve.nl>
reinkrul
added a commit
that referenced
this pull request
Apr 17, 2026
Cherry-picked 091684c. The Vault CI runner rejects setcap and the e2e test racing against vault startup caused DID creation to hit a context-deadline-exceeded against vault-adapter. Added service_healthy dependencies and SKIP_SETCAP=true. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
reinkrul
added a commit
that referenced
this pull request
Apr 17, 2026
* Backport: add index for auth creds (#3562/#3564) to V5.4 Adds the compound index `index_auth_subject_purpose_resources` (credentialSubject.id + purposeOfUse + resources.path) so POST /internal/vcr/v2/search queries for NutsAuthorizationCredential stop falling back to `index_issuer` and scanning every credential issued by the requesting care organization. Also removes the now-redundant `index_subject` (its parts are a prefix of the new index). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Backport: fix Vault e2e test startup race (#4198) to V5.4 Cherry-picked 091684c. The Vault CI runner rejects setcap and the e2e test racing against vault startup caused DID creation to hit a context-deadline-exceeded against vault-adapter. Added service_healthy dependencies and SKIP_SETCAP=true. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Add v5.4.32 release notes Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The Vault e2e test was flaky in CI because the node container started before vault-adapter was reachable, causing DID creation to fail with
context deadline exceededwaiting for vault-adapter HTTP responses. Without explicit healthchecks and dependencies, docker compose started all three services in parallel, and the node's first HTTP calls to vault-adapter landed before vault-adapter had connected to vault.Changes
vault: added a healthcheck usingvault status(exits 0 when unsealed; dev mode is always unsealed)vault-adapter: addeddepends_onvault (condition: service_healthy); kept the image's built-in HEALTHCHECK but reduced the interval for faster e2e startupnode: addeddepends_onvault-adapter (condition: service_healthy)run-test.sh: switched--wait vaultto--wait vault-adapter(vault-adapter healthy transitively implies vault healthy; vault's old--waitwas a no-op since the image has no HEALTHCHECK)Test plan
e2e-tests/storage/vault/run-test.shpasses locally🤖 Generated with Claude Code