Enabling Auth Plugin failing with context deadline exceeded

Enabling Auth Plugin failing with context deadline exceeded

The fix that worked in production was moving plugin initialization out of Factory into lazy one-time init. The reporter refactored the plugin so initialization happens once via sync.Once at first use, instead of inside the Factory function where a partially-initialized plugin could be published. They shipped this to production and it looked good. Note the remaining limitation from the thread: there is still no automatic recovery until the plugin process reloads.

Context from the issue

gh:hashicorp/vault#19192: Issue hashicorp/vault#19192 (closed, 40 comments): Hello again team, 👋

Describe the bug Vault is returning error: code = Canceled desc = context canceled" took=59.750225246s when trying to register an external auth plugin. The debug is followed by the error 2023-02-15T00:58:57.417Z [ERROR] secrets.system.system_7f9e5cfe: error occurred during enable credential: path=$PLUGIN_PATH/ error="rpc error: code = Canceled desc = context canceled"

To Reproduce Steps to reproduce the behavior:

1. Run vault plugin register -sha256=${PLUGIN_SHA256} -command=${PLUGIN_COMMAND} auth ${PLUGIN_MOUNT}
2. Run `eval vault auth enable...

Issue gh:hashicorp/vault#19192: the reporter asked: Issue hashicorp/vault#19192 (closed, 40 comments): Hello again team, 👋

Describe the bug Vault is returning error: code = Canceled desc = context canceled" took=59.750225246s when trying to register an external auth plugin. The debug is followed by the error 2023-02-15T00:58:57.417Z [ERROR] secrets.system.system_7f9e5cfe: error occurred during enable credential: path=$PLUGIN_PATH/ error="rpc error: code = Canceled desc = context canceled"

To Reproduce Steps to reproduce the behavior:

1. Run vault plugin register -sha256=${PLUGIN_SHA256} -command=${PLUGIN_COMMAND} auth ${PLUGIN_MOUNT}
2. Run eval vault auth enable... The verified answer was: The fix that worked in production was moving plugin initialization out of Factory into lazy one-time init. The reporter refactored the plugin so initialization happens once via sync.Once at first use, instead of inside the Factory` function where a partially-initialized plugin could be published. They shipped this to production and it looked good. Note the remaining limitation from the thread: there is still no automatic recovery until the plugin process reloads. Evidence thread: https://github.com/hashicorp/vault/issues/19192