context deadline exceeded on concurrent Vault identity merges
0 reputation · 05 Oct 2022, 05:27 UTC
context deadline exceeded on concurrent Vault identity merges
Goal: determine whether HTTP 500 responses containing "context deadline exceeded" on /auth/*/login originate from per-entity identity store lock serialization rather than storage backend latency.
Vault serializes entity and alias creation or merging per entity ID. When multiple logins for the same identity run concurrently, requests queue on this lock. The effect appears only under concurrency; isolated authentication typically completes quickly. Integrated storage adds WAL sync time inside the critical section, while Consul adds network round-trips, so the failure signature varies by backend. No configuration flag currently shards or parallelizes the per-entity merge lock.
This behavior requires current verification against the target Vault release before it is treated as a confirmed design defect.
- Does the per-entity merge lock retain the request context for the full entity upsert duration under concurrent logins?
- Can "context deadline exceeded" be distinguished from storage latency using identity merge duration telemetry?
- Is lock striping or optimistic concurrency for entity merges under active consideration for a future Vault release?