[Moep90]

Summary

Bounds the vault test-server startup in tests/vault_server.py so an unreachable VAULT_ADDR makes the vault tests skip (or fail in CI) instead of hanging the suite.

Fixes #

Motivation

tests/vault_server.py polled the server in while not initialized: with no timeout and except: continue. When VAULT_ADDR points at a vault that doesn't resolve or respond (stale env var, VPN off, no Docker), the loop never exits. setUpClass in test_cli.py, test_vault.py and test_vault_transit.py builds the shared server, so the whole suite hangs.

I hit this locally: the run sat on test_cli.py::CliFuncsTest::test_cli_inventory for 20+ minutes, logging NameResolutionError against the unreachable VAULT_ADDR.

What changes:

• Both startup loops (container running, vault initialized) have a deadline, KAPITAN_VAULT_SETUP_TIMEOUT (default 60s). On timeout they raise VaultServerError.
• get_shared_vault_server() caches the failure so the other vault test classes don't each wait out the timeout again.
• Outside CI the failure becomes SkipTest, so local runs skip the 35 vault tests with a reason. When the CI env var is set the VaultServerError propagates, so a broken vault service in CI fails the build instead of turning green with everything skipped.

Affected files or URLs

• tests/vault_server.py: deadlines, failure cache, skip outside CI
• tests/test_cli.py, tests/test_vault.py, tests/test_vault_transit.py: tearDownClass tolerates a missing server
• tests/test_vault_server.py (new)

Test plan

• Tests added or updated:
  • test_unreachable_vault_addr_raises_instead_of_hanging hangs on master and raises after about 4s here.
  • VaultSetupFailureTest runs VaultSecretTest.setUpClass against a vault that fails to start. It checks that the class skips without CI and raises with CI=true. The CI case fails on the previous version of this branch, which skipped there too.
• Documentation updated (if user-facing behavior changed)
• make lint passes
• make format passes (or no formatting changes needed)
• Full test suite passes (uv run pytest tests/ --no-cov): with VAULT_ADDR=http://127.0.0.1:1 KAPITAN_VAULT_SETUP_TIMEOUT=3, the three vault test files give 35 skipped without CI and 35 errors with CI=true, both in about 10s.

Risk assessment

Test helpers only. If vault in CI takes longer than 60s to come up, the vault tests now error instead of waiting forever. Raise KAPITAN_VAULT_SETUP_TIMEOUT in the workflow if that happens.

Follow-up work intentionally left out

None.

[Moep90]

Relates to #1512 — this is the test-isolation/hang half of that test-infra issue (bounding the vault test-server startup).