The Configure Tenant test issued its first kubectl patch of
tenants/root as soon as the previous test saw the aggregated
APIService report Available. That condition tracks endpoint
availability, not the serving pod's auth stack: a freshly rolled
cozystack-api pod can answer while it has not yet loaded the
requestheader client-CA, so it drops the front-proxy identity and
rejects the request as system:anonymous with a 403, failing the test
0.3s in on its very first command.
Add an authenticated GET against the same resource, bounded to 120s,
before the patch. It proves the aggregated API both serves and
authenticates a request against the actual resource before the patch's
own initial GET runs, closing the inter-test race without a blind
retry; if the aggregation layer is genuinely wedged past two minutes
the gate fails loud, surfacing a real regression.
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
Aleksei Sviridkin
3733ebd736