Vault rate limit "Code: 429" (too many requests) in CI

By Kaveh Alemi·Latchkey

Vault returned 429 because a rate-limit quota was exceeded. Many parallel CI jobs authenticating and reading at once can trip a per-path or global quota, and Vault sheds the excess load.

What this error means

Reads intermittently fail with "Code: 429 ... * rate limit quota exceeded" or "Retry-After" headers when many jobs run concurrently.

Error making API request.

URL: GET https://vault.example.com/v1/secret/data/ci/app
Code: 429. Errors:

* rate limit quota exceeded

Common causes

Concurrent jobs exceed the rate-limit quota

A large matrix or many workflows logging in and reading simultaneously surpass a per-path or global request quota.

A tight quota relative to CI volume

The configured rate-limit quota is lower than the peak request rate CI generates.

How to fix it

Back off and retry on 429

1. Honor the Retry-After header if present.
2. Add exponential backoff around Vault calls.
3. Reduce redundant logins by fetching all secrets once per job.

for i in 1 2 3 4 5; do
  vault kv get secret/ci/app && break
  sleep $((2 ** i))
done

Raise the quota (operator)

If CI legitimately needs more throughput, increase the rate-limit quota.

vault write sys/quotas/rate-limit/ci-reads \
  path="secret/data/ci" rate=200

How to prevent it

• Fetch all needed secrets in one step per job to cut request volume.
• Add backoff and honor Retry-After on 429.
• Size rate-limit quotas to peak CI concurrency.

Frequently asked questions

Related guides

References

• GitHub Actions documentation