fix(pdk/vault): do not call sema:wait in init phase (#9851)

* do not call sema:wait in init phase
* changelog

CHANGELOG.md

@@ -208,6 +208,8 @@
   and body parameter type of `kong.response.exit` to bytes. Note that old
   version of go PDK is incompatible after this change.
   [#9526](https://github.com/Kong/kong/pull/9526)
+- Vault will not call `semaphore:wait` in `init` or `init_worker` phase.
+  [#9851](https://github.com/Kong/kong/pull/9851)
 
 #### Plugins
 

kong/pdk/vault.lua

@@ -21,6 +21,7 @@ local cjson = require("cjson.safe").new()
 
 
 local ngx = ngx
+local get_phase = ngx.get_phase
 local fmt = string.format
 local sub = string.sub
 local byte = string.byte
@@ -507,10 +508,20 @@ local function new(self)
       return callback(options)
     end
 
-    -- grab a semaphore to limit concurrent updates to reduce calls to vaults
-    local wait_ok, wait_err = RETRY_SEMAPHORE:wait(RETRY_WAIT)
-    if not wait_ok then
-      self.log.notice("waiting for semaphore failed: ", wait_err or "unknown")
+    local wait_ok
+    local phase = get_phase()
+
+    if phase == "init" or phase == "init_worker" then
+      -- semaphore:wait can't work in init/init_worker phase
+      wait_ok = false
+
+    else
+      -- grab a semaphore to limit concurrent updates to reduce calls to vaults
+      local wait_err
+      wait_ok, wait_err = RETRY_SEMAPHORE:wait(RETRY_WAIT)
+      if not wait_ok then
+        self.log.notice("waiting for semaphore failed: ", wait_err or "unknown")
+      end
     end
 
     -- do we now have values with RETRY_TTL seconds ttl?