Abort waiting on authentication failure

2 files changed, 7 insertions, 2 deletions

diff --git a/client/go/internal/vespa/target.go b/client/go/internal/vespa/target.go
index 065537d8610..662e7383f97 100644
--- a/client/go/internal/vespa/target.go
+++ b/client/go/internal/vespa/target.go
@@ -37,6 +37,7 @@ const (
 )
 
 var errWaitTimeout = errors.New("wait timed out")
+var errAuth = errors.New("auth failed")
 
 // Authenticator authenticates the given HTTP request.
 type Authenticator interface {
@@ -113,7 +114,7 @@ func (s *Service) Do(request *http.Request, timeout time.Duration) (*http.Respon
 	})
 	if s.auth != nil {
 		if err := s.auth.Authenticate(request); err != nil {
-			return nil, err
+			return nil, fmt.Errorf("%w: %s", errAuth, err)
 		}
 	}
 	return s.httpClient.Do(request, timeout)
@@ -220,7 +221,9 @@ func wait(service *Service, okFn responseFunc, reqFn requestFunc, timeout, retry
 	loopOnce := timeout == 0
 	for time.Now().Before(deadline) || loopOnce {
 		response, err = service.Do(reqFn(), 10*time.Second)
-		if err == nil {
+		if errors.Is(err, errAuth) {
+			return status, fmt.Errorf("aborting wait: %w", err)
+		} else if err == nil {
 			status = response.StatusCode
 			body, err := io.ReadAll(response.Body)
 			if err != nil {
diff --git a/client/go/internal/vespa/target_test.go b/client/go/internal/vespa/target_test.go
index abcbefe5529..25e38a30151 100644
--- a/client/go/internal/vespa/target_test.go
+++ b/client/go/internal/vespa/target_test.go
@@ -120,6 +120,8 @@ func TestCustomTargetAwaitDeployment(t *testing.T) {
 func TestCloudTargetWait(t *testing.T) {
 	var logWriter bytes.Buffer
 	target, client := createCloudTarget(t, &logWriter)
+	client.NextResponseError(errAuth)
+	assertService(t, true, target, "deploy", time.Second) // No retrying on auth error
 	client.NextStatus(401)
 	assertService(t, true, target, "deploy", time.Second) // No retrying on 4xx
 	client.NextStatus(500)