eclipse-dataspace-hub / eclipse-dataspace-hub/MinimumViableDataspace

Deployment with Docker Images fails to Issue Credentials for Consumer and Provider

Open
#643 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

triage
Dominant language
Bru
Stars
130
Forks
239
PR merge metrics
No merged PRs in 30d

Description

We are working to deploy the MVD on K8S using the MVD Docker Images and we encountered several issues:

  1. We cannot access the latest Docker Images from repository: ghcr.io/eclipse-dataspace-hub/minimumviabledataspace/ we had to switch back to ghcr.io/eclipse-edc/minimumviabledataspace/ repository
  2. We managed to configure our custom deployment (main kustomization.yaml), but the identity hub seeding jobs are failing to issue credentials for provider and consumer. The Credentials are created and reach the Approved Status, but the delivery fails

Here the logs from the seeding job:
`================================================
Step 1: Create Consumer Holder in IssuerService

✓ Consumer holder created in IssuerService
Debug Response body:

Step 2: Create Consumer Participant Context in IdentityHub

✓ Consumer participant context created
Debug Response body: {"apiKey":"Y29...=.ng0d.../Shf23..==","clientId":"did:web:identityhub.consumer-test.svc.cluster.local%3A7083:consumer","clientSecret":"..."}

Step 3: Requesting credential issuance

✓ Consumer participant context created
Debug Response body: {"apiKey":"Y29...=.ng0d../VSD../Shf23..==","clientId":"did:web:identityhub.consumer-test.svc.cluster.local%3A7083:consumer","clientSecret":"..."}

Step 4: Wait for credentials to be issued

Debug Response body: {"issuerDid":"did:web:issuerservice.dsp-issuer-test.svc.cluster.local%3A10016:issuer","holderPid":"credential-request-1","issuerPid":null,"status":"CREATED","typesAndFormats":[{"id":"membership-credential-def","credentialType":"MembershipCredential","format":"VC2_0_JOSE"},{"id":"manufacturer-credential-def","credentialType":"ManufacturerCredential","format":"VC2_0_JOSE"}]}
Credential status: CREATED
Debug Response body: {"issuerDid":"did:web:issuerservice.dsp-issuer-test.svc.cluster.local%3A10016:issuer","holderPid":"credential-request-1","issuerPid":"","status":"REQUESTED","typesAndFormats":[{"id":"membership-credential-def","credentialType":"MembershipCredential","format":"VC2_0_JOSE"},{"id":"manufacturer-credential-def","credentialType":"ManufacturerCredential","format":"VC2_0_JOSE"}]}
Credential status: REQUESTED

IH Logs:
DEBUG 2026-07-10T01:04:29.834627644 [CredentialRequestManagerImpl] HolderCredentialRequest credential-request-1 is now in state CREATED
DEBUG 2026-07-10T01:04:30.514907173 Processing 'CREATED' request 'credential-request-1'
DEBUG 2026-07-10T01:04:30.576869276 [CredentialRequestManagerImpl] HolderCredentialRequest credential-request-1 is now in state REQUESTING
DEBUG 2026-07-10T01:04:30.688179272 [CredentialRequestManagerImpl] HolderCredentialRequest credential-request-1 is now in state REQUESTED
DEBUG 2026-07-10T01:05:17.700216981 [CredentialWatchdog] checking 0 credentials
DEBUG 2026-07-10T01:06:17.698966819 [CredentialWatchdog] checking 0 credentials
DEBUG 2026-07-10T01:07:17.69947485 [CredentialWatchdog] checking 0 credentials
DEBUG 2026-07-10T01:08:17.69883246 [CredentialWatchdog] checking 0 credentials
DEBUG 2026-07-10T01:09:17.700170403 [CredentialWatchdog] checking 0 credentials
DEBUG 2026-07-10T01:10:12.817767188 [CredentialRequestManagerImpl] HolderCredentialRequest credential-request-1 is now in state CREATED
DEBUG 2026-07-10T01:10:13.412030431 Processing 'CREATED' request 'credential-request-1'
DEBUG 2026-07-10T01:10:13.437302349 [CredentialRequestManagerImpl] HolderCredentialRequest credential-request-1 is now in state REQUESTING
DEBUG 2026-07-10T01:10:13.505843537 [CredentialRequestManagerImpl] HolderCredentialRequest credential-request-1 is now in state REQUESTED

ISSUER Logs:
DEBUG 2026-07-10T01:06:18.422420335 IssuanceProcess: ID eecf7fca-1f55-4353-aa94-a395b05bbdfb. Attempt #6 failed to Deliver Credentials. Cause: 
DEBUG 2026-07-10T01:06:18.432647054 [IssuanceProcessManagerImpl] IssuanceProcess eecf7fca-1f55-4353-aa94-a395b05bbdfb is now in state APPROVED
DEBUG 2026-07-10T01:06:18.440961971 Entity 03abf65b-6b3d-4bd4-8cd2-a3d71114e7c4 IssuanceProcess retry #7 will not be attempted before 714 ms.
DEBUG 2026-07-10T01:06:18.443898236 Entity 28d9c5ea-c511-4063-a61f-0265e079d68a IssuanceProcess retry #6 will not be attempted before 21940 ms.
DEBUG 2026-07-10T01:06:18.446009573 Entity eecf7fca-1f55-4353-aa94-a395b05bbdfb IssuanceProcess retry #6 will not be attempted before 63977 ms.
DEBUG 2026-07-10T01:06:19.452821749 Entity 03abf65b-6b3d-4bd4-8cd2-a3d71114e7c4 IssuanceProcess retry #7 of 7.
SEVERE 2026-07-10T01:06:19.760299035 IssuanceProcess: ID 03abf65b-6b3d-4bd4-8cd2-a3d71114e7c4. Attempt #8 failed to Deliver Credentials. Retry limit exceeded. Cause: 
WARNING 2026-07-10T01:06:19.760468661 
DEBUG 2026-07-10T01:06:19.766025076 [IssuanceProcessManagerImpl] IssuanceProcess 03abf65b-6b3d-4bd4-8cd2-a3d71114e7c4 is now in state ERRORED. errorDetail: 

!!! Not sure if these errors play a role
Jul 10, 2026 12:57:14 AM org.glassfish.jersey.internal.Errors logErrors
WARNING: The following warnings have been detected: WARNING: The (sub)resource method requestCredential in org.eclipse.edc.identityhub.protocols.dcp.issuer.api.v1alpha.credentialrequest.CredentialRequestApiController contains empty path annotation.
WARNING: The (sub)resource method getIssuerMetadata in org.eclipse.edc.identityhub.protocols.dcp.issuer.api.v1alpha.issuermetadata.IssuerMetadataApiController contains empty path annotation.

....`

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the referenced k8s/kustomization.yml and compare the configured ghcr.io image repositories. Then trace the identity hub seeding jobs using the provided IdentityHub and IssuerService logs, focusing on the credential delivery transition after APPROVED. Done means the consumer and provider credentials are delivered successfully in the custom Kubernetes deployment.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, kubernetes
Domain
devops, infrastructure, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.