Skip to content

Use limits framework instead o onchain config for Vault plugin ocr config#21405

Open
prashantkumar1982 wants to merge 6 commits intodevelopfrom
vault_limits_for_ocr3
Open

Use limits framework instead o onchain config for Vault plugin ocr config#21405
prashantkumar1982 wants to merge 6 commits intodevelopfrom
vault_limits_for_ocr3

Conversation

@prashantkumar1982
Copy link
Contributor

New limits were added for Vault here: smartcontractkit/chainlink-common#1877

This PR makes use of those. This helps us move away from depending on onchain config, which is very cumbersome to change.

AI generated this PR by this prompts:

The goal is to make code changes in Vault Plugin at chainlink/core/services/ocr2/plugins/vault/plugin.go.
The function NewReportingPlugin() at line 182 has a variable called configProto.
We want to stop reading values from that, and instead, for all fields read from there, we want to provide a separate source.

The separate source should be added by you in this file: chainlink-common/pkg/settings/cresettings/settings.go. Some fields are already existing in lines 64-69, so feel free to reuse them. But for new ones, please create new entries here, with the prefix string Vault.

For default values of all these fields, please pick the values from this place: chainlink-deployments/domains/cre/prod/durable_pipelines/archived/upgrade_vault_ocr_plugin_20260218_172509.yaml.
The relevant fields are in this file lines 47-83.

If you find a field value in the settings.go file has a default different than the one in upgrade_vault_ocr_plugin_20260218_172509.yaml, then please choose the value in the yaml file.

The changes that you make will be in 2 parts:

  1. In folder chainlink-common. Make sure you create new fields, edit existing ones as needed, but also fix any other related code in that overall folder. There are other files like defaults.json, README.md, defaults.toml, settings.go, that refer to these fields. Please edit all those files.
  2. After step 1, you need to use those in the chainlink folder changes to plugin.go file. All places using configProto as source will change to using these new cresettings source. For example, "cresettings.Default.VaultPluginBatchSizeLimit".

@github-actions
Copy link
Contributor

github-actions bot commented Mar 4, 2026

I see you updated files related to core. Please run make gocs in the root directory to add a changeset as well as in the text include at least one of the following tags:

  • #added For any new functionality added.
  • #breaking_change For any functionality that requires manual action for the node to boot.
  • #bugfix For bug fixes.
  • #changed For any change to the existing functionality.
  • #db_update For any feature that introduces updates to database schema.
  • #deprecation_notice For any upcoming deprecation functionality.
  • #internal For changesets that need to be excluded from the final changelog.
  • #nops For any feature that is NOP facing and needs to be in the official Release Notes for the release.
  • #removed For any functionality/config that is removed.
  • #updated For any functionality that is updated.
  • #wip For any change that is not ready yet and external communication about it should be held off till it is feature complete.

@github-actions
Copy link
Contributor

github-actions bot commented Mar 4, 2026

✅ No conflicts with other open PRs targeting develop

@trunk-io
Copy link

trunk-io bot commented Mar 4, 2026

Static BadgeStatic BadgeStatic BadgeStatic Badge

View Full Report ↗︎Docs

if configProto.LimitsMaxKeyValueModifiedKeys == 0 {
configProto.LimitsMaxKeyValueModifiedKeys = defaultLimitsMaxKeyValueModifiedKeys
}
return &ReportingPluginConfig{
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@prashantkumar1982 Have you checked that these values behave in the same way as the plugin limits?

I think BatchSize definitely doesn't -- if this applies unevenly across nodes in the DON we'll get a non-determinism error, regardless of whether we're hitting the batchSize or not

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The others would normally lead the plugin to return an error to the user, so I think those are also not safe to change node by node since an inconsistency will lead to a loss of quorum

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As we discussed, these 2 are problematic:

  • maxSecretsPerOwnerLimiter
  • batchSize
    Meaning these, if mismatched on a few nodes, could cause quorum failures.

we discussed that since changes will be based on limits framework, they will apply very uniformly and quickly on all nodes, but that still could be a few minutes, when potentially we fail quorum, thus slowing Vault DON, or maybe partial outage during that time.

Thus I moved these above 2 fields back to being read from onchain config.
All others are just max size changes, and should be ok to be changed safely via limits framework.

@cl-sonarqube-production
Copy link

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants