From f2aebafb776943bd215e026c882e9951725afecb Mon Sep 17 00:00:00 2001 From: Russell Stern Date: Wed, 3 Jun 2026 16:19:05 -0400 Subject: [PATCH 01/10] Added cipherless observation flag for the vault --- pkg/settings/cresettings/README.md | 2 ++ pkg/settings/cresettings/defaults.json | 2 ++ pkg/settings/cresettings/defaults.toml | 2 ++ pkg/settings/cresettings/settings.go | 4 ++++ pkg/settings/cresettings/settings_test.go | 2 ++ 5 files changed, 12 insertions(+) diff --git a/pkg/settings/cresettings/README.md b/pkg/settings/cresettings/README.md index e79c22e88a..47d12a9614 100644 --- a/pkg/settings/cresettings/README.md +++ b/pkg/settings/cresettings/README.md @@ -45,6 +45,8 @@ flowchart VaultGetSecretsShareAggregationIncludesPublicKeys[/VaultGetSecretsShareAggregationIncludesPublicKeys\]:::gate VaultOwnerAddressCanonicalizationEnabled[/VaultOwnerAddressCanonicalizationEnabled\]:::gate VaultJSONOmitUnpopulatedEnabled[/VaultJSONOmitUnpopulatedEnabled\]:::gate + VaultSignedResponseRequestIDEnabled[/VaultSignedResponseRequestIDEnabled\]:::gate + VaultCiphertextlessObservationsEnabled[/VaultCiphertextlessObservationsEnabled\]:::gate end subgraph HandleNodeMessage[gatewayHandler.HandleNodeMessage] diff --git a/pkg/settings/cresettings/defaults.json b/pkg/settings/cresettings/defaults.json index 423f335ee8..c7af18e393 100644 --- a/pkg/settings/cresettings/defaults.json +++ b/pkg/settings/cresettings/defaults.json @@ -12,6 +12,8 @@ "VaultGetSecretsShareAggregationIncludesPublicKeys": "false", "VaultOwnerAddressCanonicalizationEnabled": "false", "VaultJSONOmitUnpopulatedEnabled": "false", + "VaultSignedResponseRequestIDEnabled": "false", + "VaultCiphertextlessObservationsEnabled": "false", "GatewayHTTPGlobalRate": "500rps:500", "GatewayHTTPPerNodeRate": "100rps:100", "GatewayConfidentialRelayGlobalRate": "50rps:10", diff --git a/pkg/settings/cresettings/defaults.toml b/pkg/settings/cresettings/defaults.toml index 5a572fe49a..9ad4e3d581 100644 --- a/pkg/settings/cresettings/defaults.toml +++ b/pkg/settings/cresettings/defaults.toml @@ -11,6 +11,8 @@ VaultOptimizationsEnabled = 'false' VaultGetSecretsShareAggregationIncludesPublicKeys = 'false' VaultOwnerAddressCanonicalizationEnabled = 'false' VaultJSONOmitUnpopulatedEnabled = 'false' +VaultSignedResponseRequestIDEnabled = 'false' +VaultCiphertextlessObservationsEnabled = 'false' GatewayHTTPGlobalRate = '500rps:500' GatewayHTTPPerNodeRate = '100rps:100' GatewayConfidentialRelayGlobalRate = '50rps:10' diff --git a/pkg/settings/cresettings/settings.go b/pkg/settings/cresettings/settings.go index c8f94befab..48c6d70fc5 100644 --- a/pkg/settings/cresettings/settings.go +++ b/pkg/settings/cresettings/settings.go @@ -66,6 +66,8 @@ var Default = Schema{ VaultGetSecretsShareAggregationIncludesPublicKeys: Bool(false), VaultOwnerAddressCanonicalizationEnabled: Bool(false), VaultJSONOmitUnpopulatedEnabled: Bool(false), + VaultSignedResponseRequestIDEnabled: Bool(false), + VaultCiphertextlessObservationsEnabled: Bool(false), GatewayHTTPGlobalRate: Rate(rate.Limit(500), 500), GatewayHTTPPerNodeRate: Rate(rate.Limit(100), 100), GatewayConfidentialRelayGlobalRate: Rate(rate.Limit(50), 10), @@ -305,6 +307,8 @@ type Schema struct { VaultGetSecretsShareAggregationIncludesPublicKeys Setting[bool] VaultOwnerAddressCanonicalizationEnabled Setting[bool] VaultJSONOmitUnpopulatedEnabled Setting[bool] + VaultCiphertextlessObservationsEnabled Setting[bool] + VaultSignedResponseRequestIDEnabled Setting[bool] GatewayHTTPGlobalRate Setting[config.Rate] GatewayHTTPPerNodeRate Setting[config.Rate] GatewayConfidentialRelayGlobalRate Setting[config.Rate] diff --git a/pkg/settings/cresettings/settings_test.go b/pkg/settings/cresettings/settings_test.go index 793b264ff3..9a35661887 100644 --- a/pkg/settings/cresettings/settings_test.go +++ b/pkg/settings/cresettings/settings_test.go @@ -138,6 +138,8 @@ func TestSchema_Unmarshal(t *testing.T) { assert.False(t, cfg.VaultGetSecretsShareAggregationIncludesPublicKeys.DefaultValue) assert.False(t, cfg.VaultOwnerAddressCanonicalizationEnabled.DefaultValue) assert.False(t, cfg.VaultJSONOmitUnpopulatedEnabled.DefaultValue) + assert.False(t, cfg.VaultSignedResponseRequestIDEnabled.DefaultValue) + assert.False(t, cfg.VaultGetSecretsCiphertextlessObservationsEnabled.DefaultValue) assert.Equal(t, config.Rate{Limit: rate.Limit(20), Burst: 7}, cfg.GatewayConfidentialRelayGlobalRate.DefaultValue) assert.Equal(t, config.Rate{Limit: rate.Limit(4), Burst: 2}, cfg.GatewayConfidentialRelayPerNodeRate.DefaultValue) assert.Equal(t, 48*time.Hour, cfg.PerOrg.ZeroBalancePruningTimeout.DefaultValue) From 5a37cb036b578b44a9612f7cf95572f8fbc76bfb Mon Sep 17 00:00:00 2001 From: Russell Stern Date: Wed, 3 Jun 2026 16:23:49 -0400 Subject: [PATCH 02/10] Fixed test --- pkg/settings/cresettings/settings_test.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/settings/cresettings/settings_test.go b/pkg/settings/cresettings/settings_test.go index 9a35661887..137fe9dd88 100644 --- a/pkg/settings/cresettings/settings_test.go +++ b/pkg/settings/cresettings/settings_test.go @@ -139,7 +139,7 @@ func TestSchema_Unmarshal(t *testing.T) { assert.False(t, cfg.VaultOwnerAddressCanonicalizationEnabled.DefaultValue) assert.False(t, cfg.VaultJSONOmitUnpopulatedEnabled.DefaultValue) assert.False(t, cfg.VaultSignedResponseRequestIDEnabled.DefaultValue) - assert.False(t, cfg.VaultGetSecretsCiphertextlessObservationsEnabled.DefaultValue) + assert.False(t, cfg.VaultCiphertextlessObservationsEnabled.DefaultValue) assert.Equal(t, config.Rate{Limit: rate.Limit(20), Burst: 7}, cfg.GatewayConfidentialRelayGlobalRate.DefaultValue) assert.Equal(t, config.Rate{Limit: rate.Limit(4), Burst: 2}, cfg.GatewayConfidentialRelayPerNodeRate.DefaultValue) assert.Equal(t, 48*time.Hour, cfg.PerOrg.ZeroBalancePruningTimeout.DefaultValue) From 14c319499c90bffb3e57256a8efd83debaa817ee Mon Sep 17 00:00:00 2001 From: Russell Stern Date: Mon, 29 Jun 2026 08:54:23 -0400 Subject: [PATCH 03/10] Updated defaults --- pkg/settings/cresettings/defaults.json | 2 +- pkg/settings/cresettings/defaults.toml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pkg/settings/cresettings/defaults.json b/pkg/settings/cresettings/defaults.json index c7af18e393..0c95c1eb43 100644 --- a/pkg/settings/cresettings/defaults.json +++ b/pkg/settings/cresettings/defaults.json @@ -12,8 +12,8 @@ "VaultGetSecretsShareAggregationIncludesPublicKeys": "false", "VaultOwnerAddressCanonicalizationEnabled": "false", "VaultJSONOmitUnpopulatedEnabled": "false", - "VaultSignedResponseRequestIDEnabled": "false", "VaultCiphertextlessObservationsEnabled": "false", + "VaultSignedResponseRequestIDEnabled": "false", "GatewayHTTPGlobalRate": "500rps:500", "GatewayHTTPPerNodeRate": "100rps:100", "GatewayConfidentialRelayGlobalRate": "50rps:10", diff --git a/pkg/settings/cresettings/defaults.toml b/pkg/settings/cresettings/defaults.toml index 9ad4e3d581..2abb30a19c 100644 --- a/pkg/settings/cresettings/defaults.toml +++ b/pkg/settings/cresettings/defaults.toml @@ -11,8 +11,8 @@ VaultOptimizationsEnabled = 'false' VaultGetSecretsShareAggregationIncludesPublicKeys = 'false' VaultOwnerAddressCanonicalizationEnabled = 'false' VaultJSONOmitUnpopulatedEnabled = 'false' -VaultSignedResponseRequestIDEnabled = 'false' VaultCiphertextlessObservationsEnabled = 'false' +VaultSignedResponseRequestIDEnabled = 'false' GatewayHTTPGlobalRate = '500rps:500' GatewayHTTPPerNodeRate = '100rps:100' GatewayConfidentialRelayGlobalRate = '50rps:10' From 7e603d9e51d5ef49d22dd7cf3b118f7b10e2c5bb Mon Sep 17 00:00:00 2001 From: Russell Stern Date: Thu, 2 Jul 2026 14:29:39 -0400 Subject: [PATCH 04/10] Added new flag for relaxed consensus in vault --- pkg/settings/cresettings/README.md | 1 + pkg/settings/cresettings/defaults.json | 1 + pkg/settings/cresettings/defaults.toml | 1 + pkg/settings/cresettings/settings.go | 2 ++ pkg/settings/cresettings/settings_test.go | 1 + 5 files changed, 6 insertions(+) diff --git a/pkg/settings/cresettings/README.md b/pkg/settings/cresettings/README.md index 47d12a9614..ee957ee113 100644 --- a/pkg/settings/cresettings/README.md +++ b/pkg/settings/cresettings/README.md @@ -47,6 +47,7 @@ flowchart VaultJSONOmitUnpopulatedEnabled[/VaultJSONOmitUnpopulatedEnabled\]:::gate VaultSignedResponseRequestIDEnabled[/VaultSignedResponseRequestIDEnabled\]:::gate VaultCiphertextlessObservationsEnabled[/VaultCiphertextlessObservationsEnabled\]:::gate + VaultGetSecretsRelaxedConsensusEnabled[/VaultGetSecretsRelaxedConsensusEnabled\]:::gate end subgraph HandleNodeMessage[gatewayHandler.HandleNodeMessage] diff --git a/pkg/settings/cresettings/defaults.json b/pkg/settings/cresettings/defaults.json index 0c95c1eb43..ece78ecaf6 100644 --- a/pkg/settings/cresettings/defaults.json +++ b/pkg/settings/cresettings/defaults.json @@ -13,6 +13,7 @@ "VaultOwnerAddressCanonicalizationEnabled": "false", "VaultJSONOmitUnpopulatedEnabled": "false", "VaultCiphertextlessObservationsEnabled": "false", + "VaultGetSecretsRelaxedConsensusEnabled": "false", "VaultSignedResponseRequestIDEnabled": "false", "GatewayHTTPGlobalRate": "500rps:500", "GatewayHTTPPerNodeRate": "100rps:100", diff --git a/pkg/settings/cresettings/defaults.toml b/pkg/settings/cresettings/defaults.toml index 2abb30a19c..ae790fde35 100644 --- a/pkg/settings/cresettings/defaults.toml +++ b/pkg/settings/cresettings/defaults.toml @@ -12,6 +12,7 @@ VaultGetSecretsShareAggregationIncludesPublicKeys = 'false' VaultOwnerAddressCanonicalizationEnabled = 'false' VaultJSONOmitUnpopulatedEnabled = 'false' VaultCiphertextlessObservationsEnabled = 'false' +VaultGetSecretsRelaxedConsensusEnabled = 'false' VaultSignedResponseRequestIDEnabled = 'false' GatewayHTTPGlobalRate = '500rps:500' GatewayHTTPPerNodeRate = '100rps:100' diff --git a/pkg/settings/cresettings/settings.go b/pkg/settings/cresettings/settings.go index 48c6d70fc5..5b49d2b91d 100644 --- a/pkg/settings/cresettings/settings.go +++ b/pkg/settings/cresettings/settings.go @@ -68,6 +68,7 @@ var Default = Schema{ VaultJSONOmitUnpopulatedEnabled: Bool(false), VaultSignedResponseRequestIDEnabled: Bool(false), VaultCiphertextlessObservationsEnabled: Bool(false), + VaultGetSecretsRelaxedConsensusEnabled: Bool(false), GatewayHTTPGlobalRate: Rate(rate.Limit(500), 500), GatewayHTTPPerNodeRate: Rate(rate.Limit(100), 100), GatewayConfidentialRelayGlobalRate: Rate(rate.Limit(50), 10), @@ -308,6 +309,7 @@ type Schema struct { VaultOwnerAddressCanonicalizationEnabled Setting[bool] VaultJSONOmitUnpopulatedEnabled Setting[bool] VaultCiphertextlessObservationsEnabled Setting[bool] + VaultGetSecretsRelaxedConsensusEnabled Setting[bool] VaultSignedResponseRequestIDEnabled Setting[bool] GatewayHTTPGlobalRate Setting[config.Rate] GatewayHTTPPerNodeRate Setting[config.Rate] diff --git a/pkg/settings/cresettings/settings_test.go b/pkg/settings/cresettings/settings_test.go index 137fe9dd88..77315155b8 100644 --- a/pkg/settings/cresettings/settings_test.go +++ b/pkg/settings/cresettings/settings_test.go @@ -140,6 +140,7 @@ func TestSchema_Unmarshal(t *testing.T) { assert.False(t, cfg.VaultJSONOmitUnpopulatedEnabled.DefaultValue) assert.False(t, cfg.VaultSignedResponseRequestIDEnabled.DefaultValue) assert.False(t, cfg.VaultCiphertextlessObservationsEnabled.DefaultValue) + assert.False(t, cfg.VaultGetSecretsRelaxedConsensusEnabled.DefaultValue) assert.Equal(t, config.Rate{Limit: rate.Limit(20), Burst: 7}, cfg.GatewayConfidentialRelayGlobalRate.DefaultValue) assert.Equal(t, config.Rate{Limit: rate.Limit(4), Burst: 2}, cfg.GatewayConfidentialRelayPerNodeRate.DefaultValue) assert.Equal(t, 48*time.Hour, cfg.PerOrg.ZeroBalancePruningTimeout.DefaultValue) From 0d6197dce406edec11fb39d3a6a2fadc323d66ec Mon Sep 17 00:00:00 2001 From: Russell Stern Date: Thu, 2 Jul 2026 16:19:31 -0400 Subject: [PATCH 05/10] Removed extra field --- pkg/settings/cresettings/README.md | 1 - pkg/settings/cresettings/defaults.json | 1 - pkg/settings/cresettings/defaults.toml | 1 - pkg/settings/cresettings/settings.go | 2 -- pkg/settings/cresettings/settings_test.go | 1 - 5 files changed, 6 deletions(-) diff --git a/pkg/settings/cresettings/README.md b/pkg/settings/cresettings/README.md index ee957ee113..72d939f9a6 100644 --- a/pkg/settings/cresettings/README.md +++ b/pkg/settings/cresettings/README.md @@ -45,7 +45,6 @@ flowchart VaultGetSecretsShareAggregationIncludesPublicKeys[/VaultGetSecretsShareAggregationIncludesPublicKeys\]:::gate VaultOwnerAddressCanonicalizationEnabled[/VaultOwnerAddressCanonicalizationEnabled\]:::gate VaultJSONOmitUnpopulatedEnabled[/VaultJSONOmitUnpopulatedEnabled\]:::gate - VaultSignedResponseRequestIDEnabled[/VaultSignedResponseRequestIDEnabled\]:::gate VaultCiphertextlessObservationsEnabled[/VaultCiphertextlessObservationsEnabled\]:::gate VaultGetSecretsRelaxedConsensusEnabled[/VaultGetSecretsRelaxedConsensusEnabled\]:::gate end diff --git a/pkg/settings/cresettings/defaults.json b/pkg/settings/cresettings/defaults.json index ece78ecaf6..a3069dcd10 100644 --- a/pkg/settings/cresettings/defaults.json +++ b/pkg/settings/cresettings/defaults.json @@ -14,7 +14,6 @@ "VaultJSONOmitUnpopulatedEnabled": "false", "VaultCiphertextlessObservationsEnabled": "false", "VaultGetSecretsRelaxedConsensusEnabled": "false", - "VaultSignedResponseRequestIDEnabled": "false", "GatewayHTTPGlobalRate": "500rps:500", "GatewayHTTPPerNodeRate": "100rps:100", "GatewayConfidentialRelayGlobalRate": "50rps:10", diff --git a/pkg/settings/cresettings/defaults.toml b/pkg/settings/cresettings/defaults.toml index ae790fde35..00342fff30 100644 --- a/pkg/settings/cresettings/defaults.toml +++ b/pkg/settings/cresettings/defaults.toml @@ -13,7 +13,6 @@ VaultOwnerAddressCanonicalizationEnabled = 'false' VaultJSONOmitUnpopulatedEnabled = 'false' VaultCiphertextlessObservationsEnabled = 'false' VaultGetSecretsRelaxedConsensusEnabled = 'false' -VaultSignedResponseRequestIDEnabled = 'false' GatewayHTTPGlobalRate = '500rps:500' GatewayHTTPPerNodeRate = '100rps:100' GatewayConfidentialRelayGlobalRate = '50rps:10' diff --git a/pkg/settings/cresettings/settings.go b/pkg/settings/cresettings/settings.go index 5b49d2b91d..72424e07ee 100644 --- a/pkg/settings/cresettings/settings.go +++ b/pkg/settings/cresettings/settings.go @@ -66,7 +66,6 @@ var Default = Schema{ VaultGetSecretsShareAggregationIncludesPublicKeys: Bool(false), VaultOwnerAddressCanonicalizationEnabled: Bool(false), VaultJSONOmitUnpopulatedEnabled: Bool(false), - VaultSignedResponseRequestIDEnabled: Bool(false), VaultCiphertextlessObservationsEnabled: Bool(false), VaultGetSecretsRelaxedConsensusEnabled: Bool(false), GatewayHTTPGlobalRate: Rate(rate.Limit(500), 500), @@ -310,7 +309,6 @@ type Schema struct { VaultJSONOmitUnpopulatedEnabled Setting[bool] VaultCiphertextlessObservationsEnabled Setting[bool] VaultGetSecretsRelaxedConsensusEnabled Setting[bool] - VaultSignedResponseRequestIDEnabled Setting[bool] GatewayHTTPGlobalRate Setting[config.Rate] GatewayHTTPPerNodeRate Setting[config.Rate] GatewayConfidentialRelayGlobalRate Setting[config.Rate] diff --git a/pkg/settings/cresettings/settings_test.go b/pkg/settings/cresettings/settings_test.go index 77315155b8..f54ab841a2 100644 --- a/pkg/settings/cresettings/settings_test.go +++ b/pkg/settings/cresettings/settings_test.go @@ -138,7 +138,6 @@ func TestSchema_Unmarshal(t *testing.T) { assert.False(t, cfg.VaultGetSecretsShareAggregationIncludesPublicKeys.DefaultValue) assert.False(t, cfg.VaultOwnerAddressCanonicalizationEnabled.DefaultValue) assert.False(t, cfg.VaultJSONOmitUnpopulatedEnabled.DefaultValue) - assert.False(t, cfg.VaultSignedResponseRequestIDEnabled.DefaultValue) assert.False(t, cfg.VaultCiphertextlessObservationsEnabled.DefaultValue) assert.False(t, cfg.VaultGetSecretsRelaxedConsensusEnabled.DefaultValue) assert.Equal(t, config.Rate{Limit: rate.Limit(20), Burst: 7}, cfg.GatewayConfidentialRelayGlobalRate.DefaultValue) From 377fa8e1f9ef2e52bf9bd09df7b9b3706e29d711 Mon Sep 17 00:00:00 2001 From: Russell Stern Date: Wed, 8 Jul 2026 11:08:25 -0400 Subject: [PATCH 06/10] Remove cipherless observations setting --- pkg/settings/cresettings/README.md | 1 - pkg/settings/cresettings/defaults.json | 1 - pkg/settings/cresettings/defaults.toml | 1 - pkg/settings/cresettings/settings.go | 2 -- pkg/settings/cresettings/settings_test.go | 1 - 5 files changed, 6 deletions(-) diff --git a/pkg/settings/cresettings/README.md b/pkg/settings/cresettings/README.md index 72d939f9a6..ab0c176f39 100644 --- a/pkg/settings/cresettings/README.md +++ b/pkg/settings/cresettings/README.md @@ -45,7 +45,6 @@ flowchart VaultGetSecretsShareAggregationIncludesPublicKeys[/VaultGetSecretsShareAggregationIncludesPublicKeys\]:::gate VaultOwnerAddressCanonicalizationEnabled[/VaultOwnerAddressCanonicalizationEnabled\]:::gate VaultJSONOmitUnpopulatedEnabled[/VaultJSONOmitUnpopulatedEnabled\]:::gate - VaultCiphertextlessObservationsEnabled[/VaultCiphertextlessObservationsEnabled\]:::gate VaultGetSecretsRelaxedConsensusEnabled[/VaultGetSecretsRelaxedConsensusEnabled\]:::gate end diff --git a/pkg/settings/cresettings/defaults.json b/pkg/settings/cresettings/defaults.json index a3069dcd10..cc10485333 100644 --- a/pkg/settings/cresettings/defaults.json +++ b/pkg/settings/cresettings/defaults.json @@ -12,7 +12,6 @@ "VaultGetSecretsShareAggregationIncludesPublicKeys": "false", "VaultOwnerAddressCanonicalizationEnabled": "false", "VaultJSONOmitUnpopulatedEnabled": "false", - "VaultCiphertextlessObservationsEnabled": "false", "VaultGetSecretsRelaxedConsensusEnabled": "false", "GatewayHTTPGlobalRate": "500rps:500", "GatewayHTTPPerNodeRate": "100rps:100", diff --git a/pkg/settings/cresettings/defaults.toml b/pkg/settings/cresettings/defaults.toml index 00342fff30..a1ecc9f562 100644 --- a/pkg/settings/cresettings/defaults.toml +++ b/pkg/settings/cresettings/defaults.toml @@ -11,7 +11,6 @@ VaultOptimizationsEnabled = 'false' VaultGetSecretsShareAggregationIncludesPublicKeys = 'false' VaultOwnerAddressCanonicalizationEnabled = 'false' VaultJSONOmitUnpopulatedEnabled = 'false' -VaultCiphertextlessObservationsEnabled = 'false' VaultGetSecretsRelaxedConsensusEnabled = 'false' GatewayHTTPGlobalRate = '500rps:500' GatewayHTTPPerNodeRate = '100rps:100' diff --git a/pkg/settings/cresettings/settings.go b/pkg/settings/cresettings/settings.go index 72424e07ee..977086a8d8 100644 --- a/pkg/settings/cresettings/settings.go +++ b/pkg/settings/cresettings/settings.go @@ -66,7 +66,6 @@ var Default = Schema{ VaultGetSecretsShareAggregationIncludesPublicKeys: Bool(false), VaultOwnerAddressCanonicalizationEnabled: Bool(false), VaultJSONOmitUnpopulatedEnabled: Bool(false), - VaultCiphertextlessObservationsEnabled: Bool(false), VaultGetSecretsRelaxedConsensusEnabled: Bool(false), GatewayHTTPGlobalRate: Rate(rate.Limit(500), 500), GatewayHTTPPerNodeRate: Rate(rate.Limit(100), 100), @@ -307,7 +306,6 @@ type Schema struct { VaultGetSecretsShareAggregationIncludesPublicKeys Setting[bool] VaultOwnerAddressCanonicalizationEnabled Setting[bool] VaultJSONOmitUnpopulatedEnabled Setting[bool] - VaultCiphertextlessObservationsEnabled Setting[bool] VaultGetSecretsRelaxedConsensusEnabled Setting[bool] GatewayHTTPGlobalRate Setting[config.Rate] GatewayHTTPPerNodeRate Setting[config.Rate] diff --git a/pkg/settings/cresettings/settings_test.go b/pkg/settings/cresettings/settings_test.go index f54ab841a2..be212351ec 100644 --- a/pkg/settings/cresettings/settings_test.go +++ b/pkg/settings/cresettings/settings_test.go @@ -138,7 +138,6 @@ func TestSchema_Unmarshal(t *testing.T) { assert.False(t, cfg.VaultGetSecretsShareAggregationIncludesPublicKeys.DefaultValue) assert.False(t, cfg.VaultOwnerAddressCanonicalizationEnabled.DefaultValue) assert.False(t, cfg.VaultJSONOmitUnpopulatedEnabled.DefaultValue) - assert.False(t, cfg.VaultCiphertextlessObservationsEnabled.DefaultValue) assert.False(t, cfg.VaultGetSecretsRelaxedConsensusEnabled.DefaultValue) assert.Equal(t, config.Rate{Limit: rate.Limit(20), Burst: 7}, cfg.GatewayConfidentialRelayGlobalRate.DefaultValue) assert.Equal(t, config.Rate{Limit: rate.Limit(4), Burst: 2}, cfg.GatewayConfidentialRelayPerNodeRate.DefaultValue) From b3cda044bcd405f3977dbc824b411e7f5ddb331f Mon Sep 17 00:00:00 2001 From: Russell Stern Date: Wed, 8 Jul 2026 11:09:12 -0400 Subject: [PATCH 07/10] Add skip-invalid pending items flag + ObservationError proto --- pkg/capabilities/actions/vault/messages.pb.go | 209 +++++++++++------- pkg/capabilities/actions/vault/messages.proto | 8 + .../actions/vault/messages_test.go | 53 +++++ pkg/settings/cresettings/README.md | 1 + pkg/settings/cresettings/defaults.json | 1 + pkg/settings/cresettings/defaults.toml | 1 + pkg/settings/cresettings/settings.go | 2 + pkg/settings/cresettings/settings_test.go | 1 + 8 files changed, 201 insertions(+), 75 deletions(-) create mode 100644 pkg/capabilities/actions/vault/messages_test.go diff --git a/pkg/capabilities/actions/vault/messages.pb.go b/pkg/capabilities/actions/vault/messages.pb.go index d607130d15..1c1e1b3ddc 100644 --- a/pkg/capabilities/actions/vault/messages.pb.go +++ b/pkg/capabilities/actions/vault/messages.pb.go @@ -1271,6 +1271,52 @@ func (x *ListSecretIdentifiersResponse) GetError() string { return "" } +// ObservationError is an item-level Err(E) contribution for a pending queue request. +// When set on Observation, the observation is an error contribution for that request id. +type ObservationError struct { + state protoimpl.MessageState `protogen:"open.v1"` + Message string `protobuf:"bytes,1,opt,name=message,proto3" json:"message,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *ObservationError) Reset() { + *x = ObservationError{} + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[19] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *ObservationError) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*ObservationError) ProtoMessage() {} + +func (x *ObservationError) ProtoReflect() protoreflect.Message { + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[19] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use ObservationError.ProtoReflect.Descriptor instead. +func (*ObservationError) Descriptor() ([]byte, []int) { + return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{19} +} + +func (x *ObservationError) GetMessage() string { + if x != nil { + return x.Message + } + return "" +} + type Observation struct { state protoimpl.MessageState `protogen:"open.v1"` Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` @@ -1291,13 +1337,14 @@ type Observation struct { // *Observation_DeleteSecretsResponse // *Observation_ListSecretIdentifiersResponse Response isObservation_Response `protobuf_oneof:"response"` + Error *ObservationError `protobuf:"bytes,13,opt,name=error,proto3" json:"error,omitempty"` unknownFields protoimpl.UnknownFields sizeCache protoimpl.SizeCache } func (x *Observation) Reset() { *x = Observation{} - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[19] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[20] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1309,7 +1356,7 @@ func (x *Observation) String() string { func (*Observation) ProtoMessage() {} func (x *Observation) ProtoReflect() protoreflect.Message { - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[19] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[20] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1322,7 +1369,7 @@ func (x *Observation) ProtoReflect() protoreflect.Message { // Deprecated: Use Observation.ProtoReflect.Descriptor instead. func (*Observation) Descriptor() ([]byte, []int) { - return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{19} + return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{20} } func (x *Observation) GetId() string { @@ -1443,6 +1490,13 @@ func (x *Observation) GetListSecretIdentifiersResponse() *ListSecretIdentifiersR return nil } +func (x *Observation) GetError() *ObservationError { + if x != nil { + return x.Error + } + return nil +} + type isObservation_Request interface { isObservation_Request() } @@ -1522,7 +1576,7 @@ type Observations struct { func (x *Observations) Reset() { *x = Observations{} - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[20] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[21] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1534,7 +1588,7 @@ func (x *Observations) String() string { func (*Observations) ProtoMessage() {} func (x *Observations) ProtoReflect() protoreflect.Message { - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[20] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[21] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1547,7 +1601,7 @@ func (x *Observations) ProtoReflect() protoreflect.Message { // Deprecated: Use Observations.ProtoReflect.Descriptor instead. func (*Observations) Descriptor() ([]byte, []int) { - return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{20} + return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{21} } func (x *Observations) GetObservations() []*Observation { @@ -1597,7 +1651,7 @@ type Outcome struct { func (x *Outcome) Reset() { *x = Outcome{} - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[21] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[22] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1609,7 +1663,7 @@ func (x *Outcome) String() string { func (*Outcome) ProtoMessage() {} func (x *Outcome) ProtoReflect() protoreflect.Message { - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[21] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[22] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1622,7 +1676,7 @@ func (x *Outcome) ProtoReflect() protoreflect.Message { // Deprecated: Use Outcome.ProtoReflect.Descriptor instead. func (*Outcome) Descriptor() ([]byte, []int) { - return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{21} + return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{22} } func (x *Outcome) GetId() string { @@ -1820,7 +1874,7 @@ type Outcomes struct { func (x *Outcomes) Reset() { *x = Outcomes{} - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[22] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[23] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1832,7 +1886,7 @@ func (x *Outcomes) String() string { func (*Outcomes) ProtoMessage() {} func (x *Outcomes) ProtoReflect() protoreflect.Message { - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[22] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[23] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1845,7 +1899,7 @@ func (x *Outcomes) ProtoReflect() protoreflect.Message { // Deprecated: Use Outcomes.ProtoReflect.Descriptor instead. func (*Outcomes) Descriptor() ([]byte, []int) { - return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{22} + return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{23} } func (x *Outcomes) GetOutcomes() []*Outcome { @@ -1866,7 +1920,7 @@ type ReportInfo struct { func (x *ReportInfo) Reset() { *x = ReportInfo{} - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[23] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[24] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1878,7 +1932,7 @@ func (x *ReportInfo) String() string { func (*ReportInfo) ProtoMessage() {} func (x *ReportInfo) ProtoReflect() protoreflect.Message { - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[23] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[24] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1891,7 +1945,7 @@ func (x *ReportInfo) ProtoReflect() protoreflect.Message { // Deprecated: Use ReportInfo.ProtoReflect.Descriptor instead. func (*ReportInfo) Descriptor() ([]byte, []int) { - return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{23} + return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{24} } func (x *ReportInfo) GetId() string { @@ -1926,7 +1980,7 @@ type StoredSecret struct { func (x *StoredSecret) Reset() { *x = StoredSecret{} - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[24] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[25] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1938,7 +1992,7 @@ func (x *StoredSecret) String() string { func (*StoredSecret) ProtoMessage() {} func (x *StoredSecret) ProtoReflect() protoreflect.Message { - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[24] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[25] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1951,7 +2005,7 @@ func (x *StoredSecret) ProtoReflect() protoreflect.Message { // Deprecated: Use StoredSecret.ProtoReflect.Descriptor instead. func (*StoredSecret) Descriptor() ([]byte, []int) { - return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{24} + return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{25} } func (x *StoredSecret) GetEncryptedSecret() []byte { @@ -1972,7 +2026,7 @@ type StoredMetadata struct { func (x *StoredMetadata) Reset() { *x = StoredMetadata{} - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[25] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[26] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1984,7 +2038,7 @@ func (x *StoredMetadata) String() string { func (*StoredMetadata) ProtoMessage() {} func (x *StoredMetadata) ProtoReflect() protoreflect.Message { - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[25] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[26] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1997,7 +2051,7 @@ func (x *StoredMetadata) ProtoReflect() protoreflect.Message { // Deprecated: Use StoredMetadata.ProtoReflect.Descriptor instead. func (*StoredMetadata) Descriptor() ([]byte, []int) { - return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{25} + return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{26} } func (x *StoredMetadata) GetSecretIdentifiers() []*SecretIdentifier { @@ -2018,7 +2072,7 @@ type StoredPendingQueueIndex struct { func (x *StoredPendingQueueIndex) Reset() { *x = StoredPendingQueueIndex{} - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[26] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[27] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2030,7 +2084,7 @@ func (x *StoredPendingQueueIndex) String() string { func (*StoredPendingQueueIndex) ProtoMessage() {} func (x *StoredPendingQueueIndex) ProtoReflect() protoreflect.Message { - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[26] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[27] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2043,7 +2097,7 @@ func (x *StoredPendingQueueIndex) ProtoReflect() protoreflect.Message { // Deprecated: Use StoredPendingQueueIndex.ProtoReflect.Descriptor instead. func (*StoredPendingQueueIndex) Descriptor() ([]byte, []int) { - return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{26} + return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{27} } func (x *StoredPendingQueueIndex) GetLength() int64 { @@ -2065,7 +2119,7 @@ type StoredPendingQueueItem struct { func (x *StoredPendingQueueItem) Reset() { *x = StoredPendingQueueItem{} - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[27] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[28] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2077,7 +2131,7 @@ func (x *StoredPendingQueueItem) String() string { func (*StoredPendingQueueItem) ProtoMessage() {} func (x *StoredPendingQueueItem) ProtoReflect() protoreflect.Message { - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[27] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[28] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2090,7 +2144,7 @@ func (x *StoredPendingQueueItem) ProtoReflect() protoreflect.Message { // Deprecated: Use StoredPendingQueueItem.ProtoReflect.Descriptor instead. func (*StoredPendingQueueItem) Descriptor() ([]byte, []int) { - return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{27} + return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{28} } func (x *StoredPendingQueueItem) GetItem() *anypb.Any { @@ -2120,7 +2174,7 @@ type PendingQueueBlobItems struct { func (x *PendingQueueBlobItems) Reset() { *x = PendingQueueBlobItems{} - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[28] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[29] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2132,7 +2186,7 @@ func (x *PendingQueueBlobItems) String() string { func (*PendingQueueBlobItems) ProtoMessage() {} func (x *PendingQueueBlobItems) ProtoReflect() protoreflect.Message { - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[28] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[29] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2145,7 +2199,7 @@ func (x *PendingQueueBlobItems) ProtoReflect() protoreflect.Message { // Deprecated: Use PendingQueueBlobItems.ProtoReflect.Descriptor instead. func (*PendingQueueBlobItems) Descriptor() ([]byte, []int) { - return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{28} + return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{29} } func (x *PendingQueueBlobItems) GetItems() []*anypb.Any { @@ -2196,7 +2250,7 @@ type ReportingPluginConfig struct { func (x *ReportingPluginConfig) Reset() { *x = ReportingPluginConfig{} - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[29] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[30] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2208,7 +2262,7 @@ func (x *ReportingPluginConfig) String() string { func (*ReportingPluginConfig) ProtoMessage() {} func (x *ReportingPluginConfig) ProtoReflect() protoreflect.Message { - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[29] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[30] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2221,7 +2275,7 @@ func (x *ReportingPluginConfig) ProtoReflect() protoreflect.Message { // Deprecated: Use ReportingPluginConfig.ProtoReflect.Descriptor instead. func (*ReportingPluginConfig) Descriptor() ([]byte, []int) { - return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{29} + return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{30} } func (x *ReportingPluginConfig) GetBatchSize() int32 { @@ -2423,7 +2477,9 @@ const file_capabilities_actions_vault_messages_proto_rawDesc = "" + "\x1dListSecretIdentifiersResponse\x129\n" + "\videntifiers\x18\x01 \x03(\v2\x17.vault.SecretIdentifierR\videntifiers\x12\x18\n" + "\asuccess\x18\x02 \x01(\bR\asuccess\x12\x14\n" + - "\x05error\x18\x03 \x01(\tR\x05error\"\xec\a\n" + + "\x05error\x18\x03 \x01(\tR\x05error\",\n" + + "\x10ObservationError\x12\x18\n" + + "\amessage\x18\x01 \x01(\tR\amessage\"\x9b\b\n" + "\vObservation\x12\x0e\n" + "\x02id\x18\x01 \x01(\tR\x02id\x125\n" + "\frequest_type\x18\x02 \x01(\x0e2\x12.vault.RequestTypeR\vrequestType\x12S\n" + @@ -2437,7 +2493,8 @@ const file_capabilities_actions_vault_messages_proto_rawDesc = "" + "\x17update_secrets_response\x18\n" + " \x01(\v2\x1c.vault.UpdateSecretsResponseH\x01R\x15updateSecretsResponse\x12V\n" + "\x17delete_secrets_response\x18\v \x01(\v2\x1c.vault.DeleteSecretsResponseH\x01R\x15deleteSecretsResponse\x12o\n" + - " list_secret_identifiers_response\x18\f \x01(\v2$.vault.ListSecretIdentifiersResponseH\x01R\x1dlistSecretIdentifiersResponseB\t\n" + + " list_secret_identifiers_response\x18\f \x01(\v2$.vault.ListSecretIdentifiersResponseH\x01R\x1dlistSecretIdentifiersResponse\x12-\n" + + "\x05error\x18\r \x01(\v2\x17.vault.ObservationErrorR\x05errorB\t\n" + "\arequestB\n" + "\n" + "\bresponse\"\x94\x01\n" + @@ -2526,7 +2583,7 @@ func file_capabilities_actions_vault_messages_proto_rawDescGZIP() []byte { } var file_capabilities_actions_vault_messages_proto_enumTypes = make([]protoimpl.EnumInfo, 2) -var file_capabilities_actions_vault_messages_proto_msgTypes = make([]protoimpl.MessageInfo, 30) +var file_capabilities_actions_vault_messages_proto_msgTypes = make([]protoimpl.MessageInfo, 31) var file_capabilities_actions_vault_messages_proto_goTypes = []any{ (RequestType)(0), // 0: vault.RequestType (ReportFormat)(0), // 1: vault.ReportFormat @@ -2549,18 +2606,19 @@ var file_capabilities_actions_vault_messages_proto_goTypes = []any{ (*DeleteSecretsResponse)(nil), // 18: vault.DeleteSecretsResponse (*ListSecretIdentifiersRequest)(nil), // 19: vault.ListSecretIdentifiersRequest (*ListSecretIdentifiersResponse)(nil), // 20: vault.ListSecretIdentifiersResponse - (*Observation)(nil), // 21: vault.Observation - (*Observations)(nil), // 22: vault.Observations - (*Outcome)(nil), // 23: vault.Outcome - (*Outcomes)(nil), // 24: vault.Outcomes - (*ReportInfo)(nil), // 25: vault.ReportInfo - (*StoredSecret)(nil), // 26: vault.StoredSecret - (*StoredMetadata)(nil), // 27: vault.StoredMetadata - (*StoredPendingQueueIndex)(nil), // 28: vault.StoredPendingQueueIndex - (*StoredPendingQueueItem)(nil), // 29: vault.StoredPendingQueueItem - (*PendingQueueBlobItems)(nil), // 30: vault.PendingQueueBlobItems - (*ReportingPluginConfig)(nil), // 31: vault.ReportingPluginConfig - (*anypb.Any)(nil), // 32: google.protobuf.Any + (*ObservationError)(nil), // 21: vault.ObservationError + (*Observation)(nil), // 22: vault.Observation + (*Observations)(nil), // 23: vault.Observations + (*Outcome)(nil), // 24: vault.Outcome + (*Outcomes)(nil), // 25: vault.Outcomes + (*ReportInfo)(nil), // 26: vault.ReportInfo + (*StoredSecret)(nil), // 27: vault.StoredSecret + (*StoredMetadata)(nil), // 28: vault.StoredMetadata + (*StoredPendingQueueIndex)(nil), // 29: vault.StoredPendingQueueIndex + (*StoredPendingQueueItem)(nil), // 30: vault.StoredPendingQueueItem + (*PendingQueueBlobItems)(nil), // 31: vault.PendingQueueBlobItems + (*ReportingPluginConfig)(nil), // 32: vault.ReportingPluginConfig + (*anypb.Any)(nil), // 33: google.protobuf.Any } var file_capabilities_actions_vault_messages_proto_depIdxs = []int32{ 2, // 0: vault.SecretRequest.id:type_name -> vault.SecretIdentifier @@ -2591,29 +2649,30 @@ var file_capabilities_actions_vault_messages_proto_depIdxs = []int32{ 15, // 25: vault.Observation.update_secrets_response:type_name -> vault.UpdateSecretsResponse 18, // 26: vault.Observation.delete_secrets_response:type_name -> vault.DeleteSecretsResponse 20, // 27: vault.Observation.list_secret_identifiers_response:type_name -> vault.ListSecretIdentifiersResponse - 21, // 28: vault.Observations.observations:type_name -> vault.Observation - 0, // 29: vault.Outcome.request_type:type_name -> vault.RequestType - 10, // 30: vault.Outcome.create_secrets_request:type_name -> vault.CreateSecretsRequest - 7, // 31: vault.Outcome.get_secrets_request:type_name -> vault.GetSecretsRequest - 13, // 32: vault.Outcome.update_secrets_request:type_name -> vault.UpdateSecretsRequest - 16, // 33: vault.Outcome.delete_secrets_request:type_name -> vault.DeleteSecretsRequest - 19, // 34: vault.Outcome.list_secret_identifiers_request:type_name -> vault.ListSecretIdentifiersRequest - 12, // 35: vault.Outcome.create_secrets_response:type_name -> vault.CreateSecretsResponse - 8, // 36: vault.Outcome.get_secrets_response:type_name -> vault.GetSecretsResponse - 15, // 37: vault.Outcome.update_secrets_response:type_name -> vault.UpdateSecretsResponse - 18, // 38: vault.Outcome.delete_secrets_response:type_name -> vault.DeleteSecretsResponse - 20, // 39: vault.Outcome.list_secret_identifiers_response:type_name -> vault.ListSecretIdentifiersResponse - 23, // 40: vault.Outcomes.outcomes:type_name -> vault.Outcome - 0, // 41: vault.ReportInfo.request_type:type_name -> vault.RequestType - 1, // 42: vault.ReportInfo.format:type_name -> vault.ReportFormat - 2, // 43: vault.StoredMetadata.secret_identifiers:type_name -> vault.SecretIdentifier - 32, // 44: vault.StoredPendingQueueItem.item:type_name -> google.protobuf.Any - 32, // 45: vault.PendingQueueBlobItems.items:type_name -> google.protobuf.Any - 46, // [46:46] is the sub-list for method output_type - 46, // [46:46] is the sub-list for method input_type - 46, // [46:46] is the sub-list for extension type_name - 46, // [46:46] is the sub-list for extension extendee - 0, // [0:46] is the sub-list for field type_name + 21, // 28: vault.Observation.error:type_name -> vault.ObservationError + 22, // 29: vault.Observations.observations:type_name -> vault.Observation + 0, // 30: vault.Outcome.request_type:type_name -> vault.RequestType + 10, // 31: vault.Outcome.create_secrets_request:type_name -> vault.CreateSecretsRequest + 7, // 32: vault.Outcome.get_secrets_request:type_name -> vault.GetSecretsRequest + 13, // 33: vault.Outcome.update_secrets_request:type_name -> vault.UpdateSecretsRequest + 16, // 34: vault.Outcome.delete_secrets_request:type_name -> vault.DeleteSecretsRequest + 19, // 35: vault.Outcome.list_secret_identifiers_request:type_name -> vault.ListSecretIdentifiersRequest + 12, // 36: vault.Outcome.create_secrets_response:type_name -> vault.CreateSecretsResponse + 8, // 37: vault.Outcome.get_secrets_response:type_name -> vault.GetSecretsResponse + 15, // 38: vault.Outcome.update_secrets_response:type_name -> vault.UpdateSecretsResponse + 18, // 39: vault.Outcome.delete_secrets_response:type_name -> vault.DeleteSecretsResponse + 20, // 40: vault.Outcome.list_secret_identifiers_response:type_name -> vault.ListSecretIdentifiersResponse + 24, // 41: vault.Outcomes.outcomes:type_name -> vault.Outcome + 0, // 42: vault.ReportInfo.request_type:type_name -> vault.RequestType + 1, // 43: vault.ReportInfo.format:type_name -> vault.ReportFormat + 2, // 44: vault.StoredMetadata.secret_identifiers:type_name -> vault.SecretIdentifier + 33, // 45: vault.StoredPendingQueueItem.item:type_name -> google.protobuf.Any + 33, // 46: vault.PendingQueueBlobItems.items:type_name -> google.protobuf.Any + 47, // [47:47] is the sub-list for method output_type + 47, // [47:47] is the sub-list for method input_type + 47, // [47:47] is the sub-list for extension type_name + 47, // [47:47] is the sub-list for extension extendee + 0, // [0:47] is the sub-list for field type_name } func init() { file_capabilities_actions_vault_messages_proto_init() } @@ -2625,7 +2684,7 @@ func file_capabilities_actions_vault_messages_proto_init() { (*SecretResponse_Data)(nil), (*SecretResponse_Error)(nil), } - file_capabilities_actions_vault_messages_proto_msgTypes[19].OneofWrappers = []any{ + file_capabilities_actions_vault_messages_proto_msgTypes[20].OneofWrappers = []any{ (*Observation_CreateSecretsRequest)(nil), (*Observation_GetSecretsRequest)(nil), (*Observation_UpdateSecretsRequest)(nil), @@ -2637,7 +2696,7 @@ func file_capabilities_actions_vault_messages_proto_init() { (*Observation_DeleteSecretsResponse)(nil), (*Observation_ListSecretIdentifiersResponse)(nil), } - file_capabilities_actions_vault_messages_proto_msgTypes[21].OneofWrappers = []any{ + file_capabilities_actions_vault_messages_proto_msgTypes[22].OneofWrappers = []any{ (*Outcome_CreateSecretsRequest)(nil), (*Outcome_GetSecretsRequest)(nil), (*Outcome_UpdateSecretsRequest)(nil), @@ -2649,14 +2708,14 @@ func file_capabilities_actions_vault_messages_proto_init() { (*Outcome_DeleteSecretsResponse)(nil), (*Outcome_ListSecretIdentifiersResponse)(nil), } - file_capabilities_actions_vault_messages_proto_msgTypes[29].OneofWrappers = []any{} + file_capabilities_actions_vault_messages_proto_msgTypes[30].OneofWrappers = []any{} type x struct{} out := protoimpl.TypeBuilder{ File: protoimpl.DescBuilder{ GoPackagePath: reflect.TypeOf(x{}).PkgPath(), RawDescriptor: unsafe.Slice(unsafe.StringData(file_capabilities_actions_vault_messages_proto_rawDesc), len(file_capabilities_actions_vault_messages_proto_rawDesc)), NumEnums: 2, - NumMessages: 30, + NumMessages: 31, NumExtensions: 0, NumServices: 0, }, diff --git a/pkg/capabilities/actions/vault/messages.proto b/pkg/capabilities/actions/vault/messages.proto index f2f5367396..46d089f373 100644 --- a/pkg/capabilities/actions/vault/messages.proto +++ b/pkg/capabilities/actions/vault/messages.proto @@ -126,6 +126,12 @@ enum RequestType { LIST_SECRET_IDENTIFIERS = 5; } +// ObservationError is an item-level Err(E) contribution for a pending queue request. +// When set on Observation, the observation is an error contribution for that request id. +message ObservationError { + string message = 1; +} + message Observation { string id = 1; RequestType request_type = 2; @@ -145,6 +151,8 @@ message Observation { DeleteSecretsResponse delete_secrets_response = 11; ListSecretIdentifiersResponse list_secret_identifiers_response = 12; } + + ObservationError error = 13; } message Observations { diff --git a/pkg/capabilities/actions/vault/messages_test.go b/pkg/capabilities/actions/vault/messages_test.go new file mode 100644 index 0000000000..0618a8ce77 --- /dev/null +++ b/pkg/capabilities/actions/vault/messages_test.go @@ -0,0 +1,53 @@ +package vault + +import ( + "testing" + + "github.com/stretchr/testify/require" + "google.golang.org/protobuf/proto" +) + +func TestObservationErrorField_SHAStableForOkObservations(t *testing.T) { + t.Parallel() + + obs := &Observation{ + Id: "request-1", + RequestType: RequestType_DELETE_SECRETS, + Response: &Observation_DeleteSecretsResponse{ + DeleteSecretsResponse: &DeleteSecretsResponse{ + Responses: []*DeleteSecretResponse{{Success: false}}, + }, + }, + } + + before, err := proto.MarshalOptions{Deterministic: true}.Marshal(obs) + require.NoError(t, err) + + roundTrip := &Observation{} + require.NoError(t, proto.Unmarshal(before, roundTrip)) + require.Nil(t, roundTrip.GetError()) + + after, err := proto.MarshalOptions{Deterministic: true}.Marshal(roundTrip) + require.NoError(t, err) + require.Equal(t, before, after) +} + +func TestObservationErrorField_RoundTrip(t *testing.T) { + t.Parallel() + + obs := &Observation{ + Id: "request-1", + RequestType: RequestType_CREATE_SECRETS, + Error: &ObservationError{ + Message: "request is not valid", + }, + } + + b, err := proto.MarshalOptions{Deterministic: true}.Marshal(obs) + require.NoError(t, err) + + out := &Observation{} + require.NoError(t, proto.Unmarshal(b, out)) + require.Equal(t, "request is not valid", out.GetError().GetMessage()) + require.Nil(t, out.GetCreateSecretsResponse()) +} diff --git a/pkg/settings/cresettings/README.md b/pkg/settings/cresettings/README.md index ab0c176f39..5e64e4c3f3 100644 --- a/pkg/settings/cresettings/README.md +++ b/pkg/settings/cresettings/README.md @@ -46,6 +46,7 @@ flowchart VaultOwnerAddressCanonicalizationEnabled[/VaultOwnerAddressCanonicalizationEnabled\]:::gate VaultJSONOmitUnpopulatedEnabled[/VaultJSONOmitUnpopulatedEnabled\]:::gate VaultGetSecretsRelaxedConsensusEnabled[/VaultGetSecretsRelaxedConsensusEnabled\]:::gate + VaultSkipInvalidPendingItemsEnabled[/VaultSkipInvalidPendingItemsEnabled\]:::gate end subgraph HandleNodeMessage[gatewayHandler.HandleNodeMessage] diff --git a/pkg/settings/cresettings/defaults.json b/pkg/settings/cresettings/defaults.json index cc10485333..db82507917 100644 --- a/pkg/settings/cresettings/defaults.json +++ b/pkg/settings/cresettings/defaults.json @@ -13,6 +13,7 @@ "VaultOwnerAddressCanonicalizationEnabled": "false", "VaultJSONOmitUnpopulatedEnabled": "false", "VaultGetSecretsRelaxedConsensusEnabled": "false", + "VaultSkipInvalidPendingItemsEnabled": "false", "GatewayHTTPGlobalRate": "500rps:500", "GatewayHTTPPerNodeRate": "100rps:100", "GatewayConfidentialRelayGlobalRate": "50rps:10", diff --git a/pkg/settings/cresettings/defaults.toml b/pkg/settings/cresettings/defaults.toml index a1ecc9f562..8680982d82 100644 --- a/pkg/settings/cresettings/defaults.toml +++ b/pkg/settings/cresettings/defaults.toml @@ -12,6 +12,7 @@ VaultGetSecretsShareAggregationIncludesPublicKeys = 'false' VaultOwnerAddressCanonicalizationEnabled = 'false' VaultJSONOmitUnpopulatedEnabled = 'false' VaultGetSecretsRelaxedConsensusEnabled = 'false' +VaultSkipInvalidPendingItemsEnabled = 'false' GatewayHTTPGlobalRate = '500rps:500' GatewayHTTPPerNodeRate = '100rps:100' GatewayConfidentialRelayGlobalRate = '50rps:10' diff --git a/pkg/settings/cresettings/settings.go b/pkg/settings/cresettings/settings.go index 977086a8d8..5a1bfa6e06 100644 --- a/pkg/settings/cresettings/settings.go +++ b/pkg/settings/cresettings/settings.go @@ -67,6 +67,7 @@ var Default = Schema{ VaultOwnerAddressCanonicalizationEnabled: Bool(false), VaultJSONOmitUnpopulatedEnabled: Bool(false), VaultGetSecretsRelaxedConsensusEnabled: Bool(false), + VaultSkipInvalidPendingItemsEnabled: Bool(false), GatewayHTTPGlobalRate: Rate(rate.Limit(500), 500), GatewayHTTPPerNodeRate: Rate(rate.Limit(100), 100), GatewayConfidentialRelayGlobalRate: Rate(rate.Limit(50), 10), @@ -307,6 +308,7 @@ type Schema struct { VaultOwnerAddressCanonicalizationEnabled Setting[bool] VaultJSONOmitUnpopulatedEnabled Setting[bool] VaultGetSecretsRelaxedConsensusEnabled Setting[bool] + VaultSkipInvalidPendingItemsEnabled Setting[bool] GatewayHTTPGlobalRate Setting[config.Rate] GatewayHTTPPerNodeRate Setting[config.Rate] GatewayConfidentialRelayGlobalRate Setting[config.Rate] diff --git a/pkg/settings/cresettings/settings_test.go b/pkg/settings/cresettings/settings_test.go index be212351ec..7063fb6548 100644 --- a/pkg/settings/cresettings/settings_test.go +++ b/pkg/settings/cresettings/settings_test.go @@ -139,6 +139,7 @@ func TestSchema_Unmarshal(t *testing.T) { assert.False(t, cfg.VaultOwnerAddressCanonicalizationEnabled.DefaultValue) assert.False(t, cfg.VaultJSONOmitUnpopulatedEnabled.DefaultValue) assert.False(t, cfg.VaultGetSecretsRelaxedConsensusEnabled.DefaultValue) + assert.False(t, cfg.VaultSkipInvalidPendingItemsEnabled.DefaultValue) assert.Equal(t, config.Rate{Limit: rate.Limit(20), Burst: 7}, cfg.GatewayConfidentialRelayGlobalRate.DefaultValue) assert.Equal(t, config.Rate{Limit: rate.Limit(4), Burst: 2}, cfg.GatewayConfidentialRelayPerNodeRate.DefaultValue) assert.Equal(t, 48*time.Hour, cfg.PerOrg.ZeroBalancePruningTimeout.DefaultValue) From 4f0348e7898753899cba9b851cfe9275f548acb6 Mon Sep 17 00:00:00 2001 From: Russell Stern Date: Wed, 8 Jul 2026 12:05:41 -0400 Subject: [PATCH 08/10] Renamed feature flag --- pkg/settings/cresettings/README.md | 2 +- pkg/settings/cresettings/defaults.json | 2 +- pkg/settings/cresettings/defaults.toml | 2 +- pkg/settings/cresettings/settings.go | 4 ++-- pkg/settings/cresettings/settings_test.go | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) diff --git a/pkg/settings/cresettings/README.md b/pkg/settings/cresettings/README.md index 08287dcfd8..7f4965ff08 100644 --- a/pkg/settings/cresettings/README.md +++ b/pkg/settings/cresettings/README.md @@ -46,7 +46,7 @@ flowchart VaultOwnerAddressCanonicalizationEnabled[/VaultOwnerAddressCanonicalizationEnabled\]:::gate VaultJSONOmitUnpopulatedEnabled[/VaultJSONOmitUnpopulatedEnabled\]:::gate VaultGetSecretsRelaxedConsensusEnabled[/VaultGetSecretsRelaxedConsensusEnabled\]:::gate - VaultSkipInvalidPendingItemsEnabled[/VaultSkipInvalidPendingItemsEnabled\]:::gate + VaultIncludeInvalidPendingItemsEnabled[/VaultIncludeInvalidPendingItemsEnabled\]:::gate end subgraph HandleNodeMessage[gatewayHandler.HandleNodeMessage] diff --git a/pkg/settings/cresettings/defaults.json b/pkg/settings/cresettings/defaults.json index 975b5d534a..3fda57f3c6 100644 --- a/pkg/settings/cresettings/defaults.json +++ b/pkg/settings/cresettings/defaults.json @@ -13,7 +13,7 @@ "VaultOwnerAddressCanonicalizationEnabled": "false", "VaultJSONOmitUnpopulatedEnabled": "false", "VaultGetSecretsRelaxedConsensusEnabled": "false", - "VaultSkipInvalidPendingItemsEnabled": "false", + "VaultIncludeInvalidPendingItemsEnabled": "false", "GatewayHTTPGlobalRate": "500rps:500", "GatewayHTTPPerNodeRate": "100rps:100", "GatewayConfidentialRelayGlobalRate": "50rps:10", diff --git a/pkg/settings/cresettings/defaults.toml b/pkg/settings/cresettings/defaults.toml index ec5f542fdd..7bfcff863f 100644 --- a/pkg/settings/cresettings/defaults.toml +++ b/pkg/settings/cresettings/defaults.toml @@ -12,7 +12,7 @@ VaultGetSecretsShareAggregationIncludesPublicKeys = 'false' VaultOwnerAddressCanonicalizationEnabled = 'false' VaultJSONOmitUnpopulatedEnabled = 'false' VaultGetSecretsRelaxedConsensusEnabled = 'false' -VaultSkipInvalidPendingItemsEnabled = 'false' +VaultIncludeInvalidPendingItemsEnabled = 'false' GatewayHTTPGlobalRate = '500rps:500' GatewayHTTPPerNodeRate = '100rps:100' GatewayConfidentialRelayGlobalRate = '50rps:10' diff --git a/pkg/settings/cresettings/settings.go b/pkg/settings/cresettings/settings.go index ae2f7acde5..fa04ccecde 100644 --- a/pkg/settings/cresettings/settings.go +++ b/pkg/settings/cresettings/settings.go @@ -67,7 +67,7 @@ var Default = Schema{ VaultOwnerAddressCanonicalizationEnabled: Bool(false), VaultJSONOmitUnpopulatedEnabled: Bool(false), VaultGetSecretsRelaxedConsensusEnabled: Bool(false), - VaultSkipInvalidPendingItemsEnabled: Bool(false), + VaultIncludeInvalidPendingItemsEnabled: Bool(false), GatewayHTTPGlobalRate: Rate(rate.Limit(500), 500), GatewayHTTPPerNodeRate: Rate(rate.Limit(100), 100), GatewayConfidentialRelayGlobalRate: Rate(rate.Limit(50), 10), @@ -325,7 +325,7 @@ type Schema struct { VaultOwnerAddressCanonicalizationEnabled Setting[bool] VaultJSONOmitUnpopulatedEnabled Setting[bool] VaultGetSecretsRelaxedConsensusEnabled Setting[bool] - VaultSkipInvalidPendingItemsEnabled Setting[bool] + VaultIncludeInvalidPendingItemsEnabled Setting[bool] GatewayHTTPGlobalRate Setting[config.Rate] GatewayHTTPPerNodeRate Setting[config.Rate] GatewayConfidentialRelayGlobalRate Setting[config.Rate] diff --git a/pkg/settings/cresettings/settings_test.go b/pkg/settings/cresettings/settings_test.go index 7063fb6548..fa978136ac 100644 --- a/pkg/settings/cresettings/settings_test.go +++ b/pkg/settings/cresettings/settings_test.go @@ -139,7 +139,7 @@ func TestSchema_Unmarshal(t *testing.T) { assert.False(t, cfg.VaultOwnerAddressCanonicalizationEnabled.DefaultValue) assert.False(t, cfg.VaultJSONOmitUnpopulatedEnabled.DefaultValue) assert.False(t, cfg.VaultGetSecretsRelaxedConsensusEnabled.DefaultValue) - assert.False(t, cfg.VaultSkipInvalidPendingItemsEnabled.DefaultValue) + assert.False(t, cfg.VaultIncludeInvalidPendingItemsEnabled.DefaultValue) assert.Equal(t, config.Rate{Limit: rate.Limit(20), Burst: 7}, cfg.GatewayConfidentialRelayGlobalRate.DefaultValue) assert.Equal(t, config.Rate{Limit: rate.Limit(4), Burst: 2}, cfg.GatewayConfidentialRelayPerNodeRate.DefaultValue) assert.Equal(t, 48*time.Hour, cfg.PerOrg.ZeroBalancePruningTimeout.DefaultValue) From 90f44e787d9dc3f66b349d86fea886af6731354b Mon Sep 17 00:00:00 2001 From: Russell Stern Date: Mon, 13 Jul 2026 16:25:10 -0400 Subject: [PATCH 09/10] Added pending queue stall mechanism --- pkg/capabilities/actions/vault/messages.pb.go | 256 +++++++++++------- pkg/capabilities/actions/vault/messages.proto | 6 + .../actions/vault/messages_test.go | 31 +++ pkg/settings/cresettings/README.md | 1 + pkg/settings/cresettings/defaults.json | 1 + pkg/settings/cresettings/defaults.toml | 1 + pkg/settings/cresettings/settings.go | 2 + pkg/settings/cresettings/settings_test.go | 1 + 8 files changed, 201 insertions(+), 98 deletions(-) diff --git a/pkg/capabilities/actions/vault/messages.pb.go b/pkg/capabilities/actions/vault/messages.pb.go index 1c1e1b3ddc..ba1db9f1f7 100644 --- a/pkg/capabilities/actions/vault/messages.pb.go +++ b/pkg/capabilities/actions/vault/messages.pb.go @@ -80,6 +80,52 @@ func (RequestType) EnumDescriptor() ([]byte, []int) { return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{0} } +type PendingQueueStallSignal int32 + +const ( + PendingQueueStallSignal_PENDING_QUEUE_STALL_SIGNAL_CONTINUE PendingQueueStallSignal = 0 + PendingQueueStallSignal_PENDING_QUEUE_STALL_SIGNAL_STALLED PendingQueueStallSignal = 1 +) + +// Enum value maps for PendingQueueStallSignal. +var ( + PendingQueueStallSignal_name = map[int32]string{ + 0: "PENDING_QUEUE_STALL_SIGNAL_CONTINUE", + 1: "PENDING_QUEUE_STALL_SIGNAL_STALLED", + } + PendingQueueStallSignal_value = map[string]int32{ + "PENDING_QUEUE_STALL_SIGNAL_CONTINUE": 0, + "PENDING_QUEUE_STALL_SIGNAL_STALLED": 1, + } +) + +func (x PendingQueueStallSignal) Enum() *PendingQueueStallSignal { + p := new(PendingQueueStallSignal) + *p = x + return p +} + +func (x PendingQueueStallSignal) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (PendingQueueStallSignal) Descriptor() protoreflect.EnumDescriptor { + return file_capabilities_actions_vault_messages_proto_enumTypes[1].Descriptor() +} + +func (PendingQueueStallSignal) Type() protoreflect.EnumType { + return &file_capabilities_actions_vault_messages_proto_enumTypes[1] +} + +func (x PendingQueueStallSignal) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use PendingQueueStallSignal.Descriptor instead. +func (PendingQueueStallSignal) EnumDescriptor() ([]byte, []int) { + return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{1} +} + type ReportFormat int32 const ( @@ -113,11 +159,11 @@ func (x ReportFormat) String() string { } func (ReportFormat) Descriptor() protoreflect.EnumDescriptor { - return file_capabilities_actions_vault_messages_proto_enumTypes[1].Descriptor() + return file_capabilities_actions_vault_messages_proto_enumTypes[2].Descriptor() } func (ReportFormat) Type() protoreflect.EnumType { - return &file_capabilities_actions_vault_messages_proto_enumTypes[1] + return &file_capabilities_actions_vault_messages_proto_enumTypes[2] } func (x ReportFormat) Number() protoreflect.EnumNumber { @@ -126,7 +172,7 @@ func (x ReportFormat) Number() protoreflect.EnumNumber { // Deprecated: Use ReportFormat.Descriptor instead. func (ReportFormat) EnumDescriptor() ([]byte, []int) { - return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{1} + return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{2} } type SecretIdentifier struct { @@ -1566,12 +1612,13 @@ func (*Observation_DeleteSecretsResponse) isObservation_Response() {} func (*Observation_ListSecretIdentifiersResponse) isObservation_Response() {} type Observations struct { - state protoimpl.MessageState `protogen:"open.v1"` - Observations []*Observation `protobuf:"bytes,1,rep,name=observations,proto3" json:"observations,omitempty"` - PendingQueueItems [][]byte `protobuf:"bytes,2,rep,name=pending_queue_items,json=pendingQueueItems,proto3" json:"pending_queue_items,omitempty"` - SortNonce []byte `protobuf:"bytes,3,opt,name=sortNonce,proto3" json:"sortNonce,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache + state protoimpl.MessageState `protogen:"open.v1"` + Observations []*Observation `protobuf:"bytes,1,rep,name=observations,proto3" json:"observations,omitempty"` + PendingQueueItems [][]byte `protobuf:"bytes,2,rep,name=pending_queue_items,json=pendingQueueItems,proto3" json:"pending_queue_items,omitempty"` + SortNonce []byte `protobuf:"bytes,3,opt,name=sortNonce,proto3" json:"sortNonce,omitempty"` + PendingQueueStallSignal PendingQueueStallSignal `protobuf:"varint,4,opt,name=pending_queue_stall_signal,json=pendingQueueStallSignal,proto3,enum=vault.PendingQueueStallSignal" json:"pending_queue_stall_signal,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache } func (x *Observations) Reset() { @@ -1625,6 +1672,13 @@ func (x *Observations) GetSortNonce() []byte { return nil } +func (x *Observations) GetPendingQueueStallSignal() PendingQueueStallSignal { + if x != nil { + return x.PendingQueueStallSignal + } + return PendingQueueStallSignal_PENDING_QUEUE_STALL_SIGNAL_CONTINUE +} + type Outcome struct { state protoimpl.MessageState `protogen:"open.v1"` Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` @@ -2497,11 +2551,12 @@ const file_capabilities_actions_vault_messages_proto_rawDesc = "" + "\x05error\x18\r \x01(\v2\x17.vault.ObservationErrorR\x05errorB\t\n" + "\arequestB\n" + "\n" + - "\bresponse\"\x94\x01\n" + + "\bresponse\"\xf1\x01\n" + "\fObservations\x126\n" + "\fobservations\x18\x01 \x03(\v2\x12.vault.ObservationR\fobservations\x12.\n" + "\x13pending_queue_items\x18\x02 \x03(\fR\x11pendingQueueItems\x12\x1c\n" + - "\tsortNonce\x18\x03 \x01(\fR\tsortNonce\"\xe8\a\n" + + "\tsortNonce\x18\x03 \x01(\fR\tsortNonce\x12[\n" + + "\x1apending_queue_stall_signal\x18\x04 \x01(\x0e2\x1e.vault.PendingQueueStallSignalR\x17pendingQueueStallSignal\"\xe8\a\n" + "\aOutcome\x12\x0e\n" + "\x02id\x18\x01 \x01(\tR\x02id\x125\n" + "\frequest_type\x18\x02 \x01(\x0e2\x12.vault.RequestTypeR\vrequestType\x12S\n" + @@ -2564,7 +2619,10 @@ const file_capabilities_actions_vault_messages_proto_rawDesc = "" + "\x0eCREATE_SECRETS\x10\x02\x12\x12\n" + "\x0eUPDATE_SECRETS\x10\x03\x12\x12\n" + "\x0eDELETE_SECRETS\x10\x04\x12\x1b\n" + - "\x17LIST_SECRET_IDENTIFIERS\x10\x05*]\n" + + "\x17LIST_SECRET_IDENTIFIERS\x10\x05*j\n" + + "\x17PendingQueueStallSignal\x12'\n" + + "#PENDING_QUEUE_STALL_SIGNAL_CONTINUE\x10\x00\x12&\n" + + "\"PENDING_QUEUE_STALL_SIGNAL_STALLED\x10\x01*]\n" + "\fReportFormat\x12\x19\n" + "\x15REPORT_FORMAT_UNKNOWN\x10\x00\x12\x16\n" + "\x12REPORT_FORMAT_JSON\x10\x01\x12\x1a\n" + @@ -2582,97 +2640,99 @@ func file_capabilities_actions_vault_messages_proto_rawDescGZIP() []byte { return file_capabilities_actions_vault_messages_proto_rawDescData } -var file_capabilities_actions_vault_messages_proto_enumTypes = make([]protoimpl.EnumInfo, 2) +var file_capabilities_actions_vault_messages_proto_enumTypes = make([]protoimpl.EnumInfo, 3) var file_capabilities_actions_vault_messages_proto_msgTypes = make([]protoimpl.MessageInfo, 31) var file_capabilities_actions_vault_messages_proto_goTypes = []any{ (RequestType)(0), // 0: vault.RequestType - (ReportFormat)(0), // 1: vault.ReportFormat - (*SecretIdentifier)(nil), // 2: vault.SecretIdentifier - (*SecretRequest)(nil), // 3: vault.SecretRequest - (*EncryptedShares)(nil), // 4: vault.EncryptedShares - (*SecretData)(nil), // 5: vault.SecretData - (*SecretResponse)(nil), // 6: vault.SecretResponse - (*GetSecretsRequest)(nil), // 7: vault.GetSecretsRequest - (*GetSecretsResponse)(nil), // 8: vault.GetSecretsResponse - (*EncryptedSecret)(nil), // 9: vault.EncryptedSecret - (*CreateSecretsRequest)(nil), // 10: vault.CreateSecretsRequest - (*CreateSecretResponse)(nil), // 11: vault.CreateSecretResponse - (*CreateSecretsResponse)(nil), // 12: vault.CreateSecretsResponse - (*UpdateSecretsRequest)(nil), // 13: vault.UpdateSecretsRequest - (*UpdateSecretResponse)(nil), // 14: vault.UpdateSecretResponse - (*UpdateSecretsResponse)(nil), // 15: vault.UpdateSecretsResponse - (*DeleteSecretsRequest)(nil), // 16: vault.DeleteSecretsRequest - (*DeleteSecretResponse)(nil), // 17: vault.DeleteSecretResponse - (*DeleteSecretsResponse)(nil), // 18: vault.DeleteSecretsResponse - (*ListSecretIdentifiersRequest)(nil), // 19: vault.ListSecretIdentifiersRequest - (*ListSecretIdentifiersResponse)(nil), // 20: vault.ListSecretIdentifiersResponse - (*ObservationError)(nil), // 21: vault.ObservationError - (*Observation)(nil), // 22: vault.Observation - (*Observations)(nil), // 23: vault.Observations - (*Outcome)(nil), // 24: vault.Outcome - (*Outcomes)(nil), // 25: vault.Outcomes - (*ReportInfo)(nil), // 26: vault.ReportInfo - (*StoredSecret)(nil), // 27: vault.StoredSecret - (*StoredMetadata)(nil), // 28: vault.StoredMetadata - (*StoredPendingQueueIndex)(nil), // 29: vault.StoredPendingQueueIndex - (*StoredPendingQueueItem)(nil), // 30: vault.StoredPendingQueueItem - (*PendingQueueBlobItems)(nil), // 31: vault.PendingQueueBlobItems - (*ReportingPluginConfig)(nil), // 32: vault.ReportingPluginConfig - (*anypb.Any)(nil), // 33: google.protobuf.Any + (PendingQueueStallSignal)(0), // 1: vault.PendingQueueStallSignal + (ReportFormat)(0), // 2: vault.ReportFormat + (*SecretIdentifier)(nil), // 3: vault.SecretIdentifier + (*SecretRequest)(nil), // 4: vault.SecretRequest + (*EncryptedShares)(nil), // 5: vault.EncryptedShares + (*SecretData)(nil), // 6: vault.SecretData + (*SecretResponse)(nil), // 7: vault.SecretResponse + (*GetSecretsRequest)(nil), // 8: vault.GetSecretsRequest + (*GetSecretsResponse)(nil), // 9: vault.GetSecretsResponse + (*EncryptedSecret)(nil), // 10: vault.EncryptedSecret + (*CreateSecretsRequest)(nil), // 11: vault.CreateSecretsRequest + (*CreateSecretResponse)(nil), // 12: vault.CreateSecretResponse + (*CreateSecretsResponse)(nil), // 13: vault.CreateSecretsResponse + (*UpdateSecretsRequest)(nil), // 14: vault.UpdateSecretsRequest + (*UpdateSecretResponse)(nil), // 15: vault.UpdateSecretResponse + (*UpdateSecretsResponse)(nil), // 16: vault.UpdateSecretsResponse + (*DeleteSecretsRequest)(nil), // 17: vault.DeleteSecretsRequest + (*DeleteSecretResponse)(nil), // 18: vault.DeleteSecretResponse + (*DeleteSecretsResponse)(nil), // 19: vault.DeleteSecretsResponse + (*ListSecretIdentifiersRequest)(nil), // 20: vault.ListSecretIdentifiersRequest + (*ListSecretIdentifiersResponse)(nil), // 21: vault.ListSecretIdentifiersResponse + (*ObservationError)(nil), // 22: vault.ObservationError + (*Observation)(nil), // 23: vault.Observation + (*Observations)(nil), // 24: vault.Observations + (*Outcome)(nil), // 25: vault.Outcome + (*Outcomes)(nil), // 26: vault.Outcomes + (*ReportInfo)(nil), // 27: vault.ReportInfo + (*StoredSecret)(nil), // 28: vault.StoredSecret + (*StoredMetadata)(nil), // 29: vault.StoredMetadata + (*StoredPendingQueueIndex)(nil), // 30: vault.StoredPendingQueueIndex + (*StoredPendingQueueItem)(nil), // 31: vault.StoredPendingQueueItem + (*PendingQueueBlobItems)(nil), // 32: vault.PendingQueueBlobItems + (*ReportingPluginConfig)(nil), // 33: vault.ReportingPluginConfig + (*anypb.Any)(nil), // 34: google.protobuf.Any } var file_capabilities_actions_vault_messages_proto_depIdxs = []int32{ - 2, // 0: vault.SecretRequest.id:type_name -> vault.SecretIdentifier - 4, // 1: vault.SecretData.encrypted_decryption_key_shares:type_name -> vault.EncryptedShares - 2, // 2: vault.SecretResponse.id:type_name -> vault.SecretIdentifier - 5, // 3: vault.SecretResponse.data:type_name -> vault.SecretData - 3, // 4: vault.GetSecretsRequest.requests:type_name -> vault.SecretRequest - 6, // 5: vault.GetSecretsResponse.responses:type_name -> vault.SecretResponse - 2, // 6: vault.EncryptedSecret.id:type_name -> vault.SecretIdentifier - 9, // 7: vault.CreateSecretsRequest.encrypted_secrets:type_name -> vault.EncryptedSecret - 2, // 8: vault.CreateSecretResponse.id:type_name -> vault.SecretIdentifier - 11, // 9: vault.CreateSecretsResponse.responses:type_name -> vault.CreateSecretResponse - 9, // 10: vault.UpdateSecretsRequest.encrypted_secrets:type_name -> vault.EncryptedSecret - 2, // 11: vault.UpdateSecretResponse.id:type_name -> vault.SecretIdentifier - 14, // 12: vault.UpdateSecretsResponse.responses:type_name -> vault.UpdateSecretResponse - 2, // 13: vault.DeleteSecretsRequest.ids:type_name -> vault.SecretIdentifier - 2, // 14: vault.DeleteSecretResponse.id:type_name -> vault.SecretIdentifier - 17, // 15: vault.DeleteSecretsResponse.responses:type_name -> vault.DeleteSecretResponse - 2, // 16: vault.ListSecretIdentifiersResponse.identifiers:type_name -> vault.SecretIdentifier + 3, // 0: vault.SecretRequest.id:type_name -> vault.SecretIdentifier + 5, // 1: vault.SecretData.encrypted_decryption_key_shares:type_name -> vault.EncryptedShares + 3, // 2: vault.SecretResponse.id:type_name -> vault.SecretIdentifier + 6, // 3: vault.SecretResponse.data:type_name -> vault.SecretData + 4, // 4: vault.GetSecretsRequest.requests:type_name -> vault.SecretRequest + 7, // 5: vault.GetSecretsResponse.responses:type_name -> vault.SecretResponse + 3, // 6: vault.EncryptedSecret.id:type_name -> vault.SecretIdentifier + 10, // 7: vault.CreateSecretsRequest.encrypted_secrets:type_name -> vault.EncryptedSecret + 3, // 8: vault.CreateSecretResponse.id:type_name -> vault.SecretIdentifier + 12, // 9: vault.CreateSecretsResponse.responses:type_name -> vault.CreateSecretResponse + 10, // 10: vault.UpdateSecretsRequest.encrypted_secrets:type_name -> vault.EncryptedSecret + 3, // 11: vault.UpdateSecretResponse.id:type_name -> vault.SecretIdentifier + 15, // 12: vault.UpdateSecretsResponse.responses:type_name -> vault.UpdateSecretResponse + 3, // 13: vault.DeleteSecretsRequest.ids:type_name -> vault.SecretIdentifier + 3, // 14: vault.DeleteSecretResponse.id:type_name -> vault.SecretIdentifier + 18, // 15: vault.DeleteSecretsResponse.responses:type_name -> vault.DeleteSecretResponse + 3, // 16: vault.ListSecretIdentifiersResponse.identifiers:type_name -> vault.SecretIdentifier 0, // 17: vault.Observation.request_type:type_name -> vault.RequestType - 10, // 18: vault.Observation.create_secrets_request:type_name -> vault.CreateSecretsRequest - 7, // 19: vault.Observation.get_secrets_request:type_name -> vault.GetSecretsRequest - 13, // 20: vault.Observation.update_secrets_request:type_name -> vault.UpdateSecretsRequest - 16, // 21: vault.Observation.delete_secrets_request:type_name -> vault.DeleteSecretsRequest - 19, // 22: vault.Observation.list_secret_identifiers_request:type_name -> vault.ListSecretIdentifiersRequest - 12, // 23: vault.Observation.create_secrets_response:type_name -> vault.CreateSecretsResponse - 8, // 24: vault.Observation.get_secrets_response:type_name -> vault.GetSecretsResponse - 15, // 25: vault.Observation.update_secrets_response:type_name -> vault.UpdateSecretsResponse - 18, // 26: vault.Observation.delete_secrets_response:type_name -> vault.DeleteSecretsResponse - 20, // 27: vault.Observation.list_secret_identifiers_response:type_name -> vault.ListSecretIdentifiersResponse - 21, // 28: vault.Observation.error:type_name -> vault.ObservationError - 22, // 29: vault.Observations.observations:type_name -> vault.Observation - 0, // 30: vault.Outcome.request_type:type_name -> vault.RequestType - 10, // 31: vault.Outcome.create_secrets_request:type_name -> vault.CreateSecretsRequest - 7, // 32: vault.Outcome.get_secrets_request:type_name -> vault.GetSecretsRequest - 13, // 33: vault.Outcome.update_secrets_request:type_name -> vault.UpdateSecretsRequest - 16, // 34: vault.Outcome.delete_secrets_request:type_name -> vault.DeleteSecretsRequest - 19, // 35: vault.Outcome.list_secret_identifiers_request:type_name -> vault.ListSecretIdentifiersRequest - 12, // 36: vault.Outcome.create_secrets_response:type_name -> vault.CreateSecretsResponse - 8, // 37: vault.Outcome.get_secrets_response:type_name -> vault.GetSecretsResponse - 15, // 38: vault.Outcome.update_secrets_response:type_name -> vault.UpdateSecretsResponse - 18, // 39: vault.Outcome.delete_secrets_response:type_name -> vault.DeleteSecretsResponse - 20, // 40: vault.Outcome.list_secret_identifiers_response:type_name -> vault.ListSecretIdentifiersResponse - 24, // 41: vault.Outcomes.outcomes:type_name -> vault.Outcome - 0, // 42: vault.ReportInfo.request_type:type_name -> vault.RequestType - 1, // 43: vault.ReportInfo.format:type_name -> vault.ReportFormat - 2, // 44: vault.StoredMetadata.secret_identifiers:type_name -> vault.SecretIdentifier - 33, // 45: vault.StoredPendingQueueItem.item:type_name -> google.protobuf.Any - 33, // 46: vault.PendingQueueBlobItems.items:type_name -> google.protobuf.Any - 47, // [47:47] is the sub-list for method output_type - 47, // [47:47] is the sub-list for method input_type - 47, // [47:47] is the sub-list for extension type_name - 47, // [47:47] is the sub-list for extension extendee - 0, // [0:47] is the sub-list for field type_name + 11, // 18: vault.Observation.create_secrets_request:type_name -> vault.CreateSecretsRequest + 8, // 19: vault.Observation.get_secrets_request:type_name -> vault.GetSecretsRequest + 14, // 20: vault.Observation.update_secrets_request:type_name -> vault.UpdateSecretsRequest + 17, // 21: vault.Observation.delete_secrets_request:type_name -> vault.DeleteSecretsRequest + 20, // 22: vault.Observation.list_secret_identifiers_request:type_name -> vault.ListSecretIdentifiersRequest + 13, // 23: vault.Observation.create_secrets_response:type_name -> vault.CreateSecretsResponse + 9, // 24: vault.Observation.get_secrets_response:type_name -> vault.GetSecretsResponse + 16, // 25: vault.Observation.update_secrets_response:type_name -> vault.UpdateSecretsResponse + 19, // 26: vault.Observation.delete_secrets_response:type_name -> vault.DeleteSecretsResponse + 21, // 27: vault.Observation.list_secret_identifiers_response:type_name -> vault.ListSecretIdentifiersResponse + 22, // 28: vault.Observation.error:type_name -> vault.ObservationError + 23, // 29: vault.Observations.observations:type_name -> vault.Observation + 1, // 30: vault.Observations.pending_queue_stall_signal:type_name -> vault.PendingQueueStallSignal + 0, // 31: vault.Outcome.request_type:type_name -> vault.RequestType + 11, // 32: vault.Outcome.create_secrets_request:type_name -> vault.CreateSecretsRequest + 8, // 33: vault.Outcome.get_secrets_request:type_name -> vault.GetSecretsRequest + 14, // 34: vault.Outcome.update_secrets_request:type_name -> vault.UpdateSecretsRequest + 17, // 35: vault.Outcome.delete_secrets_request:type_name -> vault.DeleteSecretsRequest + 20, // 36: vault.Outcome.list_secret_identifiers_request:type_name -> vault.ListSecretIdentifiersRequest + 13, // 37: vault.Outcome.create_secrets_response:type_name -> vault.CreateSecretsResponse + 9, // 38: vault.Outcome.get_secrets_response:type_name -> vault.GetSecretsResponse + 16, // 39: vault.Outcome.update_secrets_response:type_name -> vault.UpdateSecretsResponse + 19, // 40: vault.Outcome.delete_secrets_response:type_name -> vault.DeleteSecretsResponse + 21, // 41: vault.Outcome.list_secret_identifiers_response:type_name -> vault.ListSecretIdentifiersResponse + 25, // 42: vault.Outcomes.outcomes:type_name -> vault.Outcome + 0, // 43: vault.ReportInfo.request_type:type_name -> vault.RequestType + 2, // 44: vault.ReportInfo.format:type_name -> vault.ReportFormat + 3, // 45: vault.StoredMetadata.secret_identifiers:type_name -> vault.SecretIdentifier + 34, // 46: vault.StoredPendingQueueItem.item:type_name -> google.protobuf.Any + 34, // 47: vault.PendingQueueBlobItems.items:type_name -> google.protobuf.Any + 48, // [48:48] is the sub-list for method output_type + 48, // [48:48] is the sub-list for method input_type + 48, // [48:48] is the sub-list for extension type_name + 48, // [48:48] is the sub-list for extension extendee + 0, // [0:48] is the sub-list for field type_name } func init() { file_capabilities_actions_vault_messages_proto_init() } @@ -2714,7 +2774,7 @@ func file_capabilities_actions_vault_messages_proto_init() { File: protoimpl.DescBuilder{ GoPackagePath: reflect.TypeOf(x{}).PkgPath(), RawDescriptor: unsafe.Slice(unsafe.StringData(file_capabilities_actions_vault_messages_proto_rawDesc), len(file_capabilities_actions_vault_messages_proto_rawDesc)), - NumEnums: 2, + NumEnums: 3, NumMessages: 31, NumExtensions: 0, NumServices: 0, diff --git a/pkg/capabilities/actions/vault/messages.proto b/pkg/capabilities/actions/vault/messages.proto index 46d089f373..25ecac4acb 100644 --- a/pkg/capabilities/actions/vault/messages.proto +++ b/pkg/capabilities/actions/vault/messages.proto @@ -155,10 +155,16 @@ message Observation { ObservationError error = 13; } +enum PendingQueueStallSignal { + PENDING_QUEUE_STALL_SIGNAL_CONTINUE = 0; + PENDING_QUEUE_STALL_SIGNAL_STALLED = 1; +} + message Observations { repeated Observation observations = 1; repeated bytes pending_queue_items = 2; bytes sortNonce = 3; + PendingQueueStallSignal pending_queue_stall_signal = 4; } message Outcome { diff --git a/pkg/capabilities/actions/vault/messages_test.go b/pkg/capabilities/actions/vault/messages_test.go index 0618a8ce77..78dd7e1c52 100644 --- a/pkg/capabilities/actions/vault/messages_test.go +++ b/pkg/capabilities/actions/vault/messages_test.go @@ -51,3 +51,34 @@ func TestObservationErrorField_RoundTrip(t *testing.T) { require.Equal(t, "request is not valid", out.GetError().GetMessage()) require.Nil(t, out.GetCreateSecretsResponse()) } + +func TestPendingQueueStallSignal_DefaultIsWireStable(t *testing.T) { + t.Parallel() + + obs := &Observations{SortNonce: make([]byte, 32)} + before, err := proto.MarshalOptions{Deterministic: true}.Marshal(obs) + require.NoError(t, err) + + roundTrip := &Observations{} + require.NoError(t, proto.Unmarshal(before, roundTrip)) + require.Equal(t, PendingQueueStallSignal_PENDING_QUEUE_STALL_SIGNAL_CONTINUE, roundTrip.GetPendingQueueStallSignal()) + + after, err := proto.MarshalOptions{Deterministic: true}.Marshal(roundTrip) + require.NoError(t, err) + require.Equal(t, before, after) +} + +func TestPendingQueueStallSignal_RoundTrip(t *testing.T) { + t.Parallel() + + obs := &Observations{ + SortNonce: make([]byte, 32), + PendingQueueStallSignal: PendingQueueStallSignal_PENDING_QUEUE_STALL_SIGNAL_STALLED, + } + b, err := proto.MarshalOptions{Deterministic: true}.Marshal(obs) + require.NoError(t, err) + + out := &Observations{} + require.NoError(t, proto.Unmarshal(b, out)) + require.Equal(t, PendingQueueStallSignal_PENDING_QUEUE_STALL_SIGNAL_STALLED, out.GetPendingQueueStallSignal()) +} diff --git a/pkg/settings/cresettings/README.md b/pkg/settings/cresettings/README.md index 7f4965ff08..2cc37a6031 100644 --- a/pkg/settings/cresettings/README.md +++ b/pkg/settings/cresettings/README.md @@ -47,6 +47,7 @@ flowchart VaultJSONOmitUnpopulatedEnabled[/VaultJSONOmitUnpopulatedEnabled\]:::gate VaultGetSecretsRelaxedConsensusEnabled[/VaultGetSecretsRelaxedConsensusEnabled\]:::gate VaultIncludeInvalidPendingItemsEnabled[/VaultIncludeInvalidPendingItemsEnabled\]:::gate + VaultPendingQueueStallThreshold{{VaultPendingQueueStallThreshold}}:::bound end subgraph HandleNodeMessage[gatewayHandler.HandleNodeMessage] diff --git a/pkg/settings/cresettings/defaults.json b/pkg/settings/cresettings/defaults.json index 3fda57f3c6..b1e98bf896 100644 --- a/pkg/settings/cresettings/defaults.json +++ b/pkg/settings/cresettings/defaults.json @@ -14,6 +14,7 @@ "VaultJSONOmitUnpopulatedEnabled": "false", "VaultGetSecretsRelaxedConsensusEnabled": "false", "VaultIncludeInvalidPendingItemsEnabled": "false", + "VaultPendingQueueStallThreshold": "0", "GatewayHTTPGlobalRate": "500rps:500", "GatewayHTTPPerNodeRate": "100rps:100", "GatewayConfidentialRelayGlobalRate": "50rps:10", diff --git a/pkg/settings/cresettings/defaults.toml b/pkg/settings/cresettings/defaults.toml index 7bfcff863f..00122e393b 100644 --- a/pkg/settings/cresettings/defaults.toml +++ b/pkg/settings/cresettings/defaults.toml @@ -13,6 +13,7 @@ VaultOwnerAddressCanonicalizationEnabled = 'false' VaultJSONOmitUnpopulatedEnabled = 'false' VaultGetSecretsRelaxedConsensusEnabled = 'false' VaultIncludeInvalidPendingItemsEnabled = 'false' +VaultPendingQueueStallThreshold = '0' GatewayHTTPGlobalRate = '500rps:500' GatewayHTTPPerNodeRate = '100rps:100' GatewayConfidentialRelayGlobalRate = '50rps:10' diff --git a/pkg/settings/cresettings/settings.go b/pkg/settings/cresettings/settings.go index fa04ccecde..91bb931cb9 100644 --- a/pkg/settings/cresettings/settings.go +++ b/pkg/settings/cresettings/settings.go @@ -68,6 +68,7 @@ var Default = Schema{ VaultJSONOmitUnpopulatedEnabled: Bool(false), VaultGetSecretsRelaxedConsensusEnabled: Bool(false), VaultIncludeInvalidPendingItemsEnabled: Bool(false), + VaultPendingQueueStallThreshold: Int(0), GatewayHTTPGlobalRate: Rate(rate.Limit(500), 500), GatewayHTTPPerNodeRate: Rate(rate.Limit(100), 100), GatewayConfidentialRelayGlobalRate: Rate(rate.Limit(50), 10), @@ -326,6 +327,7 @@ type Schema struct { VaultJSONOmitUnpopulatedEnabled Setting[bool] VaultGetSecretsRelaxedConsensusEnabled Setting[bool] VaultIncludeInvalidPendingItemsEnabled Setting[bool] + VaultPendingQueueStallThreshold Setting[int] `unit:"{observation}"` GatewayHTTPGlobalRate Setting[config.Rate] GatewayHTTPPerNodeRate Setting[config.Rate] GatewayConfidentialRelayGlobalRate Setting[config.Rate] diff --git a/pkg/settings/cresettings/settings_test.go b/pkg/settings/cresettings/settings_test.go index fa978136ac..4ce56f7f24 100644 --- a/pkg/settings/cresettings/settings_test.go +++ b/pkg/settings/cresettings/settings_test.go @@ -140,6 +140,7 @@ func TestSchema_Unmarshal(t *testing.T) { assert.False(t, cfg.VaultJSONOmitUnpopulatedEnabled.DefaultValue) assert.False(t, cfg.VaultGetSecretsRelaxedConsensusEnabled.DefaultValue) assert.False(t, cfg.VaultIncludeInvalidPendingItemsEnabled.DefaultValue) + assert.Equal(t, 0, cfg.VaultPendingQueueStallThreshold.DefaultValue) assert.Equal(t, config.Rate{Limit: rate.Limit(20), Burst: 7}, cfg.GatewayConfidentialRelayGlobalRate.DefaultValue) assert.Equal(t, config.Rate{Limit: rate.Limit(4), Burst: 2}, cfg.GatewayConfidentialRelayPerNodeRate.DefaultValue) assert.Equal(t, 48*time.Hour, cfg.PerOrg.ZeroBalancePruningTimeout.DefaultValue) From 9ae7e5f057623883942c252eaaa332d76fde9ad9 Mon Sep 17 00:00:00 2001 From: Russell Stern Date: Mon, 13 Jul 2026 16:39:21 -0400 Subject: [PATCH 10/10] Ran make generate --- pkg/capabilities/actions/vault/messages.pb.go | 28 +++++++++---------- 1 file changed, 13 insertions(+), 15 deletions(-) diff --git a/pkg/capabilities/actions/vault/messages.pb.go b/pkg/capabilities/actions/vault/messages.pb.go index cd58a9ea55..6bce231821 100644 --- a/pkg/capabilities/actions/vault/messages.pb.go +++ b/pkg/capabilities/actions/vault/messages.pb.go @@ -7,13 +7,12 @@ package vault import ( - reflect "reflect" - sync "sync" - unsafe "unsafe" - protoreflect "google.golang.org/protobuf/reflect/protoreflect" protoimpl "google.golang.org/protobuf/runtime/protoimpl" anypb "google.golang.org/protobuf/types/known/anypb" + reflect "reflect" + sync "sync" + unsafe "unsafe" ) const ( @@ -1343,6 +1342,13 @@ func (x *ListSecretIdentifiersResponse) GetError() string { return "" } +func (x *ListSecretIdentifiersResponse) GetRequestId() string { + if x != nil { + return x.RequestId + } + return "" +} + // ObservationError is an item-level Err(E) contribution for a pending queue request. // When set on Observation, the observation is an error contribution for that request id. type ObservationError struct { @@ -1389,13 +1395,6 @@ func (x *ObservationError) GetMessage() string { return "" } -func (x *ListSecretIdentifiersResponse) GetRequestId() string { - if x != nil { - return x.RequestId - } - return "" -} - type Observation struct { state protoimpl.MessageState `protogen:"open.v1"` Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` @@ -2570,12 +2569,11 @@ const file_capabilities_actions_vault_messages_proto_rawDesc = "" + "\x1dListSecretIdentifiersResponse\x129\n" + "\videntifiers\x18\x01 \x03(\v2\x17.vault.SecretIdentifierR\videntifiers\x12\x18\n" + "\asuccess\x18\x02 \x01(\bR\asuccess\x12\x14\n" + - "\x05error\x18\x03 \x01(\tR\x05error\",\n" + - "\x10ObservationError\x12\x18\n" + - "\amessage\x18\x01 \x01(\tR\amessage\"\x9b\b\n" + "\x05error\x18\x03 \x01(\tR\x05error\x12\x1d\n" + "\n" + - "request_id\x18\x04 \x01(\tR\trequestId\"\xec\a\n" + + "request_id\x18\x04 \x01(\tR\trequestId\",\n" + + "\x10ObservationError\x12\x18\n" + + "\amessage\x18\x01 \x01(\tR\amessage\"\x9b\b\n" + "\vObservation\x12\x0e\n" + "\x02id\x18\x01 \x01(\tR\x02id\x125\n" + "\frequest_type\x18\x02 \x01(\x0e2\x12.vault.RequestTypeR\vrequestType\x12S\n" +