diff --git a/pkg/capabilities/actions/vault/errors.go b/pkg/capabilities/actions/vault/errors.go new file mode 100644 index 0000000000..c587d0909c --- /dev/null +++ b/pkg/capabilities/actions/vault/errors.go @@ -0,0 +1,8 @@ +package vault + +import "errors" + +// ErrSecretVersionSkew is returned for direct GetSecrets requests when the Vault +// nodes did not agree on a single ciphertext for a secret. The request can be +// retried under a new request ID. +var ErrSecretVersionSkew = errors.New("vault: secret version skew across vault nodes") diff --git a/pkg/capabilities/actions/vault/messages.pb.go b/pkg/capabilities/actions/vault/messages.pb.go index 81a867b8e4..55cc08baf8 100644 --- a/pkg/capabilities/actions/vault/messages.pb.go +++ b/pkg/capabilities/actions/vault/messages.pb.go @@ -496,8 +496,10 @@ type GetSecretsRequest struct { OrgId string `protobuf:"bytes,2,opt,name=org_id,json=orgId,proto3" json:"org_id,omitempty"` // Deprecated: Marked as deprecated in capabilities/actions/vault/messages.proto. WorkflowOwner string `protobuf:"bytes,3,opt,name=workflow_owner,json=workflowOwner,proto3" json:"workflow_owner,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache + // Serve from each Vault node's local state instead of through OCR. + GetSecretsDirectly bool `protobuf:"varint,4,opt,name=get_secrets_directly,json=getSecretsDirectly,proto3" json:"get_secrets_directly,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache } func (x *GetSecretsRequest) Reset() { @@ -553,6 +555,13 @@ func (x *GetSecretsRequest) GetWorkflowOwner() string { return "" } +func (x *GetSecretsRequest) GetGetSecretsDirectly() bool { + if x != nil { + return x.GetSecretsDirectly + } + return false +} + type GetSecretsResponse struct { state protoimpl.MessageState `protogen:"open.v1"` Responses []*SecretResponse `protobuf:"bytes,1,rep,name=responses,proto3" json:"responses,omitempty"` @@ -2532,11 +2541,12 @@ const file_capabilities_actions_vault_messages_proto_rawDesc = "" + "\x02id\x18\x01 \x01(\v2\x17.vault.SecretIdentifierR\x02id\x12'\n" + "\x04data\x18\x02 \x01(\v2\x11.vault.SecretDataH\x00R\x04data\x12\x16\n" + "\x05error\x18\x03 \x01(\tH\x00R\x05errorB\b\n" + - "\x06result\"\x8b\x01\n" + + "\x06result\"\xbd\x01\n" + "\x11GetSecretsRequest\x120\n" + "\brequests\x18\x01 \x03(\v2\x14.vault.SecretRequestR\brequests\x12\x19\n" + "\x06org_id\x18\x02 \x01(\tB\x02\x18\x01R\x05orgId\x12)\n" + - "\x0eworkflow_owner\x18\x03 \x01(\tB\x02\x18\x01R\rworkflowOwner\"z\n" + + "\x0eworkflow_owner\x18\x03 \x01(\tB\x02\x18\x01R\rworkflowOwner\x120\n" + + "\x14get_secrets_directly\x18\x04 \x01(\bR\x12getSecretsDirectly\"z\n" + "\x12GetSecretsResponse\x123\n" + "\tresponses\x18\x01 \x03(\v2\x15.vault.SecretResponseR\tresponses\x12/\n" + "\x14raw_vault_public_key\x18\x02 \x01(\tR\x11rawVaultPublicKey\"c\n" + diff --git a/pkg/capabilities/actions/vault/messages.proto b/pkg/capabilities/actions/vault/messages.proto index 42a5de062f..ac2a38f784 100644 --- a/pkg/capabilities/actions/vault/messages.proto +++ b/pkg/capabilities/actions/vault/messages.proto @@ -41,6 +41,8 @@ message GetSecretsRequest { repeated SecretRequest requests = 1; string org_id = 2 [deprecated = true]; string workflow_owner = 3 [deprecated = true]; + // Serve from each Vault node's local state instead of through OCR. + bool get_secrets_directly = 4; } message GetSecretsResponse { diff --git a/pkg/settings/cresettings/README.md b/pkg/settings/cresettings/README.md index f405a7bfe8..46e4abfc89 100644 --- a/pkg/settings/cresettings/README.md +++ b/pkg/settings/cresettings/README.md @@ -226,6 +226,7 @@ flowchart PerWorkflow.FeatureWorkflowTagBackfillActivePeriod[/PerWorkflow.FeatureWorkflowTagBackfillActivePeriod\]:::gate PerWorkflow.FeatureConsensusStricterMedianQuorumActivePeriod[/PerWorkflow.FeatureConsensusStricterMedianQuorumActivePeriod\]:::gate PerWorkflow.FeatureConsensusIncludeAllTimestampsActivePeriod[/PerWorkflow.FeatureConsensusIncludeAllTimestampsActivePeriod\]:::gate + PerWorkflow.FeatureVaultGetSecretsDirectlyActivePeriod[/PerWorkflow.FeatureVaultGetSecretsDirectlyActivePeriod\]:::gate PerWorkflow.ExecutionTimestampsEnabled-->PerWorkflow.ExecutionTimeout-->PerWorkflow.ExecutionResponseLimit end diff --git a/pkg/settings/cresettings/defaults.json b/pkg/settings/cresettings/defaults.json index c664329ace..0956f3a15c 100644 --- a/pkg/settings/cresettings/defaults.json +++ b/pkg/settings/cresettings/defaults.json @@ -244,6 +244,7 @@ "FeatureWorkflowTagBackfillActivePeriod": "[2100-01-01 00:00:00 +0000 UTC,2101-01-01 00:00:00 +0000 UTC]", "FeatureConsensusStricterMedianQuorumActivePeriod": "[2100-01-01 00:00:00 +0000 UTC,2101-01-01 00:00:00 +0000 UTC]", "FeatureConsensusIncludeAllTimestampsActivePeriod": "[2100-01-01 00:00:00 +0000 UTC,2101-01-01 00:00:00 +0000 UTC]", + "FeatureVaultGetSecretsDirectlyActivePeriod": "[2100-01-01 00:00:00 +0000 UTC,2101-01-01 00:00:00 +0000 UTC]", "FeatureShadowTriggerModeActivePeriod": "[2100-01-01 00:00:00 +0000 UTC,2101-01-01 00:00:00 +0000 UTC]" } } \ No newline at end of file diff --git a/pkg/settings/cresettings/defaults.toml b/pkg/settings/cresettings/defaults.toml index 257d7c3d8f..eb42fdaaea 100644 --- a/pkg/settings/cresettings/defaults.toml +++ b/pkg/settings/cresettings/defaults.toml @@ -152,6 +152,7 @@ FeatureRequestHashIncludeWorkflowTagActivePeriod = '[0001-01-01 00:00:00 +0000 U FeatureWorkflowTagBackfillActivePeriod = '[2100-01-01 00:00:00 +0000 UTC,2101-01-01 00:00:00 +0000 UTC]' FeatureConsensusStricterMedianQuorumActivePeriod = '[2100-01-01 00:00:00 +0000 UTC,2101-01-01 00:00:00 +0000 UTC]' FeatureConsensusIncludeAllTimestampsActivePeriod = '[2100-01-01 00:00:00 +0000 UTC,2101-01-01 00:00:00 +0000 UTC]' +FeatureVaultGetSecretsDirectlyActivePeriod = '[2100-01-01 00:00:00 +0000 UTC,2101-01-01 00:00:00 +0000 UTC]' FeatureShadowTriggerModeActivePeriod = '[2100-01-01 00:00:00 +0000 UTC,2101-01-01 00:00:00 +0000 UTC]' [PerWorkflow.ChainAllowed] diff --git a/pkg/settings/cresettings/settings.go b/pkg/settings/cresettings/settings.go index edf3941b78..5b396924b2 100644 --- a/pkg/settings/cresettings/settings.go +++ b/pkg/settings/cresettings/settings.go @@ -377,6 +377,9 @@ var Default = Schema{ FeatureConsensusIncludeAllTimestampsActivePeriod: TimeRange( time.Date(2100, 1, 1, 0, 0, 0, 0, time.UTC), time.Date(2101, 1, 1, 0, 0, 0, 0, time.UTC)), + FeatureVaultGetSecretsDirectlyActivePeriod: TimeRange( + time.Date(2100, 1, 1, 0, 0, 0, 0, time.UTC), + time.Date(2101, 1, 1, 0, 0, 0, 0, time.UTC)), FeatureShadowTriggerModeActivePeriod: TimeRange( time.Date(2100, 1, 1, 0, 0, 0, 0, time.UTC), time.Date(2101, 1, 1, 0, 0, 0, 0, time.UTC)), @@ -617,6 +620,7 @@ type Workflows struct { FeatureWorkflowTagBackfillActivePeriod Setting[Range[config.Timestamp]] FeatureConsensusStricterMedianQuorumActivePeriod Setting[Range[config.Timestamp]] FeatureConsensusIncludeAllTimestampsActivePeriod Setting[Range[config.Timestamp]] + FeatureVaultGetSecretsDirectlyActivePeriod Setting[Range[config.Timestamp]] // FeatureShadowTriggerModeActivePeriod is the window in which coordinated trigger events are also // copied to the central trigger queue. Each event is checked against the time it was observed, so // every node switches at the same moment. diff --git a/pkg/settings/cresettings/settings_test.go b/pkg/settings/cresettings/settings_test.go index 6e597d9f8f..999c017208 100644 --- a/pkg/settings/cresettings/settings_test.go +++ b/pkg/settings/cresettings/settings_test.go @@ -314,6 +314,18 @@ func TestFeatureShadowTriggerModeActivePeriodKeyInit(t *testing.T) { }, s.DefaultValue) } +func TestFeatureVaultGetSecretsDirectlyActivePeriodKeyInit(t *testing.T) { + s := Default.PerWorkflow.FeatureVaultGetSecretsDirectlyActivePeriod + + assert.Equal(t, "PerWorkflow.FeatureVaultGetSecretsDirectlyActivePeriod", s.GetKey()) + assert.Equal(t, settings.ScopeWorkflow, s.Scope) + assert.NotNil(t, s.Parse) + assert.Equal(t, settings.Range[config.Timestamp]{ + Lower: config.Timestamp(time.Date(2100, 1, 1, 0, 0, 0, 0, time.UTC).Unix()), + Upper: config.Timestamp(time.Date(2101, 1, 1, 0, 0, 0, 0, time.UTC).Unix()), + }, s.DefaultValue) +} + func TestGatewayProxyDonIDKeyInit(t *testing.T) { s := Default.PerWorkflow.HTTPAction.GatewayProxyDonID