Vault latency feature flag and proto changes

pkg/capabilities/actions/vault/errors.go

@@ -0,0 +1,8 @@
+package vault
+
+import "errors"
+
+// ErrSecretVersionSkew is returned for direct GetSecrets requests when the Vault
+// nodes did not agree on a single ciphertext for a secret. The request can be
+// retried under a new request ID.
+var ErrSecretVersionSkew = errors.New("vault: secret version skew across vault nodes")

pkg/capabilities/actions/vault/messages.proto

@@ -41,6 +41,8 @@ message GetSecretsRequest {
   repeated SecretRequest requests = 1;
   string org_id = 2 [deprecated = true];
   string workflow_owner = 3 [deprecated = true];
+  // Serve from each Vault node's local state instead of through OCR.
+  bool get_secrets_directly = 4;
 }
 
 message GetSecretsResponse {

pkg/settings/cresettings/README.md

@@ -226,6 +226,7 @@ flowchart
         PerWorkflow.FeatureWorkflowTagBackfillActivePeriod[/PerWorkflow.FeatureWorkflowTagBackfillActivePeriod\]:::gate
         PerWorkflow.FeatureConsensusStricterMedianQuorumActivePeriod[/PerWorkflow.FeatureConsensusStricterMedianQuorumActivePeriod\]:::gate
         PerWorkflow.FeatureConsensusIncludeAllTimestampsActivePeriod[/PerWorkflow.FeatureConsensusIncludeAllTimestampsActivePeriod\]:::gate
+        PerWorkflow.FeatureVaultGetSecretsDirectlyActivePeriod[/PerWorkflow.FeatureVaultGetSecretsDirectlyActivePeriod\]:::gate
 
         PerWorkflow.ExecutionTimestampsEnabled-->PerWorkflow.ExecutionTimeout-->PerWorkflow.ExecutionResponseLimit
     end

pkg/settings/cresettings/defaults.json

@@ -244,6 +244,7 @@
 		"FeatureWorkflowTagBackfillActivePeriod": "[2100-01-01 00:00:00 +0000 UTC,2101-01-01 00:00:00 +0000 UTC]",
 		"FeatureConsensusStricterMedianQuorumActivePeriod": "[2100-01-01 00:00:00 +0000 UTC,2101-01-01 00:00:00 +0000 UTC]",
 		"FeatureConsensusIncludeAllTimestampsActivePeriod": "[2100-01-01 00:00:00 +0000 UTC,2101-01-01 00:00:00 +0000 UTC]",
+		"FeatureVaultGetSecretsDirectlyActivePeriod": "[2100-01-01 00:00:00 +0000 UTC,2101-01-01 00:00:00 +0000 UTC]",
 		"FeatureShadowTriggerModeActivePeriod": "[2100-01-01 00:00:00 +0000 UTC,2101-01-01 00:00:00 +0000 UTC]"
 	}
 }

pkg/settings/cresettings/defaults.toml

@@ -152,6 +152,7 @@ FeatureRequestHashIncludeWorkflowTagActivePeriod = '[0001-01-01 00:00:00 +0000 U
 FeatureWorkflowTagBackfillActivePeriod = '[2100-01-01 00:00:00 +0000 UTC,2101-01-01 00:00:00 +0000 UTC]'
 FeatureConsensusStricterMedianQuorumActivePeriod = '[2100-01-01 00:00:00 +0000 UTC,2101-01-01 00:00:00 +0000 UTC]'
 FeatureConsensusIncludeAllTimestampsActivePeriod = '[2100-01-01 00:00:00 +0000 UTC,2101-01-01 00:00:00 +0000 UTC]'
+FeatureVaultGetSecretsDirectlyActivePeriod = '[2100-01-01 00:00:00 +0000 UTC,2101-01-01 00:00:00 +0000 UTC]'
 FeatureShadowTriggerModeActivePeriod = '[2100-01-01 00:00:00 +0000 UTC,2101-01-01 00:00:00 +0000 UTC]'
 
 [PerWorkflow.ChainAllowed]

pkg/settings/cresettings/settings.go

@@ -377,6 +377,9 @@ var Default = Schema{
 		FeatureConsensusIncludeAllTimestampsActivePeriod: TimeRange(
 			time.Date(2100, 1, 1, 0, 0, 0, 0, time.UTC),
 			time.Date(2101, 1, 1, 0, 0, 0, 0, time.UTC)),
+		FeatureVaultGetSecretsDirectlyActivePeriod: TimeRange(
+			time.Date(2100, 1, 1, 0, 0, 0, 0, time.UTC),
+			time.Date(2101, 1, 1, 0, 0, 0, 0, time.UTC)),
 		FeatureShadowTriggerModeActivePeriod: TimeRange(
 			time.Date(2100, 1, 1, 0, 0, 0, 0, time.UTC),
 			time.Date(2101, 1, 1, 0, 0, 0, 0, time.UTC)),
@@ -617,6 +620,7 @@ type Workflows struct {
 	FeatureWorkflowTagBackfillActivePeriod            Setting[Range[config.Timestamp]]
 	FeatureConsensusStricterMedianQuorumActivePeriod  Setting[Range[config.Timestamp]]
 	FeatureConsensusIncludeAllTimestampsActivePeriod  Setting[Range[config.Timestamp]]
+	FeatureVaultGetSecretsDirectlyActivePeriod        Setting[Range[config.Timestamp]]
 	// FeatureShadowTriggerModeActivePeriod is the window in which coordinated trigger events are also
 	// copied to the central trigger queue. Each event is checked against the time it was observed, so
 	// every node switches at the same moment.

pkg/settings/cresettings/settings_test.go

@@ -314,6 +314,18 @@ func TestFeatureShadowTriggerModeActivePeriodKeyInit(t *testing.T) {
 	}, s.DefaultValue)
 }
 
+func TestFeatureVaultGetSecretsDirectlyActivePeriodKeyInit(t *testing.T) {
+	s := Default.PerWorkflow.FeatureVaultGetSecretsDirectlyActivePeriod
+
+	assert.Equal(t, "PerWorkflow.FeatureVaultGetSecretsDirectlyActivePeriod", s.GetKey())
+	assert.Equal(t, settings.ScopeWorkflow, s.Scope)
+	assert.NotNil(t, s.Parse)
+	assert.Equal(t, settings.Range[config.Timestamp]{
+		Lower: config.Timestamp(time.Date(2100, 1, 1, 0, 0, 0, 0, time.UTC).Unix()),
+		Upper: config.Timestamp(time.Date(2101, 1, 1, 0, 0, 0, 0, time.UTC).Unix()),
+	}, s.DefaultValue)
+}
+
 func TestGatewayProxyDonIDKeyInit(t *testing.T) {
 	s := Default.PerWorkflow.HTTPAction.GatewayProxyDonID