Use limits framework instead of onchain config for Vault plugin ocr config by prashantkumar1982 · Pull Request #21405 · smartcontractkit/chainlink

prashantkumar1982 · 2026-03-04T21:40:28Z

New limits were added for Vault here: smartcontractkit/chainlink-common#1877

This PR makes use of those. This helps us move away from depending on onchain config, which is very cumbersome to change.

AI generated this PR by this prompts:

The goal is to make code changes in Vault Plugin at chainlink/core/services/ocr2/plugins/vault/plugin.go.
The function NewReportingPlugin() at line 182 has a variable called configProto.
We want to stop reading values from that, and instead, for all fields read from there, we want to provide a separate source.

The separate source should be added by you in this file: chainlink-common/pkg/settings/cresettings/settings.go. Some fields are already existing in lines 64-69, so feel free to reuse them. But for new ones, please create new entries here, with the prefix string Vault.

For default values of all these fields, please pick the values from this place: chainlink-deployments/domains/cre/prod/durable_pipelines/archived/upgrade_vault_ocr_plugin_20260218_172509.yaml.
The relevant fields are in this file lines 47-83.

If you find a field value in the settings.go file has a default different than the one in upgrade_vault_ocr_plugin_20260218_172509.yaml, then please choose the value in the yaml file.

The changes that you make will be in 2 parts:

In folder chainlink-common. Make sure you create new fields, edit existing ones as needed, but also fix any other related code in that overall folder. There are other files like defaults.json, README.md, defaults.toml, settings.go, that refer to these fields. Please edit all those files.

After step 1, you need to use those in the chainlink folder changes to plugin.go file. All places using configProto as source will change to using these new cresettings source. For example, "cresettings.Default.VaultPluginBatchSizeLimit".

…nfig

… into vault_limits_for_ocr3

github-actions · 2026-03-04T21:41:59Z

I see you updated files related to core. Please run make gocs in the root directory to add a changeset as well as in the text include at least one of the following tags:

#added For any new functionality added.
#breaking_change For any functionality that requires manual action for the node to boot.
#bugfix For bug fixes.
#changed For any change to the existing functionality.
#db_update For any feature that introduces updates to database schema.
#deprecation_notice For any upcoming deprecation functionality.
#internal For changesets that need to be excluded from the final changelog.
#nops For any feature that is NOP facing and needs to be in the official Release Notes for the release.
#removed For any functionality/config that is removed.
#updated For any functionality that is updated.
#wip For any change that is not ready yet and external communication about it should be held off till it is feature complete.

github-actions · 2026-03-04T21:42:08Z

✅ No conflicts with other open PRs targeting develop

trunk-io · 2026-03-04T23:24:59Z

_{View Full Report ↗︎ ⋅ Docs}

cedric-cordenier · 2026-03-05T11:12:54Z

-	if configProto.LimitsMaxKeyValueModifiedKeys == 0 {
-		configProto.LimitsMaxKeyValueModifiedKeys = defaultLimitsMaxKeyValueModifiedKeys
-	}
+	return &ReportingPluginConfig{


@prashantkumar1982 Have you checked that these values behave in the same way as the plugin limits?

I think BatchSize definitely doesn't -- if this applies unevenly across nodes in the DON we'll get a non-determinism error, regardless of whether we're hitting the batchSize or not

The others would normally lead the plugin to return an error to the user, so I think those are also not safe to change node by node since an inconsistency will lead to a loss of quorum

As we discussed, these 2 are problematic:

maxSecretsPerOwnerLimiter

batchSize
Meaning these, if mismatched on a few nodes, could cause quorum failures.

we discussed that since changes will be based on limits framework, they will apply very uniformly and quickly on all nodes, but that still could be a few minutes, when potentially we fail quorum, thus slowing Vault DON, or maybe partial outage during that time.

Thus I moved these above 2 fields back to being read from onchain config.
All others are just max size changes, and should be ok to be changed safely via limits framework.

… into vault_limits_for_ocr3

jmank88 · 2026-03-10T21:55:03Z

-	if configProto.LimitsMaxReportCount == 0 {
-		configProto.LimitsMaxReportCount = defaultLimitsMaxReportCount
+func logLimit[N limits.Number](ctx context.Context, lggr logger.Logger, limiter limits.BoundLimiter[N]) N {
+	ctx = contexts.WithCRE(ctx, contexts.CRE{Owner: "DUMMY-OWNER-FOR-LOGGING"})


Why a dummy owner?

I didn't change this, it was pre-existing:

chainlink/core/services/ocr2/plugins/vault/plugin.go

Line 174 in ac7fc1c

ctx = contexts.WithCRE(ctx, contexts.CRE{Owner: "DUMMY-OWNER-FOR-LOGGING"})

Seems pretty hacky 🤷

I don't know why we needed to even create a new ctx. Could just reuse existing one

… into vault_limits_for_ocr3

jmank88 · 2026-03-10T23:22:06Z

-	if configSize != 0 {
-		defaultSize.DefaultValue = pkgconfig.Size(configSize) * pkgconfig.Byte
+func initializePluginLimits(ctx context.Context) (ocr3_1types.ReportingPluginLimits, error) {
+	maxQueryBytes, err := cresettings.Default.VaultMaxQuerySizeLimit.GetOrDefault(ctx, cresettings.DefaultGetter)


You need to use the getter from the limits factory. The default getter doesn't know about the distributed settings

Ok, now using the limitsFactory.Settings.
But I don't have much context of how to use the limits framework correctly. So please review if this is correct usage.
🙏

cl-sonarqube-production · 2026-03-11T02:47:20Z

Quality Gate passed

Issues
0 New issues
2 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

bolekk

Limits migration LGTM. I'm not able to check the sanity of all defaults.

prashantkumar1982 added 2 commits March 4, 2026 13:34

Use limits framework instead o onchain config for Vault plugin ocr co…

df7c741

…nfig

Merge branch 'develop' of https://github.com/smartcontractkit/chainlink…

b2147d0

… into vault_limits_for_ocr3

prashantkumar1982 added 2 commits March 4, 2026 14:06

Refactor

c62cf93

lint

ed26a17

cedric-cordenier reviewed Mar 5, 2026

View reviewed changes

cedric-cordenier requested changes Mar 5, 2026

View reviewed changes

prashantkumar1982 added 10 commits March 5, 2026 17:44

revert 2 fields

a47678d

Merge branch 'develop' of https://github.com/smartcontractkit/chainlink…

99a105d

… into vault_limits_for_ocr3

go mod

1040244

merge develop

115f577

test

e0e0399

Merge branch 'develop' of https://github.com/smartcontractkit/chainlink…

e9f7b37

… into vault_limits_for_ocr3

lint

5f9ed3a

merge develop

ac75447

lint

f8486fd

merge conflicts

7d73a7a

cedric-cordenier previously approved these changes Mar 10, 2026

View reviewed changes

prashantkumar1982 added 4 commits March 10, 2026 10:49

vault test plugin startup wait

d1e9a08

merge conflicts

a2c820c

Merge branch 'develop' of https://github.com/smartcontractkit/chainlink…

4d71e7a

… into vault_limits_for_ocr3

Bump chainlink-common

0fd5e0b

cedric-cordenier previously approved these changes Mar 10, 2026

View reviewed changes

jmank88 reviewed Mar 10, 2026

View reviewed changes

Comment thread core/services/ocr2/plugins/vault/plugin.go Outdated

jmank88 requested changes Mar 10, 2026

View reviewed changes

prashantkumar1982 added 3 commits March 10, 2026 15:22

fix closing of limits

70212cf

Merge branch 'develop' of https://github.com/smartcontractkit/chainlink…

4a9a1b7

… into vault_limits_for_ocr3

lint

f27bee3

prashantkumar1982 added 2 commits March 10, 2026 15:52

close limiters

e6ce299

limiters simplify

29f7088

jmank88 requested changes Mar 10, 2026

View reviewed changes

limiters simplify

d51ced9

jmank88 approved these changes Mar 11, 2026

View reviewed changes

bolekk approved these changes Mar 11, 2026

View reviewed changes

bolekk closed this Mar 11, 2026

prashantkumar1982 changed the title ~~Use limits framework instead o onchain config for Vault plugin ocr config~~ Use limits framework instead of onchain config for Vault plugin ocr config Mar 11, 2026

Conversation

prashantkumar1982 commented Mar 4, 2026

Uh oh!

github-actions Bot commented Mar 4, 2026

Uh oh!

github-actions Bot commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

trunk-io Bot commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cl-sonarqube-production Bot commented Mar 11, 2026

Quality Gate passed

Uh oh!

bolekk left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

github-actions Bot commented Mar 4, 2026 •

edited

Loading

trunk-io Bot commented Mar 4, 2026 •

edited

Loading