Introduce new Vault limits for all ocr3.1 config fields

pkg/settings/cresettings/README.md

@@ -174,6 +174,16 @@ flowchart
         VaultIdentifierNamespaceSizeLimit{{VaultIdentifierNamespaceSizeLimit}}:::bound
         VaultPluginBatchSizeLimit{{VaultPluginBatchSizeLimit}}:::bound
         VaultRequestBatchSizeLimit{{VaultRequestBatchSizeLimit}}:::bound
+        VaultLimitsMaxQueryLength{{VaultLimitsMaxQueryLength}}:::bound
+        VaultLimitsMaxObservationLength{{VaultLimitsMaxObservationLength}}:::bound
+        VaultLimitsMaxReportsPlusPrecursorLength{{VaultLimitsMaxReportsPlusPrecursorLength}}:::bound
+        VaultLimitsMaxReportLength{{VaultLimitsMaxReportLength}}:::bound
+        VaultLimitsMaxReportCount{{VaultLimitsMaxReportCount}}:::bound
+        VaultLimitsMaxKeyValueModifiedKeysPlusValuesLength{{VaultLimitsMaxKeyValueModifiedKeysPlusValuesLength}}:::bound
+        VaultLimitsMaxKeyValueModifiedKeys{{VaultLimitsMaxKeyValueModifiedKeys}}:::bound
+        VaultLimitsMaxBlobPayloadLength{{VaultLimitsMaxBlobPayloadLength}}:::bound
+        VaultLimitsMaxPerOracleUnexpiredBlobCumulativePayloadBytes{{VaultLimitsMaxPerOracleUnexpiredBlobCumulativePayloadBytes}}:::bound
+        VaultLimitsMaxPerOracleUnexpiredBlobCount{{VaultLimitsMaxPerOracleUnexpiredBlobCount}}:::bound
         PerOwner.VaultSecretsLimit{{PerOwner.VaultSecretsLimit}}:::bound
     end
 

pkg/settings/cresettings/defaults.json

@@ -7,8 +7,18 @@
 	"VaultIdentifierKeySizeLimit": "64b",
 	"VaultIdentifierOwnerSizeLimit": "64b",
 	"VaultIdentifierNamespaceSizeLimit": "64b",
-	"VaultPluginBatchSizeLimit": "20",
+	"VaultPluginBatchSizeLimit": "10",
 	"VaultRequestBatchSizeLimit": "10",
+	"VaultLimitsMaxQueryLength": "102400",
+	"VaultLimitsMaxObservationLength": "500000000",
+	"VaultLimitsMaxReportsPlusPrecursorLength": "500000000",
+	"VaultLimitsMaxReportLength": "500000000",
+	"VaultLimitsMaxReportCount": "10",
+	"VaultLimitsMaxKeyValueModifiedKeysPlusValuesLength": "1468006",
+	"VaultLimitsMaxKeyValueModifiedKeys": "300",
+	"VaultLimitsMaxBlobPayloadLength": "25600",
+	"VaultLimitsMaxPerOracleUnexpiredBlobCumulativePayloadBytes": "31457280",
+	"VaultLimitsMaxPerOracleUnexpiredBlobCount": "1000",
 	"PerOrg": {
 		"ZeroBalancePruningTimeout": "24h0m0s"
 	},

pkg/settings/cresettings/defaults.toml

@@ -6,8 +6,18 @@ VaultCiphertextSizeLimit = '2kb'
 VaultIdentifierKeySizeLimit = '64b'
 VaultIdentifierOwnerSizeLimit = '64b'
 VaultIdentifierNamespaceSizeLimit = '64b'
-VaultPluginBatchSizeLimit = '20'
+VaultPluginBatchSizeLimit = '10'
 VaultRequestBatchSizeLimit = '10'
+VaultLimitsMaxQueryLength = '102400'
+VaultLimitsMaxObservationLength = '500000000'
+VaultLimitsMaxReportsPlusPrecursorLength = '500000000'
+VaultLimitsMaxReportLength = '500000000'
+VaultLimitsMaxReportCount = '10'
+VaultLimitsMaxKeyValueModifiedKeysPlusValuesLength = '1468006'
+VaultLimitsMaxKeyValueModifiedKeys = '300'
+VaultLimitsMaxBlobPayloadLength = '25600'
+VaultLimitsMaxPerOracleUnexpiredBlobCumulativePayloadBytes = '31457280'
+VaultLimitsMaxPerOracleUnexpiredBlobCount = '1000'
 
 [PerOrg]
 ZeroBalancePruningTimeout = '24h0m0s'

pkg/settings/cresettings/settings.go

@@ -65,9 +65,49 @@ var Default = Schema{
 	VaultIdentifierKeySizeLimit:       Size(64 * config.Byte),
 	VaultIdentifierOwnerSizeLimit:     Size(64 * config.Byte),
 	VaultIdentifierNamespaceSizeLimit: Size(64 * config.Byte),
-	VaultPluginBatchSizeLimit:         Int(20),
+	VaultPluginBatchSizeLimit:         Int(10),
 	VaultRequestBatchSizeLimit:        Int(10),
 
+	VaultLimitsMaxQueryLength: Int(102400),
+	// Back of the envelope calculation:
+	// - An item can contain 2KB of ciphertext, 192 bytes of metadata (key, owner, namespace),
+	// a UUID (16 bytes) plus some overhead = ~2.5KB per item
+	// There can be 10 such items in a request, and 20 per batch, so 2.5KB * 10 * 20 = 500KB
+	// However as a buffer, multiplying by 10, to get ~5mb, for all 3 fields below.
+	VaultLimitsMaxObservationLength:          Int(500000000),
+	VaultLimitsMaxReportsPlusPrecursorLength: Int(500000000),
+	VaultLimitsMaxReportLength:               Int(500000000),
+	VaultLimitsMaxReportCount:                Int(10),
+	// assumption for largest item:
+	// create request with the maximum ciphertext length:
+	// - 192 bytes (sum of MaxIdentifierKeyLengthBytes + MaxIdentifierOwnerLengthBytes + MaxIdentifierNamespaceLengthBytes)
+	// - 2048 bytes (MaxCiphertextLengthBytes)
+	// = ~2240 bytes for an item
+	// There are 10 items per request (separate vault setting), 10 request per batch (BatchSize)
+	// i.e. ~224 KB per batch
+	// For a batch we will write:
+	// - a secret + metadata record per item
+	//   - the secrets are 224 KB total
+	//   - the metadata is a list of secret identifiers,
+	//     there are a maximum of 100 secrets per owner (MaxSecretsPerOwner)
+	//     i.e. 192 bytes * 100 = ~19.2 KB
+	// - the pending queue
+	//   - 10 requests in the pending queue, each request is ~22.4Kb = ~22.4 KB
+	//   - an index record =  8bytes
+	// - total = ~224 KB + ~19.2 KB + ~224 KB + 8 bytes = ~467.2 KB
+	// Setting to 1.4MB to allow for some buffer.
+	VaultLimitsMaxKeyValueModifiedKeysPlusValuesLength: Int(1468006),
+	// 10 batch size * 10 items per batch * 2 records modified per item (secret + metadata record)
+	// plus 10 batchsize items in the pending queue + 1 index record
+	// = 211 total.
+	// plus some buffer.
+	VaultLimitsMaxKeyValueModifiedKeys: Int(300),
+	// Assuming a request is max 25KB, we add a bit of buffer to allow some room.
+	VaultLimitsMaxBlobPayloadLength: Int(25600),
+	// Per docs, this should allow some additional buffer to allow for reaping time.
+	VaultLimitsMaxPerOracleUnexpiredBlobCumulativePayloadBytes: Int(31457280), // 30 mb
+	VaultLimitsMaxPerOracleUnexpiredBlobCount:                  Int(1000),
+
 	PerOrg: Orgs{
 		ZeroBalancePruningTimeout: Duration(24 * time.Hour),
 	},
@@ -178,6 +218,17 @@ type Schema struct {
 	VaultPluginBatchSizeLimit         Setting[int] `unit:"{request}"`
 	VaultRequestBatchSizeLimit        Setting[int] `unit:"{request}"`
 
+	VaultLimitsMaxQueryLength                                  Setting[int]
+	VaultLimitsMaxObservationLength                            Setting[int]
+	VaultLimitsMaxReportsPlusPrecursorLength                   Setting[int]
+	VaultLimitsMaxReportLength                                 Setting[int]
+	VaultLimitsMaxReportCount                                  Setting[int]
+	VaultLimitsMaxKeyValueModifiedKeysPlusValuesLength         Setting[int]
+	VaultLimitsMaxKeyValueModifiedKeys                         Setting[int]
+	VaultLimitsMaxBlobPayloadLength                            Setting[int]
+	VaultLimitsMaxPerOracleUnexpiredBlobCumulativePayloadBytes Setting[int]
+	VaultLimitsMaxPerOracleUnexpiredBlobCount                  Setting[int]
+
 	PerOrg      Orgs      `scope:"org"`
 	PerOwner    Owners    `scope:"owner"`
 	PerWorkflow Workflows `scope:"workflow"`