fix: de-stage local verifier config and fix documentation typos

RUNBOOK.md

@@ -48,14 +48,14 @@ the chart provided `values.yaml`. You can then follow along the original file, a
 Every value accompanies a small snippet documentation, commented out example, or helper link.
 
 We do not recommend you copy the entire file, since you'll have to maintain all values, specially across
-updates, making maitenance difficult.
+updates, making maintenance difficult.
 
 We'll detail here the "important bits" to watch out for.
 
 ### Configs
 
 A minimal values file that renders and starts cleanly, with placeholder addresses, `existingSecret`s, and one fake
-chain (see bellow for the secrets). Swap in real addresses and RPC URLs before trusting it beyond a smoke test:
+chain (see below for the secrets). Swap in real addresses and RPC URLs before trusting it beyond a smoke test:
 
 ```yaml
 aggregator:
@@ -70,7 +70,7 @@ aggregator:
           sourceVerifierAddress: "0x00000000000000000000000000000000000000a1"
           threshold: 1
           signers:
-            # Your first signer will be your own address, see bellow
+            # Your first signer will be your own address, see below
             - address: "0x00000000000000000000000000000000000000b1"
       destinationVerifiers:
         "2": "0x00000000000000000000000000000000000000c2"
@@ -83,7 +83,7 @@ aggregator:
 verifier:
   config:
     verifier_id: "committee-verifier-1"
-    signer_address: "auto"  # See bellow how to find this address for use above
+    signer_address: "auto"  # See below how to find this address for use above
     aggregators:
       - name: aggregator-1
         secret_name: aggregator_1
@@ -113,7 +113,7 @@ verifier:
         name: verifier-bootstrap-secret
 ```
 
-The configs here map almost directly to the Verifier's and Aggregators settings, see their links for for info.
+The configs here map almost directly to the Verifier's and Aggregators settings, see their links for info.
 Some changes include `useInClusterAggregator: true`, where the chart automatically configures the aggregator that is
 also deployed in this chart for the verifier, sparing you from wiring it yourself. Read the values' documentation
 for more info as you go.

charts/ccv-cell/README.md

@@ -15,8 +15,8 @@ helm install my-ccv-cell oci://public.ecr.aws/chainlink/helm/ccv-cell --version
 Available versions are listed under [Releases](https://github.com/smartcontractkit/chainlink-ccv-starter-kit/releases) and
 as [git tags](https://github.com/smartcontractkit/chainlink-ccv-starter-kit/tags), without the prefix `v`.
 
-Consult the [Values](#values) section bellow, or the [`values.yaml` file](./values.yaml) to see available configuration
-options. Also check the [Requirements](#requirements) section bellow for what you need to configure beforehand.
+Consult the [Values](#values) section below, or the [`values.yaml` file](./values.yaml) to see available configuration
+options. Also check the [Requirements](#requirements) section below for what you need to configure beforehand.
 You may also read the [runbook](../../RUNBOOK.md) for a small guide.
 
 Note that, while the chart does have and validate a JSON Schema, properties at the root beginning with `x-` are ignored,
@@ -235,7 +235,7 @@ A CCV Cell also has a few external pre-requisites for a production grade deploym
 | aggregator.service.ports.health | int | `8080` | Port for the health endpoint. |
 | aggregator.service.type | string | `"ClusterIP"` | Service type. See [Service types](https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types). |
 | aggregator.serviceAccount.annotations | object | `{}` | Annotations to add to the ServiceAccount.    For GKE Workload Identity Federation (required by `aggregator.secrets.app.gcpSecretStore`),    set `iam.gke.io/gcp-service-account` to the Google service account bound to this KSA.    For AWS IRSA (required by `aggregator.secrets.app.awsSecretStore` with `usePodIdentity: false`),    set `eks.amazonaws.com/role-arn` to the IAM role ARN that can read the secret.    For Azure Workload Identity (required by `aggregator.secrets.app.azureKeyVault` with `usePodIdentity: false`),    set `azure.workload.identity/client-id` to the Azure AD application or managed identity client ID. |
-| aggregator.serviceAccount.automountServiceAccountToken | bool | `false` | Mount the service account token into pods. See [automountServiceAccountToken](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#opt-out-of-api-credential-automounting).    By default, not needed, since this application doesn't use the Kuberentes API. |
+| aggregator.serviceAccount.automountServiceAccountToken | bool | `false` | Mount the service account token into pods. See [automountServiceAccountToken](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#opt-out-of-api-credential-automounting).    By default, not needed, since this application doesn't use the Kubernetes API. |
 | aggregator.serviceAccount.create | bool | `true` | Create a dedicated ServiceAccount for the aggregator. |
 | aggregator.serviceAccount.labels | object | `{}` | Labels to add to the ServiceAccount. |
 | aggregator.serviceAccount.name | string | `""` | Use an existing ServiceAccount instead of creating one; ignored when `create` is true. |
@@ -416,7 +416,7 @@ A CCV Cell also has a few external pre-requisites for a production grade deploym
 | verifier.secrets.evm.labels | object | `{}` | Labels to add to the verifier evm Secret. |
 | verifier.secrets.evm.type | string | `"values"` | Provisioning strategy: the default, `values`, uses .verifier.evm.config to render this as a simple ConfigMap.    However, it's common for RPC endpoints to be secrets. In that case, use one of `externalSecret`, `existingSecret`, `gcpSecretStore`,    `awsSecretStore`, or `azureKeyVault` to configure this as a secret instead. |
 | verifier.serviceAccount.annotations | object | `{}` | Annotations to add to the ServiceAccount.    For GKE Workload Identity Federation (required by `verifier.secrets.*.gcpSecretStore`),    set `iam.gke.io/gcp-service-account` to the Google service account bound to this KSA.    For AWS IRSA (required by `verifier.secrets.*.awsSecretStore` with `usePodIdentity: false`),    set `eks.amazonaws.com/role-arn` to the IAM role ARN that can read the secrets.    For Azure Workload Identity (required by `verifier.secrets.*.azureKeyVault` with `usePodIdentity: false`),    set `azure.workload.identity/client-id` to the Azure AD application or managed identity client ID. |
-| verifier.serviceAccount.automountServiceAccountToken | bool | `false` | Mount the service account token into pods. See [automountServiceAccountToken](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#opt-out-of-api-credential-automounting).    By default, not needed, since this application doesn't use the Kuberentes API. |
+| verifier.serviceAccount.automountServiceAccountToken | bool | `false` | Mount the service account token into pods. See [automountServiceAccountToken](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#opt-out-of-api-credential-automounting).    By default, not needed, since this application doesn't use the Kubernetes API. |
 | verifier.serviceAccount.create | bool | `true` | Create a dedicated ServiceAccount for the verifier, usually used for OIDC auth with your cloud provider. |
 | verifier.serviceAccount.labels | object | `{}` | Labels to add to the ServiceAccount. |
 | verifier.serviceAccount.name | string | `""` | Use an existing ServiceAccount instead of creating one; ignored when `create` is true. |

charts/ccv-cell/README.md.gotmpl

@@ -16,8 +16,8 @@ helm install my-{{ template "chart.name" . }} oci://public.ecr.aws/chainlink/hel
 Available versions are listed under [Releases](https://github.com/smartcontractkit/chainlink-ccv-starter-kit/releases) and
 as [git tags](https://github.com/smartcontractkit/chainlink-ccv-starter-kit/tags), without the prefix `v`.
 
-Consult the [Values](#values) section bellow, or the [`values.yaml` file](./values.yaml) to see available configuration
-options. Also check the [Requirements](#requirements) section bellow for what you need to configure beforehand.
+Consult the [Values](#values) section below, or the [`values.yaml` file](./values.yaml) to see available configuration
+options. Also check the [Requirements](#requirements) section below for what you need to configure beforehand.
 You may also read the [runbook](../../RUNBOOK.md) for a small guide.
 
 Note that, while the chart does have and validate a JSON Schema, properties at the root beginning with `x-` are ignored,

charts/ccv-cell/values.yaml

@@ -388,7 +388,7 @@ aggregator:
     # -- Use an existing ServiceAccount instead of creating one; ignored when `create` is true.
     name: ""
     # -- Mount the service account token into pods. See [automountServiceAccountToken](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#opt-out-of-api-credential-automounting).
-    #    By default, not needed, since this application doesn't use the Kuberentes API.
+    #    By default, not needed, since this application doesn't use the Kubernetes API.
     automountServiceAccountToken: false
 
   # -- Annotations to add to the aggregator Deployment object.
@@ -1183,7 +1183,7 @@ verifier:
     # -- Use an existing ServiceAccount instead of creating one; ignored when `create` is true.
     name: ""
     # -- Mount the service account token into pods. See [automountServiceAccountToken](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#opt-out-of-api-credential-automounting).
-    #    By default, not needed, since this application doesn't use the Kuberentes API.
+    #    By default, not needed, since this application doesn't use the Kubernetes API.
     automountServiceAccountToken: false
 
   # -- Annotations to add to the verifier Deployment object.

local/config/verifier-config.toml

@@ -2,7 +2,7 @@
 # https://github.com/smartcontractkit/chainlink-ccv/blob/main/docs/config/verifier/committee/config.documented.toml
 
 verifier_id = "committee-verifier-1"
-signer_address = "0x407ac788a176C3C752cb0052cfc3fEA5Bd7307F2"
+signer_address = "auto"
 message_disablement_rules_poll_interval = "2s"
 message_disablement_rules_client_timeout = "500ms"
 disable_finality_checkers = []
@@ -17,7 +17,7 @@ disable_finality_checkers = []
   16015286601757825753 = "0xD5C448Fc5B81EFd3108656Ce5FF9bacF2b582bdB"
 
 [on_ramp_addresses]
-  16015286601757825753 = "0xA94E45744553F4B2bea9DfB8979a02962B980732"
+  16015286601757825753 = "0x8dcf17f298c881A547D91ca4aA3C2AD7568C6777"
 
-[rmn_remote_addresses]
-  16015286601757825753 = "0xACD1e9A75cA486c6883BC5835a022536fA67fCbF"
+# rmn_remote_addresses is optional: the verifier derives the RMN Remote from the
+# OnRamp's on-chain static config, so it is left unset here.

marketplace/gcp/data-test/chart-overlay/templates/verify-secrets.yaml

@@ -86,10 +86,7 @@ stringData:
     "16015286601757825753" = "0xD5C448Fc5B81EFd3108656Ce5FF9bacF2b582bdB"
 
     [on_ramp_addresses]
-    "16015286601757825753" = "0xA94E45744553F4B2bea9DfB8979a02962B980732"
-
-    [rmn_remote_addresses]
-    "16015286601757825753" = "0xACD1e9A75cA486c6883BC5835a022536fA67fCbF"
+    "16015286601757825753" = "0x8dcf17f298c881A547D91ca4aA3C2AD7568C6777"
 ---
 apiVersion: v1
 kind: Secret