Remove hide-shared-routing-endpoint feature flag

23 files changed, 144 insertions, 234 deletions

diff --git a/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/RoutingController.java b/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/RoutingController.java
index daf9cfd428f..2c087166e36 100644
--- a/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/RoutingController.java
+++ b/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/RoutingController.java
@@ -15,9 +15,6 @@ import com.yahoo.config.provision.InstanceName;
 import com.yahoo.config.provision.SystemName;
 import com.yahoo.config.provision.zone.RoutingMethod;
 import com.yahoo.config.provision.zone.ZoneId;
-import com.yahoo.vespa.flags.BooleanFlag;
-import com.yahoo.vespa.flags.FetchVector;
-import com.yahoo.vespa.flags.Flags;
 import com.yahoo.vespa.hosted.controller.api.identifiers.DeploymentId;
 import com.yahoo.vespa.hosted.controller.api.integration.configserver.ContainerEndpoint;
 import com.yahoo.vespa.hosted.controller.api.integration.dns.Record;
@@ -73,7 +70,6 @@ public class RoutingController {
     private final Controller controller;
     private final RoutingPolicies routingPolicies;
     private final RotationRepository rotationRepository;
-    private final BooleanFlag hideSharedRoutingEndpoint;
 
     public RoutingController(Controller controller, RotationsConfig rotationsConfig) {
         this.controller = Objects.requireNonNull(controller, "controller must be non-null");
@@ -81,7 +77,6 @@ public class RoutingController {
         this.rotationRepository = new RotationRepository(Objects.requireNonNull(rotationsConfig, "rotationsConfig must be non-null"),
                                                          controller.applications(),
                                                          controller.curator());
-        this.hideSharedRoutingEndpoint = Flags.HIDE_SHARED_ROUTING_ENDPOINT.bindTo(controller.flagSource());
     }
 
     /** Create a routing context for given deployment */
@@ -186,17 +181,21 @@ public class RoutingController {
         return EndpointList.copyOf(endpoints);
     }
 
-    /** Read and return zone-scoped endpoints for given deployments, grouped by their zone */
-    public Map<ZoneId, List<Endpoint>> readZoneEndpointsOf(Collection<DeploymentId> deployments) {
-        var endpoints = new TreeMap<ZoneId, List<Endpoint>>(Comparator.comparing(ZoneId::value));
+    /** Read test runner endpoints for given deployments, grouped by their zone */
+    public Map<ZoneId, List<Endpoint>> readTestRunnerEndpointsOf(Collection<DeploymentId> deployments) {
+        TreeMap<ZoneId, List<Endpoint>> endpoints = new TreeMap<>(Comparator.comparing(ZoneId::value));
         for (var deployment : deployments) {
-            EndpointList zoneEndpoints = readEndpointsOf(deployment).scope(Endpoint.Scope.zone).not().legacy();
-            zoneEndpoints = directEndpoints(zoneEndpoints, deployment.applicationId());
+            EndpointList zoneEndpoints = readEndpointsOf(deployment).scope(Endpoint.Scope.zone)
+                                                                    .not().legacy();
+            EndpointList directEndpoints = zoneEndpoints.direct();
+            if (!directEndpoints.isEmpty()) {
+                zoneEndpoints = directEndpoints; // Use only direct endpoints if we have any
+            }
             if  ( ! zoneEndpoints.isEmpty()) {
                 endpoints.put(deployment.zoneId(), zoneEndpoints.asList());
             }
         }
-        return Collections.unmodifiableMap(endpoints);
+        return Collections.unmodifiableSortedMap(endpoints);
     }
 
     /** Returns certificate DNS names (CN and SAN values) for given deployment */
@@ -355,17 +354,6 @@ public class RoutingController {
                                                                        Priority.normal));
     }
 
-    /** Returns direct routing endpoints if any exist and feature flag is set for given application */
-    // TODO: Remove this when feature flag is removed, and in-line .direct() filter where relevant
-    public EndpointList directEndpoints(EndpointList endpoints, ApplicationId application) {
-        boolean hideSharedEndpoint = hideSharedRoutingEndpoint.with(FetchVector.Dimension.APPLICATION_ID, application.serializedForm()).value();
-        EndpointList directEndpoints = endpoints.direct();
-        if (hideSharedEndpoint && !directEndpoints.isEmpty()) {
-            return directEndpoints;
-        }
-        return endpoints;
-    }
-
     /**
      * Assigns one or more global rotations to given application, if eligible. The given application is implicitly
      * stored, ensuring that the assigned rotation(s) are persisted when this returns.
diff --git a/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/deployment/InternalStepRunner.java b/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/deployment/InternalStepRunner.java
index 684c497571d..225634634b2 100644
--- a/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/deployment/InternalStepRunner.java
+++ b/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/deployment/InternalStepRunner.java
@@ -459,7 +459,7 @@ public class InternalStepRunner implements StepRunner {
 
     /** Returns true iff all calls to endpoint in the deployment give 100 consecutive 200 OK responses on /status.html. */
     private boolean containersAreUp(ApplicationId id, ZoneId zoneId, DualLogger logger) {
-        var endpoints = controller.routing().readZoneEndpointsOf(Set.of(new DeploymentId(id, zoneId)));
+        var endpoints = controller.routing().readTestRunnerEndpointsOf(Set.of(new DeploymentId(id, zoneId)));
         if ( ! endpoints.containsKey(zoneId))
             return false;
 
@@ -485,7 +485,7 @@ public class InternalStepRunner implements StepRunner {
 
     private boolean endpointsAvailable(ApplicationId id, ZoneId zone, DualLogger logger) {
         DeploymentId deployment = new DeploymentId(id, zone);
-        Map<ZoneId, List<Endpoint>> endpoints = controller.routing().readZoneEndpointsOf(Set.of(deployment));
+        Map<ZoneId, List<Endpoint>> endpoints = controller.routing().readTestRunnerEndpointsOf(Set.of(deployment));
         if ( ! endpoints.containsKey(zone)) {
             logger.log("Endpoints not yet ready.");
             return false;
@@ -593,7 +593,7 @@ public class InternalStepRunner implements StepRunner {
         deployments.add(new DeploymentId(id.application(), zoneId));
 
         logger.log("Attempting to find endpoints ...");
-        var endpoints = controller.routing().readZoneEndpointsOf(deployments);
+        var endpoints = controller.routing().readTestRunnerEndpointsOf(deployments);
         if ( ! endpoints.containsKey(zoneId)) {
             logger.log(WARNING, "Endpoints for the deployment to test vanished again, while it was still active!");
             return Optional.of(error);
diff --git a/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/restapi/application/ApplicationApiHandler.java b/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/restapi/application/ApplicationApiHandler.java
index 73a80a0a94a..d54c3c770ba 100644
--- a/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/restapi/application/ApplicationApiHandler.java
+++ b/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/restapi/application/ApplicationApiHandler.java
@@ -96,11 +96,11 @@ import com.yahoo.vespa.hosted.controller.maintenance.ResourceMeterMaintainer;
 import com.yahoo.vespa.hosted.controller.notification.Notification;
 import com.yahoo.vespa.hosted.controller.notification.NotificationSource;
 import com.yahoo.vespa.hosted.controller.persistence.SupportAccessSerializer;
+import com.yahoo.vespa.hosted.controller.routing.RoutingStatus;
+import com.yahoo.vespa.hosted.controller.routing.context.DeploymentRoutingContext;
 import com.yahoo.vespa.hosted.controller.routing.rotation.RotationId;
 import com.yahoo.vespa.hosted.controller.routing.rotation.RotationState;
 import com.yahoo.vespa.hosted.controller.routing.rotation.RotationStatus;
-import com.yahoo.vespa.hosted.controller.routing.RoutingStatus;
-import com.yahoo.vespa.hosted.controller.routing.context.DeploymentRoutingContext;
 import com.yahoo.vespa.hosted.controller.security.AccessControlRequests;
 import com.yahoo.vespa.hosted.controller.security.Credentials;
 import com.yahoo.vespa.hosted.controller.support.access.SupportAccess;
@@ -139,7 +139,6 @@ import java.util.Comparator;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
-import java.util.Objects;
 import java.util.Optional;
 import java.util.OptionalLong;
 import java.util.Scanner;
@@ -1379,18 +1378,18 @@ public class ApplicationApiHandler extends AuditLoggingRequestHandler {
         EndpointList zoneEndpoints = controller.routing().readEndpointsOf(deploymentId)
                                                .scope(Endpoint.Scope.zone);
         if (!legacyEndpoints) {
-            zoneEndpoints = zoneEndpoints.not().legacy();
+            zoneEndpoints = zoneEndpoints.not().legacy().direct();
         }
-        for (var endpoint : controller.routing().directEndpoints(zoneEndpoints, deploymentId.applicationId())) {
+        for (var endpoint : zoneEndpoints) {
             toSlime(endpoint, endpointArray.addObject());
         }
         // Add declared endpoints
         EndpointList declaredEndpoints = controller.routing().declaredEndpointsOf(application)
                                                    .targets(deploymentId);
         if (!legacyEndpoints) {
-            declaredEndpoints = declaredEndpoints.not().legacy();
+            declaredEndpoints = declaredEndpoints.not().legacy().direct();
         }
-        for (var endpoint : controller.routing().directEndpoints(declaredEndpoints, deploymentId.applicationId())) {
+        for (var endpoint : declaredEndpoints) {
             toSlime(endpoint, endpointArray.addObject());
         }
 
@@ -2077,7 +2076,7 @@ public class ApplicationApiHandler extends AuditLoggingRequestHandler {
         return new SlimeJsonResponse(testConfigSerializer.configSlime(id,
                                                                       type,
                                                                       false,
-                                                                      controller.routing().readZoneEndpointsOf(deployments),
+                                                                      controller.routing().readTestRunnerEndpointsOf(deployments),
                                                                       controller.applications().reachableContentClustersByZone(deployments)));
     }
 
diff --git a/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/restapi/routing/RoutingApiHandler.java b/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/restapi/routing/RoutingApiHandler.java
index 226a7ca9561..7b66e60b426 100644
--- a/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/restapi/routing/RoutingApiHandler.java
+++ b/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/restapi/routing/RoutingApiHandler.java
@@ -35,6 +35,7 @@ import com.yahoo.yolean.Exceptions;
 import java.net.URI;
 import java.util.Comparator;
 import java.util.List;
+import java.util.Map;
 import java.util.Objects;
 import java.util.Optional;
 import java.util.logging.Level;
@@ -98,22 +99,21 @@ public class RoutingApiHandler extends AuditLoggingRequestHandler {
     }
 
     private HttpResponse endpoints(Path path) {
-        var instanceId = instanceFrom(path);
-        var endpoints = controller.routing().readDeclaredEndpointsOf(instanceId)
-                .sortedBy(Comparator.comparing(Endpoint::name))
-                .asList();
-
-        var deployments = endpoints.stream()
-                .flatMap(e -> e.deployments().stream())
-                .distinct()
-                .sorted(Comparator.comparing(DeploymentId::dottedString))
-                .collect(Collectors.toList());
-
-        var deploymentsStatus = deployments.stream()
-                .collect(Collectors.toMap(
-                        deploymentId -> deploymentId,
-                        deploymentId -> controller.routing().of(deploymentId).routingStatus())
-                );
+        ApplicationId instanceId = instanceFrom(path);
+        List<Endpoint> endpoints = controller.routing().readDeclaredEndpointsOf(instanceId)
+                                             .sortedBy(Comparator.comparing(Endpoint::dnsName))
+                                             .asList();
+
+        List<DeploymentId> deployments = endpoints.stream()
+                                                  .flatMap(e -> e.deployments().stream())
+                                                  .distinct()
+                                                  .collect(Collectors.toList());
+
+        Map<DeploymentId, RoutingStatus> deploymentsStatus = deployments.stream()
+                                                                        .collect(Collectors.toMap(
+                                                                                deploymentId -> deploymentId,
+                                                                                deploymentId -> controller.routing().of(deploymentId).routingStatus())
+                                                                        );
 
         var slime = new Slime();
         var root = slime.setObject();
diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/ControllerTest.java b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/ControllerTest.java
index ce8c981fb5b..8ed09bfdf8a 100644
--- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/ControllerTest.java
+++ b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/ControllerTest.java
@@ -46,6 +46,7 @@ import org.junit.Test;
 import java.time.Duration;
 import java.time.Instant;
 import java.util.Collection;
+import java.util.Comparator;
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
@@ -333,12 +334,13 @@ public class ControllerTest {
         for (Deployment deployment : deployments) {
             assertEquals("Rotation names are passed to config server in " + deployment.zone(),
                     Set.of("rotation-id-01",
+                            "app1.tenant1.global.vespa.oath.cloud",
                             "app1--tenant1.global.vespa.oath.cloud",
                             "app1--tenant1.global.vespa.yahooapis.com"),
                     tester.configServer().containerEndpointNames(context.deploymentIdIn(deployment.zone())));
         }
         context.flushDnsUpdates();
-        assertEquals(2, tester.controllerTester().nameService().records().size());
+        assertEquals(3, tester.controllerTester().nameService().records().size());
 
         Optional<Record> record = tester.controllerTester().findCname("app1--tenant1.global.vespa.yahooapis.com");
         assertTrue(record.isPresent());
@@ -352,9 +354,11 @@ public class ControllerTest {
 
         List<String> globalDnsNames = tester.controller().routing().readDeclaredEndpointsOf(context.instanceId())
                                             .scope(Endpoint.Scope.global)
+                                            .sortedBy(Comparator.comparing(Endpoint::dnsName))
                                             .mapToList(Endpoint::dnsName);
         assertEquals(List.of("app1--tenant1.global.vespa.oath.cloud",
-                             "app1--tenant1.global.vespa.yahooapis.com"),
+                             "app1--tenant1.global.vespa.yahooapis.com",
+                             "app1.tenant1.global.vespa.oath.cloud"),
                      globalDnsNames);
     }
 
@@ -375,11 +379,11 @@ public class ControllerTest {
         assertFalse(deployments.isEmpty());
 
         var notWest = Set.of(
-                "rotation-id-01", "foobar--app1--tenant1.global.vespa.oath.cloud",
-                "rotation-id-02", "app1--tenant1.global.vespa.oath.cloud",
-                "rotation-id-03", "all--app1--tenant1.global.vespa.oath.cloud"
+                "rotation-id-01", "foobar--app1--tenant1.global.vespa.oath.cloud", "foobar.app1.tenant1.global.vespa.oath.cloud",
+                "rotation-id-02", "app1--tenant1.global.vespa.oath.cloud", "app1.tenant1.global.vespa.oath.cloud",
+                "rotation-id-03", "all--app1--tenant1.global.vespa.oath.cloud", "all.app1.tenant1.global.vespa.oath.cloud"
         );
-        var west = Sets.union(notWest, Set.of("rotation-id-04", "west--app1--tenant1.global.vespa.oath.cloud"));
+        var west = Sets.union(notWest, Set.of("rotation-id-04", "west--app1--tenant1.global.vespa.oath.cloud", "west.app1.tenant1.global.vespa.oath.cloud"));
 
         for (Deployment deployment : deployments) {
             assertEquals("Rotation names are passed to config server in " + deployment.zone(),
@@ -388,7 +392,7 @@ public class ControllerTest {
         }
         context.flushDnsUpdates();
 
-        assertEquals(4, tester.controllerTester().nameService().records().size());
+        assertEquals(8, tester.controllerTester().nameService().records().size());
 
         var record1 = tester.controllerTester().findCname("app1--tenant1.global.vespa.oath.cloud");
         assertTrue(record1.isPresent());
@@ -430,7 +434,7 @@ public class ControllerTest {
         for (var zone : List.of(west, central)) {
             assertEquals(
                     "Zone " + zone + " is a member of global endpoint",
-                    Set.of("rotation-id-01", "app1--tenant1.global.vespa.oath.cloud"),
+                    Set.of("rotation-id-01", "app1--tenant1.global.vespa.oath.cloud", "app1.tenant1.global.vespa.oath.cloud"),
                     tester.configServer().containerEndpointNames(context.deploymentIdIn(zone))
             );
         }
@@ -448,13 +452,13 @@ public class ControllerTest {
         for (var zone : List.of(west, central)) {
             assertEquals(
                     "Zone " + zone + " is a member of global endpoint",
-                    Set.of("rotation-id-01", "app1--tenant1.global.vespa.oath.cloud"),
+                    Set.of("rotation-id-01", "app1--tenant1.global.vespa.oath.cloud", "app1.tenant1.global.vespa.oath.cloud"),
                     tester.configServer().containerEndpointNames(context.deploymentIdIn(zone))
             );
         }
         assertEquals(
                 "Zone " + east + " is a member of global endpoint",
-                Set.of("rotation-id-02", "east--app1--tenant1.global.vespa.oath.cloud"),
+                Set.of("rotation-id-02", "east--app1--tenant1.global.vespa.oath.cloud", "east.app1.tenant1.global.vespa.oath.cloud"),
                 tester.configServer().containerEndpointNames(context.deploymentIdIn(east))
         );
 
@@ -471,9 +475,9 @@ public class ControllerTest {
             assertEquals(
                     "Zone " + zone + " is a member of global endpoint",
                     zone.equals(east)
-                            ? Set.of("rotation-id-01", "app1--tenant1.global.vespa.oath.cloud",
-                                     "rotation-id-02", "east--app1--tenant1.global.vespa.oath.cloud")
-                            : Set.of("rotation-id-01", "app1--tenant1.global.vespa.oath.cloud"),
+                            ? Set.of("rotation-id-01", "app1--tenant1.global.vespa.oath.cloud", "app1.tenant1.global.vespa.oath.cloud",
+                                     "rotation-id-02", "east--app1--tenant1.global.vespa.oath.cloud", "east.app1.tenant1.global.vespa.oath.cloud")
+                            : Set.of("rotation-id-01", "app1--tenant1.global.vespa.oath.cloud", "app1.tenant1.global.vespa.oath.cloud"),
                     tester.configServer().containerEndpointNames(context.deploymentIdIn(zone))
             );
         }
@@ -565,7 +569,7 @@ public class ControllerTest {
                     .build();
 
             context.submit(applicationPackage).deploy();
-            assertEquals(1, tester.controllerTester().nameService().records().size());
+            assertEquals(2, tester.controllerTester().nameService().records().size());
 
             {
                 Optional<Record> record = tester.controllerTester().findCname("app1--tenant1.global.vespa.oath.cloud");
@@ -608,7 +612,7 @@ public class ControllerTest {
                     .region("us-central-1")
                     .build();
             context.submit(applicationPackage).deploy();
-            assertEquals(1, tester.controllerTester().nameService().records().size());
+            assertEquals(2, tester.controllerTester().nameService().records().size());
 
             var record = tester.controllerTester().findCname("app2--tenant2.global.vespa.oath.cloud");
             assertTrue(record.isPresent());
@@ -628,7 +632,7 @@ public class ControllerTest {
             assertEquals("rotation-id-02", context.instance().rotations().get(0).rotationId().asString());
 
             // DNS records are created for the newly assigned rotation
-            assertEquals(2, tester.controllerTester().nameService().records().size());
+            assertEquals(4, tester.controllerTester().nameService().records().size());
 
             var record1 = tester.controllerTester().findCname("app1--tenant1.global.vespa.oath.cloud");
             assertTrue(record1.isPresent());
@@ -986,6 +990,7 @@ public class ControllerTest {
         var zone1 = ZoneId.from("prod", "us-west-1");
         var zone2 = ZoneId.from("prod", "us-east-3");
         var applicationPackageBuilder = new ApplicationPackageBuilder()
+                .withoutAthenzIdentity()
                 .region(zone1.region())
                 .region(zone2.region());
         tester.controllerTester().zoneRegistry()
diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/deployment/ApplicationPackageBuilder.java b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/deployment/ApplicationPackageBuilder.java
index 91a12d3b465..a338efd856c 100644
--- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/deployment/ApplicationPackageBuilder.java
+++ b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/deployment/ApplicationPackageBuilder.java
@@ -59,7 +59,7 @@ public class ApplicationPackageBuilder {
     private String upgradePolicy = null;
     private String upgradeRollout = null;
     private String globalServiceId = null;
-    private String athenzIdentityAttributes = null;
+    private String athenzIdentityAttributes = "athenz-domain='domain' athenz-service='service'";
     private String searchDefinition = "search test { }";
     private boolean explicitSystemTest = false;
     private boolean explicitStagingTest = false;
@@ -195,7 +195,12 @@ public class ApplicationPackageBuilder {
 
     public ApplicationPackageBuilder athenzIdentity(AthenzDomain domain, AthenzService service) {
         this.athenzIdentityAttributes = Text.format("athenz-domain='%s' athenz-service='%s'", domain.value(),
-                                                      service.value());
+                                                    service.value());
+        return this;
+    }
+
+    public ApplicationPackageBuilder withoutAthenzIdentity() {
+        this.athenzIdentityAttributes = null;
         return this;
     }
 
diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/deployment/DeploymentTriggerTest.java b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/deployment/DeploymentTriggerTest.java
index fd7ba8693e2..c7c434910f3 100644
--- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/deployment/DeploymentTriggerTest.java
+++ b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/deployment/DeploymentTriggerTest.java
@@ -1161,7 +1161,7 @@ public class DeploymentTriggerTest {
     @Test
     public void testsInSeparateInstance() {
         String deploymentSpec =
-                "<deployment version='1.0'>\n" +
+                "<deployment version='1.0' athenz-domain='domain' athenz-service='service'>\n" +
                 "    <instance id='canary'>\n" +
                 "        <upgrade policy='canary' />\n" +
                 "        <test />\n" +
diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/integration/ZoneRegistryMock.java b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/integration/ZoneRegistryMock.java
index 23ab91aaf8c..97cfd520e67 100644
--- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/integration/ZoneRegistryMock.java
+++ b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/integration/ZoneRegistryMock.java
@@ -52,26 +52,28 @@ public class ZoneRegistryMock extends AbstractComponent implements ZoneRegistry
      */
     public ZoneRegistryMock(SystemName system) {
         this.system = system;
-        this.zones = system.isPublic() ?
-                List.of(ZoneApiMock.fromId("test.aws-us-east-1c"),
-                        ZoneApiMock.fromId("staging.aws-us-east-1c"),
-                        ZoneApiMock.fromId("prod.aws-us-east-1c"),
-                        ZoneApiMock.fromId("prod.aws-eu-west-1a")) :
-                List.of(ZoneApiMock.fromId("test.us-east-1"),
-                        ZoneApiMock.fromId("staging.us-east-3"),
-                        ZoneApiMock.fromId("dev.us-east-1"),
-                        ZoneApiMock.fromId("dev.aws-us-east-2a"),
-                        ZoneApiMock.fromId("perf.us-east-3"),
-                        ZoneApiMock.fromId("prod.aws-us-east-1a"),
-                        ZoneApiMock.fromId("prod.ap-northeast-1"),
-                        ZoneApiMock.fromId("prod.ap-northeast-2"),
-                        ZoneApiMock.fromId("prod.ap-southeast-1"),
-                        ZoneApiMock.fromId("prod.us-east-3"),
-                        ZoneApiMock.fromId("prod.us-west-1"),
-                        ZoneApiMock.fromId("prod.us-central-1"),
-                        ZoneApiMock.fromId("prod.eu-west-1"));
-        // All zones use a shared routing method by default
-        setRoutingMethod(this.zones, system.isPublic() ? RoutingMethod.exclusive : RoutingMethod.shared);
+        if (system.isPublic()) {
+            this.zones = List.of(ZoneApiMock.fromId("test.aws-us-east-1c"),
+                                 ZoneApiMock.fromId("staging.aws-us-east-1c"),
+                                 ZoneApiMock.fromId("prod.aws-us-east-1c"),
+                                 ZoneApiMock.fromId("prod.aws-eu-west-1a"));
+            setRoutingMethod(this.zones, RoutingMethod.exclusive);
+        } else {
+            this.zones = List.of(ZoneApiMock.fromId("test.us-east-1"),
+                                 ZoneApiMock.fromId("staging.us-east-3"),
+                                 ZoneApiMock.fromId("dev.us-east-1"),
+                                 ZoneApiMock.fromId("dev.aws-us-east-2a"),
+                                 ZoneApiMock.fromId("perf.us-east-3"),
+                                 ZoneApiMock.fromId("prod.aws-us-east-1a"),
+                                 ZoneApiMock.fromId("prod.ap-northeast-1"),
+                                 ZoneApiMock.fromId("prod.ap-northeast-2"),
+                                 ZoneApiMock.fromId("prod.ap-southeast-1"),
+                                 ZoneApiMock.fromId("prod.us-east-3"),
+                                 ZoneApiMock.fromId("prod.us-west-1"),
+                                 ZoneApiMock.fromId("prod.us-central-1"),
+                                 ZoneApiMock.fromId("prod.eu-west-1"));
+            setRoutingMethod(this.zones, RoutingMethod.sharedLayer4, RoutingMethod.shared);
+        }
     }
 
     public ZoneRegistryMock setDeploymentTimeToLive(ZoneId zone, Duration duration) {
diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/maintenance/MetricsReporterTest.java b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/maintenance/MetricsReporterTest.java
index 581ec68b3dd..d97f1d58043 100644
--- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/maintenance/MetricsReporterTest.java
+++ b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/maintenance/MetricsReporterTest.java
@@ -283,7 +283,7 @@ public class MetricsReporterTest {
 
         context.submit(applicationPackage).deploy();
         reporter.maintain();
-        assertEquals("Deployment queues name services requests", 4, metrics.getMetric(MetricsReporter.NAME_SERVICE_REQUESTS_QUEUED).intValue());
+        assertEquals("Deployment queues name services requests", 6, metrics.getMetric(MetricsReporter.NAME_SERVICE_REQUESTS_QUEUED).intValue());
 
         context.flushDnsUpdates();
         reporter.maintain();
diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/ApplicationApiCloudTest.java b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/ApplicationApiCloudTest.java
index a4de6ab7700..92055c85a53 100644
--- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/ApplicationApiCloudTest.java
+++ b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/ApplicationApiCloudTest.java
@@ -238,7 +238,7 @@ public class ApplicationApiCloudTest extends ControllerContainerCloudTest {
     @Test
     public void create_application_on_deploy() {
         var application = ApplicationName.from("unique");
-        var applicationPackage = new ApplicationPackageBuilder().build();
+        var applicationPackage = new ApplicationPackageBuilder().withoutAthenzIdentity().build();
 
         assertTrue(tester.controller().applications().getApplication(TenantAndApplicationId.from(tenantName, application)).isEmpty());
 
@@ -256,6 +256,7 @@ public class ApplicationApiCloudTest extends ControllerContainerCloudTest {
         var application = ApplicationName.from("unique");
         var applicationPackage = new ApplicationPackageBuilder()
                 .trustDefaultCertificate()
+                .withoutAthenzIdentity()
                 .build();
 
         assertTrue(tester.controller().applications().getApplication(TenantAndApplicationId.from(tenantName, application)).isEmpty());
@@ -273,6 +274,7 @@ public class ApplicationApiCloudTest extends ControllerContainerCloudTest {
 
     private ApplicationPackageBuilder prodBuilder() {
         return new ApplicationPackageBuilder()
+                .withoutAthenzIdentity()
                 .instances("default")
                 .region("aws-us-east-1c");
     }
diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/ApplicationApiTest.java b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/ApplicationApiTest.java
index c78f83ced57..df8db83f229 100644
--- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/ApplicationApiTest.java
+++ b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/ApplicationApiTest.java
@@ -26,8 +26,6 @@ import com.yahoo.vespa.athenz.api.AthenzPrincipal;
 import com.yahoo.vespa.athenz.api.AthenzUser;
 import com.yahoo.vespa.athenz.api.OktaAccessToken;
 import com.yahoo.vespa.athenz.api.OktaIdentityToken;
-import com.yahoo.vespa.flags.Flags;
-import com.yahoo.vespa.flags.InMemoryFlagSource;
 import com.yahoo.vespa.hosted.controller.Application;
 import com.yahoo.vespa.hosted.controller.ControllerTester;
 import com.yahoo.vespa.hosted.controller.Instance;
@@ -126,6 +124,7 @@ public class ApplicationApiTest extends ControllerContainerTest {
     private static final String accessDenied = "{\n  \"code\" : 403,\n  \"message\" : \"Access denied\"\n}";
 
     private static final ApplicationPackage applicationPackageDefault = new ApplicationPackageBuilder()
+            .withoutAthenzIdentity()
             .instances("default")
             .globalServiceId("foo")
             .region("us-central-1")
@@ -135,6 +134,7 @@ public class ApplicationApiTest extends ControllerContainerTest {
             .build();
 
     private static final ApplicationPackage applicationPackageInstance1 = new ApplicationPackageBuilder()
+            .withoutAthenzIdentity()
             .instances("instance1")
             .globalServiceId("foo")
             .region("us-central-1")
@@ -338,6 +338,7 @@ public class ApplicationApiTest extends ControllerContainerTest {
         app1.runJob(JobType.systemTest).runJob(JobType.stagingTest).runJob(JobType.productionUsCentral1);
 
         ApplicationPackage applicationPackage = new ApplicationPackageBuilder()
+                .withoutAthenzIdentity()
                 .instances("instance1")
                 .globalServiceId("foo")
                 .region("us-west-1")
@@ -816,6 +817,7 @@ public class ApplicationApiTest extends ControllerContainerTest {
 
         // Sixth attempt has a multi-instance deployment spec, and is accepted.
         ApplicationPackage multiInstanceSpec = new ApplicationPackageBuilder()
+                .withoutAthenzIdentity()
                 .instances("instance1,instance2")
                 .region("us-central-1")
                 .parallel("us-west-1", "us-east-3")
@@ -1522,7 +1524,7 @@ public class ApplicationApiTest extends ControllerContainerTest {
         var app = deploymentTester.newDeploymentContext(createTenantAndApplication());
         var zone = ZoneId.from(Environment.prod, RegionName.from("us-west-1"));
         deploymentTester.controllerTester().zoneRegistry().setRoutingMethod(ZoneApiMock.from(zone),
-                                                                            List.of(RoutingMethod.exclusive, RoutingMethod.shared));
+                                                                            RoutingMethod.exclusive);
         ApplicationPackage applicationPackage = new ApplicationPackageBuilder()
                 .athenzIdentity(com.yahoo.config.provision.AthenzDomain.from("domain"), AthenzService.from("service"))
                 .instances("instance1")
@@ -1541,15 +1543,6 @@ public class ApplicationApiTest extends ControllerContainerTest {
                                       .userIdentity(USER_ID),
                               new File("deployment-with-routing-policy.json"));
 
-        // GET deployment including legacy endpoints
-        tester.assertResponse(request("/application/v4/tenant/tenant1/application/application1/environment/prod/region/us-west-1/instance/instance1", GET)
-                                      .userIdentity(USER_ID)
-                                      .properties(Map.of("includeLegacyEndpoints", "true")),
-                              new File("deployment-with-routing-policy-legacy.json"));
-
-        // Hide shared endpoints
-        ((InMemoryFlagSource) tester.controller().flagSource()).withBooleanFlag(Flags.HIDE_SHARED_ROUTING_ENDPOINT.id(), true);
-
         // GET deployment
         tester.assertResponse(request("/application/v4/tenant/tenant1/application/application1/environment/prod/region/us-west-1/instance/instance1", GET)
                                       .userIdentity(USER_ID),
diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/deployment-with-routing-policy-legacy.json b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/deployment-with-routing-policy-legacy.json
deleted file mode 100644
index 4955c549b4b..00000000000
--- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/deployment-with-routing-policy-legacy.json
+++ /dev/null
@@ -1,64 +0,0 @@
-{
-  "tenant": "tenant1",
-  "application": "application1",
-  "instance": "instance1",
-  "environment": "prod",
-  "region": "us-west-1",
-  "endpoints": [
-    {
-      "cluster": "default",
-      "tls": true,
-      "url": "https://instance1.application1.tenant1.us-west-1.vespa.oath.cloud/",
-      "scope": "zone",
-      "routingMethod": "exclusive",
-      "legacy": false
-    },
-    {
-      "cluster": "default",
-      "tls": true,
-      "url": "https://instance1--application1--tenant1.us-west-1.vespa.oath.cloud:4443/",
-      "scope": "zone",
-      "routingMethod": "shared",
-      "legacy": false
-    },
-    {
-      "cluster": "default",
-      "tls": true,
-      "url": "https://instance1--application1--tenant1.us-west-1.prod.vespa.yahooapis.com:4443/",
-      "scope": "zone",
-      "routingMethod": "shared",
-      "legacy": true
-    }
-  ],
-  "clusters": "http://localhost:8080/application/v4/tenant/tenant1/application/application1/instance/instance1/environment/prod/region/us-west-1/clusters",
-  "nodes": "http://localhost:8080/zone/v2/prod/us-west-1/nodes/v2/node/?recursive=true&application=tenant1.application1.instance1",
-  "yamasUrl": "http://monitoring-system.test/?environment=prod&region=us-west-1&application=tenant1.application1.instance1",
-  "version": "6.1.0",
-  "revision": "1.0.1-commit1",
-  "deployTimeEpochMs": "(ignore)",
-  "screwdriverId": "1000",
-  "gitRepository": "repository1",
-  "gitBranch": "master",
-  "gitCommit": "commit1",
-  "applicationVersion": {
-    "hash": "1.0.1-commit1",
-    "build": 1,
-    "source": {
-      "gitRepository": "repository1",
-      "gitBranch": "master",
-      "gitCommit": "commit1"
-    },
-    "sourceUrl": "repository1/tree/commit1",
-    "commit": "commit1"
-  },
-  "status": "complete",
-  "quota": "(ignore)",
-  "activity": {},
-  "metrics": {
-    "queriesPerSecond": 0.0,
-    "writesPerSecond": 0.0,
-    "documentCount": 0.0,
-    "queryLatencyMillis": 0.0,
-    "writeLatencyMillis": 0.0
-  }
-}
diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/deployment-with-routing-policy.json b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/deployment-with-routing-policy.json
index 97ac87fb5a0..4457bede34e 100644
--- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/deployment-with-routing-policy.json
+++ b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/deployment-with-routing-policy.json
@@ -12,14 +12,6 @@
       "scope": "zone",
       "routingMethod": "exclusive",
       "legacy": false
-    },
-    {
-      "cluster": "default",
-      "tls": true,
-      "url": "https://instance1--application1--tenant1.us-west-1.vespa.oath.cloud:4443/",
-      "scope": "zone",
-      "routingMethod": "shared",
-      "legacy": false
     }
   ],
   "clusters":"http://localhost:8080/application/v4/tenant/tenant1/application/application1/instance/instance1/environment/prod/region/us-west-1/clusters",
diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/deployment.json b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/deployment.json
index ab2a3bf945c..a1c32b67eb0 100644
--- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/deployment.json
+++ b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/deployment.json
@@ -6,22 +6,6 @@
   "region": "us-central-1",
   "endpoints": [
     {
-      "cluster": "default",
-      "tls": true,
-      "url": "https://instance1--application1--tenant1.us-central-1.vespa.oath.cloud:4443/",
-      "scope": "zone",
-      "routingMethod": "shared",
-      "legacy": false
-    },
-    {
-      "cluster": "foo",
-      "tls": true,
-      "url": "https://instance1--application1--tenant1.global.vespa.oath.cloud:4443/",
-      "scope": "global",
-      "routingMethod": "shared",
-      "legacy": false
-    },
-    {
       "cluster": "foo",
       "tls": true,
       "url": "https://a0.application1.tenant1.us-central-1-r.vespa.oath.cloud/",
diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/dev-us-east-1-log-second-part.json b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/dev-us-east-1-log-second-part.json
index 45df6aad67c..175c45eb2cd 100644
--- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/dev-us-east-1-log-second-part.json
+++ b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/dev-us-east-1-log-second-part.json
@@ -11,7 +11,7 @@
       {
         "at": 0,
         "type": "info",
-        "message": " |-- https://application--tenant.us-east-1.dev.vespa.oath.cloud:4443/ (cluster 'default')"
+        "message": " |-- https://application.tenant.us-east-1.dev.vespa.oath.cloud/ (cluster 'default')"
       },
       {
         "at": 0,
diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/dev-us-east-1.json b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/dev-us-east-1.json
index f2f8e14f093..2ca520c0122 100644
--- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/dev-us-east-1.json
+++ b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/dev-us-east-1.json
@@ -8,9 +8,9 @@
     {
       "cluster": "default",
       "tls": true,
-      "url": "https://instance1--application1--tenant1.us-east-1.dev.vespa.oath.cloud:4443/",
+      "url": "https://instance1.application1.tenant1.us-east-1.dev.vespa.oath.cloud/",
       "scope": "zone",
-      "routingMethod": "shared",
+      "routingMethod": "sharedLayer4",
       "legacy": false
     }
   ],
diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/prod-us-central-1.json b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/prod-us-central-1.json
index 62ad3a2db7e..25d306ae764 100644
--- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/prod-us-central-1.json
+++ b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/prod-us-central-1.json
@@ -9,22 +9,6 @@
   "region": "us-central-1",
   "endpoints": [
     {
-      "cluster": "default",
-      "tls": true,
-      "url": "https://instance1--application1--tenant1.us-central-1.vespa.oath.cloud:4443/",
-      "scope": "zone",
-      "routingMethod": "shared",
-      "legacy": false
-    },
-    {
-      "cluster": "foo",
-      "tls": true,
-      "url": "https://instance1--application1--tenant1.global.vespa.oath.cloud:4443/",
-      "scope": "global",
-      "routingMethod": "shared",
-      "legacy": false
-    },
-    {
       "cluster": "foo",
       "tls": true,
       "url": "https://a0.application1.tenant1.us-central-1-r.vespa.oath.cloud/",
diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/system-test-log.json b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/system-test-log.json
index 7f59eaf75c2..6c6092cbd88 100644
--- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/system-test-log.json
+++ b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/system-test-log.json
@@ -232,7 +232,7 @@
       {
         "at": 0,
         "type": "info",
-        "message": " |-- https://application--tenant.us-east-1.test.vespa.oath.cloud:4443/ (cluster 'default')"
+        "message": " |-- https://application.tenant.us-east-1.test.vespa.oath.cloud/ (cluster 'default')"
       },
       {
         "at": 0,
@@ -259,7 +259,7 @@
       {
         "at": 0,
         "type": "info",
-        "message": " |-- https://application--tenant.us-east-1.test.vespa.oath.cloud:4443/ (cluster 'default')"
+        "message": " |-- https://application.tenant.us-east-1.test.vespa.oath.cloud/ (cluster 'default')"
       },
       {
         "at": 0,
diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/test-config-dev.json b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/test-config-dev.json
index 0632ab7a67b..047e10b16e4 100644
--- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/test-config-dev.json
+++ b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/test-config-dev.json
@@ -5,7 +5,7 @@
   "isCI": false,
   "endpoints": {
     "dev.us-east-1": [
-      "https://my-user--application1--tenant1.us-east-1.dev.vespa.oath.cloud:4443/"
+      "https://my-user.application1.tenant1.us-east-1.dev.vespa.oath.cloud/"
     ],
     "prod.us-central-1": [
       "https://application1--tenant1.us-central-1.vespa.oath.cloud:4443/"
@@ -13,7 +13,7 @@
   },
   "zoneEndpoints": {
     "dev.us-east-1": {
-      "default": "https://my-user--application1--tenant1.us-east-1.dev.vespa.oath.cloud:4443/"
+      "default": "https://my-user.application1.tenant1.us-east-1.dev.vespa.oath.cloud/"
     },
     "prod.us-central-1": {
       "default": "https://application1--tenant1.us-central-1.vespa.oath.cloud:4443/"
diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/routing/RoutingApiTest.java b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/routing/RoutingApiTest.java
index 5b2fabcaff8..0b128ebf7a5 100644
--- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/routing/RoutingApiTest.java
+++ b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/routing/RoutingApiTest.java
@@ -258,7 +258,7 @@ public class RoutingApiTest extends ControllerContainerTest {
 
         // One shared and one exclusive zone
         deploymentTester.controllerTester().zoneRegistry().setRoutingMethod(ZoneApiMock.from(westZone),
-                                                                            RoutingMethod.shared);
+                                                                            RoutingMethod.sharedLayer4);
         deploymentTester.controllerTester().zoneRegistry().setRoutingMethod(ZoneApiMock.from(eastZone),
                                                                             RoutingMethod.exclusive);
 
@@ -273,7 +273,7 @@ public class RoutingApiTest extends ControllerContainerTest {
                 .build();
         context.submit(applicationPackage).deploy();
 
-        // GET status for zone using shared routing
+        // GET status for zone using sharedLayer4 routing
         tester.assertResponse(operatorRequest("http://localhost:8080/routing/v1/status/tenant/tenant/application/application/instance/default/environment/prod/region/us-west-1",
                                               "", Request.Method.GET),
                               new File("rotation/deployment-status-initial.json"));
@@ -331,4 +331,5 @@ public class RoutingApiTest extends ControllerContainerTest {
         tester.assertResponse(operatorRequest("http://localhost:8080/routing/v1/status/tenant/t1/application/a1/instance/default/endpoint", "", Request.Method.GET),
                               new File("endpoint/endpoints.json"));
     }
+
 }
diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/routing/responses/endpoint/endpoints.json b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/routing/responses/endpoint/endpoints.json
index f78f913cb7e..7804b277e52 100644
--- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/routing/responses/endpoint/endpoints.json
+++ b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/routing/responses/endpoint/endpoints.json
@@ -26,6 +26,33 @@
           "changedAt": 1497618757000
         }
       ]
+    },
+    {
+      "name": "default",
+      "dnsName": "a1.t1.global.vespa.oath.cloud",
+      "routingMethod": "sharedLayer4",
+      "cluster": "default",
+      "scope": "global",
+      "zones": [
+        {
+          "routingMethod": "sharedLayer4",
+          "instance": "t1:a1:default",
+          "environment": "prod",
+          "region": "us-east-3",
+          "status": "in",
+          "agent": "unknown",
+          "changedAt": 1497618757000
+        },
+        {
+          "routingMethod": "sharedLayer4",
+          "instance": "t1:a1:default",
+          "environment": "prod",
+          "region": "us-west-1",
+          "status": "in",
+          "agent": "unknown",
+          "changedAt": 1497618757000
+        }
+      ]
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/routing/rotation/RotationRepositoryTest.java b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/routing/rotation/RotationRepositoryTest.java
index 9a56123e8e3..9be95dc7a79 100644
--- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/routing/rotation/RotationRepositoryTest.java
+++ b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/routing/rotation/RotationRepositoryTest.java
@@ -60,8 +60,8 @@ public class RotationRepositoryTest {
         Rotation expected = new Rotation(new RotationId("foo-1"), "foo-1.com");
 
         assertEquals(List.of(expected.id()), rotationIds(application.instance().rotations()));
-        assertEquals(URI.create("https://app1--tenant1.global.vespa.oath.cloud:4443/"),
-                     tester.controller().routing().readDeclaredEndpointsOf(application.instanceId()).primary().get().url());
+        assertEquals(URI.create("https://app1.tenant1.global.vespa.oath.cloud/"),
+                     tester.controller().routing().readDeclaredEndpointsOf(application.instanceId()).direct().first().get().url());
         try (RotationLock lock = repository.lock()) {
             List<AssignedRotation> rotations = repository.getOrAssignRotations(application.application().deploymentSpec(),
                                                                                application.instance(),
@@ -175,10 +175,10 @@ public class RotationRepositoryTest {
         var instance2 = tester.newDeploymentContext("tenant1", "application1", "instance2");
         assertEquals(List.of(new RotationId("foo-1")), rotationIds(instance1.instance().rotations()));
         assertEquals(List.of(new RotationId("foo-2")), rotationIds(instance2.instance().rotations()));
-        assertEquals(URI.create("https://instance1--application1--tenant1.global.vespa.oath.cloud:4443/"),
-                     tester.controller().routing().readDeclaredEndpointsOf(instance1.instanceId()).primary().get().url());
-        assertEquals(URI.create("https://instance2--application1--tenant1.global.vespa.oath.cloud:4443/"),
-                     tester.controller().routing().readDeclaredEndpointsOf(instance2.instanceId()).primary().get().url());
+        assertEquals(URI.create("https://instance1.application1.tenant1.global.vespa.oath.cloud/"),
+                     tester.controller().routing().readDeclaredEndpointsOf(instance1.instanceId()).direct().first().get().url());
+        assertEquals(URI.create("https://instance2.application1.tenant1.global.vespa.oath.cloud/"),
+                     tester.controller().routing().readDeclaredEndpointsOf(instance2.instanceId()).direct().first().get().url());
     }
 
     @Test
@@ -197,10 +197,10 @@ public class RotationRepositoryTest {
         assertEquals(List.of(new RotationId("foo-1")), rotationIds(instance1.instance().rotations()));
         assertEquals(List.of(new RotationId("foo-2")), rotationIds(instance2.instance().rotations()));
 
-        assertEquals(URI.create("https://instance1--application1--tenant1.global.vespa.oath.cloud:4443/"),
-                     tester.controller().routing().readDeclaredEndpointsOf(instance1.instanceId()).primary().get().url());
-        assertEquals(URI.create("https://instance2--application1--tenant1.global.vespa.oath.cloud:4443/"),
-                     tester.controller().routing().readDeclaredEndpointsOf(instance2.instanceId()).primary().get().url());
+        assertEquals(URI.create("https://instance1.application1.tenant1.global.vespa.oath.cloud/"),
+                     tester.controller().routing().readDeclaredEndpointsOf(instance1.instanceId()).direct().first().get().url());
+        assertEquals(URI.create("https://instance2.application1.tenant1.global.vespa.oath.cloud/"),
+                     tester.controller().routing().readDeclaredEndpointsOf(instance2.instanceId()).direct().first().get().url());
     }
 
     private void assertSingleRotation(Rotation expected, List<AssignedRotation> assignedRotations, RotationRepository repository) {
diff --git a/flags/src/main/java/com/yahoo/vespa/flags/Flags.java b/flags/src/main/java/com/yahoo/vespa/flags/Flags.java
index 065636604d9..a2333ba7bda 100644
--- a/flags/src/main/java/com/yahoo/vespa/flags/Flags.java
+++ b/flags/src/main/java/com/yahoo/vespa/flags/Flags.java
@@ -130,14 +130,6 @@ public class Flags {
             "Takes effect at redeployment",
             ZONE_ID, APPLICATION_ID);
 
-    public static final UnboundBooleanFlag HIDE_SHARED_ROUTING_ENDPOINT = defineFeatureFlag(
-            "hide-shared-routing-endpoint", false,
-            List.of("tokle", "bjormel"), "2020-12-02", "2022-02-01",
-            "Whether the controller should hide shared routing layer endpoint",
-            "Takes effect immediately",
-            APPLICATION_ID
-    );
-
     public static final UnboundBooleanFlag USE_ASYNC_MESSAGE_HANDLING_ON_SCHEDULE = defineFeatureFlag(
             "async-message-handling-on-schedule", false,
             List.of("baldersheim"), "2020-12-02", "2022-02-01",