Accept job reports only from the deployment pipeline supposed to be used

2 files changed, 33 insertions, 4 deletions

diff --git a/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/restapi/application/ApplicationApiHandler.java b/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/restapi/application/ApplicationApiHandler.java
index 747e9d95558..ec5cfaacc4e 100644
--- a/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/restapi/application/ApplicationApiHandler.java
+++ b/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/restapi/application/ApplicationApiHandler.java
@@ -65,7 +65,6 @@ import com.yahoo.vespa.hosted.controller.application.JobStatus;
 import com.yahoo.vespa.hosted.controller.application.RotationStatus;
 import com.yahoo.vespa.hosted.controller.application.SourceRevision;
 import com.yahoo.vespa.hosted.controller.athenz.impl.ZmsClientFacade;
-import com.yahoo.vespa.hosted.controller.deployment.DeploymentTrigger.ChangesToCancel;
 import com.yahoo.vespa.hosted.controller.restapi.ErrorResponse;
 import com.yahoo.vespa.hosted.controller.restapi.MessageResponse;
 import com.yahoo.vespa.hosted.controller.restapi.ResourceResponse;
@@ -896,9 +895,15 @@ public class ApplicationApiHandler extends LoggingRequestHandler {
         }
     }
 
-    private HttpResponse notifyJobCompletion(String tenant, String applicationName, HttpRequest request) {
+    private HttpResponse notifyJobCompletion(String tenant, String application, HttpRequest request) {
         try {
-            controller.applications().deploymentTrigger().notifyOfCompletion(toJobReport(tenant, applicationName, toSlime(request.getData()).get()));
+            DeploymentJobs.JobReport report = toJobReport(tenant, application, toSlime(request.getData()).get());
+            if (controller.applications().require(report.applicationId()).deploymentJobs().deployedInternally())
+                throw new IllegalArgumentException(report.applicationId() + " is set up to be deployed from internally, and no " +
+                                                   "longer accepts reports from Screwdriver v3 jobs. If you need to revert " +
+                                                   "to the old pipeline, please file a ticket at yo/vespa-support and request this.");
+
+            controller.applications().deploymentTrigger().notifyOfCompletion(report);
             return new MessageResponse("ok");
         } catch (IllegalStateException e) {
             return ErrorResponse.badRequest(Exceptions.toMessageString(e));
diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/ApplicationApiTest.java b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/ApplicationApiTest.java
index 4192e4defdb..09ea360feeb 100644
--- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/ApplicationApiTest.java
+++ b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/ApplicationApiTest.java
@@ -429,14 +429,38 @@ public class ApplicationApiTest extends ControllerContainerTest {
                                       .data(createApplicationSubmissionData(packageWithService)),
                               "{\"version\":\"1.0.43-d00d\"}");
 
+        ApplicationId app1 = ApplicationId.from("tenant1", "application1", "default");
+        tester.assertResponse(request("/application/v4/tenant/tenant1/application/application1/jobreport", POST)
+                                      .screwdriverIdentity(SCREWDRIVER_ID)
+                                      .data(asJson(new DeploymentJobs.JobReport(app1,
+                                                                                JobType.component,
+                                                                                1234,
+                                                                                123,
+                                                                                Optional.of(BuildJob.defaultSourceRevision),
+                                                                                Optional.empty()))),
+                              "{\"error-code\":\"BAD_REQUEST\",\"message\":\"" + app1 + " is set up to be deployed from internally," +
+                              " and no longer accepts reports from Screwdriver v3 jobs. If you need to revert " +
+                              "to the old pipeline, please file a ticket at yo/vespa-support and request this.\"}",
+                              400);
+
         tester.assertResponse(request("/application/v4/tenant/tenant1/application/application1/instance/default/job/production-us-west-1", DELETE)
                                       .userIdentity(USER_ID),
                               "{\"message\":\"Nothing to abort.\"}");
 
         tester.assertResponse(request("/application/v4/tenant/tenant1/application/application1/submit", DELETE)
-                                      .screwdriverIdentity(SCREWDRIVER_ID),
+                                      .userIdentity(HOSTED_VESPA_OPERATOR),
                               "{\"message\":\"Unregistered 'tenant1.application1' from internal deployment pipeline.\"}");
 
+        tester.assertResponse(request("/application/v4/tenant/tenant1/application/application1/jobreport", POST)
+                                      .screwdriverIdentity(SCREWDRIVER_ID)
+                                      .data(asJson(new DeploymentJobs.JobReport(app1,
+                                                                                JobType.component,
+                                                                                1234,
+                                                                                123,
+                                                                                Optional.of(BuildJob.defaultSourceRevision),
+                                                                                Optional.empty()))),
+                              "{\"message\":\"ok\"}");
+
         // PUT (create) the authenticated user
         byte[] data = new byte[0];
         tester.assertResponse(request("/application/v4/user?user=new_user&domain=by", PUT)