Remove support for OpsDb tenants

19 files changed, 26 insertions, 168 deletions

diff --git a/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/application/v4/model/TenantCreateOptions.java b/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/application/v4/model/TenantCreateOptions.java
index aaa80ad73a2..b99c3182f03 100644
--- a/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/application/v4/model/TenantCreateOptions.java
+++ b/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/application/v4/model/TenantCreateOptions.java
@@ -6,7 +6,6 @@ import com.fasterxml.jackson.annotation.JsonInclude;
 import com.yahoo.vespa.athenz.api.AthenzDomain;
 import com.yahoo.vespa.hosted.controller.api.identifiers.Property;
 import com.yahoo.vespa.hosted.controller.api.identifiers.PropertyId;
-import com.yahoo.vespa.hosted.controller.api.identifiers.UserGroup;
 
 /**
  * @author bjorncs
@@ -17,16 +16,9 @@ public class TenantCreateOptions {
     public AthenzDomain athensDomain;
     public Property property;
     public PropertyId propertyId;
-    public UserGroup userGroup;
 
     public TenantCreateOptions() {}
 
-    public TenantCreateOptions(UserGroup userGroup, Property property, PropertyId propertyId) {
-        this.userGroup = userGroup;
-        this.property = property;
-        this.propertyId = propertyId;
-    }
-
     public TenantCreateOptions(AthenzDomain athensDomain, Property property, PropertyId propertyId) {
         this.athensDomain = athensDomain;
         this.property = property;
diff --git a/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/application/v4/model/TenantMetaData.java b/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/application/v4/model/TenantMetaData.java
index da088c76fda..a8bda2e5f10 100644
--- a/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/application/v4/model/TenantMetaData.java
+++ b/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/application/v4/model/TenantMetaData.java
@@ -6,7 +6,6 @@ import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonInclude.Include;
 import com.yahoo.vespa.athenz.api.AthenzDomain;
 import com.yahoo.vespa.hosted.controller.api.identifiers.Property;
-import com.yahoo.vespa.hosted.controller.api.identifiers.UserGroup;
 
 import java.util.Optional;
 
@@ -19,18 +18,15 @@ public class TenantMetaData {
     public TenantType type;
     public Optional<AthenzDomain> athensDomain;
     public Optional<Property> property;
-    public Optional<UserGroup> userGroup;
 
     // Required for Jackson deserialization
     public TenantMetaData() {}
 
     public TenantMetaData(TenantType type,
                           Optional<AthenzDomain> athensDomain,
-                          Optional<Property> property,
-                          Optional<UserGroup> userGroup) {
+                          Optional<Property> property) {
         this.type = type;
         this.athensDomain = athensDomain;
         this.property = property;
-        this.userGroup = userGroup;
     }
 }
diff --git a/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/application/v4/model/TenantType.java b/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/application/v4/model/TenantType.java
index 2c543af7bf8..9f89da717be 100644
--- a/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/application/v4/model/TenantType.java
+++ b/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/application/v4/model/TenantType.java
@@ -5,7 +5,6 @@ package com.yahoo.vespa.hosted.controller.api.application.v4.model;
  * @author bjorncs
  */
 public enum TenantType {
-    OPSDB,
     USER,
     ATHENS
 }
diff --git a/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/application/v4/model/TenantUpdateOptions.java b/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/application/v4/model/TenantUpdateOptions.java
index f441fdd6ec5..4e8c164a64d 100644
--- a/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/application/v4/model/TenantUpdateOptions.java
+++ b/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/application/v4/model/TenantUpdateOptions.java
@@ -7,7 +7,6 @@ import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import com.yahoo.vespa.athenz.api.AthenzDomain;
 import com.yahoo.vespa.hosted.controller.api.identifiers.Property;
-import com.yahoo.vespa.hosted.controller.api.identifiers.UserGroup;
 
 import java.util.Objects;
 import java.util.Optional;
@@ -20,14 +19,11 @@ import java.util.Optional;
 @JsonInclude(value = JsonInclude.Include.NON_ABSENT)
 public class TenantUpdateOptions {
     public final Property property;
-    public final Optional<UserGroup> userGroup;
     public final Optional<AthenzDomain> athensDomain;
 
     @JsonCreator
     public TenantUpdateOptions(@JsonProperty("property") Property property,
-                               @JsonProperty("userGroup") Optional<UserGroup> userGroup,
                                @JsonProperty("athensDomain") Optional<AthenzDomain> athensDomain) {
-        this.userGroup = userGroup;
         this.property = property;
         this.athensDomain = athensDomain;
     }
@@ -38,20 +34,18 @@ public class TenantUpdateOptions {
         if (o == null || getClass() != o.getClass()) return false;
         TenantUpdateOptions that = (TenantUpdateOptions) o;
         return Objects.equals(property, that.property) &&
-                Objects.equals(userGroup, that.userGroup) &&
                 Objects.equals(athensDomain, that.athensDomain);
     }
 
     @Override
     public int hashCode() {
-        return Objects.hash(property, userGroup, athensDomain);
+        return Objects.hash(property, athensDomain);
     }
 
     @Override
     public String toString() {
         return "TenantUpdateOptions{" +
                 "property=" + property +
-                ", userGroup=" + userGroup +
                 ", athensDomain=" + athensDomain +
                 '}';
     }
diff --git a/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/application/v4/model/TenantWithApplications.java b/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/application/v4/model/TenantWithApplications.java
index 633547cfaca..0c40e8192d6 100644
--- a/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/application/v4/model/TenantWithApplications.java
+++ b/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/application/v4/model/TenantWithApplications.java
@@ -5,7 +5,6 @@ import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.yahoo.vespa.athenz.api.AthenzDomain;
 import com.yahoo.vespa.hosted.controller.api.identifiers.Property;
-import com.yahoo.vespa.hosted.controller.api.identifiers.UserGroup;
 
 import java.util.List;
 
@@ -19,7 +18,6 @@ public class TenantWithApplications {
     public TenantType type;
     public AthenzDomain athensDomain;
     public Property property;
-    public UserGroup userGroup;
     public List<ApplicationReference> applications;
 
     public TenantWithApplications() {}
@@ -28,12 +26,10 @@ public class TenantWithApplications {
             TenantType type,
             AthenzDomain athensDomain,
             Property property,
-            UserGroup userGroup,
             List<ApplicationReference> applications) {
         this.type = type;
         this.athensDomain = athensDomain;
         this.property = property;
-        this.userGroup = userGroup;
         this.applications = applications;
     }
 }
diff --git a/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/TenantController.java b/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/TenantController.java
index 88d7a515db1..0abf296a9a7 100644
--- a/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/TenantController.java
+++ b/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/TenantController.java
@@ -8,7 +8,6 @@ import com.yahoo.vespa.athenz.api.NToken;
 import com.yahoo.vespa.curator.Lock;
 import com.yahoo.vespa.hosted.controller.api.Tenant;
 import com.yahoo.vespa.hosted.controller.api.identifiers.TenantId;
-import com.yahoo.vespa.hosted.controller.api.identifiers.UserGroup;
 import com.yahoo.vespa.hosted.controller.api.identifiers.UserId;
 import com.yahoo.vespa.hosted.controller.api.integration.athenz.AthenzClientFactory;
 import com.yahoo.vespa.hosted.controller.api.integration.athenz.ZmsClient;
@@ -61,16 +60,13 @@ public class TenantController {
     }
 
     public List<Tenant> asList(UserId user) {
-        Set<UserGroup> userGroups = entityService.getUserGroups(user);
         Set<AthenzDomain> userDomains = new HashSet<>(athenzClientFactory.createZtsClientWithServicePrincipal()
                                                               .getTenantDomainsForUser(AthenzUser.fromUserId(user.id())));
-
-        Predicate<Tenant> hasUsersGroup = (tenant) -> tenant.getUserGroup().isPresent() && userGroups.contains(tenant.getUserGroup().get());
         Predicate<Tenant> hasUsersDomain = (tenant) -> tenant.getAthensDomain().isPresent() && userDomains.contains(tenant.getAthensDomain().get());
         Predicate<Tenant> isUserTenant = (tenant) -> tenant.getId().equals(user.toTenantId());
 
         return asList().stream()
-                .filter(t -> hasUsersGroup.test(t) || hasUsersDomain.test(t) || isUserTenant.test(t))
+                .filter(t -> hasUsersDomain.test(t) || isUserTenant.test(t))
                 .collect(Collectors.toList());
     }
 
@@ -83,11 +79,10 @@ public class TenantController {
         }
     }
 
-    /** Creates an Athens or OpsDb tenant. */
-    // TODO: Rename to createAthensTenant and move creation here when opsDbTenant creation is removed */
-    public void addTenant(Tenant tenant, Optional<NToken> token) {
+    /** Creates an Athens tenant. */
+    public void createAthenzTenant(Tenant tenant, NToken token) {
         try (Lock lock = lock(tenant.getId())) {
-            internalCreateTenant(tenant, token);
+            internalCreateTenant(tenant, Optional.of(token));
         }
     }
 
diff --git a/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/api/Tenant.java b/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/api/Tenant.java
index 9b0cf96bb89..0edc63c69f5 100644
--- a/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/api/Tenant.java
+++ b/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/api/Tenant.java
@@ -1,12 +1,11 @@
 // Copyright 2017 Yahoo Holdings. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
 package com.yahoo.vespa.hosted.controller.api;
 
-import com.yahoo.vespa.hosted.controller.api.application.v4.model.TenantType;
 import com.yahoo.vespa.athenz.api.AthenzDomain;
+import com.yahoo.vespa.hosted.controller.api.application.v4.model.TenantType;
 import com.yahoo.vespa.hosted.controller.api.identifiers.Property;
 import com.yahoo.vespa.hosted.controller.api.identifiers.PropertyId;
 import com.yahoo.vespa.hosted.controller.api.identifiers.TenantId;
-import com.yahoo.vespa.hosted.controller.api.identifiers.UserGroup;
 
 import java.util.Optional;
 
@@ -14,36 +13,29 @@ import java.util.Optional;
  * @author smorgrav
  */
 // TODO: Move this and everything it owns to com.yahoo.hosted.controller.Tenant and com.yahoo.hosted.controller.tenant.*
+// TODO: Use polymorphism to represent the two tenant types
 public class Tenant {
 
     private final TenantId id;
-    private final Optional<UserGroup> userGroup;
     private final Optional<Property> property;
     private final Optional<AthenzDomain> athenzDomain;
     private final Optional<PropertyId> propertyId;
 
     // TODO: Use factory methods. They're down at the bottom!
-    public Tenant(TenantId id, Optional<UserGroup> userGroup, Optional<Property> property, Optional<AthenzDomain> athenzDomain) {
-        this(id, userGroup, property, athenzDomain, Optional.empty());
+    public Tenant(TenantId id, Optional<Property> property, Optional<AthenzDomain> athenzDomain) {
+        this(id, property, athenzDomain, Optional.empty());
     }
 
-    public Tenant(TenantId id, Optional<UserGroup> userGroup, Optional<Property> property, Optional<AthenzDomain> athenzDomain, Optional<PropertyId> propertyId) {
+    public Tenant(TenantId id, Optional<Property> property, Optional<AthenzDomain> athenzDomain, Optional<PropertyId> propertyId) {
         if (id.isUser()) {
-            require( ! userGroup.isPresent(), "User tenant '%s' cannot have a user group.", id);
             require( ! property.isPresent(), "User tenant '%s' cannot have a property.", id);
             require( ! propertyId.isPresent(), "User tenant '%s' cannot have a property ID.", id);
             require( ! athenzDomain.isPresent(), "User tenant '%s' cannot have an athens domain.", id);
-        } else if (athenzDomain.isPresent()) {
+        } else  {
             require(   property.isPresent(), "Athens tenant '%s' must have a property.", id);
-            require( ! userGroup.isPresent(), "Athens tenant '%s' cannot have a user group.", id);
             require(   athenzDomain.isPresent(), "Athens tenant '%s' must have an athens domain.", id);
-        } else {
-            require(   property.isPresent(), "OpsDB tenant '%s' must have a property.", id);
-            require(   userGroup.isPresent(), "OpsDb tenant '%s' must have a user group.", id);
-            require( ! athenzDomain.isPresent(), "OpsDb tenant '%s' cannot have an athens domain.", id);
         }
         this.id = id;
-        this.userGroup = userGroup;
         this.property = property;
         this.athenzDomain = athenzDomain;
         this.propertyId = propertyId; // TODO: Check validity after TODO@14. OpsDb tenants have this set in Sherpa, while athens tenants do not.
@@ -51,15 +43,12 @@ public class Tenant {
     }
 
     public boolean isAthensTenant() { return athenzDomain.isPresent(); }
-    public boolean isOpsDbTenant() { return userGroup.isPresent();}
 
     public TenantType tenantType() {
         if (athenzDomain.isPresent()) {
             return TenantType.ATHENS;
-        } else if (id.isUser()) {
-            return TenantType.USER;
         } else {
-            return TenantType.OPSDB;
+            return TenantType.USER;
         }
     }
 
@@ -67,10 +56,6 @@ public class Tenant {
         return id;
     }
 
-    public Optional<UserGroup> getUserGroup() {
-        return userGroup;
-    }
-
     /** OpsDB property name of the tenant, or Optional.empty() if none is stored. */
     public Optional<Property> getProperty() {
         return property;
@@ -93,19 +78,7 @@ public class Tenant {
         if (id.isUser()) {
             throw new IllegalArgumentException("Invalid id for non-user tenant: " + id);
         }
-        return new Tenant(id, Optional.empty(), Optional.ofNullable(property),
-                          Optional.ofNullable(athensDomain), propertyId);
-    }
-
-    public static Tenant createOpsDbTenant(TenantId id, UserGroup userGroup, Property property, Optional<PropertyId> propertyId) {
-        if (id.isUser()) {
-            throw new IllegalArgumentException("Invalid id for non-user tenant: " + id);
-        }
-        return new Tenant(id, Optional.ofNullable(userGroup), Optional.ofNullable(property), Optional.empty(), propertyId);
-    }
-
-    public static Tenant createOpsDbTenant(TenantId id, UserGroup userGroup, Property property) {
-        return createOpsDbTenant(id, userGroup, property, Optional.empty());
+        return new Tenant(id, Optional.ofNullable(property), Optional.ofNullable(athensDomain), propertyId);
     }
 
     public static Tenant createUserTenant(TenantId id) {
@@ -123,7 +96,6 @@ public class Tenant {
         Tenant tenant = (Tenant) o;
 
         if (!id.equals(tenant.id)) return false;
-        if (!userGroup.equals(tenant.userGroup)) return false;
         if (!property.equals(tenant.property)) return false;
         if (!athenzDomain.equals(tenant.athenzDomain)) return false;
         if (!propertyId.equals(tenant.propertyId)) return false;
@@ -133,7 +105,6 @@ public class Tenant {
     @Override
     public int hashCode() {
         int result = id.hashCode();
-        result = 31 * result + userGroup.hashCode();
         result = 31 * result + property.hashCode();
         result = 31 * result + athenzDomain.hashCode();
         result = 31 * result + propertyId.hashCode();
diff --git a/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/restapi/application/ApplicationApiHandler.java b/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/restapi/application/ApplicationApiHandler.java
index 58e30c11baf..1c2236a6791 100644
--- a/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/restapi/application/ApplicationApiHandler.java
+++ b/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/restapi/application/ApplicationApiHandler.java
@@ -23,6 +23,7 @@ import com.yahoo.vespa.athenz.api.AthenzDomain;
 import com.yahoo.vespa.athenz.api.AthenzIdentity;
 import com.yahoo.vespa.athenz.api.AthenzPrincipal;
 import com.yahoo.vespa.athenz.api.AthenzUser;
+import com.yahoo.vespa.athenz.api.NToken;
 import com.yahoo.vespa.config.SlimeUtils;
 import com.yahoo.vespa.hosted.controller.AlreadyExistsException;
 import com.yahoo.vespa.hosted.controller.Application;
@@ -49,7 +50,6 @@ import com.yahoo.vespa.hosted.controller.api.identifiers.Property;
 import com.yahoo.vespa.hosted.controller.api.identifiers.PropertyId;
 import com.yahoo.vespa.hosted.controller.api.identifiers.ScrewdriverId;
 import com.yahoo.vespa.hosted.controller.api.identifiers.TenantId;
-import com.yahoo.vespa.hosted.controller.api.identifiers.UserGroup;
 import com.yahoo.vespa.hosted.controller.api.identifiers.UserId;
 import com.yahoo.vespa.hosted.controller.api.integration.athenz.AthenzClientFactory;
 import com.yahoo.vespa.hosted.controller.api.integration.athenz.ZmsException;
@@ -631,18 +631,7 @@ public class ApplicationApiHandler extends LoggingRequestHandler {
             case USER: {
                 throw new BadRequestException("Cannot set property or OpsDB user group for user tenant");
             }
-            case OPSDB: {
-                UserGroup userGroup = new UserGroup(mandatory("userGroup", requestData).asString());
-                updatedTenant = Tenant.createOpsDbTenant(new TenantId(tenantName),
-                                                         userGroup,
-                                                         new Property(mandatory("property", requestData).asString()),
-                                                         optional("propertyId", requestData).map(PropertyId::new));
-                controller.tenants().updateTenant(updatedTenant, getUserPrincipal(request).getNToken());
-                break;
-            }
             case ATHENS: {
-                if (requestData.field("userGroup").valid())
-                    throw new BadRequestException("Cannot set OpsDB user group to Athens tenant");
                 updatedTenant = Tenant.createAthensTenant(new TenantId(tenantName),
                                                           new AthenzDomain(mandatory("athensDomain", requestData).asString()),
                                                           new Property(mandatory("property", requestData).asString()),
@@ -664,14 +653,15 @@ public class ApplicationApiHandler extends LoggingRequestHandler {
         Inspector requestData = toSlime(request.getData()).get();
 
         Tenant tenant = new Tenant(new TenantId(tenantName),
-                                   optional("userGroup", requestData).map(UserGroup::new),
                                    optional("property", requestData).map(Property::new),
                                    optional("athensDomain", requestData).map(AthenzDomain::new),
                                    optional("propertyId", requestData).map(PropertyId::new));
         if (tenant.isAthensTenant())
             throwIfNotAthenzDomainAdmin(new AthenzDomain(mandatory("athensDomain", requestData).asString()), request);
 
-        controller.tenants().addTenant(tenant, getUserPrincipal(request).getNToken());
+        NToken token = getUserPrincipal(request).getNToken()
+                .orElseThrow(() -> new IllegalArgumentException("Could not create " + tenant + ": No NToken provided"));
+        controller.tenants().createAthenzTenant(tenant, token);
         return tenant(tenant, request, true);
     }
 
@@ -921,7 +911,6 @@ public class ApplicationApiHandler extends LoggingRequestHandler {
         tenant.getAthensDomain().ifPresent(a -> object.setString("athensDomain", a.getName()));
         tenant.getProperty().ifPresent(p -> object.setString("property", p.id()));
         tenant.getPropertyId().ifPresent(p -> object.setString("propertyId", p.toString()));
-        tenant.getUserGroup().ifPresent(g -> object.setString("userGroup", g.id()));
         Cursor applicationArray = object.setArray("applications");
         if (listApplications) { // This cludge is needed because we call this after deleting the tenant. As this call makes another tenant lookup it will fail. TODO is to support lookup on tenant
             for (Application application : controller.applications().asList(TenantName.from(tenant.getId().id()))) {
@@ -959,7 +948,6 @@ public class ApplicationApiHandler extends LoggingRequestHandler {
         metaData.setString("type", tenant.tenantType().name());
         tenant.getAthensDomain().ifPresent(a -> metaData.setString("athensDomain", a.getName()));
         tenant.getProperty().ifPresent(p -> metaData.setString("property", p.id()));
-        tenant.getUserGroup().ifPresent(g -> metaData.setString("userGroup", g.id()));
         object.setString("url", withPath("/application/v4/tenant/" + tenant.getId().id(), requestURI).toString());
     }
 
diff --git a/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/restapi/filter/ControllerAuthorizationFilter.java b/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/restapi/filter/ControllerAuthorizationFilter.java
index 5a8cdc7bc6a..efd1dd8caa7 100644
--- a/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/restapi/filter/ControllerAuthorizationFilter.java
+++ b/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/restapi/filter/ControllerAuthorizationFilter.java
@@ -167,13 +167,6 @@ public class ControllerAuthorizationFilter implements SecurityRequestFilter {
             case ATHENS:
                 return clientFactory.createZmsClientWithServicePrincipal()
                         .hasTenantAdminAccess(identity, tenant.getAthensDomain().get());
-            case OPSDB: {
-                if (!(identity instanceof AthenzUser)) {
-                    return false;
-                }
-                AthenzUser user = (AthenzUser) identity;
-                return entityService.isGroupMember(new UserId(user.getName()), tenant.getUserGroup().get());
-            }
             case USER: {
                 if (!(identity instanceof AthenzUser)) {
                     return false;
diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/ControllerTester.java b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/ControllerTester.java
index 691a5ef223d..b4bbc0f68e7 100644
--- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/ControllerTester.java
+++ b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/ControllerTester.java
@@ -196,7 +196,7 @@ public final class ControllerTester {
 
         Tenant tenant = Tenant.createAthensTenant(id, createDomain(domainName), new Property("app1Property"),
                 propertyId == null ? Optional.empty() : Optional.of(new PropertyId(propertyId.toString())));
-        controller().tenants().addTenant(tenant, Optional.of(TestIdentities.userNToken));
+        controller().tenants().createAthenzTenant(tenant, TestIdentities.userNToken);
         assertNotNull(controller().tenants().tenant(id));
         return id;
     }
diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/TestIdentities.java b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/TestIdentities.java
index b7549364b73..6c74756ca33 100644
--- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/TestIdentities.java
+++ b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/TestIdentities.java
@@ -1,7 +1,7 @@
 // Copyright 2017 Yahoo Holdings. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
 package com.yahoo.vespa.hosted.controller;
 
-import com.yahoo.vespa.hosted.controller.api.Tenant;
+import com.yahoo.vespa.athenz.api.NToken;
 import com.yahoo.vespa.hosted.controller.api.identifiers.EnvironmentId;
 import com.yahoo.vespa.hosted.controller.api.identifiers.InstanceId;
 import com.yahoo.vespa.hosted.controller.api.identifiers.Property;
@@ -9,7 +9,6 @@ import com.yahoo.vespa.hosted.controller.api.identifiers.RegionId;
 import com.yahoo.vespa.hosted.controller.api.identifiers.TenantId;
 import com.yahoo.vespa.hosted.controller.api.identifiers.UserGroup;
 import com.yahoo.vespa.hosted.controller.api.identifiers.UserId;
-import com.yahoo.vespa.athenz.api.NToken;
 
 /**
  * @author Tony Vaagenes
@@ -30,8 +29,6 @@ public class TestIdentities {
 
     public static Property property = new Property("property");
 
-    public static Tenant tenant = Tenant.createOpsDbTenant(tenantId, userGroup1, property);
-
     public static NToken userNToken = new NToken("dummy");
 
 }
diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/maintenance/ApplicationOwnershipConfirmerTest.java b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/maintenance/ApplicationOwnershipConfirmerTest.java
index c775dd3fd7c..0309eaf7d25 100644
--- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/maintenance/ApplicationOwnershipConfirmerTest.java
+++ b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/maintenance/ApplicationOwnershipConfirmerTest.java
@@ -3,7 +3,6 @@ package com.yahoo.vespa.hosted.controller.maintenance;
 
 import com.yahoo.config.provision.ApplicationId;
 import com.yahoo.vespa.hosted.controller.Application;
-import com.yahoo.vespa.hosted.controller.api.Tenant;
 import com.yahoo.vespa.hosted.controller.api.identifiers.PropertyId;
 import com.yahoo.vespa.hosted.controller.api.identifiers.TenantId;
 import com.yahoo.vespa.hosted.controller.api.integration.organization.IssueId;
@@ -45,7 +44,7 @@ public class ApplicationOwnershipConfirmerTest {
         Supplier<Application> propertyApp = () -> tester.controller().applications().require(ApplicationId.from("property", "application", "default"));
 
         TenantId user = new TenantId("by-user");
-        tester.controller().tenants().addTenant(Tenant.createUserTenant(user), Optional.empty());
+        tester.controller().tenants().createUserTenant("user");
         tester.createAndDeploy(user, "application", 2, "default");
         Supplier<Application> userApp = () -> tester.controller().applications().require(ApplicationId.from("by-user", "application", "default"));
 
diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/ContainerControllerTester.java b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/ContainerControllerTester.java
index 256dcca7a05..b810c3adeb5 100644
--- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/ContainerControllerTester.java
+++ b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/ContainerControllerTester.java
@@ -75,10 +75,10 @@ public class ContainerControllerTester {
 
     public Application createApplication(String athensDomain, String tenant, String application) {
         AthenzDomain domain1 = addTenantAthenzDomain(athensDomain, "mytenant");
-        controller().tenants().addTenant(Tenant.createAthensTenant(new TenantId(tenant), domain1,
-                                                                 new Property("property1"),
-                                                                 Optional.of(new PropertyId("1234"))),
-                                       Optional.of(TestIdentities.userNToken));
+        controller().tenants().createAthenzTenant(Tenant.createAthensTenant(new TenantId(tenant), domain1,
+                                                                            new Property("property1"),
+                                                                            Optional.of(new PropertyId("1234"))),
+                                                  TestIdentities.userNToken);
         ApplicationId app = ApplicationId.from(tenant, application, "default");
         return controller().applications().createApplication(app, Optional.of(TestIdentities.userNToken));
     }
diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/ApplicationApiTest.java b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/ApplicationApiTest.java
index 4b59e57fd5a..0ae9cf767d0 100644
--- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/ApplicationApiTest.java
+++ b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/ApplicationApiTest.java
@@ -158,18 +158,6 @@ public class ApplicationApiTest extends ControllerContainerTest {
         tester.assertResponse(request("/application/v4/tenant/tenant2", GET).userIdentity(USER_ID),
                               new File("tenant-without-applications-with-id.json"));
 
-        // Test legacy OpsDB tenants
-        // POST (add) an OpsDB tenant with property ID
-        tester.assertResponse(request("/application/v4/tenant/tenant3", POST)
-                                      .userIdentity(USER_ID)
-                                      .data("{\"userGroup\":\"group1\",\"property\":\"property1\",\"propertyId\":\"1234\"}"),
-                              new File("opsdb-tenant-with-id-without-applications.json"));
-        // PUT (modify) the OpsDB tenant to set another property
-        tester.assertResponse(request("/application/v4/tenant/tenant3", PUT)
-                                      .userIdentity(USER_ID)
-                                      .data("{\"userGroup\":\"group1\",\"property\":\"property2\",\"propertyId\":\"4321\"}"),
-                              new File("opsdb-tenant-with-new-id-without-applications.json"));
-
         // POST (create) an application
         tester.assertResponse(request("/application/v4/tenant/tenant1/application/application1", POST)
                                       .userIdentity(USER_ID)
@@ -558,6 +546,7 @@ public class ApplicationApiTest extends ControllerContainerTest {
         // Add the same tenant again
         tester.assertResponse(request("/application/v4/tenant/tenant1", POST)
                                       .userIdentity(USER_ID)
+                                      .nToken(N_TOKEN)
                                       .data("{\"athensDomain\":\"domain1\", \"property\":\"property1\"}"),
                               "{\"error-code\":\"BAD_REQUEST\",\"message\":\"Tenant 'tenant1' already exists\"}",
                               400);
diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/opsdb-tenant-with-id-without-applications.json b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/opsdb-tenant-with-id-without-applications.json
deleted file mode 100644
index a2e70d9c1eb..00000000000
--- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/opsdb-tenant-with-id-without-applications.json
+++ /dev/null
@@ -1,21 +0,0 @@
-{
-  "tenant": "tenant3",
-  "type": "OPSDB",
-  "property": "property1",
-  "propertyId": "1234",
-  "userGroup": "group1",
-  "applications": [
-
-  ],
-  "propertyUrl": "www.properties.tld/1234",
-  "contactsUrl": "www.contacts.tld/1234",
-  "issueCreationUrl": "www.issues.tld/1234",
-  "contacts": [
-    [
-      "alice"
-    ],
-    [
-      "bob"
-    ]
-  ]
-}
diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/opsdb-tenant-with-new-id-without-applications.json b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/opsdb-tenant-with-new-id-without-applications.json
deleted file mode 100644
index f9161ea49b1..00000000000
--- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/opsdb-tenant-with-new-id-without-applications.json
+++ /dev/null
@@ -1,16 +0,0 @@
-{
-  "tenant": "tenant3",
-  "type": "OPSDB",
-  "property": "property2",
-  "propertyId": "4321",
-  "userGroup": "group1",
-  "applications": [
-
-  ],
-  "propertyUrl": "www.properties.tld/4321",
-  "contactsUrl": "www.contacts.tld/4321",
-  "issueCreationUrl": "www.issues.tld/4321",
-  "contacts": [
-
-  ]
-}
diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/recursive-root.json b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/recursive-root.json
index a4395faede4..cea35b764b2 100644
--- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/recursive-root.json
+++ b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/recursive-root.json
@@ -1,5 +1,4 @@
 [
   @include(tenant2.json),
-  @include(tenant3.json),
   @include(tenant1-recursive.json)
 ]
diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/recursive-until-tenant-root.json b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/recursive-until-tenant-root.json
index 35ed8181fac..8b6b1ff7cf5 100644
--- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/recursive-until-tenant-root.json
+++ b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/recursive-until-tenant-root.json
@@ -1,6 +1,5 @@
 [
   @include(tenant2.json),
-  @include(tenant3.json),
   @include(tenant-with-application.json)
 ]
 
diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/tenant3.json b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/tenant3.json
deleted file mode 100644
index fdf3ca490f4..00000000000
--- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/responses/tenant3.json
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  "tenant": "tenant3",
-  "type": "OPSDB",
-  "property": "property2",
-  "propertyId": "4321",
-  "userGroup": "group1",
-  "applications": [],
-  "propertyUrl": "www.properties.tld/4321",
-  "contactsUrl": "www.contacts.tld/4321",
-  "issueCreationUrl": "www.issues.tld/4321",
-  "contacts": []
-}
\ No newline at end of file