Merge pull request #11771 from vespa-engine/bjorncs/access-control-validation

Bjorncs/access control validation

12 files changed, 296 insertions, 53 deletions

diff --git a/config-model/src/main/java/com/yahoo/config/model/test/HostedConfigModelRegistry.java b/config-model/src/main/java/com/yahoo/config/model/test/HostedConfigModelRegistry.java
new file mode 100644
index 00000000000..9099a527dea
--- /dev/null
+++ b/config-model/src/main/java/com/yahoo/config/model/test/HostedConfigModelRegistry.java
@@ -0,0 +1,19 @@
+// Copyright 2020 Oath Inc. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
+package com.yahoo.config.model.test;
+
+import com.yahoo.config.model.ConfigModelRegistry;
+import com.yahoo.config.model.MapConfigModelRegistry;
+
+/**
+ * Creates a {@link ConfigModelRegistry} instance that simulates the hosted environment.
+ *
+ * @author bjorncs
+ */
+public class HostedConfigModelRegistry {
+
+    private HostedConfigModelRegistry() {}
+
+    public static ConfigModelRegistry create() {
+        return MapConfigModelRegistry.createFromList(new ModelBuilderAddingAccessControlFilter());
+    }
+}
diff --git a/config-model/src/main/java/com/yahoo/config/model/test/ModelBuilderAddingAccessControlFilter.java b/config-model/src/main/java/com/yahoo/config/model/test/ModelBuilderAddingAccessControlFilter.java
new file mode 100644
index 00000000000..c69efd5d447
--- /dev/null
+++ b/config-model/src/main/java/com/yahoo/config/model/test/ModelBuilderAddingAccessControlFilter.java
@@ -0,0 +1,86 @@
+// Copyright 2020 Oath Inc. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
+package com.yahoo.config.model.test;
+
+import com.yahoo.component.ComponentId;
+import com.yahoo.component.ComponentSpecification;
+import com.yahoo.component.chain.dependencies.Dependencies;
+import com.yahoo.component.chain.model.ChainedComponentModel;
+import com.yahoo.config.model.ConfigModel;
+import com.yahoo.config.model.ConfigModelContext;
+import com.yahoo.config.model.builder.xml.ConfigModelBuilder;
+import com.yahoo.config.model.builder.xml.ConfigModelId;
+import com.yahoo.container.bundle.BundleInstantiationSpecification;
+import com.yahoo.vespa.model.container.ApplicationContainerCluster;
+import com.yahoo.vespa.model.container.ContainerModel;
+import com.yahoo.vespa.model.container.component.chain.Chain;
+import com.yahoo.vespa.model.container.http.AccessControl;
+import com.yahoo.vespa.model.container.http.Filter;
+import com.yahoo.vespa.model.container.http.Http;
+import com.yahoo.vespa.model.container.xml.ContainerModelBuilder;
+import org.w3c.dom.Element;
+
+import java.util.Collection;
+import java.util.List;
+
+/**
+ * A {@link ConfigModelBuilder} that configures a dummy filter component to the {@link AccessControl#ACCESS_CONTROL_CHAIN_ID} filter chain.
+ *
+ * @author bjorncs
+ */
+public class ModelBuilderAddingAccessControlFilter
+        extends ConfigModelBuilder<ModelBuilderAddingAccessControlFilter.ModelPlaceholder> {
+
+    public ModelBuilderAddingAccessControlFilter() {
+        super(ModelPlaceholder.class);
+    }
+
+    @Override
+    public List<ConfigModelId> handlesElements() { return ContainerModelBuilder.configModelIds; }
+
+    @Override
+    public void doBuild(ModelPlaceholder model, Element spec, ConfigModelContext modelContext) {
+        for (ContainerModel containerModel : model.containers) {
+            addFilterToContainerCluster(containerModel);
+        }
+    }
+
+    private static void addFilterToContainerCluster(ContainerModel containerModel) {
+        if (!(containerModel.getCluster() instanceof ApplicationContainerCluster)) return;
+        ApplicationContainerCluster cluster = (ApplicationContainerCluster) containerModel.getCluster();
+        Http http = cluster.getHttp();
+        if (http.getAccessControl().isPresent()) {
+            Chain<Filter> chain = http.getFilterChains()
+                    .allChains()
+                    .getComponent(AccessControl.ACCESS_CONTROL_CHAIN_ID);
+            if (chain == null) return;
+            if (!chain.getInnerComponents().isEmpty()) return;
+            chain.addInnerComponent(new DummyAccessControlFilterModel());
+        }
+    }
+
+    public static class ModelPlaceholder extends ConfigModel {
+        final Collection<ContainerModel> containers;
+
+        public ModelPlaceholder(ConfigModelContext modelContext, Collection<ContainerModel> containers) {
+            super(modelContext);
+            this.containers = containers;
+        }
+
+        @Override
+        public boolean isServing() { return false; }
+    }
+
+    private static class DummyAccessControlFilterModel extends Filter {
+
+        DummyAccessControlFilterModel() { super(createDummyComponentModel()); }
+
+        static ChainedComponentModel createDummyComponentModel() {
+            return new ChainedComponentModel(
+                    new BundleInstantiationSpecification(
+                            new ComponentId("dummy-filter"),
+                            new ComponentSpecification("com.test.DummyAccessControlFilter"),
+                            new ComponentSpecification("dummy-bundle")),
+                    Dependencies.emptyDependencies());
+        }
+    }
+}
diff --git a/config-model/src/main/java/com/yahoo/vespa/model/application/validation/AccessControlFilterValidator.java b/config-model/src/main/java/com/yahoo/vespa/model/application/validation/AccessControlFilterValidator.java
new file mode 100644
index 00000000000..774f0ba52bc
--- /dev/null
+++ b/config-model/src/main/java/com/yahoo/vespa/model/application/validation/AccessControlFilterValidator.java
@@ -0,0 +1,39 @@
+// Copyright 2020 Oath Inc. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
+package com.yahoo.vespa.model.application.validation;
+
+import com.yahoo.config.model.deploy.DeployState;
+import com.yahoo.vespa.model.VespaModel;
+import com.yahoo.vespa.model.container.component.chain.Chain;
+import com.yahoo.vespa.model.container.http.AccessControl;
+import com.yahoo.vespa.model.container.http.Filter;
+import com.yahoo.vespa.model.container.http.FilterChains;
+import com.yahoo.vespa.model.container.http.Http;
+
+/**
+ * Validates that 'access-control' is not enabled when no access control filter implementation is available.
+ *
+ * @author bjorncs
+ */
+public class AccessControlFilterValidator extends Validator {
+
+    @Override
+    public void validate(VespaModel model, DeployState deployState) {
+        model.getContainerClusters().forEach((id, cluster) -> {
+            Http http = cluster.getHttp();
+            if (http != null) {
+                if (http.getAccessControl().isPresent()) {
+                    verifyAccessControlFilterPresent(http);
+                }
+            }
+        });
+    }
+
+    private static void verifyAccessControlFilterPresent(Http http) {
+        FilterChains filterChains = http.getFilterChains();
+        Chain<Filter> chain = filterChains.allChains().getComponent(AccessControl.ACCESS_CONTROL_CHAIN_ID);
+        if (chain.getInnerComponents().isEmpty()) {
+            // No access control filter configured - it's up to a config model plugin to provide an implementation of an access control filter.
+            throw new IllegalArgumentException("The 'access-control' feature is not available in open-source Vespa.");
+        }
+    }
+}
diff --git a/config-model/src/main/java/com/yahoo/vespa/model/application/validation/Validation.java b/config-model/src/main/java/com/yahoo/vespa/model/application/validation/Validation.java
index 7d0d068f9d6..4959970d98e 100644
--- a/config-model/src/main/java/com/yahoo/vespa/model/application/validation/Validation.java
+++ b/config-model/src/main/java/com/yahoo/vespa/model/application/validation/Validation.java
@@ -19,7 +19,7 @@ import com.yahoo.vespa.model.application.validation.change.IndexedSearchClusterC
 import com.yahoo.vespa.model.application.validation.change.IndexingModeChangeValidator;
 import com.yahoo.vespa.model.application.validation.change.StartupCommandChangeValidator;
 import com.yahoo.vespa.model.application.validation.change.StreamingSearchClusterChangeValidator;
-import com.yahoo.vespa.model.application.validation.first.AccessControlValidator;
+import com.yahoo.vespa.model.application.validation.first.AccessControlOnFirstDeploymentValidator;
 
 import java.time.Instant;
 import java.util.Arrays;
@@ -57,6 +57,7 @@ public class Validation {
         new RankingConstantsValidator().validate(model, deployState);
         new SecretStoreValidator().validate(model, deployState);
         new TlsSecretsValidator().validate(model, deployState);
+        new AccessControlFilterValidator().validate(model, deployState);
 
         List<ConfigChangeAction> result = Collections.emptyList();
         if (deployState.getProperties().isFirstTimeDeployment()) {
@@ -91,7 +92,7 @@ public class Validation {
     }
 
     private static void validateFirstTimeDeployment(VespaModel model, DeployState deployState) {
-        new AccessControlValidator().validate(model, deployState);
+        new AccessControlOnFirstDeploymentValidator().validate(model, deployState);
     }
 
 }
diff --git a/config-model/src/main/java/com/yahoo/vespa/model/application/validation/first/AccessControlValidator.java b/config-model/src/main/java/com/yahoo/vespa/model/application/validation/first/AccessControlOnFirstDeploymentValidator.java
index b7bbed7ffda..97153e42ee5 100644
--- a/config-model/src/main/java/com/yahoo/vespa/model/application/validation/first/AccessControlValidator.java
+++ b/config-model/src/main/java/com/yahoo/vespa/model/application/validation/first/AccessControlOnFirstDeploymentValidator.java
@@ -23,7 +23,7 @@ import static com.yahoo.vespa.model.container.http.AccessControl.isBuiltinGetOnl
  *
  * @author gjoranv
  */
-public class AccessControlValidator extends Validator {
+public class AccessControlOnFirstDeploymentValidator extends Validator {
 
     @Override
     public void validate(VespaModel model, DeployState deployState) {
diff --git a/config-model/src/test/java/com/yahoo/vespa/model/application/validation/AccessControlFilterValidatorTest.java b/config-model/src/test/java/com/yahoo/vespa/model/application/validation/AccessControlFilterValidatorTest.java
new file mode 100644
index 00000000000..8fad2aa9af4
--- /dev/null
+++ b/config-model/src/test/java/com/yahoo/vespa/model/application/validation/AccessControlFilterValidatorTest.java
@@ -0,0 +1,61 @@
+package com.yahoo.vespa.model.application.validation;// Copyright 2020 Oath Inc. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
+
+import com.yahoo.config.model.MapConfigModelRegistry;
+import com.yahoo.config.model.NullConfigModelRegistry;
+import com.yahoo.config.model.deploy.DeployState;
+import com.yahoo.config.model.test.MockApplicationPackage;
+import com.yahoo.config.model.test.ModelBuilderAddingAccessControlFilter;
+import com.yahoo.vespa.model.VespaModel;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.rules.ExpectedException;
+import org.xml.sax.SAXException;
+
+import java.io.IOException;
+
+/**
+ * @author bjorncs
+ */
+public class AccessControlFilterValidatorTest {
+
+    private static final String SERVICES_XML = String.join(
+            "\n",
+            "<services version='1.0'>",
+            "  <container id='container-cluster-with-access-control' version='1.0'>",
+            "    <http>",
+            "      <filtering>",
+            "        <access-control domain='foo' read='true' write='true'/>",
+            "      </filtering>",
+            "    </http>",
+            "  </container>",
+            "</services>");
+
+    @Rule
+    public ExpectedException exceptionRule = ExpectedException.none();
+
+    @Test
+    public void validator_fails_with_empty_access_control_filter_chain() throws IOException, SAXException {
+        DeployState deployState = createDeployState();
+        VespaModel model = new VespaModel(new NullConfigModelRegistry(), deployState);
+
+        exceptionRule.expect(IllegalArgumentException.class);
+        exceptionRule.expectMessage("The 'access-control' feature is not available in open-source Vespa.");
+        new AccessControlFilterValidator().validate(model, deployState);
+    }
+
+    @Test
+    public void validator_accepts_non_empty_access_control_filter_chain() throws IOException, SAXException {
+        DeployState deployState = createDeployState();
+        VespaModel model = new VespaModel(
+                MapConfigModelRegistry.createFromList(new ModelBuilderAddingAccessControlFilter()),
+                deployState);
+
+        new AccessControlFilterValidator().validate(model, deployState);
+    }
+
+    private static DeployState createDeployState() {
+        return new DeployState.Builder()
+                .applicationPackage(new MockApplicationPackage.Builder().withServices(SERVICES_XML).build())
+                .build();
+    }
+}
\ No newline at end of file
diff --git a/config-model/src/test/java/com/yahoo/vespa/model/application/validation/first/AccessControlValidatorTest.java b/config-model/src/test/java/com/yahoo/vespa/model/application/validation/first/AccessControlOnFirstDeploymentValidatorTest.java
index 17ca0e2dd07..c8f1224693b 100644
--- a/config-model/src/test/java/com/yahoo/vespa/model/application/validation/first/AccessControlValidatorTest.java
+++ b/config-model/src/test/java/com/yahoo/vespa/model/application/validation/first/AccessControlOnFirstDeploymentValidatorTest.java
@@ -29,7 +29,7 @@ import static org.junit.Assert.assertTrue;
 /**
  * @author gjoranv
  */
-public class AccessControlValidatorTest  {
+public class AccessControlOnFirstDeploymentValidatorTest {
 
     @Rule
     public final ExpectedException exceptionRule = ExpectedException.none();
@@ -57,7 +57,7 @@ public class AccessControlValidatorTest  {
         DeployState deployState = deployState(servicesXml(true, true));
         VespaModel model = new VespaModel(new NullConfigModelRegistry(), deployState);
 
-        new AccessControlValidator().validate(model, deployState);
+        new AccessControlOnFirstDeploymentValidator().validate(model, deployState);
     }
 
     @Test
@@ -65,7 +65,7 @@ public class AccessControlValidatorTest  {
         DeployState deployState = deployState(servicesXml(false, false));
         VespaModel model = new VespaModel(new NullConfigModelRegistry(), deployState);
 
-        new AccessControlValidator().validate(model, deployState);
+        new AccessControlOnFirstDeploymentValidator().validate(model, deployState);
     }
 
     @Test
@@ -76,7 +76,7 @@ public class AccessControlValidatorTest  {
         DeployState deployState = deployState(servicesXml);
         VespaModel model = new VespaModel(new NullConfigModelRegistry(), deployState);
 
-        new AccessControlValidator().validate(model, deployState);
+        new AccessControlOnFirstDeploymentValidator().validate(model, deployState);
     }
 
     @Test
@@ -88,7 +88,7 @@ public class AccessControlValidatorTest  {
         DeployState deployState = deployState(servicesXml(true, false));
         VespaModel model = new VespaModel(new NullConfigModelRegistry(), deployState);
 
-        new AccessControlValidator().validate(model, deployState);
+        new AccessControlOnFirstDeploymentValidator().validate(model, deployState);
     }
 
     @Test
@@ -105,7 +105,7 @@ public class AccessControlValidatorTest  {
         DeployState deployState = deployState(servicesXml);
         VespaModel model = new VespaModel(new NullConfigModelRegistry(), deployState);
 
-        new AccessControlValidator().validate(model, deployState);
+        new AccessControlOnFirstDeploymentValidator().validate(model, deployState);
     }
 
     @Test
@@ -120,7 +120,7 @@ public class AccessControlValidatorTest  {
         DeployState deployState = deployState(servicesXml);
         VespaModel model = new VespaModel(new NullConfigModelRegistry(), deployState);
 
-        new AccessControlValidator().validate(model, deployState);
+        new AccessControlOnFirstDeploymentValidator().validate(model, deployState);
     }
 
     @Test
@@ -133,7 +133,7 @@ public class AccessControlValidatorTest  {
         DeployState deployState = deployState(servicesXml);
         VespaModel model = new VespaModel(new NullConfigModelRegistry(), deployState);
 
-        new AccessControlValidator().validate(model, deployState);
+        new AccessControlOnFirstDeploymentValidator().validate(model, deployState);
     }
 
     @Test
@@ -143,7 +143,7 @@ public class AccessControlValidatorTest  {
                                               LocalDate.parse("2000-01-01", DateTimeFormatter.ISO_DATE).atStartOfDay().atZone(ZoneOffset.UTC).toInstant());
         VespaModel model = new VespaModel(new NullConfigModelRegistry(), deployState);
 
-        new AccessControlValidator().validate(model, deployState);
+        new AccessControlOnFirstDeploymentValidator().validate(model, deployState);
     }
 
     private static DeployState deployState(String servicesXml) {
diff --git a/config-model/src/test/java/com/yahoo/vespa/model/container/search/ImplicitIndexingClusterTest.java b/config-model/src/test/java/com/yahoo/vespa/model/container/search/ImplicitIndexingClusterTest.java
index 66ed86e3eaa..30a36715a17 100644
--- a/config-model/src/test/java/com/yahoo/vespa/model/container/search/ImplicitIndexingClusterTest.java
+++ b/config-model/src/test/java/com/yahoo/vespa/model/container/search/ImplicitIndexingClusterTest.java
@@ -24,7 +24,9 @@ public class ImplicitIndexingClusterTest {
                 "  <container version=\"1.0\" id=\"jdisc\">\n" + //
                 "    <search />\n" + //
                 "    <nodes count=\"1\" />\n" + //
-                ACCESS_CONTROL_XML + //
+                "    <http>\n" + //
+                "      <server id=\"bar\" port=\"4080\" />\n" + //
+                "    </http>\n" + //
                 "  </container>\n" + //
                 "  <content id=\"music\" version=\"1.0\">\n" + //
                 "    <redundancy>1</redundancy>\n" + //
@@ -42,13 +44,6 @@ public class ImplicitIndexingClusterTest {
         assertNotNull("Indexing chain not added to jdisc", jdisc.getDocprocChains().allChains().getComponent("indexing"));
     }
 
-    private final String ACCESS_CONTROL_XML = "<http>\n" +//
-            "  <filtering>\n" +//
-            "    <access-control domain=\"foo\" />\n" +//
-            "  </filtering>\n" +//
-            "  <server id=\"bar\" port=\"4080\" />\n" +//
-            "</http>\n";
-
     private static VespaModel buildMultiTenantVespaModel(String servicesXml) {
         ModelContext.Properties properties = new TestProperties().setMultitenant(true).setHostedVespa(true);
         DeployState.Builder deployStateBuilder = new DeployState.Builder()
diff --git a/configserver/src/test/java/com/yahoo/vespa/config/server/ConfigServerBootstrapTest.java b/configserver/src/test/java/com/yahoo/vespa/config/server/ConfigServerBootstrapTest.java
index 0b56591d6a1..2a1254d0d8d 100644
--- a/configserver/src/test/java/com/yahoo/vespa/config/server/ConfigServerBootstrapTest.java
+++ b/configserver/src/test/java/com/yahoo/vespa/config/server/ConfigServerBootstrapTest.java
@@ -44,6 +44,7 @@ import static com.yahoo.vespa.config.server.ConfigServerBootstrap.Mode.BOOTSTRAP
 import static com.yahoo.vespa.config.server.ConfigServerBootstrap.Mode.INITIALIZE_ONLY;
 import static com.yahoo.vespa.config.server.ConfigServerBootstrap.VipStatusMode.VIP_STATUS_FILE;
 import static com.yahoo.vespa.config.server.ConfigServerBootstrap.VipStatusMode.VIP_STATUS_PROGRAMMATICALLY;
+import static com.yahoo.vespa.config.server.deploy.DeployTester.createHostedModelFactory;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertTrue;
@@ -61,7 +62,7 @@ public class ConfigServerBootstrapTest {
     public void testBootstrap() throws Exception {
         ConfigserverConfig configserverConfig = createConfigserverConfig(temporaryFolder);
         InMemoryProvisioner provisioner = new InMemoryProvisioner(true, "host0", "host1", "host3", "host4");
-        DeployTester tester = new DeployTester(configserverConfig, provisioner);
+        DeployTester tester = new DeployTester(List.of(createHostedModelFactory()), configserverConfig, provisioner);
         tester.deployApp("src/test/apps/hosted/");
 
         File versionFile = temporaryFolder.newFile();
@@ -94,7 +95,7 @@ public class ConfigServerBootstrapTest {
     public void testBootstrapWithVipStatusFile() throws Exception {
         ConfigserverConfig configserverConfig = createConfigserverConfig(temporaryFolder);
         InMemoryProvisioner provisioner = new InMemoryProvisioner(true, "host0", "host1", "host3", "host4");
-        DeployTester tester = new DeployTester(configserverConfig, provisioner);
+        DeployTester tester = new DeployTester(List.of(createHostedModelFactory()), configserverConfig, provisioner);
         tester.deployApp("src/test/apps/hosted/");
 
         File versionFile = temporaryFolder.newFile();
@@ -119,7 +120,7 @@ public class ConfigServerBootstrapTest {
     @Test
     public void testBootstrapWhenRedeploymentFails() throws Exception {
         ConfigserverConfig configserverConfig = createConfigserverConfig(temporaryFolder);
-        DeployTester tester = new DeployTester(configserverConfig);
+        DeployTester tester = new DeployTester(List.of(createHostedModelFactory()), configserverConfig);
         tester.deployApp("src/test/apps/hosted/");
 
         File versionFile = temporaryFolder.newFile();
diff --git a/configserver/src/test/java/com/yahoo/vespa/config/server/deploy/DeployTester.java b/configserver/src/test/java/com/yahoo/vespa/config/server/deploy/DeployTester.java
index 1121ac3a8cc..54a80adf676 100644
--- a/configserver/src/test/java/com/yahoo/vespa/config/server/deploy/DeployTester.java
+++ b/configserver/src/test/java/com/yahoo/vespa/config/server/deploy/DeployTester.java
@@ -4,6 +4,7 @@ package com.yahoo.vespa.config.server.deploy;
 import com.google.common.io.Files;
 import com.yahoo.cloud.config.ConfigserverConfig;
 import com.yahoo.config.application.api.ApplicationPackage;
+import com.yahoo.config.model.ConfigModelRegistry;
 import com.yahoo.config.model.NullConfigModelRegistry;
 import com.yahoo.config.model.api.HostProvisioner;
 import com.yahoo.config.model.api.Model;
@@ -13,6 +14,7 @@ import com.yahoo.config.model.api.ModelFactory;
 import com.yahoo.config.model.api.ValidationParameters;
 import com.yahoo.config.model.deploy.DeployState;
 import com.yahoo.config.model.provision.InMemoryProvisioner;
+import com.yahoo.config.model.test.HostedConfigModelRegistry;
 import com.yahoo.config.model.test.MockApplicationPackage;
 import com.yahoo.config.provision.ApplicationId;
 import com.yahoo.config.provision.Capacity;
@@ -99,6 +101,10 @@ public class DeployTester {
         this(modelFactories, configserverConfig, clock, Zone.defaultZone());
     }
 
+    public DeployTester(List<ModelFactory> modelFactories, ConfigserverConfig configserverConfig, HostProvisioner hostProvisioner) {
+        this(modelFactories, configserverConfig, Clock.systemUTC(), hostProvisioner);
+    }
+
     public DeployTester(List<ModelFactory> modelFactories, ConfigserverConfig configserverConfig, Clock clock, HostProvisioner provisioner) {
         this(modelFactories, configserverConfig, clock, Zone.defaultZone(), provisioner);
     }
@@ -165,6 +171,26 @@ public class DeployTester {
     public static ModelFactory createFailingModelFactory(Version version) { return new FailingModelFactory(version); }
 
 
+    public static CountingModelFactory createHostedModelFactory(Version version, Clock clock) {
+        return new CountingModelFactory(HostedConfigModelRegistry.create(), version, clock, Zone.defaultZone());
+    }
+
+    public static CountingModelFactory createHostedModelFactory(Version version, Zone zone) {
+        return new CountingModelFactory(HostedConfigModelRegistry.create(), version, Clock.systemUTC(), zone);
+    }
+
+    public static CountingModelFactory createHostedModelFactory(Version version) {
+        return new CountingModelFactory(HostedConfigModelRegistry.create(), version, Clock.systemUTC(), Zone.defaultZone());
+    }
+
+    public static CountingModelFactory createHostedModelFactory(Clock clock) {
+        return new CountingModelFactory(HostedConfigModelRegistry.create(), clock);
+    }
+
+    public static CountingModelFactory createHostedModelFactory() {
+        return new CountingModelFactory(HostedConfigModelRegistry.create(), Clock.systemUTC());
+    }
+
     /**
      * Do the initial "deploy" with the existing API-less code as the deploy API doesn't support first deploys yet.
      */
@@ -320,6 +346,14 @@ public class DeployTester {
             this.wrapped = new VespaModelFactory(version, new NullConfigModelRegistry(), clock, zone);
         }
 
+        public CountingModelFactory(ConfigModelRegistry registry, Clock clock) {
+            this.wrapped = new VespaModelFactory(registry, clock);
+        }
+
+        public CountingModelFactory(ConfigModelRegistry registry, Version version, Clock clock, Zone zone) {
+            this.wrapped = new VespaModelFactory(version, registry, clock, zone);
+        }
+
         /** Returns the number of models created successfully by this instance */
         public int creationCount() { return creationCount; }
 
diff --git a/configserver/src/test/java/com/yahoo/vespa/config/server/deploy/HostedDeployTest.java b/configserver/src/test/java/com/yahoo/vespa/config/server/deploy/HostedDeployTest.java
index 8f4ba0a7b7c..dd0c4eaf342 100644
--- a/configserver/src/test/java/com/yahoo/vespa/config/server/deploy/HostedDeployTest.java
+++ b/configserver/src/test/java/com/yahoo/vespa/config/server/deploy/HostedDeployTest.java
@@ -13,6 +13,7 @@ import com.yahoo.config.model.api.ValidationParameters;
 import com.yahoo.config.model.provision.Host;
 import com.yahoo.config.model.provision.Hosts;
 import com.yahoo.config.model.provision.InMemoryProvisioner;
+import com.yahoo.config.model.test.HostedConfigModelRegistry;
 import com.yahoo.config.provision.ApplicationId;
 import com.yahoo.config.provision.Environment;
 import com.yahoo.config.provision.RegionName;
@@ -40,7 +41,7 @@ import java.util.stream.IntStream;
 
 import static com.yahoo.vespa.config.server.deploy.DeployTester.CountingModelFactory;
 import static com.yahoo.vespa.config.server.deploy.DeployTester.createFailingModelFactory;
-import static com.yahoo.vespa.config.server.deploy.DeployTester.createModelFactory;
+import static com.yahoo.vespa.config.server.deploy.DeployTester.createHostedModelFactory;
 import static org.hamcrest.CoreMatchers.equalTo;
 import static org.hamcrest.CoreMatchers.is;
 import static org.junit.Assert.assertEquals;
@@ -62,7 +63,7 @@ public class HostedDeployTest {
 
     @Test
     public void testRedeployWithVersion() throws IOException {
-        CountingModelFactory modelFactory = createModelFactory(Version.fromString("4.5.6"), Clock.systemUTC());
+        CountingModelFactory modelFactory = createHostedModelFactory(Version.fromString("4.5.6"), Clock.systemUTC());
         DeployTester tester = new DeployTester(List.of(modelFactory), createConfigserverConfig());
         tester.deployApp("src/test/apps/hosted/", "4.5.6");
 
@@ -74,7 +75,7 @@ public class HostedDeployTest {
 
     @Test
     public void testRedeploy() throws IOException {
-        DeployTester tester = new DeployTester(createConfigserverConfig());
+        DeployTester tester = new DeployTester(List.of(createHostedModelFactory()), createConfigserverConfig());
         ApplicationId appId = tester.applicationId();
         tester.deployApp("src/test/apps/hosted/");
         assertFalse(tester.applicationRepository().getActiveSession(appId).getMetaData().isInternalRedeploy());
@@ -87,9 +88,9 @@ public class HostedDeployTest {
 
     @Test
     public void testDeployMultipleVersions() throws IOException {
-        List<ModelFactory> modelFactories = List.of(createModelFactory(Version.fromString("6.1.0")),
-                                                    createModelFactory(Version.fromString("6.2.0")),
-                                                    createModelFactory(Version.fromString("7.0.0")));
+        List<ModelFactory> modelFactories = List.of(createHostedModelFactory(Version.fromString("6.1.0")),
+                                                    createHostedModelFactory(Version.fromString("6.2.0")),
+                                                    createHostedModelFactory(Version.fromString("7.0.0")));
         DeployTester tester = new DeployTester(modelFactories, createConfigserverConfig());
         tester.deployApp("src/test/apps/hosted/", "6.2.0");
         assertEquals(4, tester.getAllocatedHostsOf(tester.applicationId()).getHosts().size());
@@ -106,12 +107,12 @@ public class HostedDeployTest {
                                    createHost("host3"), // Use a host with no version as well
                                    createHost("host4", "6.1.0"));
 
-        CountingModelFactory factory600 = createModelFactory(Version.fromString("6.0.0"));
-        CountingModelFactory factory610 = createModelFactory(Version.fromString("6.1.0"));
-        CountingModelFactory factory620 = createModelFactory(Version.fromString("6.2.0"));
-        CountingModelFactory factory700 = createModelFactory(Version.fromString("7.0.0"));
-        CountingModelFactory factory710 = createModelFactory(Version.fromString("7.1.0"));
-        CountingModelFactory factory720 = createModelFactory(Version.fromString("7.2.0"));
+        CountingModelFactory factory600 = createHostedModelFactory(Version.fromString("6.0.0"));
+        CountingModelFactory factory610 = createHostedModelFactory(Version.fromString("6.1.0"));
+        CountingModelFactory factory620 = createHostedModelFactory(Version.fromString("6.2.0"));
+        CountingModelFactory factory700 = createHostedModelFactory(Version.fromString("7.0.0"));
+        CountingModelFactory factory710 = createHostedModelFactory(Version.fromString("7.1.0"));
+        CountingModelFactory factory720 = createHostedModelFactory(Version.fromString("7.2.0"));
         List<ModelFactory> modelFactories = List.of(factory600, factory610, factory620,
                                                     factory700, factory710, factory720);
 
@@ -137,10 +138,10 @@ public class HostedDeployTest {
     public void testCreateOnlyNeededModelVersionsNewNodes() throws IOException {
         List<Host> hosts = List.of(createHost("host1"), createHost("host2"), createHost("host3"), createHost("host4"));
 
-        CountingModelFactory factory600 = createModelFactory(Version.fromString("6.0.0"));
-        CountingModelFactory factory610 = createModelFactory(Version.fromString("6.1.0"));
-        CountingModelFactory factory700 = createModelFactory(Version.fromString("7.0.0"));
-        CountingModelFactory factory720 = createModelFactory(Version.fromString("7.2.0"));
+        CountingModelFactory factory600 = createHostedModelFactory(Version.fromString("6.0.0"));
+        CountingModelFactory factory610 = createHostedModelFactory(Version.fromString("6.1.0"));
+        CountingModelFactory factory700 = createHostedModelFactory(Version.fromString("7.0.0"));
+        CountingModelFactory factory720 = createHostedModelFactory(Version.fromString("7.2.0"));
         List<ModelFactory> modelFactories = List.of(factory600, factory610, factory700, factory720);
 
         DeployTester tester = createTester(hosts, modelFactories, prodZone);
@@ -162,9 +163,9 @@ public class HostedDeployTest {
         List<Host> hosts = List.of(createHost("host1", "7.0.0"), createHost("host2", "7.0.0"),
                                    createHost("host3", "7.0.0"), createHost("host4", "7.0.0"));
 
-        CountingModelFactory factory700 = createModelFactory(Version.fromString("7.0.0"), devZone);
-        CountingModelFactory factory710 = createModelFactory(Version.fromString("7.1.0"), devZone);
-        CountingModelFactory factory720 = createModelFactory(Version.fromString("7.2.0"), devZone);
+        CountingModelFactory factory700 = createHostedModelFactory(Version.fromString("7.0.0"), devZone);
+        CountingModelFactory factory710 = createHostedModelFactory(Version.fromString("7.1.0"), devZone);
+        CountingModelFactory factory720 = createHostedModelFactory(Version.fromString("7.2.0"), devZone);
         List<ModelFactory> modelFactories = List.of(factory700, factory710, factory720);
 
         DeployTester tester = createTester(hosts, modelFactories, devZone);
@@ -189,7 +190,7 @@ public class HostedDeployTest {
                                    createHost("host3", "7.0.0"), createHost("host4", "7.0.0"));
 
         ModelFactory factory700 = createFailingModelFactory(Version.fromString("7.0.0"));
-        CountingModelFactory factory720 = createModelFactory(Version.fromString("7.2.0"), devZone);
+        CountingModelFactory factory720 = createHostedModelFactory(Version.fromString("7.2.0"), devZone);
         List<ModelFactory> modelFactories = List.of(factory700, factory720);
 
         DeployTester tester = createTester(hosts, modelFactories, devZone, Clock.systemUTC());
@@ -236,8 +237,8 @@ public class HostedDeployTest {
                                    createHost("host3", newestOnOldMajorVersion),
                                    createHost("host4", newestOnOldMajorVersion));
 
-        CountingModelFactory factory1 = createModelFactory(Version.fromString(oldestVersion));
-        CountingModelFactory factory2 = createModelFactory(Version.fromString(newestOnOldMajorVersion));
+        CountingModelFactory factory1 = createHostedModelFactory(Version.fromString(oldestVersion));
+        CountingModelFactory factory2 = createHostedModelFactory(Version.fromString(newestOnOldMajorVersion));
         ModelFactory factory3 = createFailingModelFactory(Version.fromString(newestOnNewMajorVersion));
         List<ModelFactory> modelFactories = List.of(factory1, factory2, factory3);
 
@@ -261,7 +262,7 @@ public class HostedDeployTest {
                                    createHost("host3", "7.0.0"));
 
         List<ModelFactory> modelFactories = List.of(createFailingModelFactory(Version.fromString("7.0.0")),
-                                                    createModelFactory(Version.fromString("7.1.0")));
+                                                    createHostedModelFactory(Version.fromString("7.1.0")));
 
         DeployTester tester = createTester(hosts, modelFactories, prodZone);
         tester.deployApp("src/test/apps/hosted/", "7.1.0");
@@ -274,8 +275,8 @@ public class HostedDeployTest {
      **/
     @Test
     public void testCreateOnlyNeededModelVersionsWhenNoHostsAllocated() throws IOException {
-        CountingModelFactory factory700 = createModelFactory(Version.fromString("7.0.0"));
-        CountingModelFactory factory720 = createModelFactory(Version.fromString("7.2.0"));
+        CountingModelFactory factory700 = createHostedModelFactory(Version.fromString("7.0.0"));
+        CountingModelFactory factory720 = createHostedModelFactory(Version.fromString("7.2.0"));
         List<ModelFactory> modelFactories = List.of(factory700, factory720);
 
         DeployTester tester = createTester(List.of(createHost("host1")), modelFactories, prodZone);
@@ -289,9 +290,9 @@ public class HostedDeployTest {
         // Provisioner does not reuse hosts, so need twice as many hosts as app requires
         List<Host> hosts = IntStream.rangeClosed(1, 8).mapToObj(i -> createHost("host" + i, "6.0.0")).collect(Collectors.toList());
 
-        List<ModelFactory> modelFactories = List.of(createModelFactory(Version.fromString("6.0.0")),
-                                                    createModelFactory(Version.fromString("6.1.0")),
-                                                    createModelFactory(Version.fromString("6.2.0")));
+        List<ModelFactory> modelFactories = List.of(createHostedModelFactory(Version.fromString("6.0.0")),
+                                                    createHostedModelFactory(Version.fromString("6.1.0")),
+                                                    createHostedModelFactory(Version.fromString("6.2.0")));
 
         DeployTester tester = createTester(hosts, modelFactories, prodZone, Clock.systemUTC());
         ApplicationId applicationId = tester.applicationId();
@@ -309,7 +310,7 @@ public class HostedDeployTest {
     public void testRedeployAfterExpiredValidationOverride() throws IOException {
         // Old version of model fails, but application disables loading old models until 2016-10-10, so deployment works
         ManualClock clock = new ManualClock("2016-10-09T00:00:00");
-        List<ModelFactory> modelFactories = List.of(createModelFactory(clock),
+        List<ModelFactory> modelFactories = List.of(createHostedModelFactory(clock),
                                                     createFailingModelFactory(Version.fromString("1.0.0"))); // older than default
         DeployTester tester = new DeployTester(modelFactories, createConfigserverConfig());
         tester.deployApp("src/test/apps/validationOverride/", clock.instant());
@@ -403,7 +404,7 @@ public class HostedDeployTest {
         private final ConfigChangeAction action;
 
         ConfigChangeActionsModelFactory(Version vespaVersion, ConfigChangeAction action) {
-            super(vespaVersion);
+            super(HostedConfigModelRegistry.create(), vespaVersion);
             this.action = action;
         }
 
diff --git a/configserver/src/test/java/com/yahoo/vespa/config/server/model/TestModelFactory.java b/configserver/src/test/java/com/yahoo/vespa/config/server/model/TestModelFactory.java
index 691f818020e..65994a41eae 100644
--- a/configserver/src/test/java/com/yahoo/vespa/config/server/model/TestModelFactory.java
+++ b/configserver/src/test/java/com/yahoo/vespa/config/server/model/TestModelFactory.java
@@ -1,6 +1,7 @@
 // Copyright 2017 Yahoo Holdings. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
 package com.yahoo.vespa.config.server.model;
 
+import com.yahoo.config.model.ConfigModelRegistry;
 import com.yahoo.config.model.NullConfigModelRegistry;
 import com.yahoo.config.model.api.ModelContext;
 import com.yahoo.config.model.api.ModelCreateResult;
@@ -21,6 +22,11 @@ public class TestModelFactory extends VespaModelFactory {
         this.vespaVersion = vespaVersion;
     }
 
+    public TestModelFactory(ConfigModelRegistry registry, Version vespaVersion) {
+        super(registry);
+        this.vespaVersion = vespaVersion;
+    }
+
     // Needed for testing (to get hold of ModelContext)
     @Override
     public ModelCreateResult createAndValidateModel(ModelContext modelContext, ValidationParameters validationParameters) {