Wire in isFirstDeployment to AccessControlValidator

Use a boolean that is set correctly no matter what versions are loaded
to decide when to use AccessControlValidator

11 files changed, 46 insertions, 12 deletions

diff --git a/config-model-api/src/main/java/com/yahoo/config/model/api/ModelContext.java b/config-model-api/src/main/java/com/yahoo/config/model/api/ModelContext.java
index e23d6c5b968..c75174cd999 100644
--- a/config-model-api/src/main/java/com/yahoo/config/model/api/ModelContext.java
+++ b/config-model-api/src/main/java/com/yahoo/config/model/api/ModelContext.java
@@ -50,6 +50,7 @@ public interface ModelContext {
         Zone zone();
         Set<Rotation> rotations();
         boolean isBootstrap();
+        boolean isFirstTimeDeployment();
     }
 
 }
diff --git a/config-model/src/main/java/com/yahoo/config/model/deploy/DeployProperties.java b/config-model/src/main/java/com/yahoo/config/model/deploy/DeployProperties.java
index b259f6cf3fb..53c70399e94 100644
--- a/config-model/src/main/java/com/yahoo/config/model/deploy/DeployProperties.java
+++ b/config-model/src/main/java/com/yahoo/config/model/deploy/DeployProperties.java
@@ -26,6 +26,7 @@ public class DeployProperties {
     private final boolean hostedVespa;
     private final Version vespaVersion;
     private final boolean isBootstrap;
+    private final boolean isFirstTimeDeployment;
 
     private DeployProperties(boolean multitenant,
                              ApplicationId applicationId,
@@ -35,7 +36,8 @@ public class DeployProperties {
                              URI ztsUrl,
                              String athenzDnsSuffix,
                              Version vespaVersion,
-                             boolean isBootstrap) {
+                             boolean isBootstrap,
+                             boolean isFirstTimeDeployment) {
         this.loadBalancerName = loadBalancerName;
         this.ztsUrl = ztsUrl;
         this.athenzDnsSuffix = athenzDnsSuffix;
@@ -45,6 +47,7 @@ public class DeployProperties {
         this.serverSpecs.addAll(configServerSpecs);
         this.hostedVespa = hostedVespa;
         this.isBootstrap = isBootstrap;
+        this.isFirstTimeDeployment = isFirstTimeDeployment;
     }
 
     public boolean multitenant() {
@@ -83,6 +86,9 @@ public class DeployProperties {
     /** Returns whether this deployment happens during bootstrap *prepare* (not set on activate) */
     public boolean isBootstrap() { return isBootstrap; }
 
+    /** Returns whether this is the first deployment for this application (used during *prepare*, not set on activate) */
+    public boolean isFirstTimeDeployment() { return isFirstTimeDeployment; }
+
     public static class Builder {
 
         private ApplicationId applicationId = ApplicationId.defaultId();
@@ -94,6 +100,7 @@ public class DeployProperties {
         private boolean hostedVespa = false;
         private Version vespaVersion = Version.fromIntValues(1, 0, 0);
         private boolean isBootstrap = false;
+        private boolean isFirstTimeDeployment = false;
 
         public Builder applicationId(ApplicationId applicationId) {
             this.applicationId = applicationId;
@@ -140,8 +147,14 @@ public class DeployProperties {
             return this;
         }
 
+        public Builder isFirstTimeDeployment(boolean isFirstTimeDeployment) {
+            this.isFirstTimeDeployment = isFirstTimeDeployment;
+            return this;
+        }
+
         public DeployProperties build() {
-            return new DeployProperties(multitenant, applicationId, configServerSpecs, loadBalancerName, hostedVespa, ztsUrl, athenzDnsSuffix, vespaVersion, isBootstrap);
+            return new DeployProperties(multitenant, applicationId, configServerSpecs, loadBalancerName, hostedVespa,
+                                        ztsUrl, athenzDnsSuffix, vespaVersion, isBootstrap, isFirstTimeDeployment);
         }
     }
 
diff --git a/config-model/src/main/java/com/yahoo/config/model/deploy/DeployState.java b/config-model/src/main/java/com/yahoo/config/model/deploy/DeployState.java
index 3dafb521dc8..44e101115a2 100644
--- a/config-model/src/main/java/com/yahoo/config/model/deploy/DeployState.java
+++ b/config-model/src/main/java/com/yahoo/config/model/deploy/DeployState.java
@@ -227,6 +227,7 @@ public class DeployState implements ConfigDefinitionStore {
         private Zone zone = Zone.defaultZone();
         private Instant now = Instant.now();
         private Version wantedNodeVespaVersion = Vtag.currentVersion;
+        private boolean isFirstTimeDeployment = false;
 
         public Builder applicationPackage(ApplicationPackage applicationPackage) {
             this.applicationPackage = applicationPackage;
diff --git a/config-model/src/main/java/com/yahoo/vespa/model/VespaModelFactory.java b/config-model/src/main/java/com/yahoo/vespa/model/VespaModelFactory.java
index e88153342f9..4da4e9e5693 100644
--- a/config-model/src/main/java/com/yahoo/vespa/model/VespaModelFactory.java
+++ b/config-model/src/main/java/com/yahoo/vespa/model/VespaModelFactory.java
@@ -154,6 +154,7 @@ public class VespaModelFactory implements ModelFactory {
                 .hostedVespa(properties.hostedVespa())
                 .vespaVersion(getVersion())
                 .isBootstrap(properties.isBootstrap())
+                .isFirstTimeDeployment(properties.isFirstTimeDeployment())
                 .build();
     }
 
diff --git a/config-model/src/main/java/com/yahoo/vespa/model/application/validation/Validation.java b/config-model/src/main/java/com/yahoo/vespa/model/application/validation/Validation.java
index c08e81b250f..99c45772b8f 100644
--- a/config-model/src/main/java/com/yahoo/vespa/model/application/validation/Validation.java
+++ b/config-model/src/main/java/com/yahoo/vespa/model/application/validation/Validation.java
@@ -21,8 +21,8 @@ import com.yahoo.vespa.model.application.validation.change.StreamingSearchCluste
 import com.yahoo.vespa.model.application.validation.first.AccessControlValidator;
 
 import java.time.Instant;
-import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.Collections;
 import java.util.List;
 import java.util.Optional;
 
@@ -60,13 +60,16 @@ public class Validation {
         new RankingConstantsValidator().validate(model, deployState);
         new SecretStoreValidator().validate(model, deployState);
 
-        Optional<Model> currentActiveModel = deployState.getPreviousModel();
-        if (currentActiveModel.isPresent() && (currentActiveModel.get() instanceof VespaModel))
-            return validateChanges((VespaModel)currentActiveModel.get(), model,
-                                   deployState.validationOverrides(), deployState.getDeployLogger(), deployState.now());
-        else
+        List<ConfigChangeAction> result = Collections.emptyList();;
+        if (deployState.getProperties().isFirstTimeDeployment()) {
             validateFirstTimeDeployment(model, deployState);
-            return new ArrayList<>();
+        } else {
+            Optional<Model> currentActiveModel = deployState.getPreviousModel();
+            if (currentActiveModel.isPresent() && (currentActiveModel.get() instanceof VespaModel))
+                result = validateChanges((VespaModel) currentActiveModel.get(), model,
+                                         deployState.validationOverrides(), deployState.getDeployLogger(), deployState.now());
+        }
+        return result;
     }
 
     private static List<ConfigChangeAction> validateChanges(VespaModel currentModel, VespaModel nextModel,
diff --git a/config-model/src/test/java/com/yahoo/config/model/MockModelContext.java b/config-model/src/test/java/com/yahoo/config/model/MockModelContext.java
index 6821b7e3b4b..5bd95334396 100644
--- a/config-model/src/test/java/com/yahoo/config/model/MockModelContext.java
+++ b/config-model/src/test/java/com/yahoo/config/model/MockModelContext.java
@@ -130,6 +130,9 @@ public class MockModelContext implements ModelContext {
 
             @Override
             public boolean isBootstrap() { return false; }
+
+            @Override
+            public boolean isFirstTimeDeployment() { return false; }
         };
     }
 }
diff --git a/config-model/src/test/java/com/yahoo/vespa/model/VespaModelFactoryTest.java b/config-model/src/test/java/com/yahoo/vespa/model/VespaModelFactoryTest.java
index 2261affb65b..548d3d04a63 100644
--- a/config-model/src/test/java/com/yahoo/vespa/model/VespaModelFactoryTest.java
+++ b/config-model/src/test/java/com/yahoo/vespa/model/VespaModelFactoryTest.java
@@ -212,6 +212,9 @@ public class VespaModelFactoryTest {
 
                     @Override
                     public boolean isBootstrap() { return false; }
+
+                    @Override
+                    public boolean isFirstTimeDeployment() { return false; }
                 };
             }
         };
diff --git a/configserver/src/main/java/com/yahoo/vespa/config/server/deploy/ModelContextImpl.java b/configserver/src/main/java/com/yahoo/vespa/config/server/deploy/ModelContextImpl.java
index 28dc0cc8414..914d6963ff0 100644
--- a/configserver/src/main/java/com/yahoo/vespa/config/server/deploy/ModelContextImpl.java
+++ b/configserver/src/main/java/com/yahoo/vespa/config/server/deploy/ModelContextImpl.java
@@ -124,6 +124,7 @@ public class ModelContextImpl implements ModelContext {
         private final Zone zone;
         private final Set<Rotation> rotations;
         private final boolean isBootstrap;
+        private final boolean isFirstTimeDeployment;
 
         public Properties(ApplicationId applicationId,
                           boolean multitenant,
@@ -134,7 +135,8 @@ public class ModelContextImpl implements ModelContext {
                           boolean hostedVespa,
                           Zone zone,
                           Set<Rotation> rotations,
-                          boolean isBootstrap) {
+                          boolean isBootstrap,
+                          boolean isFirstTimeDeployment) {
             this.applicationId = applicationId;
             this.multitenant = multitenant;
             this.configServerSpecs = configServerSpecs;
@@ -145,6 +147,7 @@ public class ModelContextImpl implements ModelContext {
             this.zone = zone;
             this.rotations = rotations;
             this.isBootstrap = isBootstrap;
+            this.isFirstTimeDeployment = isFirstTimeDeployment;
         }
 
         @Override
@@ -181,6 +184,8 @@ public class ModelContextImpl implements ModelContext {
         @Override
         public boolean isBootstrap() { return isBootstrap; }
 
+        @Override
+        public boolean isFirstTimeDeployment() { return isFirstTimeDeployment; }
     }
 
 }
diff --git a/configserver/src/main/java/com/yahoo/vespa/config/server/modelfactory/ActivatedModelsBuilder.java b/configserver/src/main/java/com/yahoo/vespa/config/server/modelfactory/ActivatedModelsBuilder.java
index 314b6d78ae3..2955d948d69 100644
--- a/configserver/src/main/java/com/yahoo/vespa/config/server/modelfactory/ActivatedModelsBuilder.java
+++ b/configserver/src/main/java/com/yahoo/vespa/config/server/modelfactory/ActivatedModelsBuilder.java
@@ -116,7 +116,8 @@ public class ActivatedModelsBuilder extends ModelsBuilder<Application> {
                                                configserverConfig.hostedVespa(),
                                                zone(),
                                                new Rotations(curator, TenantRepository.getTenantPath(tenant)).readRotationsFromZooKeeper(applicationId),
-                                               false); // We may be bootstrapping, but we only know and care during prepare
+                                               false, // We may be bootstrapping, but we only know and care during prepare
+                                               false); // Always false, assume no one uses it when activating
     }
 
 }
diff --git a/configserver/src/main/java/com/yahoo/vespa/config/server/session/SessionPreparer.java b/configserver/src/main/java/com/yahoo/vespa/config/server/session/SessionPreparer.java
index 0d9f8ce64b1..6a240806004 100644
--- a/configserver/src/main/java/com/yahoo/vespa/config/server/session/SessionPreparer.java
+++ b/configserver/src/main/java/com/yahoo/vespa/config/server/session/SessionPreparer.java
@@ -158,7 +158,8 @@ public class SessionPreparer {
                                                               configserverConfig.hostedVespa(),
                                                               zone,
                                                               rotationsSet,
-                                                              params.isBootstrap());
+                                                              params.isBootstrap(),
+                                                              ! currentActiveApplicationSet.isPresent());
             this.preparedModelsBuilder = new PreparedModelsBuilder(modelFactoryRegistry,
                                                                    permanentApplicationPackage,
                                                                    configDefinitionRepo,
diff --git a/configserver/src/test/java/com/yahoo/vespa/config/server/ModelContextImplTest.java b/configserver/src/test/java/com/yahoo/vespa/config/server/ModelContextImplTest.java
index ce53dc3f2fb..28fc179770a 100644
--- a/configserver/src/test/java/com/yahoo/vespa/config/server/ModelContextImplTest.java
+++ b/configserver/src/test/java/com/yahoo/vespa/config/server/ModelContextImplTest.java
@@ -51,6 +51,7 @@ public class ModelContextImplTest {
                         false,
                         Zone.defaultZone(),
                         rotations,
+                        false,
                         false),
                 Optional.empty(),
                 new Version(6), 
@@ -67,5 +68,6 @@ public class ModelContextImplTest {
         assertTrue(context.properties().zone() instanceof Zone);
         assertFalse(context.properties().hostedVespa());
         assertThat(context.properties().rotations(), equalTo(rotations));
+        assertThat(context.properties().isFirstTimeDeployment(), equalTo(false));
     }
 }