Store and share private service names

15 files changed, 89 insertions, 17 deletions

diff --git a/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/integration/configserver/LoadBalancer.java b/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/integration/configserver/LoadBalancer.java
index 8b0b674d682..01a5f9d60bb 100644
--- a/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/integration/configserver/LoadBalancer.java
+++ b/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/integration/configserver/LoadBalancer.java
@@ -5,6 +5,7 @@ import ai.vespa.http.DomainName;
 import com.yahoo.config.provision.ApplicationId;
 import com.yahoo.config.provision.ClusterSpec;
 
+import java.util.List;
 import java.util.Objects;
 import java.util.Optional;
 
@@ -22,9 +23,10 @@ public class LoadBalancer {
     private final Optional<String> ipAddress;
     private final State state;
     private final Optional<String> dnsZone;
+    private final Optional<PrivateServiceInfo> service;
 
     public LoadBalancer(String id, ApplicationId application, ClusterSpec.Id cluster, Optional<DomainName> hostname,
-                        Optional<String> ipAddress, State state, Optional<String> dnsZone) {
+                        Optional<String> ipAddress, State state, Optional<String> dnsZone, Optional<PrivateServiceInfo> service) {
         this.id = Objects.requireNonNull(id, "id must be non-null");
         this.application = Objects.requireNonNull(application, "application must be non-null");
         this.cluster = Objects.requireNonNull(cluster, "cluster must be non-null");
@@ -32,6 +34,7 @@ public class LoadBalancer {
         this.ipAddress = Objects.requireNonNull(ipAddress, "ipAddress must be non-null");
         this.state = Objects.requireNonNull(state, "state must be non-null");
         this.dnsZone = Objects.requireNonNull(dnsZone, "dnsZone must be non-null");
+        this.service = Objects.requireNonNull(service, "service must be non-null");
     }
 
     public String id() {
@@ -62,6 +65,10 @@ public class LoadBalancer {
         return state;
     }
 
+    public Optional<PrivateServiceInfo> service() {
+        return service;
+    }
+
     public enum State {
         active,
         inactive,
@@ -69,4 +76,6 @@ public class LoadBalancer {
         unknown
     }
 
+    public record PrivateServiceInfo(String id, List<String> allowedUrns) { }
+
 }
diff --git a/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/role/PathGroup.java b/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/role/PathGroup.java
index ff0a698bc48..20847c2013f 100644
--- a/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/role/PathGroup.java
+++ b/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/role/PathGroup.java
@@ -135,6 +135,7 @@ enum PathGroup {
                     "/application/v4/tenant/{tenant}/application/{application}/environment/{environment}/region/{region}/instance/{ignored}/clusters",
                     "/application/v4/tenant/{tenant}/application/{application}/environment/{environment}/region/{region}/instance/{ignored}/logs",
                     "/application/v4/tenant/{tenant}/application/{application}/environment/{environment}/region/{region}/instance/{ignored}/metrics",
+                    "/application/v4/tenant/{tenant}/application/{application}/environment/{environment}/region/{region}/instance/{ignored}/private-service",
                     "/application/v4/tenant/{tenant}/application/{application}/environment/{environment}/region/{region}/instance/{ignored}/suspended",
                     "/application/v4/tenant/{tenant}/application/{application}/environment/{environment}/region/{region}/instance/{ignored}/service/{*}",
                     "/application/v4/tenant/{tenant}/application/{application}/environment/{environment}/region/{region}/instance/{ignored}/global-rotation/{*}",
diff --git a/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/restapi/application/ApplicationApiHandler.java b/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/restapi/application/ApplicationApiHandler.java
index afd44c8e3a4..a76c5c18f9a 100644
--- a/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/restapi/application/ApplicationApiHandler.java
+++ b/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/restapi/application/ApplicationApiHandler.java
@@ -63,6 +63,7 @@ import com.yahoo.vespa.hosted.controller.api.integration.configserver.Cluster;
 import com.yahoo.vespa.hosted.controller.api.integration.configserver.ConfigServerException;
 import com.yahoo.vespa.hosted.controller.api.integration.configserver.DeploymentResult;
 import com.yahoo.vespa.hosted.controller.api.integration.configserver.DeploymentResult.LogEntry;
+import com.yahoo.vespa.hosted.controller.api.integration.configserver.LoadBalancer;
 import com.yahoo.vespa.hosted.controller.api.integration.configserver.Node;
 import com.yahoo.vespa.hosted.controller.api.integration.configserver.NodeFilter;
 import com.yahoo.vespa.hosted.controller.api.integration.configserver.NodeRepository;
@@ -287,6 +288,7 @@ public class ApplicationApiHandler extends AuditLoggingRequestHandler {
         if (path.matches("/application/v4/tenant/{tenant}/application/{application}/environment/{environment}/region/{region}/instance/{instance}")) return deployment(path.get("tenant"), path.get("application"), path.get("instance"), path.get("environment"), path.get("region"), request);
         if (path.matches("/application/v4/tenant/{tenant}/application/{application}/environment/{environment}/region/{region}/instance/{instance}/suspended")) return suspended(path.get("tenant"), path.get("application"), path.get("instance"), path.get("environment"), path.get("region"), request);
         if (path.matches("/application/v4/tenant/{tenant}/application/{application}/environment/{environment}/region/{region}/instance/{instance}/service/{service}/{host}/status/{*}")) return status(path.get("tenant"), path.get("application"), path.get("instance"), path.get("environment"), path.get("region"), path.get("service"), path.get("host"), path.getRest(), request);
+        if (path.matches("/application/v4/tenant/{tenant}/application/{application}/environment/{environment}/region/{region}/instance/{instance}/private-service")) return getPrivateServiceInfo(path.get("tenant"), path.get("application"), path.get("instance"), path.get("environment"), path.get("region"));
         if (path.matches("/application/v4/tenant/{tenant}/application/{application}/environment/{environment}/region/{region}/instance/{instance}/nodes")) return nodes(path.get("tenant"), path.get("application"), path.get("instance"), path.get("environment"), path.get("region"));
         if (path.matches("/application/v4/tenant/{tenant}/application/{application}/environment/{environment}/region/{region}/instance/{instance}/clusters")) return clusters(path.get("tenant"), path.get("application"), path.get("instance"), path.get("environment"), path.get("region"));
         if (path.matches("/application/v4/tenant/{tenant}/application/{application}/environment/{environment}/region/{region}/instance/{instance}/logs")) return logs(path.get("tenant"), path.get("application"), path.get("instance"), path.get("environment"), path.get("region"), request.propertyMap());
@@ -1960,6 +1962,22 @@ public class ApplicationApiHandler extends AuditLoggingRequestHandler {
                                                  instance.id().toShortString(), zone, inService ? "in" : "out of"));
     }
 
+    private HttpResponse getPrivateServiceInfo(String tenantName, String applicationName, String instanceName, String environment, String region) {
+        List<LoadBalancer> lbs = controller.serviceRegistry().configServer().getLoadBalancers(ApplicationId.from(tenantName, applicationName, instanceName),
+                                                                                              ZoneId.from(environment, region));
+        Slime slime = new Slime();
+        Cursor lbArray = slime.setObject().setArray("load-balancers");
+        for (LoadBalancer lb : lbs) {
+            Cursor lbObject = lbArray.addObject();
+            lbObject.setString("cluster", lb.cluster().value());
+            lb.service().ifPresent(service -> {
+                lbObject.setString("serviceId", service.id());
+                service.allowedUrns().forEach(lbObject.setArray("allowed-urns")::addString);
+            });
+        }
+        return new SlimeJsonResponse(slime);
+    }
+
     private HttpResponse getGlobalRotationOverride(String tenantName, String applicationName, String instanceName, String environment, String region) {
         DeploymentId deploymentId = new DeploymentId(ApplicationId.from(tenantName, applicationName, instanceName),
                                                      requireZone(environment, region));
diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/integration/ConfigServerMock.java b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/integration/ConfigServerMock.java
index c0f0b67926a..642397cbe1e 100644
--- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/integration/ConfigServerMock.java
+++ b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/integration/ConfigServerMock.java
@@ -31,6 +31,7 @@ import com.yahoo.vespa.hosted.controller.api.integration.configserver.ConfigServ
 import com.yahoo.vespa.hosted.controller.api.integration.configserver.ContainerEndpoint;
 import com.yahoo.vespa.hosted.controller.api.integration.configserver.DeploymentResult;
 import com.yahoo.vespa.hosted.controller.api.integration.configserver.LoadBalancer;
+import com.yahoo.vespa.hosted.controller.api.integration.configserver.LoadBalancer.PrivateServiceInfo;
 import com.yahoo.vespa.hosted.controller.api.integration.configserver.Node;
 import com.yahoo.vespa.hosted.controller.api.integration.configserver.NodeFilter;
 import com.yahoo.vespa.hosted.controller.api.integration.configserver.ProxyResponse;
@@ -410,7 +411,8 @@ public class ConfigServerMock extends AbstractComponent implements ConfigServer
                                                                    Optional.of(HostName.of("lb-0--" + id.applicationId().toFullString() + "--" + id.zoneId().toString())),
                                                                    Optional.empty(),
                                                                    LoadBalancer.State.active,
-                                                                   Optional.of("dns-zone-1"))));
+                                                                   Optional.of("dns-zone-1"),
+                                                                   Optional.of(new PrivateServiceInfo("service", List.of("arne"))))));
         }
 
         Application application = applications.get(id);
diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/ApplicationApiTest.java b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/ApplicationApiTest.java
index ee1094ac32e..2e73b3fc5fb 100644
--- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/ApplicationApiTest.java
+++ b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/application/ApplicationApiTest.java
@@ -697,6 +697,10 @@ public class ApplicationApiTest extends ControllerContainerTest {
                         .userIdentity(USER_ID),
                 new File("suspended.json"));
 
+        // GET private service info
+        tester.assertResponse(request("/application/v4/tenant/tenant1/application/application1/environment/prod/region/us-central-1/instance/instance1/private-service", GET)
+                                      .userIdentity(USER_ID),
+                              "{\"load-balancers\":[{\"cluster\":\"default\",\"serviceId\":\"service\",\"allowed-urns\":[\"arne\"]}]}");
 
         // GET service/state/v1
         tester.assertResponse(request("/application/v4/tenant/tenant1/application/application1/instance/instance1/environment/prod/region/us-central-1/service/storagenode/host.com/state/v1/?foo=bar", GET)
diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/routing/RoutingPoliciesTest.java b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/routing/RoutingPoliciesTest.java
index fb85b876adf..2d903dad503 100644
--- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/routing/RoutingPoliciesTest.java
+++ b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/routing/RoutingPoliciesTest.java
@@ -494,12 +494,13 @@ public class RoutingPoliciesTest {
         // Load balancer for the same application is provisioned again, but with a different hostname
         var newHostname = HostName.of("new-hostname");
         var loadBalancer = new LoadBalancer("LB-0-Z-" + zone1.value(),
-                context.instanceId(),
-                ClusterSpec.Id.from("c0"),
-                Optional.of(newHostname),
-                Optional.empty(),
-                LoadBalancer.State.active,
-                Optional.of("dns-zone-1"));
+                                            context.instanceId(),
+                                            ClusterSpec.Id.from("c0"),
+                                            Optional.of(newHostname),
+                                            Optional.empty(),
+                                            LoadBalancer.State.active,
+                                            Optional.of("dns-zone-1"),
+                                            Optional.empty());
         tester.controllerTester().configServer().putLoadBalancers(zone1, List.of(loadBalancer));
 
         // Application redeployment preserves DNS record
@@ -955,7 +956,8 @@ public class RoutingPoliciesTest {
                                      lbHostname,
                                      ipAddress,
                                      LoadBalancer.State.active,
-                                     Optional.of("dns-zone-1").filter(__ -> lbHostname.isPresent())));
+                                     Optional.of("dns-zone-1").filter(__ -> lbHostname.isPresent()),
+                                     Optional.empty()));
         }
         return loadBalancers;
     }
diff --git a/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/lb/LoadBalancerInstance.java b/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/lb/LoadBalancerInstance.java
index fde3c85bdab..33c9edf694d 100644
--- a/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/lb/LoadBalancerInstance.java
+++ b/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/lb/LoadBalancerInstance.java
@@ -25,10 +25,12 @@ public class LoadBalancerInstance {
     private final Set<String> networks;
     private final Set<Real> reals;
     private final LoadBalancerSettings settings;
+    private final Optional<PrivateServiceId> serviceId;
     private final CloudAccount cloudAccount;
 
-    public LoadBalancerInstance(Optional<DomainName> hostname, Optional<String> ipAddress, Optional<DnsZone> dnsZone, Set<Integer> ports,
-                                Set<String> networks, Set<Real> reals, LoadBalancerSettings settings, CloudAccount cloudAccount) {
+    public LoadBalancerInstance(Optional<DomainName> hostname, Optional<String> ipAddress, Optional<DnsZone> dnsZone,
+                                Set<Integer> ports, Set<String> networks, Set<Real> reals, LoadBalancerSettings settings,
+                                Optional<PrivateServiceId> serviceId, CloudAccount cloudAccount) {
         this.hostname = Objects.requireNonNull(hostname, "hostname must be non-null");
         this.ipAddress = Objects.requireNonNull(ipAddress, "ip must be non-null");
         this.dnsZone = Objects.requireNonNull(dnsZone, "dnsZone must be non-null");
@@ -36,6 +38,7 @@ public class LoadBalancerInstance {
         this.networks = ImmutableSortedSet.copyOf(Objects.requireNonNull(networks, "networks must be non-null"));
         this.reals = ImmutableSortedSet.copyOf(Objects.requireNonNull(reals, "targets must be non-null"));
         this.settings = Objects.requireNonNull(settings, "settings must be non-null");
+        this.serviceId = Objects.requireNonNull(serviceId, "private service id must be non-null");
         this.cloudAccount = Objects.requireNonNull(cloudAccount, "cloudAccount must be non-null");
 
         if (hostname.isEmpty() == ipAddress.isEmpty()) {
@@ -79,6 +82,11 @@ public class LoadBalancerInstance {
         return settings;
     }
 
+    /** ID of any private endpoint service configured for this load balancer. */
+    public Optional<PrivateServiceId> serviceId() {
+        return serviceId;
+    }
+
     /** Cloud account of this load balancer */
     public CloudAccount cloudAccount() {
         return cloudAccount;
@@ -86,7 +94,11 @@ public class LoadBalancerInstance {
 
     /** Returns a copy of this with reals set to given reals */
     public LoadBalancerInstance withReals(Set<Real> reals) {
-        return new LoadBalancerInstance(hostname, ipAddress, dnsZone, ports, networks, reals, settings, cloudAccount);
+        return new LoadBalancerInstance(hostname, ipAddress, dnsZone, ports, networks, reals, settings, serviceId, cloudAccount);
+    }
+
+    public LoadBalancerInstance withServiceId(PrivateServiceId serviceId) {
+        return new LoadBalancerInstance(hostname, ipAddress, dnsZone, ports, networks, reals, settings, Optional.of(serviceId), cloudAccount);
     }
 
     private static Set<Integer> requirePorts(Set<Integer> ports) {
diff --git a/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/lb/LoadBalancerServiceMock.java b/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/lb/LoadBalancerServiceMock.java
index a756c1fc01a..e0dd41f9008 100644
--- a/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/lb/LoadBalancerServiceMock.java
+++ b/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/lb/LoadBalancerServiceMock.java
@@ -63,6 +63,7 @@ public class LoadBalancerServiceMock implements LoadBalancerService {
                 ImmutableSet.of("10.2.3.0/24", "10.4.5.0/24"),
                 spec.reals(),
                 spec.settings().orElse(LoadBalancerSettings.empty),
+                spec.settings().map(__ -> PrivateServiceId.of("service")),
                 spec.cloudAccount());
         instances.put(id, instance);
         return instance;
diff --git a/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/lb/SharedLoadBalancerService.java b/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/lb/SharedLoadBalancerService.java
index 97e466827a6..c8fb1226b81 100644
--- a/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/lb/SharedLoadBalancerService.java
+++ b/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/lb/SharedLoadBalancerService.java
@@ -38,6 +38,7 @@ public class SharedLoadBalancerService implements LoadBalancerService {
                                         Set.of(),
                                         spec.reals(),
                                         spec.settings().orElse(LoadBalancerSettings.empty),
+                                        Optional.empty(),
                                         spec.cloudAccount());
     }
 
diff --git a/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/persistence/LoadBalancerSerializer.java b/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/persistence/LoadBalancerSerializer.java
index 9eccb21b756..3d352f5596b 100644
--- a/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/persistence/LoadBalancerSerializer.java
+++ b/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/persistence/LoadBalancerSerializer.java
@@ -13,6 +13,7 @@ import com.yahoo.vespa.hosted.provision.lb.DnsZone;
 import com.yahoo.vespa.hosted.provision.lb.LoadBalancer;
 import com.yahoo.vespa.hosted.provision.lb.LoadBalancerId;
 import com.yahoo.vespa.hosted.provision.lb.LoadBalancerInstance;
+import com.yahoo.vespa.hosted.provision.lb.PrivateServiceId;
 import com.yahoo.vespa.hosted.provision.lb.Real;
 
 import java.io.IOException;
@@ -48,6 +49,7 @@ public class LoadBalancerSerializer {
     private static final String realsField = "reals";
     private static final String ipAddressField = "ipAddress";
     private static final String portField = "port";
+    private static final String serviceIdField = "serviceId";
     private static final String cloudAccountField = "cloudAccount";
     private static final String settingsField = "settings";
     private static final String allowedUrnsField = "allowedUrns";
@@ -79,6 +81,9 @@ public class LoadBalancerSerializer {
                     .ifPresent(settings -> settings.allowedUrns().forEach(root.setObject(settingsField)
                                                                               .setArray(allowedUrnsField)::addString));
         loadBalancer.instance()
+                    .flatMap(LoadBalancerInstance::serviceId)
+                    .ifPresent(serviceId -> root.setString(serviceIdField, serviceId.value()));
+        loadBalancer.instance()
                     .map(LoadBalancerInstance::cloudAccount)
                     .filter(cloudAccount -> !cloudAccount.isUnspecified())
                     .ifPresent(cloudAccount -> root.setString(cloudAccountField, cloudAccount.value()));
@@ -110,9 +115,10 @@ public class LoadBalancerSerializer {
         Optional<String> ipAddress = optionalString(object.field(lbIpAddressField), Function.identity()).filter(s -> !s.isEmpty());
         Optional<DnsZone> dnsZone = optionalString(object.field(dnsZoneField), DnsZone::new);
         LoadBalancerSettings settings = loadBalancerSettings(object.field(settingsField));
+        Optional<PrivateServiceId> serviceId = optionalString(object.field(serviceIdField), PrivateServiceId::of);
         CloudAccount cloudAccount = optionalString(object.field(cloudAccountField), CloudAccount::from).orElse(CloudAccount.empty);
         Optional<LoadBalancerInstance> instance = hostname.isEmpty() && ipAddress.isEmpty() ? Optional.empty() :
-                Optional.of(new LoadBalancerInstance(hostname, ipAddress, dnsZone, ports, networks, reals, settings, cloudAccount));
+                Optional.of(new LoadBalancerInstance(hostname, ipAddress, dnsZone, ports, networks, reals, settings, serviceId, cloudAccount));
 
         return new LoadBalancer(LoadBalancerId.fromSerializedForm(object.field(idField).asString()),
                                 instance,
diff --git a/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/provisioning/LoadBalancerProvisioner.java b/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/provisioning/LoadBalancerProvisioner.java
index 26a3f231a31..60c1cf9b470 100644
--- a/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/provisioning/LoadBalancerProvisioner.java
+++ b/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/provisioning/LoadBalancerProvisioner.java
@@ -249,8 +249,11 @@ public class LoadBalancerProvisioner {
                                                                          : currentLoadBalancer.flatMap(LoadBalancer::instance)
                                                                                               .map(LoadBalancerInstance::settings)
                                                                                               .orElse(null);
-            return Optional.of(service.create(new LoadBalancerSpec(id.application(), id.cluster(), reals, settings, cloudAccount),
-                                              shouldDeactivateRouting || allowEmptyReals(currentLoadBalancer)));
+            LoadBalancerInstance created = service.create(new LoadBalancerSpec(id.application(), id.cluster(), reals, settings, cloudAccount),
+                                                          shouldDeactivateRouting || allowEmptyReals(currentLoadBalancer));
+            if (created.serviceId().isEmpty() && currentLoadBalancer.flatMap(LoadBalancer::instance).flatMap(LoadBalancerInstance::serviceId).isPresent())
+                created = created.withServiceId(currentLoadBalancer.flatMap(LoadBalancer::instance).flatMap(LoadBalancerInstance::serviceId).get());
+            return Optional.of(created);
         } catch (Exception e) {
             log.log(Level.WARNING, e, () -> "Could not (re)configure " + id + ", targeting: " +
                                             reals + ". The operation will be retried on next deployment");
diff --git a/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/restapi/LoadBalancersResponse.java b/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/restapi/LoadBalancersResponse.java
index 879c8e6a9ee..71b3adee307 100644
--- a/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/restapi/LoadBalancersResponse.java
+++ b/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/restapi/LoadBalancersResponse.java
@@ -75,6 +75,11 @@ public class LoadBalancersResponse extends SlimeJsonResponse {
                     realObject.setLong("port", real.port());
                 });
             });
+            lb.instance().ifPresent(instance -> {
+                if ( ! instance.settings().isEmpty())
+                    instance.settings().allowedUrns().forEach(lbObject.setObject("settings").setArray("allowed-urns")::addString);
+                instance.serviceId().ifPresent(serviceId -> lbObject.setString("serviceId", serviceId.value()));
+            });
             lb.instance()
               .map(LoadBalancerInstance::cloudAccount)
               .filter(cloudAccount -> !cloudAccount.isUnspecified())
diff --git a/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/testutils/MockNodeRepository.java b/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/testutils/MockNodeRepository.java
index a19e48cfa6b..4794c0b48b5 100644
--- a/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/testutils/MockNodeRepository.java
+++ b/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/testutils/MockNodeRepository.java
@@ -14,6 +14,7 @@ import com.yahoo.config.provision.DockerImage;
 import com.yahoo.config.provision.Flavor;
 import com.yahoo.config.provision.HostSpec;
 import com.yahoo.config.provision.InstanceName;
+import com.yahoo.config.provision.LoadBalancerSettings;
 import com.yahoo.config.provision.NodeFlavors;
 import com.yahoo.config.provision.NodeResources;
 import com.yahoo.config.provision.NodeType;
@@ -184,7 +185,7 @@ public class MockNodeRepository extends NodeRepository {
         activate(provisioner.prepare(zoneApp, zoneCluster, Capacity.fromRequiredNodeType(NodeType.host), null), zoneApp, provisioner);
 
         ApplicationId app1Id = ApplicationId.from(TenantName.from("tenant1"), ApplicationName.from("application1"), InstanceName.from("instance1"));
-        ClusterSpec cluster1Id = ClusterSpec.request(ClusterSpec.Type.container, ClusterSpec.Id.from("id1")).vespaVersion("6.42").build();
+        ClusterSpec cluster1Id = ClusterSpec.request(ClusterSpec.Type.container, ClusterSpec.Id.from("id1")).vespaVersion("6.42").loadBalancerSettings(new LoadBalancerSettings(List.of("arne"))).build();
         activate(provisioner.prepare(app1Id,
                                      cluster1Id,
                                      Capacity.from(new ClusterResources(2, 1, new NodeResources(2, 8, 50, 1)),
diff --git a/node-repository/src/test/java/com/yahoo/vespa/hosted/provision/persistence/LoadBalancerSerializerTest.java b/node-repository/src/test/java/com/yahoo/vespa/hosted/provision/persistence/LoadBalancerSerializerTest.java
index 1e0385d152a..d5722a59f3e 100644
--- a/node-repository/src/test/java/com/yahoo/vespa/hosted/provision/persistence/LoadBalancerSerializerTest.java
+++ b/node-repository/src/test/java/com/yahoo/vespa/hosted/provision/persistence/LoadBalancerSerializerTest.java
@@ -11,6 +11,7 @@ import com.yahoo.vespa.hosted.provision.lb.DnsZone;
 import com.yahoo.vespa.hosted.provision.lb.LoadBalancer;
 import com.yahoo.vespa.hosted.provision.lb.LoadBalancerId;
 import com.yahoo.vespa.hosted.provision.lb.LoadBalancerInstance;
+import com.yahoo.vespa.hosted.provision.lb.PrivateServiceId;
 import com.yahoo.vespa.hosted.provision.lb.Real;
 import org.junit.Test;
 
@@ -46,6 +47,7 @@ public class LoadBalancerSerializerTest {
                                                                              "127.0.0.2",
                                                                              4080)),
                                                     new LoadBalancerSettings(List.of("123")),
+                                                    Optional.of(PrivateServiceId.of("foo")),
                                                     CloudAccount.from("012345678912"))),
                                             LoadBalancer.State.active,
                                             now);
@@ -60,6 +62,7 @@ public class LoadBalancerSerializerTest {
         assertEquals(loadBalancer.changedAt().truncatedTo(MILLIS), serialized.changedAt());
         assertEquals(loadBalancer.instance().get().reals(), serialized.instance().get().reals());
         assertEquals(loadBalancer.instance().get().settings(), serialized.instance().get().settings());
+        assertEquals(loadBalancer.instance().get().serviceId(), serialized.instance().get().serviceId());
         assertEquals(loadBalancer.instance().get().cloudAccount(), serialized.instance().get().cloudAccount());
     }
 
diff --git a/node-repository/src/test/java/com/yahoo/vespa/hosted/provision/restapi/responses/load-balancers.json b/node-repository/src/test/java/com/yahoo/vespa/hosted/provision/restapi/responses/load-balancers.json
index 7ae283e3916..e1add785eed 100644
--- a/node-repository/src/test/java/com/yahoo/vespa/hosted/provision/restapi/responses/load-balancers.json
+++ b/node-repository/src/test/java/com/yahoo/vespa/hosted/provision/restapi/responses/load-balancers.json
@@ -28,7 +28,11 @@
           "ipAddress": "127.0.10.1",
           "port": 4443
         }
-      ]
+      ],
+      "settings": {
+        "allowed-urns": [ "arne" ]
+      },
+      "serviceId": "service"
     },
     {
       "id": "cfg:cfg:cfg:configservers",