Merge pull request #30727 from vespa-engine/mortent/prepare-node-cert-replacement

prepare node cert replacement

2 files changed, 8 insertions, 1 deletions

diff --git a/flags/src/main/java/com/yahoo/vespa/flags/PermanentFlags.java b/flags/src/main/java/com/yahoo/vespa/flags/PermanentFlags.java
index 05f2062136b..43bf3ec02c5 100644
--- a/flags/src/main/java/com/yahoo/vespa/flags/PermanentFlags.java
+++ b/flags/src/main/java/com/yahoo/vespa/flags/PermanentFlags.java
@@ -431,6 +431,13 @@ public class PermanentFlags {
             CLOUD_ACCOUNT
     );
 
+    public static final UnboundStringFlag REFRESH_IDENTITY_BOUNDARY = defineStringFlag(
+            "refresh-identity-after", "",
+            "Refresh the identity document and certificates issued before this timestamp. Timestamp in ISO8601 format",
+            "Takes effect on next host admin tick",
+            HOSTNAME
+    );
+
     private PermanentFlags() {}
 
     private static UnboundBooleanFlag defineFeatureFlag(
diff --git a/vespa-athenz/src/main/java/com/yahoo/vespa/athenz/identityprovider/api/EntityBindingsMapper.java b/vespa-athenz/src/main/java/com/yahoo/vespa/athenz/identityprovider/api/EntityBindingsMapper.java
index c654b790836..4bbdd24db32 100644
--- a/vespa-athenz/src/main/java/com/yahoo/vespa/athenz/identityprovider/api/EntityBindingsMapper.java
+++ b/vespa-athenz/src/main/java/com/yahoo/vespa/athenz/identityprovider/api/EntityBindingsMapper.java
@@ -125,7 +125,7 @@ public class EntityBindingsMapper {
             try (OutputStream outputStream = Files.newOutputStream(tempFile)) {
                 mapper.writeValue(outputStream, entity);
             }
-            Files.move(tempFile, file, StandardCopyOption.ATOMIC_MOVE);
+            Files.move(tempFile, file, StandardCopyOption.ATOMIC_MOVE, StandardCopyOption.REPLACE_EXISTING);
         } catch (IOException e) {
             throw new UncheckedIOException(e);
         }