Don't use credentials in production

1 files changed, 13 insertions, 7 deletions

diff --git a/vespa-osgi-testrunner/src/main/java/com/yahoo/vespa/testrunner/JunitRunner.java b/vespa-osgi-testrunner/src/main/java/com/yahoo/vespa/testrunner/JunitRunner.java
index 94ddd0a7f87..7e3f61c5c0f 100644
--- a/vespa-osgi-testrunner/src/main/java/com/yahoo/vespa/testrunner/JunitRunner.java
+++ b/vespa-osgi-testrunner/src/main/java/com/yahoo/vespa/testrunner/JunitRunner.java
@@ -1,6 +1,8 @@
 // Copyright Verizon Media. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
 package com.yahoo.vespa.testrunner;
 
+import ai.vespa.cloud.Environment;
+import ai.vespa.cloud.Zone;
 import ai.vespa.hosted.api.TestDescriptor;
 import ai.vespa.hosted.cd.internal.TestRuntimeProvider;
 import com.google.inject.Inject;
@@ -49,10 +51,11 @@ public class JunitRunner extends AbstractComponent implements TestRunner {
     @Inject
     public JunitRunner(OsgiFramework osgiFramework,
                        JunitTestRunnerConfig config,
-                       TestRuntimeProvider testRuntimeProvider) {
+                       TestRuntimeProvider testRuntimeProvider,
+                       Zone zone) {
         this.testRuntimeProvider = testRuntimeProvider;
         this.bundleContext = getUnrestrictedBundleContext(osgiFramework);
-        uglyHackSetCredentialsRootSystemProperty(config);
+        uglyHackSetCredentialsRootSystemProperty(config, zone);
     }
 
     // Hack to retrieve bundle context that allows access to other bundles
@@ -68,14 +71,17 @@ public class JunitRunner extends AbstractComponent implements TestRunner {
     }
 
     // TODO(bjorncs|tokle) Propagate credentials root without system property. Ideally move knowledge about path to test-runtime implementations
-    private static void uglyHackSetCredentialsRootSystemProperty(JunitTestRunnerConfig config) {
-        String credentialsRoot;
+    private static void uglyHackSetCredentialsRootSystemProperty(JunitTestRunnerConfig config, Zone zone) {
+        Optional<String> credentialsRoot;
         if (config.useAthenzCredentials()) {
-            credentialsRoot = Defaults.getDefaults().underVespaHome("var/vespa/sia");
+            credentialsRoot = Optional.of(Defaults.getDefaults().underVespaHome("var/vespa/sia"));
+        } else if (zone.environment() != Environment.prod){
+            // Only set credentials in non-prod zones where not available
+            credentialsRoot = Optional.of(config.artifactsPath().toString());
         } else {
-            credentialsRoot = config.artifactsPath().toString();
+            credentialsRoot = Optional.empty();
         }
-        System.setProperty("vespa.test.credentials.root", credentialsRoot);
+        credentialsRoot.ifPresent(root -> System.setProperty("vespa.test.credentials.root", root));
     }
 
     @Override