Do not read API key from disk in Cloud CI

2 files changed, 10 insertions, 1 deletions

diff --git a/client/go/cmd/config.go b/client/go/cmd/config.go
index 02477aecf28..b8a7cb9c24c 100644
--- a/client/go/cmd/config.go
+++ b/client/go/cmd/config.go
@@ -439,6 +439,9 @@ func (c *Config) readAPIKey(cli *CLI, system vespa.System, tenantName string) ([
 	if path, ok := c.apiKeyFileFromEnv(); ok {
 		return os.ReadFile(path)
 	}
+	if cli.isCloudCI() {
+		return nil, nil // Vespa Cloud CI only talks to data plane and does not have an API key
+	}
 	if !cli.isCI() {
 		client, err := auth0.New(c.authConfigPath(), system.Name, system.URL)
 		if err == nil && client.HasCredentials() {
diff --git a/client/go/cmd/config_test.go b/client/go/cmd/config_test.go
index 9f41ef46914..86c7e2695fa 100644
--- a/client/go/cmd/config_test.go
+++ b/client/go/cmd/config_test.go
@@ -157,6 +157,12 @@ func TestReadAPIKey(t *testing.T) {
 	require.Nil(t, err)
 	assert.Equal(t, []byte("foo"), key)
 
+	// Cloud CI does not read key from disk as it's not expected to have any
+	cli, _, _ = newTestCLI(t, "VESPA_CLI_CLOUD_CI=true")
+	key, err = cli.config.readAPIKey(cli, vespa.PublicSystem, "t1")
+	require.Nil(t, err)
+	assert.Nil(t, key)
+
 	// From file specified in environment
 	keyFile := filepath.Join(t.TempDir(), "key")
 	require.Nil(t, os.WriteFile(keyFile, []byte("bar"), 0600))
@@ -192,5 +198,5 @@ func TestReadAPIKey(t *testing.T) {
 	require.Nil(t, os.WriteFile(filepath.Join(cli.config.homeDir, "auth.json"), []byte(authContent), 0600))
 	key, err = cli.config.readAPIKey(cli, vespa.PublicSystem, "t1")
 	require.Nil(t, err)
-	assert.Equal(t, []byte(nil), key)
+	assert.Nil(t, key)
 }