Wire in isFirstDeployment to AccessControlValidator

Use a boolean that is set correctly no matter what versions are loaded
to decide when to use AccessControlValidator

6 files changed, 33 insertions, 9 deletions

diff --git a/config-model/src/main/java/com/yahoo/config/model/deploy/DeployProperties.java b/config-model/src/main/java/com/yahoo/config/model/deploy/DeployProperties.java
index b259f6cf3fb..53c70399e94 100644
--- a/config-model/src/main/java/com/yahoo/config/model/deploy/DeployProperties.java
+++ b/config-model/src/main/java/com/yahoo/config/model/deploy/DeployProperties.java
@@ -26,6 +26,7 @@ public class DeployProperties {
     private final boolean hostedVespa;
     private final Version vespaVersion;
     private final boolean isBootstrap;
+    private final boolean isFirstTimeDeployment;
 
     private DeployProperties(boolean multitenant,
                              ApplicationId applicationId,
@@ -35,7 +36,8 @@ public class DeployProperties {
                              URI ztsUrl,
                              String athenzDnsSuffix,
                              Version vespaVersion,
-                             boolean isBootstrap) {
+                             boolean isBootstrap,
+                             boolean isFirstTimeDeployment) {
         this.loadBalancerName = loadBalancerName;
         this.ztsUrl = ztsUrl;
         this.athenzDnsSuffix = athenzDnsSuffix;
@@ -45,6 +47,7 @@ public class DeployProperties {
         this.serverSpecs.addAll(configServerSpecs);
         this.hostedVespa = hostedVespa;
         this.isBootstrap = isBootstrap;
+        this.isFirstTimeDeployment = isFirstTimeDeployment;
     }
 
     public boolean multitenant() {
@@ -83,6 +86,9 @@ public class DeployProperties {
     /** Returns whether this deployment happens during bootstrap *prepare* (not set on activate) */
     public boolean isBootstrap() { return isBootstrap; }
 
+    /** Returns whether this is the first deployment for this application (used during *prepare*, not set on activate) */
+    public boolean isFirstTimeDeployment() { return isFirstTimeDeployment; }
+
     public static class Builder {
 
         private ApplicationId applicationId = ApplicationId.defaultId();
@@ -94,6 +100,7 @@ public class DeployProperties {
         private boolean hostedVespa = false;
         private Version vespaVersion = Version.fromIntValues(1, 0, 0);
         private boolean isBootstrap = false;
+        private boolean isFirstTimeDeployment = false;
 
         public Builder applicationId(ApplicationId applicationId) {
             this.applicationId = applicationId;
@@ -140,8 +147,14 @@ public class DeployProperties {
             return this;
         }
 
+        public Builder isFirstTimeDeployment(boolean isFirstTimeDeployment) {
+            this.isFirstTimeDeployment = isFirstTimeDeployment;
+            return this;
+        }
+
         public DeployProperties build() {
-            return new DeployProperties(multitenant, applicationId, configServerSpecs, loadBalancerName, hostedVespa, ztsUrl, athenzDnsSuffix, vespaVersion, isBootstrap);
+            return new DeployProperties(multitenant, applicationId, configServerSpecs, loadBalancerName, hostedVespa,
+                                        ztsUrl, athenzDnsSuffix, vespaVersion, isBootstrap, isFirstTimeDeployment);
         }
     }
 
diff --git a/config-model/src/main/java/com/yahoo/config/model/deploy/DeployState.java b/config-model/src/main/java/com/yahoo/config/model/deploy/DeployState.java
index 3dafb521dc8..44e101115a2 100644
--- a/config-model/src/main/java/com/yahoo/config/model/deploy/DeployState.java
+++ b/config-model/src/main/java/com/yahoo/config/model/deploy/DeployState.java
@@ -227,6 +227,7 @@ public class DeployState implements ConfigDefinitionStore {
         private Zone zone = Zone.defaultZone();
         private Instant now = Instant.now();
         private Version wantedNodeVespaVersion = Vtag.currentVersion;
+        private boolean isFirstTimeDeployment = false;
 
         public Builder applicationPackage(ApplicationPackage applicationPackage) {
             this.applicationPackage = applicationPackage;
diff --git a/config-model/src/main/java/com/yahoo/vespa/model/VespaModelFactory.java b/config-model/src/main/java/com/yahoo/vespa/model/VespaModelFactory.java
index e88153342f9..4da4e9e5693 100644
--- a/config-model/src/main/java/com/yahoo/vespa/model/VespaModelFactory.java
+++ b/config-model/src/main/java/com/yahoo/vespa/model/VespaModelFactory.java
@@ -154,6 +154,7 @@ public class VespaModelFactory implements ModelFactory {
                 .hostedVespa(properties.hostedVespa())
                 .vespaVersion(getVersion())
                 .isBootstrap(properties.isBootstrap())
+                .isFirstTimeDeployment(properties.isFirstTimeDeployment())
                 .build();
     }
 
diff --git a/config-model/src/main/java/com/yahoo/vespa/model/application/validation/Validation.java b/config-model/src/main/java/com/yahoo/vespa/model/application/validation/Validation.java
index c08e81b250f..99c45772b8f 100644
--- a/config-model/src/main/java/com/yahoo/vespa/model/application/validation/Validation.java
+++ b/config-model/src/main/java/com/yahoo/vespa/model/application/validation/Validation.java
@@ -21,8 +21,8 @@ import com.yahoo.vespa.model.application.validation.change.StreamingSearchCluste
 import com.yahoo.vespa.model.application.validation.first.AccessControlValidator;
 
 import java.time.Instant;
-import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.Collections;
 import java.util.List;
 import java.util.Optional;
 
@@ -60,13 +60,16 @@ public class Validation {
         new RankingConstantsValidator().validate(model, deployState);
         new SecretStoreValidator().validate(model, deployState);
 
-        Optional<Model> currentActiveModel = deployState.getPreviousModel();
-        if (currentActiveModel.isPresent() && (currentActiveModel.get() instanceof VespaModel))
-            return validateChanges((VespaModel)currentActiveModel.get(), model,
-                                   deployState.validationOverrides(), deployState.getDeployLogger(), deployState.now());
-        else
+        List<ConfigChangeAction> result = Collections.emptyList();;
+        if (deployState.getProperties().isFirstTimeDeployment()) {
             validateFirstTimeDeployment(model, deployState);
-            return new ArrayList<>();
+        } else {
+            Optional<Model> currentActiveModel = deployState.getPreviousModel();
+            if (currentActiveModel.isPresent() && (currentActiveModel.get() instanceof VespaModel))
+                result = validateChanges((VespaModel) currentActiveModel.get(), model,
+                                         deployState.validationOverrides(), deployState.getDeployLogger(), deployState.now());
+        }
+        return result;
     }
 
     private static List<ConfigChangeAction> validateChanges(VespaModel currentModel, VespaModel nextModel,
diff --git a/config-model/src/test/java/com/yahoo/config/model/MockModelContext.java b/config-model/src/test/java/com/yahoo/config/model/MockModelContext.java
index 6821b7e3b4b..5bd95334396 100644
--- a/config-model/src/test/java/com/yahoo/config/model/MockModelContext.java
+++ b/config-model/src/test/java/com/yahoo/config/model/MockModelContext.java
@@ -130,6 +130,9 @@ public class MockModelContext implements ModelContext {
 
             @Override
             public boolean isBootstrap() { return false; }
+
+            @Override
+            public boolean isFirstTimeDeployment() { return false; }
         };
     }
 }
diff --git a/config-model/src/test/java/com/yahoo/vespa/model/VespaModelFactoryTest.java b/config-model/src/test/java/com/yahoo/vespa/model/VespaModelFactoryTest.java
index 2261affb65b..548d3d04a63 100644
--- a/config-model/src/test/java/com/yahoo/vespa/model/VespaModelFactoryTest.java
+++ b/config-model/src/test/java/com/yahoo/vespa/model/VespaModelFactoryTest.java
@@ -212,6 +212,9 @@ public class VespaModelFactoryTest {
 
                     @Override
                     public boolean isBootstrap() { return false; }
+
+                    @Override
+                    public boolean isFirstTimeDeployment() { return false; }
                 };
             }
         };