Add token endpoint

1 files changed, 104 insertions, 0 deletions

diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/routing/RoutingPoliciesTest.java b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/routing/RoutingPoliciesTest.java
index 6ef4da8b60b..6294f9879b4 100644
--- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/routing/RoutingPoliciesTest.java
+++ b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/routing/RoutingPoliciesTest.java
@@ -16,6 +16,7 @@ import com.yahoo.config.provision.RegionName;
 import com.yahoo.config.provision.SystemName;
 import com.yahoo.config.provision.zone.RoutingMethod;
 import com.yahoo.config.provision.zone.ZoneId;
+import com.yahoo.vespa.flags.Flags;
 import com.yahoo.vespa.hosted.controller.ControllerTester;
 import com.yahoo.vespa.hosted.controller.Instance;
 import com.yahoo.vespa.hosted.controller.api.identifiers.DeploymentId;
@@ -52,7 +53,9 @@ import java.util.List;
 import java.util.Map;
 import java.util.Optional;
 import java.util.Set;
+import java.util.stream.Collector;
 import java.util.stream.Collectors;
+import java.util.stream.Stream;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertSame;
@@ -336,6 +339,103 @@ public class RoutingPoliciesTest {
     }
 
     @Test
+    void zone_token_endpoints() {
+        var tester = new RoutingPoliciesTester();
+        tester.enableTokenEndpoint(true);
+
+        var context1 = tester.newDeploymentContext("tenant1", "app1", "default");
+        var context2 = tester.newDeploymentContext("tenant1", "app2", "default");
+
+        // Deploy application
+        int clustersPerZone = 2;
+        tester.provisionLoadBalancers(clustersPerZone, context1.instanceId(), false, zone1, zone2);
+        context1.submit(applicationPackage).deferLoadBalancerProvisioningIn(Environment.prod).deploy();
+
+        // Deployment creates records and policies for all clusters in all zones
+        Set<String> expectedRecords = includeTokenEndpoints(Set.of(
+                "c0.app1.tenant1.us-west-1.vespa.oath.cloud",
+                "c1.app1.tenant1.us-west-1.vespa.oath.cloud",
+                "c0.app1.tenant1.us-central-1.vespa.oath.cloud",
+                "c1.app1.tenant1.us-central-1.vespa.oath.cloud"
+        ));
+        assertEquals(expectedRecords, tester.recordNames());
+        assertEquals(4, tester.policiesOf(context1.instanceId()).size());
+
+        // Next deploy does nothing
+        context1.submit(applicationPackage).deferLoadBalancerProvisioningIn(Environment.prod).deploy();
+        assertEquals(expectedRecords, tester.recordNames());
+        assertEquals(4, tester.policiesOf(context1.instanceId()).size());
+
+        // Add 1 cluster in each zone and deploy
+        tester.provisionLoadBalancers(clustersPerZone + 1, context1.instanceId(), false, zone1, zone2);
+        context1.submit(applicationPackage).deferLoadBalancerProvisioningIn(Environment.prod).deploy();
+        expectedRecords = includeTokenEndpoints(Set.of(
+                "c0.app1.tenant1.us-west-1.vespa.oath.cloud",
+                "c1.app1.tenant1.us-west-1.vespa.oath.cloud",
+                "c2.app1.tenant1.us-west-1.vespa.oath.cloud",
+                "c0.app1.tenant1.us-central-1.vespa.oath.cloud",
+                "c1.app1.tenant1.us-central-1.vespa.oath.cloud",
+                "c2.app1.tenant1.us-central-1.vespa.oath.cloud"
+        ));
+        assertEquals(expectedRecords, tester.recordNames());
+        assertEquals(6, tester.policiesOf(context1.instanceId()).size());
+
+        // Deploy another application
+        tester.provisionLoadBalancers(clustersPerZone, context2.instanceId(), false, zone1, zone2);
+        context2.submit(applicationPackage).deferLoadBalancerProvisioningIn(Environment.prod).deploy();
+        expectedRecords = includeTokenEndpoints(Set.of(
+                "c0.app1.tenant1.us-west-1.vespa.oath.cloud",
+                "c1.app1.tenant1.us-west-1.vespa.oath.cloud",
+                "c2.app1.tenant1.us-west-1.vespa.oath.cloud",
+                "c0.app1.tenant1.us-central-1.vespa.oath.cloud",
+                "c1.app1.tenant1.us-central-1.vespa.oath.cloud",
+                "c2.app1.tenant1.us-central-1.vespa.oath.cloud",
+                "c0.app2.tenant1.us-central-1.vespa.oath.cloud",
+                "c1.app2.tenant1.us-central-1.vespa.oath.cloud",
+                "c0.app2.tenant1.us-west-1.vespa.oath.cloud",
+                "c1.app2.tenant1.us-west-1.vespa.oath.cloud"
+        ));
+        assertEquals(expectedRecords.stream().sorted().toList(), tester.recordNames().stream().sorted().toList());
+        assertEquals(4, tester.policiesOf(context2.instanceId()).size());
+
+        // Deploy removes cluster from app1
+        tester.provisionLoadBalancers(clustersPerZone, context1.instanceId(), false, zone1, zone2);
+        context1.submit(applicationPackage).deferLoadBalancerProvisioningIn(Environment.prod).deploy();
+        expectedRecords = includeTokenEndpoints(Set.of(
+                "c0.app1.tenant1.us-west-1.vespa.oath.cloud",
+                "c1.app1.tenant1.us-west-1.vespa.oath.cloud",
+                "c0.app1.tenant1.us-central-1.vespa.oath.cloud",
+                "c1.app1.tenant1.us-central-1.vespa.oath.cloud",
+                "c0.app2.tenant1.us-central-1.vespa.oath.cloud",
+                "c1.app2.tenant1.us-central-1.vespa.oath.cloud",
+                "c0.app2.tenant1.us-west-1.vespa.oath.cloud",
+                "c1.app2.tenant1.us-west-1.vespa.oath.cloud"
+        ));
+        assertEquals(expectedRecords, tester.recordNames());
+
+        // Remove app2 completely
+        tester.controllerTester().controller().applications().requireInstance(context2.instanceId()).deployments().keySet()
+                .forEach(zone -> tester.controllerTester().controller().applications().deactivate(context2.instanceId(), zone));
+        context2.flushDnsUpdates();
+        expectedRecords = includeTokenEndpoints(Set.of(
+                "c0.app1.tenant1.us-west-1.vespa.oath.cloud",
+                "c1.app1.tenant1.us-west-1.vespa.oath.cloud",
+                "c0.app1.tenant1.us-central-1.vespa.oath.cloud",
+                "c1.app1.tenant1.us-central-1.vespa.oath.cloud"
+        ));
+        assertEquals(expectedRecords, tester.recordNames());
+        assertTrue(tester.routingPolicies().read(context2.instanceId()).isEmpty(), "Removes stale routing policies " + context2.application());
+        assertEquals(4, tester.routingPolicies().read(context1.instanceId()).size(), "Keeps routing policies for " + context1.application());
+    }
+
+    private Set<String> includeTokenEndpoints(Set<String> records) {
+        return Stream.concat(
+                        records.stream(),
+                        records.stream().map(v -> "token-" + v))
+                .collect(Collectors.toSet());
+    }
+
+    @Test
     void zone_routing_policies_without_dns_update() {
         var tester = new RoutingPoliciesTester(new DeploymentTester(), false);
         var context = tester.newDeploymentContext("tenant1", "app1", "default");
@@ -1109,6 +1209,10 @@ public class RoutingPoliciesTest {
                          .toList();
         }
 
+        void enableTokenEndpoint(boolean enabled) {
+            tester.controllerTester().flagSource().withBooleanFlag(Flags.ENABLE_DATAPLANE_PROXY.id(), enabled);
+        }
+
         /** Assert that an application endpoint points to given targets and weights */
         private void assertTargets(TenantAndApplicationId application, EndpointId endpointId, ClusterSpec.Id cluster,
                                    int loadBalancerId, Map<DeploymentId, Integer> deploymentWeights) {