Move validation to validator class

2 files changed, 7 insertions, 6 deletions

diff --git a/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/application/ApplicationPackageValidator.java b/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/application/ApplicationPackageValidator.java
index d7347b46f52..9e83e021ad8 100644
--- a/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/application/ApplicationPackageValidator.java
+++ b/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/application/ApplicationPackageValidator.java
@@ -46,6 +46,13 @@ public class ApplicationPackageValidator {
         validateSteps(applicationPackage.deploymentSpec());
         validateEndpointRegions(applicationPackage.deploymentSpec());
         validateEndpointChange(application, applicationPackage, instant);
+        validateSecurityClientsPem(applicationPackage);
+    }
+
+    /** Verify that we have the security/clients.pem file for public systems */
+    public void validateSecurityClientsPem(ApplicationPackage applicationPackage) {
+        if (controller.system().isPublic() && applicationPackage.trustedCertificates().isEmpty())
+            throw new IllegalArgumentException("Missing required file 'security/clients.pem'");
     }
 
     /** Verify that each of the production zones listed in the deployment spec exist in this system */
diff --git a/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/restapi/application/ApplicationApiHandler.java b/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/restapi/application/ApplicationApiHandler.java
index 98808ea5686..1c8279f6d8d 100644
--- a/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/restapi/application/ApplicationApiHandler.java
+++ b/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/restapi/application/ApplicationApiHandler.java
@@ -1956,12 +1956,6 @@ public class ApplicationApiHandler extends LoggingRequestHandler {
 
         ApplicationPackage applicationPackage = new ApplicationPackage(dataParts.get(EnvironmentResource.APPLICATION_ZIP), true);
 
-        // if we are in public and 'security/clients.pem' is not present (i.e. we don't have any trusted
-        // certificates), we should fail early instead of waiting for the configserver to fail.
-        if (controller.system().isPublic() && applicationPackage.trustedCertificates().isEmpty()) {
-            throw new IllegalArgumentException("Missing required file 'security/clients.pem'");
-        }
-
         controller.applications().verifyApplicationIdentityConfiguration(TenantName.from(tenant),
                                                                          Optional.empty(),
                                                                          Optional.empty(),