Always include zone-scoped endpoints when deploying

3 files changed, 45 insertions, 39 deletions

diff --git a/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/RoutingController.java b/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/RoutingController.java
index 2b2ec725d7e..e3b93b5635f 100644
--- a/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/RoutingController.java
+++ b/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/RoutingController.java
@@ -134,44 +134,44 @@ public class RoutingController {
         // Add zone-scoped endpoints
         Map<EndpointId, List<GeneratedEndpoint>> generatedForDeclaredEndpoints = new HashMap<>();
         Set<ClusterSpec.Id> clustersWithToken = new HashSet<>();
-        if (randomizedEndpointsEnabled(deployment.applicationId())) { // TODO(mpolden): Remove this guard once config-models < 8.220 are gone
-            RoutingPolicyList applicationPolicies = policies().read(TenantAndApplicationId.from(deployment.applicationId()));
-            RoutingPolicyList deploymentPolicies = applicationPolicies.deployment(deployment);
-            for (var container : services.containers()) {
-                ClusterSpec.Id clusterId = ClusterSpec.Id.from(container.id());
-                boolean tokenSupported = container.authMethods().contains(BasicServicesXml.Container.AuthMethod.token);
-                if (tokenSupported) {
-                    clustersWithToken.add(clusterId);
-                }
-                Optional<RoutingPolicy> clusterPolicy = deploymentPolicies.cluster(clusterId).first();
-                List<GeneratedEndpoint> generatedForCluster = clusterPolicy.map(policy -> policy.generatedEndpoints().cluster().asList())
-                                                                           .orElseGet(List::of);
-                // Generate endpoints if cluster does not have any
-                if (generatedForCluster.isEmpty()) {
-                    generatedForCluster = generateEndpoints(tokenSupported, certificate, Optional.empty());
-                }
-                endpoints = endpoints.and(endpointsOf(deployment, clusterId, GeneratedEndpointList.copyOf(generatedForCluster)).scope(Scope.zone));
+        boolean generatedEndpointsEnabled = randomizedEndpointsEnabled(deployment.applicationId());
+        RoutingPolicyList applicationPolicies = policies().read(TenantAndApplicationId.from(deployment.applicationId()));
+        RoutingPolicyList deploymentPolicies = applicationPolicies.deployment(deployment);
+        for (var container : services.containers()) {
+            ClusterSpec.Id clusterId = ClusterSpec.Id.from(container.id());
+            boolean tokenSupported = container.authMethods().contains(BasicServicesXml.Container.AuthMethod.token);
+            if (tokenSupported) {
+                clustersWithToken.add(clusterId);
             }
-
-            // Generate endpoints if declared endpoint does not have any
-            for (var container : services.containers()) {
-                ClusterSpec.Id clusterId = ClusterSpec.Id.from(container.id());
-                applicationPolicies.cluster(clusterId).asList().stream()
-                                   .flatMap(policy -> policy.generatedEndpoints().declared().asList().stream())
-                                   .forEach(ge -> generatedForDeclaredEndpoints.computeIfAbsent(ge.endpoint().get(), (k) -> List.of(ge)));
+            Optional<RoutingPolicy> clusterPolicy = deploymentPolicies.cluster(clusterId).first();
+            List<GeneratedEndpoint> generatedForCluster = clusterPolicy.map(policy -> policy.generatedEndpoints().cluster().asList())
+                                                                       .orElseGet(List::of);
+            // Generate endpoints if cluster does not have any
+            if (generatedForCluster.isEmpty()) {
+                generatedForCluster = generateEndpoints(tokenSupported, certificate, Optional.empty());
             }
-            Stream.concat(spec.endpoints().stream(), spec.instances().stream().flatMap(i -> i.endpoints().stream()))
-                  .forEach(endpoint -> {
-                      EndpointId endpointId = EndpointId.of(endpoint.endpointId());
-                      generatedForDeclaredEndpoints.computeIfAbsent(endpointId, (k) -> {
-                          boolean tokenSupported = clustersWithToken.contains(ClusterSpec.Id.from(endpoint.containerId()));
-                          return generateEndpoints(tokenSupported, certificate, Optional.of(endpointId));
-                      });
-                  });
+            GeneratedEndpointList generatedEndpoints = generatedEndpointsEnabled ? GeneratedEndpointList.copyOf(generatedForCluster) : GeneratedEndpointList.EMPTY;
+            endpoints = endpoints.and(endpointsOf(deployment, clusterId, generatedEndpoints).scope(Scope.zone));
         }
 
         // Add global- and application-scoped endpoints
-        endpoints = endpoints.and(declaredEndpointsOf(application.get().id(), spec, generatedForDeclaredEndpoints).targets(deployment));
+        for (var container : services.containers()) {
+            ClusterSpec.Id clusterId = ClusterSpec.Id.from(container.id());
+            applicationPolicies.cluster(clusterId).asList().stream()
+                               .flatMap(policy -> policy.generatedEndpoints().declared().asList().stream())
+                               .forEach(ge -> generatedForDeclaredEndpoints.computeIfAbsent(ge.endpoint().get(), (k) -> List.of(ge)));
+        }
+        // Generate endpoints if declared endpoint does not have any
+        Stream.concat(spec.endpoints().stream(), spec.instances().stream().flatMap(i -> i.endpoints().stream()))
+              .forEach(endpoint -> {
+                  EndpointId endpointId = EndpointId.of(endpoint.endpointId());
+                  generatedForDeclaredEndpoints.computeIfAbsent(endpointId, (k) -> {
+                      boolean tokenSupported = clustersWithToken.contains(ClusterSpec.Id.from(endpoint.containerId()));
+                      return generatedEndpointsEnabled ? generateEndpoints(tokenSupported, certificate, Optional.of(endpointId)) : null;
+                  });
+              });
+        Map<EndpointId, List<GeneratedEndpoint>> generatedEndpoints = generatedEndpointsEnabled ? generatedForDeclaredEndpoints : Map.of();
+        endpoints = endpoints.and(declaredEndpointsOf(application.get().id(), spec, generatedEndpoints).targets(deployment));
         PreparedEndpoints prepared = new PreparedEndpoints(deployment,
                                                            endpoints,
                                                            application.get().require(deployment.applicationId().instance()).rotations(),
diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/ControllerTest.java b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/ControllerTest.java
index 1a886a50589..279b09f7b0b 100644
--- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/ControllerTest.java
+++ b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/ControllerTest.java
@@ -1091,6 +1091,8 @@ public class ControllerTest {
                 .region(zone1.region())
                 .region(zone2.region())
                 .region(zone3.region())
+                .container("qrs", AuthMethod.mtls)
+                .container("default", AuthMethod.mtls)
                 .endpoint("default", "default")
                 .endpoint("foo", "qrs")
                 .endpoint("us", "default", zone1.region().value(), zone2.region().value())
@@ -1100,15 +1102,19 @@ public class ControllerTest {
         // Deployment passes container endpoints to config server
         for (var zone : List.of(zone1, zone2)) {
             assertEquals(Set.of("application.tenant.global.vespa.oath.cloud",
-                            "foo.application.tenant.global.vespa.oath.cloud",
-                            "us.application.tenant.global.vespa.oath.cloud"),
+                                "foo.application.tenant.global.vespa.oath.cloud",
+                                "us.application.tenant.global.vespa.oath.cloud",
+                                "qrs.application.tenant." + zone.region().value() + ".vespa.oath.cloud",
+                                "application.tenant." + zone.region().value() + ".vespa.oath.cloud"),
                     tester.configServer().containerEndpointNames(context.deploymentIdIn(zone)),
                     "Expected container endpoints in " + zone);
         }
         assertEquals(Set.of("application.tenant.global.vespa.oath.cloud",
-                        "foo.application.tenant.global.vespa.oath.cloud"),
-                tester.configServer().containerEndpointNames(context.deploymentIdIn(zone3)),
-                "Expected container endpoints in " + zone3);
+                            "foo.application.tenant.global.vespa.oath.cloud",
+                            "qrs.application.tenant.eu-west-1.vespa.oath.cloud",
+                            "application.tenant.eu-west-1.vespa.oath.cloud"),
+                     tester.configServer().containerEndpointNames(context.deploymentIdIn(zone3)),
+                     "Expected container endpoints in " + zone3);
     }
 
     @Test
diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/deployment/ApplicationPackageBuilder.java b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/deployment/ApplicationPackageBuilder.java
index 5c20bce0099..3623ddc4e56 100644
--- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/deployment/ApplicationPackageBuilder.java
+++ b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/deployment/ApplicationPackageBuilder.java
@@ -129,7 +129,7 @@ public class ApplicationPackageBuilder {
                             .append(m.name()).append("-").append(i)
                             .append("'/>\n");
             }
-            servicesBody.append("     </client>\n");
+            servicesBody.append("      </client>\n");
         }
         servicesBody.append("    </clients>\n")
                     .append("  </container>\n");