Merge branch 'master' into bjormel/aws-main-controller

5 files changed, 91 insertions, 68 deletions

diff --git a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/configserver/noderepository/NodeSpec.java b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/configserver/noderepository/NodeSpec.java
index 0300d7e92ff..d902fb7b3c4 100644
--- a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/configserver/noderepository/NodeSpec.java
+++ b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/configserver/noderepository/NodeSpec.java
@@ -9,6 +9,7 @@ import com.yahoo.config.provision.DockerImage;
 import com.yahoo.config.provision.NodeResources;
 import com.yahoo.config.provision.NodeType;
 import com.yahoo.config.provision.WireguardKey;
+import com.yahoo.config.provision.WireguardKeyWithTimestamp;
 import com.yahoo.vespa.hosted.node.admin.task.util.file.DiskSize;
 
 import java.net.URI;
@@ -73,9 +74,7 @@ public class NodeSpec {
 
     private final List<TrustStoreItem> trustStore;
 
-    private final Optional<WireguardKey> wireguardPubkey;
-
-    private final Optional<Instant> wireguardKeyTimestamp;
+    private final Optional<WireguardKeyWithTimestamp> wireguardKeyWithTimestamp;
 
     private final boolean wantToRebuild;
 
@@ -112,8 +111,7 @@ public class NodeSpec {
             Optional<URI> archiveUri,
             Optional<ApplicationId> exclusiveTo,
             List<TrustStoreItem> trustStore,
-            Optional<WireguardKey> wireguardPubkey,
-            Optional<Instant> wireguardKeyTimestamp,
+            Optional<WireguardKeyWithTimestamp> wireguardPubkey,
             boolean wantToRebuild) {
 
         if (state == NodeState.active) {
@@ -157,8 +155,7 @@ public class NodeSpec {
         this.archiveUri = Objects.requireNonNull(archiveUri);
         this.exclusiveTo = Objects.requireNonNull(exclusiveTo);
         this.trustStore = Objects.requireNonNull(trustStore);
-        this.wireguardPubkey = Objects.requireNonNull(wireguardPubkey);
-        this.wireguardKeyTimestamp = Objects.requireNonNull(wireguardKeyTimestamp);
+        this.wireguardKeyWithTimestamp = Objects.requireNonNull(wireguardPubkey);
         this.wantToRebuild = wantToRebuild;
     }
 
@@ -313,9 +310,7 @@ public class NodeSpec {
         return trustStore;
     }
 
-    public Optional<WireguardKey> wireguardPubkey() { return wireguardPubkey; }
-
-    public Optional<Instant> wireguardKeyTimestamp() { return wireguardKeyTimestamp; }
+    public Optional<WireguardKeyWithTimestamp> wireguardKeyWithTimestamp() { return wireguardKeyWithTimestamp; }
 
     public boolean wantToRebuild() {
         return wantToRebuild;
@@ -358,8 +353,7 @@ public class NodeSpec {
                 Objects.equals(archiveUri, that.archiveUri) &&
                 Objects.equals(exclusiveTo, that.exclusiveTo) &&
                 Objects.equals(trustStore, that.trustStore) &&
-                Objects.equals(wireguardPubkey, that.wireguardPubkey) &&
-                Objects.equals(wireguardKeyTimestamp, that.wireguardKeyTimestamp) &&
+                Objects.equals(wireguardKeyWithTimestamp, that.wireguardKeyWithTimestamp) &&
                 Objects.equals(wantToRebuild, that.wantToRebuild);
     }
 
@@ -398,8 +392,7 @@ public class NodeSpec {
                 archiveUri,
                 exclusiveTo,
                 trustStore,
-                wireguardPubkey,
-                wireguardKeyTimestamp,
+                wireguardKeyWithTimestamp,
                 wantToRebuild);
     }
 
@@ -438,8 +431,7 @@ public class NodeSpec {
                 + " archiveUri=" + archiveUri
                 + " exclusiveTo=" + exclusiveTo
                 + " trustStore=" + trustStore
-                + " wireguardPubkey=" + wireguardPubkey
-                + " wireguardKeyTimestamp=" + wireguardKeyTimestamp
+                + " wireguardPubkey=" + wireguardKeyWithTimestamp
                 + " wantToRebuild=" + wantToRebuild
                 + " }";
     }
@@ -477,8 +469,7 @@ public class NodeSpec {
         private Optional<URI> archiveUri = Optional.empty();
         private Optional<ApplicationId> exclusiveTo = Optional.empty();
         private List<TrustStoreItem> trustStore = List.of();
-        private Optional<WireguardKey> wireguardPubkey = Optional.empty();
-        private Optional<Instant> wireguardKeyTimestamp = Optional.empty();
+        private Optional<WireguardKeyWithTimestamp> wireguardPubkey = Optional.empty();
         private boolean wantToRebuild = false;
 
         public Builder() {}
@@ -514,8 +505,7 @@ public class NodeSpec {
             node.archiveUri.ifPresent(this::archiveUri);
             node.exclusiveTo.ifPresent(this::exclusiveTo);
             trustStore(node.trustStore);
-            node.wireguardPubkey.ifPresent(this::wireguardPubkey);
-            node.wireguardKeyTimestamp.ifPresent(this::wireguardKeyTimestamp);
+            node.wireguardKeyWithTimestamp.ifPresent(this::wireguardKeyWithTimestamp);
             wantToRebuild(node.wantToRebuild);
         }
 
@@ -704,13 +694,13 @@ public class NodeSpec {
             return this;
         }
 
-        public Builder wireguardPubkey(WireguardKey wireguardPubKey) {
-            this.wireguardPubkey = Optional.of(wireguardPubKey);
+        public Builder wireguardPubkey(WireguardKey wireguardPubkey) {
+            this.wireguardPubkey = Optional.of(new WireguardKeyWithTimestamp(wireguardPubkey, Instant.EPOCH));
             return this;
         }
 
-        public Builder wireguardKeyTimestamp(Instant wireguardKeyTimestamp) {
-            this.wireguardKeyTimestamp = Optional.of(wireguardKeyTimestamp);
+        public Builder wireguardKeyWithTimestamp(WireguardKeyWithTimestamp wireguardPubKey) {
+            this.wireguardPubkey = Optional.of(wireguardPubKey);
             return this;
         }
 
@@ -846,7 +836,7 @@ public class NodeSpec {
                                 wantedFirmwareCheck, currentFirmwareCheck, modelName,
                                 resources, realResources, ipAddresses, additionalIpAddresses,
                                 reports, events, parentHostname, archiveUri, exclusiveTo, trustStore,
-                                wireguardPubkey, wireguardKeyTimestamp, wantToRebuild);
+                                wireguardPubkey, wantToRebuild);
         }
 
 
diff --git a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/configserver/noderepository/RealNodeRepository.java b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/configserver/noderepository/RealNodeRepository.java
index a9cc2d698e9..17d3b51398f 100644
--- a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/configserver/noderepository/RealNodeRepository.java
+++ b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/configserver/noderepository/RealNodeRepository.java
@@ -11,6 +11,7 @@ import com.yahoo.config.provision.HostName;
 import com.yahoo.config.provision.NodeResources;
 import com.yahoo.config.provision.NodeType;
 import com.yahoo.config.provision.WireguardKey;
+import com.yahoo.config.provision.WireguardKeyWithTimestamp;
 import com.yahoo.config.provision.host.FlavorOverrides;
 import com.yahoo.vespa.hosted.node.admin.configserver.ConfigServerApi;
 import com.yahoo.vespa.hosted.node.admin.configserver.HttpException;
@@ -139,26 +140,28 @@ public class RealNodeRepository implements NodeRepository {
 
         return response.nodes.stream()
                 .mapMulti((NodeRepositoryNode node, Consumer<WireguardPeer> consumer) -> {
-                    if (node.wireguardPubkey == null || node.wireguardPubkey.isEmpty()) return;
-                    List<VersionedIpAddress> ipAddresses = node.ipAddresses.stream()
-                            .map(InetAddresses::forString)
-                            .filter(address -> !address.isLoopbackAddress() && !address.isLinkLocalAddress() && !address.isSiteLocalAddress())
-                            .map(VersionedIpAddress::from)
-                            .toList();
-                    if (ipAddresses.isEmpty()) return;
+                    var keyWithTimestamp = createWireguardKeyWithTimestamp(node.wireguardKeyWithTimestamp,
+                                                                           node.wireguardPubkey,
+                                                                           node.wireguardKeyTimestamp);
+                    if (keyWithTimestamp == null) return;
 
-                    // Unbox to prevent NPE
-                    long keyTimestamp = node.wireguardKeyTimestamp == null ? 0L : node.wireguardKeyTimestamp;
+                    List<VersionedIpAddress> ipAddresses = getIpAddresses(node);
+                    if (ipAddresses.isEmpty()) return;
 
-                    consumer.accept(new WireguardPeer(HostName.of(node.hostname),
-                                                      ipAddresses,
-                                                      WireguardKey.from(node.wireguardPubkey),
-                                                      Instant.ofEpochMilli(keyTimestamp)));
+                    consumer.accept(new WireguardPeer(HostName.of(node.hostname), ipAddresses, keyWithTimestamp));
                 })
                 .sorted()
                 .toList();
     }
 
+    private static List<VersionedIpAddress> getIpAddresses(NodeRepositoryNode node) {
+        return node.ipAddresses.stream()
+                .map(InetAddresses::forString)
+                .filter(address -> !address.isLoopbackAddress() && !address.isLinkLocalAddress() && !address.isSiteLocalAddress())
+                .map(VersionedIpAddress::from)
+                .toList();
+    }
+
     @Override
     public List<WireguardPeer> getConfigserverPeers() {
         GetWireguardResponse response = configServerApi.get("/nodes/v2/wireguard", GetWireguardResponse.class);
@@ -246,8 +249,9 @@ public class RealNodeRepository implements NodeRepository {
                 Optional.ofNullable(node.archiveUri).map(URI::create),
                 Optional.ofNullable(node.exclusiveTo).map(ApplicationId::fromSerializedForm),
                 trustStore,
-                Optional.ofNullable(node.wireguardPubkey).map(WireguardKey::from),
-                Optional.ofNullable(node.wireguardKeyTimestamp).map(Instant::ofEpochMilli),
+                Optional.ofNullable(createWireguardKeyWithTimestamp(node.wireguardKeyWithTimestamp,
+                                                                    node.wireguardPubkey,
+                                                                    node.wireguardKeyTimestamp)),
                 node.wantToRebuild);
     }
 
@@ -364,20 +368,39 @@ public class RealNodeRepository implements NodeRepository {
         node.trustStore = nodeAttributes.getTrustStore().stream()
                 .map(item -> new NodeRepositoryNode.TrustStoreItem(item.fingerprint(), item.expiry().toEpochMilli()))
                 .toList();
-        node.wireguardPubkey = nodeAttributes.getWireguardPubkey().map(WireguardKey::value).orElse(null);
+        // This is used for patching, and timestamp must only be set on the server side, hence sending EPOCH.
+        node.wireguardKeyWithTimestamp = nodeAttributes.getWireguardPubkey()
+                .map(key -> new NodeRepositoryNode.WireguardKeyWithTimestamp(key.value(), 0L))
+                .orElse(null);
         Map<String, JsonNode> reports = nodeAttributes.getReports();
         node.reports = reports == null || reports.isEmpty() ? null : new TreeMap<>(reports);
 
+        // TODO wg: remove when all nodes are using new key+timestamp format
+        node.wireguardPubkey = nodeAttributes.getWireguardPubkey().map(WireguardKey::value).orElse(null);
         return node;
     }
 
     private static WireguardPeer createConfigserverPeer(GetWireguardResponse.Configserver configServer) {
-        // Unbox to prevent NPE
-        long keyTimestamp = configServer.wireguardKeyTimestamp == null ? 0L : configServer.wireguardKeyTimestamp;
-
         return new WireguardPeer(HostName.of(configServer.hostname),
                                  configServer.ipAddresses.stream().map(VersionedIpAddress::from).toList(),
-                                 WireguardKey.from(configServer.wireguardPubkey),
-                                 Instant.ofEpochMilli(keyTimestamp));
+                                 createWireguardKeyWithTimestamp(configServer.wireguardKeyWithTimestamp,
+                                                                 configServer.wireguardPubkey,
+                                                                 configServer.wireguardKeyTimestamp));
+    }
+
+    private static WireguardKeyWithTimestamp createWireguardKeyWithTimestamp(NodeRepositoryNode.WireguardKeyWithTimestamp wirguardJson,
+                                                                             String oldKeyJson, Long oldTimestampJson) {
+        if (wirguardJson != null && wirguardJson.key != null && ! wirguardJson.key.isEmpty()) {
+            return new WireguardKeyWithTimestamp(WireguardKey.from(wirguardJson.key),
+                                                 Instant.ofEpochMilli(wirguardJson.timestamp));
+            // TODO wg: remove when all nodes are using new key+timestamp format
+        } else if (oldKeyJson != null) {
+            var timestamp = oldTimestampJson != null ? oldTimestampJson : 0L;
+            return new WireguardKeyWithTimestamp(WireguardKey.from(oldKeyJson),
+                                                 Instant.ofEpochMilli(timestamp));
+            // TODO END
+        } else return null;
+
     }
+
 }
diff --git a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/configserver/noderepository/bindings/GetWireguardResponse.java b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/configserver/noderepository/bindings/GetWireguardResponse.java
index dcbf4cc163f..47903795ef7 100644
--- a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/configserver/noderepository/bindings/GetWireguardResponse.java
+++ b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/configserver/noderepository/bindings/GetWireguardResponse.java
@@ -27,27 +27,23 @@ public class GetWireguardResponse {
     public static class Configserver {
 
         @JsonProperty("hostname")
-        public final String hostname;
+        public String hostname;
 
         @JsonProperty("ipAddresses")
-        public final List<String> ipAddresses;
+        public List<String> ipAddresses;
+
+        @JsonProperty("wireguard")
+        public NodeRepositoryNode.WireguardKeyWithTimestamp wireguardKeyWithTimestamp;
 
-        @JsonProperty("wireguardPubkey")
-        public final String wireguardPubkey;
 
+        // TODO wg: remove when all nodes use new key+timestamp format
+        @JsonProperty("wireguardPubkey")
+        @JsonInclude(JsonInclude.Include.NON_EMPTY)
+        public String wireguardPubkey;
         @JsonProperty("wireguardKeyTimestamp")
-        public final Long wireguardKeyTimestamp;
-
-        @JsonCreator
-        public Configserver(@JsonProperty("hostname") String hostname,
-                            @JsonProperty("ipAddresses") List<String> ipAddresses,
-                            @JsonProperty("wireguardPubkey") String wireguardPubkey,
-                            @JsonProperty("wireguardKeyTimestamp") Long wireguardKeyTimestamp) {
-            this.hostname = hostname;
-            this.ipAddresses = ipAddresses;
-            this.wireguardPubkey = wireguardPubkey;
-            this.wireguardKeyTimestamp = wireguardKeyTimestamp;
-        }
+        @JsonInclude(JsonInclude.Include.NON_EMPTY)
+        public Long wireguardKeyTimestamp;
+
     }
 
 }
diff --git a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/configserver/noderepository/bindings/NodeRepositoryNode.java b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/configserver/noderepository/bindings/NodeRepositoryNode.java
index 3d0d052a877..35ca757ebbe 100644
--- a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/configserver/noderepository/bindings/NodeRepositoryNode.java
+++ b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/configserver/noderepository/bindings/NodeRepositoryNode.java
@@ -92,6 +92,10 @@ public class NodeRepositoryNode {
     @JsonProperty("trustStore")
     @JsonInclude(JsonInclude.Include.NON_EMPTY)
     public List<TrustStoreItem> trustStore;
+    @JsonProperty("wireguard")
+    public WireguardKeyWithTimestamp wireguardKeyWithTimestamp;
+
+    // TODO wg: remove separate key and timestamp when all nodes use new keyWithTimestamp
     @JsonProperty("wireguardPubkey")
     @JsonInclude(JsonInclude.Include.NON_EMPTY)
     public String wireguardPubkey;
@@ -141,13 +145,25 @@ public class NodeRepositoryNode {
                ", exclusiveTo='" + exclusiveTo + '\'' +
                ", history=" + history +
                ", trustStore=" + trustStore +
-               ", wireguardPubkey=" + wireguardPubkey +
-               ", wireguardKeyTimestamp=" + wireguardKeyTimestamp +
+               ", wireguard=" + wireguardKeyTimestamp +
                ", reports=" + reports +
                '}';
     }
 
     @JsonIgnoreProperties(ignoreUnknown = true)
+    public static class WireguardKeyWithTimestamp {
+        @JsonProperty("key")
+        public String key;
+        @JsonProperty("timestamp")
+        public long timestamp;
+
+        public WireguardKeyWithTimestamp(@JsonProperty("key") String key, @JsonProperty("timestamp") long timestamp) {
+            this.key = key;
+            this.timestamp = timestamp;
+        }
+    }
+
+    @JsonIgnoreProperties(ignoreUnknown = true)
     public static class Owner {
         @JsonProperty("tenant")
         public String tenant;
diff --git a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/wireguard/WireguardPeer.java b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/wireguard/WireguardPeer.java
index b5428f57f08..e5ab9a1ce31 100644
--- a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/wireguard/WireguardPeer.java
+++ b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/wireguard/WireguardPeer.java
@@ -1,10 +1,9 @@
 package com.yahoo.vespa.hosted.node.admin.wireguard;
 
 import com.yahoo.config.provision.HostName;
-import com.yahoo.config.provision.WireguardKey;
+import com.yahoo.config.provision.WireguardKeyWithTimestamp;
 import com.yahoo.vespa.hosted.node.admin.task.util.network.VersionedIpAddress;
 
-import java.time.Instant;
 import java.util.List;
 
 /**
@@ -15,8 +14,7 @@ import java.util.List;
  */
 public record WireguardPeer(HostName hostname,
                             List<VersionedIpAddress> ipAddresses,
-                            WireguardKey publicKey,
-                            Instant wireguardKeyTimestamp) implements Comparable<WireguardPeer> {
+                            WireguardKeyWithTimestamp keyWithTimestamp) implements Comparable<WireguardPeer> {
 
     public WireguardPeer {
         if (ipAddresses.isEmpty()) throw new IllegalArgumentException("No IP addresses for peer node " + hostname.value());