Delay getting regitry credentials until they are needed

4 files changed, 9 insertions, 11 deletions

diff --git a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/container/ContainerOperations.java b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/container/ContainerOperations.java
index 264035b86a1..1ee7bfebc21 100644
--- a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/container/ContainerOperations.java
+++ b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/container/ContainerOperations.java
@@ -62,8 +62,8 @@ public class ContainerOperations {
     }
 
     /** Pull image asynchronously. Returns true if image is still downloading and false if download is complete */
-    public boolean pullImageAsyncIfNeeded(TaskContext context, DockerImage dockerImage, RegistryCredentials registryCredentials) {
-        return !imageDownloader.get(context, dockerImage, registryCredentials);
+    public boolean pullImageAsyncIfNeeded(TaskContext context, DockerImage dockerImage, RegistryCredentialsProvider credentialsProvider) {
+        return !imageDownloader.get(context, dockerImage, credentialsProvider);
     }
 
     /** Executes a command inside container identified by given context. Does NOT throw on non-zero exit code */
diff --git a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/container/image/ContainerImageDownloader.java b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/container/image/ContainerImageDownloader.java
index 1e37e080528..c37cdbe80c0 100644
--- a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/container/image/ContainerImageDownloader.java
+++ b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/container/image/ContainerImageDownloader.java
@@ -5,7 +5,7 @@ import com.yahoo.concurrent.DaemonThreadFactory;
 import com.yahoo.config.provision.DockerImage;
 import com.yahoo.vespa.hosted.node.admin.component.TaskContext;
 import com.yahoo.vespa.hosted.node.admin.container.ContainerEngine;
-import com.yahoo.vespa.hosted.node.admin.container.RegistryCredentials;
+import com.yahoo.vespa.hosted.node.admin.container.RegistryCredentialsProvider;
 
 import java.util.Collections;
 import java.util.HashSet;
@@ -40,12 +40,12 @@ public class ContainerImageDownloader {
      *
      * @return true if the image download has completed.
      */
-    public boolean get(TaskContext context, DockerImage image, RegistryCredentials registryCredentials) {
+    public boolean get(TaskContext context, DockerImage image, RegistryCredentialsProvider credentialsProvider) {
         if (pendingDownloads.contains(image)) return false;
         if (containerEngine.hasImage(context, image)) return true;
         executorService.submit(() -> {
             try {
-                containerEngine.pullImage(context, image, registryCredentials);
+                containerEngine.pullImage(context, image, credentialsProvider.get());
             } catch (RuntimeException e) {
                 LOG.log(Level.SEVERE, "Failed to download container image " + image, e);
             } finally {
diff --git a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/nodeagent/NodeAgentImpl.java b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/nodeagent/NodeAgentImpl.java
index 4c17bfbe039..aad67d19f3f 100644
--- a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/nodeagent/NodeAgentImpl.java
+++ b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/nodeagent/NodeAgentImpl.java
@@ -21,7 +21,6 @@ import com.yahoo.vespa.hosted.node.admin.configserver.orchestrator.OrchestratorE
 import com.yahoo.vespa.hosted.node.admin.container.Container;
 import com.yahoo.vespa.hosted.node.admin.container.ContainerOperations;
 import com.yahoo.vespa.hosted.node.admin.container.ContainerResources;
-import com.yahoo.vespa.hosted.node.admin.container.RegistryCredentials;
 import com.yahoo.vespa.hosted.node.admin.container.RegistryCredentialsProvider;
 import com.yahoo.vespa.hosted.node.admin.maintenance.ContainerWireguardTask;
 import com.yahoo.vespa.hosted.node.admin.maintenance.StorageMaintainer;
@@ -431,9 +430,8 @@ public class NodeAgentImpl implements NodeAgent {
         NodeSpec node = context.node();
         if (node.wantedDockerImage().equals(container.map(c -> c.image()))) return false;
 
-        RegistryCredentials credentials = registryCredentialsProvider.get();
         return node.wantedDockerImage()
-                   .map(image -> containerOperations.pullImageAsyncIfNeeded(context, image, credentials))
+                   .map(image -> containerOperations.pullImageAsyncIfNeeded(context, image, registryCredentialsProvider))
                    .orElse(false);
     }
 
diff --git a/node-admin/src/test/java/com/yahoo/vespa/hosted/node/admin/container/image/ContainerImageDownloaderTest.java b/node-admin/src/test/java/com/yahoo/vespa/hosted/node/admin/container/image/ContainerImageDownloaderTest.java
index 9fd14e7e665..a25bab02121 100644
--- a/node-admin/src/test/java/com/yahoo/vespa/hosted/node/admin/container/image/ContainerImageDownloaderTest.java
+++ b/node-admin/src/test/java/com/yahoo/vespa/hosted/node/admin/container/image/ContainerImageDownloaderTest.java
@@ -25,11 +25,11 @@ public class ContainerImageDownloaderTest {
         TaskContext context = new TestTaskContext();
         DockerImage image = DockerImage.fromString("registry.example.com/repo/vespa:7.42");
 
-        assertFalse(downloader.get(context, image, RegistryCredentials.none), "Download started");
-        assertFalse(downloader.get(context, image, RegistryCredentials.none), "Download pending");
+        assertFalse(downloader.get(context, image, () -> RegistryCredentials.none), "Download started");
+        assertFalse(downloader.get(context, image, () -> RegistryCredentials.none), "Download pending");
         podman.completeDownloadOf(image);
         boolean downloadCompleted;
-        while (!(downloadCompleted = downloader.get(context, image, RegistryCredentials.none))) ;
+        while (!(downloadCompleted = downloader.get(context, image, () -> RegistryCredentials.none))) ;
         assertTrue(downloadCompleted, "Download completed");
     }