Encapsulate wiregaurd key + timestamp in new class

- Use 'wireguard' object with key and timestamp for Rest api.
- Keep zk node format unchanged.

3 files changed, 34 insertions, 14 deletions

diff --git a/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/restapi/NodePatcher.java b/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/restapi/NodePatcher.java
index 9f1ab3dc3d5..cad034e01aa 100644
--- a/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/restapi/NodePatcher.java
+++ b/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/restapi/NodePatcher.java
@@ -11,6 +11,7 @@ import com.yahoo.config.provision.NodeFlavors;
 import com.yahoo.config.provision.NodeResources;
 import com.yahoo.config.provision.TenantName;
 import com.yahoo.config.provision.WireguardKey;
+import com.yahoo.config.provision.WireguardKeyWithTimestamp;
 import com.yahoo.slime.Cursor;
 import com.yahoo.slime.Inspector;
 import com.yahoo.slime.ObjectTraverser;
@@ -108,7 +109,8 @@ public class NodePatcher {
                                               "reports",
                                               "trustStore",
                                               "vespaVersion",
-                                              "wireguardPubkey"));
+                                              "wireguardPubkey", // TODO wg: remove when all nodes use new key+timestamp format
+                                              "wireguard"));
             if (!disallowedFields.isEmpty()) {
                 throw new IllegalArgumentException("Patching fields not supported: " + disallowedFields);
             }
@@ -271,9 +273,13 @@ public class NodePatcher {
                 return value.type() == Type.NIX ? node.withoutSwitchHostname() : node.withSwitchHostname(value.asString());
             case "trustStore":
                 return nodeWithTrustStore(node, value);
-            case "wireguardPubkey":
-                return node.withWireguardPubkey(SlimeUtils.optionalString(value).map(WireguardKey::new).orElse(null))
-                        .withWireguardKeyTimestamp(clock.instant());
+            case "wireguard":
+                // This is where we set the key timestamp.
+                var key = SlimeUtils.optionalString(value.field("key")).map(WireguardKey::new).orElse(null);
+                return node.withWireguardPubkey(new WireguardKeyWithTimestamp(key, clock.instant()));
+            case "wireguardPubkey":  // TODO wg: remove when all nodes use new key+timestamp format
+                var oldKey = SlimeUtils.optionalString(value).map(WireguardKey::new).orElse(null);
+                return node.withWireguardPubkey(new WireguardKeyWithTimestamp(oldKey, clock.instant()));
             default:
                 throw new IllegalArgumentException("Could not apply field '" + name + "' on a node: No such modifiable field");
         }
diff --git a/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/restapi/NodesResponse.java b/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/restapi/NodesResponse.java
index a8f526544d7..05bb0a27d69 100644
--- a/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/restapi/NodesResponse.java
+++ b/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/restapi/NodesResponse.java
@@ -8,6 +8,7 @@ import com.yahoo.config.provision.ClusterMembership;
 import com.yahoo.config.provision.DockerImage;
 import com.yahoo.config.provision.HostName;
 import com.yahoo.config.provision.NodeResources;
+import com.yahoo.config.provision.WireguardKeyWithTimestamp;
 import com.yahoo.config.provision.serialization.NetworkPortsSerializer;
 import com.yahoo.container.jdisc.HttpRequest;
 import com.yahoo.restapi.SlimeJsonResponse;
@@ -192,8 +193,13 @@ class NodesResponse extends SlimeJsonResponse {
         if (!node.cloudAccount().isUnspecified()) {
             object.setString("cloudAccount", node.cloudAccount().value());
         }
-        node.wireguardPubKey().ifPresent(key -> object.setString("wireguardPubkey", key.value()));
-        node.wireguardKeyTimestamp().ifPresent(timestamp -> object.setLong("wireguardKeyTimestamp", timestamp.toEpochMilli()));
+        node.wireguardPubKey().ifPresent(key -> toSlime(key, object.setObject("wireguard")));
+
+        // TODO wg: remove when all nodes have upgraded to new key+timestamp format
+        node.wireguardPubKey().ifPresent(key -> {
+            object.setString("wireguardPubkey", key.key().value());
+            object.setLong("wireguardKeyTimestamp", key.timestamp().toEpochMilli());
+        });
     }
 
     private Version resolveVersionFlag(StringFlag flag, Node node, Allocation allocation) {
@@ -237,6 +243,11 @@ class NodesResponse extends SlimeJsonResponse {
         }
     }
 
+    static void toSlime(WireguardKeyWithTimestamp keyWithTimestamp, Cursor object) {
+        object.setString("key", keyWithTimestamp.key().value());
+        object.setLong("timestamp", keyWithTimestamp.timestamp().toEpochMilli());
+    }
+
     private Optional<DockerImage> currentContainerImage(Node node) {
         if (node.status().containerImage().isPresent()) {
             return node.status().containerImage();
diff --git a/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/restapi/WireguardResponse.java b/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/restapi/WireguardResponse.java
index 16e85dfa48a..e29c4f1b87a 100644
--- a/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/restapi/WireguardResponse.java
+++ b/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/restapi/WireguardResponse.java
@@ -1,7 +1,7 @@
 package com.yahoo.vespa.hosted.provision.restapi;
 
 import com.yahoo.config.provision.NodeType;
-import com.yahoo.config.provision.WireguardKey;
+import com.yahoo.config.provision.WireguardKeyWithTimestamp;
 import com.yahoo.restapi.SlimeJsonResponse;
 import com.yahoo.slime.Cursor;
 import com.yahoo.vespa.hosted.provision.Node;
@@ -10,9 +10,9 @@ import com.yahoo.vespa.hosted.provision.NodeRepository;
 import com.yahoo.vespa.hosted.provision.node.IP;
 
 import java.net.InetAddress;
-import java.time.Instant;
 import java.util.List;
-import java.util.Optional;
+
+import static com.yahoo.vespa.hosted.provision.restapi.NodesResponse.toSlime;
 
 /**
  * A response containing the wireguard peer config for each configserver that has a public key.
@@ -36,17 +36,20 @@ public class WireguardResponse extends SlimeJsonResponse {
                     .toList();
             if (ipAddresses.isEmpty()) continue;
 
-            addConfigserver(cfgArray.addObject(), cfg.hostname(), cfg.wireguardPubKey().get(),
-                            cfg.wireguardKeyTimestamp(), ipAddresses);
+            addConfigserver(cfgArray.addObject(), cfg.hostname(), cfg.wireguardPubKey().get(), ipAddresses);
         }
     }
 
-    private void addConfigserver(Cursor cfgEntry, String hostname, WireguardKey key, Optional<Instant> keyTimestamp,
+    private void addConfigserver(Cursor cfgEntry, String hostname, WireguardKeyWithTimestamp keyWithTimestamp,
                                  List<String> ipAddresses) {
         cfgEntry.setString("hostname", hostname);
-        cfgEntry.setString("wireguardPubkey", key.value());
-        cfgEntry.setLong("wireguardKeyTimestamp", keyTimestamp.orElse(Instant.EPOCH).toEpochMilli());
+
+        // TODO wg: remove when all nodes are using new key+timestamp format
+        cfgEntry.setString("wireguardPubkey", keyWithTimestamp.key().value());
+        cfgEntry.setLong("wireguardKeyTimestamp", keyWithTimestamp.timestamp().toEpochMilli());
+
         NodesResponse.ipAddressesToSlime(ipAddresses, cfgEntry.setArray("ipAddresses"));
+        toSlime(keyWithTimestamp, cfgEntry.setObject("wireguard"));
     }
 
     private static boolean isPublicIp(String ipAddress) {