Merge pull request #25625 from vespa-engine/jonmv/private-endpoints

Reapply private endpoint changes [run-systemtest]

13 files changed, 113 insertions, 68 deletions

diff --git a/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/lb/LoadBalancerInstance.java b/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/lb/LoadBalancerInstance.java
index 33c9edf694d..2856a38075b 100644
--- a/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/lb/LoadBalancerInstance.java
+++ b/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/lb/LoadBalancerInstance.java
@@ -4,7 +4,7 @@ package com.yahoo.vespa.hosted.provision.lb;
 import ai.vespa.http.DomainName;
 import com.google.common.collect.ImmutableSortedSet;
 import com.yahoo.config.provision.CloudAccount;
-import com.yahoo.config.provision.LoadBalancerSettings;
+import com.yahoo.config.provision.ZoneEndpoint;
 
 import java.util.Objects;
 import java.util.Optional;
@@ -24,12 +24,12 @@ public class LoadBalancerInstance {
     private final Set<Integer> ports;
     private final Set<String> networks;
     private final Set<Real> reals;
-    private final LoadBalancerSettings settings;
+    private final ZoneEndpoint settings;
     private final Optional<PrivateServiceId> serviceId;
     private final CloudAccount cloudAccount;
 
     public LoadBalancerInstance(Optional<DomainName> hostname, Optional<String> ipAddress, Optional<DnsZone> dnsZone,
-                                Set<Integer> ports, Set<String> networks, Set<Real> reals, LoadBalancerSettings settings,
+                                Set<Integer> ports, Set<String> networks, Set<Real> reals, ZoneEndpoint settings,
                                 Optional<PrivateServiceId> serviceId, CloudAccount cloudAccount) {
         this.hostname = Objects.requireNonNull(hostname, "hostname must be non-null");
         this.ipAddress = Objects.requireNonNull(ipAddress, "ip must be non-null");
@@ -78,7 +78,7 @@ public class LoadBalancerInstance {
     }
 
     /** Static user-configured settings of this load balancer */
-    public LoadBalancerSettings settings() {
+    public ZoneEndpoint settings() {
         return settings;
     }
 
diff --git a/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/lb/LoadBalancerServiceMock.java b/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/lb/LoadBalancerServiceMock.java
index e0dd41f9008..c19aebcda6e 100644
--- a/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/lb/LoadBalancerServiceMock.java
+++ b/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/lb/LoadBalancerServiceMock.java
@@ -4,8 +4,8 @@ package com.yahoo.vespa.hosted.provision.lb;
 import ai.vespa.http.DomainName;
 import com.google.common.collect.ImmutableSet;
 import com.yahoo.config.provision.ClusterSpec;
-import com.yahoo.config.provision.LoadBalancerSettings;
 import com.yahoo.config.provision.NodeType;
+import com.yahoo.config.provision.ZoneEndpoint;
 
 import java.util.Collections;
 import java.util.HashMap;
@@ -62,7 +62,7 @@ public class LoadBalancerServiceMock implements LoadBalancerService {
                 Collections.singleton(4443),
                 ImmutableSet.of("10.2.3.0/24", "10.4.5.0/24"),
                 spec.reals(),
-                spec.settings().orElse(LoadBalancerSettings.empty),
+                spec.settings().orElse(ZoneEndpoint.defaultEndpoint),
                 spec.settings().map(__ -> PrivateServiceId.of("service")),
                 spec.cloudAccount());
         instances.put(id, instance);
diff --git a/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/lb/LoadBalancerSpec.java b/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/lb/LoadBalancerSpec.java
index dca6d434330..e0ef6739542 100644
--- a/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/lb/LoadBalancerSpec.java
+++ b/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/lb/LoadBalancerSpec.java
@@ -5,7 +5,7 @@ import com.google.common.collect.ImmutableSortedSet;
 import com.yahoo.config.provision.ApplicationId;
 import com.yahoo.config.provision.CloudAccount;
 import com.yahoo.config.provision.ClusterSpec;
-import com.yahoo.config.provision.LoadBalancerSettings;
+import com.yahoo.config.provision.ZoneEndpoint;
 
 import java.util.Objects;
 import java.util.Optional;
@@ -21,11 +21,11 @@ public class LoadBalancerSpec {
     private final ApplicationId application;
     private final ClusterSpec.Id cluster;
     private final Set<Real> reals;
-    private final Optional<LoadBalancerSettings> settings;
+    private final Optional<ZoneEndpoint> settings;
     private final CloudAccount cloudAccount;
 
     public LoadBalancerSpec(ApplicationId application, ClusterSpec.Id cluster, Set<Real> reals,
-                            LoadBalancerSettings settings, CloudAccount cloudAccount) {
+                            ZoneEndpoint settings, CloudAccount cloudAccount) {
         this.application = Objects.requireNonNull(application);
         this.cluster = Objects.requireNonNull(cluster);
         this.reals = ImmutableSortedSet.copyOf(Objects.requireNonNull(reals));
@@ -49,7 +49,7 @@ public class LoadBalancerSpec {
     }
 
     /** Static user-configured settings for this load balancer. */
-    public Optional<LoadBalancerSettings> settings() {
+    public Optional<ZoneEndpoint> settings() {
         return settings;
     }
 
diff --git a/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/lb/SharedLoadBalancerService.java b/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/lb/SharedLoadBalancerService.java
index c8fb1226b81..5dc099460a4 100644
--- a/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/lb/SharedLoadBalancerService.java
+++ b/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/lb/SharedLoadBalancerService.java
@@ -3,8 +3,8 @@ package com.yahoo.vespa.hosted.provision.lb;
 
 import ai.vespa.http.DomainName;
 import com.yahoo.config.provision.ClusterSpec;
-import com.yahoo.config.provision.LoadBalancerSettings;
 import com.yahoo.config.provision.NodeType;
+import com.yahoo.config.provision.ZoneEndpoint;
 
 import java.util.Objects;
 import java.util.Optional;
@@ -29,15 +29,15 @@ public class SharedLoadBalancerService implements LoadBalancerService {
 
     @Override
     public LoadBalancerInstance create(LoadBalancerSpec spec, boolean force) {
-        if (spec.settings().isPresent() && ! spec.settings().get().isEmpty())
-            throw new IllegalArgumentException("custom load balancer settings are not supported with " + getClass());
+        if (spec.settings().isPresent() && ! spec.settings().get().isDefault())
+            throw new IllegalArgumentException("custom zone endpoint settings are not supported with " + getClass());
         return new LoadBalancerInstance(Optional.of(DomainName.of(vipHostname)),
                                         Optional.empty(),
                                         Optional.empty(),
                                         Set.of(4443),
                                         Set.of(),
                                         spec.reals(),
-                                        spec.settings().orElse(LoadBalancerSettings.empty),
+                                        spec.settings().orElse(ZoneEndpoint.defaultEndpoint),
                                         Optional.empty(),
                                         spec.cloudAccount());
     }
diff --git a/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/persistence/LoadBalancerSerializer.java b/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/persistence/LoadBalancerSerializer.java
index 3d352f5596b..6bac1dab3dd 100644
--- a/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/persistence/LoadBalancerSerializer.java
+++ b/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/persistence/LoadBalancerSerializer.java
@@ -3,7 +3,9 @@ package com.yahoo.vespa.hosted.provision.persistence;
 
 import ai.vespa.http.DomainName;
 import com.yahoo.config.provision.CloudAccount;
-import com.yahoo.config.provision.LoadBalancerSettings;
+import com.yahoo.config.provision.ZoneEndpoint;
+import com.yahoo.config.provision.ZoneEndpoint.AllowedUrn;
+import com.yahoo.config.provision.ZoneEndpoint.AccessType;
 import com.yahoo.slime.ArrayTraverser;
 import com.yahoo.slime.Cursor;
 import com.yahoo.slime.Inspector;
@@ -52,7 +54,11 @@ public class LoadBalancerSerializer {
     private static final String serviceIdField = "serviceId";
     private static final String cloudAccountField = "cloudAccount";
     private static final String settingsField = "settings";
+    private static final String publicField = "public";
+    private static final String privateField = "private";
     private static final String allowedUrnsField = "allowedUrns";
+    private static final String accessTypeField = "type";
+    private static final String urnField = "urn";
 
     public static byte[] toJson(LoadBalancer loadBalancer) {
         Slime slime = new Slime();
@@ -77,15 +83,13 @@ public class LoadBalancerSerializer {
         }));
         loadBalancer.instance()
                     .map(LoadBalancerInstance::settings)
-                    .filter(settings -> ! settings.isEmpty())
-                    .ifPresent(settings -> settings.allowedUrns().forEach(root.setObject(settingsField)
-                                                                              .setArray(allowedUrnsField)::addString));
+                    .ifPresent(settings -> toSlime(root.setObject(settingsField), settings));
         loadBalancer.instance()
                     .flatMap(LoadBalancerInstance::serviceId)
                     .ifPresent(serviceId -> root.setString(serviceIdField, serviceId.value()));
         loadBalancer.instance()
                     .map(LoadBalancerInstance::cloudAccount)
-                    .filter(cloudAccount -> !cloudAccount.isUnspecified())
+                    .filter(cloudAccount -> ! cloudAccount.isUnspecified())
                     .ifPresent(cloudAccount -> root.setString(cloudAccountField, cloudAccount.value()));
         try {
             return SlimeUtils.toJsonBytes(slime);
@@ -114,7 +118,7 @@ public class LoadBalancerSerializer {
         Optional<DomainName> hostname = optionalString(object.field(hostnameField), Function.identity()).filter(s -> !s.isEmpty()).map(DomainName::of);
         Optional<String> ipAddress = optionalString(object.field(lbIpAddressField), Function.identity()).filter(s -> !s.isEmpty());
         Optional<DnsZone> dnsZone = optionalString(object.field(dnsZoneField), DnsZone::new);
-        LoadBalancerSettings settings = loadBalancerSettings(object.field(settingsField));
+        ZoneEndpoint settings = zoneEndpoint(object.field(settingsField));
         Optional<PrivateServiceId> serviceId = optionalString(object.field(serviceIdField), PrivateServiceId::of);
         CloudAccount cloudAccount = optionalString(object.field(cloudAccountField), CloudAccount::from).orElse(CloudAccount.empty);
         Optional<LoadBalancerInstance> instance = hostname.isEmpty() && ipAddress.isEmpty() ? Optional.empty() :
@@ -126,11 +130,35 @@ public class LoadBalancerSerializer {
                                 Instant.ofEpochMilli(object.field(changedAtField).asLong()));
     }
 
-    private static LoadBalancerSettings loadBalancerSettings(Inspector settingsObject) {
-        if ( ! settingsObject.valid()) return LoadBalancerSettings.empty;
-        return new LoadBalancerSettings(SlimeUtils.entriesStream(settingsObject.field(allowedUrnsField))
-                                                  .map(Inspector::asString)
-                                                  .toList());
+    private static void toSlime(Cursor settingsObject, ZoneEndpoint settings) {
+        settingsObject.setBool(publicField, settings.isPublicEndpoint());
+        settingsObject.setBool(privateField, settings.isPrivateEndpoint());
+        if (settings.isPrivateEndpoint()) {
+            Cursor allowedUrnsArray = settingsObject.setArray(allowedUrnsField);
+            for (AllowedUrn urn : settings.allowedUrns()) {
+                Cursor urnObject = allowedUrnsArray.addObject();
+                urnObject.setString(urnField, urn.urn());
+                urnObject.setString(accessTypeField,
+                                    switch (urn.type()) {
+                                        case awsPrivateLink -> "awsPrivateLink";
+                                        case gcpServiceConnect -> "gcpServiceConnect";
+                                    });
+            }
+        }
+    }
+
+    private static ZoneEndpoint zoneEndpoint(Inspector settingsObject) {
+        if ( ! settingsObject.valid()) return ZoneEndpoint.defaultEndpoint;
+        return new ZoneEndpoint(settingsObject.field(publicField).asBool(),
+                                settingsObject.field(privateField).asBool(),
+                                SlimeUtils.entriesStream(settingsObject.field(allowedUrnsField))
+                                          .map(urnObject -> new AllowedUrn(switch (urnObject.field(accessTypeField).asString()) {
+                                                                               case "awsPrivateLink" -> AccessType.awsPrivateLink;
+                                                                               case "gcpServiceConnect" -> AccessType.gcpServiceConnect;
+                                                                               default -> throw new IllegalArgumentException("unknown service access type in '" + urnObject + "'");
+                                                                           },
+                                                                           urnObject.field(urnField).asString()))
+                                          .toList());
     }
 
     private static <T> Optional<T> optionalValue(Inspector field, Function<Inspector, T> fieldMapper) {
diff --git a/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/provisioning/LoadBalancerProvisioner.java b/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/provisioning/LoadBalancerProvisioner.java
index 3e8124d5309..92fdb1d2e52 100644
--- a/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/provisioning/LoadBalancerProvisioner.java
+++ b/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/provisioning/LoadBalancerProvisioner.java
@@ -7,9 +7,9 @@ import com.yahoo.config.provision.ApplicationTransaction;
 import com.yahoo.config.provision.CloudAccount;
 import com.yahoo.config.provision.ClusterSpec;
 import com.yahoo.config.provision.HostName;
-import com.yahoo.config.provision.LoadBalancerSettings;
 import com.yahoo.config.provision.NodeType;
 import com.yahoo.config.provision.TenantName;
+import com.yahoo.config.provision.ZoneEndpoint;
 import com.yahoo.config.provision.exception.LoadBalancerServiceException;
 import com.yahoo.transaction.NestedTransaction;
 import com.yahoo.vespa.flags.BooleanFlag;
@@ -108,11 +108,13 @@ public class LoadBalancerProvisioner {
      * Calling this when no load balancer has been prepared for given cluster is a no-op.
      */
     public void activate(Set<ClusterSpec> clusters, NodeList newActive, ApplicationTransaction transaction) {
-        Map<ClusterSpec.Id, LoadBalancerSettings> activatingClusters = clusters.stream()
-                                                                      .collect(groupingBy(LoadBalancerProvisioner::effectiveId,
-                                                                                          reducing(LoadBalancerSettings.empty,
-                                                                                                   ClusterSpec::loadBalancerSettings,
-                                                                                                   (o, n) -> o.isEmpty() ? n : o)));
+        Map<ClusterSpec.Id, ZoneEndpoint> activatingClusters = clusters.stream()
+                                                                       // .collect(Collectors.toMap(ClusterSpec::id, ClusterSpec::zoneEndpoint));
+                                                                       // TODO: this dies with combined clusters Ü
+                                                                       .collect(groupingBy(LoadBalancerProvisioner::effectiveId,
+                                                                                          reducing(ZoneEndpoint.defaultEndpoint,
+                                                                                                   ClusterSpec::zoneEndpoint,
+                                                                                                   (o, n) -> o.isDefault() ? n : o)));
         for (var cluster : loadBalancedClustersOf(newActive).entrySet()) {
             if ( ! activatingClusters.containsKey(cluster.getKey()))
                 continue;
@@ -209,7 +211,7 @@ public class LoadBalancerProvisioner {
         requireInstance(id, instance, cloudAccount);
     }
 
-    private void activate(ApplicationTransaction transaction, ClusterSpec.Id cluster, LoadBalancerSettings settings, NodeList nodes) {
+    private void activate(ApplicationTransaction transaction, ClusterSpec.Id cluster, ZoneEndpoint settings, NodeList nodes) {
         Instant now = nodeRepository.clock().instant();
         LoadBalancerId id = new LoadBalancerId(transaction.application(), cluster);
         Optional<LoadBalancer> loadBalancer = db.readLoadBalancer(id);
@@ -226,7 +228,7 @@ public class LoadBalancerProvisioner {
     /** Provision or reconfigure a load balancer instance, if necessary */
     private Optional<LoadBalancerInstance> provisionInstance(LoadBalancerId id, NodeList nodes,
                                                              Optional<LoadBalancer> currentLoadBalancer,
-                                                             LoadBalancerSettings loadBalancerSettings,
+                                                             ZoneEndpoint zoneEndpoint,
                                                              CloudAccount cloudAccount) {
         boolean shouldDeactivateRouting = deactivateRouting.with(FetchVector.Dimension.APPLICATION_ID,
                                                                  id.application().serializedForm())
@@ -237,13 +239,13 @@ public class LoadBalancerProvisioner {
         } else {
             reals = realsOf(nodes);
         }
-        if (isUpToDate(currentLoadBalancer, reals, loadBalancerSettings))
+        if (isUpToDate(currentLoadBalancer, reals, zoneEndpoint))
             return currentLoadBalancer.get().instance();
         log.log(Level.INFO, () -> "Provisioning instance for " + id + ", targeting: " + reals);
         try {
             // Override settings at activation, otherwise keep existing ones.
-            LoadBalancerSettings settings = loadBalancerSettings != null ? loadBalancerSettings
-                                                                         : currentLoadBalancer.flatMap(LoadBalancer::instance)
+            ZoneEndpoint settings = zoneEndpoint != null ? zoneEndpoint
+                                                         : currentLoadBalancer.flatMap(LoadBalancer::instance)
                                                                                               .map(LoadBalancerInstance::settings)
                                                                                               .orElse(null);
             LoadBalancerInstance created = service.create(new LoadBalancerSpec(id.application(), id.cluster(), reals, settings, cloudAccount),
@@ -306,11 +308,11 @@ public class LoadBalancerProvisioner {
     }
 
     /** Returns whether load balancer has given reals, and settings if specified*/
-    private static boolean isUpToDate(Optional<LoadBalancer> loadBalancer, Set<Real> reals, LoadBalancerSettings loadBalancerSettings) {
+    private static boolean isUpToDate(Optional<LoadBalancer> loadBalancer, Set<Real> reals, ZoneEndpoint zoneEndpoint) {
         if (loadBalancer.isEmpty()) return false;
         if (loadBalancer.get().instance().isEmpty()) return false;
         return    loadBalancer.get().instance().get().reals().equals(reals)
-               && (loadBalancerSettings == null || loadBalancer.get().instance().get().settings().equals(loadBalancerSettings));
+               && (zoneEndpoint == null || loadBalancer.get().instance().get().settings().equals(zoneEndpoint));
     }
 
     /** Returns whether to allow given load balancer to have no reals */
diff --git a/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/restapi/LoadBalancersResponse.java b/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/restapi/LoadBalancersResponse.java
index fdf69b60690..15a799c06d8 100644
--- a/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/restapi/LoadBalancersResponse.java
+++ b/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/restapi/LoadBalancersResponse.java
@@ -2,6 +2,7 @@
 package com.yahoo.vespa.hosted.provision.restapi;
 
 import com.yahoo.config.provision.ApplicationId;
+import com.yahoo.config.provision.ZoneEndpoint.AllowedUrn;
 import com.yahoo.container.jdisc.HttpRequest;
 import com.yahoo.restapi.SlimeJsonResponse;
 import com.yahoo.slime.Cursor;
@@ -76,8 +77,17 @@ public class LoadBalancersResponse extends SlimeJsonResponse {
                 });
             });
             lb.instance().ifPresent(instance -> {
-                if ( ! instance.settings().isEmpty())
-                    instance.settings().allowedUrns().forEach(lbObject.setObject("settings").setArray("allowedUrns")::addString);
+                if ( ! instance.settings().isDefault()) {
+                    Cursor urnsArray = lbObject.setObject("settings").setArray("allowedUrns");
+                    for (AllowedUrn urn : instance.settings().allowedUrns()) {
+                        Cursor urnObject = urnsArray.addObject();
+                        urnObject.setString("type", switch (urn.type()) {
+                                                        case awsPrivateLink -> "aws-private-link";
+                                                        case gcpServiceConnect -> "gcp-service-connect";
+                                                    });
+                        urnObject.setString("urn", urn.urn());
+                    }
+                }
                 instance.serviceId().ifPresent(serviceId -> lbObject.setString("serviceId", serviceId.value()));
             });
             lb.instance()
diff --git a/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/testutils/MockNodeRepository.java b/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/testutils/MockNodeRepository.java
index 91c8f803429..92ffe9828c3 100644
--- a/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/testutils/MockNodeRepository.java
+++ b/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/testutils/MockNodeRepository.java
@@ -14,12 +14,12 @@ import com.yahoo.config.provision.DockerImage;
 import com.yahoo.config.provision.Flavor;
 import com.yahoo.config.provision.HostSpec;
 import com.yahoo.config.provision.InstanceName;
-import com.yahoo.config.provision.LoadBalancerSettings;
 import com.yahoo.config.provision.NodeFlavors;
 import com.yahoo.config.provision.NodeResources;
 import com.yahoo.config.provision.NodeType;
 import com.yahoo.config.provision.TenantName;
 import com.yahoo.config.provision.Zone;
+import com.yahoo.config.provision.ZoneEndpoint;
 import com.yahoo.transaction.Mutex;
 import com.yahoo.transaction.NestedTransaction;
 import com.yahoo.vespa.curator.mock.MockCurator;
@@ -189,7 +189,7 @@ public class MockNodeRepository extends NodeRepository {
         activate(provisioner.prepare(zoneApp, zoneCluster, Capacity.fromRequiredNodeType(NodeType.host), null), zoneApp, provisioner);
 
         ApplicationId app1Id = ApplicationId.from(TenantName.from("tenant1"), ApplicationName.from("application1"), InstanceName.from("instance1"));
-        ClusterSpec cluster1Id = ClusterSpec.request(ClusterSpec.Type.container, ClusterSpec.Id.from("id1")).vespaVersion("6.42").loadBalancerSettings(new LoadBalancerSettings(List.of("arne"))).build();
+        ClusterSpec cluster1Id = ClusterSpec.request(ClusterSpec.Type.container, ClusterSpec.Id.from("id1")).vespaVersion("6.42").loadBalancerSettings(new ZoneEndpoint(List.of("arne"))).build();
         activate(provisioner.prepare(app1Id,
                                      cluster1Id,
                                      Capacity.from(new ClusterResources(2, 1, new NodeResources(2, 8, 50, 1)),
diff --git a/node-repository/src/test/java/com/yahoo/vespa/hosted/provision/lb/SharedLoadBalancerServiceTest.java b/node-repository/src/test/java/com/yahoo/vespa/hosted/provision/lb/SharedLoadBalancerServiceTest.java
index 92c7ba7fe27..a646d26ea29 100644
--- a/node-repository/src/test/java/com/yahoo/vespa/hosted/provision/lb/SharedLoadBalancerServiceTest.java
+++ b/node-repository/src/test/java/com/yahoo/vespa/hosted/provision/lb/SharedLoadBalancerServiceTest.java
@@ -5,7 +5,7 @@ import com.yahoo.config.provision.ApplicationId;
 import com.yahoo.config.provision.CloudAccount;
 import com.yahoo.config.provision.ClusterSpec;
 import com.yahoo.config.provision.HostName;
-import com.yahoo.config.provision.LoadBalancerSettings;
+import com.yahoo.config.provision.ZoneEndpoint;
 import org.junit.Test;
 
 import java.util.Optional;
@@ -29,7 +29,7 @@ public class SharedLoadBalancerServiceTest {
     @Test
     public void test_create_lb() {
         var lb = loadBalancerService.create(new LoadBalancerSpec(applicationId, clusterId, reals,
-                                                                 LoadBalancerSettings.empty, CloudAccount.empty),
+                                                                 ZoneEndpoint.defaultEndpoint, CloudAccount.empty),
                                             false);
 
         assertEquals(Optional.of(HostName.of("vip.example.com")), lb.hostname());
diff --git a/node-repository/src/test/java/com/yahoo/vespa/hosted/provision/persistence/LoadBalancerSerializerTest.java b/node-repository/src/test/java/com/yahoo/vespa/hosted/provision/persistence/LoadBalancerSerializerTest.java
index d5722a59f3e..dee895b02d2 100644
--- a/node-repository/src/test/java/com/yahoo/vespa/hosted/provision/persistence/LoadBalancerSerializerTest.java
+++ b/node-repository/src/test/java/com/yahoo/vespa/hosted/provision/persistence/LoadBalancerSerializerTest.java
@@ -6,7 +6,7 @@ import com.google.common.collect.ImmutableSet;
 import com.yahoo.config.provision.ApplicationId;
 import com.yahoo.config.provision.CloudAccount;
 import com.yahoo.config.provision.ClusterSpec;
-import com.yahoo.config.provision.LoadBalancerSettings;
+import com.yahoo.config.provision.ZoneEndpoint;
 import com.yahoo.vespa.hosted.provision.lb.DnsZone;
 import com.yahoo.vespa.hosted.provision.lb.LoadBalancer;
 import com.yahoo.vespa.hosted.provision.lb.LoadBalancerId;
@@ -46,7 +46,7 @@ public class LoadBalancerSerializerTest {
                                                                     new Real(DomainName.of("real-2"),
                                                                              "127.0.0.2",
                                                                              4080)),
-                                                    new LoadBalancerSettings(List.of("123")),
+                                                    new ZoneEndpoint(List.of("123")),
                                                     Optional.of(PrivateServiceId.of("foo")),
                                                     CloudAccount.from("012345678912"))),
                                             LoadBalancer.State.active,
diff --git a/node-repository/src/test/java/com/yahoo/vespa/hosted/provision/provisioning/LoadBalancerProvisionerTest.java b/node-repository/src/test/java/com/yahoo/vespa/hosted/provision/provisioning/LoadBalancerProvisionerTest.java
index e32643860f5..3653e20d848 100644
--- a/node-repository/src/test/java/com/yahoo/vespa/hosted/provision/provisioning/LoadBalancerProvisionerTest.java
+++ b/node-repository/src/test/java/com/yahoo/vespa/hosted/provision/provisioning/LoadBalancerProvisionerTest.java
@@ -9,9 +9,9 @@ import com.yahoo.config.provision.CloudAccount;
 import com.yahoo.config.provision.ClusterResources;
 import com.yahoo.config.provision.ClusterSpec;
 import com.yahoo.config.provision.HostSpec;
-import com.yahoo.config.provision.LoadBalancerSettings;
 import com.yahoo.config.provision.NodeResources;
 import com.yahoo.config.provision.NodeType;
+import com.yahoo.config.provision.ZoneEndpoint;
 import com.yahoo.config.provision.exception.LoadBalancerServiceException;
 import com.yahoo.transaction.NestedTransaction;
 import com.yahoo.vespa.flags.InMemoryFlagSource;
@@ -215,7 +215,7 @@ public class LoadBalancerProvisionerTest {
     public void provision_load_balancer_combined_cluster() {
         Supplier<List<LoadBalancer>> lbs = () -> tester.nodeRepository().loadBalancers().list(app1).asList();
         var combinedId = ClusterSpec.Id.from("container1");
-        var nodes = prepare(app1, clusterRequest(ClusterSpec.Type.combined, ClusterSpec.Id.from("content1"), Optional.of(combinedId), LoadBalancerSettings.empty));
+        var nodes = prepare(app1, clusterRequest(ClusterSpec.Type.combined, ClusterSpec.Id.from("content1"), Optional.of(combinedId), ZoneEndpoint.defaultEndpoint));
         assertEquals(1, lbs.get().size());
         assertEquals("Prepare provisions load balancer with reserved nodes", 2, lbs.get().get(0).instance().get().reals().size());
         tester.activate(app1, nodes);
@@ -320,10 +320,10 @@ public class LoadBalancerProvisionerTest {
         tester.activate(app1, prepare(app1, capacity, clusterRequest(ClusterSpec.Type.container, ClusterSpec.Id.from("c1"))));
         LoadBalancerList loadBalancers = tester.nodeRepository().loadBalancers().list();
         assertEquals(1, loadBalancers.size());
-        assertEquals(LoadBalancerSettings.empty, loadBalancers.first().get().instance().get().settings());
+        assertEquals(ZoneEndpoint.defaultEndpoint, loadBalancers.first().get().instance().get().settings());
 
         // Next deployment contains new settings
-        LoadBalancerSettings settings = new LoadBalancerSettings(List.of("alice", "bob"));
+        ZoneEndpoint settings = new ZoneEndpoint(List.of("alice", "bob"));
         tester.activate(app1, prepare(app1, capacity, clusterRequest(ClusterSpec.Type.container, ClusterSpec.Id.from("c1"), Optional.empty(), settings)));
         loadBalancers = tester.nodeRepository().loadBalancers().list();
         assertEquals(1, loadBalancers.size());
@@ -430,10 +430,10 @@ public class LoadBalancerProvisionerTest {
     }
 
     private static ClusterSpec clusterRequest(ClusterSpec.Type type, ClusterSpec.Id id) {
-        return clusterRequest(type, id, Optional.empty(), LoadBalancerSettings.empty);
+        return clusterRequest(type, id, Optional.empty(), ZoneEndpoint.defaultEndpoint);
     }
 
-    private static ClusterSpec clusterRequest(ClusterSpec.Type type, ClusterSpec.Id id, Optional<ClusterSpec.Id> combinedId, LoadBalancerSettings settings) {
+    private static ClusterSpec clusterRequest(ClusterSpec.Type type, ClusterSpec.Id id, Optional<ClusterSpec.Id> combinedId, ZoneEndpoint settings) {
         return ClusterSpec.request(type, id).vespaVersion("6.42").combinedId(combinedId).loadBalancerSettings(settings).build();
     }
 
diff --git a/node-repository/src/test/java/com/yahoo/vespa/hosted/provision/provisioning/VirtualNodeProvisioningTest.java b/node-repository/src/test/java/com/yahoo/vespa/hosted/provision/provisioning/VirtualNodeProvisioningTest.java
index 5143aa91f56..086df4d0c33 100644
--- a/node-repository/src/test/java/com/yahoo/vespa/hosted/provision/provisioning/VirtualNodeProvisioningTest.java
+++ b/node-repository/src/test/java/com/yahoo/vespa/hosted/provision/provisioning/VirtualNodeProvisioningTest.java
@@ -49,8 +49,8 @@ public class VirtualNodeProvisioningTest {
     private static final NodeResources resources1 = new NodeResources(4, 8, 100, 1);
     private static final NodeResources resources2 = new NodeResources(1, 4, 100, 1,
                                                                       NodeResources.DiskSpeed.fast, NodeResources.StorageType.local);
-    private static final ClusterSpec contentClusterSpec = ClusterSpec.request(ClusterSpec.Type.content, ClusterSpec.Id.from("myContent")).vespaVersion("6.42").build();
-    private static final ClusterSpec containerClusterSpec = ClusterSpec.request(ClusterSpec.Type.container, ClusterSpec.Id.from("myContainer")).vespaVersion("6.42").build();
+    private static final ClusterSpec contentClusterSpec = ClusterSpec.request(ClusterSpec.Type.content, ClusterSpec.Id.from("my-content")).vespaVersion("6.42").build();
+    private static final ClusterSpec containerClusterSpec = ClusterSpec.request(ClusterSpec.Type.container, ClusterSpec.Id.from("my-container")).vespaVersion("6.42").build();
 
     private final ApplicationId applicationId = ProvisioningTester.applicationId("test");
 
@@ -242,7 +242,7 @@ public class VirtualNodeProvisioningTest {
         Version wantedVespaVersion = Version.fromString("6.39");
         int nodeCount = 7;
         List<HostSpec> hosts = tester.prepare(application1,
-                                              ClusterSpec.request(ClusterSpec.Type.content, ClusterSpec.Id.from("myContent")).vespaVersion(wantedVespaVersion).build(),
+                                              ClusterSpec.request(ClusterSpec.Type.content, ClusterSpec.Id.from("my-content")).vespaVersion(wantedVespaVersion).build(),
                                               nodeCount, 1, resources2);
         tester.activate(application1, new HashSet<>(hosts));
 
@@ -253,7 +253,7 @@ public class VirtualNodeProvisioningTest {
         // Upgrade Vespa version on nodes
         Version upgradedWantedVespaVersion = Version.fromString("6.40");
         List<HostSpec> upgradedHosts = tester.prepare(application1,
-                                                      ClusterSpec.request(ClusterSpec.Type.content, ClusterSpec.Id.from("myContent")).vespaVersion(upgradedWantedVespaVersion).build(),
+                                                      ClusterSpec.request(ClusterSpec.Type.content, ClusterSpec.Id.from("my-content")).vespaVersion(upgradedWantedVespaVersion).build(),
                                                       nodeCount, 1, resources2);
         tester.activate(application1, new HashSet<>(upgradedHosts));
         NodeList upgradedNodes = tester.getNodes(application1, Node.State.active);
@@ -275,7 +275,7 @@ public class VirtualNodeProvisioningTest {
         int nodeCount = 7;
         try {
             List<HostSpec> nodes = tester.prepare(application1,
-                                                  ClusterSpec.request(ClusterSpec.Type.content, ClusterSpec.Id.from("myContent")).vespaVersion(wantedVespaVersion).build(),
+                                                  ClusterSpec.request(ClusterSpec.Type.content, ClusterSpec.Id.from("my-content")).vespaVersion(wantedVespaVersion).build(),
                                                   nodeCount, 1, resources2);
             fail("Expected the allocation to fail due to parent hosts not being active yet");
         } catch (NodeAllocationException expected) { }
@@ -285,7 +285,7 @@ public class VirtualNodeProvisioningTest {
 
         // Try allocating tenants again
         List<HostSpec> nodes = tester.prepare(application1,
-                                              ClusterSpec.request(ClusterSpec.Type.content, ClusterSpec.Id.from("myContent")).vespaVersion(wantedVespaVersion).build(),
+                                              ClusterSpec.request(ClusterSpec.Type.content, ClusterSpec.Id.from("my-content")).vespaVersion(wantedVespaVersion).build(),
                                               nodeCount, 1, resources2);
         tester.activate(application1, new HashSet<>(nodes));
 
@@ -309,14 +309,14 @@ public class VirtualNodeProvisioningTest {
 
         Version wantedVespaVersion = Version.fromString("6.39");
         List<HostSpec> nodes = tester.prepare(application2_1,
-                                              ClusterSpec.request(ClusterSpec.Type.container, ClusterSpec.Id.from("myContent")).vespaVersion(wantedVespaVersion).build(),
+                                              ClusterSpec.request(ClusterSpec.Type.container, ClusterSpec.Id.from("my-content")).vespaVersion(wantedVespaVersion).build(),
                                               6, 1, resources);
         assertHostSpecParentReservation(nodes, Optional.empty(), tester); // We do not get nodes on hosts reserved to tenant1
         tester.activate(application2_1, nodes);
 
         try {
             tester.prepare(application2_2,
-                           ClusterSpec.request(ClusterSpec.Type.container, ClusterSpec.Id.from("myContent")).vespaVersion(wantedVespaVersion).build(),
+                           ClusterSpec.request(ClusterSpec.Type.container, ClusterSpec.Id.from("my-content")).vespaVersion(wantedVespaVersion).build(),
                            5, 1, resources);
             fail("Expected exception");
         }
@@ -325,7 +325,7 @@ public class VirtualNodeProvisioningTest {
         }
 
         nodes = tester.prepare(application1_1,
-                               ClusterSpec.request(ClusterSpec.Type.container, ClusterSpec.Id.from("myContent")).vespaVersion(wantedVespaVersion).build(),
+                               ClusterSpec.request(ClusterSpec.Type.container, ClusterSpec.Id.from("my-content")).vespaVersion(wantedVespaVersion).build(),
                                10, 1, resources);
         assertHostSpecParentReservation(nodes, Optional.of(tenant1), tester);
         tester.activate(application1_1, nodes);
@@ -346,14 +346,14 @@ public class VirtualNodeProvisioningTest {
         try {
             // No capacity for 'container' nodes
             tester.prepare(applicationId,
-                    ClusterSpec.request(ClusterSpec.Type.container, ClusterSpec.Id.from("myContent")).vespaVersion(wantedVespaVersion).build(),
+                    ClusterSpec.request(ClusterSpec.Type.container, ClusterSpec.Id.from("my-content")).vespaVersion(wantedVespaVersion).build(),
                     6, 1, resources);
             fail("Expected to fail node allocation");
         } catch (NodeAllocationException ignored) { }
 
         // Same cluster, but content type is now 'content'
         List<HostSpec> nodes = tester.prepare(applicationId,
-                ClusterSpec.request(ClusterSpec.Type.content, ClusterSpec.Id.from("myContent")).vespaVersion(wantedVespaVersion).build(),
+                ClusterSpec.request(ClusterSpec.Type.content, ClusterSpec.Id.from("my-content")).vespaVersion(wantedVespaVersion).build(),
                 6, 1, resources);
         tester.activate(applicationId, nodes);
 
@@ -445,7 +445,7 @@ public class VirtualNodeProvisioningTest {
             assertEquals("No room for 3 nodes as 2 of 4 hosts are exclusive",
                          "Could not satisfy request for 3 nodes with " +
                          "[vcpu: 1.0, memory: 4.0 Gb, disk 100.0 Gb, bandwidth: 1.0 Gbps, architecture: x86_64] " +
-                         "in tenant2.app2 container cluster 'myContainer' 6.39: " +
+                         "in tenant2.app2 container cluster 'my-container' 6.39: " +
                          "Node allocation failure on group 0: " +
                          "Not enough suitable nodes available due to host exclusivity constraints",
                          e.getMessage());
@@ -465,14 +465,14 @@ public class VirtualNodeProvisioningTest {
             tester.makeReadyChildren(1, resources2, "host2");
 
             tester.prepare(application1,
-                           ClusterSpec.request(ClusterSpec.Type.content, ClusterSpec.Id.from("myContent")).vespaVersion("6.42").build(),
+                           ClusterSpec.request(ClusterSpec.Type.content, ClusterSpec.Id.from("my-content")).vespaVersion("6.42").build(),
                            2, 1,
                            resources2.with(NodeResources.StorageType.remote));
         }
         catch (NodeAllocationException e) {
             assertEquals("Could not satisfy request for 2 nodes with " +
                          "[vcpu: 1.0, memory: 4.0 Gb, disk 100.0 Gb, bandwidth: 1.0 Gbps, storage type: remote, architecture: x86_64] " +
-                         "in tenant.app1 content cluster 'myContent'" +
+                         "in tenant.app1 content cluster 'my-content'" +
                          " 6.42: Node allocation failure on group 0",
                          e.getMessage());
         }
@@ -672,7 +672,7 @@ public class VirtualNodeProvisioningTest {
 
     private void prepareAndActivate(ApplicationId application, int nodeCount, boolean exclusive, NodeResources resources, ProvisioningTester tester) {
         Set<HostSpec> hosts = new HashSet<>(tester.prepare(application,
-                                                           ClusterSpec.request(ClusterSpec.Type.container, ClusterSpec.Id.from("myContainer")).vespaVersion("6.39").exclusive(exclusive).build(),
+                                                           ClusterSpec.request(ClusterSpec.Type.container, ClusterSpec.Id.from("my-container")).vespaVersion("6.39").exclusive(exclusive).build(),
                                                            Capacity.from(new ClusterResources(nodeCount, 1, resources), false, true)));
         tester.activate(application, hosts);
     }
diff --git a/node-repository/src/test/java/com/yahoo/vespa/hosted/provision/restapi/responses/load-balancers.json b/node-repository/src/test/java/com/yahoo/vespa/hosted/provision/restapi/responses/load-balancers.json
index bbccc72c7f9..becca98a913 100644
--- a/node-repository/src/test/java/com/yahoo/vespa/hosted/provision/restapi/responses/load-balancers.json
+++ b/node-repository/src/test/java/com/yahoo/vespa/hosted/provision/restapi/responses/load-balancers.json
@@ -30,7 +30,12 @@
         }
       ],
       "settings": {
-        "allowedUrns": [ "arne" ]
+        "allowedUrns": [
+          {
+            "type": "aws-private-link",
+            "urn": "arne"
+          }
+        ]
       },
       "serviceId": "service"
     },