Add remaining capabilities and capability sets to C++

5 files changed, 206 insertions, 73 deletions

diff --git a/vespalib/src/tests/net/tls/capabilities/capabilities_test.cpp b/vespalib/src/tests/net/tls/capabilities/capabilities_test.cpp
index 1180867ba92..0bf04289a65 100644
--- a/vespalib/src/tests/net/tls/capabilities/capabilities_test.cpp
+++ b/vespalib/src/tests/net/tls/capabilities/capabilities_test.cpp
@@ -59,36 +59,40 @@ void check_capability_set_mapping(const std::string& name, CapabilitySet expecte
 }
 
 TEST("All known capabilities can be looked up by name, and resolve back to same name") {
-    check_capability_mapping("vespa.none",                     Capability::none());
-    check_capability_mapping("vespa.http.unclassified",        Capability::http_unclassified());
-    check_capability_mapping("vespa.restapi.unclassified",     Capability::restapi_unclassified());
-    check_capability_mapping("vespa.rpc.unclassified",         Capability::rpc_unclassified());
-    check_capability_mapping("vespa.client.filereceiver_api",  Capability::client_filereceiver_api());
-    check_capability_mapping("vespa.client.slobrok_api",       Capability::client_slobrok_api());
-    check_capability_mapping("vespa.configproxy.config_api",   Capability::configproxy_config_api());
-    check_capability_mapping("vespa.configproxy.management_api",
-                             Capability::configproxy_management_api());
+    check_capability_mapping("vespa.none",                          Capability::none());
+    check_capability_mapping("vespa.http.unclassified",             Capability::http_unclassified());
+    check_capability_mapping("vespa.restapi.unclassified",          Capability::restapi_unclassified());
+    check_capability_mapping("vespa.rpc.unclassified",              Capability::rpc_unclassified());
+    check_capability_mapping("vespa.client.filereceiver_api",       Capability::client_filereceiver_api());
+    check_capability_mapping("vespa.client.slobrok_api",            Capability::client_slobrok_api());
+    check_capability_mapping("vespa.cluster_controller.reindexing", Capability::cluster_controller_reindexing());
+    check_capability_mapping("vespa.cluster_controller.state",      Capability::cluster_controller_state());
+    check_capability_mapping("vespa.cluster_controller.status",     Capability::cluster_controller_status());
+    check_capability_mapping("vespa.configproxy.config_api",        Capability::configproxy_config_api());
+    check_capability_mapping("vespa.configproxy.management_api",    Capability::configproxy_management_api());
     check_capability_mapping("vespa.configproxy.filedistribution_api",
                              Capability::configproxy_filedistribution_api());
-    check_capability_mapping("vespa.configserver.config_api",  Capability::configserver_config_api());
+    check_capability_mapping("vespa.configserver.config_api",       Capability::configserver_config_api());
     check_capability_mapping("vespa.configserver.filedistribution_api",
                              Capability::configserver_filedistribution_api());
-    check_capability_mapping("vespa.container.document_api",   Capability::container_document_api());
-    check_capability_mapping("vespa.container.management_api", Capability::container_management_api());
-    check_capability_mapping("vespa.content.storage_api",      Capability::content_storage_api());
-    check_capability_mapping("vespa.content.document_api",     Capability::content_document_api());
-    check_capability_mapping("vespa.content.search_api",       Capability::content_search_api());
-    check_capability_mapping("vespa.content.proton_admin_api", Capability::content_proton_admin_api());
-    check_capability_mapping("vespa.slobrok.api",              Capability::slobrok_api());
-    check_capability_mapping("vespa.config.sentinel_api",      Capability::config_sentinel_api());
-    check_capability_mapping("vespa.content.status_pages",     Capability::content_status_pages());
-    check_capability_mapping("vespa.content.metrics_api",      Capability::content_metrics_api());
+    check_capability_mapping("vespa.container.document_api",        Capability::container_document_api());
+    check_capability_mapping("vespa.container.management_api",      Capability::container_management_api());
+    check_capability_mapping("vespa.container.state_api",           Capability::container_state_api());
     check_capability_mapping("vespa.content.cluster_controller.internal_state_api",
                              Capability::content_cluster_controller_internal_state_api());
-    check_capability_mapping("vespa.logserver.api",            Capability::logserver_api());
-    check_capability_mapping("vespa.metricsproxy.management_api",
-                             Capability::metricsproxy_management_api());
-    check_capability_mapping("vespa.metricsproxy.metrics_api", Capability::metricsproxy_metrics_api());
+    check_capability_mapping("vespa.content.document_api",          Capability::content_document_api());
+    check_capability_mapping("vespa.content.metrics_api",           Capability::content_metrics_api());
+    check_capability_mapping("vespa.content.proton_admin_api",      Capability::content_proton_admin_api());
+    check_capability_mapping("vespa.content.search_api",            Capability::content_search_api());
+    check_capability_mapping("vespa.content.status_pages",          Capability::content_status_pages());
+    check_capability_mapping("vespa.content.storage_api",           Capability::content_storage_api());
+    check_capability_mapping("vespa.logserver.api",                 Capability::logserver_api());
+    check_capability_mapping("vespa.metricsproxy.management_api",   Capability::metricsproxy_management_api());
+    check_capability_mapping("vespa.metricsproxy.metrics_api",      Capability::metricsproxy_metrics_api());
+    check_capability_mapping("vespa.sentinel.connectivity_check",   Capability::sentinel_connectivity_check());
+    check_capability_mapping("vespa.sentinel.inspect_services",     Capability::sentinel_inspect_services());
+    check_capability_mapping("vespa.sentinel.management_api",       Capability::sentinel_management_api());
+    check_capability_mapping("vespa.slobrok.api",                   Capability::slobrok_api());
 }
 
 TEST("Unknown capability name returns nullopt") {
@@ -97,14 +101,29 @@ TEST("Unknown capability name returns nullopt") {
 
 TEST("CapabilitySet instances can be stringified") {
     EXPECT_EQUAL(CapabilitySet::content_node().to_string(),
-                 "CapabilitySet({vespa.content.storage_api, vespa.content.document_api, vespa.slobrok.api})");
+                 "CapabilitySet({vespa.configproxy.config_api, "
+                                "vespa.configproxy.filedistribution_api, "
+                                "vespa.configserver.config_api, "
+                                "vespa.configserver.filedistribution_api, "
+                                "vespa.container.document_api, "
+                                "vespa.container.state_api, "
+                                "vespa.content.document_api, "
+                                "vespa.content.metrics_api, "
+                                "vespa.content.status_pages, "
+                                "vespa.content.storage_api, "
+                                "vespa.logserver.api, "
+                                "vespa.metricsproxy.metrics_api, "
+                                "vespa.sentinel.connectivity_check, "
+                                "vespa.slobrok.api})");
 }
 
 TEST("All known capability sets can be looked up by name") {
+    check_capability_set_mapping("vespa.all",                     CapabilitySet::all());
     check_capability_set_mapping("vespa.content_node",            CapabilitySet::content_node());
     check_capability_set_mapping("vespa.container_node",          CapabilitySet::container_node());
     check_capability_set_mapping("vespa.telemetry",               CapabilitySet::telemetry());
     check_capability_set_mapping("vespa.cluster_controller_node", CapabilitySet::cluster_controller_node());
+    check_capability_set_mapping("vespa.logserver_node",          CapabilitySet::logserver_node());
     check_capability_set_mapping("vespa.config_server",           CapabilitySet::config_server());
 }
 
@@ -116,11 +135,25 @@ TEST("Resolving a capability set adds all its underlying capabilities") {
     CapabilitySet caps;
     EXPECT_TRUE(caps.resolve_and_add("vespa.content_node"));
     // Slightly suboptimal; this test will fail if the default set of capabilities for vespa.content_node changes.
-    EXPECT_EQUAL(caps.count(), 3u);
+    EXPECT_EQUAL(caps.count(), 14u);
     EXPECT_FALSE(caps.empty());
     EXPECT_TRUE(caps.contains(Capability::content_storage_api()));
     EXPECT_TRUE(caps.contains(Capability::content_document_api()));
+    EXPECT_TRUE(caps.contains(Capability::container_document_api()));
+    // vespa.content_node -> shared node caps:
+    EXPECT_TRUE(caps.contains(Capability::logserver_api()));
+    EXPECT_TRUE(caps.contains(Capability::configserver_config_api()));
+    EXPECT_TRUE(caps.contains(Capability::configserver_filedistribution_api()));
+    EXPECT_TRUE(caps.contains(Capability::configproxy_config_api()));
+    EXPECT_TRUE(caps.contains(Capability::configproxy_filedistribution_api()));
+    // vespa.content_node -> shared node caps -> vespa.telemetry
+    EXPECT_TRUE(caps.contains(Capability::content_status_pages()));
+    EXPECT_TRUE(caps.contains(Capability::content_metrics_api()));
+    EXPECT_TRUE(caps.contains(Capability::container_state_api()));
+    EXPECT_TRUE(caps.contains(Capability::metricsproxy_metrics_api()));
+    EXPECT_TRUE(caps.contains(Capability::sentinel_connectivity_check()));
     EXPECT_TRUE(caps.contains(Capability::slobrok_api()));
+    // Not included:
     EXPECT_FALSE(caps.contains(Capability::content_search_api()));
 }
 
@@ -144,12 +177,20 @@ TEST("Resolving multiple capabilities/sets adds union of capabilities") {
     CapabilitySet caps;
     EXPECT_TRUE(caps.resolve_and_add("vespa.content_node"));   // CapabilitySet
     EXPECT_TRUE(caps.resolve_and_add("vespa.container_node")); // ditto
-    EXPECT_EQUAL(caps, CapabilitySet::of({Capability::content_storage_api(), Capability::content_document_api(),
-                                          Capability::slobrok_api(), Capability::content_search_api()}));
+    EXPECT_EQUAL(caps, CapabilitySet::of({Capability::content_storage_api(),
+                                          Capability::content_document_api(),
+                                          Capability::container_document_api(),
+                                          Capability::slobrok_api(),
+                                          Capability::content_search_api()})
+            .union_of(CapabilitySet::shared_app_node_capabilities()));
     EXPECT_TRUE(caps.resolve_and_add("vespa.content.metrics_api")); // Capability (single)
-    EXPECT_EQUAL(caps, CapabilitySet::of({Capability::content_storage_api(), Capability::content_document_api(),
-                                          Capability::slobrok_api(), Capability::content_search_api(),
-                                          Capability::content_metrics_api()}));
+    EXPECT_EQUAL(caps, CapabilitySet::of({Capability::content_storage_api(),
+                                          Capability::content_document_api(),
+                                          Capability::container_document_api(),
+                                          Capability::slobrok_api(),
+                                          Capability::content_search_api(),
+                                          Capability::content_metrics_api()})
+            .union_of(CapabilitySet::shared_app_node_capabilities()));
 }
 
 TEST("Default-constructed CapabilitySet has no capabilities") {
@@ -164,12 +205,23 @@ TEST("Default-constructed CapabilitySet has no capabilities") {
 TEST("CapabilitySet can be created with all capabilities") {
     auto caps = CapabilitySet::make_with_all_capabilities();
     EXPECT_EQUAL(caps.count(), CapabilitySet::max_count());
+    EXPECT_EQUAL(caps, CapabilitySet::all()); // alias
     EXPECT_TRUE(caps.contains(Capability::none()));
     EXPECT_TRUE(caps.contains(Capability::content_storage_api()));
     EXPECT_TRUE(caps.contains(Capability::content_metrics_api()));
     // ... we just assume the rest are present as well.
 }
 
+TEST("CapabilitySet can be explicitly unioned") {
+    const auto a = CapabilitySet::of({Capability::content_document_api()});
+    const auto b = CapabilitySet::of({Capability::content_search_api()});
+    auto c = a.union_of(b);
+
+    EXPECT_EQUAL(c.count(), 2u);
+    EXPECT_TRUE(c.contains(Capability::content_document_api()));
+    EXPECT_TRUE(c.contains(Capability::content_search_api()));
+}
+
 TEST("CapabilitySet::contains_all() requires an intersection of capabilities") {
     auto cap1 = Capability::content_document_api();
     auto cap2 = Capability::content_search_api();
diff --git a/vespalib/src/vespa/vespalib/net/tls/capability.cpp b/vespalib/src/vespa/vespalib/net/tls/capability.cpp
index 91fb1cf18ef..cfc1cc7a7cc 100644
--- a/vespalib/src/vespa/vespalib/net/tls/capability.cpp
+++ b/vespalib/src/vespa/vespalib/net/tls/capability.cpp
@@ -19,6 +19,9 @@ constexpr std::array<std::string_view, Capability::max_value_count()> capability
     "vespa.rpc.unclassified"sv,
     "vespa.client.filereceiver_api"sv,
     "vespa.client.slobrok_api"sv,
+    "vespa.cluster_controller.reindexing"sv,
+    "vespa.cluster_controller.state"sv,
+    "vespa.cluster_controller.status"sv,
     "vespa.configproxy.config_api"sv,
     "vespa.configproxy.management_api"sv,
     "vespa.configproxy.filedistribution_api"sv,
@@ -26,18 +29,21 @@ constexpr std::array<std::string_view, Capability::max_value_count()> capability
     "vespa.configserver.filedistribution_api"sv,
     "vespa.container.document_api"sv,
     "vespa.container.management_api"sv,
-    "vespa.content.storage_api"sv,
+    "vespa.container.state_api"sv,
+    "vespa.content.cluster_controller.internal_state_api"sv,
     "vespa.content.document_api"sv,
-    "vespa.content.search_api"sv,
+    "vespa.content.metrics_api"sv,
     "vespa.content.proton_admin_api"sv,
-    "vespa.content.cluster_controller.internal_state_api"sv,
-    "vespa.slobrok.api"sv,
-    "vespa.config.sentinel_api"sv,
+    "vespa.content.search_api"sv,
     "vespa.content.status_pages"sv,
-    "vespa.content.metrics_api"sv,
+    "vespa.content.storage_api"sv,
     "vespa.logserver.api"sv,
     "vespa.metricsproxy.management_api"sv,
     "vespa.metricsproxy.metrics_api"sv,
+    "vespa.sentinel.connectivity_check"sv,
+    "vespa.sentinel.inspect_services"sv,
+    "vespa.sentinel.management_api"sv,
+    "vespa.slobrok.api"sv
 };
 
 } // anon ns
@@ -61,6 +67,9 @@ std::optional<Capability> Capability::find_capability(const string& cap_name) no
         {"vespa.rpc.unclassified",                              rpc_unclassified()},
         {"vespa.client.filereceiver_api",                       client_filereceiver_api()},
         {"vespa.client.slobrok_api",                            client_slobrok_api()},
+        {"vespa.cluster_controller.reindexing",                 cluster_controller_reindexing()},
+        {"vespa.cluster_controller.state",                      cluster_controller_state()},
+        {"vespa.cluster_controller.status",                     cluster_controller_status()},
         {"vespa.configproxy.config_api",                        configproxy_config_api()},
         {"vespa.configproxy.management_api",                    configproxy_management_api()},
         {"vespa.configproxy.filedistribution_api",              configproxy_filedistribution_api()},
@@ -68,18 +77,21 @@ std::optional<Capability> Capability::find_capability(const string& cap_name) no
         {"vespa.configserver.filedistribution_api",             configserver_filedistribution_api()},
         {"vespa.container.document_api",                        container_document_api()},
         {"vespa.container.management_api",                      container_management_api()},
-        {"vespa.content.storage_api",                           content_storage_api()},
+        {"vespa.container.state_api",                           container_state_api()},
+        {"vespa.content.cluster_controller.internal_state_api", content_cluster_controller_internal_state_api()},
         {"vespa.content.document_api",                          content_document_api()},
-        {"vespa.content.search_api",                            content_search_api()},
+        {"vespa.content.metrics_api",                           content_metrics_api()},
         {"vespa.content.proton_admin_api",                      content_proton_admin_api()},
-        {"vespa.content.cluster_controller.internal_state_api", content_cluster_controller_internal_state_api()},
-        {"vespa.slobrok.api",                                   slobrok_api()},
-        {"vespa.config.sentinel_api",                           config_sentinel_api()},
+        {"vespa.content.search_api",                            content_search_api()},
         {"vespa.content.status_pages",                          content_status_pages()},
-        {"vespa.content.metrics_api",                           content_metrics_api()},
+        {"vespa.content.storage_api",                           content_storage_api()},
         {"vespa.logserver.api",                                 logserver_api()},
         {"vespa.metricsproxy.management_api",                   metricsproxy_management_api()},
         {"vespa.metricsproxy.metrics_api",                      metricsproxy_metrics_api()},
+        {"vespa.sentinel.connectivity_check",                   sentinel_connectivity_check()},
+        {"vespa.sentinel.inspect_services",                     sentinel_inspect_services()},
+        {"vespa.sentinel.management_api",                       sentinel_management_api()},
+        {"vespa.slobrok.api",                                   slobrok_api()}
     });
     auto iter = name_to_cap.find(cap_name);
     return (iter != name_to_cap.end()) ? std::optional<Capability>(iter->second) : std::nullopt;
diff --git a/vespalib/src/vespa/vespalib/net/tls/capability.h b/vespalib/src/vespa/vespalib/net/tls/capability.h
index ff49869689d..a7a1dcd15ac 100644
--- a/vespalib/src/vespa/vespalib/net/tls/capability.h
+++ b/vespalib/src/vespa/vespalib/net/tls/capability.h
@@ -31,6 +31,9 @@ private:
         RpcUnclassified,
         ClientFilereceiverApi,
         ClientSlobrokApi,
+        ClusterControllerReindexing,
+        ClusterControllerState,
+        ClusterControllerStatus,
         ConfigproxyConfigApi,
         ConfigproxyManagementApi,
         ConfigproxyFiledistributionApi,
@@ -38,24 +41,27 @@ private:
         ConfigserverFiledistributionApi,
         ContainerDocumentApi,
         ContainerManagementApi,
-        ContentStorageApi,
+        ContainerStateApi,
+        ContentClusterControllerInternalStateApi,
         ContentDocumentApi,
-        ContentSearchApi,
+        ContentMetricsApi,
         ContentProtonAdminApi,
-        ContentClusterControllerInternalStateApi,
-        SlobrokApi,
-        ConfigSentinelApi,
+        ContentSearchApi,
         ContentStatusPages,
-        ContentMetricsApi,
+        ContentStorageApi,
         LogserverApi,
         MetricsproxyManagementApi,
         MetricsproxyMetricsApi,
+        SentinelConnectivityCheck,
+        SentinelInspectServices,
+        SentinelManagementApi,
+        SlobrokApi,
         // When adding a capability ID to the end, max_value_count() MUST be updated
     };
 public:
     constexpr static size_t max_value_count() noexcept {
         // This must refer to the highest possible CapabilityId enum value.
-        return static_cast<size_t>(Id::MetricsproxyMetricsApi) + 1;
+        return static_cast<size_t>(Id::SlobrokApi) + 1;
     }
 private:
     Id _cap_id;
@@ -114,6 +120,18 @@ public:
         return Capability(Id::ClientSlobrokApi);
     }
 
+    constexpr static Capability cluster_controller_reindexing() noexcept {
+        return Capability(Id::ClusterControllerReindexing);
+    }
+
+    constexpr static Capability cluster_controller_state() noexcept {
+        return Capability(Id::ClusterControllerState);
+    }
+
+    constexpr static Capability cluster_controller_status() noexcept {
+        return Capability(Id::ClusterControllerStatus);
+    }
+
     constexpr static Capability configproxy_config_api() noexcept {
         return Capability(Id::ConfigproxyConfigApi);
     }
@@ -142,6 +160,10 @@ public:
         return Capability(Id::ContainerManagementApi);
     }
 
+    constexpr static Capability container_state_api() noexcept {
+        return Capability(Id::ContainerStateApi);
+    }
+
     constexpr static Capability content_storage_api() noexcept {
         return Capability(Id::ContentStorageApi);
     }
@@ -166,10 +188,6 @@ public:
         return Capability(Id::SlobrokApi);
     }
 
-    constexpr static Capability config_sentinel_api() noexcept {
-        return Capability(Id::ConfigSentinelApi);
-    }
-
     constexpr static Capability content_status_pages() noexcept {
         return Capability(Id::ContentStatusPages);
     }
@@ -190,6 +208,18 @@ public:
         return Capability(Id::MetricsproxyMetricsApi);
     }
 
+    constexpr static Capability sentinel_connectivity_check() noexcept {
+        return Capability(Id::SentinelConnectivityCheck);
+    }
+
+    constexpr static Capability sentinel_inspect_services() noexcept {
+        return Capability(Id::SentinelInspectServices);
+    }
+
+    constexpr static Capability sentinel_management_api() noexcept {
+        return Capability(Id::SentinelManagementApi);
+    }
+
 };
 
 std::ostream& operator<<(std::ostream&, const Capability& cap);
diff --git a/vespalib/src/vespa/vespalib/net/tls/capability_set.cpp b/vespalib/src/vespa/vespalib/net/tls/capability_set.cpp
index 3663694e31a..cff56208ae4 100644
--- a/vespalib/src/vespa/vespalib/net/tls/capability_set.cpp
+++ b/vespalib/src/vespa/vespalib/net/tls/capability_set.cpp
@@ -26,10 +26,12 @@ string CapabilitySet::to_string() const {
 
 std::optional<CapabilitySet> CapabilitySet::find_capability_set(const string& cap_set_name) noexcept {
     static const hash_map<string, CapabilitySet> name_to_cap_set({
+        {"vespa.all",                     all()},
         {"vespa.content_node",            content_node()},
         {"vespa.container_node",          container_node()},
         {"vespa.telemetry",               telemetry()},
         {"vespa.cluster_controller_node", cluster_controller_node()},
+        {"vespa.logserver_node",          logserver_node()},
         {"vespa.config_server",           config_server()}
     });
     auto iter = name_to_cap_set.find(cap_set_name);
@@ -50,30 +52,59 @@ bool CapabilitySet::resolve_and_add(const string& set_or_cap_name) noexcept {
 // Note: the capability set factory functions below are all just using constexpr and/or inline
 // functions, so the compiler will happily optimize them to just "return <constant bit pattern>".
 
+CapabilitySet CapabilitySet::all() noexcept {
+    return make_with_all_capabilities();
+}
+
 CapabilitySet CapabilitySet::content_node() noexcept {
     return CapabilitySet::of({Capability::content_storage_api(),
                               Capability::content_document_api(),
-                              Capability::slobrok_api()});
+                              Capability::container_document_api()})
+            .union_of(shared_app_node_capabilities());
 }
 
 CapabilitySet CapabilitySet::container_node() noexcept {
     return CapabilitySet::of({Capability::content_document_api(),
-                              Capability::content_search_api(),
-                              Capability::slobrok_api()});
+                              Capability::content_search_api()})
+            .union_of(shared_app_node_capabilities());
 }
 
 CapabilitySet CapabilitySet::telemetry() noexcept {
     return CapabilitySet::of({Capability::content_status_pages(),
-                              Capability::content_metrics_api()});
+                              Capability::content_metrics_api(),
+                              Capability::container_state_api(),
+                              Capability::metricsproxy_metrics_api(),
+                              Capability::sentinel_connectivity_check()});
 }
 
 CapabilitySet CapabilitySet::cluster_controller_node() noexcept {
     return CapabilitySet::of({Capability::content_cluster_controller_internal_state_api(),
-                              Capability::slobrok_api()});
+                              Capability::client_slobrok_api(),
+                              Capability::container_document_api()}) // for reindexing
+            .union_of(shared_app_node_capabilities());
+}
+
+CapabilitySet CapabilitySet::logserver_node() noexcept {
+    return shared_app_node_capabilities();
 }
 
 CapabilitySet CapabilitySet::config_server() noexcept {
-    return CapabilitySet::of({/*TODO define required capabilities*/});
+    return CapabilitySet::of({Capability::client_filereceiver_api(),
+                              Capability::container_management_api(),
+                              Capability::slobrok_api(),
+                              Capability::cluster_controller_reindexing(),
+                              Capability::cluster_controller_state()})
+            .union_of(telemetry());
+}
+
+CapabilitySet CapabilitySet::shared_app_node_capabilities() noexcept {
+    return CapabilitySet::of({Capability::logserver_api(),
+                              Capability::configserver_config_api(),
+                              Capability::configserver_filedistribution_api(),
+                              Capability::configproxy_config_api(),
+                              Capability::configproxy_filedistribution_api(),
+                              Capability::slobrok_api()})
+            .union_of(telemetry());
 }
 
 CapabilitySet CapabilitySet::make_with_all_capabilities() noexcept {
diff --git a/vespalib/src/vespa/vespalib/net/tls/capability_set.h b/vespalib/src/vespa/vespalib/net/tls/capability_set.h
index f86b043ee7b..8aad28a4162 100644
--- a/vespalib/src/vespa/vespalib/net/tls/capability_set.h
+++ b/vespalib/src/vespa/vespalib/net/tls/capability_set.h
@@ -42,19 +42,19 @@ public:
     constexpr CapabilitySet() noexcept = default;
     constexpr ~CapabilitySet() = default;
 
-    string to_string() const;
+    [[nodiscard]] string to_string() const;
 
-    bool operator==(const CapabilitySet& rhs) const noexcept {
+    [[nodiscard]] bool operator==(const CapabilitySet& rhs) const noexcept {
         return (_capability_mask == rhs._capability_mask);
     }
 
     [[nodiscard]] bool empty() const noexcept {
         return _capability_mask.none();
     }
-    size_t count() const noexcept {
+    [[nodiscard]] size_t count() const noexcept {
         return _capability_mask.count();
     }
-    constexpr static size_t max_count() noexcept {
+    [[nodiscard]] constexpr static size_t max_count() noexcept {
         return Capability::max_value_count();
     }
 
@@ -72,6 +72,10 @@ public:
         _capability_mask |= cap_set._capability_mask;
     }
 
+    [[nodiscard]] CapabilitySet union_of(const CapabilitySet& cap_set) const noexcept {
+        return CapabilitySet(_capability_mask | cap_set._capability_mask);
+    }
+
     template <typename Func>
     void for_each_capability(Func f) const noexcept(noexcept(f(Capability::content_storage_api()))) {
         for (size_t i = 0; i < _capability_mask.size(); ++i) {
@@ -91,9 +95,9 @@ public:
      */
     [[nodiscard]] bool resolve_and_add(const string& set_or_cap_name) noexcept;
 
-    static std::optional<CapabilitySet> find_capability_set(const string& cap_set_name) noexcept;
+    [[nodiscard]] static std::optional<CapabilitySet> find_capability_set(const string& cap_set_name) noexcept;
 
-    static CapabilitySet of(std::initializer_list<Capability> caps) noexcept {
+    [[nodiscard]] static CapabilitySet of(std::initializer_list<Capability> caps) noexcept {
         CapabilitySet set;
         for (const auto& cap : caps) {
             set._capability_mask |= cap_as_bit_set(cap);
@@ -101,14 +105,18 @@ public:
         return set;
     }
 
-    static CapabilitySet content_node() noexcept;
-    static CapabilitySet container_node() noexcept;
-    static CapabilitySet telemetry() noexcept;
-    static CapabilitySet cluster_controller_node() noexcept;
-    static CapabilitySet config_server() noexcept;
+    [[nodiscard]] static CapabilitySet all() noexcept;
+    [[nodiscard]] static CapabilitySet content_node() noexcept;
+    [[nodiscard]] static CapabilitySet container_node() noexcept;
+    [[nodiscard]] static CapabilitySet telemetry() noexcept;
+    [[nodiscard]] static CapabilitySet cluster_controller_node() noexcept;
+    [[nodiscard]] static CapabilitySet logserver_node() noexcept;
+    [[nodiscard]] static CapabilitySet config_server() noexcept;
+
+    [[nodiscard]] static CapabilitySet make_with_all_capabilities() noexcept;
+    [[nodiscard]] static constexpr CapabilitySet make_empty() noexcept { return {}; };
 
-    static CapabilitySet make_with_all_capabilities() noexcept;
-    static CapabilitySet make_empty() noexcept { return CapabilitySet(); };
+    [[nodiscard]] static CapabilitySet shared_app_node_capabilities() noexcept;
 };
 
 std::ostream& operator<<(std::ostream&, const CapabilitySet& cap_set);