1 files changed, 30 insertions, 0 deletions
diff --git a/config-model-api/src/main/java/com/yahoo/config/application/api/DeploymentSpec.java b/config-model-api/src/main/java/com/yahoo/config/application/api/DeploymentSpec.java
index f778c2c2d0e..a19a83f1207 100644
--- a/config-model-api/src/main/java/com/yahoo/config/application/api/DeploymentSpec.java
+++ b/config-model-api/src/main/java/com/yahoo/config/application/api/DeploymentSpec.java
@@ -62,6 +62,7 @@ public class DeploymentSpec {
         this.xmlForm = xmlForm;
         validateTotalDelay(steps);
         validateUpgradePoliciesOfIncreasingConservativeness(steps);
+        validateAthenz();
     }
 
     /** Throw an IllegalArgumentException if the total delay exceeds 24 hours */
@@ -89,6 +90,35 @@ public class DeploymentSpec {
         }
     }
 
+    /**
+     * Throw an IllegalArgumentException if Athenz configuration violates:
+     * domain not configured -> no zone can configure service
+     * domain configured -> all zones must configure service
+     */
+    private void validateAthenz() {
+        // If athenz domain is not set, athenz service cannot be set on any level
+        if (athenzDomain.isEmpty()) {
+            for (DeploymentInstanceSpec instance : instances()) {
+                for (DeploymentSpec.DeclaredZone zone : instance.zones()) {
+                    if (zone.athenzService().isPresent()) {
+                        throw new IllegalArgumentException("Athenz service configured for zone: " + zone + ", but Athenz domain is not configured");
+                    }
+                }
+            }
+            // if athenz domain is not set, athenz service must be set implicitly or directly on all zones.
+        }
+        else if (athenzService.isEmpty()) {
+            for (DeploymentInstanceSpec instance : instances()) {
+                for (DeploymentSpec.DeclaredZone zone : instance.zones()) {
+                    if (zone.athenzService().isEmpty()) {
+                        throw new IllegalArgumentException("Athenz domain is configured, but Athenz service not configured for zone: " + zone);
+                    }
+                }
+            }
+        }
+    }
+
+
     /** Returns the major version this application is pinned to, or empty (default) to allow all major versions */
     public Optional<Integer> majorVersion() { return majorVersion; }