1 files changed, 48 insertions, 12 deletions

diff --git a/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/maintenance/ArchiveAccessMaintainer.java b/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/maintenance/ArchiveAccessMaintainer.java
index b096a853541..6c4f5ffff9d 100644
--- a/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/maintenance/ArchiveAccessMaintainer.java
+++ b/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/maintenance/ArchiveAccessMaintainer.java
@@ -2,16 +2,25 @@
 package com.yahoo.vespa.hosted.controller.maintenance;
 
 import com.google.common.collect.Maps;
+import com.yahoo.config.provision.TenantName;
+import com.yahoo.config.provision.zone.ZoneApi;
+import com.yahoo.config.provision.zone.ZoneId;
 import com.yahoo.jdisc.Metric;
+import com.yahoo.vespa.flags.BooleanFlag;
+import com.yahoo.vespa.flags.FetchVector;
+import com.yahoo.vespa.flags.Flags;
 import com.yahoo.vespa.hosted.controller.Controller;
 import com.yahoo.vespa.hosted.controller.api.integration.archive.ArchiveService;
 import com.yahoo.vespa.hosted.controller.api.integration.zone.ZoneRegistry;
 import com.yahoo.vespa.hosted.controller.archive.CuratorArchiveBucketDb;
+import com.yahoo.vespa.hosted.controller.tenant.AthenzTenant;
 import com.yahoo.vespa.hosted.controller.tenant.CloudTenant;
 import com.yahoo.vespa.hosted.controller.tenant.Tenant;
 
 import java.time.Duration;
+import java.util.List;
 import java.util.Map;
+import java.util.function.Function;
 import java.util.stream.Collectors;
 
 /**
@@ -27,6 +36,8 @@ public class ArchiveAccessMaintainer extends ControllerMaintainer {
     private final ArchiveService archiveService;
     private final ZoneRegistry zoneRegistry;
     private final Metric metric;
+    private final BooleanFlag archiveEnabled;
+    private final BooleanFlag developerRoleEnabled;
 
     public ArchiveAccessMaintainer(Controller controller, Metric metric, Duration interval) {
         super(controller, interval);
@@ -34,6 +45,8 @@ public class ArchiveAccessMaintainer extends ControllerMaintainer {
         this.archiveService = controller.serviceRegistry().archiveService();
         this.zoneRegistry = controller().zoneRegistry();
         this.metric = metric;
+        this.archiveEnabled = Flags.ENABLE_ONPREM_TENANT_S3_ARCHIVE.bindTo(controller().flagSource());
+        this.developerRoleEnabled = Flags.ENABLE_TENANT_DEVELOPER_ROLE.bindTo(controller().flagSource());
     }
 
     @Override
@@ -43,22 +56,45 @@ public class ArchiveAccessMaintainer extends ControllerMaintainer {
                 metric.set(bucketCountMetricName, archiveBucketDb.buckets(zoneId).size(),
                         metric.createContext(Map.of("zone", zoneId.value()))));
 
-        var tenantArchiveAccessRoles = controller().tenants().asList().stream()
-                .filter(t -> t instanceof CloudTenant)
-                .map(t -> (CloudTenant) t)
-                .filter(t -> t.archiveAccessRole().isPresent())
-                .collect(Collectors.toUnmodifiableMap(
-                        Tenant::name, cloudTenant -> cloudTenant.archiveAccessRole().orElseThrow()));
 
-        zoneRegistry.zones().controllerUpgraded().ids().forEach(zoneId ->
-                archiveBucketDb.buckets(zoneId).forEach(archiveBucket ->
-                        archiveService.updateBucketAndKeyPolicy(zoneId, archiveBucket,
-                                Maps.filterEntries(tenantArchiveAccessRoles,
-                                        entry -> archiveBucket.tenants().contains(entry.getKey())))
-                )
+        zoneRegistry.zones().controllerUpgraded().zones().forEach(z -> {
+                    ZoneId zoneId = z.getId();
+                    var tenantArchiveAccessRoles = tenantArchiveAccessRoles(z);
+                    archiveBucketDb.buckets(zoneId).forEach(archiveBucket ->
+                            archiveService.updateBucketAndKeyPolicy(zoneId, archiveBucket,
+                                    Maps.filterEntries(tenantArchiveAccessRoles,
+                                            entry -> archiveBucket.tenants().contains(entry.getKey())))
+                    );
+                }
         );
 
         return 1.0;
     }
 
+    private Map<TenantName, String> tenantArchiveAccessRoles(ZoneApi zone) {
+        List<Tenant> tenants = controller().tenants().asList();
+        if (zoneRegistry.system().isPublic()) {
+            return tenants.stream()
+                    .filter(t -> t instanceof CloudTenant)
+                    .map(t -> (CloudTenant) t)
+                    .filter(t -> t.archiveAccessRole().isPresent())
+                    .collect(Collectors.toUnmodifiableMap(
+                            Tenant::name, cloudTenant -> cloudTenant.archiveAccessRole().orElseThrow()));
+        } else {
+            return tenants.stream()
+                    .filter(t -> t instanceof AthenzTenant
+                            && enabled(archiveEnabled, t, zone) && enabled(developerRoleEnabled, t, zone))
+                    .map(Tenant::name)
+                    .collect(Collectors.toUnmodifiableMap(
+                            Function.identity(), t -> zoneRegistry.tenantDeveloperRoleArn(t).orElseThrow()));
+
+        }
+    }
+
+    private boolean enabled(BooleanFlag flag, Tenant tenant, ZoneApi zone) {
+        return flag.with(FetchVector.Dimension.TENANT_ID, tenant.name().value())
+                .with(FetchVector.Dimension.ZONE_ID, zone.getId().value())
+                .value();
+    }
+
 }