1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
|
// Copyright Yahoo. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
package com.yahoo.vespa.hosted.controller.tenant;
import com.google.common.collect.BiMap;
import com.google.common.collect.ImmutableBiMap;
import com.yahoo.config.provision.TenantName;
import com.yahoo.vespa.hosted.controller.api.integration.secrets.TenantSecretStore;
import com.yahoo.vespa.hosted.controller.api.role.SimplePrincipal;
import java.security.Principal;
import java.security.PublicKey;
import java.time.Instant;
import java.util.List;
import java.util.Objects;
import java.util.Optional;
/**
* A paying tenant in a Vespa cloud service.
*
* @author jonmv
*/
public class CloudTenant extends Tenant {
private final Optional<SimplePrincipal> creator;
private final BiMap<PublicKey, SimplePrincipal> developerKeys;
private final TenantInfo info;
private final List<TenantSecretStore> tenantSecretStores;
private final ArchiveAccess archiveAccess;
private final Optional<Instant> invalidateUserSessionsBefore;
private final Optional<BillingReference> billingReference;
/** Public for the serialization layer — do not use! */
public CloudTenant(TenantName name, Instant createdAt, LastLoginInfo lastLoginInfo, Optional<SimplePrincipal> creator,
BiMap<PublicKey, SimplePrincipal> developerKeys, TenantInfo info,
List<TenantSecretStore> tenantSecretStores, ArchiveAccess archiveAccess,
Optional<Instant> invalidateUserSessionsBefore, Instant tenantRoleLastMaintained,
List<CloudAccountInfo> cloudAccounts, Optional<BillingReference> billingReference) {
super(name, createdAt, lastLoginInfo, Optional.empty(), tenantRoleLastMaintained, cloudAccounts);
this.creator = creator;
this.developerKeys = developerKeys;
this.info = Objects.requireNonNull(info);
this.tenantSecretStores = tenantSecretStores;
this.archiveAccess = Objects.requireNonNull(archiveAccess);
this.invalidateUserSessionsBefore = invalidateUserSessionsBefore;
this.billingReference = Objects.requireNonNull(billingReference);
}
/** Creates a tenant with the given name, provided it passes validation. */
public static CloudTenant create(TenantName tenantName, Instant createdAt, Principal creator) {
return new CloudTenant(requireName(tenantName),
createdAt,
LastLoginInfo.EMPTY,
Optional.ofNullable(creator).map(SimplePrincipal::of),
ImmutableBiMap.of(), TenantInfo.empty(), List.of(), new ArchiveAccess(), Optional.empty(),
Instant.EPOCH, List.of(), Optional.empty());
}
/** The user that created the tenant */
public Optional<SimplePrincipal> creator() {
return creator;
}
/** Legal name, addresses etc */
public TenantInfo info() {
return info;
}
/** Returns the set of developer keys and their corresponding developers for this tenant. */
public BiMap<PublicKey, SimplePrincipal> developerKeys() { return developerKeys; }
/** List of configured secret stores */
public List<TenantSecretStore> tenantSecretStores() {
return tenantSecretStores;
}
/**
* Role or member that is allowed to access archive bucket (log, dump)
*
* For AWS is this the IAM role
* For GCP it is a GCP member
*/
public ArchiveAccess archiveAccess() {
return archiveAccess;
}
/** Returns instant before which all user sessions that have access to this tenant must be refreshed */
public Optional<Instant> invalidateUserSessionsBefore() {
return invalidateUserSessionsBefore;
}
public Optional<BillingReference> billingReference() {
return billingReference;
}
@Override
public Type type() {
return Type.cloud;
}
}
|
