1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
|
// Copyright Yahoo. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
package com.yahoo.vespa.hosted.controller.application.pkg;
import com.yahoo.config.application.api.DeploymentInstanceSpec;
import com.yahoo.config.application.api.DeploymentSpec;
import com.yahoo.config.application.api.Endpoint;
import com.yahoo.config.application.api.ValidationId;
import com.yahoo.config.application.api.ValidationOverrides;
import com.yahoo.config.provision.CloudName;
import com.yahoo.config.provision.Environment;
import com.yahoo.config.provision.InstanceName;
import com.yahoo.config.provision.zone.ZoneApi;
import com.yahoo.config.provision.zone.ZoneId;
import com.yahoo.vespa.hosted.controller.Application;
import com.yahoo.vespa.hosted.controller.Controller;
import com.yahoo.vespa.hosted.controller.application.EndpointId;
import com.yahoo.vespa.hosted.controller.deployment.DeploymentSteps;
import java.time.Instant;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.HashSet;
import java.util.List;
import java.util.Map;
import java.util.Objects;
import java.util.Optional;
import java.util.stream.Collectors;
/**
* This contains validators for a {@link ApplicationPackage} that depend on a {@link Controller} to perform validation.
*
* @author mpolden
*/
public class ApplicationPackageValidator {
private final Controller controller;
public ApplicationPackageValidator(Controller controller) {
this.controller = Objects.requireNonNull(controller, "controller must be non-null");
}
/**
* Validate the given application package
*
* @throws IllegalArgumentException if any validations fail
*/
public void validate(Application application, ApplicationPackage applicationPackage, Instant instant) {
validateSteps(applicationPackage.deploymentSpec());
validateEndpointRegions(applicationPackage.deploymentSpec());
validateEndpointChange(application, applicationPackage, instant);
validateCompactedEndpoint(applicationPackage);
validateSecurityClientsPem(applicationPackage);
}
/** Verify that we have the security/clients.pem file for public systems */
private void validateSecurityClientsPem(ApplicationPackage applicationPackage) {
if (!controller.system().isPublic() || applicationPackage.deploymentSpec().steps().isEmpty()) return;
if (applicationPackage.trustedCertificates().isEmpty())
throw new IllegalArgumentException("Missing required file 'security/clients.pem'");
}
/** Verify that each of the production zones listed in the deployment spec exist in this system */
private void validateSteps(DeploymentSpec deploymentSpec) {
for (var spec : deploymentSpec.instances()) {
new DeploymentSteps(spec, controller::system).jobs();
spec.zones().stream()
.filter(zone -> zone.environment() == Environment.prod)
.forEach(zone -> {
if ( ! controller.zoneRegistry().hasZone(ZoneId.from(zone.environment(),
zone.region().orElseThrow()))) {
throw new IllegalArgumentException("Zone " + zone + " in deployment spec was not found in this system!");
}
});
}
}
/** Verify that no single endpoint contains regions in different clouds */
private void validateEndpointRegions(DeploymentSpec deploymentSpec) {
for (var instance : deploymentSpec.instances()) {
for (var endpoint : instance.endpoints()) {
var clouds = new HashSet<CloudName>();
for (var region : endpoint.regions()) {
for (ZoneApi zone : controller.zoneRegistry().zones().all().in(Environment.prod).in(region).zones()) {
clouds.add(zone.getCloudName());
}
}
if (clouds.size() != 1) {
throw new IllegalArgumentException("Endpoint '" + endpoint.endpointId() + "' in " + instance +
" cannot contain regions in different clouds: " +
endpoint.regions().stream().sorted().collect(Collectors.toList()));
}
}
}
}
/** Verify endpoint configuration of given application package */
private void validateEndpointChange(Application application, ApplicationPackage applicationPackage, Instant instant) {
applicationPackage.deploymentSpec().instances().forEach(instance -> validateEndpointChange(application,
instance.name(),
applicationPackage,
instant));
}
/** Verify that compactable endpoint parts (instance name and endpoint ID) do not clash */
private void validateCompactedEndpoint(ApplicationPackage applicationPackage) {
Map<List<String>, InstanceEndpoint> instanceEndpoints = new HashMap<>();
for (var instanceSpec : applicationPackage.deploymentSpec().instances()) {
for (var endpoint : instanceSpec.endpoints()) {
List<String> nonCompactableIds = nonCompactableIds(instanceSpec.name(), endpoint);
InstanceEndpoint instanceEndpoint = new InstanceEndpoint(instanceSpec.name(), endpoint.endpointId());
InstanceEndpoint existingEndpoint = instanceEndpoints.get(nonCompactableIds);
if (existingEndpoint != null) {
throw new IllegalArgumentException("Endpoint with ID '" + endpoint.endpointId() + "' in instance '"
+ instanceSpec.name().value() +
"' clashes with endpoint '" + existingEndpoint.endpointId +
"' in instance '" + existingEndpoint.instance + "'");
}
instanceEndpoints.put(nonCompactableIds, instanceEndpoint);
}
}
}
/** Verify changes to endpoint configuration by comparing given application package to the existing one, if any */
private void validateEndpointChange(Application application, InstanceName instanceName, ApplicationPackage applicationPackage, Instant instant) {
var validationId = ValidationId.globalEndpointChange;
if (applicationPackage.validationOverrides().allows(validationId, instant)) return;
var endpoints = application.deploymentSpec().instance(instanceName)
.map(ApplicationPackageValidator::allEndpointsOf)
.orElseGet(List::of);
var newEndpoints = allEndpointsOf(applicationPackage.deploymentSpec().requireInstance(instanceName));
if (newEndpoints.containsAll(endpoints)) return; // Adding new endpoints is fine
if (containsAllDestinationsOf(endpoints, newEndpoints)) return; // Adding destinations is fine
var removedEndpoints = new ArrayList<>(endpoints);
removedEndpoints.removeAll(newEndpoints);
newEndpoints.removeAll(endpoints);
throw new IllegalArgumentException(validationId.value() + ": application '" + application.id() +
(instanceName.isDefault() ? "" : "." + instanceName.value()) +
"' has endpoints " + endpoints +
", but does not include all of these in deployment.xml. Deploying given " +
"deployment.xml will remove " + removedEndpoints +
(newEndpoints.isEmpty() ? "" : " and add " + newEndpoints) +
". " + ValidationOverrides.toAllowMessage(validationId));
}
/** Returns whether newEndpoints contains all destinations in endpoints */
private static boolean containsAllDestinationsOf(List<Endpoint> endpoints, List<Endpoint> newEndpoints) {
var containsAllRegions = true;
var hasSameCluster = true;
for (var endpoint : endpoints) {
var endpointContainsAllRegions = false;
var endpointHasSameCluster = false;
for (var newEndpoint : newEndpoints) {
if (endpoint.endpointId().equals(newEndpoint.endpointId())) {
endpointContainsAllRegions = newEndpoint.regions().containsAll(endpoint.regions());
endpointHasSameCluster = newEndpoint.containerId().equals(endpoint.containerId());
}
}
containsAllRegions &= endpointContainsAllRegions;
hasSameCluster &= endpointHasSameCluster;
}
return containsAllRegions && hasSameCluster;
}
/** Returns all configued endpoints of given deployment instance spec */
private static List<Endpoint> allEndpointsOf(DeploymentInstanceSpec deploymentInstanceSpec) {
var endpoints = new ArrayList<>(deploymentInstanceSpec.endpoints());
legacyEndpoint(deploymentInstanceSpec).ifPresent(endpoints::add);
return endpoints;
}
/** Returns global service ID as an endpoint, if any global service ID is set */
private static Optional<Endpoint> legacyEndpoint(DeploymentInstanceSpec instance) {
return instance.globalServiceId().map(globalServiceId -> {
var targets = instance.zones().stream()
.filter(zone -> zone.environment().isProduction())
.flatMap(zone -> zone.region().stream())
.distinct()
.map(region -> new Endpoint.Target(region, instance.name(), 1))
.collect(Collectors.toList());
return new Endpoint(EndpointId.defaultId().id(), globalServiceId, Endpoint.Level.instance, targets);
});
}
/** Returns a list of the non-compactable IDs of given instance and endpoint */
private static List<String> nonCompactableIds(InstanceName instance, Endpoint endpoint) {
List<String> ids = new ArrayList<>(2);
if (!instance.isDefault()) {
ids.add(instance.value());
}
if (!"default".equals(endpoint.endpointId())) {
ids.add(endpoint.endpointId());
}
return ids;
}
private static class InstanceEndpoint {
private final InstanceName instance;
private final String endpointId;
public InstanceEndpoint(InstanceName instance, String endpointId) {
this.instance = instance;
this.endpointId = endpointId;
}
}
}
|
