ArchiveService no longer needs list of tenant IAM roles for Athenz tenants
@@ -3,24 +3,20 @@ package com.yahoo.vespa.hosted.controller.maintenance;
import com.google.common.collect.Maps;
import com.yahoo.config.provision.TenantName;
-import com.yahoo.config.provision.zone.ZoneApi;
import com.yahoo.config.provision.zone.ZoneId;
import com.yahoo.jdisc.Metric;
import com.yahoo.vespa.flags.BooleanFlag;
-import com.yahoo.vespa.flags.FetchVector;
import com.yahoo.vespa.flags.Flags;
import com.yahoo.vespa.hosted.controller.Controller;
import com.yahoo.vespa.hosted.controller.api.integration.archive.ArchiveService;
import com.yahoo.vespa.hosted.controller.api.integration.zone.ZoneRegistry;
import com.yahoo.vespa.hosted.controller.archive.CuratorArchiveBucketDb;
-import com.yahoo.vespa.hosted.controller.tenant.AthenzTenant;
import com.yahoo.vespa.hosted.controller.tenant.CloudTenant;
import com.yahoo.vespa.hosted.controller.tenant.Tenant;
import java.time.Duration;
import java.util.List;
import java.util.Map;
-import java.util.function.Function;
import java.util.stream.Collectors;
/**
@@ -60,7 +56,7 @@ public class ArchiveAccessMaintainer extends ControllerMaintainer {
zoneRegistry.zones().controllerUpgraded().zones().forEach(z -> {
ZoneId zoneId = z.getId();
try {
- var tenantArchiveAccessRoles = tenantArchiveAccessRoles(z);
+ var tenantArchiveAccessRoles = cloudTenantArchiveExternalAccessRoles();
archiveBucketDb.buckets(zoneId).forEach(archiveBucket ->
archiveService.updateBucketAndKeyPolicy(zoneId, archiveBucket,
Maps.filterEntries(tenantArchiveAccessRoles,
@@ -75,30 +71,14 @@ public class ArchiveAccessMaintainer extends ControllerMaintainer {
return 1.0;
}
- private Map<TenantName, String> tenantArchiveAccessRoles(ZoneApi zone) {
+ private Map<TenantName, String> cloudTenantArchiveExternalAccessRoles() {
List<Tenant> tenants = controller().tenants().asList();
- if (zoneRegistry.system().isPublic()) {
return tenants.stream()
.filter(t -> t instanceof CloudTenant)
.map(t -> (CloudTenant) t)
.filter(t -> t.archiveAccessRole().isPresent())
.collect(Collectors.toUnmodifiableMap(
Tenant::name, cloudTenant -> cloudTenant.archiveAccessRole().orElseThrow()));
- } else {
- return tenants.stream()
- .filter(t -> t instanceof AthenzTenant
- && enabled(archiveEnabled, t, zone) && enabled(developerRoleEnabled, t, zone))
- .map(Tenant::name)
- .collect(Collectors.toUnmodifiableMap(
- Function.identity(), t -> zoneRegistry.tenantDeveloperRoleArn(t).orElseThrow()));
-
- }
- }
-
- private boolean enabled(BooleanFlag flag, Tenant tenant, ZoneApi zone) {
- return flag.with(FetchVector.Dimension.TENANT_ID, tenant.name().value())
- .with(FetchVector.Dimension.ZONE_ID, zone.getId().value())
- .value();
}
}
