IdentityDocumentGenerator { public SignedIdentityDocument generateSignedIdentityDocument(String hostname, IdentityType identityType) { try { Node node = nodeRepository.getNode(hostname).orElseThrow(() -> new RuntimeException("Unable to find node " + hostname)); Allocation allocation = node.allocation().orElseThrow(() -> new RuntimeException("No allocation for node " + node.hostname())); VespaUniqueInstanceId providerUniqueId = new VespaUniqueInstanceId( allocation.membership().index(), allocation.membership().cluster().id().value(), allocation.owner().instance().value(), allocation.owner().application().value(), allocation.owner().tenant().value(), zone.region().value(), zone.environment().value(), identityType); Set<String> ips = new HashSet<>(node.ipConfig().primary()); PrivateKey privateKey = keyProvider.getPrivateKey(athenzProviderServiceConfig.secretVersion()); AthenzService providerService = new AthenzService(athenzProviderServiceConfig.domain(), athenzProviderServiceConfig.serviceName()); String configServerHostname = HostName.getLocalhost(); Instant createdAt = Instant.now(); String signature = signer.generateSignature( providerUniqueId, providerService, configServerHostname, node.hostname(), createdAt, ips, identityType, privateKey); return new SignedIdentityDocument( signature, SignedIdentityDocument.DEFAULT_KEY_VERSION, providerUniqueId, providerService, SignedIdentityDocument.DEFAULT_DOCUMENT_VERSION, configServerHostname, node.hostname(), createdAt, ips, identityType); } catch (Exception e) { throw new RuntimeException("Exception generating identity document: " + e.getMessage(), e); } } @Inject  IdentityDocumentGenerator(AthenzProviderServiceConfig config,
                                     NodeRepository nodeRepository,
                                     Zone zone,
                                     KeyProvider keyProvider); SignedIdentityDocument generateSignedIdentityDocument(String hostname, IdentityType identityType);  }
@Test public void generates_valid_identity_document() { String parentHostname = "docker-host"; String containerHostname = "docker-container"; ApplicationId appid = ApplicationId.from( TenantName.from("tenant"), ApplicationName.from("application"), InstanceName.from("default")); Allocation allocation = new Allocation(appid, ClusterMembership.from("container/default/0/0", Version.fromString("1.2.3"), Optional.empty()), new NodeResources(1, 1, 1, 1), Generation.initial(), false); Node parentNode = Node.create("ostkid", new IP.Config(Set.of("127.0.0.1"), Set.of()), parentHostname, Optional.empty(), Optional.empty(), new MockNodeFlavors().getFlavorOrThrow("default"), Optional.empty(), NodeType.host, Optional.empty()); Node containerNode = Node.createDockerNode(Set.of("::1"), containerHostname, parentHostname, new MockNodeFlavors().getFlavorOrThrow("default").resources(), NodeType.tenant) .with(allocation); NodeRepository nodeRepository = mock(NodeRepository.class); when(nodeRepository.getNode(eq(parentHostname))).thenReturn(Optional.of(parentNode)); when(nodeRepository.getNode(eq(containerHostname))).thenReturn(Optional.of(containerNode)); AutoGeneratedKeyProvider keyProvider = new AutoGeneratedKeyProvider(); String dnsSuffix = "vespa.dns.suffix"; AthenzProviderServiceConfig config = getAthenzProviderConfig("domain", "service", dnsSuffix); IdentityDocumentGenerator identityDocumentGenerator = new IdentityDocumentGenerator(config, nodeRepository, ZONE, keyProvider); SignedIdentityDocument signedIdentityDocument = identityDocumentGenerator.generateSignedIdentityDocument(containerHostname, IdentityType.TENANT); assertEquals(containerHostname, signedIdentityDocument.instanceHostname()); String environment = "dev"; String region = "us-north-1"; VespaUniqueInstanceId expectedProviderUniqueId = new VespaUniqueInstanceId(0, "default", "default", "application", "tenant", region, environment, IdentityType.TENANT); assertEquals(expectedProviderUniqueId, signedIdentityDocument.providerUniqueId()); assertTrue(signedIdentityDocument.ipAddresses().contains("::1")); IdentityDocumentSigner signer = new IdentityDocumentSigner(); assertTrue(signer.hasValidSignature(signedIdentityDocument, keyProvider.getPublicKey(0))); }