Code review comment: We should make deployment fail on failed role creation.

Code before review:
public ActivateResult deploy2(JobId job, boolean deploySourceVersions) {
if (job.application().instance().isTester())
throw new IllegalArgumentException("'" + job.application() + "' is a tester application!");
TenantAndApplicationId applicationId = TenantAndApplicationId.from(job.application());
ZoneId zone = job.type().zone(controller.system());
try (Lock deploymentLock = lockForDeployment(job.application(), zone)) {
Set<ContainerEndpoint> endpoints;
Optional<EndpointCertificateMetadata> endpointCertificateMetadata;
Optional<ApplicationRoles> applicationRoles = Optional.empty();
Run run = controller.jobController().last(job)
.orElseThrow(() -> new IllegalStateException("No known run of '" + job + "'"));
if (run.hasEnded())
throw new IllegalStateException("No deployment expected for " + job + " now, as no job is running");
Version platform = run.versions().sourcePlatform().filter(__ -> deploySourceVersions).orElse(run.versions().targetPlatform());
ApplicationVersion revision = run.versions().sourceApplication().filter(__ -> deploySourceVersions).orElse(run.versions().targetApplication());
ApplicationPackage applicationPackage = getApplicationPackage(job.application(), zone, revision);
try (Lock lock = lock(applicationId)) {
LockedApplication application = new LockedApplication(requireApplication(applicationId), lock);
Instance instance = application.get().require(job.application().instance());
Deployment deployment = instance.deployments().get(zone);
if (   zone.environment().isProduction() && deployment != null
&& (   platform.compareTo(deployment.version()) < 0 && ! instance.change().isPinned()
|| revision.compareTo(deployment.applicationVersion()) < 0 && ! (revision.isUnknown() && controller.system().isCd())))
throw new IllegalArgumentException(String.format("Rejecting deployment of application %s to %s, as the requested versions (platform: %s, application: %s)" +
" are older than the currently deployed (platform: %s, application: %s).",
job.application(), zone, platform, revision, deployment.version(), deployment.applicationVersion()));
if (   ! applicationPackage.trustedCertificates().isEmpty()
&&   run.testerCertificate().isPresent())
applicationPackage = applicationPackage.withTrustedCertificate(run.testerCertificate().get());
endpointCertificateMetadata = endpointCertificateManager.getEndpointCertificateMetadata(instance, zone);
endpoints = controller.routing().registerEndpointsInDns(application.get(), job.application().instance(), zone);
if (provisionApplicationRoles.with(FetchVector.Dimension.ZONE_ID, zone.value()).value()) {
try {
applicationRoles = controller.serviceRegistry().applicationRoleService().createApplicationRoles(instance.id());
} catch (Exception e) {
log.log(Level.SEVERE, "Exception creating application roles for application: " + instance.id(), e);
}
}
}
ActivateResult result = deploy(job.application(), applicationPackage, zone, platform, endpoints, endpointCertificateMetadata, applicationRoles);
lockApplicationOrThrow(applicationId, application ->
store(application.with(job.application().instance(),
instance -> instance.withNewDeployment(zone, revision, platform,
clock.instant(), warningsFrom(result)))));
return result;
}
}

Line under review: log.log(Level.SEVERE, "Exception creating application roles for application: " + instance.id(), e);

Code after addressing the review:
public ActivateResult deploy2(JobId job, boolean deploySourceVersions) {
if (job.application().instance().isTester())
throw new IllegalArgumentException("'" + job.application() + "' is a tester application!");
TenantAndApplicationId applicationId = TenantAndApplicationId.from(job.application());
ZoneId zone = job.type().zone(controller.system());
try (Lock deploymentLock = lockForDeployment(job.application(), zone)) {
Set<ContainerEndpoint> endpoints;
Optional<EndpointCertificateMetadata> endpointCertificateMetadata;
Optional<ApplicationRoles> applicationRoles = Optional.empty();
Run run = controller.jobController().last(job)
.orElseThrow(() -> new IllegalStateException("No known run of '" + job + "'"));
if (run.hasEnded())
throw new IllegalStateException("No deployment expected for " + job + " now, as no job is running");
Version platform = run.versions().sourcePlatform().filter(__ -> deploySourceVersions).orElse(run.versions().targetPlatform());
ApplicationVersion revision = run.versions().sourceApplication().filter(__ -> deploySourceVersions).orElse(run.versions().targetApplication());
ApplicationPackage applicationPackage = getApplicationPackage(job.application(), zone, revision);
try (Lock lock = lock(applicationId)) {
LockedApplication application = new LockedApplication(requireApplication(applicationId), lock);
Instance instance = application.get().require(job.application().instance());
Deployment deployment = instance.deployments().get(zone);
if (   zone.environment().isProduction() && deployment != null
&& (   platform.compareTo(deployment.version()) < 0 && ! instance.change().isPinned()
|| revision.compareTo(deployment.applicationVersion()) < 0 && ! (revision.isUnknown() && controller.system().isCd())))
throw new IllegalArgumentException(String.format("Rejecting deployment of application %s to %s, as the requested versions (platform: %s, application: %s)" +
" are older than the currently deployed (platform: %s, application: %s).",
job.application(), zone, platform, revision, deployment.version(), deployment.applicationVersion()));
if (   ! applicationPackage.trustedCertificates().isEmpty()
&&   run.testerCertificate().isPresent())
applicationPackage = applicationPackage.withTrustedCertificate(run.testerCertificate().get());
endpointCertificateMetadata = endpointCertificateManager.getEndpointCertificateMetadata(instance, zone);
endpoints = controller.routing().registerEndpointsInDns(application.get(), job.application().instance(), zone);
if (provisionApplicationRoles.with(FetchVector.Dimension.ZONE_ID, zone.value()).value()) {
try {
applicationRoles = controller.serviceRegistry().applicationRoleService().createApplicationRoles(instance.id());
} catch (Exception e) {
log.log(Level.SEVERE, "Exception creating application roles for application: " + instance.id(), e);
throw new RuntimeException("Unable to provision iam roles for application");
}
}
}
ActivateResult result = deploy(job.application(), applicationPackage, zone, platform, endpoints, endpointCertificateMetadata, applicationRoles);
lockApplicationOrThrow(applicationId, application ->
store(application.with(job.application().instance(),
instance -> instance.withNewDeployment(zone, revision, platform,
clock.instant(), warningsFrom(result)))));
return result;
}
}