Merge pull request #7127 from hashicorp/b-unset-ct

nomad: unset consul token on job register

Author: shoenig

nomad/job_endpoint.go

@@ -256,6 +256,9 @@ func (j *Job) Register(args *structs.JobRegisterRequest, reply *structs.JobRegis
 	// Clear the Vault token
 	args.Job.VaultToken = ""
 
+	// Clear the Consul token
+	args.Job.ConsulToken = ""
+
 	// Check if the job has changed at all
 	if existingJob == nil || existingJob.SpecChanged(args.Job) {
 		// Set the submit time

nomad/job_endpoint_test.go

@@ -317,6 +317,15 @@ func TestJobEndpoint_Register_Connect_AllowUnauthenticatedFalse(t *testing.T) {
 		}
 	}
 
+	noTokenOnJob := func(t *testing.T) {
+		fsmState := s1.State()
+		ws := memdb.NewWatchSet()
+		storedJob, err := fsmState.JobByID(ws, job.Namespace, job.ID)
+		require.NoError(t, err)
+		require.NotNil(t, storedJob)
+		require.Empty(t, storedJob.ConsulToken)
+	}
+
 	// Each variation of the provided Consul operator token
 	noOpToken := ""
 	unrecognizedOpToken := uuid.Generate()
@@ -353,6 +362,7 @@ func TestJobEndpoint_Register_Connect_AllowUnauthenticatedFalse(t *testing.T) {
 		var response structs.JobRegisterResponse
 		err := msgpackrpc.CallWithCodec(codec, "Job.Register", request, &response)
 		require.NoError(t, err)
+		noTokenOnJob(t)
 	})
 }