Files
nomad/command
Tim Gross 4de1665942 consul: improve reliability of deregistration (#24166)
When the local Consul agent receives a deregister request, it performs a
pre-flight check using the locally cached ACL token. The agent then sends the
request upstream to the Consul servers as part of anti-entropy, using its own
token. This requires that the token we use for deregistration is valid even
though that's not the token used to write to the Consul server.

There are several cases where the service identity token might no longer exist
at the time of deregistration:
* A race condition between the sync and destroying the allocation.
* Misconfiguration of the Consul auth method with a TTL.
* Out-of-band destruction of the token.

Additionally, Nomad's sync with Consul returns early if there are any errors,
which means that a single broken token can prevent any other service on the
Nomad agent from being registered or deregistered.

Update Nomad's sync with Consul to use the Nomad agent's own Consul token for
deregistration, regardless of which token the service was registered
with. Accumulate errors from the sync so that they no longer block
deregistration of other services.

Fixes: https://github.com/hashicorp/nomad/issues/20159
2024-10-11 12:32:23 -04:00
..
2023-10-20 13:05:55 -04:00
2023-10-20 13:05:55 -04:00
2024-03-11 08:52:08 +00:00
2024-09-25 19:59:16 -04:00
2024-09-25 19:59:16 -04:00
2023-11-02 09:02:07 +01:00