store ACL Accessor ID from Job.Register with Job (#8204)

In multiregion deployments when ACLs are enabled, the deploymentwatcher needs
an appropriately scoped ACL token with the same `submit-job` rights as the
user who submitted it. The token will already be replicated, so store the
accessor ID so that it can be retrieved by the leader.

api/jobs.go

@@ -787,6 +787,7 @@ type Job struct {
 	Meta              map[string]string
 	ConsulToken       *string `mapstructure:"consul_token"`
 	VaultToken        *string `mapstructure:"vault_token"`
+	NomadTokenID      *string `mapstructure:"nomad_token_id"`
 	Status            *string
 	StatusDescription *string
 	Stable            *bool
@@ -849,6 +850,9 @@ func (j *Job) Canonicalize() {
 	if j.VaultToken == nil {
 		j.VaultToken = stringToPtr("")
 	}
+	if j.NomadTokenID == nil {
+		j.NomadTokenID = stringToPtr("")
+	}
 	if j.Status == nil {
 		j.Status = stringToPtr("")
 	}

api/jobs_test.go

@@ -243,6 +243,7 @@ func TestJobs_Canonicalize(t *testing.T) {
 				AllAtOnce:         boolToPtr(false),
 				ConsulToken:       stringToPtr(""),
 				VaultToken:        stringToPtr(""),
+				NomadTokenID:      stringToPtr(""),
 				Status:            stringToPtr(""),
 				StatusDescription: stringToPtr(""),
 				Stop:              boolToPtr(false),
@@ -332,6 +333,7 @@ func TestJobs_Canonicalize(t *testing.T) {
 				AllAtOnce:         boolToPtr(false),
 				ConsulToken:       stringToPtr(""),
 				VaultToken:        stringToPtr(""),
+				NomadTokenID:      stringToPtr(""),
 				Status:            stringToPtr(""),
 				StatusDescription: stringToPtr(""),
 				Stop:              boolToPtr(false),
@@ -404,6 +406,7 @@ func TestJobs_Canonicalize(t *testing.T) {
 				AllAtOnce:         boolToPtr(false),
 				ConsulToken:       stringToPtr(""),
 				VaultToken:        stringToPtr(""),
+				NomadTokenID:      stringToPtr(""),
 				Stop:              boolToPtr(false),
 				Stable:            boolToPtr(false),
 				Version:           uint64ToPtr(0),
@@ -569,6 +572,7 @@ func TestJobs_Canonicalize(t *testing.T) {
 				AllAtOnce:         boolToPtr(false),
 				ConsulToken:       stringToPtr(""),
 				VaultToken:        stringToPtr(""),
+				NomadTokenID:      stringToPtr(""),
 				Stop:              boolToPtr(false),
 				Stable:            boolToPtr(false),
 				Version:           uint64ToPtr(0),
@@ -726,6 +730,7 @@ func TestJobs_Canonicalize(t *testing.T) {
 				AllAtOnce:         boolToPtr(false),
 				ConsulToken:       stringToPtr(""),
 				VaultToken:        stringToPtr(""),
+				NomadTokenID:      stringToPtr(""),
 				Stop:              boolToPtr(false),
 				Stable:            boolToPtr(false),
 				Version:           uint64ToPtr(0),
@@ -811,6 +816,7 @@ func TestJobs_Canonicalize(t *testing.T) {
 				AllAtOnce:         boolToPtr(false),
 				ConsulToken:       stringToPtr(""),
 				VaultToken:        stringToPtr(""),
+				NomadTokenID:      stringToPtr(""),
 				Stop:              boolToPtr(false),
 				Stable:            boolToPtr(false),
 				Version:           uint64ToPtr(0),
@@ -975,6 +981,7 @@ func TestJobs_Canonicalize(t *testing.T) {
 				AllAtOnce:         boolToPtr(false),
 				ConsulToken:       stringToPtr(""),
 				VaultToken:        stringToPtr(""),
+				NomadTokenID:      stringToPtr(""),
 				Stop:              boolToPtr(false),
 				Stable:            boolToPtr(false),
 				Version:           uint64ToPtr(0),
@@ -1137,6 +1144,7 @@ func TestJobs_Canonicalize(t *testing.T) {
 				AllAtOnce:         boolToPtr(false),
 				ConsulToken:       stringToPtr(""),
 				VaultToken:        stringToPtr(""),
+				NomadTokenID:      stringToPtr(""),
 				Stop:              boolToPtr(false),
 				Stable:            boolToPtr(false),
 				Version:           uint64ToPtr(0),

nomad/job_endpoint.go

@@ -96,6 +96,16 @@ func (j *Job) Register(args *structs.JobRegisterRequest, reply *structs.JobRegis
 	}
 	args.Job = job
 
+	// Attach the Nomad token's accessor ID so that deploymentwatcher
+	// can reference the token later
+	tokenID, err := j.srv.ResolveSecretToken(args.AuthToken)
+	if err != nil {
+		return err
+	}
+	if tokenID != nil {
+		args.Job.NomadTokenID = tokenID.AccessorID
+	}
+
 	// Set the warning message
 	reply.Warnings = structs.MergeMultierrorWarnings(warnings...)
 

nomad/structs/structs.go

@@ -3631,6 +3631,10 @@ type Job struct {
 	// transfer the token and is not stored after Job submission.
 	VaultToken string
 
+	// NomadTokenID is the Accessor ID of the ACL token (if any)
+	// used to register this version of the job. Used by deploymentwatcher.
+	NomadTokenID string
+
 	// Job status
 	Status string