fix: consul service deregister w/ sunken tokens

pkgs/consul/0001-state-deregister-service-with-sunken-token.patch

@@ -0,0 +1,66 @@
+From 263b1ed5d4ce59abc1359663f0b0e1dd3a0563dd Mon Sep 17 00:00:00 2001
+From: David Arnold <david.arnold@iohk.io>
+Date: Tue, 15 Mar 2022 15:20:45 -0500
+Subject: [PATCH] state: deregister service with sunken token
+
+fixes: #12145
+---
+ agent/local/state.go | 35 +++++++++++++++++++++++++++++++++--
+ 1 file changed, 33 insertions(+), 2 deletions(-)
+
+diff --git a/agent/local/state.go b/agent/local/state.go
+index 8427068d7..ec8f1bcaf 100644
+--- a/agent/local/state.go
++++ b/agent/local/state.go
+@@ -1287,6 +1287,13 @@ func (l *State) deleteService(key structs.ServiceID) error {
+ 		EnterpriseMeta: key.EnterpriseMeta,
+ 		WriteRequest:   structs.WriteRequest{Token: st},
+ 	}
++	fallback_req := structs.DeregisterRequest{
++		Datacenter:     l.config.Datacenter,
++		Node:           l.config.NodeName,
++		ServiceID:      key.ID,
++		EnterpriseMeta: key.EnterpriseMeta,
++		WriteRequest:   structs.WriteRequest{Token: l.tokens.AgentToken()},
++	}
+ 	var out struct{}
+ 	err := l.Delegate.RPC("Catalog.Deregister", &req, &out)
+ 	switch {
+@@ -1303,8 +1310,32 @@ func (l *State) deleteService(key structs.ServiceID) error {
+ 		}
+ 		l.logger.Info("Deregistered service", "service", key.ID)
+ 		return nil
+-
+-	case acl.IsErrPermissionDenied(err), acl.IsErrNotFound(err):
++	case acl.IsErrNotFound(err):
++    		// token might have sunken already, fallback to the default token
++        	var out struct{}
++        	err := l.Delegate.RPC("Catalog.Deregister", &fallback_req, &out)
++        	switch {
++        	case err == nil:
++        		delete(l.services, key)
++        		// service deregister also deletes associated checks
++        		for _, c := range l.checks {
++        			if c.Deleted && c.Check != nil {
++        				sid := c.Check.CompoundServiceID()
++        				if sid.Matches(key) {
++        					l.pruneCheck(c.Check.CompoundCheckID())
++        				}
++        			}
++        		}
++        		l.logger.Info("Deregistered service", "service", key.ID)
++        		return nil
++        	default:
++        		l.logger.Warn("Deregistering service failed.",
++        			"service", key.String(),
++        			"error", err,
++        		)
++        		return err
++        	}
++	case acl.IsErrPermissionDenied(err):
+ 		// todo(fs): mark the service to be in sync to prevent excessive retrying before next full sync
+ 		// todo(fs): some backoff strategy might be a better solution
+ 		l.services[key].InSync = true
+-- 
+2.33.1
+

pkgs/consul/default.nix

@@ -27,6 +27,8 @@ buildGoModule rec {
     #   https://github.com/hashicorp/consul/issues/8283
     #   https://github.com/hashicorp/consul/pull/9639
     ./consul-issue-8283.patch
+    # https://github.com/hashicorp/consul/issues/12145
+    ./0001-state-deregister-service-with-sunken-token.patch
   ];
 
   passthru.tests.consul = nixosTests.consul;