add ttl validation tests

nomad/structs/workload_id.go

@@ -173,7 +173,7 @@ func (wi *WorkloadIdentity) Warnings() error {
 		mErr.Errors = append(mErr.Errors, fmt.Errorf("while multiple audiences is allowed, it is more secure to use 1 audience per identity"))
 	}
 
-	if wi.Name != "" || wi.Name != WorkloadIdentityDefaultName {
+	if wi.Name != "" && wi.Name != WorkloadIdentityDefaultName {
 		if wi.TTL == 0 {
 			mErr.Errors = append(mErr.Errors, fmt.Errorf("identities without an expiration are insecure"))
 		}

nomad/structs/workload_id_test.go

@@ -6,6 +6,7 @@ package structs
 import (
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/hashicorp/nomad/ci"
 	"github.com/shoenig/test/must"
@@ -45,6 +46,12 @@ func TestWorkloadIdentity_Equal(t *testing.T) {
 
 	newWI.Audience = []string{"foo"}
 	must.NotEqual(t, orig, newWI)
+
+	newWI.Audience = orig.Audience
+	must.Equal(t, orig, newWI)
+
+	newWI.TTL = 123 * time.Hour
+	must.NotEqual(t, orig, newWI)
 }
 
 // TestWorkloadIdentity_Validate asserts that canonicalized workload identities
@@ -84,12 +91,14 @@ func TestWorkloadIdentity_Validate(t *testing.T) {
 				Audience: []string{"http://nomadproject.io/"},
 				Env:      true,
 				File:     true,
+				TTL:      time.Hour,
 			},
 			Exp: WorkloadIdentity{
 				Name:     "foo-id",
 				Audience: []string{"http://nomadproject.io/"},
 				Env:      true,
 				File:     true,
+				TTL:      time.Hour,
 			},
 		},
 		{
@@ -143,6 +152,26 @@ func TestWorkloadIdentity_Validate(t *testing.T) {
 			},
 			Warn: "while multiple audiences is allowed, it is more secure to use 1 audience per identity",
 		},
+		{
+			Desc: "Bad TTL",
+			In: WorkloadIdentity{
+				Name: "foo",
+				TTL:  -1 * time.Hour,
+			},
+			Err: "ttl must be >= 0",
+		},
+		{
+			Desc: "No TTL",
+			In: WorkloadIdentity{
+				Name:     "foo",
+				Audience: []string{"foo"},
+			},
+			Exp: WorkloadIdentity{
+				Name:     "foo",
+				Audience: []string{"foo"},
+			},
+			Warn: "identities without an expiration are insecure",
+		},
 	}
 
 	for _, tc := range cases {