Implement rsyslog TLS support

Implement rsyslog TLS support

This changes the rsyslog configuration
we generate to use TLS. We install the
rsyslog-gnutls package and generate a
new CA cert, server cert and key
specifically for rsyslog.

This completely changes the way rsyslog
configuration is managed. Now, instead
of writing at bootstrap time and having
an upgrade step, we have a worker that
writes the syslog config whenever syslog
parameters change. The state server will
generate certificates and propagate the
CA cert to other agents via environ config.

There are some other miscellaneous changes:
  - we now use reliable forwarding, as
    otherwise the machine agent and unit
    agent will restart rsyslog while
    log messages are buffered causing
    message loss
  - dedicated upgrades for rsyslog are
    redundant and removed. The new worker
    upgrades machine and unit agent rsyslog
    automatically.
  - syslog-port can now be changed, and must
    be changed to work around the privilege
    drop race in rsyslog 5.x (this is the
    sole motivation)
  - the local provider symlinks machine-0.log
    into /var/log/juju$namespace so that we
    do not need any configuration other than
    the existing namespace to determine log
    location

Fixes lp:1281071
Fixes lp:1284020

https://code.launchpad.net/~axwalk/juju-core/lp1281071-rsyslog-worker-tls/+merge/208531

Requires: https://code.launchpad.net/~axwalk/juju-core/remove-syslog-cloudinit-config/+merge/208278

(do not edit description out of merge proposal)

[axw, 2014-02-27 05:39:18]

Please take a look.

[axw, 2014-02-27 05:50:02]

Please take a look.

[thumper, 2014-02-27 06:22:38]

LGTM

Initially thought this would clash with Ian's work, but appears not.

https://codereview.appspot.com/68930045/diff/20001/cmd/jujud/unit.go
File cmd/jujud/unit.go (right):

https://codereview.appspot.com/68930045/diff/20001/cmd/jujud/unit.go#newcode98
cmd/jujud/unit.go:98: runner.StartWorker("rsyslog", func() (worker.Worker,
error) {
Hmm... the sooner we can merge the unit agent and the machine agent the better I
think.

https://codereview.appspot.com/68930045/diff/20001/log/syslog/config.go
File log/syslog/config.go (right):

https://codereview.appspot.com/68930045/diff/20001/log/syslog/config.go#newco...
log/syslog/config.go:57: $DefaultNetstreamDriverCAFile {{tlsCACertPath}}
I know all this is going to conflict with Ian's branch we he changes the
behaviour to use a struct.

https://codereview.appspot.com/68930045/diff/20001/log/syslog/testing/syslogc...
File log/syslog/testing/syslogconf.go (right):

https://codereview.appspot.com/68930045/diff/20001/log/syslog/testing/syslogc...
log/syslog/testing/syslogconf.go:18: $InputFileName
/var/log/juju{{.Namespace}}/{{.MachineTag}}.log
Ah... maybe not then.

https://codereview.appspot.com/68930045/diff/20001/worker/rsyslog/worker.go
File worker/rsyslog/worker.go (right):

https://codereview.appspot.com/68930045/diff/20001/worker/rsyslog/worker.go#n...
worker/rsyslog/worker.go:175: var lookupUser = func(username string) (uid, gid
int, err error) {
useful elsewhere?

[axw, 2014-02-27 07:02:49]

https://codereview.appspot.com/68930045/diff/20001/log/syslog/config.go
File log/syslog/config.go (right):

https://codereview.appspot.com/68930045/diff/20001/log/syslog/config.go#newco...
log/syslog/config.go:57: $DefaultNetstreamDriverCAFile {{tlsCACertPath}}
On 2014/02/27 06:22:38, thumper wrote:
> I know all this is going to conflict with Ian's branch we he changes the
> behaviour to use a struct.

Nah, Ian's stuff just changed the tests. We should probably do the same thing
here, but really it's not that important.

https://codereview.appspot.com/68930045/diff/20001/worker/rsyslog/worker.go
File worker/rsyslog/worker.go (right):

https://codereview.appspot.com/68930045/diff/20001/worker/rsyslog/worker.go#n...
worker/rsyslog/worker.go:175: var lookupUser = func(username string) (uid, gid
int, err error) {
On 2014/02/27 06:22:38, thumper wrote:
> useful elsewhere?

I'd rather not institutionalise it, because this will only work on *Nix (other
OSes, such as Windows, may have non-integer Uid/Gid). I'll keep an eye out for
people doing the same thing.