Merge lp://staging/~axwalk/juju-core/lp1281071-rsyslog-worker-tls into lp://staging/~go-bot/juju-core/trunk
| Status: | Merged | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Approved by: | Andrew Wilkins | ||||||||
| Approved revision: | no longer in the source branch. | ||||||||
| Merged at revision: | 2364 | ||||||||
| Proposed branch: | lp://staging/~axwalk/juju-core/lp1281071-rsyslog-worker-tls | ||||||||
| Merge into: | lp://staging/~go-bot/juju-core/trunk | ||||||||
| Prerequisite: | lp://staging/~axwalk/juju-core/remove-syslog-cloudinit-config | ||||||||
| Diff against target: |
1452 lines (+1008/-32) 27 files modified
cmd/jujud/agent.go (+18/-0) cmd/jujud/machine.go (+12/-0) cmd/jujud/machine_test.go (+27/-0) cmd/jujud/unit.go (+4/-0) cmd/jujud/unit_test.go (+22/-0) environs/cloudinit/cloudinit.go (+1/-0) environs/config/config.go (+14/-2) log/syslog/config.go (+73/-19) log/syslog/config_test.go (+1/-0) log/syslog/testing/syslogconf.go (+21/-4) provider/local/config.go (+0/-1) provider/local/environ.go (+9/-5) state/api/params/params.go (+5/-0) state/api/rsyslog/package_test.go (+14/-0) state/api/rsyslog/rsyslog.go (+44/-0) state/api/rsyslog/rsyslog_test.go (+35/-0) state/api/state.go (+6/-0) state/apiserver/root.go (+12/-0) state/apiserver/rsyslog/package_test.go (+14/-0) state/apiserver/rsyslog/rsyslog.go (+56/-0) state/apiserver/rsyslog/rsyslog_test.go (+82/-0) upgrades/rsysloggnutls.go (+14/-0) upgrades/steps118.go (+5/-0) upgrades/steps118_test.go (+2/-1) worker/rsyslog/export_test.go (+12/-0) worker/rsyslog/rsyslog_test.go (+248/-0) worker/rsyslog/worker.go (+257/-0) |
||||||||
| To merge this branch: | bzr merge lp://staging/~axwalk/juju-core/lp1281071-rsyslog-worker-tls | ||||||||
| Related bugs: |
|
| Reviewer | Review Type | Date Requested | Status |
|---|---|---|---|
| Juju Engineering | Pending | ||
|
Review via email:
|
|||
Commit message
Implement rsyslog TLS support
This changes the rsyslog configuration
we generate to use TLS. We install the
rsyslog-gnutls package and generate a
new CA cert, server cert and key
specifically for rsyslog.
This completely changes the way rsyslog
configuration is managed. Now, instead
of writing at bootstrap time and having
an upgrade step, we have a worker that
writes the syslog config whenever syslog
parameters change. The state server will
generate certificates and propagate the
CA cert to other agents via environ config.
There are some other miscellaneous changes:
- we now use reliable forwarding, as
otherwise the machine agent and unit
agent will restart rsyslog while
log messages are buffered causing
message loss
- dedicated upgrades for rsyslog are
redundant and removed. The new worker
upgrades machine and unit agent rsyslog
automatically.
- syslog-port can now be changed, and must
be changed to work around the privilege
drop race in rsyslog 5.x (this is the
sole motivation)
- the local provider symlinks machine-0.log
into /var/log/
do not need any configuration other than
the existing namespace to determine log
location
Fixes lp:1281071
Fixes lp:1284020
Description of the change
Implement rsyslog TLS support
This changes the rsyslog configuration
we generate to use TLS. We install the
rsyslog-gnutls package and generate a
new CA cert, server cert and key
specifically for rsyslog.
This completely changes the way rsyslog
configuration is managed. Now, instead
of writing at bootstrap time and having
an upgrade step, we have a worker that
writes the syslog config whenever syslog
parameters change. The state server will
generate certificates and propagate the
CA cert to other agents via environ config.
There are some other miscellaneous changes:
- we now use reliable forwarding, as
otherwise the machine agent and unit
agent will restart rsyslog while
log messages are buffered causing
message loss
- dedicated upgrades for rsyslog are
redundant and removed. The new worker
upgrades machine and unit agent rsyslog
automatically.
- syslog-port can now be changed, and must
be changed to work around the privilege
drop race in rsyslog 5.x (this is the
sole motivation)
- the local provider symlinks machine-0.log
into /var/log/
do not need any configuration other than
the existing namespace to determine log
location
Fixes lp:1281071
Fixes lp:1284020
| Andrew Wilkins (axwalk) wrote | # |
| Andrew Wilkins (axwalk) wrote | # |
| Tim Penhey (thumper) wrote | # |
| Andrew Wilkins (axwalk) wrote | # |
| Go Bot (go-bot) wrote | # |
| Go Bot (go-bot) wrote | # |
| Go Bot (go-bot) wrote | # |
Reviewers: mp+208531_
Message:
Please take a look.
Description:
Implement rsyslog TLS support
This changes the rsyslog configuration
we generate to use TLS. We install the
rsyslog-gnutls package and generate a
new CA cert, server cert and key
specifically for rsyslog.
This completely changes the way rsyslog
configuration is managed. Now, instead
of writing at bootstrap time and having
an upgrade step, we have a worker that
writes the syslog config whenever syslog
parameters change. The state server will
generate certificates and propagate the
CA cert to other agents via environ config.
There are some other miscellaneous changes:
- we now use reliable forwarding, as
otherwise the machine agent and unit
agent will restart rsyslog while
log messages are buffered causing
message loss
- dedicated upgrades for rsyslog are
redundant and removed. The new worker
upgrades machine and unit agent rsyslog
automatically.
- syslog-port can now be changed, and must
be changed to work around the privilege
drop race in rsyslog 5.x (this is the
sole motivation)
- the local provider symlinks machine-0.log
into /var/log/
do not need any configuration other than
the existing namespace to determine log
location
Fixes lp:1281071
Fixes lp:1284020
https:/
Requires:
https:/
(do not edit description out of merge proposal)
Please review this at https:/
Affected files (+1011, -32 lines):
A [revision details]
M cmd/jujud/agent.go
M cmd/jujud/
M cmd/jujud/
M cmd/jujud/unit.go
M cmd/jujud/
M environs/
M environs/
M log/syslog/
M log/syslog/
M log/syslog/
M provider/
M provider/
M state/api/
A state/api/
A state/api/
A state/api/
M state/api/state.go
M state/apiserver
A state/apiserver
A state/apiserver
A state/apiserver
A upgrades/
M upgrades/
M upgrades/
A worker/
A worker/
A worker/