Merge lp:~mfoord/juju-core/ha-rsyslog-api into lp:~go-bot/juju-core/trunk

[Michael Foord]

utils/syslog: update rsyslog conf

Update rsyslog configuration (and restart)
when the api servers change.

https://codereview.appspot.com/95390044/

[lp:~mfoord/juju-core/ha-rsyslog-api]

2731. By Michael Foord on 2014-05-14

Merge

2732. By Michael Foord on 2014-05-14

Test fixes - yay

2733. By Michael Foord on 2014-05-14

Merge plus fixes

2734. By Michael Foord on 2014-05-14

Expanded test for GetRsyslogConfig

2735. By Michael Foord on 2014-05-14

Comment fix

2736. By Michael Foord on 2014-05-14

Test WatchForRsyslogChanges

2737. By Michael Foord on 2014-05-14

Switch to watching APIHostPorts for RsyslogChanges API

2738. By Michael Foord on 2014-05-14

Test fixes

2739. By Michael Foord on 2014-05-14

Change to checking for MachineAgent authorization in the new API

2740. By Michael Foord on 2014-05-14

Fix build

2741. By Michael Foord on 2014-05-15

Merge

2742. By Michael Foord on 2014-05-15

Test fixes

2743. By Michael Foord on 2014-05-15

Test improvement and comment

2744. By Michael Foord on 2014-05-15

Merge

2745. By Michael Foord on 2014-05-15

Merge

2746. By Michael Foord on 2014-05-15

Remove debugging print

2747. By Michael Foord on 2014-05-15

Remove testing comments

2748. By Michael Foord on 2014-05-15

Add back in comments

2749. By Michael Foord on 2014-05-16

Merge

2750. By Michael Foord on 2014-05-19

Start using HostPorts in rsyslog template rendering

2751. By Michael Foord on 2014-05-19

Extract convenience function for building HostPorts

2752. By Michael Foord on 2014-05-19

Initial test tweaks

2753. By Michael Foord on 2014-05-21

Merge

Unmerged revisions

2753. By Michael Foord on 2014-05-21

Merge

2752. By Michael Foord on 2014-05-19

Initial test tweaks

2751. By Michael Foord on 2014-05-19

Extract convenience function for building HostPorts

2750. By Michael Foord on 2014-05-19

Start using HostPorts in rsyslog template rendering

2749. By Michael Foord on 2014-05-16

Merge

2748. By Michael Foord on 2014-05-15

Add back in comments

2747. By Michael Foord on 2014-05-15

Remove testing comments

2746. By Michael Foord on 2014-05-15

Remove debugging print

2745. By Michael Foord on 2014-05-15

Merge

2744. By Michael Foord on 2014-05-15

Merge

=== modified file 'cmd/jujud/agent.go'
--- cmd/jujud/agent.go	2014-05-14 21:13:17 +0000
+++ cmd/jujud/agent.go	2014-05-19 14:05:26 +0000
@@ -322,11 +322,7 @@
 var newRsyslogConfigWorker = func(st *apirsyslog.State, agentConfig agent.Config, mode rsyslog.RsyslogMode) (worker.Worker, error) {
 	tag := agentConfig.Tag()
 	namespace := agentConfig.Value(agent.Namespace)
-	addrs, err := agentConfig.APIAddresses()
-	if err != nil {
-		return nil, err
-	}
-	return rsyslog.NewRsyslogConfigWorker(st, mode, tag, namespace, addrs)
+	return rsyslog.NewRsyslogConfigWorker(st, mode, tag, namespace, []instance.HostPort{})
 }
 
 // hookExecutionLock returns an *fslock.Lock suitable for use as a unit

=== modified file 'instance/address.go'
--- instance/address.go	2014-05-01 00:54:26 +0000
+++ instance/address.go	2014-05-19 14:05:26 +0000
@@ -114,6 +114,13 @@
 	return outAddresses
 }
 
+//NewHostPorts is a convenience function to create HostPorts from a string
+//slice and port
+func NewHostPorts(inAddresses []string, port int) []HostPort {
+	addresses := NewAddresses(inAddresses...)
+	return AddressesWithPort(addresses, port)
+}
+
 func DeriveAddressType(value string) AddressType {
 	ip := net.ParseIP(value)
 	switch {

=== modified file 'state/api/params/params.go'
--- state/api/params/params.go	2014-05-09 13:24:50 +0000
+++ state/api/params/params.go	2014-05-19 14:05:26 +0000
@@ -681,6 +681,13 @@
 	CACert []byte
 }
 
+// RsyslogConfigResult holds the result of a GetRsyslogConfig call.
+type RsyslogConfigResult struct {
+	CACert    string
+	Port      int
+	HostPorts []instance.HostPort
+}
+
 // DistributionGroupResult contains the result of
 // the DistributionGroup provisioner API call.
 type DistributionGroupResult struct {

=== modified file 'state/api/rsyslog/rsyslog.go'
--- state/api/rsyslog/rsyslog.go	2014-04-11 17:51:58 +0000
+++ state/api/rsyslog/rsyslog.go	2014-05-19 14:05:26 +0000
@@ -4,25 +4,31 @@
 package rsyslog
 
 import (
+	"fmt"
+
+	"launchpad.net/juju-core/instance"
 	"launchpad.net/juju-core/state/api/base"
-	"launchpad.net/juju-core/state/api/common"
 	"launchpad.net/juju-core/state/api/params"
+	"launchpad.net/juju-core/state/api/watcher"
 )
 
 const rsyslogAPI = "Rsyslog"
 
+// RsyslogConfig holds the values needed for the rsyslog worker
+type RsyslogConfig struct {
+	CACert    string
+	Port      int
+	HostPorts []instance.HostPort
+}
+
 // State provides access to the Rsyslog API facade.
 type State struct {
-	*common.EnvironWatcher
 	caller base.Caller
 }
 
 // NewState creates a new client-side Rsyslog facade.
 func NewState(caller base.Caller) *State {
-	return &State{
-		EnvironWatcher: common.NewEnvironWatcher(rsyslogAPI, caller),
-		caller:         caller,
-	}
+	return &State{caller: caller}
 }
 
 // SetRsyslogCert sets the rsyslog CA certificate,
@@ -42,3 +48,42 @@
 	}
 	return nil
 }
+
+// WatchForRsyslogChanges returns a new NotifyWatcher.
+func (st *State) WatchForRsyslogChanges(agentTag string) (watcher.NotifyWatcher, error) {
+	var results params.NotifyWatchResults
+	args := params.Entities{
+		Entities: []params.Entity{{Tag: agentTag}},
+	}
+
+	err := st.caller.Call(rsyslogAPI, "", "WatchForRsyslogChanges", args, &results)
+	if err != nil {
+		// TODO: Not directly tested
+		return nil, err
+	}
+	if len(results.Results) != 1 {
+		// TODO: Not directly tested
+		return nil, fmt.Errorf("expected 1 result, got %d", len(results.Results))
+	}
+	result := results.Results[0]
+	if result.Error != nil {
+		//  TODO: Not directly tested
+		return nil, result.Error
+	}
+	w := watcher.NewNotifyWatcher(st.caller, result)
+	return w, nil
+}
+
+// GetRsyslogConfig returns a RsyslogConfig.
+func (st *State) GetRsyslogConfig() (*RsyslogConfig, error) {
+	var result params.RsyslogConfigResult
+	err := st.caller.Call(rsyslogAPI, "", "GetRsyslogConfig", nil, &result)
+	if err != nil {
+		return nil, err
+	}
+	return &RsyslogConfig{
+		CACert:    result.CACert,
+		Port:      result.Port,
+		HostPorts: result.HostPorts,
+	}, nil
+}

=== modified file 'state/api/rsyslog/rsyslog_test.go'
--- state/api/rsyslog/rsyslog_test.go	2014-03-21 18:02:23 +0000
+++ state/api/rsyslog/rsyslog_test.go	2014-05-19 14:05:26 +0000
@@ -5,14 +5,22 @@
 
 import (
 	gc "launchpad.net/gocheck"
+	"launchpad.net/juju-core/instance"
+	"launchpad.net/juju-core/juju/testing"
+	"launchpad.net/juju-core/state"
+	"launchpad.net/juju-core/state/api"
+	"launchpad.net/juju-core/state/api/rsyslog"
 
-	jujutesting "launchpad.net/juju-core/juju/testing"
-	apitesting "launchpad.net/juju-core/state/api/testing"
+	statetesting "launchpad.net/juju-core/state/testing"
+	coretesting "launchpad.net/juju-core/testing"
 )
 
 type rsyslogSuite struct {
-	jujutesting.JujuConnSuite
-	*apitesting.EnvironWatcherTests
+	testing.JujuConnSuite
+
+	st      *api.State
+	machine *state.Machine
+	rsyslog *rsyslog.State
 }
 
 var _ = gc.Suite(&rsyslogSuite{})
@@ -20,15 +28,51 @@
 func (s *rsyslogSuite) SetUpTest(c *gc.C) {
 	s.JujuConnSuite.SetUpTest(c)
 
-	stateAPI, _ := s.OpenAPIAsNewMachine(c)
-	rsyslogAPI := stateAPI.Rsyslog()
-	c.Assert(rsyslogAPI, gc.NotNil)
-
-	s.EnvironWatcherTests = apitesting.NewEnvironWatcherTests(
-		rsyslogAPI,
-		s.BackingState,
-		apitesting.NoSecrets,
-	)
+	s.st, s.machine = s.OpenAPIAsNewMachine(c, state.JobManageEnviron)
+	err := s.machine.SetAddresses(instance.NewAddress("0.1.2.3", instance.NetworkUnknown))
+	c.Assert(err, gc.IsNil)
+
+	// Create the rsyslog API facade
+	s.rsyslog = s.st.Rsyslog()
+	c.Assert(s.rsyslog, gc.NotNil)
+}
+
+func (s *rsyslogSuite) TestGetRsyslogConfig(c *gc.C) {
+	err := s.APIState.Client().EnvironmentSet(map[string]interface{}{"rsyslog-ca-cert": coretesting.CACert})
+	c.Assert(err, gc.IsNil)
+
+	cfg, err := s.rsyslog.GetRsyslogConfig()
+	c.Assert(err, gc.IsNil)
+	c.Assert(cfg, gc.NotNil)
+
+	c.Assert(cfg.CACert, gc.Equals, coretesting.CACert)
+	c.Assert(cfg.HostPorts, gc.HasLen, 1)
+	hostPort := cfg.HostPorts[0]
+	c.Assert(hostPort.Address.Value, gc.Equals, "0.1.2.3")
+
+	// the rsyslog port is set by the provider/dummy/environs.go
+	c.Assert(hostPort.Port, gc.Equals, 2345)
+}
+
+func (s *rsyslogSuite) TestWatchForRsyslogChanges(c *gc.C) {
+	w, err := s.rsyslog.WatchForRsyslogChanges(s.machine.Tag())
+	c.Assert(err, gc.IsNil)
+	defer statetesting.AssertStop(c, w)
+
+	wc := statetesting.NewNotifyWatcherC(c, s.BackingState, w)
+	// Initial event
+	wc.AssertOneChange()
+
+	// change the API HostPorts
+	newHostPorts := instance.AddressesWithPort(instance.NewAddresses("127.0.0.1"), 6541)
+	err = s.State.SetAPIHostPorts([][]instance.HostPort{newHostPorts})
+	c.Assert(err, gc.IsNil)
+
+	// assert we get notified
+	wc.AssertOneChange()
+
+	statetesting.AssertStop(c, w)
+	wc.AssertClosed()
 }
 
 // SetRsyslogCACert is tested in state/apiserver/rsyslog

=== added file 'state/apiserver/rsyslog/config.go'
--- state/apiserver/rsyslog/config.go	1970-01-01 00:00:00 +0000
+++ state/apiserver/rsyslog/config.go	2014-05-19 14:05:26 +0000
@@ -0,0 +1,33 @@
+package rsyslog
+
+import (
+	"net"
+
+	"launchpad.net/juju-core/environs/config"
+	"launchpad.net/juju-core/instance"
+	apirsyslog "launchpad.net/juju-core/state/api/rsyslog"
+)
+
+// newRsyslogConfig creates a new instance of the RsyslogConfig.
+func newRsyslogConfig(envCfg *config.Config, api *RsyslogAPI) (*apirsyslog.RsyslogConfig, error) {
+	stateAddrsResult, err := api.StateAddresser.StateAddresses()
+	if err != nil {
+		return nil, err
+	}
+	port := envCfg.SyslogPort()
+
+	var bareAddrs []string
+	for _, addr := range stateAddrsResult.Result {
+		hostOnly, _, err := net.SplitHostPort(addr)
+		if err != nil {
+			return nil, err
+		}
+		bareAddrs = append(bareAddrs, hostOnly)
+	}
+
+	return &apirsyslog.RsyslogConfig{
+		CACert:    envCfg.RsyslogCACert(),
+		Port:      port,
+		HostPorts: instance.NewHostPorts(bareAddrs, port),
+	}, nil
+}

=== modified file 'state/apiserver/rsyslog/rsyslog.go'
--- state/apiserver/rsyslog/rsyslog.go	2014-04-11 17:51:58 +0000
+++ state/apiserver/rsyslog/rsyslog.go	2014-05-19 14:05:26 +0000
@@ -8,17 +8,25 @@
 	"launchpad.net/juju-core/state"
 	"launchpad.net/juju-core/state/api/params"
 	"launchpad.net/juju-core/state/apiserver/common"
+	"launchpad.net/juju-core/state/watcher"
 )
 
 // RsyslogAPI implements the API used by the rsyslog worker.
 type RsyslogAPI struct {
 	*common.EnvironWatcher
-	st        *state.State
-	canModify bool
+
+	st             *state.State
+	resources      *common.Resources
+	authorizer     common.Authorizer
+	StateAddresser *common.StateAddresser
+	canModify      bool
 }
 
 // NewRsyslogAPI creates a new instance of the Rsyslog API.
 func NewRsyslogAPI(st *state.State, resources *common.Resources, authorizer common.Authorizer) (*RsyslogAPI, error) {
+	if !authorizer.AuthMachineAgent() && !authorizer.AuthUnitAgent() {
+		return nil, common.ErrPerm
+	}
 	// Can always watch for environ changes.
 	getCanWatch := common.AuthAlways(true)
 	// Does not get the secrets.
@@ -26,10 +34,14 @@
 	return &RsyslogAPI{
 		EnvironWatcher: common.NewEnvironWatcher(st, resources, getCanWatch, getCanReadSecrets),
 		st:             st,
+		authorizer:     authorizer,
+		resources:      resources,
 		canModify:      authorizer.AuthEnvironManager(),
+		StateAddresser: common.NewStateAddresser(st),
 	}, nil
 }
 
+// SetRsyslogCert sets the rsyslog CACert.
 func (api *RsyslogAPI) SetRsyslogCert(args params.SetRsyslogCertParams) (params.ErrorResult, error) {
 	var result params.ErrorResult
 	if !api.canModify {
@@ -46,3 +58,49 @@
 	}
 	return result, nil
 }
+
+// GetRsyslogConfig returns a RsyslogConfigResult.
+func (api *RsyslogAPI) GetRsyslogConfig() (params.RsyslogConfigResult, error) {
+	cfg, err := api.st.EnvironConfig()
+	if err != nil {
+		return params.RsyslogConfigResult{}, err
+	}
+
+	rsyslogCfg, err := newRsyslogConfig(cfg, api)
+	if err != nil {
+		return params.RsyslogConfigResult{}, err
+	}
+
+	return params.RsyslogConfigResult{
+		CACert:    rsyslogCfg.CACert,
+		Port:      rsyslogCfg.Port,
+		HostPorts: rsyslogCfg.HostPorts,
+	}, nil
+}
+
+// WatchForRsyslogChanges starts a watcher to track if there are changes
+// that require we update the rsyslog.d configurations for a machine and/or unit.
+func (api *RsyslogAPI) WatchForRsyslogChanges(args params.Entities) (params.NotifyWatchResults, error) {
+	result := params.NotifyWatchResults{
+		Results: make([]params.NotifyWatchResult, len(args.Entities)),
+	}
+	for i := range args.Entities {
+		err := common.ErrPerm
+		if api.authorizer.AuthMachineAgent() || api.authorizer.AuthUnitAgent() {
+			watch := api.st.WatchAPIHostPorts()
+			// Consume the initial event. Technically, API
+			// calls to Watch 'transmit' the initial event
+			// in the Watch response. But NotifyWatchers
+			// have no state to transmit.
+			if _, ok := <-watch.Changes(); ok {
+				result.Results[i].NotifyWatcherId = api.resources.Register(watch)
+				err = nil
+			} else {
+				err = watcher.MustErr(watch)
+			}
+		}
+		result.Results[i].Error = common.ServerError(err)
+	}
+	return result, nil
+
+}

=== modified file 'state/apiserver/rsyslog/rsyslog_test.go'
--- state/apiserver/rsyslog/rsyslog_test.go	2014-04-11 17:51:58 +0000
+++ state/apiserver/rsyslog/rsyslog_test.go	2014-05-19 14:05:26 +0000
@@ -9,6 +9,7 @@
 	jc "github.com/juju/testing/checkers"
 	gc "launchpad.net/gocheck"
 
+	"launchpad.net/juju-core/instance"
 	"launchpad.net/juju-core/juju/testing"
 	"launchpad.net/juju-core/state"
 	"launchpad.net/juju-core/state/api/params"
@@ -25,6 +26,7 @@
 	*commontesting.EnvironWatcherTest
 	authorizer apiservertesting.FakeAuthorizer
 	resources  *common.Resources
+	rsyslog    *rsyslog.RsyslogAPI
 }
 
 var _ = gc.Suite(&rsyslogSuite{})
@@ -34,6 +36,7 @@
 	s.authorizer = apiservertesting.FakeAuthorizer{
 		LoggedIn:       true,
 		EnvironManager: true,
+		MachineAgent:   true,
 	}
 	s.resources = common.NewResources()
 	api, err := rsyslog.NewRsyslogAPI(s.State, s.resources, s.authorizer)
@@ -43,28 +46,37 @@
 }
 
 func verifyRsyslogCACert(c *gc.C, st *apirsyslog.State, expected string) {
-	cfg, err := st.EnvironConfig()
+	cfg, err := st.GetRsyslogConfig()
 	c.Assert(err, gc.IsNil)
-	c.Assert(cfg.RsyslogCACert(), gc.DeepEquals, expected)
+	c.Assert(cfg.CACert, gc.DeepEquals, expected)
 }
 
 func (s *rsyslogSuite) TestSetRsyslogCert(c *gc.C) {
-	st, _ := s.OpenAPIAsNewMachine(c, state.JobManageEnviron)
-	err := st.Rsyslog().SetRsyslogCert(coretesting.CACert)
+	st, m := s.OpenAPIAsNewMachine(c, state.JobManageEnviron)
+	err := m.SetAddresses(instance.NewAddress("0.1.2.3", instance.NetworkUnknown))
+	c.Assert(err, gc.IsNil)
+
+	err = st.Rsyslog().SetRsyslogCert(coretesting.CACert)
 	c.Assert(err, gc.IsNil)
 	verifyRsyslogCACert(c, st.Rsyslog(), coretesting.CACert)
 }
 
 func (s *rsyslogSuite) TestSetRsyslogCertNil(c *gc.C) {
-	st, _ := s.OpenAPIAsNewMachine(c, state.JobManageEnviron)
-	err := st.Rsyslog().SetRsyslogCert("")
+	st, m := s.OpenAPIAsNewMachine(c, state.JobManageEnviron)
+	err := m.SetAddresses(instance.NewAddress("0.1.2.3", instance.NetworkUnknown))
+	c.Assert(err, gc.IsNil)
+
+	err = st.Rsyslog().SetRsyslogCert("")
 	c.Assert(err, gc.ErrorMatches, "no certificates found")
 	verifyRsyslogCACert(c, st.Rsyslog(), "")
 }
 
 func (s *rsyslogSuite) TestSetRsyslogCertInvalid(c *gc.C) {
-	st, _ := s.OpenAPIAsNewMachine(c, state.JobManageEnviron)
-	err := st.Rsyslog().SetRsyslogCert(string(pem.EncodeToMemory(&pem.Block{
+	st, m := s.OpenAPIAsNewMachine(c, state.JobManageEnviron)
+	err := m.SetAddresses(instance.NewAddress("0.1.2.3", instance.NetworkUnknown))
+	c.Assert(err, gc.IsNil)
+
+	err = st.Rsyslog().SetRsyslogCert(string(pem.EncodeToMemory(&pem.Block{
 		Type:  "CERTIFICATE",
 		Bytes: []byte("not a valid certificate"),
 	})))
@@ -73,10 +85,35 @@
 }
 
 func (s *rsyslogSuite) TestSetRsyslogCertPerms(c *gc.C) {
-	st, _ := s.OpenAPIAsNewMachine(c, state.JobHostUnits)
-	err := st.Rsyslog().SetRsyslogCert(coretesting.CACert)
+	// create a machine-0 so we have an addresss to log to
+	m, err := s.State.AddMachine("trusty", state.JobManageEnviron)
+	c.Assert(err, gc.IsNil)
+	err = m.SetAddresses(instance.NewAddress("0.1.2.3", instance.NetworkUnknown))
+	c.Assert(err, gc.IsNil)
+
+	unitState, _ := s.OpenAPIAsNewMachine(c, state.JobHostUnits)
+	err = unitState.Rsyslog().SetRsyslogCert(coretesting.CACert)
 	c.Assert(err, gc.ErrorMatches, "invalid entity name or password")
 	c.Assert(err, jc.Satisfies, params.IsCodeUnauthorized)
 	// Verify no change was effected.
-	verifyRsyslogCACert(c, st.Rsyslog(), "")
+	verifyRsyslogCACert(c, unitState.Rsyslog(), "")
+}
+
+func (s *rsyslogSuite) TestUpgraderAPIAllowsUnitAgent(c *gc.C) {
+	anAuthorizer := s.authorizer
+	anAuthorizer.UnitAgent = true
+	anAuthorizer.MachineAgent = false
+	anUpgrader, err := rsyslog.NewRsyslogAPI(s.State, s.resources, anAuthorizer)
+	c.Check(err, gc.IsNil)
+	c.Check(anUpgrader, gc.NotNil)
+}
+
+func (s *rsyslogSuite) TestUpgraderAPIRefusesNonUnitNonMachineAgent(c *gc.C) {
+	anAuthorizer := s.authorizer
+	anAuthorizer.UnitAgent = false
+	anAuthorizer.MachineAgent = false
+	anUpgrader, err := rsyslog.NewRsyslogAPI(s.State, s.resources, anAuthorizer)
+	c.Check(err, gc.NotNil)
+	c.Check(anUpgrader, gc.IsNil)
+	c.Assert(err, gc.ErrorMatches, "permission denied")
 }

=== modified file 'utils/syslog/config.go'
--- utils/syslog/config.go	2014-05-12 10:28:29 +0000
+++ utils/syslog/config.go	2014-05-19 14:05:26 +0000
@@ -8,8 +8,9 @@
 	"fmt"
 	"io/ioutil"
 	"path/filepath"
-	"strings"
 	"text/template"
+
+	"launchpad.net/juju-core/instance"
 )
 
 // tagOffset represents the substring start value for the tag to return
@@ -53,8 +54,8 @@
 $template LongTagForwardFormat,"<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg%"
 
 $RuleSet local
-{{range $i, $stateServerIP := stateServerHosts}}
-# start: Forwarding rule for {{$stateServerIP}}
+{{range $i, $rsyslogServer := rsyslogServers}}
+# start: Forwarding rule for {{$rsyslogServer}}
 $ActionQueueType LinkedList
 $ActionQueueFileName {{logfileName}}{{namespace}}_{{$i}}
 $ActionResumeRetryCount -1
@@ -64,8 +65,8 @@
 $ActionSendStreamDriverAuthMode anon
 $ActionSendStreamDriverMode 1 # run driver in TLS-only mode
 
-:syslogtag, startswith, "juju{{namespace}}-" @@{{$stateServerIP}}:{{portNumber}};LongTagForwardFormat
-# end: Forwarding rule for {{$stateServerIP}}
+:syslogtag, startswith, "juju{{namespace}}-" @@{{$rsyslogServer}};LongTagForwardFormat
+# end: Forwarding rule for {{rsyslogServer}}
 {{end}}
 & ~
 $FileCreateMode 0640
@@ -112,8 +113,8 @@
 $InputFileTag juju{{namespace}}-{{logfileName}}:
 $InputFileStateFile {{logfileName}}{{namespace}}
 $InputRunFileMonitor
-{{range $i, $stateServerIP := stateServerHosts}}
-# start: Forwarding rule for {{$stateServerIP}}
+{{range $i, $rsyslogServer := rsyslogServers}}
+# start: Forwarding rule for {{$rsyslogServer}}
 $ActionQueueType LinkedList
 $ActionQueueFileName {{logfileName}}{{namespace}}_{{$i}}
 $ActionResumeRetryCount -1
@@ -124,8 +125,8 @@
 $ActionSendStreamDriverMode 1 # run driver in TLS-only mode
 
 $template LongTagForwardFormat,"<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg%"
-:syslogtag, startswith, "juju{{namespace}}-" @@{{$stateServerIP}}:{{portNumber}};LongTagForwardFormat
-# end: Forwarding rule for {{$stateServerIP}}
+:syslogtag, startswith, "juju{{namespace}}-" @@{{$rsyslogServer}};LongTagForwardFormat
+# end: Forwarding rule for {{$rsyslogServer}}
 {{end}}
 & ~
 `
@@ -159,8 +160,8 @@
 	ConfigFileName string
 	// the name of the log file to tail.
 	LogFileName string
-	// the addresses of the state server to which messages should be forwarded.
-	StateServerAddresses []string
+	// the addresses of the rsyslog servers to which messages should be forwarded.
+	RsyslogHostPorts []instance.HostPort
 	// CA certificate file name.
 	CACertFileName string
 	// Server certificate file name.
@@ -177,13 +178,13 @@
 
 // NewForwardConfig creates a SyslogConfig instance used on unit nodes to forward log entries
 // to the state server nodes.
-func NewForwardConfig(logFile, logDir string, port int, namespace string, stateServerAddresses []string) *SyslogConfig {
+func NewForwardConfig(logFile, logDir string, port int, namespace string, rsyslogHostPorts []instance.HostPort) *SyslogConfig {
 	conf := &SyslogConfig{
-		configTemplate:       nodeRsyslogTemplate,
-		StateServerAddresses: stateServerAddresses,
-		LogFileName:          logFile,
-		Port:                 port,
-		LogDir:               logDir,
+		configTemplate:   nodeRsyslogTemplate,
+		RsyslogHostPorts: rsyslogHostPorts,
+		LogFileName:      logFile,
+		Port:             port,
+		LogDir:           logDir,
 	}
 	if namespace != "" {
 		conf.Namespace = "-" + namespace
@@ -193,13 +194,13 @@
 
 // NewAccumulateConfig creates a SyslogConfig instance used to accumulate log entries from the
 // various unit nodes.
-func NewAccumulateConfig(logFile, logDir string, port int, namespace string, stateServerAddresses []string) *SyslogConfig {
+func NewAccumulateConfig(logFile, logDir string, port int, namespace string, rsyslogHostPorts []instance.HostPort) *SyslogConfig {
 	conf := &SyslogConfig{
-		configTemplate:       stateServerRsyslogTemplate,
-		LogFileName:          logFile,
-		Port:                 port,
-		LogDir:               logDir,
-		StateServerAddresses: stateServerAddresses,
+		configTemplate:   stateServerRsyslogTemplate,
+		LogFileName:      logFile,
+		Port:             port,
+		LogDir:           logDir,
+		RsyslogHostPorts: rsyslogHostPorts,
 	}
 	if namespace != "" {
 		conf.Namespace = "-" + namespace
@@ -236,13 +237,13 @@
 
 // Render generates the rsyslog config.
 func (slConfig *SyslogConfig) Render() ([]byte, error) {
-	var stateServerHosts = func() []string {
-		var hosts []string
-		for _, addr := range slConfig.StateServerAddresses {
-			parts := strings.Split(addr, ":")
-			hosts = append(hosts, parts[0])
+	var rsyslogServers = func() []string {
+		var servers []string
+		for _, hostPort := range slConfig.RsyslogHostPorts {
+			server := hostPort.Address.Value + ":" + string(hostPort.Port)
+			servers = append(servers, server)
 		}
-		return hosts
+		return servers
 	}
 
 	var logFilePath = func() string {
@@ -251,16 +252,16 @@
 
 	t := template.New("")
 	t.Funcs(template.FuncMap{
-		"logfileName":      func() string { return slConfig.LogFileName },
-		"stateServerHosts": stateServerHosts,
-		"logfilePath":      logFilePath,
-		"portNumber":       func() int { return slConfig.Port },
-		"logDir":           func() string { return slConfig.LogDir },
-		"namespace":        func() string { return slConfig.Namespace },
-		"tagStart":         func() int { return tagOffset + len(slConfig.Namespace) },
-		"tlsCACertPath":    slConfig.CACertPath,
-		"tlsCertPath":      slConfig.ServerCertPath,
-		"tlsKeyPath":       slConfig.ServerKeyPath,
+		"logfileName":    func() string { return slConfig.LogFileName },
+		"rsyslogServers": rsyslogServers,
+		"logfilePath":    logFilePath,
+		"portNumber":     func() int { return slConfig.Port },
+		"logDir":         func() string { return slConfig.LogDir },
+		"namespace":      func() string { return slConfig.Namespace },
+		"tagStart":       func() int { return tagOffset + len(slConfig.Namespace) },
+		"tlsCACertPath":  slConfig.CACertPath,
+		"tlsCertPath":    slConfig.ServerCertPath,
+		"tlsKeyPath":     slConfig.ServerKeyPath,
 	})
 
 	// Process the rsyslog config template and echo to the conf file.

=== modified file 'worker/rsyslog/rsyslog_test.go'
--- worker/rsyslog/rsyslog_test.go	2014-05-12 15:57:30 +0000
+++ worker/rsyslog/rsyslog_test.go	2014-05-19 14:05:26 +0000
@@ -16,6 +16,7 @@
 	gc "launchpad.net/gocheck"
 
 	"launchpad.net/juju-core/cert"
+	"launchpad.net/juju-core/instance"
 	jujutesting "launchpad.net/juju-core/juju/testing"
 	"launchpad.net/juju-core/state"
 	"launchpad.net/juju-core/state/api"
@@ -30,6 +31,9 @@
 
 type RsyslogSuite struct {
 	jujutesting.JujuConnSuite
+
+	st      *api.State
+	machine *state.Machine
 }
 
 var _ = gc.Suite(&RsyslogSuite{})
@@ -50,6 +54,10 @@
 	s.PatchValue(rsyslog.RestartRsyslog, func() error { return nil })
 	s.PatchValue(rsyslog.LogDir, c.MkDir())
 	s.PatchValue(rsyslog.RsyslogConfDir, c.MkDir())
+
+	s.st, s.machine = s.OpenAPIAsNewMachine(c, state.JobManageEnviron)
+	err := s.machine.SetAddresses(instance.NewAddress("0.1.2.3", instance.NetworkUnknown))
+	c.Assert(err, gc.IsNil)
 }
 
 func waitForFile(c *gc.C, file string) {
@@ -87,7 +95,7 @@
 }
 
 func (s *RsyslogSuite) TestTearDown(c *gc.C) {
-	st, m := s.OpenAPIAsNewMachine(c, state.JobManageEnviron)
+	st, m := s.st, s.machine
 	worker, err := rsyslog.NewRsyslogConfigWorker(st.Rsyslog(), rsyslog.RsyslogModeAccumulate, m.Tag(), "", []string{"0.1.2.3"})
 	c.Assert(err, gc.IsNil)
 	confFile := filepath.Join(*rsyslog.RsyslogConfDir, "25-juju.conf")
@@ -131,7 +139,7 @@
 }
 
 func (s *RsyslogSuite) TestModeAccumulate(c *gc.C) {
-	st, m := s.OpenAPIAsNewMachine(c, state.JobManageEnviron)
+	st, m := s.st, s.machine
 	worker, err := rsyslog.NewRsyslogConfigWorker(st.Rsyslog(), rsyslog.RsyslogModeAccumulate, m.Tag(), "", nil)
 	c.Assert(err, gc.IsNil)
 	defer func() { c.Assert(worker.Wait(), gc.IsNil) }()
@@ -165,7 +173,7 @@
 }
 
 func (s *RsyslogSuite) TestAccumulateHA(c *gc.C) {
-	_, m := s.OpenAPIAsNewMachine(c, state.JobManageEnviron)
+	m := s.machine
 	syslogConfig := syslog.NewAccumulateConfig(m.Tag(), *rsyslog.LogDir, 6541, "", []string{"192.168.1", "127.0.0.1"})
 	rendered, err := syslogConfig.Render()
 	c.Assert(err, gc.IsNil)
@@ -178,7 +186,11 @@
 }
 
 func (s *RsyslogSuite) TestNamespace(c *gc.C) {
-	st, _ := s.OpenAPIAsNewMachine(c, state.JobManageEnviron)
+	st := s.st
+	// set the rsyslog cert
+	err := s.APIState.Client().EnvironmentSet(map[string]interface{}{"rsyslog-ca-cert": coretesting.CACert})
+	c.Assert(err, gc.IsNil)
+
 	// namespace only takes effect in filenames
 	// for machine-0; all others assume isolation.
 	s.testNamespace(c, st, "machine-0", "", "25-juju.conf", *rsyslog.LogDir)
@@ -201,19 +213,23 @@
 
 	err := os.MkdirAll(expectedLogDir, 0755)
 	c.Assert(err, gc.IsNil)
-	err = s.APIState.Client().EnvironmentSet(map[string]interface{}{"rsyslog-ca-cert": coretesting.CACert})
-	c.Assert(err, gc.IsNil)
 	worker, err := rsyslog.NewRsyslogConfigWorker(st.Rsyslog(), rsyslog.RsyslogModeForwarding, tag, namespace, []string{"0.1.2.3"})
 	c.Assert(err, gc.IsNil)
 	defer func() { c.Assert(worker.Wait(), gc.IsNil) }()
 	defer worker.Kill()
 
-	// Ensure that ca-cert.pem gets written to the expected log dir.
-	waitForFile(c, filepath.Join(expectedLogDir, "ca-cert.pem"))
+	// change the API HostPorts to trigger an rsyslog restart
+	newHostPorts := instance.AddressesWithPort(instance.NewAddresses("127.0.0.1"), 6541)
+	err = s.State.SetAPIHostPorts([][]instance.HostPort{newHostPorts})
+	c.Assert(err, gc.IsNil)
 
 	// Wait for rsyslog to be restarted, so we can check to see
 	// what the name of the config file is.
 	waitForRestart(c, restarted)
+
+	// Ensure that ca-cert.pem gets written to the expected log dir.
+	waitForFile(c, filepath.Join(expectedLogDir, "ca-cert.pem"))
+
 	dir, err := os.Open(*rsyslog.RsyslogConfDir)
 	c.Assert(err, gc.IsNil)
 	names, err := dir.Readdirnames(-1)

=== modified file 'worker/rsyslog/worker.go'
--- worker/rsyslog/worker.go	2014-05-14 21:13:17 +0000
+++ worker/rsyslog/worker.go	2014-05-19 14:05:26 +0000
@@ -15,6 +15,7 @@
 
 	"launchpad.net/juju-core/agent"
 	"launchpad.net/juju-core/cert"
+	"launchpad.net/juju-core/instance"
 	"launchpad.net/juju-core/names"
 	apirsyslog "launchpad.net/juju-core/state/api/rsyslog"
 	"launchpad.net/juju-core/state/api/watcher"
@@ -53,7 +54,7 @@
 	mode            RsyslogMode
 	syslogConfig    *syslog.SyslogConfig
 	rsyslogConfPath string
-
+	tag             string
 	// We store the syslog-port and rsyslog-ca-cert
 	// values after writing the rsyslog configuration,
 	// so we can decide whether a change has occurred.
@@ -63,12 +64,12 @@
 
 var _ worker.NotifyWatchHandler = (*RsyslogConfigHandler)(nil)
 
-// NewRsyslogConfigWorker returns a worker.Worker that watches
-// for config changes and updates rsyslog configuration based
+// NewRsyslogConfigWorker returns a worker.Worker that uses
+// WatchForRsyslogChanges and updates rsyslog configuration based
 // on changes. The worker will remove the configuration file
 // on teardown.
-func NewRsyslogConfigWorker(st *apirsyslog.State, mode RsyslogMode, tag, namespace string, stateServerAddrs []string) (worker.Worker, error) {
-	handler, err := newRsyslogConfigHandler(st, mode, tag, namespace, stateServerAddrs)
+func NewRsyslogConfigWorker(st *apirsyslog.State, mode RsyslogMode, tag, namespace string, rsyslogHostPorts []instance.HostPort) (worker.Worker, error) {
+	handler, err := newRsyslogConfigHandler(st, mode, tag, namespace, rsyslogHostPorts)
 	if err != nil {
 		return nil, err
 	}
@@ -76,15 +77,15 @@
 	return worker.NewNotifyWorker(handler), nil
 }
 
-func newRsyslogConfigHandler(st *apirsyslog.State, mode RsyslogMode, tag, namespace string, stateServerAddrs []string) (*RsyslogConfigHandler, error) {
+func newRsyslogConfigHandler(st *apirsyslog.State, mode RsyslogMode, tag, namespace string, rsyslogHostPorts []instance.HostPort) (*RsyslogConfigHandler, error) {
 	var syslogConfig *syslog.SyslogConfig
 	if mode == RsyslogModeAccumulate {
 		syslogConfig = syslog.NewAccumulateConfig(
-			tag, logDir, 0, namespace, stateServerAddrs,
+			tag, logDir, 0, namespace, rsyslogHostPorts,
 		)
 	} else {
 		syslogConfig = syslog.NewForwardConfig(
-			tag, logDir, 0, namespace, stateServerAddrs,
+			tag, logDir, 0, namespace, rsyslogHostPorts,
 		)
 	}
 
@@ -116,6 +117,7 @@
 		st:           st,
 		mode:         mode,
 		syslogConfig: syslogConfig,
+		tag:          tag,
 	}, nil
 }
 
@@ -125,7 +127,7 @@
 			return nil, errors.Annotate(err, "failed to write rsyslog certificates")
 		}
 	}
-	return h.st.WatchForEnvironConfigChanges()
+	return h.st.WatchForRsyslogChanges(h.tag)
 }
 
 var restartRsyslog = syslog.Restart
@@ -138,20 +140,18 @@
 }
 
 func (h *RsyslogConfigHandler) Handle() error {
-	cfg, err := h.st.EnvironConfig()
+	cfg, err := h.st.GetRsyslogConfig()
 	if err != nil {
 		return errors.Annotate(err, "cannot get environ config")
 	}
-	rsyslogCACert := cfg.RsyslogCACert()
+	rsyslogCACert := cfg.CACert
 	if rsyslogCACert == "" {
 		return nil
 	}
-	// If neither syslog-port nor rsyslog-ca-cert
-	// have changed, we can drop out now.
-	if cfg.SyslogPort() == h.syslogPort && rsyslogCACert == h.rsyslogCACert {
-		return nil
-	}
-	h.syslogConfig.Port = cfg.SyslogPort()
+
+	h.syslogConfig.Port = cfg.Port
+	h.syslogConfig.RsyslogHostPorts = cfg.HostPorts
+
 	if h.mode == RsyslogModeForwarding {
 		if err := writeFileAtomic(h.syslogConfig.CACertPath(), []byte(rsyslogCACert), 0644, 0, 0); err != nil {
 			return errors.Annotate(err, "cannot write CA certificate")
@@ -172,7 +172,7 @@
 	// Record config values so we don't try again.
 	// Do this last so we recover from intermittent
 	// failures.
-	h.syslogPort = cfg.SyslogPort()
+	h.syslogPort = cfg.Port
 	h.rsyslogCACert = rsyslogCACert
 	return nil
 }