Fix haproxy access to rsyslogd on Noble

Ubuntu Noble ships with an enforcing rsyslogd apparmor profile. This
profile prevents our haproxy container from opening the syslog socket we
bind mount into the container. I discussed this in #ubuntu-security
which resulted in this issue:

  https://bugs.launchpad.net/ubuntu/+source/rsyslog/+bug/2098148

which includes many details on what is going on. This change implements
the suggested workaround for our haproxy nodes. I believe this is the
only place we are currently attempting to directly access rsyslog
sockets from within containers.

The tl;dr on the fix is that we have to tell rsyslogd to attach
disconnected connections as the container runs in a different filesystem
namespace which disconnects the paths for the socket. Unfortunately
sarnold indicates that we have to edit the primary profile configuration
file as this flag applies to the top level of the profile. We cannot use
one of the files this profile #includes.

Change-Id: I4e09211a1bdc4dfbf3012a66e79c181c6fb957a4

playbooks/roles/haproxy/tasks/main.yaml

@@ -22,6 +22,20 @@
     that:
       - haproxy_config_template is defined
 
+- name: Fix rsyslog apparmor profile on Noble and newer
+  when: ansible_distribution_version is version('24.04', '>=')
+  block:
+    - name: Edit rsyslogd apparmor profile
+      lineinfile:
+        path: /etc/apparmor.d/usr.sbin.rsyslogd
+        regexp: '^profile rsyslogd /usr/sbin/rsyslogd {'
+        line: 'profile rsyslogd /usr/sbin/rsyslogd flags=(attach_disconnected) {'
+      register: profile_update
+
+    - name: Reload rsyslogd apparmor profile
+      command: apparmor_parser -r /etc/apparmor.d/usr.sbin.rsyslogd
+      when: profile_update.changed
+
 - name: Write rsyslog file
   copy:
     src: rsyslog.d/49-haproxy.conf

testinfra/test_zuul_lb.py

@@ -32,3 +32,10 @@ def test_haproxy_statsd_running(host):
     out = json.loads(cmd.stdout)
     assert out[0]["State"]["Status"] == "running"
     assert out[0]["RestartCount"] == 0
+
+def test_haproxy_logging(host):
+    # rsyslog is configured to add a unix socket at this path
+    assert host.file('/var/lib/haproxy/dev/log').is_socket
+    # Haproxy logs to syslog via the above socket which produces
+    # this logfile
+    assert host.file('/var/log/haproxy.log').is_file