[4.0] rabbitmq: Fix ACL of SSL key after uid/gid change + keystone: Use correct paths when syncing certs

[skazi0]

In shared storage based HA setup, rabbitmq uses fixed uid/gid=91.
This user/group modification was done after (optional) SSL certificate
generation. The ACLs on the SSL key were incorrect making rabbitmq
unable to start because with EACCESS errors.

Second commit is taken from #2145 to avoid cross-PR dependencies in gating.

The sync failed when certs and/or keys were located in non-default paths.

Note: forward ports need to include only the rabbitmq part as the keystone change is not relevant for newer versions.

[skazi0]

This will hopefully fix the HA gating failures we have in stable/4.0 branch. In later branches rabbitmq uses native clustering by default and this mode doesn't use the static uid/gid code so the problem doesn't show there.

[JanZerebecki]

Looks good to forward-port (if that applies) once it passes CI.

[skazi0]

Temporarily added this fix #2145 as both are probably needed to have the gating pass.

[cmurphy]

Can you clarify more what the issue was that the commit "keystone: Use correct paths when syncing certs" is fixing? That part of the code isn't doing HTTPS but actually configuration needed for PKI token signing.

I think we're also supposed to fix in master first and then backport?

[skazi0]

@cmurphy adding to Jan's comment, the problem is that gating jobs have (recently) enabled want_all_ssl which triggered all kinds of SSL failures. In SOC7 it covered some code paths which seem not to be tested very well. In later branches those parts are either removed or not used by default so these problems didn't pop up earlier.

As for the porting strategy... note that we have two sets of labels (forward/back ports). IMO the bugs should be fixed where it's mostly relevant and then ported wherever suitable. This approach was used especially in upgrade related work where we were doing lots of changes in the stable branches.

[skazi0]

Replaced cherry-picked commit with updated one.

[skazi0]

@skazi0 related issue: SOC-9026