fail deploy when RELP transport is combined with TLS

jobs/syslog_forwarder/templates/syslog-release-forwarding-rules.conf.erb

@@ -38,6 +38,7 @@ $ActionExecOnlyWhenPreviousIsSuspended on
           syslog_fallback_transport = fallback_server.fetch('transport')
         %>
         <% if syslog_fallback_transport == 'relp' %>
+        <% raise "TLS is not supported for RELP fallback servers. Change fallback transport to TCP, or disable syslog.tls_enabled." if p('syslog.tls_enabled') %>
 $ModLoad omrelp
 :omrelp:<%= syslog_fallback_address %>:<%= syslog_fallback_port %>;SyslogForwarderTemplate
         <% elsif syslog_fallback_transport == 'tcp' %>

jobs/syslog_forwarder/templates/syslog-release-forwarding-setup.conf.erb

@@ -69,7 +69,10 @@ $ActionQueueType LinkedList            # Allocate on-demand
 <% if p('syslog.tls_enabled') %>
   <%
     if syslog_transport == 'udp'
-      raise "TLS is not supported with UDP. Change transport to TCP or RELP, or disable TLS."
+      raise "TLS is not supported with UDP. Change transport to TCP, or disable TLS."
+    end
+    if syslog_transport == 'relp'
+      raise "TLS is not supported with RELP in this release. Change transport to TCP, or disable TLS."
     end
     ca_cert_path = '/etc/ssl/certs/ca-certificates.crt'
 

tests/acceptance_test.go

@@ -234,15 +234,20 @@ var _ = Describe("Forwarding loglines to a TCP syslog drain", func() {
 	})
 
 	Context("when TLS is configured over relp", func() {
-		BeforeEach(func() {
-			Cleanup()
-			DeployWithVarsStore("manifests/relp-tls.yml")
-		})
 		AfterEach(func() {
 			Cleanup()
 		})
 
-		TestSharedBehavior()
+		It("will fail the deploy, since RELP does not support TLS in this release", func() {
+			By("Deploying")
+
+			session := BoshCmd("deploy", "manifests/relp-tls.yml",
+				"-v", fmt.Sprintf("deployment=%s", DeploymentName()),
+				fmt.Sprintf("--vars-store=/tmp/%s-vars.yml", DeploymentName()),
+				"-v", fmt.Sprintf("stemcell-os=%s", StemcellOS()))
+			Eventually(session, 10*time.Minute).Should(gexec.Exit(1))
+			Eventually(BoshCmd("locks")).ShouldNot(gbytes.Say(DeploymentName()))
+		})
 	})
 
 	Context("when TLS is configured and mTLS is enforced", func() {

tests/manifests/relp-tls.yml

@@ -25,6 +25,8 @@ instance_groups:
         release: syslog
         properties:
           syslog:
+            address: "storer.default.((deployment)).bosh"
+            port: 514
             transport: "relp"
             tls_enabled: true
             permitted_peer: "*.storer.default.((deployment)).bosh"