[VAULT-1618] Agent error log level is mismatched

`logLevelToStringPtr` translates `go-hclog`'s `ERROR` to `"ERROR"` for
Consul Template's runner, but that expects `ERR` and is quite strict
about it.

This will address hashicorp/vault-k8s#223
after it is set as the default image in `vault-k8s`.

I didn't find a simple way to test this other than starting up a full
server and agent and letting them run, which is unfortunately fairly
slow.

I confirmed that this addresses the original issue by modifying the helm
chart with the values in this commit and patching the log level to `err`.

command/agent/template/template.go

@@ -341,7 +341,7 @@ func logLevelToStringPtr(level hclog.Level) *string {
 	case hclog.Warn:
 		levelStr = "WARN"
 	case hclog.Error:
-		levelStr = "ERROR"
+		levelStr = "ERR"
 	default:
 		levelStr = "INFO"
 	}

command/agent/template/template_test.go

@@ -188,7 +188,7 @@ func TestCacheConfigNoListener(t *testing.T) {
 	assert.NotNil(t, ctConfig.Vault.Transport.CustomDialer)
 }
 
-func TestServerRun(t *testing.T) {
+func createHttpTestServer() *httptest.Server {
 	// create http test server
 	mux := http.NewServeMux()
 	mux.HandleFunc("/v1/kv/myapp/config", func(w http.ResponseWriter, r *http.Request) {
@@ -203,8 +203,13 @@ func TestServerRun(t *testing.T) {
 		fmt.Fprintln(w, `{"errors":["1 error occurred:\n\t* permission denied\n\n"]}`)
 	})
 
-	ts := httptest.NewServer(mux)
+	return httptest.NewServer(mux)
+}
+
+func TestServerRun(t *testing.T) {
+	ts := createHttpTestServer()
 	defer ts.Close()
+
 	tmpDir, err := ioutil.TempDir("", "agent-tests")
 	defer os.RemoveAll(tmpDir)
 	if err != nil {
@@ -400,6 +405,70 @@ func TestServerRun(t *testing.T) {
 	}
 }
 
+// TestNewServerLogLevels tests that the server can be started with any log
+// level.
+func TestNewServerLogLevels(t *testing.T) {
+	ts := createHttpTestServer()
+	defer ts.Close()
+
+	tmpDir, err := ioutil.TempDir("", "agent-tests")
+	defer os.RemoveAll(tmpDir)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	levels := []hclog.Level{hclog.NoLevel, hclog.Trace, hclog.Debug, hclog.Info, hclog.Warn, hclog.Error}
+	for _, level := range levels {
+		name := fmt.Sprintf("log_%s", level)
+		t.Run(name, func(t *testing.T) {
+			server := NewServer(&ServerConfig{
+				Logger:        logging.NewVaultLogger(level),
+				LogWriter:     hclog.DefaultOutput,
+				LogLevel:      level,
+				ExitAfterAuth: true,
+				AgentConfig: &config.Config{
+					Vault: &config.Vault{
+						Address: ts.URL,
+					},
+				},
+			})
+			if server == nil {
+				t.Fatal("nil server returned")
+			}
+
+			templateTokenCh := make(chan string, 1)
+
+			templateTest := &ctconfig.TemplateConfig{
+				Contents: pointerutil.StringPtr(templateContents),
+			}
+			dstFile := fmt.Sprintf("%s/%s", tmpDir, name)
+			templateTest.Destination = pointerutil.StringPtr(dstFile)
+			templatesToRender := []*ctconfig.TemplateConfig{templateTest}
+
+			ctx, cancel := context.WithTimeout(context.Background(), 20*time.Second)
+
+			errCh := make(chan error)
+			go func() {
+				errCh <- server.Run(ctx, templateTokenCh, templatesToRender)
+			}()
+
+			// send a dummy value to trigger auth so the server will exit
+			templateTokenCh <- "test"
+
+			select {
+			case <-ctx.Done():
+				t.Fatal("timeout reached before templates were rendered")
+			case err := <-errCh:
+				if err != nil {
+					t.Fatalf("did not expect error, got: %v", err)
+				}
+			}
+			cancel()
+			server.Stop()
+		})
+	}
+}
+
 var jsonResponse = `
 {
   "request_id": "8af096e9-518c-7351-eff5-5ba20554b21f",