A problem in the way that ssh/gssapi authentication works can be
worked around by moving the anycast servers first.  We had reverted
this change in the past when networking told us anycast was not
ready for primetime, so this change has been well tested.  Now that
anycast is a production service moving to it will solve an immediate
problem.

The tls_support.pp class used a dubious reference to a variable
defined in the tls resource definition.  This was used to install the
ca cert required for accessing the central syslog service.  The change
requires that the cert be explicitly in manifests that want to use the
base::syslog::tls resource to install rsyslog fragments.