# Appendix B -- As-Built Version / Channel / Revision Lock

Source: `juju export-bundle` (model `openstack`) + the in-cloud mgmt-cluster
captures, 2026-06-09; B.2/B.3 workload-image, template, driver, and helm facts refreshed
in the 2026-06-17 sweep (D1 + DOCFIX-032 + DOCFIX-035). B.1 re-baselined 2026-07-05
from asbuilt/20260705-201118 (ops-update-20260705 + follow-on magnum/vault refreshes, addenda 16-17) -- this also
absorbed stale non-window rows (hacluster/ceph-mon/mysql rows) missed at the last
rebuild re-baseline. ASCII-only.

POLICY (D-002 + consolidation prompt): the bundle PINS CHANNELS, not revisions.
This appendix records the as-built REVISIONS as the known-good baseline. A fresh
deploy resolving a channel to a higher revision than below is EXPECTED -- treat
this as "last-known-good," verify against Charmhub at pre-flight, and refresh the
table on a successful validated deploy.

## B.1 Charm channels + as-built revisions

| Application                     | Charm                      | Channel (pinned)   | As-built rev |
| ------------------------------- | -------------------------- | ------------------ | ------------ |
| barbican                        | barbican                   | 2024.1/stable      | 265 |
| barbican-hacluster              | hacluster                  | 2.4/stable         | 166 |
| barbican-mysql-router           | mysql-router               | 8.0/stable         | 1154 |
| barbican-vault                  | barbican-vault             | 2024.1/stable      | 99 |
| ceph-mon                        | ceph-mon                   | squid/stable       | 491 |
| ceph-osd                        | ceph-osd                   | squid/stable       | 632 |
| ceph-radosgw                    | ceph-radosgw               | squid/stable       | 600 |
| ceph-radosgw-hacluster          | hacluster                  | 2.4/stable         | 166 |
| cinder                          | cinder                     | 2024.1/stable      | 820 |
| cinder-ceph                     | cinder-ceph                | 2024.1/stable      | 568 |
| cinder-hacluster                | hacluster                  | 2.4/stable         | 166 |
| cinder-mysql-router             | mysql-router               | 8.0/stable         | 1154 |
| dashboard-mysql-router          | mysql-router               | 8.0/stable         | 1154 |
| glance                          | glance                     | 2024.1/stable      | 681 |
| glance-hacluster                | hacluster                  | 2.4/stable         | 166 |
| glance-mysql-router             | mysql-router               | 8.0/stable         | 1154 |
| glance-simplestreams-sync       | glance-simplestreams-sync  | 2024.1/stable      | 152 |
| keystone                        | keystone                   | 2024.1/stable      | 817 |
| keystone-hacluster              | hacluster                  | 2.4/stable         | 166 |
| keystone-mysql-router           | mysql-router               | 8.0/stable         | 1154 |
| magnum                          | magnum                     | 2024.1/stable      | 96 |
| magnum-dashboard                | magnum-dashboard           | 2024.1/stable      | 122 |
| magnum-hacluster                | hacluster                  | 2.4/stable         | 166 |
| magnum-mysql-router             | mysql-router               | 8.0/stable         | 1154 |
| memcached                       | memcached                  | latest/stable      | 39 |
| mysql-innodb-cluster            | mysql-innodb-cluster       | 8.0/stable         | 164 |
| ncc-mysql-router                | mysql-router               | 8.0/stable         | 1154 |
| neutron-api                     | neutron-api                | 2024.1/stable      | 710 |
| neutron-api-hacluster           | hacluster                  | 2.4/stable         | 166 |
| neutron-api-mysql-router        | mysql-router               | 8.0/stable         | 1154 |
| neutron-api-plugin-ovn          | neutron-api-plugin-ovn     | 2024.1/stable      | 215 |
| nova-cloud-controller           | nova-cloud-controller      | 2024.1/stable      | 823 |
| nova-cloud-controller-hacluster | hacluster                  | 2.4/stable         | 166 |
| nova-compute                    | nova-compute               | 2024.1/stable      | 894 |
| octavia                         | octavia                    | 2024.1/stable      | 542 |
| octavia-dashboard               | octavia-dashboard          | 2024.1/stable      | 168 |
| octavia-diskimage-retrofit      | octavia-diskimage-retrofit | 2024.1/stable      | 232 |
| octavia-hacluster               | hacluster                  | 2.4/stable         | 166 |
| octavia-mysql-router            | mysql-router               | 8.0/stable         | 1154 |
| openstack-dashboard             | openstack-dashboard        | 2024.1/stable      | 750 |
| openstack-dashboard-hacluster   | hacluster                  | 2.4/stable         | 166 |
| ovn-central                     | ovn-central                | 24.03/stable       | 311 |
| ovn-chassis                     | ovn-chassis                | 24.03/stable       | 396 |
| ovn-chassis-octavia             | ovn-chassis                | 24.03/stable       | 396 |
| placement                       | placement                  | 2024.1/stable      | 154 |
| placement-hacluster             | hacluster                  | 2.4/stable         | 166 |
| placement-mysql-router          | mysql-router               | 8.0/stable         | 1154 |
| rabbitmq-server                 | rabbitmq-server            | 3.9/stable         | 295 |
| vault                           | vault                      | 1.8/stable         | 714 |
| vault-mysql-router              | mysql-router               | 8.0/stable         | 1154 |

Notes:
- memcached is on `latest/stable` (rev 39) -- the only charm not on a versioned
  track. AT PRE-FLIGHT run `juju info memcached` to list available tracks; if no
  stable versioned track exists, either pin revision 39 explicitly in the bundle
  or accept `latest/stable` knowingly. Flagged as a drift candidate.
- mysql-router subordinates show mixed as-built revisions (most 1154; the
  ncc/dashboard/vault routers at 1136) on the SAME `8.0/stable` channel. This is
  benign under channel-pinning (all resolve to current `8.0/stable` on redeploy);
  recorded only for completeness.
- vault is pinned `1.8/stable` (rev 714) DELIBERATELY, not merely as currency: the `1.16` line is
  a fundamentally different, incompatible charm (certs interface V0->V1, Raft-only, no upgrade
  path, broken with Charmed Ceph). See docs/D-068-vault-1.8-vs-1.16-analysis.md + D-068 amendment
  (2026-07-05). 1.8.8 is EOL -- getting off it is an OPEN D-068 item, with 1.16 ruled out.
- EXCLUDED from the bundle: the `k8s` charm (channel `1.32/stable`) deployed on
  Juju machine 4 / MAAS `capi-mgmt` (10.12.4.100). That is the retired D-033
  out-of-cloud node, slated for Phase 7 teardown; the in-cloud mgmt cluster
  (D-035) replaces it. It is intentionally absent here.

## B.2 In-cloud management cluster + CAPI constellation (D-034 / D-035 / D-037)

Node `capi-mgmt-v2` (FIP + internal IP are per-rebuild -- this rebuild FIP 10.12.5.103 / internal 10.20.0.107; 2026-06-09: 10.12.7.40 / 10.20.0.45), single-node, non-CAPI-managed:
- k8s-snap: channel `1.32-classic/stable`, rev 5326, k8s v1.32.13 (classic confinement)
- CAPI core + kubeadm-bootstrap + kubeadm-control-plane: v1.13.2
- CAPO (infra provider): v0.14.4
- cert-manager: v1.20.2
- ORC: v2.5.0   [install BEFORE `clusterctl init` -- CAPO v0.14.4 hard-deps the ORC Image CRD]
- CAAPH (cluster-api-addon-provider): chart 0.12.0 (`helm --version`, from dependencies.json; deploys image 62f7c00)
- cluster-api-janitor-openstack: chart 0.11.0 (`helm --version`, from dependencies.json; deploys image d527847)
- cluster-autoscaler (per-workload): v1.30.4
- Mgmt CNI: Cilium 1.17.12-ck0. Workload-cluster CNI: Calico (DOCFIX-032: pinned explicitly, not relied-on default).
- helm: v3.17.3 -- mgmt-VM tooling (phase-06 6.6a) AND the magnum conductor (phase-07 7.4),
  installed to /usr/local/bin + a /usr/bin/helm symlink so the conductor's restricted init PATH
  resolves it (DOCFIX-035).

VERSION-SOURCE RULE (D-034): every provider ref above is read live from the chosen
`capi-helm-charts` release tag's `dependencies.json` via `jq`. DO NOT hardcode
semver in IaC -- this table is a snapshot for redeploy comparison only.

## B.3 Magnum driver + chart (Layer B -- outside Juju channels, manually pinned)

- magnum-capi-helm driver: 1.3.0 was the AS-FIRST-BUILT pin; the v1 AS-BUILT pin is the
  RELEASED `magnum-capi-helm==1.4.0` (D-042; installed, health HEALTHY). 1.3.0 is contract-INCOHERENT with the
  Layer-A core -- it reads `apiVersion` off the infrastructureRef, which CAPI v1.13
  (v1beta2 contract) no longer carries, so the driver's `infrastructure` health GET
  returns "not found" (cosmetic only -- the create path is unaffected; the chart
  templates resource versions). (1.3.0 also supersedes D-007's `1.1.0` and the late-May
  `1.2.0` note -- both stale; Review-later: reconcile design-decisions.md.)
- DRIVER DECISION (D-042, amends D-034): pin the RELEASED `magnum-capi-helm==1.4.0`
  (the "generalize-api-resources" feature; released line 1.0.0/1.1.0/1.2.0/1.2.1/1.3.0/
  1.4.0). 1.4.0 resolves each resource query as
  `api_resources.get(<Kind>,{}).get("api_version", <code-default>)`; the driver's CODE
  defaults are v1beta1 for the CAPI core kinds, but the `api_resources` OPTION itself
  defaults to an EMPTY map `{}` (the v1beta1 values are code-level fallbacks, NOT option
  defaults). CAPI v1.13.2 / CAPO v0.14.4 serve v1beta1, so an empty map yields matching
  v1beta1 lookups -- set `api_resources = {}` EXPLICITLY (phase-07 7.5: the option's
  registered default is a dict and the driver `json.loads()` it; an explicit string `{}`
  avoids the oslo coercion question). Override a kind only if it serves v1beta2-only.
  Same pin for testcloud and Roosevelt. RULE: the Layer-B
  driver pin MUST be contract-coherent with the Layer-A CAPI core; verify that
  intersection at deploy. Install: phase-07 7.3-7.6.
- chart repo: https://azimuth-cloud.github.io/capi-helm-charts
- chart name: openstack-cluster ; default_helm_chart_version: 0.25.1
- conf.d drop-in: /etc/magnum/magnum.conf.d/00-capi-helm.conf (D-037)
- workload kube image (D1): ubuntu-jammy-kube-v1.34.8 (azimuth-images 0.28.0, build 260518-1604);
  kube_version v1.34.8, os_distro ubuntu; sha512 7efde4857c9f9da045a98d71def30e229b3d7fffd8a5680e8aee0c5a8b13ba73fca3cf758a927230a1fbe3c451d8d21cfaeded96091e2a4f313c6a404760bdb3
  (manifest.json). Seeded by STAGE-AND-VERIFY from the azimuth CDN (FINDING-3 -- glance
  web-download 403s the urllib UA). Bumped from EOL v1.32.13 (within CAPI v1.13.2 support).
- workload template (D1): capi-k8s-v1-34 (was capi-k8s-v1-32), --network-driver calico pinned (DOCFIX-032).
- note (CNI, DOCFIX-032): the `capi-k8s-v1-34` template PINS `--network-driver calico`
  explicitly. Under driver 1.4.0 `network_driver` IS honored (maps to the chart); chart 0.25.1
  ships only Calico (flannel not packaged), so the explicit pin documents intent and does not
  rely on the default staying Calico (appendix-A: CNI-label / DOCFIX-032; phase-08).
- v1 END STATE: 1.4.0 installed and `health_status = HEALTHY` (D-011). 1.3.0 is only a
  TEMPORARY rollback/holding state (phase-07 Rollback), never a v1 completion. Either
  way, do NOT wire magnum auto-heal to health_status (CAPI MachineHealthCheck handles
  healing independently -- proven during the D-040 OOM recovery).

## B.4 Pre-flight checklist (redeploy)

1. `scripts/pre-flight-checks.sh` -- verify every channel above still resolves on Charmhub.
2. `juju info memcached` -- confirm track decision (see B.1 note).
3. Read CAPI constellation live from `dependencies.json` (D-034); compare to B.2.
4. Driver (D-042): pin the RELEASED `magnum-capi-helm==1.4.0` (contract-coherent with the
   Layer-A CAPI core; `api_resources` defaults to v1beta1, which CAPI v1.13.2 serves).
   Confirm 1.4.0 still resolves on PyPI and that the cluster serves v1beta1 (phase-07 7.3).
