Fork: 0
OpenStack / openstack-caracal-dc-dc
Transfer to URL with SHA Find file
Newer
Older
openstack-caracal-dc-dc / docs / changelog-20260710-netbox-roles-aggregates.md
@JANeumatrix JANeumatrix 17 hours ago 2 KB netbox uploads
Raw Blame History

Changelog 2026-07-10 -- NetBox roles + aggregates prerequisite (VR1 DC-DC)

Added

  • netbox/roles-aggregates-import.py -- idempotent, preview-by-default script that creates the five missing six-plane IPAM roles and the aggregates that netbox/dc-dc-prefixes-import.py assumes already exist. Closes gaps G1 + G2 (below).
  • docs/dc-dc-netbox-buildout-scope.md -- consolidated planning/decision scope for the VR1 NetBox buildout, reconciling the repo (D-100..D-110), a live read of netbox.baldurkeep.com (v4.5.8, 2026-07-10), and the parallel IPAM-design chats. The authoritative reference the Code stream builds from.

Why -- reconciliation findings (live NetBox vs repo vs design chats)

A live NetBox read surfaced gaps and divergences that the prefixes-import tool would trip on:

  • G1 -- six-plane roles: only storage exists; provider-public, metal-admin, metal-internal, data-tenant, replication were missing. The prefixes-import tool die()s on a missing role by design (does not create roles).
  • G2 -- aggregates: 0 aggregates despite ARIN being the RIR and NetBox being the IPAM apex (D-010).
  • Authoritative model = D-101 (six-plane, ULA-internal, GUA-external, /60 tenant). The byte-aligned /32 / /64-per-tenant carve from the parallel IPAM-design project diverged and is superseded for the DC-DC buildout (it used the old role set, /64 tenants, and a nibble-1 VR0/VR1 placement; deployed NetBox + D-101 use the six-plane set, /60 tenants from a separate delegation pool, and nibble-2 VR placement). Details in the scope doc, section 3.
  • Still open (not this delivery): G5 DC-naming mismatch (vr1-dc0/vr1-dc1 in NetBox vs DC1/DC2 in decisions + the prefixes tool's vr1-dc1/vr1-dc2) blocks the prefixes import until resolved; VR1 VLAN groups absent (G4); the three D-101 literals (ORG_ULA_48, per-DC DC_GUA_PREFIX, DC2_V4_SUPERNET) still need assignment.

Aggregate detail

2602:f3e2::/36 (the HELD allocation = region-0 of the planned /32; NOT /32 -- declaring space not yet allocated is dishonest for an IPAM apex; update to /32 after the expand), 23.157.124.0/24, 10.0.0.0/8, 172.16.0.0/12, and -- only if ORG_ULA_48 is passed -- the org ULA /48. New RIRs RFC 4193 ULA and RFC 1918 are created for the private aggregates; ARIN is assumed pre-existing (it is).

Validation

Script previewed (read-only) against live NetBox 4.5.8: correctly reports 12 objects to create (5 roles + 2 RIRs + 5 aggregates) and 0 pre-existing, storage detected as existing, ARIN detected (id=1). Not committed -- Code runs --commit after review.

Sub-decisions requiring ratification (candidate D-111+, assign via ledger-scan)

Per the scope doc section 5: the prefixes tool's per-plane subcarve (align to the deployed NN role mnemonic); DC naming (G5); DC2 v4 supernet value; tenant /60 confirmation; VR0-DC0 old-model retirement. None block this delivery (roles + aggregates are model-independent).