# overlays/vr1-dc0-vips.yaml
# Per-DC VIP overlay for vr1-dc0. GENERATED by scripts/render-dc-overlays.py from
# render/values/vr1-dc0-vips.yaml -- edit the values file and re-render; do not
# hand-edit this file.
#   juju deploy ./bundle.yaml --overlay ./overlays/vr1-dc0-vips.yaml
#
# RULING 3 (2026-07-25) made bundle.yaml VIP-FREE, so this file is the ONLY source of
# vr1-dc0's VIPs and the bundle is not deployable without it.
#
# DUAL-FAMILY per R2 (RULED 2026-07-27): each vip carries the three v4 legs THEN the
# three v6 legs, and `prefer-ipv6: true` travels WITH them -- the two must never be
# separated (a merge that keeps prefer-ipv6 while dropping the v6 legs leaves HAProxy
# bound on :::port with no v6 VIP for pacemaker to manage; provider-bundle-check
# invariant 9 now rejects that pair). Column order is
# provider-public / metal-admin / metal-internal, v4 then v6.
#   v4 prefixes  MEASURED from scripts/lib-net.sh lib_net_select_dc vr1-dc0
#   v6 prefixes  READ FROM THE NETBOX APEX (D-136 option (D)); the provider leg uses
#                the DEDICATED GUA VIP /64, admin+internal their own plane /64s
#   v6 host part MIRRORS the v4 octet textually (RULED 2026-07-27) -- .50 -> ::50
#
# vault .61 and designate .62 are R11 (a D-020 AMENDMENT, 2026-07-27). Per R6 these
# land BEFORE overlays/dc-ha-scaleup.yaml, which is what gives vault a real HA target.
# The B1 / B5 tokens below are DEFINED in bundle.yaml's own header block.
applications:
  keystone:
    options:
      prefer-ipv6: true
      vip: "10.12.4.50 10.12.8.50 10.12.12.50 2602:f3e2:f02:11::50 fd50:840e:74e2:220::50 fd50:840e:74e2:221::50" # B1 front-loaded VIP; IS the catalog endpoint (B5, no os-public-hostname)
  barbican:
    options:
      prefer-ipv6: true
      vip: "10.12.4.51 10.12.8.51 10.12.12.51 2602:f3e2:f02:11::51 fd50:840e:74e2:220::51 fd50:840e:74e2:221::51" # B1
  cinder:
    options:
      prefer-ipv6: true
      vip: "10.12.4.52 10.12.8.52 10.12.12.52 2602:f3e2:f02:11::52 fd50:840e:74e2:220::52 fd50:840e:74e2:221::52" # B1
  glance:
    options:
      prefer-ipv6: true
      vip: "10.12.4.53 10.12.8.53 10.12.12.53 2602:f3e2:f02:11::53 fd50:840e:74e2:220::53 fd50:840e:74e2:221::53" # B1
  magnum:
    options:
      prefer-ipv6: true
      vip: "10.12.4.54 10.12.8.54 10.12.12.54 2602:f3e2:f02:11::54 fd50:840e:74e2:220::54 fd50:840e:74e2:221::54" # B1
  neutron-api:
    options:
      prefer-ipv6: true
      vip: "10.12.4.55 10.12.8.55 10.12.12.55 2602:f3e2:f02:11::55 fd50:840e:74e2:220::55 fd50:840e:74e2:221::55" # B1
  nova-cloud-controller:
    options:
      prefer-ipv6: true
      vip: "10.12.4.56 10.12.8.56 10.12.12.56 2602:f3e2:f02:11::56 fd50:840e:74e2:220::56 fd50:840e:74e2:221::56" # B1
  octavia:
    options:
      prefer-ipv6: true
      vip: "10.12.4.57 10.12.8.57 10.12.12.57 2602:f3e2:f02:11::57 fd50:840e:74e2:220::57 fd50:840e:74e2:221::57" # B1
  openstack-dashboard:
    options:
      prefer-ipv6: true
      vip: "10.12.4.58 10.12.8.58 10.12.12.58 2602:f3e2:f02:11::58 fd50:840e:74e2:220::58 fd50:840e:74e2:221::58" # B1 -- browse HTTPS by IP (B5); ALLOWED_HOSTS must permit the VIP IP (verify at deploy)
  placement:
    options:
      prefer-ipv6: true
      vip: "10.12.4.59 10.12.8.59 10.12.12.59 2602:f3e2:f02:11::59 fd50:840e:74e2:220::59 fd50:840e:74e2:221::59" # B1
  ceph-radosgw:
    options:
      prefer-ipv6: true
      vip: "10.12.4.60 10.12.8.60 10.12.12.60 2602:f3e2:f02:11::60 fd50:840e:74e2:220::60 fd50:840e:74e2:221::60" # B1 -- radosgw HA un-deferred for Roosevelt fidelity (decorative HA on testcloud)
  vault:
    options:
      prefer-ipv6: true
      vip: "10.12.4.61 10.12.8.61 10.12.12.61 2602:f3e2:f02:11::61 fd50:840e:74e2:220::61 fd50:840e:74e2:221::61" # R11 (D-020 amendment) -- was ruled in D-020's own enumeration and never built
  designate:
    options:
      prefer-ipv6: true
      vip: "10.12.4.62 10.12.8.62 10.12.12.62 2602:f3e2:f02:11::62 fd50:840e:74e2:220::62 fd50:840e:74e2:221::62" # R11 (D-020 amendment) -- NEW to D-020's enumeration; dnsaas is already provider-bound