Fork: 0
OpenStack / openstack-caracal-dc-dc
Transfer to URL with SHA Find file
Newer
Older
openstack-caracal-dc-dc / docs / archive / session-ledger-rotated-20260805.md
@JANeumatrix JANeumatrix 1 day ago 6 KB Session close 2026-08-05 (part 2): D-121 HA 14/14 + vault metal-only; GA-R4 bookend
Raw Blame History

Rotated session-ledger summaries -- moved 2026-08-05 (GA-R4 rule 3 / F1)

Moved VERBATIM from docs/session-ledger.md at the 2026-08-05 (part 2) close to keep the live ledger under the 300-line cap. Also folds forward the 2026-08-01 rotation pointer (docs/archive/session-ledger-rotated-20260801.md, unchanged).

SESSION CLOSE 2026-07-31 -- Stage 5 dc0: prefer-ipv6 ruled, deploy succeeded then torn down for a clean rebuild (bounded, GA-R4)

  • Branch dc-dc-stage5-preconditions, 45 commits pushed. NO stage opened/closed. Scan: 3 decisions, SEC 26, D 139 / DOCFIX 207 / BUNDLEFIX 053.
  • 8 RULINGS (GA-R5, all utterances quoted): prefer-ipv6 dropped from the six, then from ALL thirteen; P5's five new findings accepted; option D (explicit base on 56 apps AND a clean model); jammy-backports synced; UCA points in-DC; snaps get an in-DC forward proxy; and the MAAS proxy declined in favour of the owned one.
  • THE RESEARCH INVERTED ITS OWN PREMISE. Read from the charm ARTIFACTS: prefer-ipv6 is NOT what makes HAProxy bind :::port -- that is gated on the kernel disable_ipv6 sysctl, and pacemaker picks IPv6addr by family detection. Neither consults the option. vault ships no haproxy at all ([::]:8200 hardcoded).
  • >>> THE BUNDLE DEPLOYED (attempt 3, Deploy of bundle completed.) <<< after three failures each one layer deeper: unknown option; a missing policies/overrides.zip on the client host; and a bundle relying on default-base being deployable exactly ONCE.
  • FOUR ARTIFACT DEFECTS, each masked by the one before it (apt-get update --error-on=any fails on the first bad source): backports 404, upstream UCA unreachable, prefer-ipv6 fatal on containers with only link-local v6, and snaps with no path. Units tracked 22 -> 17 -> 4 -> 7-in-one-class.
  • THE v6 HALF IS CARVED AS ADDRESSES BUT NEVER MADE OPERATIONAL -- all six v6 plane subnets carry ZERO allocatable ranges, the rack has NO global v6 at all, the mirror does not answer on v6, and nodes have no v6 default route. Operator: dual-stack was "only a safety net". DC1 carries the IPv6 build; DC0 folds it back.
  • TEARDOWN STALLED AND WAS FORCED. All 26 agents were stopped, so no hook could run -- a fixed point, not backoff. --force cleared it; NOTHING was stranded. All nine nodes renamed to their ruled vr1-dc0-<role>-NN by pinned boot MAC and back to Ready.
  • SNAP PROXY BUILT AND INDEPENDENTLY REVIEWED, NOT APPLIED. squid at the utility .4:3129, allowlisted, 53/53 mutations killed; review says the ruled design is HONOURED on all four counts and logs FOUR real bugs. Nothing proven end to end.
  • OWNED: a red-lint push (| tail masked the exit code); a git add -A that swept an agent's files into an unrelated commit; two instrument misreads (a juju models summary read as progress, and stale unit logs read as current); and a wrong "immutable system_id" claim the operator corrected.
  • NEXT: apply the review cuts, re-run the mutation pass (S8 invalidates it), confirm BUG-3's deny shape once, install the proxy, then add-model + spaces + deploy. Sweep: docs/audit/queued-findings-20260731-stage5-deploy.txt (11 FIRST SURFACE). Bodies: docs/changelog-20260731-prefer-ipv6-research.md. Status ONLY in CURRENT-STATE.md.

SESSION CLOSE 2026-08-01 -- snap proxy LIVE, D-139 adopted, IPv6 PROVEN on the node planes (bounded, GA-R4)

  • Branch dc-dc-stage5-preconditions, 8 commits pushed (d555b90..844b2e4). NO stage opened or closed. Scan: 3 open decisions, SEC 26 (none opened this session), D 140 / DOCFIX 207 / BUNDLEFIX 053.
  • THE dc0 SNAP PROXY IS LIVE. check dc0 PASS exit 0, 16 assertions, re-verified independently of the agent that installed it -- and a real snap payload fetched through it (HTTP 206, first bytes hsqs). No longer fixture-green. BUG-3 confirmed by measurement (no assertion changed); BUG-4 fixed at BOTH sites where the review had named one.
  • D-139 ADOPTED -- two rulings taken in separate exchanges: IPv6-only on the east-west planes, and the whole plane carve moved to GUA on the octet map VR0 and Willamette already use.
  • THEN ITS DECIDING REASON WAS REFUTED BY MY OWN VERIFICATION -- glibc 2.35 implements RFC 3484, not 6724, so ULA and GUA are EQUAL at precedence 40. Put back to the operator rather than quietly kept; ruling CONFIRMED on its other grounds and the dead rationale STRUCK IN PLACE, not deleted.
  • RULING A IS NOT ACHIEVABLE at current charm revisions -- ceph-osd fails a v6-only plane in BOTH directions, hacluster still ships ip_version: ipv4, OVN documents encap as IPv4-only. Narrowed by ruling ("B plus C") to a storage+replication experiment plus the upstream fix; LP draft written, operator files it.
  • >>> IPv6 IS PROVEN ON THE dc0 NODE PLANES <<< 6/6 addresses live on the NICs, 0% loss node-to-node on all six planes, ND resolving from a COLD neighbour table. Gate G19 built AND run live. IPv6 is also already load-bearing: node time sync runs over fd50:840e:74e2:220::6, stratum 3.
  • THE RECORDED ROOT CAUSE OF THE v4-ONLY CONTAINERS WAS WRONG. MAAS has 100% of every v6 /64 available; the real limit is juju taking addrs[0] from an unsorted query, family-blind, with no knob (LP #1723240, open since 2017). Corrected per GA-R1 C2.
  • THE "JUJU CLIENT BLOCKER" WAS NOT ONE -- the client is live and registered on the rack, exactly where D-138 puts it. Corrects this repo's own 2026-07-31 finding 9d.
  • D-139's OWN EXECUTION LIST WAS DEFECTIVE AND IS REPLACED. dc-node-v6-carve.py pivots on IPv4 existing, so run after v4 removal it would carve four fewer planes per node and exit clean.
  • OWNED: my BUG-1 fix was wrong (a secondary alias is never the kernel's chosen source); I scoped the v6 experiment wrong (ceph couples storage+replication); I stated an agent's input source wrongly; I scoped a research agent with no repo path, so 355 lines landed in /tmp and needed rescuing; and one commit went red on ASCII-only em-dashes.
  • Gauntlet ALL GREEN (96), repo-lint 0 fail, d139-gua-carve 71/71, dc-node-v6-verify 55/55. voffice1's clone is 36 commits BEHIND -- no loss, but a live hazard on the Plane-2 host.
  • AMENDED AFTER THE BOOKEND (2026-08-01): both DC containment VMs resized 416 -> 480 GiB through tofu (operator: "Option 2 look sgood me"), 128 GiB swap added (operator-run), and preflight gained gate P8, substrate drift (harness 33 -> 38, proven live at zero diff). Host used 809 -> 63 GiB. Found: dc0's MAAS region and juju controller have autostart=disable. Bodies: changelog items 21-22.
  • NEXT: apex CREATE-only push (tool built, independently reviewed, dry-run byte-identical), then the bundle deploy -- its blockers are cleared. network-get on a v6-only bound space is still unmeasured and gates the v4-removal experiment. Sweep: docs/audit/queued-findings-20260801-stage5-ipv6-d139.txt (6 FIRST SURFACE). Body: docs/changelog-20260731-snap-proxy-apply-ipv6.md. Status ONLY in CURRENT-STATE.md.