Network-space binding & placement reference (VR1 per-DC)

Purpose. A grounded, cross-checkable reference for the six network planes, what each carries, and where every application's Juju bindings land -- so a future session can VERIFY a binding against intent without re-researching or re-engineering it. Built 2026-08-05 from the live bundle + relation topology + the 2026-08-03 plane-purpose sweep, verified against dataflow.

Authority. This is a DERIVED reference, not a new authority. The governing decision is D-052 (docs/design-decisions.md) and its amendments; plane CIDRs come from scripts/lib-net.sh; deviations are ruled in their own D-NNN. Where this doc and D-052 ever disagree, D-052 wins and this doc is corrected. Regenerate the matrix from bundle.yaml when bindings change (the generator is trivial: invert applications[*].bindings by space).

1. The six planes

CIDRs are per-DC (dc0 / dc1). metal-admin and metal-internal are the two "metal" planes that split the legacy single metal space (D-052).

Reachability mechanics (why the '' default matters): metal-admin does not route in VR1 (the .1 gateway was removed 2026-07-29). Nodes reach the juju controller (.5 on metal-admin) by L2 adjacency on the flat /22. A unit with no metal-admin leg cannot reach the controller at all -- it cannot download agent binaries and its agent never starts. This is the single most important operational fact behind the binding rules below.

2. The binding rule (the one that governs everything)

Every app binds '': metal-admin (its management leg), and binds each explicit endpoint to the plane matching that endpoint's TRAFFIC TYPE.

The Juju '' (default) binding has dual significance: (a) the fallback space for any unbound endpoint, and (b) the unit's primary NIC -- its private-address and its path to the controller. It is the MANAGEMENT binding, not a "what kind of service is this" tag. A pure storage service (ceph-osd) still binds '': metal-admin; a pure DB service (mysql-innodb-cluster) still binds '': metal-admin. Their data rides storage / metal-internal via EXPLICIT endpoint bindings; their management stays on metal-admin. Binding '' to an isolated data plane strips the management leg -- this is exactly the ovn-central regression that the 2026-08-03 amendment introduced and the 2026-08-05 re-amendment reverted (Section 5).

Endpoint -> plane, by traffic type:

3. Per-app binding matrix (56 apps)

Cell = count of that app's endpoints on the plane (blank = 0). '' default is called out separately -- it is metal-admin for all 56 apps (the rule in Section 2). Generated from bundle.yaml.

4. Dataflow confirmation (108 relations, spot-verified)

Every relation's plane is consistent with its endpoints' traffic type:

• Service-to-service -> metal-internal: all :certificates <-> vault:certificates, all :shared-db <-> *-mysql-router, all :amqp <-> rabbitmq-server, all :identity-service <-> keystone, all :ha <-> *-hacluster.
• Ceph client -> storage; OSD replication -> replication: cinder-ceph/nova-compute/glance:ceph <-> ceph-mon:client (storage); ceph-osd:cluster, ceph-rbd-mirror:ceph-local <-> ceph-mon:rbd-mirror (replication).
• Overlay -> data-tenant: ovn-chassis:ovsdb <-> ovn-central:ovsdb control on metal-internal; the geneve data legs on data-tenant.
• Public -> provider-public: only the :public / designate:dnsaas VIPs.

5. Ruled exceptions & their governing decisions

Do NOT "correct" these against the generic rule -- each is a ruled fix. (CLAUDE.md: grep the governing D-NNN before touching a built binding. The 2026-08-03 sweep flagged #1 as a deviation and had to self-correct -- the lesson is baked in here.)

The ovn-central story (the reference case for "management leg != service category"): the 2026-08-03 amendment moved ovn-central's '' to metal-internal to fix a cert-resolution bug (LP #2044324). It never fixed the cert (its own clarification admits this), and when first deployed (2026-08-04) it left all three ovn-central containers single-legged on the isolated metal-internal plane, unable to reach the controller -> agent never started. The 2026-08-05 re-amendment restores '': metal-admin (the universal pattern); ovn-central's functional endpoints (certificates, ovsdb*) stay metal-internal (its data IS a metal-internal service); the cert CN is fixed independently by the /etc/hosts postruncmd (scripts/dc-node-etchosts.sh, phase-01 Step 1.2b). See D-052 RE-AMENDMENT 2026-08-05 and docs/CURRENT-STATE.md.

6. Cross-references

• D-052 (+ 2026-08-03 amendment, 2026-08-05 re-amendment) -- the governing decision.
• D-072 / BUNDLEFIX-011 -- dashboard cluster:metal-admin exception.
• D-106 -- designate reactivation (dnsaas dual-VIP).
• D-125 -- metal-internal egress isolation.
• scripts/lib-net.sh -- plane CIDRs / names (per-DC).
• docs/audit/binding-plane-purpose-sweep-20260803.txt -- the full 446-endpoint classification.
• scripts/dc-node-etchosts.sh + tests/dc-node-etchosts -- the ovn-central cert-CN fix.

Roosevelt deltas (from D-052): dedicated redundant corosync ring (heartbeat off the service plane); dedicated live-migration plane + QEMU-native TLS; revisit whether cross-DC service-to-service on metal-internal warrants its own inter-DC plane.