Fork: 0
OpenStack / openstack-caracal-dc-dc
Transfer to URL with SHA Find file
Newer
Older
openstack-caracal-dc-dc / docs / changelog-20260710-sweep-vr0-runbook-opentofu-fixes.md
@JANeumatrix JANeumatrix 6 hours ago 4 KB DOCFIX-170: full-project sweep -- VR0 runbook + OpenTofu doc fixes
Raw Blame History

Changelog 2026-07-10 -- Full-project sweep: VR0 runbook + OpenTofu doc fixes (DOCFIX-170)

No live infrastructure touched. Part of the full-project sweep requested after DOCFIX-169 (the first cascading-staleness fix). Eight parallel review agents audited bundle.yaml, VR0 runbooks, scripts, OpenTofu modules, DC-DC runbook consistency, test harness quality, security posture, and NetBox/IPAM consistency. This changelog covers the VR0 runbook and OpenTofu documentation findings; sibling changelogs cover DC-DC runbook fixes (DOCFIX-171), bundle.yaml fixes (DOCFIX-172), and script logic bugs (DOCFIX-173).

Items

1. DOCFIX-170a -- runbooks/phase-08-workload-cluster-acceptance.md Designate framing

FILE: runbooks/phase-08-workload-cluster-acceptance.md.

WHAT: same cascading-staleness class as DOCFIX-169 (phase-01), found by a dedicated VR0-runbook-audit agent: this runbook's header and its D-011.8 acceptance-bar item both still framed Designate as flatly "DEFERRED (D-019)" even though bundle.yaml's DOCFIX-167 edit now deploys designate/ designate-bind/designate-mysql-router/designate-hacluster live (D-106 supersedes D-019). Fixed with a NUANCED correction, not a blanket flip to PASS: D-011.1's "all charms active/idle" check will now include these 4 units, but D-011.8's actual acceptance criterion (tenant hostname resolution) is STILL not meaningfully testable for a plain VR0 run -- the full D-008 bootstrap chain needs the per-DC os-public-hostname overlay this shared bundle deliberately does NOT carry (Stage 7's job, not automatic from the charms merely being deployed). The runbook now says so explicitly, cross-referencing runbooks/dc-dc-phase6-designate-cos-magnum.md Step 9 as where D-011.8 actually gets exercised for real.

2. DOCFIX-170b -- opentofu/modules/base-image/outputs.tf stale comment

FILE: opentofu/modules/base-image/outputs.tf.

WHAT: found by the OpenTofu deep-review agent: the pool/name output descriptions referenced nonexistent modules/cloudinit-vm input variables (base_volume_pool/base_volume_name) -- that module only ever declared base_volume_path, which is what its real main.tf actually consumes (via .path, the third, correctly-described output). Leftover wording from an earlier design that named things differently before settling on passing .path directly. No functional effect (neither module is instantiated yet, nothing calls .pool/.name) -- cosmetic, now corrected.

Verification

bash scripts/repo-lint.sh: 0 fail, 1 documented legacy warn. Full test gauntlet (bash scripts/run-tests-all.sh): 23/51 FAILED, identical to every prior check tonight (same pre-existing "jq missing on this workstation" environment gaps) -- zero regressions.

Sweep summary (all eight dimensions, for the record)

  • bundle.yaml deep audit: found magnum-dashboard missing its entire bindings: block (pre-existing, since the D-052 commit, not tonight's regression) + two cosmetically-misplaced section-header comments + header VIP-count staleness -- see DOCFIX-172.
  • VR0 runbooks audit: this changelog's item 1, plus confirmed phase-00/02/03/04/05/06/07 and all four appendices clean of the same staleness class; script/flag/D-NNN citation spot-checks all clean.
  • scripts/*.sh audit: found 4 confirmed logic bugs (unguarded pipelines/function calls under set -e+pipefail) + 1 dormant landmine in ledger-scan.sh's DOCFIX/BUNDLEFIX regex -- see DOCFIX-173.
  • OpenTofu modules deep review: this changelog's item 2; otherwise clean, including the newest module (office1-network) correctly mirroring the already-fixed attribute-style syntax convention.
  • DC-DC runbook consistency (second pass): found Stage 1's calculator scripts never wired into Step 3, Stage 5's stale Sequence-list bracket tag, Stage 6's checklist overstating its own step content, and two DOCFIX numbers (164, 167) never closed out in the ledger's own boilerplate -- see DOCFIX-171 and this session's direct ledger fix.
  • Test harness quality audit: clean -- no new instances of the dead-assertion bug class found anywhere else in 51 harnesses; the originally-fixed dc-dc-prefixes-import harness reconfirmed correct (40/40, exact call-site count match).
  • Security/secrets posture audit: one moderate finding (rbd-mirror bootstrap token's predictable path, no permission hardening) -- see DOCFIX-173; everything else clean, including a spot-check of 3 older secrets-handling scripts.
  • NetBox/IPAM consistency audit: clean for the current, active DC-DC pipeline (byte-for-byte match against lib-net.sh); one refinement to an already-known v1-script staleness (the retired ipv4-prefixes- import.py's "LBaaS Mgmt" role label on a CIDR now repurposed to storage -- out of scope, that script is deliberately not maintained).

REVERT (this changelog's items only): git checkout HEAD~ -- runbooks/ phase-08-workload-cluster-acceptance.md opentofu/modules/base-image/ outputs.tf (safe).