Fork: 0
OpenStack / openstack-caracal-dc-dc
Transfer to URL with SHA Find file
Newer
Older
openstack-caracal-dc-dc / docs / changelog-20260721-close-and-delivery.md
@JANeumatrix JANeumatrix 6 hours ago 3 KB node-vm: MAAS owns node power -- ignore_changes on running (operator-ruled)
Raw Blame History

Session changelog 2026-07-21 (successor session) -- disconnect recovery + queued delivery

One changelog per session (GA-R2/D1). Status lives ONLY in docs/CURRENT-STATE.md; this file is narrative + reverts. Predecessor session (ops-commissioning-diag, disconnected before its bookend): docs/changelog-20260721-commissioning-diag.md.

1. Predecessor session close LANDED (commit 8b3adb3)

  • The ops-commissioning-diag session disconnected before committing its deliverable. This session re-verified read-only first (9/9 nodes Ready in MAAS with virsh power; dc0-node-dns active+enabled with the 10.12.8.3 alias up; dhcpd running on BOTH controllers; diag-serial tag deleted and serial-console re-attached to hardy-dove = Phase-7 cleanup confirmed done), then committed the predecessor's 7 files verbatim plus the bounded session-ledger close entry and a machine-derived block re-seed from the 2026-07-21 scan (D next-free 132, DOCFIX 197, BUNDLEFIX 052, 10 open SEC rows). Operator-approved this session.
  • Revert: git revert 8b3adb3 (returns the record to the not-yet-durable state; the live cloud is untouched by that commit).

2. MAC pinning in modules/node-vm (queued item 9a of the predecessor)

  • modules/node-vm: new OPTIONAL interface_macs variable (list(string), default [] = unpinned for pre-enlistment use; validations: all-or- nothing length vs network_names -- partial pinning is rejected -- and 6-byte hex format). Interfaces comprehension consumes it as mac = { address = ... } -- shape VERIFIED against the provider schema (dmacvicar/libvirt 0.9.8, tofu providers schema -json, this session).
  • opentofu/vr1-dc0-substrate: all 9 nodes pinned. 54 MACs MEASURED this session (virsh domiflist on vvr1-dc0, read-only; order = the vr1_dc0_node_nics plane order) and the 9 metal-admin entries cross-checked against MAAS boot-interface records 9/9 (machines read). No value inferred; no value reused from the adjudication file without re-measurement.
  • NEW harness tests/node-vm/run-tests.sh (12 cases: variable shape, validations, consumption, 9 lists / 54 literals / 0 duplicates in the inner root, pass-through, tofu validate). Gauntlet 72 -> 73 ALL GREEN; repo-lint 0 fail; opentofu-validate PASS (both EXTRA roots).
  • NOT YET APPLIED: the inner root's state (on voffice1) does not carry the pins until an operator-gated tofu apply there. The plan gate for that apply: expected NO REPLACE -- pins equal live values, so the plan must show only benign in-place mac adoption or no-op; ANY replace is a STOP (present to operator, do not apply).
  • Revert: git revert of this delivery commit (module + root + harness together); live domains unaffected until the gated apply.

3. node-vm power-ownership guard (operator-ruled this session)

  • The MAC-pin verification plan on voffice1 (captured: docs/audit/inner-plan-20260721-macpin.txt -- 0/9/0, 54 mac adoptions, ZERO replaces) exposed an entanglement: the module hardcodes running = true while MAAS holds all 9 Ready nodes OFF, so the apply would ALSO have powered on all 9 nodes outside MAAS's control.
  • RULING (this session): question = how to proceed with the entangled apply; operator selection = "ignore_changes on running first (Recommended)".
  • Shipped: lifecycle { ignore_changes = [running] } on the node domain (create still boots for PXE enlistment; after that MAAS owns power -- virsh here, IPMI on Roosevelt). Harness grew 3 cases (T13-T15: guard present, exactly one ignore_changes, cites MAAS). 15 cases green.
  • Revert: remove the lifecycle block + T13-T15; the 9 power-on changes return to the next plan.