Fork: 0
OpenStack / openstack-caracal-dc-dc
Transfer to URL with SHA Find file
Newer
Older
openstack-caracal-dc-dc / docs / changelog-20260805-vault-init-ovn-resolved.md
@JANeumatrix JANeumatrix 20 hours ago 3 KB Close-fix 2026-08-05: add Body changelog, verify root CA (openssl), reconcile D-142 scan-visibility + durability
Raw Blame History

Changelog 2026-08-05 -- vault init DONE + ovn-central RESOLVED; D-142 vault-init QoL saved

Session body (the "what changed" record; status authority stays in docs/CURRENT-STATE.md). Commits: ca3c0d3 (engineering + as-built), 8305ceb (GA-R4 close), plus this close-fix. No cloud mutation by the agent this session -- the vault init one-shot was operator-run (secret custody); the agent's changes are all docs.

What happened (live, operator-run -- recorded no-secrets)

  • Fresh read-only phase-02-vault-preflight vr1-dc0 on the dc0 rack -> PROCEED (9 machines started; mysql 3/3 active+ONLINE, 1 R/W; vault fresh; census 66 units, 0 workload-error, 0 agent-error).
  • Operator ran runbooks/phase-02-vault-bringup.md Steps 2.1-2.3 VERBATIM on the dc0 rack (-m vr1-dc0, VR0 -m openstack head-substituted): init (5 shares + TOKEN_OK, 2>&1|tee, pre-init writability probe PROBE_OK, off-host save by hand), unseal 3/3 (Sealed=false), authorize-charm + generate-root-ca -> vault/0 active/idle "Unit is ready".
  • Root CA (PUBLIC anchor; openssl-verified on the rack from the pasted PEM): subject CN = Vault Root Certificate Authority (charm-pki-local); notBefore Aug 5 02:05:57 2026 GMT; notAfter Aug 2 01:06:27 2036 GMT; sha256 75:DF:33:97:43:48:17:FE:85:97:1C:EC:60:DB:D5:4B:0D:FB:60:4A:0B:F4:60:08:92:E8:12:E5:29:69:35:A1.
  • >>> ovn-central/3,4,5 ALL active/idle "Unit is ready" (/4 leader ovnnb_db+ovnsb_db, /5 northd active) -- the OVN NB/SB cluster FORMED. This closes the multi-session ovn-central cert saga via BOTH fixes landed this cycle: dc-node-etchosts.sh Step 1.2b (CN delivery) + the D-052 re-amendment ''->metal-admin (reachability). Census 40->47 active, 0 error.

Files changed (docs only)

  • NEW docs/audit/vault-init-qol-proposal-20260805.md -- full R1-R5 QoL engineering + hidden-prompt safety analysis + tee-write residual + pre-init writability probe + R3 harness constraints + operator's verbatim safety constraint.
  • NEW docs/audit/queued-findings-20260805-vault-init-close.txt -- 3 first-surface items.
  • docs/design-decisions.md -- D-142 PROPOSED / OPEN (vault-init workflow QoL sweep; approved-in-principle, impl deferred; R2 transport unresolved). Distinct from D-068 (substrate) / D-011.6 (unseal bar).
  • docs/runbook-fold-register.md -- F13 (D-138: -m openstack->-m vr1-dc0 + run-location = DC rack on phase-02-vault-bringup.md; scope-stretch stated; OPEN).
  • docs/audit/stage5-dc0-redeploy-asexec-20260804.txt -- appended the vault-init outcome (no secrets), root CA as-built (openssl-verified), ovn-central resolution, and the remaining ceph item.
  • docs/CURRENT-STATE.md -- 2026-08-05 (CONTINUED) status block + close reference.
  • docs/session-ledger.md -- GA-R4 close block.

Security hygiene

The child token printed by vault token create -field=token appeared in plaintext in the operator's otherwise-redacted paste (init keys + root token WERE redacted). It was -ttl=10m, unset after use, and long expired by paste time -> dead/benign, no rotation. NOT stored/echoed/committed. Lesson recorded: redact token-create output too.

Remaining (separate, NOT vault/ovn)

ceph-mon/2 + ceph-radosgw/0 stuck allocating ("waiting for machine", apt-wedge class) -> cascade to ceph-osd x4 (Incomplete monitor) -> glance + nova-compute x2 (Incomplete storage-backend). Triage via appendix-A after this close.

Revert

Docs-only. To revert: git revert 8305ceb ca3c0d3 <this-commit> (or `git checkout d6975fb --

` per file). No cloud state to unwind -- the vault init was operator-run and is not reverted by touching the repo.