Fork: 0
OpenStack / openstack-caracal-dc-dc
Transfer to URL with SHA Find file
Newer
Older
openstack-caracal-dc-dc / docs / changelog-20260807-dc0-tailscale-provisioning.md
@JANeumatrix JANeumatrix 2 hours ago 5 KB dc0 tailscale .7: MAAS power+commission (Ready) + aux-carve tooling
Raw Blame History

Changelog 2026-08-07 -- dc0 Tailscale .7 subnet-router: MAAS provisioning + aux-carve tooling

Session: pick up the 2026-08-06/07 close -- provision the per-DC Tailscale .7 subnet-router toward closing phase-03 Step 3.3 (Horizon over the tailnet). Branch dc-dc-stage5-preconditions. Under blanket approval the changelog is the review surface: each item states WHAT, WHY (evidence), and HOW TO REVERT. Live cloud mutations are individually operator-gated.

Operator rulings this session (GA-R5; verbatim, dated 2026-08-07):

  • dc1 approach: "No migration. Build region on DC1 correctly." -- dc1's .7 is gated behind building the dedicated vr1-dc1-region on vr1-dc1-maas-01 (N3); do NOT enlist it into the Office1 admin region. Consistent with the standing region-per-DC invariant (D-132 q1).
  • Tailscale join key: operator has a plain (not tag-scoped) pre-auth key. The ruled design (D-129(iii) amdt note 1) is TAGGED identity; a plain key cannot authorise --advertise-tags=tag:subnet-router, so the JOIN stays blocked pending a tagged key + the Headscale-side autoApprovers/star-ACL (N1). Provisioning to carved-and-ready is unblocked.

As-executed log (O3, repeated): run-logged.sh opens an interactive script -aqe subshell, which a background agent cannot drive; the log was NOT opened. Every mutation below is gated and captured here with its read-back. Flagged, not silent.

Measured corrections to the record (GA-R1 C2 -- measurement wins)

  • The dc0 .7 VM had already self-enlisted into vr1-dc0-region as known-marten (system_id n4parh), status New, power_type UNSET, powered off -- its six NICs carry the pinned tailscale MACs (opentofu/vr1-dc0-substrate/main.tf:243-245). The 2026-08-06/07 close said "powered off"; the enlisted-already part was not recorded. virsh domstate = shut off.
  • subtle-grouse is the dc0 juju controller (power_id=vr1-dc0-juju-01), never renamed in MAAS; it carries the 2-plane carve because dc-node-carve.sh resolves ROLE from the stable lib-hosts LOGICAL name and machine IDENTITY from the pinned boot MAC -- the MAAS random name is irrelevant. This is the idiom the tailscale aux-carve reuses.
  • vr1-dc1-region is NOT registered; dc1's rack (nmpcq4) + 9 nodes are in the Office1 admin region. dc1 .7 has no dedicated region -> the operator ruling above.

Item 1 -- dc0 .7 VM: MAAS power control set + commissioned to Ready (LIVE, gated)

WHAT: on known-marten (n4parh) in vr1-dc0-region: (a) maas-node-power.sh --commit set power_type=virsh, power_address=qemu+ssh://jessea123@10.12.8.2/system (the DC-region-reachable metal-admin form, read off the working juju controller's power-parameters), power_id=vr1-dc0-tailscale-01. Read-back: [ok] known-marten -> vr1-dc0-tailscale-01 (power state: off) -- MAAS proved power control by a live query-power-state. (b) maas vr1-dc0-region machine commission n4parh -> polled Commissioning -> Testing -> Ready at 02:55:33Z.

WHY: the .7 router must be MAAS-deployed to get an OS (it is NOT in the juju model, so nothing else deploys it -- DOCFIX-200's "stay Ready" applies only to juju-managed role nodes). Power MUST be set before commission (the unset-power silent drop-to-New trap). The power address is the region-reachable 10.12.8.2 (measured OPEN from the DC-local region; the Office1-form 172.31.0.2 is CLOSED from there); listed domains over the transit 172.31.0.2 via VIRSH_URI.

REVERT: maas vr1-dc0-region machine release n4parh (back to Ready) or ... machine delete n4parh + power off the domain; the substrate VM is untouched.

Item 2 -- dc-node-carve.sh + lib-hosts.sh: AUX carve target for the Tailscale .7 router

WHAT: taught the v4 node carve to carve the per-DC Tailscale .7 VM, which is NOT an OpenStack role node:

  • scripts/lib-hosts.sh: new CARVE_AUX_HOSTS array (default empty; ( vr1-dc0-tailscale-01 ) / ( vr1-dc1-tailscale-01 ) per DC) so the VM is a carve target WITHOUT entering HOSTS (every HOSTS consumer -- maas-role-tags, pre-flight-checks ${#HOSTS[@]}, phase-00-teardown, reenroll-hosts, dc-node-v6-carve -- would otherwise treat it as a role node). Inert HOST_OCTET[..]=7 + HOST_BOOT_MAC entries (map keys are looked-up, never iterated). New NODE_CARVE_TAILSCALE_PLANES=2 + TAILSCALE_HOST_SUFFIX.
  • scripts/dc-node-carve.sh: is_tailscale_host + is_two_plane_host (juju OR tailscale); planes_for_host and BOTH br-ex branches + the "spare NICs / NO br-ex" verifier now key on is_two_plane_host -- so the tailscale VM carves metal-admin + provider-public RAW with NO OVS br-ex (identical to the juju controller, octet 7). --host accepts CARVE_AUX_HOSTS members; a bare apply still iterates HOSTS only (aux = opt-in by --host).
  • tests/dc-node-carve/run-tests.sh: t01 machine fixture + emit_tailscale + T28..T33 -- passes on the 2-plane no-br-ex end state at 10.12.8.7/10.12.4.7, and FAILS (failing- direction fixtures) on a tailscale VM grown a br-ex (tsbrex) or with a spare NIC carved onto a plane (tscarved); T31 proves the aux --host allowance did not widen unknown hosts.

WHY: hard rule 4 -- no tested artifact carved this 2-leg shape (the existing tool is role/juju shaped; a mis-key silently falls through to a 6-plane br-ex role carve). Implements the ruled D-129(iii) amendment (2026-08-07) + D-134 octet map; no new D-number. The carve must precede MAAS-deploy (MAAS refuses interface changes on a Deployed machine).

GATES: tests/dc-node-carve/run-tests.sh 58 passed / 0 failed; repo-lint 0 fail (1 legacy warn); full gauntlet ALL GREEN (101 harnesses) -- docs/audit/gauntlet-20260807-tailscale-carve.txt.

REVERT: git revert this commit -- removes CARVE_AUX_HOSTS, the tailscale predicates, and the harness cases; dc-node-carve.sh returns to role+juju only. lib-hosts map keys become inert. No live-cloud effect (this item is repo tooling; the carve APPLY is a separate gated mutation).