|
G18 OPENED: IPAM apex completeness for the Octavia lb-mgmt plane (blocking, deferred)
Operator direction, verbatim: "leave this as an open decision that will need a ruling once we have the cloud live and we have a better read on the network and how everything is functioning with the addition of the new IPv6 configurations. Make this a gated decision so we cannot close the project (or whatever phase you think it best ruled in) without a ruling on this item." WHAT IT IS. R8 ruled that Octavia creates and owns its own IPv6 lb-mgmt network. The measured consequence is that the octavia charm exposes NO CIDR, address-family or router configuration option -- create-mgmt-network (default True) is the only related option -- so the prefix is CHARM-GENERATED and cannot come from the D-111 carve. NetBox is therefore knowingly incomplete for exactly one plane. That is the authority-inversion concern the audit's lens 7 raised: the apex being back-filled to match a deploy rather than driving it. WHY DEFERRED RATHER THAN RULED NOW. It is not answerable from artifacts -- it needs the cloud live and an observed read on IPv6 behaviour. It is also adjacent to the UNRULED D-136 NetBox-coupled render pipeline, which covers the same apex-authority ground, so ruling it early would pre-empt that decision. PLACEMENT. Recorded as gate G18 in CURRENT-STATE section 6, the gate authority. [R] ruling-type: closes ONLY on a GA-R5 recorded ruling with the exact utterance, dated, committed and pushed. ANSWERABLE from Stage 5 onward, since the prefix exists once Octavia deploys. BLOCKING at the FINAL stage close / project close -- the deployment may not be declared complete while it is open. That placement gives the widest window in which live evidence can accumulate while still guaranteeing the question cannot be lost. Options are pre-recorded in the gate row so a future session does not have to re-derive them: (a) back-fill the charm-created prefix into NetBox post-deploy as a documented record; (b) record the plane as charm-owned and explicitly out of apex scope; (c) fold it into D-136's render-pipeline ruling if that is taken first. ALSO CROSS-RECORDED, because it is exactly the kind of thing that gets "fixed" by mistake: the absence of an lb-mgmt :x80 prefix in the VR1 ULA carve is CORRECT under R8, not a gap. Noted in the D-101 R8 ruling note and in the G18 row. Mirrored into docs/audit/queued-rulings-20260727.md as R16 (gated, deferred) with CURRENT-STATE named as the authority, so the queue and the gate table agree. Revert: git revert this commit; the gate row and cross-references are additive. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf |
|---|
|
|
| docs/CURRENT-STATE.md |
|---|
| docs/audit/queued-rulings-20260727.md |
|---|
| docs/design-decisions.md |
|---|