Operator ran init/unseal/authorize/generate-root-ca. vault/0 active, root CA
issued. Cascade: 25 units active, zero error. neutron-api-plugin-ovn, ovn-chassis,
ovn-chassis-octavia active on their certs.

ovn-central/0,1,2 stuck ~15min 'awaiting server certificate data'. Measured: the
container holds both addresses (10.12.8.185 metal-admin, 10.12.12.122
metal-internal); network-get resolves both cert bindings; ovn-central published a
valid request (sans for both addrs + certificate_name); vault published back ca +
client.cert + client.key but NO per-unit server cert -- which is what ovn-central
waits on. The 'skipping internal/admin/public, no local address' warnings are
benign (unused endpoint spaces; the real request carries correct SANs). Vault can
sign (other consumers active) but hasn't produced ovn-central's server cert.
Logged, awaiting operator direction on remedy.

Expected-tail blocked units unchanged; nova-compute 'services not running' was
transient and self-cleared.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf