ovn-central cert: root-caused, fix PROVEN live, and wired for redeploy ...

Root cause (measured, corrects the committed rdns_mode/binding framing):
charm-ovn-central derives its TLS common_name from get_hostname(its
metal-internal address); that plane is deliberately isolated (D-052) with no
reachable resolver, so the reverse lookup returns None -> empty CN -> vault
issues no server cert -> OVN cluster never forms. rdns_mode=2 and the PTR
exist; only the reverse is unreachable from the isolated plane.

Binding approach REFUTED live (3 configs): the charm uses the metal-internal
address regardless of which endpoint is rebound, and juju default-route
selection is not tied to the default binding. So the app STAYS on
metal-internal (D-052-correct for its OVSDB/certificates data type).

Fix PROVEN end-to-end (controlled single-unit test): an /etc/hosts reverse
entry -> CN populated -> vault issued ovn-central_0.server.cert ->
/etc/ovn/{cert_host,key_host,ovn-central.crt} written; control units without
it stayed broken. OVN imposes no CN-content rule; vault signs any non-empty CN.

Wired (verify-at-provision on the redeploy):
- NEW scripts/dc-node-etchosts.sh + tests/dc-node-etchosts (harness 9/9):
  renders a per-DC cloudinit-userdata adding each node's metal-internal
  address -> hostname to /etc/hosts at provision; CIDR derived from lib-net
  (dc0 10.12.12.0/22, dc1 10.12.72.0/22). Rendered runcmd executed live and
  correctly scoped to metal-internal.
- runbooks/phase-01-bundle-deploy.md Step 1.2b: gated pre-deploy step
  (after add-model, before deploy), VR1-only.
- A NEW mechanism borrowing D-008's shape, not D-008 itself.

Records: reeval RESOLUTION + CURRENT-STATE RESOLVED+WIRED + changelog; the old
rdns_mode remediation is VOID. Gauntlet ALL GREEN (99), repo-lint 0 fail.
Live tests were reversible; model left at its captured before-state.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf

CORRECT ovn-central root cause: NOT rdns_mode -- metal-internal is isolated (no reachable resolver) ...

Autonomous step-1 measurement refuted the committed rdns_mode diagnosis:
- rdns_mode=2 on ALL planes; the PTR EXISTS at the region BIND (10.12.8.6
  answers dig -x 10.12.12.122). "enable rdns_mode" is a VOID no-op.
- metal-internal is deliberately isolated (link-scoped routes only; ping -I
  eth1 10.12.8.6 -> NO ROUTE). The region controller has no metal-internal
  interface, so no resolver is reachable on that plane.
- systemd-resolved scopes the reverse of a container's OWN metal-internal
  address to eth1 -> no reachable resolver -> empty cert CN. Discriminating
  test (advisor-directed): both links set to the reachable 10.12.8.6 STILL
  failed "No route to host" -> NOT a dns_servers change either.

The fix is therefore a DECISION (decouple ovn-central's cert CN from
metal-internal reverse-DNS), a precondition for any redeploy (same MAAS,
verify at provision time). VOID banners + CORRECTION blocks added to the
reeval, remediation-plan, sweep, and CURRENT-STATE. Refutation of LP #2044324
and the vault-issuance rule are unchanged and stand.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf

audit: ovn-central cert reeval + remediation plan + Stage-5 misses sweep ...

Re-evaluation of the prior (wrong) ovn-central "awaiting server certificate
data" diagnosis, from fresh live measurement + 3 source-level agents + an
adversarial review. Corrected root cause: ovn-central derives its cert CN from
a REVERSE lookup of its metal-internal address; metal-internal is the only
plane of six without reverse-DNS PTRs, so get_hostname() -> None -> empty
common_name -> vault issues no server cert -> ovn-central blocks. LP #2044324
is NO MATCH; no upstream fix / channel bump helps.

- ovn-central-cert-reeval-20260803.md      -- root cause, evidence, what the
  prior diagnosis got wrong, ranked remedies, why-no-PTR.
- ovn-central-cert-remediation-plan-20260803.md -- gated rdns_mode + re-fire
  sequence with corrected (non-false-green) acceptance criteria.
- stage5-sweep-misses-20260803.md          -- F1 metal-internal rdns outlier +
  standup tooling never sets rdns_mode; F2 four hacluster units blocked on
  stale pre-D-141 IPv6 VIP CIB resources; F3 octavia error is downstream of
  neutron VIP TLS. Meta: incomplete-transition tails.

All findings MEASURED read-only this session; every remediation step is
operator-gated and NOT executed. SEC-033 (relation databag exposes vault
global-client key) noted for separate filing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf