diff --git a/bundle.yaml b/bundle.yaml index f6fed0d..d4cc719 100644 --- a/bundle.yaml +++ b/bundle.yaml @@ -478,7 +478,14 @@ num_units: 3 to: [lxd:0, lxd:1, lxd:2] bindings: - '': metal-admin + # D-052 AMENDMENT 2026-08-03: default '' on metal-internal, NOT metal-admin. ovn-central + # resolves its internal/admin/public cert addresses via the DEFAULT binding; on metal-admin + # in this multi-space model it finds no address, skips the server-cert request, and never + # gets a server cert (charm-ovn-central LP #2044324, multi-space-specific) -- so its TLS + # OVSDB never starts and the OVN NB/SB cluster never forms. Its certificates+ovsdb* already + # bind metal-internal; putting the default there makes cert resolution single-space (the + # proven pre-D-052 shape). D-052 isolation is unchanged for every other app. + '': metal-internal certificates: metal-internal coordinator: metal-internal ovsdb: metal-internal diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index a33fd7a..7d93f34 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -2068,13 +2068,15 @@ + ovsdb* endpoints already live there); D-052 isolation unchanged for every other app. Full text: `docs/design-decisions.md` D-052 amendment 2026-08-03. **BUNDLE PLANE-PURPOSE SWEEP DONE (operator-requested), all 56 apps, capture - `docs/audit/binding-plane-purpose-sweep-20260803.txt`:** exactly ONE other deviation -- - `openstack-dashboard:cluster` binds metal-admin where D-052 places cluster peers on - metal-internal (sole outlier of 14 cluster-carrying apps; functionally benign but off-intent) - -- PROPOSED, not yet ruled. Four classifier flags verified NON-issues (octavia:ovsdb-cms - dangling/unused; ceph-radosgw public/object-store/cluster are gateway endpoints correctly - placed). NEXT: apply the ovn-central rebind (bundle + live `juju bind`), verify ovn-central - gets its server cert and the OVN cluster forms; decide the dashboard fix. + `docs/audit/binding-plane-purpose-sweep-20260803.txt`:** NO other real deviation. **CORRECTED:** + the first pass flagged `openstack-dashboard:cluster` (metal-admin) as a 2nd deviation; it is + **D-072 / BUNDLEFIX-011** (ruled, as-executed), documented at `bundle.yaml:667` -- cluster on + metal-internal makes the dashboard VIP HTTPS DEAD (horizon vhost quirk), so reverting it + reintroduces the bug D-072 fixed. My sweep classified by binding VALUE without grepping the + governing D-NNN; caught by reading the in-bundle comment before applying. Five flags verified + NON-issues (D-072 dashboard; octavia:ovsdb-cms dangling; ceph-radosgw gateway endpoints). **ONLY + ovn-central changes.** APPLIED to `bundle.yaml` (default -> metal-internal, provider-bundle-check + PASS); NEXT: re-stage + live `juju bind ovn-central`, verify server cert + OVN cluster forms. **>>> PRE-VAULT-INIT END STATE REACHED; VAULT PREFLIGHT PASSES `PROCEED` 2026-08-03. <<<** After the stall fix, the model converged: `scripts/phase-02-vault-preflight.sh vr1-dc0` (staged + sha256-verified on the rack, `90910dfb`) reports **PROCEED** -- mysql cluster 3/3 diff --git a/docs/audit/binding-plane-purpose-sweep-20260803.txt b/docs/audit/binding-plane-purpose-sweep-20260803.txt index eaad98c..2fe3e9d 100644 --- a/docs/audit/binding-plane-purpose-sweep-20260803.txt +++ b/docs/audit/binding-plane-purpose-sweep-20260803.txt @@ -19,7 +19,13 @@ storage : Ceph public (rbd client + mon + ceph control) replication : Ceph OSD cluster replication -RAW FLAGS: 6. AFTER VERIFICATION: 2 real, 4 non-issues. +RAW FLAGS: 6. AFTER VERIFICATION: 1 real (ovn-central), 5 non-issues. + +>>> CORRECTION 2026-08-03: my first pass called openstack-dashboard:cluster a 2nd real +>>> deviation. IT IS NOT -- it is D-072 / BUNDLEFIX-011, a RULED, as-executed fix documented +>>> in a comment RIGHT ABOVE the line in bundle.yaml (:667). I classified by binding VALUE and +>>> did not grep the governing D-NNN (CLAUDE.md requires that before touching a built surface). +>>> Reverting it would reintroduce the dashboard-VIP-HTTPS-dead bug D-072 repaired. NOT fixed. -------------------------------------------------------------------------------------- REAL DEVIATIONS (2) @@ -32,13 +38,16 @@ Operator ruling 2026-08-03: "ovn-central should be in metal-internal." (D-052 amendment for one app; isolation intact elsewhere.) -2. openstack-dashboard cluster metal-admin -> metal-internal [FOUND BY SWEEP] - `cluster` is the dashboard's HA peer relation. D-052 places cluster peers on - metal-internal, and EVERY other app with a cluster endpoint binds it there (barbican, - cinder, glance, keystone, magnum, mysql-innodb-cluster, neutron-api, nova-cloud-controller, - octavia, placement, rabbitmq, vault, memcached). openstack-dashboard is the SOLE outlier - -- an oversight, not intent. Functionally works on metal-admin but violates the D-052 - service-to-service-on-metal-internal intent. Recommend fix to metal-internal. +2. openstack-dashboard cluster metal-admin -- NOT A DEVIATION (CORRECTED). This is + D-072 / BUNDLEFIX-011 (ADOPTED + as-executed 2026-07-05), documented in a comment directly + above the binding (bundle.yaml:667): horizon renders haproxy's 443 backend on the CLUSTER + binding address but only creates apache SSL vhosts for the default + public addresses, so + cluster on metal-internal = TLS backend on a vhost-less address = dashboard VIP HTTPS DEAD + (L4 check masks it). metal-admin matches the default binding so the backend lands on a served + vhost. Reverting it reintroduces the exact bug D-072 fixed. DO NOT TOUCH. My sweep flagged it + because it compared binding VALUES against generic D-052 purposes without grepping the + governing D-NNN -- the lesson: a binding that deviates from the generic rule may be a RULED + EXCEPTION, and CLAUDE.md requires grepping the D-NNN before calling a built value a defect. -------------------------------------------------------------------------------------- VERIFIED NON-ISSUES (4) -- classifier false positives, confirmed against relations @@ -54,5 +63,6 @@ (ceph-radosgw:mon -> storage IS correct: it reaches ceph-mon on the storage plane.) -------------------------------------------------------------------------------------- -CONCLUSION: fix 2 bindings -- ovn-central (default) and openstack-dashboard:cluster, -both -> metal-internal. Every other binding matches its plane's D-052 purpose. +CONCLUSION: fix ONE binding -- ovn-central (default) -> metal-internal. Every other +binding either matches its plane's D-052 purpose or is a DOCUMENTED ruled exception +(openstack-dashboard:cluster = D-072). No other change. diff --git a/docs/design-decisions.md b/docs/design-decisions.md index d010a07..ae65c9c 100644 --- a/docs/design-decisions.md +++ b/docs/design-decisions.md @@ -886,14 +886,17 @@ **THE PLANE-PURPOSE SWEEP (all 56 apps, capture `docs/audit/binding-plane-purpose-sweep-20260803.txt`).** Every binding was classified against the plane purposes above and verified against the relation -topology. Result: exactly ONE other deviation -- -**`openstack-dashboard:cluster` binds `metal-admin` where D-052 places cluster PEERS on -`metal-internal`**; it is the sole outlier among 14 apps carrying a `cluster` endpoint (all -others `metal-internal`), an oversight not intent. Four classifier flags were verified NON-issues -(octavia:ovsdb-cms is a dangling endpoint in no relation; ceph-radosgw public/object-store/cluster -are gateway API/service/peer endpoints correctly placed). **The dashboard fix is PROPOSED, not -yet ruled** -- presented for the operator's decision; it is a genuine D-052-intent deviation but -functionally benign (dashboard HA peering works on metal-admin), so it is not urgent. +topology. Result: **NO other real deviation.** The +first pass flagged `openstack-dashboard:cluster` (metal-admin) as a 2nd deviation; **CORRECTED +-- it is D-072 / BUNDLEFIX-011**, a RULED, as-executed fix documented in a comment at +`bundle.yaml:667`: horizon renders haproxy's 443 backend on the cluster-binding address but only +creates apache SSL vhosts for the default+public addresses, so cluster on metal-internal = +dashboard VIP HTTPS dead. Reverting it reintroduces the bug D-072 fixed. The sweep flagged it +because it compared binding VALUES against generic plane purposes WITHOUT grepping the governing +D-NNN (which CLAUDE.md requires before touching a built surface); the lesson recorded. Five +classifier flags verified NON-issues (D-072 dashboard; octavia:ovsdb-cms dangling/unused; +ceph-radosgw public/object-store/cluster are gateway endpoints correctly placed). **Only the +ovn-central default binding changes.** **Roosevelt delta:** the per-DC bundle template binds ovn-central's `""` default to metal-internal from the start; a charm that resolves endpoint addresses via the default binding