diff --git a/docs/changelog-20260709-stage0-ratification.md b/docs/changelog-20260709-stage0-ratification.md new file mode 100644 index 0000000..ff47956 --- /dev/null +++ b/docs/changelog-20260709-stage0-ratification.md @@ -0,0 +1,86 @@ +# Changelog 2026-07-09 -- Stage 0 ratification: D-100..D-110 ADOPTED (DOCFIX-150) + +No live infrastructure touched -- decision-record edits only. Closes Stage 0 +of `docs/dc-dc-deployment-workflow.md`, the gate blocking real Phase-0/1/2 +work since the DC-DC design was drafted this same day. + +## Item + +### 1. DOCFIX-150 -- Stage 0 decision ratification +FILES: `docs/design-decisions.md` (11 status-line updates + D-101 +amendment + D-102 merge), `docs/dc-dc-buildout-design.md` (Section 10 +rewritten as a ruling record, Section 3's Ceph gate annotated, stray +"Section D-102" cross-reference corrected to D-101), `docs/session-ledger.md` +(machine-derived block re-seeded, narrative entry). + +WHAT: operator ruled on the buildout design's 6 redline items (via two +AskUserQuestion rounds, live) and on each of D-100 through D-110 +individually, per this repo's own discipline ("present options, do not +implement" until ruled -- this delivery is the ruling, not a unilateral +implementation). + +**Redline rulings:** +- Ceph replication factor: size=3 by default; size=2 only as an explicit, + logged Phase-0 fallback if the measured disk budget doesn't fit -- never a + silent choice. +- `tc netem` link profile: same-metro dark-fiber lean, confirmed; re-tune + when a specific Roosevelt inter-DC target is known. +- D-102 (IPv6 tenant/MTU sub-policy) folds into D-101 (address plan); D-109 + (Vault posture) stays standalone, NOT merged. +- metal-admin: GAINS a ULA (IPv6) leg alongside its existing v4 -- this + REVERSES the buildout design's own stated lean ("keep metal-admin + v4-only"). A genuine ruling, not a rubber-stamp of the recommended default. +- COS (observability): per-DC only for VR1, confirmed (no Office1 roll-up). +- Per-DC artifact mirror sync topology: independent upstream pull per DC, + confirmed (not one DC seeding the peer). + +**Per-decision disposition, `docs/design-decisions.md`:** +- D-100, D-103, D-104, D-105, D-106, D-107, D-108, D-110: status flipped + PROPOSED -> ADOPTED 2026-07-09 (operator ruling). D-100's netem/Office1- + fiber sub-items, D-105's COS sub-item, and D-107's mirror-topology + sub-item rewritten from "Open sub-item(s)" to "Sub-item(s) RULED," with + the operator's specific answer recorded inline. +- D-101: status ADOPTED + AMENDED same day -- the family matrix's + metal-admin line moved from "IPv4 retained" to the dual-stack group (the + ULA-leg ruling); D-102's full decision body folded in as a new "Tenant/MTU + sub-policy" section; the "Open sub-items" line narrowed to only the + genuinely still-open NetBox literals (a NetBox-assignment task, not a + ratification question -- already tracked as gap #3 in the deployment + workflow's tooling gap register). +- D-102: status changed to `MERGED INTO D-101 (2026-07-09, operator + ruling)`. Body text LEFT IN PLACE, per this repo's append-only + decision-record discipline -- the entry is retained for numbering/history, + not deleted; D-101 is now the current, authoritative text for this + sub-policy. +- D-109: status ADOPTED, explicitly noting it was confirmed to stand alone + despite D-102 folding into D-101 the same day (a real, considered + distinction, not an oversight -- Vault/security posture is different + enough from addressing to keep independently amendable). +- D-106's own open sub-item (cross-DC name resolution, not needed for VR1) + was NOT one of the six items the buildout doc flagged for explicit + redline -- adopted per its own stated lean along with the rest of D-106, + noted plainly in the decision text rather than silently assumed. + +VERIFIED, not just asserted: `bash scripts/ledger-scan.sh`'s "PROPOSED / OPEN +decisions" list no longer contains any of D-100 through D-110 -- only D-068 +and D-071 remain (pre-existing, unrelated to this gate). `repo-lint.sh`: +0 fail / 1 documented legacy warn (unchanged). `tests/repo-lint` harness: +34/34 (unchanged -- no script logic touched, decision-record content only). + +`docs/dc-dc-deployment-workflow.md`'s Stage 0 banner and summary table, +plus the companion visual tracker, updated to reflect Stage 0 CLEARED (see +the companion Artifact redeploy). + +REVERT: `git checkout HEAD~ -- docs/design-decisions.md +docs/dc-dc-buildout-design.md docs/session-ledger.md` (re-opens Stage 0 -- +not recommended; if a specific ruling needs reconsidering, amend that one +decision's entry instead of reverting the whole ratification). + +## Next actionable step + +Stage 0 cleared -- Stage 1 (Phase 0: vcloud host prep) and onward can now +proceed on runbook/tooling authorship without an open-decision blocker. +Real values still pending NetBox assignment (DC2's supernet, the org ULA +/48, per-DC GUA carve) and infrastructure access (a `tofu`/`qemu-img`/ +ISO-tool-capable machine, a real vcloud host) remain separate, non-decision +blockers -- tracked in the tooling gap register, not this ratification. diff --git a/docs/dc-dc-buildout-design.md b/docs/dc-dc-buildout-design.md index 23a1a12..c9175a6 100644 --- a/docs/dc-dc-buildout-design.md +++ b/docs/dc-dc-buildout-design.md @@ -62,18 +62,20 @@ - Nested KVM: confirm / enable (`nested` module param; Intel vs AMD differs). Verify guest virtualization is exposed to the DC node VMs. -- Ceph replication factor: target size=3 / min_size=2 (production-honest, lowest delta). - This is CONDITIONAL on the disk budget. The Phase-0 disk math must account for: DC1 Ceph - (size=3) + DC2 Ceph (size=3) + per-DC radosgw backup pools (themselves replicated within - each cluster, and duplicated cross-DC by multisite) + Glance rbd-mirror targets + images - + per-DC mirrors. If size=3 across both clusters plus the backup/mirror footprint exceeds - 10 TiB, fall back to size=2 as an EXPLICIT, documented test-only deviation (its own - decision note), never a silent choice -- Roosevelt sizing must not inherit a hidden 2x. +- Ceph replication factor: **RULED 2026-07-09 (operator):** target size=3 / min_size=2 + by default (production-honest, lowest delta), CONFIRMED. This is CONDITIONAL on the disk + budget. The Phase-0 disk math must account for: DC1 Ceph (size=3) + DC2 Ceph (size=3) + + per-DC radosgw backup pools (themselves replicated within each cluster, and duplicated + cross-DC by multisite) + Glance rbd-mirror targets + images + per-DC mirrors. If size=3 + across both clusters plus the backup/mirror footprint exceeds 10 TiB, fall back to size=2 + as an EXPLICIT, documented test-only deviation (its own decision note) -- CONFIRMED as the + ONLY path to size=2: never a silent choice, Roosevelt sizing must not inherit a hidden 2x. Thin-provisioning is the lever; the reserve split (Ceph vs backup/mirror/images) is set in Phase 0 from the measured DC0 per-node OSD footprint. -- MTU: measure the host L2 MTU. Compute the geneve-over-v6 budget (Section D-102). Prefer - jumbo (9000) end-to-end; if pinned at 1500, set the reduced tenant MTU consistently. Do - not assume jumbo. MTU stacking (nested virt + geneve + VLAN) is the classic failure mode. +- MTU: measure the host L2 MTU. Compute the geneve-over-v6 budget (D-101, folded in from + D-102 per the 2026-07-09 operator ruling). Prefer jumbo (9000) end-to-end; if pinned at + 1500, set the reduced tenant MTU consistently. Do not assume jumbo. MTU stacking (nested + virt + geneve + VLAN) is the classic failure mode. ## 4. Phase spine @@ -89,7 +91,7 @@ the MTU plan set on the underlay. Gate: nested KVM verified; disk budget computed and the Ceph size decision recorded; measured MTU recorded; virtual networks present and isolated as designed. -Owns: D-100 (fabric), D-101/D-102 (MTU), Section 3 gates. +Owns: D-100 (fabric), D-101 (MTU -- folds in former D-102 per the 2026-07-09 operator ruling), Section 3 gates. ### Phase 1 -- Office1 headend standup Goal: stand up the operator's deployment headend first, before any DC. @@ -202,14 +204,26 @@ - Single-unit controllers (D-104) and single-unit rbd-mirror daemon (D-108) are VR1 test economies; Roosevelt scales both to HA. -## 10. Open items for operator redline +## 10. Operator redline -- RULED 2026-07-09 (Stage 0 ratification complete) -- Ceph size=3 vs a documented size=2 fallback (gated on the Phase-0 disk math). -- netem link profile (same-metro lean vs a specific Roosevelt inter-DC target). -- Whether D-102 folds into D-101, and whether D-109 stands alone. -- metal-admin admin-API ULA leg (lean: no). -- COS per-DC-only vs an Office1 roll-up (lean: per-DC only). -- Mirror sync topology (independent upstream pull per DC vs seed-from-peer). +All six items below were ruled by the operator on 2026-07-09; see the referenced +D-NNN entries in `docs/design-decisions.md` for the authoritative recorded text. +D-100 through D-110 are now ADOPTED (D-102 MERGED into D-101; D-109 confirmed +standalone) -- Stage 0 of `docs/dc-dc-deployment-workflow.md` is CLEARED. + +- Ceph size=3 vs a documented size=2 fallback: **RULED** -- size=3 by default, + size=2 only as an explicit, logged Phase-0 fallback if the disk math doesn't + fit (Section 3). +- netem link profile: **RULED** -- same-metro lean now (D-100), re-tune when a + specific Roosevelt inter-DC target is known. +- Whether D-102 folds into D-101, and whether D-109 stands alone: **RULED** -- + D-102 folds into D-101; D-109 stays standalone (D-101, D-109). +- metal-admin admin-API ULA leg: **RULED** -- ADDED (reverses the stated lean; + D-101). +- COS per-DC-only vs an Office1 roll-up: **RULED** -- per-DC only, confirming + the stated lean (D-105). +- Mirror sync topology: **RULED** -- independent upstream pull per DC, + confirming the stated lean (D-107). ## 11. Landing this deliverable diff --git a/docs/dc-dc-deployment-workflow.md b/docs/dc-dc-deployment-workflow.md index 7705570..c6b0a77 100644 --- a/docs/dc-dc-deployment-workflow.md +++ b/docs/dc-dc-deployment-workflow.md @@ -14,29 +14,21 @@ --- -## Stage 0 -- Decision ratification (BLOCKING) +## Stage 0 -- Decision ratification (CLEARED 2026-07-09) -Nothing in Stage 1 onward starts until this clears. D-100..D-110 are ALL -**PROPOSED**, not ADOPTED (see `docs/design-decisions.md`). +**RATIFIED.** D-100..D-110 are ALL ADOPTED (`docs/design-decisions.md`; +D-102 MERGED into D-101 per the operator's own ruling, not deleted -- +retained for numbering/history; D-109 confirmed standalone). All 6 +redline items ruled (`docs/dc-dc-buildout-design.md` Section 10 is now a +ruling record, not an open list): Ceph size=3-by-default (size=2 only as an +explicit Phase-0 fallback); netem same-metro lean; D-102/D-101 merge + +D-109 standalone; metal-admin GAINS a ULA leg (a real reversal of the +stated lean, not a rubber-stamp); COS per-DC-only; mirror sync independent +per-DC. Verified via `bash scripts/ledger-scan.sh`: none of D-100..D-110 +appear under "PROPOSED / OPEN decisions." Full ruling record: +`docs/changelog-20260709-stage0-ratification.md`. -1. Operator reviews `docs/dc-dc-buildout-design.md` in full. -2. Rule on each of D-100..D-110 individually (ADOPTED / AMENDED / REJECTED) -- - not a blanket approval; each carries distinct, separable scope. -3. Rule on the 6 open-redline items (buildout design Section 10): - - Ceph `size=3` vs a documented `size=2` fallback (gated on Phase-0 disk math) - - `tc netem` link profile (same-metro lean vs a specific Roosevelt target) - - Whether D-102 folds into D-101, and whether D-109 stands alone - - metal-admin admin-API ULA leg (lean: no) - - COS per-DC-only vs an Office1 roll-up (lean: per-DC only) - - Mirror sync topology (independent upstream pull per DC vs seed-from-peer) -4. Record each ruling as an amendment in `docs/design-decisions.md` (same - convention as every prior D-NNN ruling in this repo). - -**Exit gate:** every D-100..D-110 is ADOPTED or explicitly deferred with a -documented fallback. `bash scripts/ledger-scan.sh` should show none of them under -"PROPOSED / OPEN decisions" (or only the explicitly-deferred ones). - -**State:** NOT STARTED. +**State:** DONE. --- @@ -47,7 +39,7 @@ | **Goal** | Turn the bare vcloud host into a substrate Office1 can deploy from. | | **Build** | Nested KVM enabled; libvirt storage pools + thin-provisioning; dark-fiber + per-site ISP-edge virtual networks; the six per-DC plane segments as virtual networks; MTU plan set on the underlay. | | **Gate** | Nested KVM verified; disk budget computed + Ceph size decision recorded; measured MTU recorded; virtual networks present and isolated as designed. | -| **Owns** | D-100 (fabric), D-101/D-102 (MTU), buildout-design Section 3 (host/disk/MTU gates). | +| **Owns** | D-100 (fabric), D-101 (MTU -- folds in former D-102), buildout-design Section 3 (host/disk/MTU gates). | | **Reuse vs new** | NEW. No VR0-DC0 analog -- that testcloud IS the single vcloud host, already prepared; this is preparing the host to carry TWO independent DC substrates plus Office1. | | **Authoring status** | Runbook not started. `opentofu/` SCAFFOLD started 2026-07-09: `modules/dc-planes` (six per-DC planes) + `modules/mesh-link` (dark-fiber legs) + `modules/dc-storage-pool` wired for DC1 + Office1 -- see `opentofu/README.md` for what's built vs deliberately deferred (node-VM/domain resources, DC2 CIDRs, netem). UNVALIDATED: no `tofu` binary available to run `scripts/opentofu-validate.sh` yet. | @@ -318,7 +310,7 @@ | Layer | Status | |---|---| | Design (`dc-dc-buildout-design.md`) | DONE, PROPOSED | -| Decisions (D-100..D-110) | DRAFTED, ALL PROPOSED -- **Stage 0 is the very next action** | +| Decisions (D-100..D-110) | **ADOPTED 2026-07-09** (D-102 merged into D-101; D-109 standalone) -- Stage 0 CLEARED | | DR mechanism seed | DONE (`dc-dc-replication-DR-seed.md`), superseded-carrier corrected into D-108 | | Stage 0-7 runbooks | NOT YET WRITTEN -- see Tooling gap register above for the itemized breakdown | | `opentofu/` (networks/pools/node-VM PXE/cloud-init-VM patterns) | SCAFFOLDED 2026-07-09, UNVALIDATED (no `tofu` binary available this session) -- see gap #2 and `opentofu/README.md` | diff --git a/docs/design-decisions.md b/docs/design-decisions.md index f8e828c..b7b868e 100644 --- a/docs/design-decisions.md +++ b/docs/design-decisions.md @@ -1943,7 +1943,7 @@ ## D-100: Inter-DC network topology and fabric (VR1) -**Status:** PROPOSED 2026-07-09 (DC-DC planning). Instantiates the D-052 per-DC template across two DCs. +**Status:** ADOPTED 2026-07-09 (operator ruling). Instantiates the D-052 per-DC template across two DCs. **Context:** VR1 is a virtual regional two-DC test environment (DC1, DC2, plus an Office1 headend), all nested libvirt VMs on one vcloud host, rehearsing the future bare-metal multi-DC site (Roosevelt). D-052 already defines the six-plane per-DC template and tags metal-admin DC-local / metal-internal "may-cross-fiber" -- but that label assumed a single stretched cloud. @@ -1957,13 +1957,13 @@ **References:** instantiates D-052 (six-plane per-DC template; independent-cloud cross-fiber refinement); carries the D-057 root-cause br-ex discipline as revised by D-060 (Pattern A); pairs with D-101 (families), D-107 (edge egress), D-108 (replication). -**Open sub-items:** exact netem parameters (Phase-0 measurement + Roosevelt target); whether Office1<->DC fiber carries anything beyond MAAS / Juju / operator management (lean: management only). +**Sub-items RULED 2026-07-09 (operator):** netem link profile -- same-metro dark-fiber lean CONFIRMED as the default (low single-digit ms, jumbo-capable); re-tune when a specific Roosevelt inter-DC target is known, not before. Office1<->DC fiber carries management traffic only (MAAS/Juju/operator) -- CONFIRMED per the stated lean (not one of the six items the buildout doc listed for explicit redline; adopted with the rest of D-100, flag if this needs separate reconsideration). --- ## D-101: DC-DC address plan and IPv6 family matrix (VR1) -**Status:** PROPOSED 2026-07-09. Activates the developed family-follows-reachability IPv6 plan for VR1. NetBox (vcloud-local) is the IPAM authority for all literals. +**Status:** ADOPTED 2026-07-09 (operator ruling), AMENDED same day: (a) metal-admin gains a ULA leg (reverses this decision's own stated lean, see the family matrix below); (b) D-102 (IPv6 tenant addressing and MTU sub-policy) is MERGED into this decision per operator ruling -- D-102's entry is retained for numbering/history only, see its own Status line. Activates the developed family-follows-reachability IPv6 plan for VR1. NetBox (vcloud-local) is the IPAM authority for all literals. **Context:** v1 / DC0 is IPv4-only on 10.12.0.0/16 (six planes in `scripts/lib-net.sh`). The developed IPv6 plan (in-project, not yet committed) classifies planes by reachability: GUA for external clients, ULA for internal-only, IPv4 where forced. DC-DC is the phase that activates it. @@ -1971,23 +1971,29 @@ - Per-DC distinct v4: DC1 INHERITS the DC0 six-plane v4 layout (provider-public 10.12.4.0/22 ... replication 10.12.36.0/22) unchanged, so DC1 equals the validated template. DC2 gets a DISTINCT, non-overlapping parallel supernet (same six-plane structure; exact prefixes assigned in NetBox, non-colliding with DC1, operator infrastructure, and client VPN ranges per D-074). Distinct ranges keep DR / backup endpoints unambiguous (no NAT hairpin). - Family matrix (per DC), family follows reachability: - IPv6-only ULA: data-tenant (geneve underlay), storage (Ceph public), replication (Ceph cluster, including the cross-DC leg), Octavia lb-mgmt, and P2P links. Internal, no external clients. - - Dual-stack (IPv4 + ULA v6): the metal-internal API-endpoint VIPs gain a v6 (ULA) address; each DC's Vault issues IPv6-SAN certs (D-109). - - IPv4 retained: MAAS PXE / provisioning (PXE is v4-first); metal-admin (operator / MAAS / admin API, DC-local); and datastore east-west (MySQL / RabbitMQ stay v4-bound -- the plane is dual-stack-capable but v6 there is not chased: marginal benefit, real cert / complexity cost). + - Dual-stack (IPv4 + ULA v6): the metal-internal API-endpoint VIPs gain a v6 (ULA) address; each DC's Vault issues IPv6-SAN certs (D-109). **AMENDED 2026-07-09 (operator ruling):** metal-admin ALSO joins this dual-stack group (a ULA leg alongside its existing v4) -- reverses this decision's original lean of keeping metal-admin v4-only; PXE itself stays v4-first regardless (see below), the ULA leg is for the admin-API traffic on that plane, not PXE. + - IPv4 retained: MAAS PXE / provisioning (PXE is v4-first, unaffected by the metal-admin amendment above); and datastore east-west (MySQL / RabbitMQ stay v4-bound -- the plane is dual-stack-capable but v6 there is not chased: marginal benefit, real cert / complexity cost). - GUA (ARIN 2602:f3e2::/32, region-0 /36): provider public API VIPs, native v6 ext_net, tenant pool delegation. Enabled here because the simulated OPNsense edge is ours -- the D-015 "upstream-router IPv6 readiness" gate on external GUA does NOT apply in VR1, so VR1 can rehearse the full internal-ULA plus external-GUA end state. - Replication carrier correction: the DR seed names the cross-DC carrier as v4 10.12.36.0/22. Per this matrix and the operator ruling that replication is not IPv4-bound, the cross-DC replication carrier is IPv6-only ULA (a /64 from the org ULA /48). This SUPERSEDES the DR-seed carrier line. v1 / DC0 `lib-net.sh` v4 values are unchanged (DC-DC assigns families on its own layer). - Literals: the org ULA /48, the per-DC GUA carve out of the /36, and DC2's v4 supernet are NetBox-authoritative, populated via the extended import pipeline (`netbox/*-import.py` extended for multi-DC and dual-stack). They are NOT hardcoded in this decision. +- **Tenant/MTU sub-policy (folded in from D-102, 2026-07-09 operator ruling):** + - Tenant v6 routing: native GUA routing, no NAT66 -- the simulated OPNsense edge routes tenant GUA prefixes (prefix delegation or static routes). NAT66 is discouraged and we own the edge, so native is both correct and feasible. + - Tenant v6 block size: /60 per tenant default (~4080 per cloud); /56 available on request. + - Tenant address mode: SLAAC default (RA); DHCPv6-stateful available for tenants needing deterministic addressing. + - MTU / geneve-over-v6: compute the exact byte budget in Phase 0 against the MEASURED host L2 MTU. An IPv6 outer header adds 20 bytes over IPv4 (40 vs 20); geneve-over-v6 overhead is about 40 (IPv6) + 8 (UDP) + 8 (Geneve base) = 56 bytes, before nested-virt and options. Recommendation: raise the vcloud underlay to jumbo (9000) end-to-end so tenant MTU stays 1500 and amphora/geneve fit; if the underlay is pinned at 1500, tenant MTU drops to about 1444 (v6-geneve) and MUST be set consistently across ovn geneve, tenant-network MTU, and amphora. The measured underlay MTU is a Phase-0 gate -- do not assume jumbo. + - Phase-A rollback posture: go straight to IPv6-only on the internal three (data / storage / replication) rather than dual-stack-then-flip, given plane isolation and the Octavia ULA proof. Dual-then-flip is the conservative alternative if Phase-0 verification of Ceph-over-v6 / geneve-over-v6 is not clean. -**Rationale / tradeoffs:** matches the operator directive (v6 wherever possible, v4 only where forced) and maximizes Roosevelt rehearsal value (proves Ceph-over-v6, geneve-over-v6, native v6 tenant routing). The two forced-v4 points (PXE, datastore east-west) are explicitly justified rather than incidental. +**Rationale / tradeoffs:** matches the operator directive (v6 wherever possible, v4 only where forced) and maximizes Roosevelt rehearsal value (proves Ceph-over-v6, geneve-over-v6, native v6 tenant routing). The two forced-v4 points (PXE, datastore east-west) are explicitly justified rather than incidental. Native routing plus SLAAC for tenants is the IPv6-correct default; the MTU budget is the classic nested-OpenStack failure mode, handled by measurement plus jumbo. Ceph-over-v6 (`ms_bind_ipv6`) and OVN geneve-over-v6 remain Phase-0 verification gates in the buildout doc. -**References:** activates the developed IPv6 plan (its Phase A/B/C); carries D-016 / D-074 (tenant CIDR policy); supersedes the DR-seed v4 replication carrier; feeds D-102 (tenant/MTU), D-106 (AAAA), D-108 (replication), D-109 (Vault v6-SAN). NetBox is IPAM apex. +**References:** activates the developed IPv6 plan (its Phase A/B/C); carries D-016 / D-074 (tenant CIDR policy); supersedes the DR-seed v4 replication carrier; feeds D-106 (AAAA), D-108 (replication), D-109 (Vault v6-SAN, kept standalone per 2026-07-09 operator ruling -- not merged here). NetBox is IPAM apex. -**Open sub-items:** the exact NetBox literals; whether the metal-admin admin-API endpoint also gets a ULA leg (lean: no -- keep metal-admin v4-only, it is DC-local operator/PXE). +**Remaining open item:** the exact NetBox literals (org ULA /48, per-DC GUA carve, DC2's v4 supernet) -- pending NetBox assignment (gap #3 in `docs/dc-dc-deployment-workflow.md`'s tooling gap register), not a ratification question. --- ## D-102: IPv6 tenant addressing and MTU sub-policy (VR1) -**Status:** PROPOSED 2026-07-09. Kept separate from D-101 (tenant-facing sub-policy vs the plane matrix); merge on operator preference. +**Status:** MERGED INTO D-101 (2026-07-09, operator ruling). Content below is retained for numbering/history only, per this repo's append-only decision-record discipline -- D-101 is now the current, authoritative text for this sub-policy. Do not amend the body below; amend D-101 instead. **Decision (leans; operator to ratify):** - Tenant v6 routing: native GUA routing, no NAT66 -- the simulated OPNsense edge routes tenant GUA prefixes (prefix delegation or static routes). NAT66 is discouraged and we own the edge, so native is both correct and feasible. @@ -2004,7 +2010,7 @@ ## D-103: OpenTofu / MAAS / Juju lifecycle seam (VR1) -**Status:** PROPOSED 2026-07-09. Resolves the double-specified node-VM ownership question. +**Status:** ADOPTED 2026-07-09 (operator ruling). Resolves the double-specified node-VM ownership question. **Decision:** - OpenTofu owns create / destroy of: the libvirt domains that stand in for DC "hardware"; all virtual networks (the dark-fiber, plane, and ISP-edge segments); the OPNsense edge VMs; and the Office1 service VMs (MAAS-region, NetBox, GitBucket). OpenTofu runs from the Office1 operator VM against the vcloud host libvirt. @@ -2022,7 +2028,7 @@ ## D-104: Juju controller topology and HA posture (VR1) -**Status:** PROPOSED 2026-07-09. Adds the controller-topology / HA posture the DC-DC phase was gated on. References D-071 (patch cadence); does NOT amend it. +**Status:** ADOPTED 2026-07-09 (operator ruling). Adds the controller-topology / HA posture the DC-DC phase was gated on. References D-071 (patch cadence); does NOT amend it. **Decision:** - One Juju controller PER DC, deployed in-DC (on a MAAS-deployed machine in that DC), each managing only its own cloud. DR-independent: a controller loss affects only its DC. @@ -2038,7 +2044,7 @@ ## D-105: CAPI management-cluster placement and COS / Magnum scope (VR1) -**Status:** PROPOSED 2026-07-09. Carries D-035 to the two-DC topology. +**Status:** ADOPTED 2026-07-09 (operator ruling). Carries D-035 to the two-DC topology. **Decision:** - Each DC runs its OWN in-cloud, single-homed capi-mgmt cluster (per D-035), independent per DC. No shared or Office1 management cluster. @@ -2049,13 +2055,13 @@ **References:** carries D-035; carries D-046 (domain-setup re-run); COS / Magnum scope confirmed by operator. -**Open sub-item:** whether COS is per-DC-only or also aggregates a light roll-up at Office1 (lean: per-DC only for VR1; revisit for Roosevelt). +**Sub-item RULED 2026-07-09 (operator):** COS is per-DC-only for VR1, CONFIRMED (no Office1 roll-up) -- revisit for Roosevelt. --- ## D-106: Designate reactivation (VR1) -**Status:** PROPOSED 2026-07-09. SUPERSEDES D-019 (Designate deferral); REACTIVATES D-008 (DNS architecture). +**Status:** ADOPTED 2026-07-09 (operator ruling). SUPERSEDES D-019 (Designate deferral); REACTIVATES D-008 (DNS architecture). **Decision:** - Designate is deployed in-bundle in each DC, backend `designate-bind` (bind9, the Charmed-OpenStack-native backend, lowest delta). @@ -2066,13 +2072,13 @@ **References:** supersedes D-019; reactivates D-008; resolves the D-019 / D-021 root cause; AAAA depends on D-101. Office1 headend services use a region-level subdomain outside the per-cloud convention (e.g. `maas.office1.vr1...`) -- exact scheme is a buildout-doc detail. -**Open sub-item:** cross-DC name resolution (a DC1 tenant resolving a DC2 name) -- lean NOT needed for VR1 (independent clouds); revisit only if a federated-service requirement emerges. +**Sub-item adopted per its stated lean (2026-07-09):** cross-DC name resolution (a DC1 tenant resolving a DC2 name) is NOT needed for VR1 (independent clouds) -- this was not one of the six items the buildout doc listed for explicit operator redline, so it is adopted along with the rest of D-106 rather than separately re-asked; revisit only if a federated-service requirement emerges. --- ## D-107: Airgap posture, per-DC artifact mirror, and NTP (VR1) -**Status:** PROPOSED 2026-07-09. +**Status:** ADOPTED 2026-07-09 (operator ruling). **Decision:** - Airgap is enforced at the NODE level: OpenStack nodes (control / compute / ceph) reach NO internet directly. They pull all artifacts (apt, snap, charmhub, container registry, images including amphora) ONLY from an in-DC mirror. @@ -2083,13 +2089,13 @@ **References:** pairs with D-100 (per-site ISP edge), D-101 (disk budget), and the Phase-0 disk math. -**Open sub-item:** mirror sync topology (each DC pulls upstream independently vs one DC pulls and peers seed) -- lean independent upstream pull per DC for full independence; measure disk cost in Phase 0. +**Sub-item RULED 2026-07-09 (operator):** mirror sync topology is independent upstream pull per DC, CONFIRMED (not one DC pulling and seeding the peer) -- for full DC-redeploy-independence; measure the disk cost in Phase 0. --- ## D-108: Cross-DC replication mechanism (VR1) -**Status:** PROPOSED 2026-07-09. Engineers the mechanism for the SETTLED Tier-A DR decision (`docs/dc-dc-replication-DR-seed.md`); does not reopen the posture. +**Status:** ADOPTED 2026-07-09 (operator ruling). Engineers the mechanism for the SETTLED Tier-A DR decision (`docs/dc-dc-replication-DR-seed.md`); does not reopen the posture. **Decision (mechanism):** - Cinder volumes: `cinder-backup` to a cross-DC-replicated object store via `ceph-radosgw` MULTISITE (a zonegroup with the two DCs as zones; bucket-level bidirectional sync) as the replicated backup target. A restore reconstitutes the volume with its Cinder metadata in the peer -- the honest cross-independent-cloud path. Multisite is chosen over a single mirrored bucket for bidirectional, per-object async replication with conflict handling. @@ -2108,7 +2114,7 @@ ## D-109: Vault posture for VR1 -**Status:** PROPOSED 2026-07-09. +**Status:** ADOPTED 2026-07-09 (operator ruling). Confirmed to STAND ALONE, not merged into D-101 despite D-102 folding in the same day -- Vault/security posture is a distinct-enough surface to keep independently amendable. **Decision:** - Per-DC INDEPENDENT Vault roots (each DC's Vault is its own root CA; no regional root-of-trust this phase). @@ -2123,7 +2129,7 @@ ## D-110: DC-DC numbering and repo-seed policy -**Status:** PROPOSED 2026-07-09 (meta / process). +**Status:** ADOPTED 2026-07-09 (operator ruling; meta / process). **Decision:** - The DC-DC decision series starts at D-100 in the repo `openstack-caracal-dc-dc`, seeded from `openstack-caracal-ipv4` at commit 8813efc (verified: new-repo HEAD equals 8813efc; `design-decisions.md` ceils at D-075). diff --git a/docs/session-ledger.md b/docs/session-ledger.md index 9cfd246..bb479bb 100644 --- a/docs/session-ledger.md +++ b/docs/session-ledger.md @@ -21,22 +21,24 @@ ## Machine-derived (re-seed from `scripts/ledger-scan.sh`; do not hand-edit) -_As of 2026-07-09 scan (post-DOCFIX-140, new repo `openstack-caracal-dc-dc`); +_As of 2026-07-09 scan (post-DOCFIX-149, Stage 0/D-100..D-110 ratified); re-run the scan to refresh:_ - **PROPOSED / OPEN decisions:** D-068 (Vault substrate hardening, Roosevelt -- 1.16 ruled out per amendment; off-EOL path OPEN), D-071 (routine update cadence + controller patch policy -- operator to rule; gated on the pre-DC-DC HA/backup - session), D-100..D-110 (DC-DC/VR1 originating design -- ALL PROPOSED, awaiting - operator redline per `docs/dc-dc-buildout-design.md` Section 10/11). _(D-050 + session). **D-100..D-110 are ALL ADOPTED as of 2026-07-09** (D-102 MERGED into + D-101; D-109 confirmed standalone) -- Stage 0 of + `docs/dc-dc-deployment-workflow.md` is CLEARED; see + `docs/dc-dc-buildout-design.md` Section 10 for the ruling record. _(D-050 RESOLVED/CLOSED 2026-07-06 via D-051; D-073 APPLIED live 2026-07-06 -- not scan-tracked as open. D-076..D-099 are a RESERVED source-project band, never assigned in this repo, per D-110.)_ - **OPEN security rows:** SEC-001 (rotate at v1 close, re-ruled 2026-07-06), SEC-003 (custodians + second-person unseal -- DEFERRED; keeps d011-06 MANUAL), SEC-004 (flip repo to private at v1 close -- deferral reaffirmed). -- **Next-free numbers:** D = 111, DOCFIX = 141, BUNDLEFIX = 012. - (Seeded from the 2026-07-09 scan, post repo-rename sweep.) +- **Next-free numbers:** D = 111, DOCFIX = 150, BUNDLEFIX = 012. + (Seeded from the 2026-07-09 scan, post Stage-0 ratification.) --- @@ -902,6 +904,23 @@ freshly generated, never the stock sample's own shipped default). `opentofu/README.md` + workflow doc + visual tracker updated. Uncommitted -- operator has not yet asked to commit this piece. +- **DONE -- Stage 0 (decision ratification) RATIFIED 2026-07-09 (changelog + `docs/changelog-20260709-stage0-ratification.md`, DOCFIX-150):** operator + walked through the 6 buildout-design redline items live (AskUserQuestion, + 2 rounds): Ceph size=3-by-default (size=2 only as an explicit Phase-0 + fallback); netem same-metro lean; D-102 folds into D-101, D-109 stays + standalone; metal-admin GAINS a ULA leg (reverses the stated lean -- a + real deviation, not a rubber-stamp); COS per-DC-only confirmed; mirror + sync topology independent-per-DC confirmed. All 11 of D-100..D-110 + individually flipped PROPOSED -> ADOPTED in `docs/design-decisions.md` + (D-102's content preserved under a MERGED-INTO-D-101 status line, per the + append-only discipline -- not deleted). `docs/dc-dc-buildout-design.md` + Section 10 rewritten from "open items" to a ruling record; Section 3's + Ceph gate and the stray "Section D-102" cross-reference corrected to + D-101. **Verified via `ledger-scan.sh`: D-100..D-110 no longer appear + under PROPOSED/OPEN** -- only D-068/D-071 remain (separate, pre-existing, + unrelated to this gate). repo-lint 0 fail/1 documented warn, harness + 34/34. Stage 0 of `docs/dc-dc-deployment-workflow.md` is CLEARED.