diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index d0d313d..c302145 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -124,15 +124,15 @@ ## 3. What is AUTHORED-BUT-NOT-APPLIED (in the tree, not in state / live) -- voffice1 transit NIC (2026-07-19): `module "voffice1"` gains the - mesh-vr1-dc0-office1 leg (appended second; enp1s0 preserved) + a - per-NIC-named seed netplan with the region end `172.31.0.1/30` from - the D-124 tfvars. Basis: measured this session -- the transit net is - ISOLATED with only vvr1-dc0 attached; NOTHING held 172.31.0.1, so - step B had no ssh path and no rack->region enrollment path. Apply is - gated (planned voffice1 restart window); the LIVE address lands via - an in-guest netplan drop-in at the same gated step (cloud-init does - not re-run). See section 5 + the session changelog. +- (2026-07-20) The step-B transit-reach work is APPLIED and verified -- + voffice1 holds the region end `172.31.0.1/30` on enp2s0 (plus its + in-guest drop-in `/etc/netplan/60-transit.yaml`); `vvr1-dc0` answers + at `172.31.0.2` (netplan set-name root cause fixed, kernel names + enp1s0/enp2s0 kept); ssh `-J voffice1` with the dc0 key works; + rack->region ping 10.10.0.20 0% loss. Kea reservation re-keyed to the + regenerated voffice1 MAC (incident, session changelog item 3). + Consequence for the G10 bootstrap: call site-headend-install.sh with + `--transit-if enp1s0 --uplink-if enp2s0`. - `module "vvr1_dc0"` (`opentofu/main.tf:360`) -- the DC0 containment VM (416 GiB / 108 vCPU, D-121/D-123 sizing) + its disk, seed volume, and @@ -191,20 +191,18 @@ - pre-reboot gate was 5/0/6 (recorded at `docs/dc0-deploy-readiness.md:59`, `docs/session-ledger.md:278`). -The EXPECTED outer plan is **1/1/1** (voffice1 transit-NIC change, -AUTHORED 2026-07-19, apply gated): + replace of -`module.voffice1.libvirt_cloudinit_disk.seed` (network_config change; -seed VOLUME suppressed per D-130) + in-place interface add on -`module.voffice1.libvirt_domain.vm` (mesh transit appended SECOND -- -office1-local stays index 0/enp1s0, verified from the plan JSON). -Capture: `docs/audit/outer-plan-20260719-voffice1-transit.txt`. -Mechanism operator-ruled 2026-07-19 ("voffice1 via IaC + restart" -- -session changelog, ruling record). After its gated apply the expected -plan returns to **ZERO DIFF**. History: 7/2/7 post-reboot symptom -> -6/2/6 post-D-130 -> 6/0/6 post-G6-reconcile -> applied 6/0/6 exact -> -zero diff converged (`outer-plan-20260719-postA-converged.txt`) -> -1/1/1 authored (this entry). Any OTHER diff is a STOP (investigate -drift before touching anything). +The EXPECTED outer plan is **ZERO DIFF** ("no differences"), re-recorded +2026-07-20 with its evidencing capture +(`docs/audit/outer-plan-20260720-postfix-converged.txt`) after two gated +applies in the step-B window (both exact: voffice1 transit NIC 1/1/1, +vvr1-dc0 seed replace 2/0/2 -- session changelog items 2-4, captures +`outer-{plan,apply}-20260719-voffice1-transit.txt` and +`outer-{plan,apply}-20260719-vvr1dc0-netplan-fix.txt`). History: 7/2/7 +post-reboot symptom -> 6/2/6 post-D-130 -> 6/0/6 post-G6-reconcile -> +applied exact -> zero diff -> 1/1/1 (voffice1 transit, ruled+applied) -> +2/0/2 (rack netplan fix, applied) -> zero diff converged (this entry). +A future outer plan showing ANY diff is a STOP (investigate drift +before touching anything). ## 6. Open gates diff --git a/docs/audit/outer-apply-20260719-voffice1-transit.txt b/docs/audit/outer-apply-20260719-voffice1-transit.txt new file mode 100644 index 0000000..474e7b2 --- /dev/null +++ b/docs/audit/outer-apply-20260719-voffice1-transit.txt @@ -0,0 +1,8 @@ +module.voffice1.libvirt_cloudinit_disk.seed: Destroying... [id=775234004c2669d9] +module.voffice1.libvirt_cloudinit_disk.seed: Destruction complete after 0s +module.voffice1.libvirt_cloudinit_disk.seed: Creating... +module.voffice1.libvirt_cloudinit_disk.seed: Creation complete after 0s [id=a4694210c663c9ce] +module.voffice1.libvirt_domain.vm: Modifying... [name=voffice1] +module.voffice1.libvirt_domain.vm: Modifications complete after 1s [name=voffice1] + +Apply complete! Resources: 1 added, 1 changed, 1 destroyed. diff --git a/docs/audit/outer-apply-20260719-vvr1dc0-netplan-fix.txt b/docs/audit/outer-apply-20260719-vvr1dc0-netplan-fix.txt new file mode 100644 index 0000000..100f1e5 --- /dev/null +++ b/docs/audit/outer-apply-20260719-vvr1dc0-netplan-fix.txt @@ -0,0 +1,10 @@ +module.vvr1_dc0.libvirt_volume.seed: Destroying... [id=/var/lib/libvirt/vr1/vr1-dc0/vvr1-dc0-cloudinit.iso] +module.vvr1_dc0.libvirt_volume.seed: Destruction complete after 0s +module.vvr1_dc0.libvirt_cloudinit_disk.seed: Destroying... [id=4666ca51f035e4d8] +module.vvr1_dc0.libvirt_cloudinit_disk.seed: Destruction complete after 0s +module.vvr1_dc0.libvirt_cloudinit_disk.seed: Creating... +module.vvr1_dc0.libvirt_cloudinit_disk.seed: Creation complete after 0s [id=ff281478c6083cc3] +module.vvr1_dc0.libvirt_volume.seed: Creating... +module.vvr1_dc0.libvirt_volume.seed: Creation complete after 0s [id=/var/lib/libvirt/vr1/vr1-dc0/vvr1-dc0-cloudinit.iso] + +Apply complete! Resources: 2 added, 0 changed, 2 destroyed. diff --git a/docs/audit/outer-plan-20260719-vvr1dc0-netplan-fix.txt b/docs/audit/outer-plan-20260719-vvr1dc0-netplan-fix.txt new file mode 100644 index 0000000..e5ec3fb --- /dev/null +++ b/docs/audit/outer-plan-20260719-vvr1dc0-netplan-fix.txt @@ -0,0 +1,112 @@ +module.voffice1.libvirt_cloudinit_disk.seed: Refreshing state... [id=a4694210c663c9ce] +module.vvr1_dc0.libvirt_cloudinit_disk.seed: Refreshing state... [id=4666ca51f035e4d8] +module.office1_network.libvirt_network.office1_local: Refreshing state... [id=8fdd2a97-417c-44d4-89e4-ae8d65594135] +module.mesh_vr1_dc0_office1.libvirt_network.link: Refreshing state... [id=8318548f-c3d6-4e06-bef4-fe3f11d68125] +module.mesh_vr1_dc0_vr1_dc1.libvirt_network.link: Refreshing state... [id=9cbc8589-9f40-48e6-872e-ef3abfe29a93] +module.office1_storage.libvirt_pool.dc: Refreshing state... [id=5f94194c-69c1-4b04-a85f-c18d87303a03] +module.mesh_vr1_dc1_office1.libvirt_network.link: Refreshing state... [id=38a20d2d-cd91-4604-a5f4-8e2a6609633c] +module.vr1_dc0_storage.libvirt_pool.dc: Refreshing state... [id=7ce1101c-a89e-40ca-9263-5f572bee40a9] +module.vr1_dc1_storage.libvirt_pool.dc: Refreshing state... [id=4a1df114-ee04-4c80-9233-cc0c140c8556] +module.vr1_dc0_uplink.libvirt_network.site_wan: Refreshing state... [id=f3500153-e4de-45f1-8854-9c92974a6094] +module.vvr1_dc0.libvirt_volume.seed: Refreshing state... [id=/var/lib/libvirt/vr1/vr1-dc0/vvr1-dc0-cloudinit.iso] +module.voffice1.libvirt_volume.seed: Refreshing state... [id=/var/lib/libvirt/vr1/office1/voffice1-cloudinit.iso] +module.office1_opnsense.libvirt_volume.disk: Refreshing state... [id=/var/lib/libvirt/vr1/office1/office1-opnsense-disk.qcow2] +module.ubuntu_noble_base.libvirt_volume.base: Refreshing state... [id=/var/lib/libvirt/vr1/office1/ubuntu-24.04-base.qcow2] +module.voffice1.libvirt_volume.disk: Refreshing state... [id=/var/lib/libvirt/vr1/office1/voffice1-disk.qcow2] +module.vvr1_dc0.libvirt_volume.disk: Refreshing state... [id=/var/lib/libvirt/vr1/vr1-dc0/vvr1-dc0-disk.qcow2] +module.office1_opnsense.libvirt_domain.vm: Refreshing state... [name=office1-opnsense] +module.voffice1.libvirt_domain.vm: Refreshing state... [name=voffice1] +module.vvr1_dc0.libvirt_domain.vm: Refreshing state... [name=vvr1-dc0] + +Note: Objects have changed outside of OpenTofu + +OpenTofu detected the following changes made outside of OpenTofu since the +last "tofu apply" which may have affected this plan: + + # module.voffice1.libvirt_domain.vm has changed + ~ resource "libvirt_domain" "vm" { + ~ id = 1 -> 5 + name = "voffice1" + # (11 unchanged attributes hidden) + } + + +Unless you have made equivalent changes to your configuration, or ignored the +relevant attributes using ignore_changes, the following plan may include +actions to undo or respond to these changes. + +───────────────────────────────────────────────────────────────────────────── + +OpenTofu used the selected providers to generate the following execution +plan. Resource actions are indicated with the following symbols: +-/+ destroy and then create replacement + +OpenTofu will perform the following actions: + + # module.vvr1_dc0.libvirt_cloudinit_disk.seed must be replaced +-/+ resource "libvirt_cloudinit_disk" "seed" { + ~ id = "4666ca51f035e4d8" -> (known after apply) + ~ meta_data = <<-EOT # forces replacement + - instance-id: vvr1-dc0-d123 + + instance-id: vvr1-dc0-d123-r2 + local-hostname: vvr1-dc0 + EOT + name = "vvr1-dc0-cloudinit" + ~ network_config = <<-EOT # forces replacement + version: 2 + ethernets: + - mgmt: + + transit: + match: + name: "enp1s0" + - set-name: mgmt + addresses: ["172.31.0.2/30"] + routes: + - to: "10.10.0.0/22" + via: "172.31.0.1" + uplink: + match: + name: "enp2s0" + - set-name: uplink + dhcp4: false + dhcp6: false + bridges: + br-vr1-dc0-wan: + interfaces: [uplink] + dhcp4: false + dhcp6: false + parameters: + stp: false + forward-delay: 0 + EOT + ~ path = "/tmp/terraform-provider-libvirt-cloudinit/cloudinit-4666ca51f035e4d8.iso" -> (known after apply) + ~ size = 45056 -> (known after apply) + # (1 unchanged attribute hidden) + } + + # module.vvr1_dc0.libvirt_volume.seed will be replaced, as requested +-/+ resource "libvirt_volume" "seed" { + ~ allocation = 45056 -> (known after apply) + ~ capacity = 45056 -> (known after apply) + ~ create = { + ~ content = { + ~ url = "/tmp/terraform-provider-libvirt-cloudinit/cloudinit-4666ca51f035e4d8.iso" -> (known after apply) + } + } + ~ id = "/var/lib/libvirt/vr1/vr1-dc0/vvr1-dc0-cloudinit.iso" -> (known after apply) + ~ key = "/var/lib/libvirt/vr1/vr1-dc0/vvr1-dc0-cloudinit.iso" -> (known after apply) + name = "vvr1-dc0-cloudinit.iso" + ~ path = "/var/lib/libvirt/vr1/vr1-dc0/vvr1-dc0-cloudinit.iso" -> (known after apply) + ~ physical = 45056 -> (known after apply) + # (1 unchanged attribute hidden) + } + +Plan: 2 to add, 0 to change, 2 to destroy. + +───────────────────────────────────────────────────────────────────────────── + +Saved the plan to: +/home/jessea123/openstack-caracal-dc-dc/opentofu/vvr1dc0-netplan-fix.tfplan + +To perform exactly these actions, run the following command to apply: + tofu apply "/home/jessea123/openstack-caracal-dc-dc/opentofu/vvr1dc0-netplan-fix.tfplan" diff --git a/docs/audit/outer-plan-20260720-postfix-converged.txt b/docs/audit/outer-plan-20260720-postfix-converged.txt new file mode 100644 index 0000000..428ca55 --- /dev/null +++ b/docs/audit/outer-plan-20260720-postfix-converged.txt @@ -0,0 +1,24 @@ +module.voffice1.libvirt_cloudinit_disk.seed: Refreshing state... [id=a4694210c663c9ce] +module.vvr1_dc0.libvirt_cloudinit_disk.seed: Refreshing state... [id=ff281478c6083cc3] +module.vr1_dc1_storage.libvirt_pool.dc: Refreshing state... [id=4a1df114-ee04-4c80-9233-cc0c140c8556] +module.vr1_dc0_storage.libvirt_pool.dc: Refreshing state... [id=7ce1101c-a89e-40ca-9263-5f572bee40a9] +module.office1_storage.libvirt_pool.dc: Refreshing state... [id=5f94194c-69c1-4b04-a85f-c18d87303a03] +module.mesh_vr1_dc1_office1.libvirt_network.link: Refreshing state... [id=38a20d2d-cd91-4604-a5f4-8e2a6609633c] +module.mesh_vr1_dc0_office1.libvirt_network.link: Refreshing state... [id=8318548f-c3d6-4e06-bef4-fe3f11d68125] +module.office1_network.libvirt_network.office1_local: Refreshing state... [id=8fdd2a97-417c-44d4-89e4-ae8d65594135] +module.mesh_vr1_dc0_vr1_dc1.libvirt_network.link: Refreshing state... [id=9cbc8589-9f40-48e6-872e-ef3abfe29a93] +module.vr1_dc0_uplink.libvirt_network.site_wan: Refreshing state... [id=f3500153-e4de-45f1-8854-9c92974a6094] +module.office1_opnsense.libvirt_volume.disk: Refreshing state... [id=/var/lib/libvirt/vr1/office1/office1-opnsense-disk.qcow2] +module.ubuntu_noble_base.libvirt_volume.base: Refreshing state... [id=/var/lib/libvirt/vr1/office1/ubuntu-24.04-base.qcow2] +module.voffice1.libvirt_volume.seed: Refreshing state... [id=/var/lib/libvirt/vr1/office1/voffice1-cloudinit.iso] +module.vvr1_dc0.libvirt_volume.seed: Refreshing state... [id=/var/lib/libvirt/vr1/vr1-dc0/vvr1-dc0-cloudinit.iso] +module.vvr1_dc0.libvirt_volume.disk: Refreshing state... [id=/var/lib/libvirt/vr1/vr1-dc0/vvr1-dc0-disk.qcow2] +module.voffice1.libvirt_volume.disk: Refreshing state... [id=/var/lib/libvirt/vr1/office1/voffice1-disk.qcow2] +module.office1_opnsense.libvirt_domain.vm: Refreshing state... [name=office1-opnsense] +module.vvr1_dc0.libvirt_domain.vm: Refreshing state... [name=vvr1-dc0] +module.voffice1.libvirt_domain.vm: Refreshing state... [name=voffice1] + +No changes. Your infrastructure matches the configuration. + +OpenTofu has compared your real infrastructure against your configuration and +found no differences, so no changes are needed. diff --git a/docs/changelog-20260719-dc0-deploy-stepB.md b/docs/changelog-20260719-dc0-deploy-stepB.md index dfeed0f..7027e7e 100644 --- a/docs/changelog-20260719-dc0-deploy-stepB.md +++ b/docs/changelog-20260719-dc0-deploy-stepB.md @@ -44,3 +44,83 @@ and the previous "en*" glob `network_config` (git revert of this commit); if already applied, a follow-up plan shows the interface removal and the in-guest drop-in `/etc/netplan/60-transit.yaml` is deleted. + +## 3. APPLIED: voffice1 transit NIC + incident: MAC regen broke the Kea reservation + +- Gated window executed 2026-07-19/20 (logged): graceful shutdown -> apply + (1/1/1 exact, `docs/audit/outer-apply-20260719-voffice1-transit.txt`) -> + domain up with both NICs, office1-local index 0. +- **INCIDENT (found+fixed in-window):** the provider REGENERATED both NIC + MACs on the interface-list rebuild (old lan MAC `52:54:00:6a:87:e5` -> + new `52:54:00:89:e1:19`). The Kea reservation (MAC-keyed) missed and + voffice1 leased pool address `.108` (measured via edge ARP). FIX: re-keyed + reservation uuid `b12621e6-63e9-4714-9726-2e130c84e069` to the new MAC via + the D-113 API (`kea/dhcpv4/set_reservation` -> saved; + `kea/service/reconfigure` -> ok), then a detached + `networkctl reconfigure enp1s0` -> voffice1 back on `10.10.0.20`. +- **LOGGED FINDING (not executed):** `modules/cloudinit-vm` does not pin + MACs, so ANY interface-list change re-rolls them and breaks MAC-keyed + DHCP reservations. Roosevelt-relevant; candidate module `mac` var or a + documented ops step. Also: live transit config landed as in-guest netplan + drop-in `/etc/netplan/60-transit.yaml` (narrows the lan glob to enp1s0 + + transit enp2s0 static) -- the drop-in must ALSO narrow `lan`, else the + 50-cloud-init `en*` glob claims enp2s0 (measured: first drop-in attempt + without it left enp2s0 addressless). +- **Revert:** `kea/dhcpv4/set_reservation` back to the old MAC (senseless + unless the NIC change is also reverted); delete the drop-in. + +## 4. vvr1-dc0 transit dead on arrival -- ROOT CAUSE (netplan set-name) + fix + +- Symptom: `172.31.0.2` unreachable; MEASURED: both rack NICs emitted ZERO + frames ever (host FDB virbr7/virbr4, voffice1 ARP FAILED); guest OS alive + (ACPI-responsive; cloud-init completed per offline logs). +- Guest is a SEALED BOX: `modules/cloudinit-vm` domains have NO serial + console, NO qga channel, NO graphics; qga is NOT in the noble base image + and its cloud-init install failed (no egress) -- so no console, no agent, + no network. **LOGGED FINDING: add opt-in serial console (+ the D-129-style + qga channel var) to `modules/cloudinit-vm` -- observability gap bites every + future DC VM. NOT executed mid-step.** +- Offline inspection (libguestfs, operator-run, captures + `~/vvr1-dc0-offline-inspect{,2}.txt`): NIC names enp1s0/enp2s0 CORRECT + (naming trap closed); root cause = netplan `match.name` + `set-name`: + boot 1 renames don't apply (.link written after udev add) so the rendered + config matched nothing; after removing set-name, boot 2 STILL failed + because the early-boot netplan generator ran against the OLD config and + renamed the devices to mgmt/uplink before cloud-init wrote the new file + (one-boot lag, measured in syslog). Boot 3 (current config, no renames) + is the verification boot. +- FIX (this commit + applied): `network_config` drops set-name, keeps + MEASURED kernel names; `instance-id` bumped `vvr1-dc0-d123 -> -d123-r2` + (side effects noted in-block); seed replaced via explicit + `-replace=module.vvr1_dc0.libvirt_volume.seed` (the sanctioned override + of D-130 ignore_changes for INTENDED seed changes) -- plan/apply 2/0/2 + exact (`docs/audit/outer-{plan,apply}-20260719-vvr1dc0-netplan-fix.txt`). +- CONSEQUENCE for step B: bootstrap runs with + `--transit-if enp1s0 --uplink-if enp2s0` (script defaults mgmt/uplink no + longer match reality); runbook prose naming "mgmt" needs a DOCFIX at + stage close. +- **Revert:** git revert of the netplan/instance-id edit + one more + seed `-replace` apply + reboot. + +## 4b. VERIFICATION (2026-07-20, logged window) + +- Boot 3 with the fixed config: `enp1s0 UP 172.31.0.2/30`, region route + present, `br-vr1-dc0-wan` up. +- voffice1 -> 172.31.0.2 ping 0% loss; ssh + `-i ~/vr1-dc0-creds/vr1-dc0_svc_ed25519 -J voffice1 jessea123@172.31.0.2` + works (D-126 -J shape, per-env key); rack -> region `ping 10.10.0.20` + 0% loss (the MAAS-enrollment path for the G10 bootstrap). +- Outer plan CONVERGED back to ZERO DIFF + (`docs/audit/outer-plan-20260720-postfix-converged.txt`); CURRENT-STATE + section 5 updated in the same commit. +- Follow-items (logged, not executed): D-126 DC ssh-config alias row for + vvr1-dc0 (now measurable: 172.31.0.2 via -J voffice1, dc0 key); + cloudinit-vm serial-console/qga observability vars; cloudinit-vm MAC + pinning; DOCFIX for runbook "mgmt/uplink" naming. + +## 5. Host tooling: libguestfs-tools installed on vcloud (operator-run) + +- `sudo apt-get install -y libguestfs-tools` (1:1.52.0-5ubuntu3) -- enables + offline guest inspection (virt-cat/virt-ls), used for items 4's captures. + Standard KVM-host tooling; Roosevelt-transferable. +- **Revert:** `sudo apt-get remove libguestfs-tools`. diff --git a/opentofu/main.tf b/opentofu/main.tf index b644feb..5c668f6 100644 --- a/opentofu/main.tf +++ b/opentofu/main.tf @@ -419,8 +419,14 @@ - [systemctl, enable, --now, qemu-guest-agent] EOT + # instance-id BUMPED d123 -> d123-r2 (2026-07-19): cloud-init applies network config + # only on a boot-new-instance event, so the netplan fix above cannot reach the already- + # booted guest without it. Re-run side effects accepted and noted: SSH HOST keys + # regenerate (nothing pins them yet), package_update/qga install fail again harmlessly + # (no egress; qga is absent from the noble base image -- measured via the runcmd + # "Unit file qemu-guest-agent.service does not exist" failure in cloud-init-output). meta_data = <<-EOT - instance-id: vvr1-dc0-d123 + instance-id: vvr1-dc0-d123-r2 local-hostname: vvr1-dc0 EOT @@ -431,10 +437,16 @@ # this (documented trap; modules/opnsense-edge + the runbook). metal-admin gives # the rack no default route; the region route rides the transit toward Office1 # (10.10.0.0/22, as-built D-115). - # OUTER legs = transit (NIC1 enp1s0 -> mgmt) + D-125 uplink (NIC2 enp2s0 -> uplink). - # INTERFACE-NAMING TRAP applies to BOTH (enp1s0/enp2s0 vs ensX depend on machine type, - # unknown until first boot -- CONFIRM on boot and adjust each `match` before relying on - # this). metal-admin is configured on the INNER bridge by the BOOTSTRAP step + # OUTER legs = transit (NIC1 enp1s0) + D-125 uplink (NIC2 enp2s0). Names MEASURED + # 2026-07-19 from the guest's kernel rename log (offline virt-cat: eth0->enp1s0, + # eth1->enp2s0) -- the naming trap is CONFIRMED CLOSED for this q35 shape. + # set-name is DELIBERATELY ABSENT: the first boot shipped `match.name` + `set-name` + # and BOTH interfaces stayed down with zero frames ever emitted (measured: host FDB + + # ARP FAILED) -- the known netplan pitfall that set-name is only reliable when + # matching by macaddress (which is provider-generated here, hence rebuild-brittle, + # hence not used). The kernel names ARE the interface names; the bootstrap is called + # with `--transit-if enp1s0 --uplink-if enp2s0` (script defaults say mgmt/uplink). + # metal-admin is configured on the INNER bridge by the BOOTSTRAP step # (site-headend-install.sh node-host mode) using var.vr1_dc0_rack_metal_admin_ip -- that # var is consumed by the bootstrap script, NOT by this outer root nor the inner OpenTofu # root (it remains a required tfvar for the L1-07 rack-addressing gate). The region route @@ -445,15 +457,14 @@ # vcloud-ISP /24 address across it) is declared HERE so it exists before the inner apply. # STP off (single port). The bootstrap only VERIFIES the bridge + grants libvirt/AppArmor # access + isolation-tests egress; it does not create the bridge. br_netfilter CONSTRAINT - # (D-125): SEC-010's FORWARD-drop MUST stay scoped to `mgmt` -- a GLOBAL forward drop would - # silently kill bridged WAN frames if br_netfilter is loaded. + # (D-125): SEC-010's FORWARD-drop MUST stay scoped to the transit interface (enp1s0) -- + # a GLOBAL forward drop would silently kill bridged WAN frames if br_netfilter is loaded. network_config = <<-EOT version: 2 ethernets: - mgmt: + transit: match: name: "enp1s0" - set-name: mgmt addresses: ["${var.vr1_dc0_rack_transit_ip}/${var.vr1_dc0_rack_transit_prefix}"] routes: - to: "10.10.0.0/22" @@ -461,7 +472,6 @@ uplink: match: name: "enp2s0" - set-name: uplink dhcp4: false dhcp6: false bridges: