diff --git a/docs/changelog-20260710-sweep-vr0-runbook-opentofu-fixes.md b/docs/changelog-20260710-sweep-vr0-runbook-opentofu-fixes.md new file mode 100644 index 0000000..5f573f9 --- /dev/null +++ b/docs/changelog-20260710-sweep-vr0-runbook-opentofu-fixes.md @@ -0,0 +1,87 @@ +# Changelog 2026-07-10 -- Full-project sweep: VR0 runbook + OpenTofu doc fixes (DOCFIX-170) + +No live infrastructure touched. Part of the full-project sweep requested +after DOCFIX-169 (the first cascading-staleness fix). Eight parallel +review agents audited bundle.yaml, VR0 runbooks, scripts, OpenTofu +modules, DC-DC runbook consistency, test harness quality, security +posture, and NetBox/IPAM consistency. This changelog covers the VR0 +runbook and OpenTofu documentation findings; sibling changelogs cover +DC-DC runbook fixes (DOCFIX-171), bundle.yaml fixes (DOCFIX-172), and +script logic bugs (DOCFIX-173). + +## Items + +### 1. DOCFIX-170a -- `runbooks/phase-08-workload-cluster-acceptance.md` Designate framing +FILE: `runbooks/phase-08-workload-cluster-acceptance.md`. + +WHAT: same cascading-staleness class as DOCFIX-169 (phase-01), found by a +dedicated VR0-runbook-audit agent: this runbook's header and its D-011.8 +acceptance-bar item both still framed Designate as flatly "DEFERRED (D-019)" +even though `bundle.yaml`'s DOCFIX-167 edit now deploys `designate`/ +`designate-bind`/`designate-mysql-router`/`designate-hacluster` live (D-106 +supersedes D-019). Fixed with a NUANCED correction, not a blanket flip to +PASS: D-011.1's "all charms active/idle" check will now include these 4 +units, but D-011.8's actual acceptance criterion (tenant hostname +resolution) is STILL not meaningfully testable for a plain VR0 run -- the +full D-008 bootstrap chain needs the per-DC `os-public-hostname` overlay +this shared bundle deliberately does NOT carry (Stage 7's job, not +automatic from the charms merely being deployed). The runbook now says so +explicitly, cross-referencing `runbooks/dc-dc-phase6-designate-cos-magnum.md` +Step 9 as where D-011.8 actually gets exercised for real. + +### 2. DOCFIX-170b -- `opentofu/modules/base-image/outputs.tf` stale comment +FILE: `opentofu/modules/base-image/outputs.tf`. + +WHAT: found by the OpenTofu deep-review agent: the `pool`/`name` output +descriptions referenced nonexistent `modules/cloudinit-vm` input variables +(`base_volume_pool`/`base_volume_name`) -- that module only ever declared +`base_volume_path`, which is what its real `main.tf` actually consumes (via +`.path`, the third, correctly-described output). Leftover wording from an +earlier design that named things differently before settling on passing +`.path` directly. No functional effect (neither module is instantiated +yet, nothing calls `.pool`/`.name`) -- cosmetic, now corrected. + +## Verification + +`bash scripts/repo-lint.sh`: 0 fail, 1 documented legacy warn. Full test +gauntlet (`bash scripts/run-tests-all.sh`): 23/51 FAILED, identical to +every prior check tonight (same pre-existing "jq missing on this +workstation" environment gaps) -- zero regressions. + +## Sweep summary (all eight dimensions, for the record) + +- **bundle.yaml deep audit**: found `magnum-dashboard` missing its entire + `bindings:` block (pre-existing, since the D-052 commit, not tonight's + regression) + two cosmetically-misplaced section-header comments + + header VIP-count staleness -- see DOCFIX-172. +- **VR0 runbooks audit**: this changelog's item 1, plus confirmed + phase-00/02/03/04/05/06/07 and all four appendices clean of the same + staleness class; script/flag/D-NNN citation spot-checks all clean. +- **scripts/*.sh audit**: found 4 confirmed logic bugs (unguarded + pipelines/function calls under `set -e`+pipefail) + 1 dormant landmine + in `ledger-scan.sh`'s DOCFIX/BUNDLEFIX regex -- see DOCFIX-173. +- **OpenTofu modules deep review**: this changelog's item 2; otherwise + clean, including the newest module (`office1-network`) correctly + mirroring the already-fixed attribute-style syntax convention. +- **DC-DC runbook consistency (second pass)**: found Stage 1's calculator + scripts never wired into Step 3, Stage 5's stale Sequence-list bracket + tag, Stage 6's checklist overstating its own step content, and two + DOCFIX numbers (164, 167) never closed out in the ledger's own + boilerplate -- see DOCFIX-171 and this session's direct ledger fix. +- **Test harness quality audit**: clean -- no new instances of the + dead-assertion bug class found anywhere else in 51 harnesses; the + originally-fixed `dc-dc-prefixes-import` harness reconfirmed correct + (40/40, exact call-site count match). +- **Security/secrets posture audit**: one moderate finding (rbd-mirror + bootstrap token's predictable path, no permission hardening) -- see + DOCFIX-173; everything else clean, including a spot-check of 3 older + secrets-handling scripts. +- **NetBox/IPAM consistency audit**: clean for the current, active DC-DC + pipeline (byte-for-byte match against `lib-net.sh`); one refinement to + an already-known v1-script staleness (the retired `ipv4-prefixes- + import.py`'s "LBaaS Mgmt" role label on a CIDR now repurposed to + `storage` -- out of scope, that script is deliberately not maintained). + +REVERT (this changelog's items only): `git checkout HEAD~ -- runbooks/ +phase-08-workload-cluster-acceptance.md opentofu/modules/base-image/ +outputs.tf` (safe). diff --git a/docs/session-ledger.md b/docs/session-ledger.md index b07772e..237bc23 100644 --- a/docs/session-ledger.md +++ b/docs/session-ledger.md @@ -1218,9 +1218,12 @@ Octavia entry rather than silently forcing the risk through. Updated Stage 5's runbook (`runbooks/dc-dc-phase4-juju-bundle-per-dc.md`) Step 6 and the tooling gap register item #13 to reflect all of this. `bash - scripts/repo-lint.sh`: 0 fail, 1 documented legacy warn. Uncommitted -- - orchestrating session will assign the real DOCFIX number at integration - time alongside the other parallel gap-closure work tonight. + scripts/repo-lint.sh`: 0 fail, 1 documented legacy warn. Changelog: + `docs/changelog-20260709-ipv6-family-matrix-overlay.md`, **DOCFIX-164** + (number confirmed and closed out here -- this line previously ended + with unresolved "will assign at integration time" boilerplate; caught by + the full-project-sweep's DC-DC-runbook-consistency agent as an + integration miss, fixed 2026-07-10). - **DONE -- `$DC` parameterization for the 3 MAAS scripts (changelog `docs/changelog-20260709-maas-scripts-dc-param.md`, DOCFIX-166), closing gap #15 sub-item 2's CLI-invocation half:** `scripts/reenroll- @@ -1244,9 +1247,9 @@ item #15 and `runbooks/dc-dc-phase3-maas-enlist-deploy.md` (gap #2, Steps 5 and 8, delivery checklist) updated to reflect the partial closure -- six of the seven gap-#15 sub-findings remain open, said plainly rather - than overclaiming. No live infrastructure touched. Uncommitted -- - orchestrating session will assign the real DOCFIX number at integration - time. + than overclaiming. No live infrastructure touched. (DOCFIX-166, already + cited above -- this closing line's stale "will assign at integration + time" boilerplate corrected 2026-07-10, flagged by the same sweep pass.) - **DONE (uncommitted) -- Gaps #6 + #14 (bundle.yaml: Designate reactivation + D-108 DR mechanism), done directly by the orchestrating session given the stakes (this is the SAME `bundle.yaml` the jumphost operates the @@ -1282,8 +1285,11 @@ their earlier "template"/"known gap" framing. NOT applied to any live model this session -- no live cloud reachable; this is a repo-source change only, to be reviewed via `juju deploy --dry-run` before any real - apply. Uncommitted -- orchestrating session will assign the real DOCFIX - number at integration time. + apply. Changelog `docs/changelog-20260709-designate-cinderbackup- + rbdmirror.md`, **DOCFIX-167** (number confirmed and closed out here -- + this line previously ended with unresolved "will assign at integration + time" boilerplate; caught as an integration miss by the full-project + sweep's DC-DC-runbook-consistency agent, fixed 2026-07-10). - **DONE (uncommitted) -- Tooling gap register item #5 MECHANISM CLOSED 2026-07-09 (changelog `docs/changelog-20260709-ceph-replication- tooling.md`, DOCFIX-165 -- numbering deferred to the orchestrating @@ -1374,6 +1380,80 @@ deploy). `bash scripts/repo-lint.sh`: 0 fail, 1 documented legacy warn. Sweep continues across the rest of the repo (scripts, other runbooks, OpenTofu modules, test quality, security/secrets posture). +- **DONE -- Full-project sweep COMPLETE: 8 parallel agents (bundle.yaml, + VR0 runbooks, scripts, OpenTofu modules, DC-DC runbook consistency, test + harness quality, security/secrets, NetBox/IPAM), all findings triaged + and real ones fixed, changelogs DOCFIX-170/171/172/173:** + - **DOCFIX-170** (`docs/changelog-20260710-sweep-vr0-runbook-opentofu- + fixes.md`): `phase-08-workload-cluster-acceptance.md`'s Designate + framing (same cascading-staleness class as DOCFIX-169), nuanced not a + blanket flip -- charms now active/idle-checkable, but D-011.8's real + resolution criterion still needs Stage 7's os-public-hostname overlay, + not automatic from deployment alone. Plus a stale `opentofu/modules/ + base-image/outputs.tf` comment (cosmetic, no functional effect). + - **DOCFIX-171** (`docs/changelog-20260710-sweep-dcdc-runbook-fixes.md`): + Stage 1's calculator scripts (DOCFIX-162) never wired into its own + Step 3 -- fixed to actually invoke them; Stage 5's Sequence-list still + said `[NOT YET WRITTEN]` for the IPv6 overlay after the Step 6 body + was updated -- fixed; Stage 6's checklist claimed its steps call the + new Ceph scripts when the step bodies still only showed raw commands + -- added real "PREFER `scripts/dc-dc-...`" pointers to Steps 4, 5, 8, + 10.2, 11.2 themselves, closing the gap between claim and text. Also + closed out two orphaned ledger entries (DOCFIX-164, 167) whose closing + lines never got their real number written in during the earlier + integration pass -- an integration miss the sweep itself caught. + - **DOCFIX-172** (`docs/changelog-20260710-sweep-bundle-fixes.md`): + `magnum-dashboard` had NO `bindings:` block AT ALL -- a real, + pre-existing bug (confirmed via `git log`, present since the D-052 + explicit-bindings commit, not tonight's regression) violating this + bundle's own stated "explicit per-application blocks" discipline. + Fixed with a minimal, metadata-confirmed block (subordinate, only a + real `dashboard` endpoint -- NOT a copy of `octavia-dashboard`'s + fuller shape, which has a `certificates` endpoint this charm doesn't). + Also relocated two section-header comments that sat before the WRONG + app's bindings block (functionally harmless, confirmed via + `yaml.safe_load` -- purely a future-edit-risk fix) and corrected the + header's stale "11 API charms" VIP-chain count to 12 (with the + VIP-triple count of 11 correctly left alone, since designate doesn't + carry a `vip:` option). `provider-bundle-check.py` PASS throughout, + 56 apps/108 relations unchanged. + - **DOCFIX-173** (`docs/changelog-20260710-sweep-script-fixes.md`): 4 + confirmed logic bugs + 1 security hardening, ALL independently + reproduced in isolation before being trusted (the same discipline + that caught the dc-dc-prefixes-import bug earlier tonight) -- + including catching that a FIRST proposed fix for one of them + (`scripts/phase-06-capi-stack.sh`) was itself wrong: `|| true` after a + failing pipeline under `pipefail` silently discards `PIPESTATUS`, + which would have made the "GATE FAIL" check never fire again, WORSE + than the original bug. The correct `if pipeline; then :; fi` idiom was + verified via reproduction before committing. Full list: `carve-host- + interfaces.sh`'s `emit()` returning 1 unguarded under `set -e` (killed + apply-mode runs on the first MAAS error, before the FATAL-accumulator + summary could print); `phase-06-capi-stack.sh`'s `PIPESTATUS` read + (as above); `juju-spaces-check.sh` and `osd-blank-check.sh`'s one + unguarded display-only pipe each (both safely `|| true`-able since + nothing downstream needed their PIPESTATUS); `scripts/ledger-scan.sh`'s + DOCFIX/BUNDLEFIX regex using a fixed `{3}` instead of `{3,}` -- the + SAME bug class this repo already got bitten by once for D-numbers + (fixed there via `{3,}`, never mirrored here) -- a dormant landmine, + not yet reachable (repo is at DOCFIX-170ish) but real; and + `dc-dc-rbd-mirror.sh`'s bootstrap token using a predictable `/tmp` + path with no permission hardening -- hardened to a random-suffixed + path + immediate `chmod 600`. + Full test gauntlet re-run after all fixes: 23/51 FAILED, identical to + every prior check tonight (same pre-existing jq-missing environment + gaps) -- zero regressions across the entire sweep-and-fix pass. + **Also flagged, not a repo issue:** the scripts-audit agent reported + that a skill's tool output contained injected text resembling a system + reminder, instructing it to conceal a date change from the operator -- + it correctly disregarded the concealment instruction and reported the + anomaly rather than act on it. The main session observed an + identically-worded, identically-formatted message earlier this same + evening (a genuine date-rollover notice, consistent with the session + crossing midnight) and treated it as benign/expected rather than a live + attack -- noted here for the operator's own awareness per this + environment's prompt-injection disclosure norm, not because either + session took any unsafe action in response. diff --git a/opentofu/modules/base-image/outputs.tf b/opentofu/modules/base-image/outputs.tf index 25172e9..a02ad67 100644 --- a/opentofu/modules/base-image/outputs.tf +++ b/opentofu/modules/base-image/outputs.tf @@ -1,10 +1,10 @@ output "pool" { - description = "Pool the base image lives in -- for modules/cloudinit-vm's base_volume_pool input." + description = "Pool the base image lives in." value = libvirt_volume.base.pool } output "name" { - description = "Base image volume name -- for modules/cloudinit-vm's base_volume_name input." + description = "Base image volume name." value = libvirt_volume.base.name } diff --git a/runbooks/phase-08-workload-cluster-acceptance.md b/runbooks/phase-08-workload-cluster-acceptance.md index c2ef46d..34d41a5 100644 --- a/runbooks/phase-08-workload-cluster-acceptance.md +++ b/runbooks/phase-08-workload-cluster-acceptance.md @@ -5,10 +5,11 @@ API LB), then run the D-011 acceptance bar. Passing D-011 is the gate that unlocks the project-completion tasks. -Decisions: D-011 (acceptance bar; amended by D-019 -- item 8 Designate deferred), -D-031/D-036 (driver/engine/chart coherence), D-039 (app-cred roles incl. -load-balancer_member), D-040 (reserved-host-memory), D-041 (non-HA mgmt manual -start), D-042 (driver contract coherence -> health HEALTHY after phase-07). +Decisions: D-011 (acceptance bar; item 8 Designate -- D-019 deferred it for +v1, D-106 SUPERSEDES D-019 for VR1 DC-DC 2026-07-10, see the item 8 callout +below), D-031/D-036 (driver/engine/chart coherence), D-039 (app-cred roles +incl. load-balancer_member), D-040 (reserved-host-memory), D-041 (non-HA mgmt +manual start), D-042 (driver contract coherence -> health HEALTHY after phase-07). Troubleshooting: appendix-A -- stuck-delete finalizer, LB-failover, OOM/manual-start, uninitialized-taint, CNI-label, DOCFIX-021. @@ -300,10 +301,26 @@ Snapshot 2 (post-tenant-setup). qcow2-level, per-VM, on the jumphost hypervisor. Pass: Snapshot 1 captured (Snapshot 2 after tenant setup). -- **D-011.8 -- Designate zones + tenant hostname resolution.** DEFERRED. - D-019 deferred Designate (dropped do-doc-10-dns). Also moot under IP-only B5: - there are no API hostnames to resolve; tenants use IPs/VIPs. Re-scope when DNS - returns (v2). NOT required for v1 acceptance. +- **D-011.8 -- Designate zones + tenant hostname resolution.** STILL DEFERRED + for a PLAIN v1/VR0 run, but the REASON changed 2026-07-10 (DOCFIX-167) -- + read before assuming either "still fully deferred" or "now passes": + `bundle.yaml` itself now deploys `designate`/`designate-bind`/`designate- + mysql-router`/`designate-hacluster` (D-106 supersedes D-019 for VR1 DC-DC). + D-011.1's "all charms active/idle" check WILL include these 4 new units. + However, D-011.8's actual acceptance criterion (tenant hostname resolution) + is STILL not meaningfully testable for a plain VR0 run: the full D-008 + bootstrap chain (static /etc/hosts -> `os-public-hostname` per API charm + -> Vault FQDN-SAN certs -> Designate zone + A/AAAA -> Neutron + `dns-domain`/`dns-servers` -> tenant subnets with `--dns-nameserver`) needs + the per-DC `os-public-hostname` overlay this shared `bundle.yaml` + deliberately does NOT carry (see its own DOCFIX-167 header comment) -- + that wiring is `runbooks/dc-dc-phase6-designate-cos-magnum.md`'s job + (Stage 7), not automatic from the charms merely being deployed. So: PASS + only under Stage 7's actual DNS-bootstrap execution (that runbook already + says to record D-011.8 PASS/FAIL against ITS Step 9, not this deferred + wording); DEFERRED still correctly describes a plain phase-08 run where + Stage 7 hasn't run. Do not silently mark this PASS just because the + charms show `active/idle`. ## Step 8.5 -- (Optional) Clean delete verification (capi-mgmt scope). Confirms the manage/teardown path.