diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index 7799043..bb62fca 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -1026,6 +1026,15 @@ the option from the six and KEEP their v6 VIP legs -- is what the measurement supports; option (c) would remove v6 that measurably works and would contradict D-101.** NOT TAKEN HERE: the ruling is the operator's, the overlay is untouched, R2 is unamended. + **WHAT OPTION (b) ACTUALLY COSTS, MEASURED BEFORE THE FORK WAS PUT -- IT IS NOT A VALUES-FILE + EDIT.** `prefer-ipv6: true` is INJECTED UNCONDITIONALLY BY THE RENDERER + (`scripts/render-dc-overlays.py:243-246`, emitted for every app whenever `fam == "dual"`), + and `family: dual` is a SINGLE TOP-LEVEL key in `render/values/vr1-dc{0,1}-vips.yaml:3` -- + not per-app data. So there is no value to edit: implementing (b) means teaching the renderer + which charms declare the option, re-pointing `tests/render-drift` (whose whole purpose is to + catch a hand-edited overlay), and replacing `provider-bundle-check` invariant 9. Both DCs, + symmetric. That is a code change with a harness, not a one-line data fix -- stated here so + the ruling is taken on the real cost. **CONSEQUENCE THAT TRAVELS WITH THE RULING: `provider-bundle-check` INVARIANT 9's MECHANISM CLAIM IS FACTUALLY WRONG** (`scripts/provider-bundle-check.py:30-33`, `:288-295`: "prefer-ipv6 makes HAProxy bind :::port in ADDITION to *:port, so the two must travel together"). Its @@ -1048,7 +1057,9 @@ `vr1-dc0-vips` + `vr1-dc0-machines` + `vr1-dc0-octavia-pki`) was compared against each charm's own `config.yaml` at its pinned channel: **56 applications, 81 option assignments, 20 charm schemas, 0 unresolvable, and the ONLY findings are `prefer-ipv6` on the same six.** - So no further option-name failure is waiting for attempt 2. An unreadable or unrecognised + SCOPE, stated so this is not read as "attempt 2 is safe": it checks option NAMES, for the + dc0 input only. Option VALUE TYPES are unchecked and dc1's input is unswept -- both are + owed before the redeploy, and each could cost an attempt the same way. An unreadable or unrecognised schema REFUSES rather than passing. **A REPO GATE FOR THIS IS OWED, NOT BUILT** (hard rule 1 + the standing directive); the method is reproduced verbatim in the capture. **RUNBOOK DEFECT FOUND IN PASSING, LOGGED NOT FIXED (DOCFIX material):** diff --git a/docs/audit/stage5-prefer-ipv6-charm-research-20260731.txt b/docs/audit/stage5-prefer-ipv6-charm-research-20260731.txt index 9811b5e..6993a78 100644 --- a/docs/audit/stage5-prefer-ipv6-charm-research-20260731.txt +++ b/docs/audit/stage5-prefer-ipv6-charm-research-20260731.txt @@ -240,9 +240,24 @@ Would remove v6 that measurably works, and would contradict D-101 (dual-stack where IPv4 is required, IPv6-only where sound, BOTH DCs this deployment). - The overlays are GENERATED (D-136 (D)). Whatever is ruled is applied by editing - render/values/vr1-dc{0,1}-vips.yaml and re-rendering -- never by hand-editing - overlays/, which `tests/render-drift` exists to catch. BOTH DCs, symmetric. + The overlays are GENERATED (D-136 (D)) -- never hand-edit overlays/, which + `tests/render-drift` exists to catch. BOTH DCs, symmetric. + + WHAT (b) COSTS, MEASURED BEFORE PUTTING THE FORK -- IT IS NOT A VALUES-FILE EDIT. + `prefer-ipv6: true` is INJECTED UNCONDITIONALLY BY THE RENDERER: + + scripts/render-dc-overlays.py:243-246 + if fam == "dual": + # prefer-ipv6 and the v6 legs must land together, or HAProxy binds + # :::port with no v6 VIP for pacemaker to manage. + out.append(" prefer-ipv6: true\n") + + and `family: dual` is a SINGLE TOP-LEVEL key at render/values/vr1-dc0-vips.yaml:3 + (same at dc1:3) -- not per-app data. There is no value to edit. Implementing (b) + means teaching the renderer which charms DECLARE the option, re-pointing + tests/render-drift, and replacing invariant 9. A code change with a harness, not a + one-line data fix. Note also that the injection's own comment repeats the mechanism + claim refuted above. ADDITIONAL MEASUREMENT -- FULL OPTION-NAME SWEEP OF THE dc0 DEPLOY INPUT ----------------------------------------------------------------------- @@ -265,7 +280,16 @@ [FAIL] vault vault@1.8/stable does not declare option 'prefer-ipv6' >>> `prefer-ipv6` ON THOSE SIX IS THE ONLY UNKNOWN OPTION IN THE ENTIRE DEPLOY INPUT. -Once it is resolved, no further option-name failure is waiting for attempt 2. + +SCOPE OF THAT CLAIM, stated so it is not read as "attempt 2 is safe". This checked +option NAMES, for the dc0 input only. TWO EXTENSIONS ARE OWED BEFORE THE REDEPLOY, +each able to cost a whole attempt the same way: + (i) OPTION VALUE TYPES -- every downloaded config.yaml carries a `type:` field + that this pass discarded. A boolean assigned a string fails the same way. + (ii) THE dc1 INPUT -- unswept. There is no ruled DC ordering and the fix is + symmetric, so a dc1-only defect would surface as a further failed deploy. +Sequenced AFTER the ruling: doing them now would be precondition work the standing +directive puts out of scope. Schemas read (revision at 2024.1/stable unless noted): barbican 265, ceph-mon 491, ceph-osd 953, ceph-radosgw 600 (squid/stable), cinder 820, designate 418, diff --git a/docs/changelog-20260731-prefer-ipv6-research.md b/docs/changelog-20260731-prefer-ipv6-research.md index 372e244..3115ab4 100644 --- a/docs/changelog-20260731-prefer-ipv6-research.md +++ b/docs/changelog-20260731-prefer-ipv6-research.md @@ -79,8 +79,29 @@ capture so it can be re-run or promoted later. CURRENT-STATE already records that no gate in this repo reads a charm config schema. +**Scope, stated so it is not over-read.** It checked option NAMES, for the dc0 input +only. Two extensions are OWED before the redeploy and are sequenced after the ruling: +option VALUE TYPES (every downloaded `config.yaml` carries the `type:` field this pass +discarded), and the dc1 input, which is unswept. + **Revert.** Nothing to revert -- no repo artifact was created by this item. +## Item 5 -- MEASUREMENT ONLY: what option (b) would actually cost + +**What.** Before putting the fork to the operator, the implementation cost of (b) was +measured rather than assumed. `prefer-ipv6: true` is INJECTED UNCONDITIONALLY by +`scripts/render-dc-overlays.py:243-246` for every app whenever `fam == "dual"`, and +`family: dual` is a SINGLE TOP-LEVEL key at `render/values/vr1-dc{0,1}-vips.yaml:3` -- +not per-app data. + +**Consequence.** There is no value to edit. (b) means teaching the renderer which +charms declare the option, re-pointing `tests/render-drift`, and replacing +`provider-bundle-check` invariant 9 -- a code change with a harness, not a one-line +data fix. The injection's own inline comment repeats the mechanism claim this +session's research refutes. + +**Revert.** Nothing to revert. + ## Item 4 -- LOGGED NOT FIXED: the dc0 deploy block omits a non-no-op overlay **What.** `runbooks/dc-dc-phase4-juju-bundle-per-dc.md:553-557` gives the dc0 deploy