diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index f20f5a1..8879d49 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -1459,6 +1459,26 @@ DCs with one mechanism instead of widening the mirror-vs-proxy asymmetry. Placement is build-time engineering; **if it takes its own VM the D-134 octet map needs a ruled octet FIRST**, since that map is a standing cross-DC standard. + **RULING 1 BUILT 2026-07-31.** `overlays/vr1-dc0-machines.yaml` now sets + `deb http://10.12.8.4/cloud-archive jammy-updates/caracal main` on **15 apps**, and the + scope was **DERIVED FROM THE CHARM SCHEMAS rather than hand-listed**: every app whose charm + accepts an origin key AND resolves to a UCA pocket -- 12 `openstack-origin` (explicit + `cloud:jammy-caracal` or the charm default `caracal`) plus 3 ceph `source`. Every other app + defaults to `distro` (the Ubuntu archive only) and needs nothing, which is why the + subordinate mysql-routers, `ceph-rbd-mirror`, `mysql-innodb-cluster`, + `glance-simplestreams-sync` and `rabbitmq-server` are deliberately absent. **The earlier + in-session figure of "six apps" was the count that set it EXPLICITLY and was never the + scope** -- the charm-default apps carry the same upstream source, measured on the + containers: both `keystone/0` and `ceph-mon/1` hold + `deb http://ubuntu-cloud.archive.canonical.com/ubuntu jammy-updates/caracal main`. + **NOTE THAT KEYSTONE CLEARED INSTALL ANYWAY** -- so the unreachable UCA is not universally + fatal; it is fatal where a charm's `apt_update` runs `--error-on=any` (the ceph charms) and + is a CORRECTNESS problem everywhere else, since a node that cannot reach the Caracal pocket + silently gets jammy's own OpenStack instead. **LOGGED NOT CHANGED: `ovn-central`'s charm + default is `source: zed`, NOT caracal** -- it points at a UCA pocket the dc0 mirror does not + carry, and repointing it would change its RELEASE rather than its URL, so it is a separate + question. Gauntlet ALL GREEN (93); repo-lint 0 fail; `provider-bundle-check` PASS on the dc0 + deploy input. **memcached SCALED to 3 in `overlays/dc-ha-scaleup.yaml`** (operator-directed 2026-07-31); its exclusion comment is RE-POINTED rather than left stale. **`ceph-rbd-mirror` is PINNED, NOT SETTLED** -- gap register **item 22** carries four options and the recommendation diff --git a/overlays/vr1-dc0-machines.yaml b/overlays/vr1-dc0-machines.yaml index a502712..07be79c 100644 --- a/overlays/vr1-dc0-machines.yaml +++ b/overlays/vr1-dc0-machines.yaml @@ -103,3 +103,78 @@ bridge-interface-mappings: >- br-ex:52:54:00:8c:2a:8c br-ex:52:54:00:50:48:88 + + # ---- UCA SOURCE -> THE IN-DC MIRROR (RULED 2026-07-31, GA-R5: "Point origin/source + # at the mirrored UCA, per-DC overlay"). ---- + # + # WHY: the charms otherwise add `deb http://ubuntu-cloud.archive.canonical.com/ubuntu + # jammy-updates/caracal main`, which is MEASURED UNREACHABLE from a node (000) under + # D-107's node-level airgap, while the mirrored copy answers 200 with real content. + # juju's `apt-mirror` model-config rewrites only the UBUNTU archive, never the UCA + # source a charm adds -- so this is the only place it can be pointed. + # + # THIS IS A PER-DC VALUE and therefore CANNOT live in bundle.yaml: the mirror address + # differs per DC. dc1 gets NO equivalent block -- its apt-cacher-ng forwards whatever + # URL it is handed, so `cloud:jammy-caracal` keeps working there. That asymmetry is + # D-135's experiment RESULT (full mirror rewrites every non-Ubuntu source; proxy + # rewrites none), not a defect to "fix" for symmetry. + # + # SCOPE DERIVED FROM THE CHARM SCHEMAS, not hand-listed: 15 apps whose charm accepts an + # origin key AND resolves to a UCA pocket -- 12 `openstack-origin` (explicit + # cloud:jammy-caracal or the charm default `caracal`) + 3 ceph `source`. Every other app + # defaults to `distro` (the Ubuntu archive only) and needs nothing. + # + # NO `|key` SUFFIX IS NEEDED: measured, the UCA signing key is already on the nodes at + # /etc/apt/trusted.gpg.d/ubuntu-keyring-2012-cloud-archive.gpg, and debmirror preserved + # the upstream Release/InRelease signatures, so the mirrored copy verifies as-is. + # + # LOGGED, NOT CHANGED HERE: `ovn-central`'s charm default is `source: zed`, NOT caracal. + # It therefore points at a UCA pocket the dc0 mirror does not carry (jammy-updates/caracal + # only). Repointing it would change its RELEASE, not just its URL, so it is a separate + # question and is left alone. + + barbican: + options: + openstack-origin: "deb http://10.12.8.4/cloud-archive jammy-updates/caracal main" + cinder: + options: + openstack-origin: "deb http://10.12.8.4/cloud-archive jammy-updates/caracal main" + designate: + options: + openstack-origin: "deb http://10.12.8.4/cloud-archive jammy-updates/caracal main" + glance: + options: + openstack-origin: "deb http://10.12.8.4/cloud-archive jammy-updates/caracal main" + keystone: + options: + openstack-origin: "deb http://10.12.8.4/cloud-archive jammy-updates/caracal main" + magnum: + options: + openstack-origin: "deb http://10.12.8.4/cloud-archive jammy-updates/caracal main" + neutron-api: + options: + openstack-origin: "deb http://10.12.8.4/cloud-archive jammy-updates/caracal main" + nova-cloud-controller: + options: + openstack-origin: "deb http://10.12.8.4/cloud-archive jammy-updates/caracal main" + nova-compute: + options: + openstack-origin: "deb http://10.12.8.4/cloud-archive jammy-updates/caracal main" + octavia: + options: + openstack-origin: "deb http://10.12.8.4/cloud-archive jammy-updates/caracal main" + openstack-dashboard: + options: + openstack-origin: "deb http://10.12.8.4/cloud-archive jammy-updates/caracal main" + placement: + options: + openstack-origin: "deb http://10.12.8.4/cloud-archive jammy-updates/caracal main" + ceph-mon: + options: + source: "deb http://10.12.8.4/cloud-archive jammy-updates/caracal main" + ceph-osd: + options: + source: "deb http://10.12.8.4/cloud-archive jammy-updates/caracal main" + ceph-radosgw: + options: + source: "deb http://10.12.8.4/cloud-archive jammy-updates/caracal main"