diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index 42d63ef..2ea9f0e 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -1799,8 +1799,38 @@ **RELATED, and expected for the same reason:** the dry-run's `WARNING These fields ... line 62: field name ... line 96: field variables ... will be ignored` is the pair of benign R11 warnings `phase-01-bundle-deploy.md:175-176` already documents. Not a finding. - **THE DEPLOY ITSELF IS NOT RUN.** Step 4.3 is a gated MUTATION and awaits operator - approval; the dry-run is where this session stops. + **>>> THE dc0 BUNDLE IS DEPLOYED. `Deploy of bundle completed.` EXIT 0, 2026-08-02. <<<** + Capture: `docs/audit/stage5-deploy-dc0-20260802.txt`. **OPERATOR APPROVAL, exact + utterance: "Approved, continue as autonomously as possible"** -- covering the single-file + overlay re-stage and Step 4.3. Run from the dc0 rack (D-138), model `vr1-dc0`, juju + 3.6.27. Pre-deploy the model read `Model "vr1-dc0" is empty` and ALL SIX inputs were + sha256-verified against repo HEAD in the same window as the deploy, not inherited: the + five tracked files MATCH and the PKI overlay is unchanged at `5fc117f1` mode `0600` + (hashed, never read). The command was the DOCFIX-208 form -- the machines overlay the + runbook omitted until this session. + **>>> STEP 4.4 PASSED ON ALL THREE ITEMS AT ITS FIRST EVER EXECUTION, AND ITEM 1 SETTLES + A PROPERTY THIS REPO HAS CARRIED AS UNPROVEN SINCE 2026-07-29. <<<** `juju config + ovn-chassis` shows ALL THREE options, each `source: user`: `bridge-interface-mappings` + = `br-ex:52:54:00:8c:2a:8c br-ex:52:54:00:50:48:88` (exactly two MACs), `ovn-bridge-mappings` + = `physnet1:br-ex`, `prefer-chassis-as-gw` = `true`. **JUJU MERGES AN OVERLAY'S `options` + MAP KEY-BY-KEY; IT DOES NOT REPLACE IT.** Both machines overlays' headers had carried + this as "near-certain but NOT PROVEN HERE"; no offline check could settle it + (`_deep_merge` merges key-by-key by construction) and the dry-run prints no options at + any verbosity. The entire `*-vips.yaml` architecture rests on this behaviour and it is + now MEASURED rather than assumed. **Item 2 PASS:** all FIFTEEN apps read + `deb http://10.12.8.4/cloud-archive jammy-updates/caracal main`; not one reads + `cloud:jammy-caracal` or the UCA, so the second injury DOCFIX-208 prevented is confirmed + prevented on the live model. **Item 3 PASS:** `ovn-central` reads `source: zed`, its + charm default, deliberately left alone -- expected, not a defect. + **MEASURED IN PASSING:** `ceph-osd/0..3` already carry GUA IPv6 + (`2602:f3e2:f02:10::150/151/152/153`), so the D-139 GUA carve is live on the addresses + juju is provisioning against, not merely present in MAAS. + **CONVERGENCE IS IN PROGRESS** -- at t+0 all units read `agent:allocating, + workload:waiting`, which is the expected shape. The Step 4.3 target end state is + phase-01's PRE-vault-init state: nine machines `started`, ZERO units in `error`, + `mysql-innodb-cluster` ACTIVE, and the only `blocked` units `vault/0` ("Vault needs to be + initialized" -- the Stage-5 Step 5 trigger, not a fault) and `octavia` ("Awaiting + configure-resources"). Vault init is the NEXT step, not part of this one. **>>> THE dc0 SNAP FORWARD PROXY IS INSTALLED, RUNNING AND GATE-VERIFIED 2026-07-31. THE LAST BUILD BETWEEN HERE AND `add-model` IS DONE. <<<** Capture diff --git a/docs/audit/stage5-deploy-dc0-20260802.txt b/docs/audit/stage5-deploy-dc0-20260802.txt new file mode 100644 index 0000000..c2d7c0d --- /dev/null +++ b/docs/audit/stage5-deploy-dc0-20260802.txt @@ -0,0 +1,413 @@ +stage5-deploy-dc0-20260802.txt +============================== +STAGE 5 / PHASE 4, vr1-dc0: `juju deploy` EXECUTED 2026-08-02, operator-approved +("Approved, continue as autonomously as possible"). Run FROM THE dc0 RACK (D-138), +model vr1-dc0 on controller vr1-dc0-controller, juju 3.6.27. + +PRE-DEPLOY VERIFICATION (all six inputs, sha256 against repo HEAD, model empty): + bundle.yaml 4c8a78527a3100f6... MATCH + overlays/vr1-dc0-vips.yaml 80d861560a6b3c52... MATCH + overlays/vr1-dc0-machines.yaml dd914358d517922b... MATCH (re-staged this session) + policies/domain-manager-policy.yaml 64f99b638a1855b0... MATCH + policies/overrides.zip 02fe1fd7fcf07bfc... MATCH + overlays/vr1-dc0-octavia-pki.yaml 5fc117f188332042... mode 600 (hashed, never read) + `juju status -m vr1-dc0` -> Model "vr1-dc0" is empty. + +COMMAND (the DOCFIX-208 form -- the machines overlay was missing from the runbook's +dc0 command until this session): + + juju deploy ./bundle.yaml \ + --overlay overlays/vr1-dc0-vips.yaml \ + --overlay overlays/vr1-dc0-machines.yaml \ + --overlay overlays/vr1-dc0-octavia-pki.yaml \ + -m vr1-dc0 + +RESULT: `Deploy of bundle completed.` EXIT=0. + +================================================================================ +STEP 4.4 -- MERGED CONFIG ASSERTED LIVE, before the model settled. FIRST EVER RUN +of this gate (authored earlier the same session against an empty model). +ALL THREE ITEMS PASS. +================================================================================ + +>>> ITEM 1 PASS -- AND IT SETTLES A QUESTION NOTHING IN THE CHAIN COULD PROVE. <<< +`juju config ovn-chassis -m vr1-dc0` shows ALL THREE options, each `source: user`: + + bridge-interface-mappings value: br-ex:52:54:00:8c:2a:8c br-ex:52:54:00:50:48:88 + ovn-bridge-mappings value: physnet1:br-ex + prefer-chassis-as-gw value: true + +JUJU MERGES AN OVERLAY'S `options` MAP KEY-BY-KEY; IT DOES NOT REPLACE IT. Both +machines overlays' headers had carried this as "near-certain but NOT PROVEN HERE" +since 2026-07-29, and no offline check could settle it (provider-bundle-check.py's +_deep_merge merges key-by-key by construction, so it cannot tell the two apart) nor +could the dry-run (it prints no options at any verbosity). Now MEASURED. The whole +*-vips.yaml architecture rests on this behaviour. +Exactly TWO MACs, as required (a third would mean a wrong node). + +>>> ITEM 2 PASS -- all 15 apps resolve to the in-DC mirror, none to the UCA. <<< +`juju config openstack-origin -m vr1-dc0` (12) and ` source` (3): + barbican, cinder, designate, glance, keystone, magnum, neutron-api, + nova-cloud-controller, nova-compute, octavia, openstack-dashboard, placement, + ceph-mon, ceph-osd, ceph-radosgw + -> ALL FIFTEEN: deb http://10.12.8.4/cloud-archive jammy-updates/caracal main +NOT ONE reads cloud:jammy-caracal or ubuntu-cloud.archive.canonical.com, which are +MEASURED UNREACHABLE from a node (000) under the D-107 airgap. This is the second +injury DOCFIX-208 prevented, now confirmed prevented on the live model. + +>>> ITEM 3 PASS -- ovn-central reads `source: zed`. <<< +Its charm default, deliberately left alone (overlays/vr1-dc0-machines.yaml header: +repointing it would change its RELEASE, not just its URL). EXPECTED, not a defect. + +================================================================================ +FIRST STATUS READ (immediately post-deploy; machines allocating) +================================================================================ +All units agent:allocating / workload:waiting, as expected at t+0. +NOTED: ceph-osd/0..3 already carry GUA IPv6 -- 2602:f3e2:f02:10::150/151/152/153 -- +so the D-139 GUA plane carve is live on the node addresses juju is provisioning +against, not merely present in MAAS. + +--- deploy output, verbatim ---------------------------------------------------- +Located charm "barbican" in charm-hub, channel 2024.1/stable +Located charm "hacluster" in charm-hub, channel 2.4/stable +Located charm "mysql-router" in charm-hub, channel 8.0/stable +Located charm "barbican-vault" in charm-hub, channel 2024.1/stable +Located charm "ceph-mon" in charm-hub, channel squid/stable +Located charm "ceph-osd" in charm-hub, channel squid/stable +Located charm "ceph-radosgw" in charm-hub, channel squid/stable +Located charm "hacluster" in charm-hub, channel 2.4/stable +Located charm "ceph-rbd-mirror" in charm-hub, channel squid/stable +Located charm "cinder" in charm-hub, channel 2024.1/stable +Located charm "cinder-backup" in charm-hub, channel 2024.1/stable +Located charm "cinder-ceph" in charm-hub, channel 2024.1/stable +Located charm "hacluster" in charm-hub, channel 2.4/stable +Located charm "mysql-router" in charm-hub, channel 8.0/stable +Located charm "mysql-router" in charm-hub, channel 8.0/stable +Located charm "designate" in charm-hub, channel 2024.1/stable +Located charm "designate-bind" in charm-hub, channel 2024.1/stable +Located charm "hacluster" in charm-hub, channel 2.4/stable +Located charm "mysql-router" in charm-hub, channel 8.0/stable +Located charm "glance" in charm-hub, channel 2024.1/stable +Located charm "hacluster" in charm-hub, channel 2.4/stable +Located charm "mysql-router" in charm-hub, channel 8.0/stable +Located charm "glance-simplestreams-sync" in charm-hub, channel 2024.1/stable +Located charm "keystone" in charm-hub, channel 2024.1/stable +Located charm "hacluster" in charm-hub, channel 2.4/stable +Located charm "mysql-router" in charm-hub, channel 8.0/stable +Located charm "magnum" in charm-hub, channel 2024.1/stable +Located charm "magnum-dashboard" in charm-hub, channel 2024.1/stable +Located charm "hacluster" in charm-hub, channel 2.4/stable +Located charm "mysql-router" in charm-hub, channel 8.0/stable +Located charm "memcached" in charm-hub, channel latest/stable +Located charm "mysql-innodb-cluster" in charm-hub, channel 8.0/stable +Located charm "mysql-router" in charm-hub, channel 8.0/stable +Located charm "neutron-api" in charm-hub, channel 2024.1/stable +Located charm "hacluster" in charm-hub, channel 2.4/stable +Located charm "mysql-router" in charm-hub, channel 8.0/stable +Located charm "neutron-api-plugin-ovn" in charm-hub, channel 2024.1/stable +Located charm "nova-cloud-controller" in charm-hub, channel 2024.1/stable +Located charm "hacluster" in charm-hub, channel 2.4/stable +Located charm "nova-compute" in charm-hub, channel 2024.1/stable +Located charm "octavia" in charm-hub, channel 2024.1/stable +Located charm "octavia-dashboard" in charm-hub, channel 2024.1/stable +Located charm "octavia-diskimage-retrofit" in charm-hub, channel 2024.1/stable +Located charm "hacluster" in charm-hub, channel 2.4/stable +Located charm "mysql-router" in charm-hub, channel 8.0/stable +Located charm "openstack-dashboard" in charm-hub, channel 2024.1/stable +Located charm "hacluster" in charm-hub, channel 2.4/stable +Located charm "ovn-central" in charm-hub, channel 24.03/stable +Located charm "ovn-chassis" in charm-hub, channel 24.03/stable +Located charm "ovn-chassis" in charm-hub, channel 24.03/stable +Located charm "placement" in charm-hub, channel 2024.1/stable +Located charm "hacluster" in charm-hub, channel 2.4/stable +Located charm "mysql-router" in charm-hub, channel 8.0/stable +Located charm "rabbitmq-server" in charm-hub, channel 3.9/stable +Located charm "vault" in charm-hub, channel 1.8/stable +Located charm "mysql-router" in charm-hub, channel 8.0/stable +Executing changes: +- upload charm barbican from charm-hub for base ubuntu@22.04/stable from channel 2024.1/stable with architecture=amd64 +- deploy application barbican from charm-hub on ubuntu@22.04/stable with 2024.1/stable + added resource policyd-override +- upload charm hacluster from charm-hub for base ubuntu@22.04/stable from channel 2.4/stable with architecture=amd64 +- deploy application barbican-hacluster from charm-hub on ubuntu@22.04/stable with 2.4/stable using hacluster +- upload charm mysql-router from charm-hub for base ubuntu@22.04/stable from channel 8.0/stable with architecture=amd64 +- deploy application barbican-mysql-router from charm-hub on ubuntu@22.04/stable with 8.0/stable using mysql-router +- upload charm barbican-vault from charm-hub for base ubuntu@22.04/stable from channel 2024.1/stable with architecture=amd64 +- deploy application barbican-vault from charm-hub on ubuntu@22.04/stable with 2024.1/stable +- upload charm ceph-mon from charm-hub for base ubuntu@22.04/stable from channel squid/stable with architecture=amd64 +- deploy application ceph-mon from charm-hub on ubuntu@22.04/stable with squid/stable + added resource alert-rules +- upload charm ceph-osd from charm-hub for base ubuntu@22.04/stable from channel squid/stable with architecture=amd64 +- deploy application ceph-osd from charm-hub on ubuntu@22.04/stable with squid/stable +- upload charm ceph-radosgw from charm-hub for base ubuntu@22.04/stable from channel squid/stable with architecture=amd64 +- deploy application ceph-radosgw from charm-hub on ubuntu@22.04/stable with squid/stable +- deploy application ceph-radosgw-hacluster from charm-hub on ubuntu@22.04/stable with 2.4/stable using hacluster +- upload charm ceph-rbd-mirror from charm-hub for base ubuntu@22.04/stable from channel squid/stable with architecture=amd64 +- deploy application ceph-rbd-mirror from charm-hub on ubuntu@22.04/stable with squid/stable +- upload charm cinder from charm-hub for base ubuntu@22.04/stable from channel 2024.1/stable with architecture=amd64 +- deploy application cinder from charm-hub on ubuntu@22.04/stable with 2024.1/stable + added resource policyd-override +- upload charm cinder-backup from charm-hub for base ubuntu@22.04/stable from channel 2024.1/stable with architecture=amd64 +- deploy application cinder-backup from charm-hub on ubuntu@22.04/stable with 2024.1/stable +- upload charm cinder-ceph from charm-hub for base ubuntu@22.04/stable from channel 2024.1/stable with architecture=amd64 +- deploy application cinder-ceph from charm-hub on ubuntu@22.04/stable with 2024.1/stable +- deploy application cinder-hacluster from charm-hub on ubuntu@22.04/stable with 2.4/stable using hacluster +- deploy application cinder-mysql-router from charm-hub on ubuntu@22.04/stable with 8.0/stable using mysql-router +- deploy application dashboard-mysql-router from charm-hub on ubuntu@22.04/stable with 8.0/stable using mysql-router +- upload charm designate from charm-hub for base ubuntu@22.04/stable from channel 2024.1/stable with architecture=amd64 +- deploy application designate from charm-hub on ubuntu@22.04/stable with 2024.1/stable + added resource policyd-override +- upload charm designate-bind from charm-hub for base ubuntu@22.04/stable from channel 2024.1/stable with architecture=amd64 +- deploy application designate-bind from charm-hub on ubuntu@22.04/stable with 2024.1/stable +- deploy application designate-hacluster from charm-hub on ubuntu@22.04/stable with 2.4/stable using hacluster +- deploy application designate-mysql-router from charm-hub on ubuntu@22.04/stable with 8.0/stable using mysql-router +- upload charm glance from charm-hub for base ubuntu@22.04/stable from channel 2024.1/stable with architecture=amd64 +- deploy application glance from charm-hub on ubuntu@22.04/stable with 2024.1/stable + added resource policyd-override +- deploy application glance-hacluster from charm-hub on ubuntu@22.04/stable with 2.4/stable using hacluster +- deploy application glance-mysql-router from charm-hub on ubuntu@22.04/stable with 8.0/stable using mysql-router +- upload charm glance-simplestreams-sync from charm-hub for base ubuntu@22.04/stable from channel 2024.1/stable with architecture=amd64 +- deploy application glance-simplestreams-sync from charm-hub on ubuntu@22.04/stable with 2024.1/stable + added resource simplestreams +- upload charm keystone from charm-hub for base ubuntu@22.04/stable from channel 2024.1/stable with architecture=amd64 +- deploy application keystone from charm-hub on ubuntu@22.04/stable with 2024.1/stable + added resource policyd-override +- deploy application keystone-hacluster from charm-hub on ubuntu@22.04/stable with 2.4/stable using hacluster +- deploy application keystone-mysql-router from charm-hub on ubuntu@22.04/stable with 8.0/stable using mysql-router +- upload charm magnum from charm-hub for base ubuntu@22.04/stable from channel 2024.1/stable with architecture=amd64 +- deploy application magnum from charm-hub on ubuntu@22.04/stable with 2024.1/stable +- upload charm magnum-dashboard from charm-hub for base ubuntu@22.04/stable from channel 2024.1/stable with architecture=amd64 +- deploy application magnum-dashboard from charm-hub on ubuntu@22.04/stable with 2024.1/stable +- deploy application magnum-hacluster from charm-hub on ubuntu@22.04/stable with 2.4/stable using hacluster +- deploy application magnum-mysql-router from charm-hub on ubuntu@22.04/stable with 8.0/stable using mysql-router +- upload charm memcached from charm-hub for base ubuntu@22.04/stable from channel latest/stable with architecture=amd64 +- deploy application memcached from charm-hub on ubuntu@22.04/stable with latest/stable +- upload charm mysql-innodb-cluster from charm-hub for base ubuntu@22.04/stable from channel 8.0/stable with architecture=amd64 +- deploy application mysql-innodb-cluster from charm-hub on ubuntu@22.04/stable with 8.0/stable + added resource mysql-shell +- deploy application ncc-mysql-router from charm-hub on ubuntu@22.04/stable with 8.0/stable using mysql-router +- upload charm neutron-api from charm-hub for base ubuntu@22.04/stable from channel 2024.1/stable with architecture=amd64 +- deploy application neutron-api from charm-hub on ubuntu@22.04/stable with 2024.1/stable + added resource policyd-override +- deploy application neutron-api-hacluster from charm-hub on ubuntu@22.04/stable with 2.4/stable using hacluster +- deploy application neutron-api-mysql-router from charm-hub on ubuntu@22.04/stable with 8.0/stable using mysql-router +- upload charm neutron-api-plugin-ovn from charm-hub for base ubuntu@22.04/stable from channel 2024.1/stable with architecture=amd64 +- deploy application neutron-api-plugin-ovn from charm-hub on ubuntu@22.04/stable with 2024.1/stable +- upload charm nova-cloud-controller from charm-hub for base ubuntu@22.04/stable from channel 2024.1/stable with architecture=amd64 +- deploy application nova-cloud-controller from charm-hub on ubuntu@22.04/stable with 2024.1/stable + added resource policyd-override +- deploy application nova-cloud-controller-hacluster from charm-hub on ubuntu@22.04/stable with 2.4/stable using hacluster +- upload charm nova-compute from charm-hub for base ubuntu@22.04/stable from channel 2024.1/stable with architecture=amd64 +- deploy application nova-compute from charm-hub on ubuntu@22.04/stable with 2024.1/stable +- upload charm octavia from charm-hub for base ubuntu@22.04/stable from channel 2024.1/stable with architecture=amd64 +- deploy application octavia from charm-hub on ubuntu@22.04/stable with 2024.1/stable + added resource policyd-override +- upload charm octavia-dashboard from charm-hub for base ubuntu@22.04/stable from channel 2024.1/stable with architecture=amd64 +- deploy application octavia-dashboard from charm-hub on ubuntu@22.04/stable with 2024.1/stable +- upload charm octavia-diskimage-retrofit from charm-hub for base ubuntu@22.04/stable from channel 2024.1/stable with architecture=amd64 +- deploy application octavia-diskimage-retrofit from charm-hub on ubuntu@22.04/stable with 2024.1/stable + added resource core18 + added resource octavia-diskimage-retrofit + added resource snapd +- deploy application octavia-hacluster from charm-hub on ubuntu@22.04/stable with 2.4/stable using hacluster +- deploy application octavia-mysql-router from charm-hub on ubuntu@22.04/stable with 8.0/stable using mysql-router +- upload charm openstack-dashboard from charm-hub for base ubuntu@22.04/stable from channel 2024.1/stable with architecture=amd64 +- deploy application openstack-dashboard from charm-hub on ubuntu@22.04/stable with 2024.1/stable + added resource policyd-override + added resource theme +- deploy application openstack-dashboard-hacluster from charm-hub on ubuntu@22.04/stable with 2.4/stable using hacluster +- upload charm ovn-central from charm-hub for base ubuntu@22.04/stable from channel 24.03/stable with architecture=amd64 +- deploy application ovn-central from charm-hub on ubuntu@22.04/stable with 24.03/stable +- upload charm ovn-chassis from charm-hub for base ubuntu@22.04/stable from channel 24.03/stable with architecture=amd64 +- deploy application ovn-chassis from charm-hub on ubuntu@22.04/stable with 24.03/stable +- deploy application ovn-chassis-octavia from charm-hub on ubuntu@22.04/stable with 24.03/stable using ovn-chassis +- upload charm placement from charm-hub for base ubuntu@22.04/stable from channel 2024.1/stable with architecture=amd64 +- deploy application placement from charm-hub on ubuntu@22.04/stable with 2024.1/stable +- deploy application placement-hacluster from charm-hub on ubuntu@22.04/stable with 2.4/stable using hacluster +- deploy application placement-mysql-router from charm-hub on ubuntu@22.04/stable with 8.0/stable using mysql-router +- upload charm rabbitmq-server from charm-hub for base ubuntu@22.04/stable from channel 3.9/stable with architecture=amd64 +- deploy application rabbitmq-server from charm-hub on ubuntu@22.04/stable with 3.9/stable +- upload charm vault from charm-hub for base ubuntu@22.04/stable from channel 1.8/stable with architecture=amd64 +- deploy application vault from charm-hub on ubuntu@22.04/stable with 1.8/stable + added resource core + added resource vault +- deploy application vault-mysql-router from charm-hub on ubuntu@22.04/stable with 8.0/stable using mysql-router +- add new machine 0 +- add new machine 1 +- add new machine 2 +- add new machine 3 +- add new machine 4 +- add new machine 5 +- add new machine 6 +- add new machine 7 +- add new machine 8 +- add relation nova-cloud-controller:memcache - memcached:cache +- add relation vault-mysql-router:db-router - mysql-innodb-cluster:db-router +- add relation vault:shared-db - vault-mysql-router:shared-db +- add relation mysql-innodb-cluster:certificates - vault:certificates +- add relation keystone-mysql-router:db-router - mysql-innodb-cluster:db-router +- add relation keystone-mysql-router:shared-db - keystone:shared-db +- add relation keystone:certificates - vault:certificates +- add relation keystone:ha - keystone-hacluster:ha +- add relation glance-mysql-router:db-router - mysql-innodb-cluster:db-router +- add relation glance-mysql-router:shared-db - glance:shared-db +- add relation glance:identity-service - keystone:identity-service +- add relation glance:certificates - vault:certificates +- add relation glance:ha - glance-hacluster:ha +- add relation glance-simplestreams-sync:identity-service - keystone:identity-service +- add relation glance-simplestreams-sync:certificates - vault:certificates +- add relation ncc-mysql-router:db-router - mysql-innodb-cluster:db-router +- add relation ncc-mysql-router:shared-db - nova-cloud-controller:shared-db +- add relation nova-cloud-controller:identity-service - keystone:identity-service +- add relation nova-cloud-controller:amqp - rabbitmq-server:amqp +- add relation nova-cloud-controller:image-service - glance:image-service +- add relation nova-cloud-controller:neutron-api - neutron-api:neutron-api +- add relation nova-cloud-controller:cloud-compute - nova-compute:cloud-compute +- add relation nova-cloud-controller:cinder-volume-service - cinder:cinder-volume-service +- add relation nova-cloud-controller:certificates - vault:certificates +- add relation nova-cloud-controller:ha - nova-cloud-controller-hacluster:ha +- add relation nova-compute:amqp - rabbitmq-server:amqp +- add relation nova-compute:image-service - glance:image-service +- add relation placement-mysql-router:db-router - mysql-innodb-cluster:db-router +- add relation placement-mysql-router:shared-db - placement:shared-db +- add relation placement:identity-service - keystone:identity-service +- add relation placement:placement - nova-cloud-controller:placement +- add relation placement:certificates - vault:certificates +- add relation placement:ha - placement-hacluster:ha +- add relation neutron-api-mysql-router:db-router - mysql-innodb-cluster:db-router +- add relation neutron-api-mysql-router:shared-db - neutron-api:shared-db +- add relation neutron-api:identity-service - keystone:identity-service +- add relation neutron-api:amqp - rabbitmq-server:amqp +- add relation neutron-api:certificates - vault:certificates +- add relation neutron-api-plugin-ovn:neutron-plugin - neutron-api:neutron-plugin-api-subordinate +- add relation neutron-api-plugin-ovn:ovsdb-cms - ovn-central:ovsdb-cms +- add relation neutron-api-plugin-ovn:certificates - vault:certificates +- add relation ovn-central:certificates - vault:certificates +- add relation ovn-chassis:ovsdb - ovn-central:ovsdb +- add relation ovn-chassis:nova-compute - nova-compute:neutron-plugin +- add relation ovn-chassis:certificates - vault:certificates +- add relation neutron-api:ha - neutron-api-hacluster:ha +- add relation cinder-mysql-router:db-router - mysql-innodb-cluster:db-router +- add relation cinder-mysql-router:shared-db - cinder:shared-db +- add relation cinder:identity-service - keystone:identity-service +- add relation cinder:amqp - rabbitmq-server:amqp +- add relation cinder:image-service - glance:image-service +- add relation cinder:certificates - vault:certificates +- add relation cinder-ceph:storage-backend - cinder:storage-backend +- add relation cinder-ceph:ceph - ceph-mon:client +- add relation cinder-ceph:ceph-access - nova-compute:ceph-access +- add relation cinder:ha - cinder-hacluster:ha +- add relation cinder-backup:backup-backend - cinder:backup-backend +- add relation cinder-backup:ceph - ceph-mon:client +- add relation ceph-mon:osd - ceph-osd:mon +- add relation ceph-mon:client - nova-compute:ceph +- add relation ceph-mon:client - glance:ceph +- add relation ceph-radosgw:mon - ceph-mon:radosgw +- add relation ceph-radosgw:identity-service - keystone:identity-service +- add relation ceph-radosgw:certificates - vault:certificates +- add relation ceph-radosgw:ha - ceph-radosgw-hacluster:ha +- add relation ceph-rbd-mirror:ceph-local - ceph-mon:rbd-mirror +- add relation dashboard-mysql-router:db-router - mysql-innodb-cluster:db-router +- add relation dashboard-mysql-router:shared-db - openstack-dashboard:shared-db +- add relation openstack-dashboard:identity-service - keystone:identity-service +- add relation openstack-dashboard:certificates - vault:certificates +- add relation openstack-dashboard:ha - openstack-dashboard-hacluster:ha +- add relation octavia-mysql-router:db-router - mysql-innodb-cluster:db-router +- add relation octavia-mysql-router:shared-db - octavia:shared-db +- add relation octavia:identity-service - keystone:identity-service +- add relation octavia:amqp - rabbitmq-server:amqp +- add relation octavia:neutron-api - neutron-api:neutron-load-balancer +- add relation octavia:certificates - vault:certificates +- add relation octavia-dashboard:dashboard - openstack-dashboard:dashboard-plugin +- add relation ovn-chassis-octavia:ovsdb - ovn-central:ovsdb +- add relation ovn-chassis-octavia:ovsdb-subordinate - octavia:ovsdb-subordinate +- add relation ovn-chassis-octavia:certificates - vault:certificates +- add relation octavia-diskimage-retrofit:juju-info - glance-simplestreams-sync:juju-info +- add relation octavia-diskimage-retrofit:identity-credentials - keystone:identity-credentials +- add relation octavia:ha - octavia-hacluster:ha +- add relation barbican-mysql-router:db-router - mysql-innodb-cluster:db-router +- add relation barbican-mysql-router:shared-db - barbican:shared-db +- add relation barbican:identity-service - keystone:identity-service +- add relation barbican:amqp - rabbitmq-server:amqp +- add relation barbican:certificates - vault:certificates +- add relation barbican:secrets - barbican-vault:secrets +- add relation barbican-vault:certificates - vault:certificates +- add relation barbican-vault:secrets-storage - vault:secrets +- add relation barbican:ha - barbican-hacluster:ha +- add relation magnum-mysql-router:db-router - mysql-innodb-cluster:db-router +- add relation magnum:shared-db - magnum-mysql-router:shared-db +- add relation magnum:identity-service - keystone:identity-service +- add relation magnum:amqp - rabbitmq-server:amqp +- add relation magnum:certificates - vault:certificates +- add relation magnum-dashboard:dashboard - openstack-dashboard:dashboard-plugin +- add relation magnum:ha - magnum-hacluster:ha +- add relation designate-mysql-router:db-router - mysql-innodb-cluster:db-router +- add relation designate-mysql-router:shared-db - designate:shared-db +- add relation designate:identity-service - keystone:identity-service +- add relation designate:amqp - rabbitmq-server:amqp +- add relation designate:certificates - vault:certificates +- add relation designate:coordinator-memcached - memcached:cache +- add relation designate:dns-backend - designate-bind:dns-backend +- add relation designate:ha - designate-hacluster:ha +- add unit ceph-osd/0 to new machine 5 +- add unit ceph-osd/1 to new machine 6 +- add unit ceph-osd/2 to new machine 7 +- add unit ceph-osd/3 to new machine 8 +- add unit nova-compute/0 to new machine 3 +- add unit nova-compute/1 to new machine 4 +- add lxd container 0/lxd/0 on new machine 0 +- add lxd container 0/lxd/1 on new machine 0 +- add lxd container 1/lxd/0 on new machine 1 +- add lxd container 2/lxd/0 on new machine 2 +- add lxd container 0/lxd/2 on new machine 0 +- add lxd container 0/lxd/3 on new machine 0 +- add lxd container 0/lxd/4 on new machine 0 +- add lxd container 0/lxd/5 on new machine 0 +- add lxd container 2/lxd/1 on new machine 2 +- add lxd container 0/lxd/6 on new machine 0 +- add lxd container 1/lxd/1 on new machine 1 +- add lxd container 0/lxd/7 on new machine 0 +- add lxd container 0/lxd/8 on new machine 0 +- add lxd container 0/lxd/9 on new machine 0 +- add lxd container 0/lxd/10 on new machine 0 +- add lxd container 1/lxd/2 on new machine 1 +- add lxd container 2/lxd/2 on new machine 2 +- add lxd container 0/lxd/11 on new machine 0 +- add lxd container 0/lxd/12 on new machine 0 +- add lxd container 0/lxd/13 on new machine 0 +- add lxd container 0/lxd/14 on new machine 0 +- add lxd container 0/lxd/15 on new machine 0 +- add lxd container 1/lxd/3 on new machine 1 +- add lxd container 2/lxd/3 on new machine 2 +- add lxd container 0/lxd/16 on new machine 0 +- add lxd container 0/lxd/17 on new machine 0 +- add lxd container 0/lxd/18 on new machine 0 +- add unit barbican/0 to 0/lxd/0 +- add unit ceph-mon/0 to 0/lxd/1 +- add unit ceph-mon/1 to 1/lxd/0 +- add unit ceph-mon/2 to 2/lxd/0 +- add unit ceph-radosgw/0 to 0/lxd/2 +- add unit ceph-rbd-mirror/0 to 0/lxd/3 +- add unit cinder/0 to 0/lxd/4 +- add unit designate/0 to 0/lxd/5 +- add unit designate-bind/0 to 2/lxd/1 +- add unit glance/0 to 0/lxd/6 +- add unit glance-simplestreams-sync/0 to 1/lxd/1 +- add unit keystone/0 to 0/lxd/7 +- add unit magnum/0 to 0/lxd/8 +- add unit memcached/0 to 0/lxd/9 +- add unit mysql-innodb-cluster/0 to 0/lxd/10 +- add unit mysql-innodb-cluster/1 to 1/lxd/2 +- add unit mysql-innodb-cluster/2 to 2/lxd/2 +- add unit neutron-api/0 to 0/lxd/11 +- add unit nova-cloud-controller/0 to 0/lxd/12 +- add unit octavia/0 to 0/lxd/13 +- add unit openstack-dashboard/0 to 0/lxd/14 +- add unit ovn-central/0 to 0/lxd/15 +- add unit ovn-central/1 to 1/lxd/3 +- add unit ovn-central/2 to 2/lxd/3 +- add unit placement/0 to 0/lxd/16 +- add unit rabbitmq-server/0 to 0/lxd/17 +- add unit vault/0 to 0/lxd/18 +Deploy of bundle completed. +EXIT=0 diff --git a/docs/changelog-20260802-deploy-input.md b/docs/changelog-20260802-deploy-input.md index 83da045..e1403f5 100644 --- a/docs/changelog-20260802-deploy-input.md +++ b/docs/changelog-20260802-deploy-input.md @@ -275,3 +275,43 @@ **THE DEPLOY IS NOT RUN.** Step 4.3 is a gated mutation and awaits operator approval. This session stops at the dry-run. + +## Item 7 -- THE dc0 BUNDLE IS DEPLOYED (operator-approved mutation) + +Operator: *"Approved, continue as autonomously as possible"* -- covering the +single-file overlay re-stage and Step 4.3. + +**Re-stage (mutation 1).** `scp -p overlays/vr1-dc0-machines.yaml` to the rack's +`~/repo-stage`, restoring the digest-match invariant after this session's +comment-only edit. Verified `dd914358` both ends. Single file, for the same reason +the 2026-07-31 and 08-02 re-stages were single-file: a wholesale refresh risks the +`0600` PKI overlay (SEC-029). + +**Deploy (mutation 2).** All six inputs sha256-verified against HEAD in the same +window, model confirmed `empty`, then the DOCFIX-208 command. Result: +`Deploy of bundle completed.` **EXIT 0.** Capture: +`docs/audit/stage5-deploy-dc0-20260802.txt`. + +**Step 4.4 -- first ever execution, ALL THREE ITEMS PASS.** + +1. **The property this repo has carried as unproven since 2026-07-29 is now + MEASURED: juju merges an overlay's `options` map KEY-BY-KEY, it does not + replace it.** `ovn-chassis` shows all three options `source: user` -- + `bridge-interface-mappings` (exactly two MACs), `ovn-bridge-mappings: + physnet1:br-ex`, `prefer-chassis-as-gw: true`. Nothing offline could settle + this (`_deep_merge` merges key-by-key by construction) and the dry-run prints + no options at all. The whole `*-vips.yaml` architecture rests on it. +2. All **fifteen** apps read the in-DC mirror; not one reads the UCA. The second + injury DOCFIX-208 prevented, confirmed prevented on the live model. +3. `ovn-central` reads `source: zed` -- its charm default, deliberately left alone. + +**The gate needed no shape correction.** The `.get()`/sentinel hardening was never +exercised, because every key was present; that is the good outcome, not evidence the +hardening was unnecessary. + +**Measured in passing:** `ceph-osd/0..3` already carry GUA IPv6 +(`2602:f3e2:f02:10::150-153`), so the D-139 carve is live on the addresses juju is +provisioning against. + +- **Revert:** `juju remove-application` per app, or destroy and recreate the + `vr1-dc0` model. Not a git revert -- this item is a live-cloud mutation.