diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index 3fb2187..99a72a5 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -1279,6 +1279,35 @@ neutering `wrongbase` kills T51; neutering the refuse branch kills T53. Harness 50 -> **55/55**; gauntlet ALL GREEN (93); repo-lint 0 fail; `provider-bundle-check` on the dc0 deploy input PASS. + **>>> THE MODEL WAS CLEARED AND BUNDLE DEPLOY ATTEMPT 3 SUCCEEDED, 2026-07-31: + `Deploy of bundle completed.` EXIT 0. <<<** Capture + `docs/audit/stage5-dc0-deploy-attempt3-20260731.txt`. **MEASURED IMMEDIATELY AFTER: juju + holds 56 applications, 9 machines, 33 units, machines `pending`/`allocating`; MAAS reads + 10 machines -- 9 `Deploying` and 1 `Deployed` (the juju controller, already up).** The + clear was executed first: all 23 application definitions removed **INDIVIDUALLY, never + batched (hard rule 3)**, each read back, with the precondition re-verified immediately + before the first removal (0 units, 0 machines, nothing provisioned) and the model read + back as `Model "vr1-dc0" is empty` afterwards. **STEP-3.5 STATE SURVIVED THE CLEAR, + checked rather than assumed:** `apt-mirror http://10.12.8.4/ubuntu` still set and all six + spaces still bound with both their v4 and v6 subnets. The deploy input was staged on the + rack with **all five files sha256-compared to repo HEAD** (`bundle.yaml` `4c8a7852`, + vips `daa2919d`, machines `b70e4eed`, `policies/overrides.zip` `02fe1fd7`, and the + gitignored octavia-pki `5fc117f1` at `0600`, SEC-029 custody untouched). + **THREE DEFECTS CLOSED IN THE ORDER THEY WERE HIT:** attempt 1's `unknown option + "prefer-ipv6"` (by the D-101 ruling note); attempt 2a's missing `policies/overrides.zip` on + the client host (by staging it); attempt 2b's `barbican` 265-vs-261 downgrade refusal (by + option D -- explicit base on all 56 AND a clean model). + **OPERATIONAL NOTE, recorded because the first removal read as a failure: `juju + remove-application` PROMPTS by default and aborts on non-interactive stdin** (`ERROR + application removal: aborted`, exit 1). `--no-prompt` is required from a non-interactive + session. + **WHAT IS NOT CLAIMED: `Deploy of bundle completed.` means juju ACCEPTED and QUEUED the + bundle. It does NOT mean the cloud is up.** 9 machines are allocating and 33 units are + pending; the settle to phase-01's documented pre-vault-init end state takes hours, and + nothing here asserts unit health, relation settling or any service verdict. + **G17's dc0 half is NOW GENUINELY ARMABLE and this is its one-shot window** -- the existing + capture was taken on the CONTROLLER VM and says so; the nine ROLE nodes are booting for the + first time as of this entry. **RUNBOOK DEFECT FOUND IN PASSING, LOGGED NOT FIXED (DOCFIX material):** `runbooks/dc-dc-phase4-juju-bundle-per-dc.md:553-557` gives the dc0 deploy WITHOUT `overlays/vr1-dc0-machines.yaml`, while the dc1 block three lines below includes its diff --git a/docs/audit/stage5-dc0-deploy-attempt3-20260731.txt b/docs/audit/stage5-dc0-deploy-attempt3-20260731.txt new file mode 100644 index 0000000..72acbb2 --- /dev/null +++ b/docs/audit/stage5-dc0-deploy-attempt3-20260731.txt @@ -0,0 +1,78 @@ +STAGE 5 -- dc0 bundle deploy ATTEMPT 3 (2026-07-31): SUCCEEDED +============================================================== + +>>> VERDICT: `Deploy of bundle completed.` EXIT 0 <<< + +COMMAND (from the dc0 rack, D-138 client host, cwd ~/repo-stage): + juju deploy ./bundle.yaml --overlay ./overlays/vr1-dc0-vips.yaml \ + --overlay ./overlays/vr1-dc0-machines.yaml \ + --overlay ./overlays/vr1-dc0-octavia-pki.yaml -m vr1-dc0 + +MEASURED IMMEDIATELY AFTER + juju 56 applications, 9 machines, 33 units + machine juju-status : 9 x pending + machine instance-stat: 9 x allocating + MAAS 10 machines: 9 Deploying, 1 Deployed (the juju controller, already up) + +WHAT MADE THIS ATTEMPT DIFFERENT -- three defects closed, in the order they were hit +------------------------------------------------------------------------------------ + attempt 1 `unknown option "prefer-ipv6"` on barbican. Aborted at VALIDATION, model + left empty. CLOSED by the D-101 RULING NOTE 2026-07-31: the six charms that + do not declare the option no longer receive it, and every v6 VIP leg is + retained -- the option was never what made HAProxy bind `:::port`. + attempt 2a `file for resource "policyd-override": stat .../policies/overrides.zip: no + such file or directory`. Reached EXECUTION and left 23 application + definitions. CLOSED by staging `policies/` on the rack, sha256-verified. + attempt 2b `barbican: downgrades are not currently supported: deployed revision 265 is + newer than requested revision 261`. CLOSED by RULING 2026-07-31 (option D): + an explicit `base: ubuntu@22.04/stable` on all 56 applications, plus + clearing the model so the deploy runs the path that is MEASURED to work. + +THE PRE-DEPLOY SEQUENCE, all of it verified rather than assumed +--------------------------------------------------------------- + 1. bundle fixed: 56/56 applications carry an explicit base; the edit was cross-checked + against `yaml.safe_load` (a first pass silently covered 44 of 56 -- the twelve + `-hacluster` apps are single-line FLOW MAPPINGS) and asserted on the ARTIFACT (the + parsed structures with `base` stripped are IDENTICAL to the original). + 2. gated: `provider-bundle-check` invariant 12 is NEW and mutation-proven five ways, so + the 56 lines cannot be silently simplified away. It caught a real gap on its FIRST + run -- `overlays/dc-ha-scaleup.yaml` DEFINES `vault-hacluster`, an application in no + other file, and it had no base. That is a LATER deploy step, so the trap would have + re-opened after this deploy succeeded. + 3. proven: the fully-based bundle `--dry-run` against the LIVE 23-app model exited 0, + where the unbased one errored. The one-app test before it was an INFERENCE; this is + the measurement. + 4. deploy input staged on the rack and ALL FIVE files sha256-compared to repo HEAD: + bundle.yaml 4c8a7852, vr1-dc0-vips daa2919d, vr1-dc0-machines b70e4eed, + policies/overrides.zip 02fe1fd7, and the gitignored vr1-dc0-octavia-pki 5fc117f1 + (0600, SEC-029 custody untouched). + 5. model CLEARED: all 23 application definitions removed INDIVIDUALLY, never batched + (hard rule 3), each read back; precondition re-verified immediately before the first + removal (0 units, 0 machines, nothing provisioned). Read-back after: `Model + "vr1-dc0" is empty`, 0 applications / 0 machines. + 6. Step-3.5 model state confirmed to have SURVIVED the clear: `apt-mirror + http://10.12.8.4/ubuntu` still set, all six spaces still bound with their v4 and v6 + subnets. + 7. preflight P1-P4 + P7 PASS; P5 RED with 11 findings, ALL ELEVEN ruled-accepted + (six 2026-07-30, five 2026-07-31), enumerated in + docs/audit/stage5-preflight-dc0-20260731.txt. + +NOTES CARRIED FORWARD +--------------------- + - `juju remove-application` PROMPTS by default and aborts on a non-interactive stdin + (`ERROR application removal: aborted`, exit 1). `--no-prompt` is required from a + non-interactive session. Recorded because the first removal read as a failure. + - `ceph-osd`'s `tags=openstack` constraint (bundle.yaml) is still the known exposure and + is still NOT a problem for this deploy: placement is by explicit machine id + (`ceph-osd/0..3` -> machines 5,6,7,8). A later UNPLACED `juju add-unit ceph-osd` would + match no machine. LOGGED, unchanged. + - **G17's dc0 half is now genuinely armable.** The existing capture was taken on the + CONTROLLER VM, not a role node, and said so. The nine role nodes are booting for the + first time as this file is written -- that is G17's window. + +WHAT IS NOT CLAIMED +------------------- +`Deploy of bundle completed.` means juju ACCEPTED and queued the bundle. It does NOT mean +the cloud is up. 9 machines are allocating, 33 units are pending, and the settle to +phase-01's documented pre-vault-init end state takes hours. Nothing here asserts unit +health, relation settling, or any service verdict. diff --git a/docs/changelog-20260731-prefer-ipv6-research.md b/docs/changelog-20260731-prefer-ipv6-research.md index bf02b56..194b766 100644 --- a/docs/changelog-20260731-prefer-ipv6-research.md +++ b/docs/changelog-20260731-prefer-ipv6-research.md @@ -416,3 +416,33 @@ **Revert.** `git revert` this commit -- bundle, overlay, gate and harness must move together, since the gate fails on a bundle without the base lines. + +## Item 13 -- option D half 2: model cleared, and BUNDLE DEPLOY ATTEMPT 3 SUCCEEDED + +**`Deploy of bundle completed.` EXIT 0.** Capture +`docs/audit/stage5-dc0-deploy-attempt3-20260731.txt`. + +**The clear.** All 23 application definitions removed INDIVIDUALLY, never batched (hard +rule 3), each read back. The precondition was re-verified immediately before the first +removal -- 0 units, 0 machines, nothing provisioned -- and the model read back as `Model +"vr1-dc0" is empty` afterwards. **Step-3.5 state survived, checked not assumed:** +`apt-mirror` still set, all six spaces still bound with both address families. + +**Measured immediately after the deploy:** juju 56 applications / 9 machines / 33 units, +machines `pending`/`allocating`; MAAS 9 `Deploying` + 1 `Deployed` (the controller). + +**Operational note, recorded because the first removal read as a failure:** `juju +remove-application` PROMPTS by default and aborts on non-interactive stdin (`ERROR +application removal: aborted`, exit 1). `--no-prompt` is required from a non-interactive +session. + +**What is NOT claimed.** `Deploy of bundle completed.` means juju ACCEPTED and QUEUED the +bundle. It does not mean the cloud is up. The settle takes hours and nothing here asserts +unit health, relation settling or any service verdict. + +**G17's dc0 half is now genuinely armable** -- the existing capture was taken on the +CONTROLLER VM and says so. The nine role nodes are booting for the first time. + +**Revert.** Not revertible as a repo change; the deploy is live cloud state. Reversing it +means `juju remove-application` per app or destroying the model, which is an operator +decision.