diff --git a/bundle.yaml b/bundle.yaml index d4cc719..0bee152 100644 --- a/bundle.yaml +++ b/bundle.yaml @@ -478,14 +478,20 @@ num_units: 3 to: [lxd:0, lxd:1, lxd:2] bindings: - # D-052 AMENDMENT 2026-08-03: default '' on metal-internal, NOT metal-admin. ovn-central - # resolves its internal/admin/public cert addresses via the DEFAULT binding; on metal-admin - # in this multi-space model it finds no address, skips the server-cert request, and never - # gets a server cert (charm-ovn-central LP #2044324, multi-space-specific) -- so its TLS - # OVSDB never starts and the OVN NB/SB cluster never forms. Its certificates+ovsdb* already - # bind metal-internal; putting the default there makes cert resolution single-space (the - # proven pre-D-052 shape). D-052 isolation is unchanged for every other app. - '': metal-internal + # D-052 RE-AMENDMENT 2026-08-05: default '' RESTORED to metal-admin (reverts the + # 2026-08-03 '' -> metal-internal amendment). MEASURED refutation: the '' default is the + # MANAGEMENT binding (a unit's primary NIC + juju agent <-> controller path) -- every one + # of the 56 apps binds '' to metal-admin. Moving ovn-central's '' to the ISOLATED + # metal-internal plane left its containers single-legged on 10.12.12.x with no route to the + # controller (10.12.8.5:17070 UNREACHABLE), so the agent-binary download failed and + # ovn-central could never come up (first deployed 2026-08-04; never worked). The 08-03 + # amendment's cert rationale was ALSO refuted: the rebind never issued a server cert (its + # own clarification admits this). The real cert cause is get_hostname() reverse-DNS on the + # isolated plane, now fixed independently of binding by scripts/dc-node-etchosts.sh (the + # postruncmd /etc/hosts entry, phase-01 Step 1.2b). ovn-central's FUNCTIONAL endpoints stay + # metal-internal (its data IS a metal-internal service); only the management default moves. + # See docs/network-space-binding-reference.md and D-052 RE-AMENDMENT 2026-08-05. + '': metal-admin certificates: metal-internal coordinator: metal-internal ovsdb: metal-internal diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index b9a2352..6fb914b 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -2225,6 +2225,27 @@ phase-02 vault init (operator-only), converge.** QUEUED (operator, needs a ruling before execution): Tailscale on DC0/DC1 -- intersects D-107 / D-128 / the 08-02 "VPN deferred to Roosevelt" ruling. + **>>> 2026-08-05 -- D-052 RE-AMENDED (GA-R5): ovn-central `""` default metal-internal -> + metal-admin. Stage 5 remains OPEN. <<<** The verify-at-provision gate caught that the 08-03 + D-052 amendment (`""` -> metal-internal, commit 53e046e, NEVER deployed until 08-04) left all + 3 ovn-central containers single-legged on the ISOLATED metal-internal plane with no route to + the controller (10.12.8.5:17070 UNREACHABLE) -> agent-binary download failed -> ovn-central + could never start. Root: the `""` default is the MANAGEMENT binding (primary NIC + agent<-> + controller), universal `""`=metal-admin across all 56 apps; ovn-central was the sole outlier. + The amendment's cert rationale was already withdrawn (rebind never issued a cert); the cert CN + is fixed independently by the `/etc/hosts` postruncmd (dc-node-etchosts.sh, Step 1.2b). + **Operator ruling, exact utterance: "Once that is done then move on to the proposed move to + metal-admin"** -- after a full-board binding/dataflow audit of all 56 apps + 6 planes (operator- + directed). DELIVERED: `docs/network-space-binding-reference.md` (NEW reference matrix + + placement justification); `bundle.yaml` ovn-central `""` -> metal-admin (functional endpoints + stay metal-internal); D-052 RE-AMENDMENT 2026-08-05 recorded. **NEXT: re-stage bundle to rack, + apply to the live model (re-home ovn-central), then resume: verify /etc/hosts on ovn-central -> + vault init (operator-only) -> ovn cert issues -> converge.** The pre-vault-init settle + (phase-02-vault-preflight PROCEED) was reached 2026-08-04 but vault init is HELD until + ovn-central is re-homed. Audit note: one converge incident en route -- mysql-innodb-cluster/1 + wedged on the 08-03 apt-cacher-ng hang class; remediated (proxy restart + remove/re-add as + mysql/3). Full record: `docs/audit/stage5-dc0-redeploy-asexec-20260804.txt`, + `docs/changelog-20260804-stage5-dc0-redeploy.md`. **>>> SESSION CLOSE 2026-08-03 (GA-R4 bookend). Stage 5 remains OPEN; this is a session bookend, NOT a stage close. <<<** DEPLOY IS MID-STAGE-5: bundle deployed + mostly converged (9 machines started, mysql ONLINE, vault init+unseal+root-CA, ~25 units active, 0 error), diff --git a/docs/audit/stage5-dc0-redeploy-asexec-20260804.txt b/docs/audit/stage5-dc0-redeploy-asexec-20260804.txt index b2e37db..bae06e7 100644 --- a/docs/audit/stage5-dc0-redeploy-asexec-20260804.txt +++ b/docs/audit/stage5-dc0-redeploy-asexec-20260804.txt @@ -144,4 +144,71 @@ 9 machines "0"-"8", every machine tags=openstack-vr1-dc0, (3 control/2 compute/4 storage); ceph-osd->5-8, nova-compute->3-4; no overlay error; rc=0. GATE PASS. -## (below appended as each further mutation executes -- NEXT: Step 4.3 deploy, operator-gated) +## Step 4.3 -- the real deploy [MUTATION, GA-R5 operator-ruled 2026-08-04] +Operator ruling (verbatim selection): "Proceed with the deploy". +[2026-08-04] vr1-dc0-rack :: + cd ~/repo-stage && juju deploy ./bundle.yaml \ + --overlay overlays/vr1-dc0-vips.yaml --overlay overlays/vr1-dc0-machines.yaml \ + --overlay overlays/vr1-dc0-octavia-pki.yaml -m vr1-dc0 + -> "Deploy of bundle completed." rc=0. 9 machines + ~24 containers/units added. + ovn-central 0/lxd/15, 1/lxd/3, 2/lxd/3 (will provision WITH the postruncmd /etc/hosts fix). +REVERT: juju destroy-model vr1-dc0 (Path M). + +## Step 4.4 -- merged-config gate (read-only, run immediately) GATE PASS + ovn-chassis all THREE options present (source=user): bridge-interface-mappings= + 'br-ex:52:54:00:8c:2a:8c br-ex:52:54:00:50:48:88', ovn-bridge-mappings='physnet1:br-ex', + prefer-chassis-as-gw=True -- juju merged the options map key-by-key correctly. + openstack-origin/source: all set, none UNSET (mix of cloud:jammy-caracal + caracal, + matching the prior converged deploy / same bundle sha -- observation, not a defect). + First execution of this gate ran clean (no shape correction needed). + +## CONVERGE INCIDENT -- mysql-innodb-cluster/1 wedged (08-03 apt recurrence) [operator-ruled] +SYMPTOM: mysql/1 (container 1/lxd/2) stuck agent=allocating "waiting for machine" ~90min. + cloud-init blocked since 20:24:54 on `eatmydata apt-get update` (capture=False) that + infinitely retried a hanging index (jammy-backports InRelease via the proxy) and never + completed -> jujud never installed (/var/lib/juju/tools empty). The 08-03 apt-wedge class; + appendix-A has NO entry for it (DOC GAP owed -- fold the symptom+fix into appendix-A). +REMEDY 1 (operator ruling: "Restart apt-cacher-ng proxy first") [MUTATION]: + vr1-dc0-rack :: sudo systemctl restart apt-cacher-ng -> active, :3142. Proxy PROVEN + healthy after (curl -x proxy jammy-backports InRelease = 200 in ~1s). But the container's + apt stayed independently wedged (stale looping process); restart alone did not clear it. +REMEDY 2 (operator ruling: "Remove + re-add the unit") [MUTATION]: + vr1-dc0-rack :: juju remove-unit mysql-innodb-cluster/1 --force --no-prompt -> rc=0 + (--force: agent never came up, no hooks to run; unit never joined the cluster). + Verified: /1 gone, container 1/lxd/2 GONE. + vr1-dc0-rack :: juju add-unit mysql-innodb-cluster -n 1 --to lxd:1 -> rc=0 + -> mysql-innodb-cluster/3 on fresh container 1/lxd/4 (provisioning against the healthy proxy). +REVERT: n/a (converge remediation; the fresh unit replaces the wedged one). + +## >>> MAJOR FINDING (verify-at-provision gate CAUGHT IT): the D-052 amendment binding +## (53e046e) makes ovn-central UNREACHABLE from the controller. NEVER DEPLOYED BEFORE. <<< +MEASURED: all 3 ovn-central containers have a SINGLE leg on the ISOLATED metal-internal + plane (/0=10.12.12.106, /1=10.12.12.3, /2=10.12.12.1), NO default route, NO metal-admin + leg. -> cannot reach the controller (10.12.8.5/10.12.4.5 :17070 UNREACHABLE) -> "download + agent binaries" retries forever (attempt 547+) -> jujud installed but agent stuck + allocating -> ovn-central can NEVER come up. mysql containers have TWO legs (metal-admin + + metal-internal); ovn-central got metal-internal ONLY because the bundle binds EVERY + ovn-central endpoint incl the DEFAULT '' to metal-internal. +ROOT: commit 53e046e (2026-08-03 20:49) "apply ovn-central default -> metal-internal": + '': metal-admin -> '': metal-internal. juju uses the DEFAULT binding for the machine's + controller/management connection, so moving it to the isolated plane cut controller reach. + This amendment was NEVER DEPLOYED: the 08-03 deploy PREDATED it (its ovn-central units were + idle/up, degraded on cert only -- which REQUIRES controller reachability, impossible on a + metal-internal-only leg). This fresh deploy is its first exposure; it fails. +CROSS-CUT: the 08-04 /etc/hosts postruncmd fix (this session, PROVEN logic -- manual + WOULD-ADD test) makes get_hostname resolve INDEPENDENTLY of the binding. So the amendment's + stated purpose (single-space cert-CN resolution) is now covered by a different mechanism, + and the amendment's remaining effect is purely harmful (unreachable ovn-central). + => This is a RULED-BUT-NOT-BUILT amendment whose deciding reason is refuted by measurement + (the D-139 shape). Needs a GA-R5 D-052 RE-AMENDMENT ruling. HOLD vault init until ruled + (settle gate PROCEED is true-but-irrelevant: it never checks ovn-central). +LOGGED (not fixed, hard rule 1): (a) do NOT edit bundle bindings mid-step -- present options; + (b) the postruncmd mechanism is STRUCTURALLY FRAGILE -- it runs at the END of juju's runcmd, + so ANY earlier blocker (apt wedge, agent-binary retry) prevents the /etc/hosts entry from + ever being written. Delivery is gated behind juju's entire runcmd completing. Record in the + changelog/appendix-A regardless of the binding ruling. +Model state PRESERVED (converged-but-ovn-blocked) for whichever way the operator rules. + +## NEXT (pending): converge to pre-vault-init -> verify /etc/hosts on an ovn-central unit +## (delivery proof) -> phase-02 Step 2.1 vault init (OPERATOR-ONLY one-shot) -> ovn cert +## issues -> converge. (below appended as each further mutation executes) diff --git a/docs/design-decisions.md b/docs/design-decisions.md index 89c2335..76ab1ab 100644 --- a/docs/design-decisions.md +++ b/docs/design-decisions.md @@ -914,6 +914,43 @@ separate charm/interface defect (LP #2044324, server-cert request/response) and is tracked as its own item. The binding is retained because it is the right categorization, not as a cert fix. +### RE-AMENDMENT 2026-08-05 -- ovn-central `""` default REVERTED to metal-admin (SUPERSEDES the 2026-08-03 `""` change) + +**Operator ruling, exact utterance: "Once that is done then move on to the proposed move to +metal-admin."** (Ruled after a full-board binding/dataflow audit of all 56 apps + all 6 planes, +which the operator directed and reviewed; the reference is now `docs/network-space-binding-reference.md`.) +The "proposed move" is: ovn-central `"": metal-internal` -> `"": metal-admin`; its functional +endpoints (`certificates`, `ovsdb*`, `coordinator`) STAY metal-internal. + +**Why the 2026-08-03 amendment's `""` change is REVERSED (measured refutation -- the D-139 +ruling-note shape):** the 2026-08-03 amendment moved `""` to metal-internal on TWO stated +grounds, both now refuted: +1. **The cert-fix ground** was already withdrawn in the CLARIFICATION above (the rebind never + issued a server cert). The real cert cause is `get_hostname()` reverse-DNS failing on the + ISOLATED metal-internal plane, fixed INDEPENDENTLY OF BINDING by the `/etc/hosts` postruncmd + (`scripts/dc-node-etchosts.sh`, phase-01 Step 1.2b, PROVEN 2026-08-04). +2. **The "right categorization" ground is WRONG about what the `""` default IS.** The `""` + default is not a service-category tag; it is the **management binding** -- a unit's primary + NIC and its juju agent <-> controller path. MEASURED 2026-08-04 (the amendment's FIRST real + deploy): with `"": metal-internal`, all three ovn-central containers came up single-legged on + 10.12.12.x (the isolated plane), with NO route to the controller (`10.12.8.5:17070` + UNREACHABLE), so the agent-binary download failed (`Attempt 547 ...`) and ovn-central could + NEVER start. **ovn-central is the ONLY app of 56 without a metal-admin leg**; every other + service -- including pure-storage (ceph-osd) and pure-DB (mysql-innodb-cluster) services -- + keeps `"": metal-admin` and rides its data plane via EXPLICIT endpoint bindings. ovn-central's + data IS a metal-internal service (its 6 functional endpoints stay there); its MANAGEMENT + belongs on metal-admin like everyone else's. + +**SCOPE.** Reverts ONLY ovn-central's `""` default. Every other D-052 binding is unchanged and +was re-verified correct against dataflow in the 2026-08-05 audit (the only ruled exceptions are +D-072 dashboard:cluster and D-106 designate:dnsaas). **Roosevelt delta corrected:** the per-DC +template binds ovn-central `"": metal-admin` (universal) with functional endpoints on +metal-internal; the cert-CN fix is the `/etc/hosts` mechanism, not a management-binding move. + +**Delivery:** bundle.yaml ovn-central binding block updated this ruling; re-staged to the DC +rack; applied to the live vr1-dc0 model (ovn-central re-homed). Reference + rationale: +`docs/network-space-binding-reference.md`. + ## D-053 -- Rename network space `fabric-data` -> `data-tenant` (2026-06-25) **Status:** ADOPTED. Naming-only change to the D-052 plane set; no architectural change. diff --git a/docs/network-space-binding-reference.md b/docs/network-space-binding-reference.md new file mode 100644 index 0000000..38ee24a --- /dev/null +++ b/docs/network-space-binding-reference.md @@ -0,0 +1,185 @@ +# Network-space binding & placement reference (VR1 per-DC) + +**Purpose.** A grounded, cross-checkable reference for the six network planes, what each +carries, and where every application's Juju bindings land -- so a future session can VERIFY a +binding against intent without re-researching or re-engineering it. Built 2026-08-05 from the +live bundle + relation topology + the 2026-08-03 plane-purpose sweep, verified against dataflow. + +**Authority.** This is a DERIVED reference, not a new authority. The governing decision is +**D-052** (`docs/design-decisions.md`) and its amendments; plane CIDRs come from +`scripts/lib-net.sh`; deviations are ruled in their own D-NNN. Where this doc and D-052 ever +disagree, D-052 wins and this doc is corrected. Regenerate the matrix from `bundle.yaml` when +bindings change (the generator is trivial: invert `applications[*].bindings` by space). + +--- + +## 1. The six planes + +CIDRs are per-DC (dc0 / dc1). metal-admin and metal-internal are the two "metal" planes that +split the legacy single `metal` space (D-052). + +| Plane | dc0 CIDR | dc1 CIDR | Encap | Routes? | Role | RHOSP analog | +|---|---|---|---|---|---|---| +| **provider-public** | 10.12.4.0/22 | 10.12.64.0/22 | untagged | **YES** (edge `.1`) | Public API VIPs + floating IPs | External | +| **metal-admin** | 10.12.8.0/22 | 10.12.68.0/22 | untagged | no (flat L2; **controller lives here**) | Management/OAM: MAAS/PXE, **juju agent<->controller**, operator, monitoring, admin API, and the **`''` default of every app**. DC-LOCAL | Management + Provisioning | +| **metal-internal** | 10.12.12.0/22 | 10.12.72.0/22 | tagged VLAN | no (**isolated**, D-125) | All service-to-service control: internal API, shared-db, amqp, certificates/secrets, cache, cluster peers, `ovsdb*`, identity. **MAY cross DC fiber** | Internal API | +| **data-tenant** | 10.12.16.0/22 | 10.12.76.0/22 | tagged | no | Tenant **geneve overlay** | Tenant | +| **storage** | 10.12.32.0/22 | 10.12.80.0/22 | tagged | no | **Ceph public** (RBD client <-> mon/OSD) | Storage | +| **replication** | 10.12.36.0/22 | 10.12.84.0/22 | tagged | no | **Ceph OSD cluster** replication + RBD mirror | Storage-Management | + +**Reachability mechanics (why the `''` default matters):** metal-admin does **not** route in VR1 +(the `.1` gateway was removed 2026-07-29). Nodes reach the juju controller (`.5` on metal-admin) +by **L2 adjacency** on the flat /22. A unit with **no metal-admin leg cannot reach the +controller at all** -- it cannot download agent binaries and its agent never starts. This is the +single most important operational fact behind the binding rules below. + +--- + +## 2. The binding rule (the one that governs everything) + +> **Every app binds `'': metal-admin` (its management leg), and binds each explicit endpoint to +> the plane matching that endpoint's TRAFFIC TYPE.** + +The Juju `''` (default) binding has dual significance: (a) the fallback space for any unbound +endpoint, **and (b) the unit's primary NIC -- its `private-address` and its path to the +controller.** It is the MANAGEMENT binding, not a "what kind of service is this" tag. A pure +storage service (ceph-osd) still binds `'': metal-admin`; a pure DB service +(mysql-innodb-cluster) still binds `'': metal-admin`. Their *data* rides storage / metal-internal +via EXPLICIT endpoint bindings; their *management* stays on metal-admin. **Binding `''` to an +isolated data plane strips the management leg** -- this is exactly the ovn-central regression that +the 2026-08-03 amendment introduced and the 2026-08-05 re-amendment reverted (Section 5). + +Endpoint -> plane, by traffic type: + +| Traffic type | Plane | Example endpoints | +|---|---|---| +| Public API / FIPs | provider-public | `:public`, `designate:dnsaas` (DNS-native VIP) | +| Internal API, shared-db, amqp, certificates, identity, cache, HA/cluster peers, `ovsdb*` | metal-internal | `:shared-db`, `:amqp`, `:certificates`, `:identity-service`, `:ha`, `:ovsdb*` | +| Ceph client + mon + ceph control | storage | `:ceph`, `ceph-mon:{client,osd,mon,radosgw,...}`, `ceph-osd:public` | +| Ceph OSD replication + RBD mirror | replication | `ceph-osd:cluster`, `ceph-mon:cluster`, `ceph-rbd-mirror:{ceph-local,ceph-remote}` | +| Tenant geneve overlay | data-tenant | `nova-compute:neutron-plugin`, `ovn-chassis:data`, `ovn-chassis-octavia:data`, `octavia:ovsdb-cms` | +| Management/OAM (fallback) | metal-admin | `''` default (all apps) | + +--- + +## 3. Per-app binding matrix (56 apps) + +Cell = count of that app's endpoints on the plane (blank = 0). `''` default is called out +separately -- it is **metal-admin for all 56 apps** (the rule in Section 2). Generated from +`bundle.yaml`. + +| App | `''` default | prov-pub | m-internal | storage | repl | data | m-admin (non-default) | +|---|---|---|---|---|---|---|---| +| barbican | **metal-admin** | 1 | 8 | | | | | +| barbican-hacluster | **metal-admin** | | 4 | | | | | +| barbican-mysql-router | **metal-admin** | | 3 | | | | | +| barbican-vault | **metal-admin** | | 3 | | | | | +| ceph-mon | **metal-admin** | | | 7 | 2 | | | +| ceph-osd | **metal-admin** | | 1 | 2 | 1 | | | +| ceph-radosgw | **metal-admin** | 1 | 9 | 1 | | | | +| ceph-radosgw-hacluster | **metal-admin** | | 4 | | | | | +| ceph-rbd-mirror | **metal-admin** | | 1 | | 2 | | | +| cinder | **metal-admin** | 1 | 12 | 1 | | | | +| cinder-backup | **metal-admin** | | | 1 | | | | +| cinder-ceph | **metal-admin** | | 1 | 2 | | | | +| cinder-hacluster | **metal-admin** | | 4 | | | | | +| cinder-mysql-router | **metal-admin** | | 3 | | | | | +| dashboard-mysql-router | **metal-admin** | | 3 | | | | | +| designate | **metal-admin** | 1 | 6 | | | | | +| designate-bind | **metal-admin** | | 1 | | | | | +| designate-hacluster | **metal-admin** | | 4 | | | | | +| designate-mysql-router | **metal-admin** | | 3 | | | | | +| glance | **metal-admin** | 1 | 11 | 1 | | | | +| glance-hacluster | **metal-admin** | | 4 | | | | | +| glance-mysql-router | **metal-admin** | | 3 | | | | | +| glance-simplestreams-sync | **metal-admin** | | 4 | | | | | +| keystone | **metal-admin** | 1 | 13 | | | | | +| keystone-hacluster | **metal-admin** | | 4 | | | | | +| keystone-mysql-router | **metal-admin** | | 3 | | | | | +| magnum | **metal-admin** | 1 | 7 | | | | | +| magnum-dashboard | **metal-admin** | | 1 | | | | | +| magnum-hacluster | **metal-admin** | | 4 | | | | | +| magnum-mysql-router | **metal-admin** | | 3 | | | | | +| memcached | **metal-admin** | | 2 | | | | | +| mysql-innodb-cluster | **metal-admin** | | 5 | | | | | +| ncc-mysql-router | **metal-admin** | | 3 | | | | | +| neutron-api | **metal-admin** | 1 | 10 | | | | | +| neutron-api-hacluster | **metal-admin** | | 4 | | | | | +| neutron-api-mysql-router | **metal-admin** | | 3 | | | | | +| neutron-api-plugin-ovn | **metal-admin** | | 3 | | | | | +| nova-cloud-controller | **metal-admin** | 1 | 18 | | | | | +| nova-cloud-controller-hacluster | **metal-admin** | | 4 | | | | | +| nova-compute | **metal-admin** | | 9 | 2 | | 1 | | +| octavia | **metal-admin** | 1 | 10 | | | 1 | | +| octavia-dashboard | **metal-admin** | | 2 | | | | | +| octavia-diskimage-retrofit | **metal-admin** | | 2 | | | | | +| octavia-hacluster | **metal-admin** | | 4 | | | | | +| octavia-mysql-router | **metal-admin** | | 3 | | | | | +| openstack-dashboard | **metal-admin** | 1 | 10 | | | | 1 | +| openstack-dashboard-hacluster | **metal-admin** | | 4 | | | | | +| ovn-central | **metal-admin** | | 6 | | | | | +| ovn-chassis | **metal-admin** | | 4 | | | 1 | | +| ovn-chassis-octavia | **metal-admin** | | 4 | | | 1 | | +| placement | **metal-admin** | 1 | 8 | | | | | +| placement-hacluster | **metal-admin** | | 4 | | | | | +| placement-mysql-router | **metal-admin** | | 3 | | | | | +| rabbitmq-server | **metal-admin** | | 4 | | | | | +| vault | **metal-admin** | | 7 | | | | | +| vault-mysql-router | **metal-admin** | | 3 | | | | | + +--- + +## 4. Dataflow confirmation (108 relations, spot-verified) + +Every relation's plane is consistent with its endpoints' traffic type: +- **Service-to-service -> metal-internal:** all `:certificates <-> vault:certificates`, all + `:shared-db <-> *-mysql-router`, all `:amqp <-> rabbitmq-server`, all + `:identity-service <-> keystone`, all `:ha <-> *-hacluster`. +- **Ceph client -> storage; OSD replication -> replication:** + `cinder-ceph/nova-compute/glance:ceph <-> ceph-mon:client` (storage); `ceph-osd:cluster`, + `ceph-rbd-mirror:ceph-local <-> ceph-mon:rbd-mirror` (replication). +- **Overlay -> data-tenant:** `ovn-chassis:ovsdb <-> ovn-central:ovsdb` control on metal-internal; + the geneve `data` legs on data-tenant. +- **Public -> provider-public:** only the `:public` / `designate:dnsaas` VIPs. + +--- + +## 5. Ruled exceptions & their governing decisions + +Do NOT "correct" these against the generic rule -- each is a ruled fix. (CLAUDE.md: grep the +governing D-NNN before touching a built binding. The 2026-08-03 sweep flagged #1 as a deviation +and had to self-correct -- the lesson is baked in here.) + +| Binding | Looks like | Actually | Governing | +|---|---|---|---| +| `openstack-dashboard cluster: metal-admin` | should be metal-internal | horizon renders haproxy's 443 backend on the cluster address but only makes apache SSL vhosts for default+public -> cluster on metal-internal = **dashboard HTTPS VIP dead** | **D-072 / BUNDLEFIX-011** | +| `designate dnsaas: provider-public` | svc-to-svc? | designate's **public DNS-native VIP** (dual-VIP pattern), a public-facing endpoint | **D-106** | +| `octavia ovsdb-cms: data-tenant` | mis-placed | D-052 lists it under data-tenant; endpoint is **inert** (octavia reaches OVN via the chassis subordinate) | **D-052** | +| `ceph-radosgw public/object-store/cluster` | Ceph nets? | radosgw is a **gateway**: `public`=S3/Swift API, `object-store`=svc API, `cluster`=radosgw HA -- none are Ceph OSD/public networks | **D-052** | +| `ovn-central '': metal-admin` | (see below) | **RE-AMENDMENT 2026-08-05** -- reverts the 08-03 `'' -> metal-internal` which cut controller reachability; cert CN now handled by `dc-node-etchosts.sh` | **D-052 re-amendment** | + +**The ovn-central story (the reference case for "management leg != service category"):** the +2026-08-03 amendment moved ovn-central's `''` to metal-internal to fix a cert-resolution bug +(LP #2044324). It never fixed the cert (its own clarification admits this), and when first +deployed (2026-08-04) it left all three ovn-central containers single-legged on the isolated +metal-internal plane, unable to reach the controller -> agent never started. The 2026-08-05 +re-amendment restores `'': metal-admin` (the universal pattern); ovn-central's functional +endpoints (`certificates`, `ovsdb*`) stay metal-internal (its data IS a metal-internal service); +the cert CN is fixed independently by the `/etc/hosts` postruncmd (`scripts/dc-node-etchosts.sh`, +phase-01 Step 1.2b). See D-052 RE-AMENDMENT 2026-08-05 and `docs/CURRENT-STATE.md`. + +--- + +## 6. Cross-references + +- **D-052** (+ 2026-08-03 amendment, 2026-08-05 re-amendment) -- the governing decision. +- **D-072 / BUNDLEFIX-011** -- dashboard cluster:metal-admin exception. +- **D-106** -- designate reactivation (dnsaas dual-VIP). +- **D-125** -- metal-internal egress isolation. +- `scripts/lib-net.sh` -- plane CIDRs / names (per-DC). +- `docs/audit/binding-plane-purpose-sweep-20260803.txt` -- the full 446-endpoint classification. +- `scripts/dc-node-etchosts.sh` + `tests/dc-node-etchosts` -- the ovn-central cert-CN fix. + +**Roosevelt deltas (from D-052):** dedicated redundant corosync ring (heartbeat off the service +plane); dedicated live-migration plane + QEMU-native TLS; revisit whether cross-DC +service-to-service on metal-internal warrants its own inter-DC plane.