diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index 8968e69..23b1e65 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -1128,6 +1128,36 @@ **REVIEW OWED AT THE CLOSE OF THIS DEPLOYMENT** (same utterance) -- forward item **F4** in `docs/dc-dc-deployment-workflow.md`, whose trigger is the END OF THIS deployment, unlike F1-F3. Cheap to change by construction: a renderer input change plus a re-render. +- **RENDER-PIPELINE STEP 3 OPENED 2026-07-27 -- read-only half DONE, no live mutation yet.** + `scripts/dc-plane-ipam.sh check ` SHIPPED (harness `tests/dc-plane-ipam` **14/14**; + gauntlet **ALL GREEN (83)**, manifest re-recorded deliberately). **This is the executable gate + R4's D-134 amendment ruled and that D-134 never had** -- until now its band table lived only + as decision prose, which is why "RULED IS NOT BUILT" caught it. Expected state is DERIVED, not + hardcoded (hard rule 3): v4 planes from `lib-net.sh` via the DC selector, **v6 planes from the + NetBox APEX record** (D-136 option (D) applied -- the apex is the source, so no second + hand-maintained table), bands from the D-134 2026-07-23 amendment. + **MEASURED LIVE BASELINE, both DCs, capture `docs/audit/dc-plane-ipam-baseline-20260727.txt`: + 6 pass / 18 fail EACH, symmetric.** All six v4 planes present per DC; **ZERO of the six v6 + planes present** (three-layer confirmation of U17 now including MAAS itself -- measured 17 v4 + subnets and exactly ONE v6, which is Office1's, not a DC plane); **ZERO of the twelve D-134 + bands reserved** per DC (cloud-wide there are 3 ipranges, ALL `dynamic`, exactly as R4 + measured). **PROVEN ABLE TO BOTH FAIL AND PASS:** every live run fails because everything it + asserts is absent, so harness case T6 runs a fully-provisioned fixture to green -- a gate only + ever observed failing is as untrustworthy as one only ever observed passing. It also REFUSES + (exit 2, never "clean") on an unreachable MAAS, an unreadable apex, or a band of an + unrecognised type, and distinguishes an ABSENT `maas` binary from an unreachable MAAS -- the + misdiagnosis class this audit found three times. + **DESIGN QUESTION DELIBERATELY NOT DECIDED BY THE GATE:** the provider GUA **VIP `/64`** + (`2602:f3e2:f02:11::/64` dc0, `f03:11::/64` dc1) is REPORTED but NOT asserted as a MAAS + subnet. Rationale: it holds hacluster-managed API VIPs, not node addresses, so MAAS never + allocates from it and cannot hand one out -- unlike the v4 VIPs, which sit INSIDE the plane + `/22`s and therefore do need reserving. Whether it should also exist as a MAAS subnet is open. + **voffice1 NOW TRACKS `dc-dc-stage5-preconditions`** (was `main`): the tool is repo-carried and + runs where `maas` lives, so the branch is required there. tfstate sha256s re-verified UNCHANGED + across the switch. **Return it to `main` at merge** -- a working host left on a retired branch + is precisely the Phase-0 defect. + **NOT YET DONE, and each is an operator-gated live mutation:** the v6 carve on the 12 plane + fabrics, the band reservations, the rack-bridge v6 legs, and the apex population. - Position inside Stage 3: deploy step A EXECUTED 2026-07-19 (6/0/6 exact; convergence zero -- `docs/audit/outer-plan-20260719-postA-converged.txt`). **Deploy step B diff --git a/docs/audit/dc-plane-ipam-baseline-20260727.txt b/docs/audit/dc-plane-ipam-baseline-20260727.txt new file mode 100644 index 0000000..2d98966 --- /dev/null +++ b/docs/audit/dc-plane-ipam-baseline-20260727.txt @@ -0,0 +1,79 @@ +dc-plane-ipam check -- LIVE BASELINE, read-only, 2026-07-28T01:14:46Z +Run from voffice1 (D-128 Plane-2 host; 'maas' is ABSENT on vcloud). + +########## vr1-dc0 ########## +== dc-plane-ipam check vr1-dc0 == + apex record: netbox/draft/vr1-office1-current-20260725.json + +-- v4 planes (from lib-net) -- + [ok] v4 provider-public 10.12.4.0/22 present (fabric=vr1-dc0-provider-public) + [ok] v4 metal-admin 10.12.8.0/22 present (fabric=fabric-4) + [ok] v4 metal-internal 10.12.12.0/22 present (fabric=vr1-dc0-metal-internal) + [ok] v4 data-tenant 10.12.16.0/22 present (fabric=vr1-dc0-data-tenant) + [ok] v4 storage 10.12.32.0/22 present (fabric=vr1-dc0-storage) + [ok] v4 replication 10.12.36.0/22 present (fabric=vr1-dc0-replication) + +-- v6 planes (from the apex) -- + [FAIL] v6 data-tenant fd50:840e:74e2:230::/64 ABSENT from MAAS (R2 dual-stack is RULED; the v6 carve has not run) + [FAIL] v6 metal-admin fd50:840e:74e2:220::/64 ABSENT from MAAS (R2 dual-stack is RULED; the v6 carve has not run) + [FAIL] v6 metal-internal fd50:840e:74e2:221::/64 ABSENT from MAAS (R2 dual-stack is RULED; the v6 carve has not run) + [FAIL] v6 provider-public 2602:f3e2:f02:10::/64 ABSENT from MAAS (R2 dual-stack is RULED; the v6 carve has not run) + [note] provider-public 2602:f3e2:f02:11::/64 provider VIP block, MAAS subnet=no (not asserted) + [FAIL] v6 replication fd50:840e:74e2:250::/64 ABSENT from MAAS (R2 dual-stack is RULED; the v6 carve has not run) + [FAIL] v6 storage fd50:840e:74e2:240::/64 ABSENT from MAAS (R2 dual-stack is RULED; the v6 carve has not run) + +-- D-134 reserved bands (v4) -- + [FAIL] provider-public util band 10.12.4.4-10.12.4.49 NOT reserved (D-134 is RULED; MAAS may hand these out mid-deploy) + [FAIL] provider-public vip band 10.12.4.50-10.12.4.99 NOT reserved (D-134 is RULED; MAAS may hand these out mid-deploy) + [FAIL] metal-admin util band 10.12.8.4-10.12.8.49 NOT reserved (D-134 is RULED; MAAS may hand these out mid-deploy) + [FAIL] metal-admin vip band 10.12.8.50-10.12.8.99 NOT reserved (D-134 is RULED; MAAS may hand these out mid-deploy) + [FAIL] metal-internal util band 10.12.12.4-10.12.12.49 NOT reserved (D-134 is RULED; MAAS may hand these out mid-deploy) + [FAIL] metal-internal vip band 10.12.12.50-10.12.12.99 NOT reserved (D-134 is RULED; MAAS may hand these out mid-deploy) + [FAIL] data-tenant util band 10.12.16.4-10.12.16.49 NOT reserved (D-134 is RULED; MAAS may hand these out mid-deploy) + [FAIL] data-tenant vip band 10.12.16.50-10.12.16.99 NOT reserved (D-134 is RULED; MAAS may hand these out mid-deploy) + [FAIL] storage util band 10.12.32.4-10.12.32.49 NOT reserved (D-134 is RULED; MAAS may hand these out mid-deploy) + [FAIL] storage vip band 10.12.32.50-10.12.32.99 NOT reserved (D-134 is RULED; MAAS may hand these out mid-deploy) + [FAIL] replication util band 10.12.36.4-10.12.36.49 NOT reserved (D-134 is RULED; MAAS may hand these out mid-deploy) + [FAIL] replication vip band 10.12.36.50-10.12.36.99 NOT reserved (D-134 is RULED; MAAS may hand these out mid-deploy) + +RESULT: pass=6 fail=18 +FAIL: dc-plane-ipam check vr1-dc0 -- 18 assertion(s) failed + +########## vr1-dc1 ########## +== dc-plane-ipam check vr1-dc1 == + apex record: netbox/draft/vr1-office1-current-20260725.json + +-- v4 planes (from lib-net) -- + [ok] v4 provider-public 10.12.64.0/22 present (fabric=vr1-dc1-provider-public) + [ok] v4 metal-admin 10.12.68.0/22 present (fabric=fabric-142) + [ok] v4 metal-internal 10.12.72.0/22 present (fabric=vr1-dc1-metal-internal) + [ok] v4 data-tenant 10.12.76.0/22 present (fabric=vr1-dc1-data-tenant) + [ok] v4 storage 10.12.80.0/22 present (fabric=vr1-dc1-storage) + [ok] v4 replication 10.12.84.0/22 present (fabric=vr1-dc1-replication) + +-- v6 planes (from the apex) -- + [FAIL] v6 data-tenant fd50:840e:74e2:330::/64 ABSENT from MAAS (R2 dual-stack is RULED; the v6 carve has not run) + [FAIL] v6 metal-admin fd50:840e:74e2:320::/64 ABSENT from MAAS (R2 dual-stack is RULED; the v6 carve has not run) + [FAIL] v6 metal-internal fd50:840e:74e2:321::/64 ABSENT from MAAS (R2 dual-stack is RULED; the v6 carve has not run) + [FAIL] v6 provider-public 2602:f3e2:f03:10::/64 ABSENT from MAAS (R2 dual-stack is RULED; the v6 carve has not run) + [note] provider-public 2602:f3e2:f03:11::/64 provider VIP block, MAAS subnet=no (not asserted) + [FAIL] v6 replication fd50:840e:74e2:350::/64 ABSENT from MAAS (R2 dual-stack is RULED; the v6 carve has not run) + [FAIL] v6 storage fd50:840e:74e2:340::/64 ABSENT from MAAS (R2 dual-stack is RULED; the v6 carve has not run) + +-- D-134 reserved bands (v4) -- + [FAIL] provider-public util band 10.12.64.4-10.12.64.49 NOT reserved (D-134 is RULED; MAAS may hand these out mid-deploy) + [FAIL] provider-public vip band 10.12.64.50-10.12.64.99 NOT reserved (D-134 is RULED; MAAS may hand these out mid-deploy) + [FAIL] metal-admin util band 10.12.68.4-10.12.68.49 NOT reserved (D-134 is RULED; MAAS may hand these out mid-deploy) + [FAIL] metal-admin vip band 10.12.68.50-10.12.68.99 NOT reserved (D-134 is RULED; MAAS may hand these out mid-deploy) + [FAIL] metal-internal util band 10.12.72.4-10.12.72.49 NOT reserved (D-134 is RULED; MAAS may hand these out mid-deploy) + [FAIL] metal-internal vip band 10.12.72.50-10.12.72.99 NOT reserved (D-134 is RULED; MAAS may hand these out mid-deploy) + [FAIL] data-tenant util band 10.12.76.4-10.12.76.49 NOT reserved (D-134 is RULED; MAAS may hand these out mid-deploy) + [FAIL] data-tenant vip band 10.12.76.50-10.12.76.99 NOT reserved (D-134 is RULED; MAAS may hand these out mid-deploy) + [FAIL] storage util band 10.12.80.4-10.12.80.49 NOT reserved (D-134 is RULED; MAAS may hand these out mid-deploy) + [FAIL] storage vip band 10.12.80.50-10.12.80.99 NOT reserved (D-134 is RULED; MAAS may hand these out mid-deploy) + [FAIL] replication util band 10.12.84.4-10.12.84.49 NOT reserved (D-134 is RULED; MAAS may hand these out mid-deploy) + [FAIL] replication vip band 10.12.84.50-10.12.84.99 NOT reserved (D-134 is RULED; MAAS may hand these out mid-deploy) + +RESULT: pass=6 fail=18 +FAIL: dc-plane-ipam check vr1-dc1 -- 18 assertion(s) failed + diff --git a/tests/HARNESS-MANIFEST b/tests/HARNESS-MANIFEST index 869dc63..22b3060 100644 --- a/tests/HARNESS-MANIFEST +++ b/tests/HARNESS-MANIFEST @@ -23,6 +23,7 @@ dc-dc-whole-host-budget dc-edge-wan-import dc-mirror +dc-plane-ipam dc-rack-mgmt-import dc-rack-net dc-selector diff --git a/tests/dc-plane-ipam/run-tests.sh b/tests/dc-plane-ipam/run-tests.sh new file mode 100755 index 0000000..2e0c95e --- /dev/null +++ b/tests/dc-plane-ipam/run-tests.sh @@ -0,0 +1,145 @@ +#!/usr/bin/env bash +# tests/dc-plane-ipam/run-tests.sh -- offline harness for scripts/dc-plane-ipam.sh. +# +# Stubs the `maas` client with a fakebin returning controlled JSON, and points the +# tool at fixture apex records. Mutates nothing outside $TMP; never touches live MAAS. +# +# THE POINT OF T6: everything this gate asserts is currently ABSENT live, so every +# real run FAILS. A gate only ever observed failing is as untrustworthy as one only +# ever observed passing -- T6 proves it CAN go green on a fully-provisioned fixture, +# so a future green is meaningful rather than merely unobserved. +# Exit: 0 all pass | 1 any case failed. ASCII + LF. +set -uo pipefail +HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +REPO="$(cd "$HERE/../.." && pwd)" +TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT +PASS=0; FAIL=0 + +ok() { PASS=$((PASS+1)); printf ' PASS %s\n' "$1"; } +bad() { FAIL=$((FAIL+1)); printf ' FAIL %s\n' "$1"; shift; [ $# -gt 0 ] && printf '%s\n' "$*" | sed 's/^/ /'; } + +# ---- fixture apex record: the six dc0 plane /64s + the provider VIP /64 -------- +mkapex() { # mkapex [omit-role] + python3 - "$1" "${2:-}" <<'PY' +import json, sys +out, omit = [], sys.argv[2] +planes = [("metal-admin","fd50:840e:74e2:220::/64"),("metal-internal","fd50:840e:74e2:221::/64"), + ("data-tenant","fd50:840e:74e2:230::/64"),("storage","fd50:840e:74e2:240::/64"), + ("replication","fd50:840e:74e2:250::/64"),("provider-public","2602:f3e2:f02:10::/64")] +for role, pre in planes: + if role == omit: continue + out.append({"prefix":pre,"scope":{"name":"vr1-dc0"},"role":{"slug":role}, + "description":"VR1 DC0 %s (ULA /64 active)" % role}) +out.append({"prefix":"2602:f3e2:f02:11::/64","scope":{"name":"vr1-dc0"}, + "role":{"slug":"provider-public"},"description":"VR1 DC0 provider-public (GUA VIP /64)"}) +out.append({"prefix":"fd50:840e:74e2:220::/60","scope":{"name":"vr1-dc0"}, + "role":{"slug":"metal-admin"},"description":"parent /60 -- must be IGNORED"}) +json.dump({"ipam/prefixes": out}, open(sys.argv[1], "w")) +PY +} + +# ---- fakebin maas ------------------------------------------------------------- +# [subnets_rc] [ranges_rc] +mkmaas() { + local d="$1" v6="$2" bands="$3" src="${4:-0}" rrc="${5:-0}" + mkdir -p "$d/fakebin" + cat > "$d/fakebin/maas" <