diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index 3c8279a..d1a2926 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -2458,16 +2458,18 @@ F1). lib-hosts carries `vr1-dc1-tailscale-01` (octet 7, MAC `52:54:00:f9:d6:df`); the aux-carve reuses on dc1 once its region exists. **>>> dc1-region workstream STARTED 2026-08-07 (changelog Item 7). <<<** The `.6` region VM - (`normal-piglet`->`vr1-dc1-maas-01`, power set, recommissioned) is **Ready** in the Office1 - region (bootstrapped BY Office1, like dc0's `hot-kid`; the `.6`/`.7` had Failed commissioning on - unset-power; a transient virsh-login error cleared on retry). REMAINING (next session): (1) 2-leg - CARVE metal-admin `10.12.68.6` + provider-public `10.12.64.6` BEFORE deploy (aux-carve needs a - `-maas-01` extension + `--profile admin`; the hot-kid under-carve lesson); (2) deploy jammy; - (3) **MAAS region install/init -- OPERATOR ONE-SHOT** (verified MAAS 3.7 procedure in changelog - Item 7: `snap install maas --channel=3.7/stable` + external PostgreSQL 16 + `maas init region+rack - --database-uri ... --maas-url http://10.12.68.6:5240/MAAS` + `createadmin` with a PER-DC ssh key - fixing F2); (4) register `vr1-dc1-region`, config via the tested tools (topology/power-key/IPAM/ - DHCP/image-sync); (5) REBUILD the 9 nodes+juju+.7 FRESH into it. + (`normal-piglet`->`vr1-dc1-maas-01`) is **Deployed (jammy), power on** in the Office1 region: + power set -> recommissioned Ready -> aux-carve EXTENDED for `-maas-01` (commit `9fea7c1`) -> + carved metal-admin `10.12.68.6` + provider-public `10.12.64.6` (`--profile admin`, all 3 Office1 + racks in `--expect-rack`; `pass=6/0`) -> deployed jammy; BOTH legs live (ping `10.12.68.6` + + `10.12.64.6` 0% from the rack). The `.6`/`.7` first Failed commissioning on unset-power; transient + virsh-login/power flakes cleared on retry/re-query. **NEXT: (a) MAAS region install/init on the + `.6` -- OPERATOR ONE-SHOT** (verified MAAS 3.7 procedure, changelog Item 7: + `snap install maas --channel=3.7/stable` + external PostgreSQL 16 + `maas init region+rack + --database-uri ... --maas-url http://10.12.68.6:5240/MAAS` + `createadmin`; `createadmin`=SEC-020 + AND reaching the `.6` needs the operator's `vr1-office1-svc` key over `ssh -J + ubuntu@10.12.68.6`); (b) register `vr1-dc1-region`, config via the tested tools (topology/power- + key/IPAM/DHCP/image-sync); (c) REBUILD the 9 nodes+juju+.7 FRESH into it. F-CV1: designate _admin backend DOWN -- **RESOLVED 2026-08-06 (BUNDLEFIX-056, operator-approved fix EXECUTED + VERIFIED).** Root cause (governing = D-052 + generic binding rule + the D-020 amendment's ruled .62 triple, NOT D-141): designate's bundle bindings OMITTED public + internal, diff --git a/docs/changelog-20260807-dc0-tailscale-provisioning.md b/docs/changelog-20260807-dc0-tailscale-provisioning.md index d010798..6680a1b 100644 --- a/docs/changelog-20260807-dc0-tailscale-provisioning.md +++ b/docs/changelog-20260807-dc0-tailscale-provisioning.md @@ -211,3 +211,32 @@ REVERT: `maas admin machine release e773tq` (back to Ready is already the state) or set power_type back to unset; the substrate VM is untouched. + +## Item 8 -- aux-carve extended to the region VM; dc1 `.6` carved + deployed (LIVE, gated) + +WHAT (tooling, commit `9fea7c1`): taught the aux-carve the MAAS region VM shape. `dc-node-carve.sh` +`is_region_host` (suffix `-maas-01`) folded into `is_two_plane_host` (juju OR tailscale OR region); +`lib-hosts.sh` `REGION_HOST_SUFFIX` + `CARVE_AUX_HOSTS` gains `vr1-dc{0,1}-maas-01` (octet 6, pinned +MACs `dc:5c:0b` / `ff:5c:02`); harness `r01`/`emit_region` + T34..T35 (**63/0**; gauntlet **101**). +The region VM carves the SAME 2-plane no-br-ex shape at octet 6 -- metal-admin is its service +address (nodes reach MAAS at `:5240`), provider-public is egress for image sync. + +WHAT (live, gated): carved `vr1-dc1-maas-01` (e773tq) IN THE OFFICE1 region (`--profile admin +--expect-rack voffice1,vvr1-dc0,vvr1-dc1` -- maas-profile-assert matches the rack set EXACTLY, so +all 3 Office1 racks are named; the `.6` is Office1-bootstrapped like dc0's hot-kid). Verified the +dc1 plane subnets exist in Office1 first (metal-admin `10.12.68.0/22` gw none; provider-public +`10.12.64.0/22` gw `10.12.64.1`) so no hot-kid under-carve. 4 mutations, each read back: +enp1s0 -> STATIC `10.12.68.6` (metal-admin), enp2s0 -> VLAN 5194 + STATIC `10.12.64.6` +(provider-public). Then MAAS-deployed jammy -> **Deployed, power on**; BOTH carved legs live +(from the dc1 rack, provider-public leg `virbr4 10.12.64.2/22`: ping `10.12.68.6` AND `10.12.64.6` +0% loss). A transient MAAS `power: error` during deploy cleared on a `query-power-state` re-query +(state `on`) -- same qemu+ssh flake as the commissioning one, cosmetic. + +REMAINING (the region does NOT exist until this runs): **MAAS install/init on the `.6` is an +OPERATOR ONE-SHOT** -- both because `createadmin` sets a SEC-020 superuser AND because reaching the +`.6` (deployed with the Office1-injected `vr1-office1-svc` key, over `ssh -J ubuntu@10.12.68.6`) +needs that key. Verified MAAS 3.7 commands (Item 7). Then register `vr1-dc1-region`, config via the +tested tools, and rebuild the 9 nodes+juju+.7 fresh into it. + +REVERT: `maas admin machine release e773tq` returns it to Ready (carve persists); `git revert +9fea7c1` removes the region aux-carve (lib-hosts map keys go inert; no live effect). diff --git a/docs/session-ledger.md b/docs/session-ledger.md index 5d457a1..60f17a7 100644 --- a/docs/session-ledger.md +++ b/docs/session-ledger.md @@ -294,5 +294,5 @@ - OWNED: nearly read the prior close's "powered off" as "not enlisted" (measured `known-marten` first); the advisor caught the unverified provider-public leg (then measured both legs live) and the missing bookend; `run-logged.sh` NOT opened (O3, 2nd consecutive -- a background agent cannot drive its interactive subshell). - Gates: repo-lint 0 fail (1 legacy warn); gauntlet ALL GREEN 101 (docs-only edits since). Sweep: `docs/audit/queued-findings-20260807-dc0-tailscale-provisioning.txt` (F1-F4 FIRST SURFACE: no per-DC MAAS-region-build runbook; the vr1-office1-svc inject vs SEC-012/016; phase-3 aux-deploy DOCFIX). Body: `docs/changelog-20260807-dc0-tailscale-provisioning.md`. - POST-BOOKEND (same session): operator naming correction -> renamed dc0 known-marten->vr1-dc0-tailscale-01 + subtle-grouse->vr1-dc0-juju-01 (all 11 dc0-region names now vr1-dc0-*); recorded the standing convention as **D-134 AMENDMENT 2026-08-07** ("Record that as the preferred naming convention going forward") + lib-hosts comment. dc1 node-handling RULED "Rebuild fresh into dc1-region" (build region, then power/enlist/commission/deploy the 9 nodes+juju FRESH into it -- NOT delete+re-enlist). -- dc1-region STARTED: `.6` region VM (`normal-piglet`->`vr1-dc1-maas-01`, power set, recommissioned) is **Ready** in the Office1 region (bootstrapped by Office1 like dc0's hot-kid; transient virsh-login error cleared on retry). MAAS 3.7 install/init RESEARCHED (changelog Item 7; matches Office1 3.7.2 + PostgreSQL 16, external DB required, createadmin=SEC-020 one-shot). -- NEXT (dc1): (1) extend aux-carve for `-maas-01` + carve `.6` metal-admin 10.12.68.6 + provider-public 10.12.64.6 BEFORE deploy (hot-kid under-carve lesson); (2) deploy jammy; (3) MAAS install/init OPERATOR ONE-SHOT (researched cmds in changelog Item 7); (4) register `vr1-dc1-region` + config via tested tools; (5) REBUILD 9 nodes+juju+.7 fresh into it. Separately dc0 Step 3.3 closes on a TAGGED key + Headscale access -> `site-tailscale.sh install` -> browser login `https://10.12.8.58`. Status ONLY in CURRENT-STATE.md. +- dc1-region STARTED + `.6` region VM DONE to Deployed: `normal-piglet`->`vr1-dc1-maas-01`, power set -> recommissioned -> aux-carve EXTENDED for `-maas-01` (commit 9fea7c1, gauntlet 101) -> carved 10.12.68.6 + 10.12.64.6 (--profile admin, all 3 Office1 racks) -> **Deployed jammy, both legs live** (ping 0%). MAAS 3.7 install/init researched (changelog Items 7-8; external DB, createadmin=SEC-020). +- NEXT (dc1): (a) **MAAS region install/init on the .6 -- OPERATOR ONE-SHOT** (researched cmds, changelog Item 7; createadmin=SEC-020 + reaching the .6 needs the operator's vr1-office1-svc key over `ssh -J ubuntu@10.12.68.6`); (b) register `vr1-dc1-region` + config via tested tools; (c) REBUILD 9 nodes+juju+.7 fresh into it. Separately dc0 Step 3.3 closes on a TAGGED key + Headscale access -> `site-tailscale.sh install` -> browser login `https://10.12.8.58`. Status ONLY in CURRENT-STATE.md.