diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index b6a0e5b..ecc7bbc 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -2400,14 +2400,19 @@ at Step 7) -> installed `python3-openstackclient 6.6.0-0ubuntu2` on the rack (see section 7 row). **EXIT GATE OPEN on (a) F-CV3: dashboard VIP 10.12.4.58:443 serves PLAINTEXT (apache-SSL-inactive despite certs present) -- Horizon exit-gate FAILS; and (b) Step 3.4 domain-manager policy NOT RUN. - F-CV1: designate _admin backend DOWN, root cause CONFIRMED = a BIND-PLANE MISMATCH (apache - https frontend binds metal-admin 10.12.8.198:8991 only; haproxy's admin backend dials - metal-internal 10.12.12.110:8991 where no SSL vhost exists) -- VR1 dual-metal-plane specific - (D-141); the earlier "collateral of the block" reading is RETRACTED.** F-CV1 and F-CV3 are TWO - SEPARATE findings (designate = wrong-plane bind; dashboard = charm https frontend not effective, - root cause NOT nailed), both charm-TLS-frontend layer (certs ARE present -- not the ovn - CN-issuance class). LOGGED, not fixed (hard rule 1); triage authorized by operator 2026-08-06; - remediation is a focused GATED session. Sweep: docs/audit/queued-findings-20260806-phase03-coreverify.txt. + F-CV1: designate _admin backend DOWN (apache https frontend binds metal-admin 10.12.8.198:8991 + only; haproxy's admin backend dials metal-internal 10.12.12.110:8991 where no SSL vhost exists). + ROOT CAUSE researched 2026-08-06 (governing = D-052 + the generic binding rule, NOT D-141 -- + attribution corrected): designate's endpoint bindings deviate from every sibling API app. + `:internal`->metal-internal is a CONFIRMED DEFECT (on the `''` metal-admin fallback; no ruled + exception; cert already covers the metal-internal SANs; all 3 units have metal-internal addrs). + `:public`->provider-public is OPEN pending an operator RULING (designate uniquely carries + `:dnsaas` on provider-public per the D-106 dual-VIP -- its REST API may be intentionally + metal-admin-only). The earlier "collateral of the block" reading is RETRACTED.** F-CV1 and + F-CV3 are TWO SEPARATE findings (dashboard = charm https frontend not effective, NOT a binding + issue -- its bindings are correct; needs its own triage). Fix method = D-072 precedent + (bundle + live juju bind + haproxy-readback verify). LOGGED, not fixed (hard rule 1); triage + authorized 2026-08-06. Sweep: docs/audit/queued-findings-20260806-phase03-coreverify.txt. **NAMED-GATE DEFECT found by measurement -- `phase-03-core-verify.md` Step 3.1 asserts expected non-active/idle = 1 (octavia only); the VR1 roster yields 4 deferred-by-design + gss.** That gate is STALE for VR1 and a DOCFIX is owed (also owed on that runbook: `-m openstack` -> `-m vr1-dc0` diff --git a/docs/audit/queued-findings-20260806-phase03-coreverify.txt b/docs/audit/queued-findings-20260806-phase03-coreverify.txt index 0ab44b7..db4de8b 100644 --- a/docs/audit/queued-findings-20260806-phase03-coreverify.txt +++ b/docs/audit/queued-findings-20260806-phase03-coreverify.txt @@ -7,14 +7,22 @@ --- FINDINGS (logged, NOT fixed -- hard rule 1; operator authorized triage 2026-08-06) --- -F-CV1 [CONFIRMED root cause] designate _admin haproxy backend DOWN. - designate/0 apache https frontend binds ONLY 10.12.8.198:8991 (metal-admin); haproxy's - `designate-api_admin_10.12.12.110` backend dials designate-0 at 10.12.12.110:8991 - (METAL-INTERNAL), where apache has no SSL vhost -> check-ssl hits plaintext -> DOWN. - BIND-PLANE MISMATCH, VR1 dual-metal-plane specific (D-141 .8 metal-admin vs .12 metal-internal). - NOT Stage-7 collateral (structural). Fix (focused session, GATED): align the admin-interface - plane -- charm binds metal-internal too, OR haproxy admin backend dials metal-admin; correct - plane is a D-141/B1 question. Re-run haproxy sweep after. +F-CV1 designate _admin haproxy backend DOWN. designate/0 apache https frontend binds ONLY + 10.12.8.198:8991 (metal-admin); haproxy's `designate-api_admin_10.12.12.110` backend dials + 10.12.12.110:8991 (METAL-INTERNAL) where apache has no SSL vhost -> check-ssl -> DOWN. + ROOT CAUSE (researched 2026-08-06, governing = D-052 + the generic binding rule; NOT D-141): + designate's endpoint bindings deviate from every sibling API app. + - `:internal` -> metal-internal = CONFIRMED DEFECT (sits on the `''` metal-admin FALLBACK; + every sibling binds internal->metal-internal; no ruled exception). designate has a + metal-internal VIP 10.12.12.62 and its cert ALREADY carries the metal-internal SANs, but + no apache vhost there. FIX (gated, bundle+live per D-072): add `internal: metal-internal` + to bundle.yaml + `juju bind designate internal=metal-internal`; verify haproxy readback + + https-200 + re-read cert SANs. All 3 units have metal-internal addrs (no --force needed). + - `:public` -> provider-public = OPEN, needs operator RULING. designate uniquely has + prov-pub=1 = `:dnsaas` (D-106 dual-VIP), not `:public`; cert doesn't cover provider-public. + May be intentional (tenants consume DNS, not the designate REST API). DO NOT assume. + Section-4 table (network-space-binding-reference.md:88) is "Generated from bundle.yaml" + (descriptive of the defect), not intent. designate is Stage-7-blocked -> no urgency. F-CV3 [root cause NOT nailed] dashboard VIP 10.12.4.58:443 serves PLAINTEXT (Horizon exit-gate FAILS). Certs present under /etc/apache2/ssl/horizon/; apache :433 served by Ubuntu diff --git a/docs/audit/stage5-dc0-phase03-coreverify-20260806.txt b/docs/audit/stage5-dc0-phase03-coreverify-20260806.txt index 48ee27a..8dc8855 100644 --- a/docs/audit/stage5-dc0-phase03-coreverify-20260806.txt +++ b/docs/audit/stage5-dc0-phase03-coreverify-20260806.txt @@ -219,6 +219,42 @@ backend served by Ubuntu default-ssl.conf, charm https frontend not effective (different question, no one-command discriminator, left as recorded). Do NOT chase a common fix. +## RECONCILIATION 2026-08-06 (after prior-art + governing-decision research; advisor-directed) +Two CORRECTIONS to the F-CV1 framing above -- the earlier commits (aaeee93, CURRENT-STATE) +called it "CONFIRMED bind-plane mismatch (D-141)" BEFORE checking the governing decisions; +that ordering was backwards (memory #17). The check does not overturn the finding but +RESCOPES it and RE-ATTRIBUTES it: + (1) ATTRIBUTION: NOT D-141 (that is dual-stack IPAM). The governing surface is D-052 + (binding topology) + the generic rule in docs/network-space-binding-reference.md + Section 2/3: `''` default = metal-admin (OAM/mgmt FALLBACK, line 61); `:public` -> + provider-public; internal API -> metal-internal. + (2) SCOPE: split into a CONFIRMED half and an OPEN half: + - `:internal` -> metal-internal is a CONFIRMED DEFECT. Every sibling API app binds + `:internal` to metal-internal (glance m-internal=11, keystone=13, ...); designate's + sits on the metal-admin FALLBACK (an omission, not a choice). designate HAS a + metal-internal VIP (10.12.12.62) and its cert ALREADY carries the metal-internal SANs + (10.12.12.110 + .62), but apache builds an SSL vhost only on metal-admin -> haproxy's + _admin backend at 10.12.12.110 hits no vhost -> DOWN. No ruled exception covers it. + - `:public` -> provider-public is OPEN (operator ruling needed). designate uniquely has + prov-pub=1 = `:dnsaas` (the D-106 dual-VIP exception, ruled), NOT `:public`. The + exceptions table (line 156) frames dnsaas as designate's public-facing surface, which + is consistent with an intent that designate's REST API is metal-admin-only and tenants + consume DNS not the API. The cert does NOT cover provider-public. So moving `:public` + may be right or may be against design -- ASK, do not assume glance's pattern. + (3) The Section-4 per-app table (line 88) is "Generated from bundle.yaml" (line 68) -- + DESCRIPTIVE of the current (defective) bundle, NOT prescriptive intent. It is not + evidence that designate's bindings are as-designed. +BLOCKING CHECKS FOR THE FIX (advisor): (a) all 3 designate units HAVE metal-internal addrs + (10.12.12.110/.144/.143) -- `juju bind internal=metal-internal` will NOT be refused, no + --force; (b) cert already covers the metal-internal SANs -> low reissue risk, but RE-READ + the issued cert SANs AND do haproxy-backend-readback + https-200 after (D-072 precedent + method; assert the artifact not the config). +PROPOSED FIX (gated, together -- bundle + live, per D-072): add `internal: metal-internal` + to designate's bundle.yaml bindings + `juju bind designate internal=metal-internal`; verify + haproxy _admin backend readback moves onto a served address + comes UP, re-read cert SANs. + `:public` deferred to the operator ruling. designate is Stage-7-blocked (not serving) -> + no urgency; do it correctly, not fast. + ## Step 3.4 keystone domain-manager policy -- NOT RUN this session Deferred with the openstack-client-dependent verification depth; the PO: stage-1 check + the C.4 G3 behavioral probe (which mutates -- creates user/project) are owed. Recorded as