diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index e5f408d..f9db231 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -2522,6 +2522,31 @@ writes PREFIXES into the apex ONLY.** No MAAS subnet, no node address and no VIP was created, moved or deleted; steps 2 and 3 are outstanding. **`vr1-dc1` has NOT been pushed** -- the two DCs are separately approved. + **>>> THE DEPLOY INPUT NOW CONFORMS: `overlays/vr1-dc0-vips.yaml` IS FULLY GUA. <<<** All + 39 v6 VIP legs are GUA (13 `f02:11::` provider + 13 `f02:20::` metal-admin + 13 `f02:21::` + metal-internal); **`fd50:` occurrences: ZERO**. The renderer reproduces it byte-for-byte and + `provider-bundle-check` PASSES with `13 clustered VIP(s) ... (13 dual-family)`. **BOTH APEX + READERS HAD TO LEARN FAMILY FIRST** -- step 1 creates GUA alongside ULA and step 6 retires + ULA, so mid-transition every v6-only plane has two `/64`s under one (role, kind) key and both + readers could only REFUSE (measured live: `derive --dual-family` rc 2; the gate "cannot + evaluate barbican's dual-family vip"). `render-dc-overlays.py` gained `--v6-family`; + `provider-bundle-check.py` gained per-application, per-leg resolution needing no flag at any + call site. **A LOSSY PATH WAS FOUND AND NOT TAKEN: a full `derive` drops the 13 per-app + `comment:` fields** (overlay 4368 -> 3593 bytes), so the values file was edited surgically + instead -- exactly 26 changed overlay lines, every comment intact. `derive` being lossy + against its own committed values file is LOGGED NOT FIXED. + **>>> A PROPERTY WAS TRADED AWAY AND IT IS NOT A WIN: THE GATE NO LONGER CATCHES A + WRONG-FAMILY LEG. <<<** Measured -- substituting a ULA admin leg into the GUA dc0 overlay now + **PASSES**, because per-leg resolution grades it against the ULA band, which exists until + step 6. This is NECESSARY (dc1 is legitimately ULA, so no gate can hardcode a family) but it + means **D-139 family conformance is now checked by NOTHING**, and this change makes that the + ONLY thing standing between a DC and a deploy on the wrong family. A ruled-table conformance + gate is OWED. **TWO BUGS I INTRODUCED WERE CAUGHT BY THE HARNESS, NOT BY REVIEW:** inferring + family ONCE from the provider leg (which is GUA in both worlds, so every dc1 fixture asked + for GUA bands on a still-ULA DC -- 7 cases red), then resolving bands once for the whole + bundle and grading all 13 apps against the first app's families. **`vr1-dc1` is UNTOUCHED** + and still gates correctly through the same per-leg path. `tests/render-dc-overlays` 18 -> + **23/23**, `tests/provider-bundle-check` **55/55**, gauntlet **ALL GREEN (96)**. **STILL OWED BEFORE THE DEPLOY, in ruled order:** ~~D-139 step 1~~ DONE (apex CREATE-only push, `netbox/d139-gua-carve.py --dc vr1-dc0 --commit`; tool built, independently reviewed, dry-run byte-identical, `--commit` never yet passed), step 2 (MAAS GUA `/64`s alongside the diff --git a/docs/changelog-20260801-stage5-deploy-prep.md b/docs/changelog-20260801-stage5-deploy-prep.md index 30ec381..9496208 100644 --- a/docs/changelog-20260801-stage5-deploy-prep.md +++ b/docs/changelog-20260801-stage5-deploy-prep.md @@ -174,3 +174,63 @@ re-carve node addresses under a live cloud, which the entry warns is the expensive path since addresses bake into `agent.conf` at deploy time. - **A durable unit for the 5241 tunnel** -- item 2's finding; unruled, logged only. + +--- + +## Item 5 -- D-139 step 1 EXECUTED (apex GUA carve, vr1-dc0) + +See `docs/audit/d139-step1-apex-push-dc0-20260801.txt` and the CURRENT-STATE block. +`--commit` exit 0, 13/13 read-back, apex 139 -> 152 verified by an INDEPENDENT query. +Nothing deleted: 9 ULA prefixes and all 26 ULA VIP legs still resolve. + +**Revert.** Delete the 13 created prefixes (they are new and carry no dependents). + +--- + +## Item 6 -- the VIP overlay re-rendered onto GUA, and the two apex readers taught FAMILY + +**What.** `overlays/vr1-dc0-vips.yaml` now carries GUA on all 39 v6 VIP legs (was 13 GUA + +26 ULA). `render/values/vr1-dc0-vips.yaml` gains the two GUA prefixes, a refreshed +`apex_record`, and a new `v6_family: gua` provenance key. `scripts/render-dc-overlays.py` +gains `v6_family()` + `--v6-family`; `scripts/provider-bundle-check.py` gains per-leg, +per-application family resolution. + +**Why it was needed.** Step 1 creates GUA ALONGSIDE the ULA rows and step 6 retires the ULA +rows, so for the WHOLE transition every v6-only plane has two `/64`s under one (role, kind) +key. Both apex readers keyed without a family dimension, so both could only REFUSE. Measured +live minutes after the push: `derive --dual-family` -> rc 2, and the gate -> "cannot evaluate +barbican's dual-family vip". The D-136 pipeline was unrunnable for exactly the migration it +exists to serve. + +**A LOSSY PATH FOUND AND NOT TAKEN.** `derive` does not reproduce the per-app `comment:` +fields, so a full re-derive silently dropped 13 comments and shrank the overlay 4368 -> 3593 +bytes. Reverted; the values file was edited surgically instead (3 lines), giving exactly 26 +changed overlay lines -- 13 vip lines x 2 -- with every comment intact. **`derive` being lossy +against its own committed values file is a real gap, LOGGED NOT FIXED.** + +**TWO BUGS I INTRODUCED, BOTH CAUGHT BY THE HARNESS AND NOT BY REVIEW.** (i) I inferred the +family ONCE from `parts[3]`, the provider leg -- but provider-public's VIP `/64` is GUA in +BOTH worlds (`:11::`), so every dc1 fixture asked for GUA bands on a still-ULA DC: 7 cases +red. (ii) The corrected version still resolved bands ONCE for the whole bundle and reused +them across all 13 applications, grading every later app against the first app's families. +Fixed by resolving per application AND per leg, cached on the family triple. + +**>>> A PROPERTY WAS TRADED AWAY, AND IT IS NOT A WIN: THE GATE NO LONGER CATCHES A +WRONG-FAMILY LEG. <<<** Measured: substituting a ULA admin leg into the GUA dc0 overlay now +PASSES, because per-leg resolution grades it against the ULA band -- which still exists until +step 6. This is NECESSARY (dc1 is legitimately ULA, so no gate can hardcode a family) but it +means D-139 family conformance is now checked by NOTHING. That was already recorded as a gap +(`docs/audit/d139-conformance-dc0-20260801.txt` D.2); this change makes it the ONLY thing that +would catch a DC deployed on the wrong family. A ruled-table conformance gate is OWED. + +**Verification.** `tests/render-dc-overlays` 18 -> **23/23** (T17/T17b/T18/T19/T20), three +mutations each killing named cases, script restored sha256-identical. +`tests/provider-bundle-check` **55/55**. Gauntlet **ALL GREEN (96)**; repo-lint 0 fail / 1 +warn. Renderer `check` reproduces the new overlay byte-for-byte. The real deploy input gates +PASS with `13 clustered VIP(s) ... (13 dual-family)`, and a corrupted GUA leg still FAILS. + +**vr1-dc1 is UNTOUCHED** -- its apex has no GUA, so its overlay stays ULA and now gates +correctly through the same per-leg path. + +**Revert.** `git revert `; the overlay's prior bytes are recoverable from the values +file by restoring the three prefix lines and re-rendering. diff --git a/netbox/draft/vr1-office1-current-20260801.json b/netbox/draft/vr1-office1-current-20260801.json new file mode 100644 index 0000000..e886309 --- /dev/null +++ b/netbox/draft/vr1-office1-current-20260801.json @@ -0,0 +1,3176 @@ +{ + "_note": "READ-ONLY snapshot of the office1-netbox RECORD (VR1 working apex, DOCFIX-195). IDs discarded; refs by slug/prefix.", + "_source": "http://10.10.1.10:8000", + "dcim/regions": [ + { + "description": "Top-level region for US West metros. Holds Eugene (and future West Coast metros).", + "name": "US West", + "parent": null, + "slug": "us-west" + }, + { + "description": "Region0 \u2014 Eugene, OR metro. Nested under US West. Assigned 10.16.0.0/16 IPv4.", + "name": "Eugene", + "parent": "us-west", + "slug": "eugene" + }, + { + "description": "Virtual Regions for testing", + "name": "Virtual Regions", + "parent": null, + "slug": "virtual-region" + }, + { + "description": "Virtual Region for testing", + "name": "VR0", + "parent": "virtual-region", + "slug": "vr0" + }, + { + "description": "Virtual Region for testing", + "name": "VR1", + "parent": "virtual-region", + "slug": "vr1" + } + ], + "dcim/sites": [ + { + "description": "Primary office \u2014 Office0 at 10.16.4.0/24", + "name": "Charnelton", + "region": "eugene", + "slug": "charnelton", + "status": "active" + }, + { + "description": "Future manufacturing/OT \u2014 Cloud3 at 10.16.64.0/20 (reserved)", + "name": "Cleveland", + "region": "eugene", + "slug": "cleveland", + "status": "planned" + }, + { + "description": "Primary DC and current Internet edge \u2014 Cloud0 at 10.16.16.0/20", + "name": "Roosevelt", + "region": "eugene", + "slug": "roosevelt", + "status": "active" + }, + { + "description": "Future tertiary DC \u2014 Cloud2 at 10.16.48.0/20 (reserved)", + "name": "Stevenson", + "region": "eugene", + "slug": "stevenson", + "status": "planned" + }, + { + "description": "Virtual Site for testing", + "name": "VR0 DC0", + "region": "vr0", + "slug": "vr0-dc0", + "status": "active" + }, + { + "description": "Virtual Site for testing", + "name": "VR0 DC1", + "region": "vr0", + "slug": "vr0-dc1", + "status": "active" + }, + { + "description": "Virtual Site for testing", + "name": "VR0 Off0", + "region": "vr0", + "slug": "vr0-off0", + "status": "active" + }, + { + "description": "Virtual Site for testing", + "name": "VR1 DC0", + "region": "vr1", + "slug": "vr1-dc0", + "status": "active" + }, + { + "description": "Virtual Site for testing", + "name": "VR1 DC1", + "region": "vr1", + "slug": "vr1-dc1", + "status": "active" + }, + { + "description": "", + "name": "VR1 Off1", + "region": "vr1", + "slug": "vr1-off1", + "status": "active" + }, + { + "description": "Secondary DC \u2014 Cloud1 at 10.16.32.0/20. Future Internet edge once ARIN allocation and transit contracts move.", + "name": "Willamette", + "region": "eugene", + "slug": "willamette", + "status": "active" + } + ], + "ipam/aggregates": [ + { + "description": "RFC1918 private IPv4.", + "prefix": "10.0.0.0/8", + "rir": "rfc-1918" + }, + { + "description": "ARIN IPv4 allocation.", + "prefix": "23.157.124.0/24", + "rir": "arin" + }, + { + "description": "RFC1918 private IPv4 (OOB space).", + "prefix": "172.16.0.0/12", + "rir": "rfc-1918" + }, + { + "description": "ARIN IPv6 allocation: the HELD /36 = region-0 of the planned /32 (D-101). Update to /32 after the expand completes.", + "prefix": "2602:f3e2::/36", + "rir": "arin" + }, + { + "description": "Org ULA /48 (internal-only; D-101 literal).", + "prefix": "fd50:840e:74e2::/48", + "rir": "rfc-4193-ula" + } + ], + "ipam/ip-addresses": [ + { + "address": "10.10.1.10/24", + "description": "office1-netbox service (D-120 static band; re-IP from .201)", + "dns_name": "office1-netbox", + "role": null, + "status": "active" + }, + { + "address": "10.10.1.11/24", + "description": "office1-tailscale subnet router (D-120 static band; re-IP from .202)", + "dns_name": "office1-tailscale", + "role": null, + "status": "active" + }, + { + "address": "10.12.4.50/22", + "description": "VIP keystone provider-public (vr1-dc0) -- D-020 octet .50", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.4.51/22", + "description": "VIP barbican provider-public (vr1-dc0) -- D-020 octet .51", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.4.52/22", + "description": "VIP cinder provider-public (vr1-dc0) -- D-020 octet .52", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.4.53/22", + "description": "VIP glance provider-public (vr1-dc0) -- D-020 octet .53", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.4.54/22", + "description": "VIP magnum provider-public (vr1-dc0) -- D-020 octet .54", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.4.55/22", + "description": "VIP neutron-api provider-public (vr1-dc0) -- D-020 octet .55", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.4.56/22", + "description": "VIP nova-cloud-controller provider-public (vr1-dc0) -- D-020 octet .56", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.4.57/22", + "description": "VIP octavia provider-public (vr1-dc0) -- D-020 octet .57", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.4.58/22", + "description": "VIP openstack-dashboard provider-public (vr1-dc0) -- D-020 octet .58", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.4.59/22", + "description": "VIP placement provider-public (vr1-dc0) -- D-020 octet .59", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.4.60/22", + "description": "VIP ceph-radosgw provider-public (vr1-dc0) -- D-020 octet .60", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.4.61/22", + "description": "VIP vault provider-public (vr1-dc0) -- D-020 octet .61", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.4.62/22", + "description": "VIP designate provider-public (vr1-dc0) -- D-020 octet .62", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.8.2/22", + "description": "vr1-dc0 MAAS rack controller (vvr1-dc0) metal-admin static IP (D-124; D-120 static band)", + "dns_name": "vvr1-dc0", + "role": null, + "status": "active" + }, + { + "address": "10.12.8.50/22", + "description": "VIP keystone metal-admin (vr1-dc0) -- D-020 octet .50", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.8.51/22", + "description": "VIP barbican metal-admin (vr1-dc0) -- D-020 octet .51", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.8.52/22", + "description": "VIP cinder metal-admin (vr1-dc0) -- D-020 octet .52", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.8.53/22", + "description": "VIP glance metal-admin (vr1-dc0) -- D-020 octet .53", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.8.54/22", + "description": "VIP magnum metal-admin (vr1-dc0) -- D-020 octet .54", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.8.55/22", + "description": "VIP neutron-api metal-admin (vr1-dc0) -- D-020 octet .55", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.8.56/22", + "description": "VIP nova-cloud-controller metal-admin (vr1-dc0) -- D-020 octet .56", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.8.57/22", + "description": "VIP octavia metal-admin (vr1-dc0) -- D-020 octet .57", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.8.58/22", + "description": "VIP openstack-dashboard metal-admin (vr1-dc0) -- D-020 octet .58", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.8.59/22", + "description": "VIP placement metal-admin (vr1-dc0) -- D-020 octet .59", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.8.60/22", + "description": "VIP ceph-radosgw metal-admin (vr1-dc0) -- D-020 octet .60", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.8.61/22", + "description": "VIP vault metal-admin (vr1-dc0) -- D-020 octet .61", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.8.62/22", + "description": "VIP designate metal-admin (vr1-dc0) -- D-020 octet .62", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.12.50/22", + "description": "VIP keystone metal-internal (vr1-dc0) -- D-020 octet .50", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.12.51/22", + "description": "VIP barbican metal-internal (vr1-dc0) -- D-020 octet .51", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.12.52/22", + "description": "VIP cinder metal-internal (vr1-dc0) -- D-020 octet .52", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.12.53/22", + "description": "VIP glance metal-internal (vr1-dc0) -- D-020 octet .53", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.12.54/22", + "description": "VIP magnum metal-internal (vr1-dc0) -- D-020 octet .54", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.12.55/22", + "description": "VIP neutron-api metal-internal (vr1-dc0) -- D-020 octet .55", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.12.56/22", + "description": "VIP nova-cloud-controller metal-internal (vr1-dc0) -- D-020 octet .56", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.12.57/22", + "description": "VIP octavia metal-internal (vr1-dc0) -- D-020 octet .57", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.12.58/22", + "description": "VIP openstack-dashboard metal-internal (vr1-dc0) -- D-020 octet .58", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.12.59/22", + "description": "VIP placement metal-internal (vr1-dc0) -- D-020 octet .59", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.12.60/22", + "description": "VIP ceph-radosgw metal-internal (vr1-dc0) -- D-020 octet .60", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.12.61/22", + "description": "VIP vault metal-internal (vr1-dc0) -- D-020 octet .61", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.12.62/22", + "description": "VIP designate metal-internal (vr1-dc0) -- D-020 octet .62", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.64.50/22", + "description": "VIP keystone provider-public (vr1-dc1) -- D-020 octet .50", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.64.51/22", + "description": "VIP barbican provider-public (vr1-dc1) -- D-020 octet .51", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.64.52/22", + "description": "VIP cinder provider-public (vr1-dc1) -- D-020 octet .52", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.64.53/22", + "description": "VIP glance provider-public (vr1-dc1) -- D-020 octet .53", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.64.54/22", + "description": "VIP magnum provider-public (vr1-dc1) -- D-020 octet .54", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.64.55/22", + "description": "VIP neutron-api provider-public (vr1-dc1) -- D-020 octet .55", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.64.56/22", + "description": "VIP nova-cloud-controller provider-public (vr1-dc1) -- D-020 octet .56", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.64.57/22", + "description": "VIP octavia provider-public (vr1-dc1) -- D-020 octet .57", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.64.58/22", + "description": "VIP openstack-dashboard provider-public (vr1-dc1) -- D-020 octet .58", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.64.59/22", + "description": "VIP placement provider-public (vr1-dc1) -- D-020 octet .59", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.64.60/22", + "description": "VIP ceph-radosgw provider-public (vr1-dc1) -- D-020 octet .60", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.64.61/22", + "description": "VIP vault provider-public (vr1-dc1) -- D-020 octet .61", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.64.62/22", + "description": "VIP designate provider-public (vr1-dc1) -- D-020 octet .62", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.68.2/22", + "description": "vr1-dc1 MAAS rack controller (vvr1-dc1) metal-admin static IP (D-124 amendment 2026-07-21; D-120 static band)", + "dns_name": "vvr1-dc1", + "role": null, + "status": "active" + }, + { + "address": "10.12.68.50/22", + "description": "VIP keystone metal-admin (vr1-dc1) -- D-020 octet .50", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.68.51/22", + "description": "VIP barbican metal-admin (vr1-dc1) -- D-020 octet .51", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.68.52/22", + "description": "VIP cinder metal-admin (vr1-dc1) -- D-020 octet .52", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.68.53/22", + "description": "VIP glance metal-admin (vr1-dc1) -- D-020 octet .53", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.68.54/22", + "description": "VIP magnum metal-admin (vr1-dc1) -- D-020 octet .54", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.68.55/22", + "description": "VIP neutron-api metal-admin (vr1-dc1) -- D-020 octet .55", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.68.56/22", + "description": "VIP nova-cloud-controller metal-admin (vr1-dc1) -- D-020 octet .56", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.68.57/22", + "description": "VIP octavia metal-admin (vr1-dc1) -- D-020 octet .57", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.68.58/22", + "description": "VIP openstack-dashboard metal-admin (vr1-dc1) -- D-020 octet .58", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.68.59/22", + "description": "VIP placement metal-admin (vr1-dc1) -- D-020 octet .59", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.68.60/22", + "description": "VIP ceph-radosgw metal-admin (vr1-dc1) -- D-020 octet .60", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.68.61/22", + "description": "VIP vault metal-admin (vr1-dc1) -- D-020 octet .61", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.68.62/22", + "description": "VIP designate metal-admin (vr1-dc1) -- D-020 octet .62", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.72.50/22", + "description": "VIP keystone metal-internal (vr1-dc1) -- D-020 octet .50", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.72.51/22", + "description": "VIP barbican metal-internal (vr1-dc1) -- D-020 octet .51", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.72.52/22", + "description": "VIP cinder metal-internal (vr1-dc1) -- D-020 octet .52", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.72.53/22", + "description": "VIP glance metal-internal (vr1-dc1) -- D-020 octet .53", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.72.54/22", + "description": "VIP magnum metal-internal (vr1-dc1) -- D-020 octet .54", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.72.55/22", + "description": "VIP neutron-api metal-internal (vr1-dc1) -- D-020 octet .55", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.72.56/22", + "description": "VIP nova-cloud-controller metal-internal (vr1-dc1) -- D-020 octet .56", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.72.57/22", + "description": "VIP octavia metal-internal (vr1-dc1) -- D-020 octet .57", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.72.58/22", + "description": "VIP openstack-dashboard metal-internal (vr1-dc1) -- D-020 octet .58", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.72.59/22", + "description": "VIP placement metal-internal (vr1-dc1) -- D-020 octet .59", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.72.60/22", + "description": "VIP ceph-radosgw metal-internal (vr1-dc1) -- D-020 octet .60", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.72.61/22", + "description": "VIP vault metal-internal (vr1-dc1) -- D-020 octet .61", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.72.62/22", + "description": "VIP designate metal-internal (vr1-dc1) -- D-020 octet .62", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:11::50/64", + "description": "VIP keystone provider-public v6 (vr1-dc0) -- octet mirror ::50", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:11::51/64", + "description": "VIP barbican provider-public v6 (vr1-dc0) -- octet mirror ::51", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:11::52/64", + "description": "VIP cinder provider-public v6 (vr1-dc0) -- octet mirror ::52", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:11::53/64", + "description": "VIP glance provider-public v6 (vr1-dc0) -- octet mirror ::53", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:11::54/64", + "description": "VIP magnum provider-public v6 (vr1-dc0) -- octet mirror ::54", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:11::55/64", + "description": "VIP neutron-api provider-public v6 (vr1-dc0) -- octet mirror ::55", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:11::56/64", + "description": "VIP nova-cloud-controller provider-public v6 (vr1-dc0) -- octet mirror ::56", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:11::57/64", + "description": "VIP octavia provider-public v6 (vr1-dc0) -- octet mirror ::57", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:11::58/64", + "description": "VIP openstack-dashboard provider-public v6 (vr1-dc0) -- octet mirror ::58", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:11::59/64", + "description": "VIP placement provider-public v6 (vr1-dc0) -- octet mirror ::59", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:11::60/64", + "description": "VIP ceph-radosgw provider-public v6 (vr1-dc0) -- octet mirror ::60", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:11::61/64", + "description": "VIP vault provider-public v6 (vr1-dc0) -- octet mirror ::61", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:11::62/64", + "description": "VIP designate provider-public v6 (vr1-dc0) -- octet mirror ::62", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f03:11::50/64", + "description": "VIP keystone provider-public v6 (vr1-dc1) -- octet mirror ::50", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f03:11::51/64", + "description": "VIP barbican provider-public v6 (vr1-dc1) -- octet mirror ::51", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f03:11::52/64", + "description": "VIP cinder provider-public v6 (vr1-dc1) -- octet mirror ::52", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f03:11::53/64", + "description": "VIP glance provider-public v6 (vr1-dc1) -- octet mirror ::53", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f03:11::54/64", + "description": "VIP magnum provider-public v6 (vr1-dc1) -- octet mirror ::54", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f03:11::55/64", + "description": "VIP neutron-api provider-public v6 (vr1-dc1) -- octet mirror ::55", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f03:11::56/64", + "description": "VIP nova-cloud-controller provider-public v6 (vr1-dc1) -- octet mirror ::56", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f03:11::57/64", + "description": "VIP octavia provider-public v6 (vr1-dc1) -- octet mirror ::57", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f03:11::58/64", + "description": "VIP openstack-dashboard provider-public v6 (vr1-dc1) -- octet mirror ::58", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f03:11::59/64", + "description": "VIP placement provider-public v6 (vr1-dc1) -- octet mirror ::59", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f03:11::60/64", + "description": "VIP ceph-radosgw provider-public v6 (vr1-dc1) -- octet mirror ::60", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f03:11::61/64", + "description": "VIP vault provider-public v6 (vr1-dc1) -- octet mirror ::61", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f03:11::62/64", + "description": "VIP designate provider-public v6 (vr1-dc1) -- octet mirror ::62", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:220::50/64", + "description": "VIP keystone metal-admin v6 (vr1-dc0) -- octet mirror ::50", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:220::51/64", + "description": "VIP barbican metal-admin v6 (vr1-dc0) -- octet mirror ::51", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:220::52/64", + "description": "VIP cinder metal-admin v6 (vr1-dc0) -- octet mirror ::52", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:220::53/64", + "description": "VIP glance metal-admin v6 (vr1-dc0) -- octet mirror ::53", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:220::54/64", + "description": "VIP magnum metal-admin v6 (vr1-dc0) -- octet mirror ::54", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:220::55/64", + "description": "VIP neutron-api metal-admin v6 (vr1-dc0) -- octet mirror ::55", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:220::56/64", + "description": "VIP nova-cloud-controller metal-admin v6 (vr1-dc0) -- octet mirror ::56", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:220::57/64", + "description": "VIP octavia metal-admin v6 (vr1-dc0) -- octet mirror ::57", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:220::58/64", + "description": "VIP openstack-dashboard metal-admin v6 (vr1-dc0) -- octet mirror ::58", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:220::59/64", + "description": "VIP placement metal-admin v6 (vr1-dc0) -- octet mirror ::59", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:220::60/64", + "description": "VIP ceph-radosgw metal-admin v6 (vr1-dc0) -- octet mirror ::60", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:220::61/64", + "description": "VIP vault metal-admin v6 (vr1-dc0) -- octet mirror ::61", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:220::62/64", + "description": "VIP designate metal-admin v6 (vr1-dc0) -- octet mirror ::62", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:221::50/64", + "description": "VIP keystone metal-internal v6 (vr1-dc0) -- octet mirror ::50", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:221::51/64", + "description": "VIP barbican metal-internal v6 (vr1-dc0) -- octet mirror ::51", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:221::52/64", + "description": "VIP cinder metal-internal v6 (vr1-dc0) -- octet mirror ::52", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:221::53/64", + "description": "VIP glance metal-internal v6 (vr1-dc0) -- octet mirror ::53", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:221::54/64", + "description": "VIP magnum metal-internal v6 (vr1-dc0) -- octet mirror ::54", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:221::55/64", + "description": "VIP neutron-api metal-internal v6 (vr1-dc0) -- octet mirror ::55", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:221::56/64", + "description": "VIP nova-cloud-controller metal-internal v6 (vr1-dc0) -- octet mirror ::56", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:221::57/64", + "description": "VIP octavia metal-internal v6 (vr1-dc0) -- octet mirror ::57", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:221::58/64", + "description": "VIP openstack-dashboard metal-internal v6 (vr1-dc0) -- octet mirror ::58", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:221::59/64", + "description": "VIP placement metal-internal v6 (vr1-dc0) -- octet mirror ::59", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:221::60/64", + "description": "VIP ceph-radosgw metal-internal v6 (vr1-dc0) -- octet mirror ::60", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:221::61/64", + "description": "VIP vault metal-internal v6 (vr1-dc0) -- octet mirror ::61", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:221::62/64", + "description": "VIP designate metal-internal v6 (vr1-dc0) -- octet mirror ::62", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:320::50/64", + "description": "VIP keystone metal-admin v6 (vr1-dc1) -- octet mirror ::50", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:320::51/64", + "description": "VIP barbican metal-admin v6 (vr1-dc1) -- octet mirror ::51", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:320::52/64", + "description": "VIP cinder metal-admin v6 (vr1-dc1) -- octet mirror ::52", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:320::53/64", + "description": "VIP glance metal-admin v6 (vr1-dc1) -- octet mirror ::53", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:320::54/64", + "description": "VIP magnum metal-admin v6 (vr1-dc1) -- octet mirror ::54", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:320::55/64", + "description": "VIP neutron-api metal-admin v6 (vr1-dc1) -- octet mirror ::55", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:320::56/64", + "description": "VIP nova-cloud-controller metal-admin v6 (vr1-dc1) -- octet mirror ::56", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:320::57/64", + "description": "VIP octavia metal-admin v6 (vr1-dc1) -- octet mirror ::57", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:320::58/64", + "description": "VIP openstack-dashboard metal-admin v6 (vr1-dc1) -- octet mirror ::58", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:320::59/64", + "description": "VIP placement metal-admin v6 (vr1-dc1) -- octet mirror ::59", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:320::60/64", + "description": "VIP ceph-radosgw metal-admin v6 (vr1-dc1) -- octet mirror ::60", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:320::61/64", + "description": "VIP vault metal-admin v6 (vr1-dc1) -- octet mirror ::61", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:320::62/64", + "description": "VIP designate metal-admin v6 (vr1-dc1) -- octet mirror ::62", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:321::50/64", + "description": "VIP keystone metal-internal v6 (vr1-dc1) -- octet mirror ::50", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:321::51/64", + "description": "VIP barbican metal-internal v6 (vr1-dc1) -- octet mirror ::51", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:321::52/64", + "description": "VIP cinder metal-internal v6 (vr1-dc1) -- octet mirror ::52", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:321::53/64", + "description": "VIP glance metal-internal v6 (vr1-dc1) -- octet mirror ::53", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:321::54/64", + "description": "VIP magnum metal-internal v6 (vr1-dc1) -- octet mirror ::54", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:321::55/64", + "description": "VIP neutron-api metal-internal v6 (vr1-dc1) -- octet mirror ::55", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:321::56/64", + "description": "VIP nova-cloud-controller metal-internal v6 (vr1-dc1) -- octet mirror ::56", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:321::57/64", + "description": "VIP octavia metal-internal v6 (vr1-dc1) -- octet mirror ::57", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:321::58/64", + "description": "VIP openstack-dashboard metal-internal v6 (vr1-dc1) -- octet mirror ::58", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:321::59/64", + "description": "VIP placement metal-internal v6 (vr1-dc1) -- octet mirror ::59", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:321::60/64", + "description": "VIP ceph-radosgw metal-internal v6 (vr1-dc1) -- octet mirror ::60", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:321::61/64", + "description": "VIP vault metal-internal v6 (vr1-dc1) -- octet mirror ::61", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:321::62/64", + "description": "VIP designate metal-internal v6 (vr1-dc1) -- octet mirror ::62", + "dns_name": "", + "role": null, + "status": "reserved" + } + ], + "ipam/ip-ranges": [ + { + "description": "D-120 static site-services band (.2-.49) -- MAAS static-assign, outside the dynamic range", + "end_address": "10.10.1.49/24", + "range": "10.10.1.2/24-10.10.1.49/24", + "role": null, + "start_address": "10.10.1.2/24", + "status": "active" + }, + { + "description": "D-120 MAAS dynamic band (.100-.200) -- enlistment/commissioning/PXE/DHCP", + "end_address": "10.10.1.200/24", + "range": "10.10.1.100/24-10.10.1.200/24", + "role": null, + "start_address": "10.10.1.100/24", + "status": "active" + }, + { + "description": "D-120 deployed-node band (.201-.254) -- MAAS auto-assign for compute/OpenStack nodes", + "end_address": "10.10.1.254/24", + "range": "10.10.1.201/24-10.10.1.254/24", + "role": null, + "start_address": "10.10.1.201/24", + "status": "active" + }, + { + "description": "D-134 utility band (vr1-dc0 provider-public) -- .4-.49", + "end_address": "10.12.4.49/22", + "range": "10.12.4.4/22-10.12.4.49/22", + "role": null, + "start_address": "10.12.4.4/22", + "status": "reserved" + }, + { + "description": "D-134 VIP band (vr1-dc0 provider-public) -- .50-.99", + "end_address": "10.12.4.99/22", + "range": "10.12.4.50/22-10.12.4.99/22", + "role": null, + "start_address": "10.12.4.50/22", + "status": "reserved" + }, + { + "description": "D-134 utility band (vr1-dc0 metal-admin) -- .4-.49", + "end_address": "10.12.8.49/22", + "range": "10.12.8.4/22-10.12.8.49/22", + "role": null, + "start_address": "10.12.8.4/22", + "status": "reserved" + }, + { + "description": "D-134 VIP band (vr1-dc0 metal-admin) -- .50-.99", + "end_address": "10.12.8.99/22", + "range": "10.12.8.50/22-10.12.8.99/22", + "role": null, + "start_address": "10.12.8.50/22", + "status": "reserved" + }, + { + "description": "D-134 utility band (vr1-dc0 metal-internal) -- .4-.49", + "end_address": "10.12.12.49/22", + "range": "10.12.12.4/22-10.12.12.49/22", + "role": null, + "start_address": "10.12.12.4/22", + "status": "reserved" + }, + { + "description": "D-134 VIP band (vr1-dc0 metal-internal) -- .50-.99", + "end_address": "10.12.12.99/22", + "range": "10.12.12.50/22-10.12.12.99/22", + "role": null, + "start_address": "10.12.12.50/22", + "status": "reserved" + }, + { + "description": "D-134 utility band (vr1-dc0 data-tenant) -- .4-.49", + "end_address": "10.12.16.49/22", + "range": "10.12.16.4/22-10.12.16.49/22", + "role": null, + "start_address": "10.12.16.4/22", + "status": "reserved" + }, + { + "description": "D-134 VIP band (vr1-dc0 data-tenant) -- .50-.99", + "end_address": "10.12.16.99/22", + "range": "10.12.16.50/22-10.12.16.99/22", + "role": null, + "start_address": "10.12.16.50/22", + "status": "reserved" + }, + { + "description": "D-134 utility band (vr1-dc0 storage) -- .4-.49", + "end_address": "10.12.32.49/22", + "range": "10.12.32.4/22-10.12.32.49/22", + "role": null, + "start_address": "10.12.32.4/22", + "status": "reserved" + }, + { + "description": "D-134 VIP band (vr1-dc0 storage) -- .50-.99", + "end_address": "10.12.32.99/22", + "range": "10.12.32.50/22-10.12.32.99/22", + "role": null, + "start_address": "10.12.32.50/22", + "status": "reserved" + }, + { + "description": "D-134 utility band (vr1-dc0 replication) -- .4-.49", + "end_address": "10.12.36.49/22", + "range": "10.12.36.4/22-10.12.36.49/22", + "role": null, + "start_address": "10.12.36.4/22", + "status": "reserved" + }, + { + "description": "D-134 VIP band (vr1-dc0 replication) -- .50-.99", + "end_address": "10.12.36.99/22", + "range": "10.12.36.50/22-10.12.36.99/22", + "role": null, + "start_address": "10.12.36.50/22", + "status": "reserved" + }, + { + "description": "D-134 utility band (vr1-dc1 provider-public) -- .4-.49", + "end_address": "10.12.64.49/22", + "range": "10.12.64.4/22-10.12.64.49/22", + "role": null, + "start_address": "10.12.64.4/22", + "status": "reserved" + }, + { + "description": "D-134 VIP band (vr1-dc1 provider-public) -- .50-.99", + "end_address": "10.12.64.99/22", + "range": "10.12.64.50/22-10.12.64.99/22", + "role": null, + "start_address": "10.12.64.50/22", + "status": "reserved" + }, + { + "description": "D-134 utility band (vr1-dc1 metal-admin) -- .4-.49", + "end_address": "10.12.68.49/22", + "range": "10.12.68.4/22-10.12.68.49/22", + "role": null, + "start_address": "10.12.68.4/22", + "status": "reserved" + }, + { + "description": "D-134 VIP band (vr1-dc1 metal-admin) -- .50-.99", + "end_address": "10.12.68.99/22", + "range": "10.12.68.50/22-10.12.68.99/22", + "role": null, + "start_address": "10.12.68.50/22", + "status": "reserved" + }, + { + "description": "D-134 utility band (vr1-dc1 metal-internal) -- .4-.49", + "end_address": "10.12.72.49/22", + "range": "10.12.72.4/22-10.12.72.49/22", + "role": null, + "start_address": "10.12.72.4/22", + "status": "reserved" + }, + { + "description": "D-134 VIP band (vr1-dc1 metal-internal) -- .50-.99", + "end_address": "10.12.72.99/22", + "range": "10.12.72.50/22-10.12.72.99/22", + "role": null, + "start_address": "10.12.72.50/22", + "status": "reserved" + }, + { + "description": "D-134 utility band (vr1-dc1 data-tenant) -- .4-.49", + "end_address": "10.12.76.49/22", + "range": "10.12.76.4/22-10.12.76.49/22", + "role": null, + "start_address": "10.12.76.4/22", + "status": "reserved" + }, + { + "description": "D-134 VIP band (vr1-dc1 data-tenant) -- .50-.99", + "end_address": "10.12.76.99/22", + "range": "10.12.76.50/22-10.12.76.99/22", + "role": null, + "start_address": "10.12.76.50/22", + "status": "reserved" + }, + { + "description": "D-134 utility band (vr1-dc1 storage) -- .4-.49", + "end_address": "10.12.80.49/22", + "range": "10.12.80.4/22-10.12.80.49/22", + "role": null, + "start_address": "10.12.80.4/22", + "status": "reserved" + }, + { + "description": "D-134 VIP band (vr1-dc1 storage) -- .50-.99", + "end_address": "10.12.80.99/22", + "range": "10.12.80.50/22-10.12.80.99/22", + "role": null, + "start_address": "10.12.80.50/22", + "status": "reserved" + }, + { + "description": "D-134 utility band (vr1-dc1 replication) -- .4-.49", + "end_address": "10.12.84.49/22", + "range": "10.12.84.4/22-10.12.84.49/22", + "role": null, + "start_address": "10.12.84.4/22", + "status": "reserved" + }, + { + "description": "D-134 VIP band (vr1-dc1 replication) -- .50-.99", + "end_address": "10.12.84.99/22", + "range": "10.12.84.50/22-10.12.84.99/22", + "role": null, + "start_address": "10.12.84.50/22", + "status": "reserved" + } + ], + "ipam/prefixes": [ + { + "description": "Local Subnet", + "is_pool": false, + "mark_utilized": false, + "prefix": "0.0.0.0/8", + "role": "localnet", + "scope_type": null, + "status": "reserved" + }, + { + "description": "Corp Private", + "is_pool": false, + "mark_utilized": false, + "prefix": "10.0.0.0/8", + "role": "private", + "scope_type": null, + "status": "container" + }, + { + "description": "Office (v4) -- /22 per office (D-115)", + "is_pool": false, + "mark_utilized": false, + "prefix": "10.10.0.0/16", + "role": "office", + "scope_type": null, + "status": "container" + }, + { + "description": "VR1 Off1 -- office /22 (D-115)", + "is_pool": false, + "mark_utilized": false, + "prefix": "10.10.0.0/22", + "role": "office", + "scope_site": "vr1-off1", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "VR1 Off1 office1-local LAN -- Kea DHCP on the OPNsense edge (D-115)", + "is_pool": false, + "mark_utilized": false, + "prefix": "10.10.0.0/24", + "role": "office", + "scope_site": "vr1-off1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 Off1 LXD compose net (lxdbr0) -- MAAS DHCP (D-114/D-115)", + "is_pool": false, + "mark_utilized": false, + "prefix": "10.10.1.0/24", + "role": "office", + "scope_site": "vr1-off1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "Virtual Cloud IPs", + "is_pool": false, + "mark_utilized": false, + "prefix": "10.12.0.0/16", + "role": "cloud", + "scope_type": null, + "status": "active" + }, + { + "description": "VR1 DC0 provider-public (v4; D-101)", + "is_pool": false, + "mark_utilized": false, + "prefix": "10.12.4.0/22", + "role": "provider-public", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 metal-admin (v4; D-101)", + "is_pool": false, + "mark_utilized": false, + "prefix": "10.12.8.0/22", + "role": "metal-admin", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 metal-internal (v4; D-101)", + "is_pool": false, + "mark_utilized": false, + "prefix": "10.12.12.0/22", + "role": "metal-internal", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 data-tenant (v4; D-101)", + "is_pool": false, + "mark_utilized": false, + "prefix": "10.12.16.0/22", + "role": "data-tenant", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 storage (v4; D-101)", + "is_pool": false, + "mark_utilized": false, + "prefix": "10.12.32.0/22", + "role": "storage", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 replication (v4; D-101)", + "is_pool": false, + "mark_utilized": false, + "prefix": "10.12.36.0/22", + "role": "replication", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC1 provider-public (v4; D-101)", + "is_pool": false, + "mark_utilized": false, + "prefix": "10.12.64.0/22", + "role": "provider-public", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC1 metal-admin (v4; D-101)", + "is_pool": false, + "mark_utilized": false, + "prefix": "10.12.68.0/22", + "role": "metal-admin", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC1 metal-internal (v4; D-101)", + "is_pool": false, + "mark_utilized": false, + "prefix": "10.12.72.0/22", + "role": "metal-internal", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC1 data-tenant (v4; D-101)", + "is_pool": false, + "mark_utilized": false, + "prefix": "10.12.76.0/22", + "role": "data-tenant", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC1 storage (v4; D-101)", + "is_pool": false, + "mark_utilized": false, + "prefix": "10.12.80.0/22", + "role": "storage", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC1 replication (v4; D-101)", + "is_pool": false, + "mark_utilized": false, + "prefix": "10.12.84.0/22", + "role": "replication", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "Current assignment to Willamette dev cloud", + "is_pool": false, + "mark_utilized": false, + "prefix": "10.16.0.0/16", + "role": "dc", + "scope_type": null, + "status": "deprecated" + }, + { + "description": "Current assignment to Roosevelt dev cloud", + "is_pool": false, + "mark_utilized": false, + "prefix": "10.17.0.0/16", + "role": "dc", + "scope_type": null, + "status": "deprecated" + }, + { + "description": "Public ARIN assignment to Abysius Inc", + "is_pool": false, + "mark_utilized": false, + "prefix": "23.157.124.0/24", + "role": "public", + "scope_type": null, + "status": "container" + }, + { + "description": "CGNAT Reserved", + "is_pool": false, + "mark_utilized": false, + "prefix": "100.64.0.0/10", + "role": "cgnat", + "scope_type": null, + "status": "reserved" + }, + { + "description": "Localhost", + "is_pool": false, + "mark_utilized": false, + "prefix": "127.0.0.0/8", + "role": "localhost", + "scope_type": null, + "status": "reserved" + }, + { + "description": "Link-Local", + "is_pool": false, + "mark_utilized": false, + "prefix": "169.254.0.0/16", + "role": "link-local", + "scope_type": null, + "status": "reserved" + }, + { + "description": "Corp OOB Private", + "is_pool": false, + "mark_utilized": false, + "prefix": "172.16.0.0/12", + "role": "private", + "scope_type": null, + "status": "container" + }, + { + "description": "Edge (v4) -- simulated ISP/WAN segments; mirrors v6 2602:f3e2:fe::/48 (D-115)", + "is_pool": false, + "mark_utilized": false, + "prefix": "172.30.0.0/16", + "role": "edge", + "scope_type": null, + "status": "container" + }, + { + "description": "VR1 Off1 office1-wan -- simulated ISP uplink (D-115)", + "is_pool": false, + "mark_utilized": false, + "prefix": "172.30.1.0/24", + "role": "edge", + "scope_site": "vr1-off1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "vr1-dc0 simulated-ISP edge WAN (D-115)", + "is_pool": false, + "mark_utilized": false, + "prefix": "172.30.2.0/24", + "role": "edge", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "vr1-dc1 simulated-ISP edge WAN (D-115)", + "is_pool": false, + "mark_utilized": false, + "prefix": "172.30.3.0/24", + "role": "edge", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "Transit (v4) -- dedicated per-DC point-to-point transit supernet (D-124, operator-pinned 2026-07-16); UNSCOPED container, each DC's link scoped to its site. Precondition for dc-rack-mgmt-import.", + "is_pool": false, + "mark_utilized": false, + "prefix": "172.31.0.0/24", + "role": "transit", + "scope_type": null, + "status": "container" + }, + { + "description": "office1<->dc0 management transit -- region<->rack MAAS control path (D-124 Scheme A)", + "is_pool": false, + "mark_utilized": false, + "prefix": "172.31.0.0/30", + "role": "transit", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "office1<->dc1 management transit -- region<->rack MAAS control path (D-124 Scheme A)", + "is_pool": false, + "mark_utilized": false, + "prefix": "172.31.0.4/30", + "role": "transit", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "Residential Private", + "is_pool": false, + "mark_utilized": false, + "prefix": "192.168.0.0/16", + "role": "private", + "scope_type": null, + "status": "reserved" + }, + { + "description": "Public Multicast", + "is_pool": false, + "mark_utilized": false, + "prefix": "224.0.0.0/4", + "role": "multicast", + "scope_type": null, + "status": "reserved" + }, + { + "description": "Public Reserved - Enterprise Private", + "is_pool": false, + "mark_utilized": false, + "prefix": "240.0.0.0/4", + "role": "private", + "scope_type": null, + "status": "container" + }, + { + "description": "Localhost", + "is_pool": false, + "mark_utilized": false, + "prefix": "::1/128", + "role": "localhost", + "scope_type": null, + "status": "reserved" + }, + { + "description": "Discard Prefix", + "is_pool": false, + "mark_utilized": false, + "prefix": "100::/64", + "role": "discard", + "scope_type": null, + "status": "reserved" + }, + { + "description": "Public ARIN assignment to Abysius Inc", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2::/36", + "role": "public", + "scope_type": null, + "status": "container" + }, + { + "description": "Inter-Regional Infrastructure", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2::/40", + "role": "infra", + "scope_type": null, + "status": "container" + }, + { + "description": "Inter-Regional Site to Site Links", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2::/48", + "role": "infra", + "scope_type": null, + "status": "container" + }, + { + "description": "Edge Networks", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:fe::/48", + "role": null, + "scope_type": null, + "status": "container" + }, + { + "description": "Private cloud tenant reservation", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:ff::/48", + "role": "openstack-tenant", + "scope_type": null, + "status": "reserved" + }, + { + "description": "Eugene Region; Sites receive /24 allocations starting at fc01:0100::/24", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:100::/40", + "role": "region", + "scope_region": "eugene", + "scope_type": "dcim.region", + "status": "container" + }, + { + "description": "Eugene Regional Infrastructure", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:100::/48", + "role": "infra", + "scope_region": "eugene", + "scope_type": "dcim.region", + "status": "container" + }, + { + "description": "Eugene Site to Site Links", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:100::/56", + "role": "infra", + "scope_region": "eugene", + "scope_type": "dcim.region", + "status": "container" + }, + { + "description": "Eugene Regional Offices; Offices are allocated /32 subnets", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:101::/48", + "role": "office", + "scope_region": "eugene", + "scope_type": "dcim.region", + "status": "container" + }, + { + "description": "Reserved for fun and profit", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:101::/56", + "role": "office", + "scope_region": "eugene", + "scope_type": "dcim.region", + "status": "reserved" + }, + { + "description": "Charnelton", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:101:100::/56", + "role": "office", + "scope_site": "charnelton", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "Willamette Site", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102::/48", + "role": "dc", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "Omega Cloud", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102::/56", + "role": "cloud", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102:10::/60", + "role": "provider", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102:10::/64", + "role": "provider", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "Willamette Omega Cloud \u2014 Provider API VIPs (charm-managed via hacluster; excluded from Neutron pools)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102:11::/64", + "role": "provider", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102:20::/60", + "role": "metal", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102:20::/64", + "role": "metal", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102:30::/60", + "role": "data", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102:30::/64", + "role": "data", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102:40::/60", + "role": "storage", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102:40::/64", + "role": "storage", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102:50::/60", + "role": "repl", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102:50::/64", + "role": "repl", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102:80::/60", + "role": "lbaas-mgmt", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102:80::/64", + "role": "lbaas-mgmt", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102:e0::/60", + "role": "vpn", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102:f0::/60", + "role": "oob", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102:f0::/64", + "role": "oob", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "Psi Cloud", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102:100::/56", + "role": "cloud", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "Beta Cloud", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102:1600::/56", + "role": "cloud", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "Alpha Cloud", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102:1700::/56", + "role": "cloud", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "Roosevelt Site", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:103::/48", + "role": "dc", + "scope_site": "roosevelt", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "Second Region", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:200::/40", + "role": "region", + "scope_type": null, + "status": "reserved" + }, + { + "description": "Third Region", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:300::/40", + "role": "region", + "scope_type": null, + "status": "reserved" + }, + { + "description": "Virtual Region 0 (VR0)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e00::/40", + "role": "region", + "scope_region": "vr0", + "scope_type": "dcim.region", + "status": "container" + }, + { + "description": "Virtual Region 0 (VR0) Infrastructure", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e00::/48", + "role": "infra", + "scope_region": "vr0", + "scope_type": "dcim.region", + "status": "container" + }, + { + "description": "VR0 Site to Site Links", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e00::/56", + "role": "infra", + "scope_region": "vr0", + "scope_type": "dcim.region", + "status": "active" + }, + { + "description": "VR0 DC1 to DC0 Site to Site Link", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e00:1::/127", + "role": "infra", + "scope_region": "vr0", + "scope_type": "dcim.region", + "status": "active" + }, + { + "description": "VR0 Off0 to DC0 Site to Site Link", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e00:2::/127", + "role": "infra", + "scope_region": "vr0", + "scope_type": "dcim.region", + "status": "active" + }, + { + "description": "Virtual Region 0 (VR0) Offices", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e01::/48", + "role": "office", + "scope_region": "vr0", + "scope_type": "dcim.region", + "status": "container" + }, + { + "description": "Virtual Region 0 (VR0) Offices; Reserved for fun and profit", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e01::/56", + "role": "office", + "scope_region": "vr0", + "scope_type": "dcim.region", + "status": "reserved" + }, + { + "description": "Virtual Region 0 (VR0) Office 0 (Off0)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e01:100::/56", + "role": "office", + "scope_site": "vr0-off0", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "VR0 Off0 Office Subnet", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e01:100::/64", + "role": "office", + "scope_site": "vr0-off0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "Virtual Region 0 (VR0) Datacenter 0 (DC0)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e02::/48", + "role": "dc", + "scope_site": "vr0-dc0", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "VR0 DC0 Omega Cloud", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e02::/56", + "role": "cloud", + "scope_site": "vr0-dc0", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "VR0 DC0 Omega Cloud Provider Prefix", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e02:10::/60", + "role": "provider", + "scope_site": "vr0-dc0", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "VR0 DC0 Omega Cloud Provider Subnet", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e02:10::/64", + "role": "provider", + "scope_site": "vr0-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR0 DC0 Omega Cloud \u2014 Provider API VIPs (charm-managed via hacluster; excluded from Neutron pools)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e02:11::/64", + "role": "provider", + "scope_site": "vr0-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR0 DC0 Omega Cloud Metal Prefix", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e02:20::/60", + "role": "metal", + "scope_site": "vr0-dc0", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "VR0 DC0 Omega Cloud Metal Subnet", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e02:20::/64", + "role": "metal", + "scope_site": "vr0-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR0 DC0 Omega Cloud Data Prefix", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e02:30::/60", + "role": "data", + "scope_site": "vr0-dc0", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "VR0 DC0 Omega Cloud Data Subnet", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e02:30::/64", + "role": "data", + "scope_site": "vr0-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR0 DC0 Omega Cloud Storage Prefix", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e02:40::/60", + "role": "storage", + "scope_site": "vr0-dc0", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "VR0 DC0 Omega Cloud Storage Subnet", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e02:40::/64", + "role": "storage", + "scope_site": "vr0-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR0 DC0 Omega Cloud Replication Prefix", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e02:50::/60", + "role": "repl", + "scope_site": "vr0-dc0", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "VR0 DC0 Omega Cloud Replication Subnet", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e02:50::/64", + "role": "repl", + "scope_site": "vr0-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR0 DC0 Omega Cloud LBaaS Management Prefix", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e02:80::/60", + "role": "lbaas-mgmt", + "scope_site": "vr0-dc0", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "VR0 DC0 Omega Cloud LBaaS Management Subnet", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e02:80::/64", + "role": "lbaas-mgmt", + "scope_site": "vr0-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR0 DC0 Omega Cloud VPN Prefix", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e02:e0::/60", + "role": "vpn", + "scope_site": "vr0-dc0", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "VR0 DC0 Omega Cloud OOB Prefix", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e02:f0::/60", + "role": "oob", + "scope_site": "vr0-dc0", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "VR0 DC0 Omega Cloud OOB Subnet", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e02:f0::/64", + "role": "oob", + "scope_site": "vr0-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "Virtual Region 0 (VR0) Datacenter 1 (DC1)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e03::/48", + "role": "dc", + "scope_site": "vr0-dc1", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "Virtual Region 1 (VR1)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f00::/40", + "role": "region", + "scope_region": "vr1", + "scope_type": "dcim.region", + "status": "container" + }, + { + "description": "Virtual Region 1 (VR1) Infrastructure", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f00::/48", + "role": "infra", + "scope_region": "vr1", + "scope_type": "dcim.region", + "status": "container" + }, + { + "description": "VR1 Site to Site Links", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f00::/56", + "role": "infra", + "scope_region": "vr1", + "scope_type": "dcim.region", + "status": "active" + }, + { + "description": "Virtual Region 1 (VR1) Offices", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f01::/48", + "role": "office", + "scope_region": "vr1", + "scope_type": "dcim.region", + "status": "container" + }, + { + "description": "Virtual Region 1 (VR1) Offices; Reserved for fun and profit", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f01::/56", + "role": "office", + "scope_region": "vr1", + "scope_type": "dcim.region", + "status": "reserved" + }, + { + "description": "VR1 Off1 (D-115) -- mirrors VR0 Off0 e01:100::/56", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f01:100::/56", + "role": "office", + "scope_site": "vr1-off1", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "VR1 Off1 office subnet -- NOT YET DEPLOYED (v6 does not egress the lab)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f01:100::/64", + "role": "office", + "scope_site": "vr1-off1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "Virtual Region 1 (VR1) Datacenter 0 (DC0)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f02::/48", + "role": "dc", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "VR1 DC0 provider-public (GUA /60; D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f02:10::/60", + "role": "provider-public", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 provider-public (GUA /64 active; D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f02:10::/64", + "role": "provider-public", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 provider-public (GUA VIP /64; D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f02:11::/64", + "role": "provider-public", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 metal-admin (GUA /60; D-139)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f02:20::/60", + "role": "metal-admin", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 metal-admin (GUA /64; D-139)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f02:20::/64", + "role": "metal-admin", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 metal-internal (GUA /64; D-139)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f02:21::/64", + "role": "metal-internal", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 data-tenant (GUA /60; D-139)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f02:30::/60", + "role": "data-tenant", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 data-tenant (GUA /64; D-139)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f02:30::/64", + "role": "data-tenant", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 storage (GUA /60; D-139)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f02:40::/60", + "role": "storage", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 storage (GUA /64; D-139)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f02:40::/64", + "role": "storage", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 replication (GUA /60; D-139)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f02:50::/60", + "role": "replication", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 replication (GUA /64; D-139)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f02:50::/64", + "role": "replication", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 lb-mgmt (GUA /60; D-139)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f02:80::/60", + "role": "lbaas-mgmt", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 lb-mgmt (GUA /64; D-139)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f02:80::/64", + "role": "lbaas-mgmt", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 oob (GUA /60; D-139)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f02:f0::/60", + "role": "oob", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 oob (GUA /64; D-139)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f02:f0::/64", + "role": "oob", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "Virtual Region 1 (VR1) Datacenter 1 (DC1)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f03::/48", + "role": "dc", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "VR1 DC1 provider-public (GUA /60; D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f03:10::/60", + "role": "provider-public", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC1 provider-public (GUA /64 active; D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f03:10::/64", + "role": "provider-public", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC1 provider-public (GUA VIP /64; D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f03:11::/64", + "role": "provider-public", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "Centrally assigned ULA (Not Active)", + "is_pool": false, + "mark_utilized": false, + "prefix": "fc00::/8", + "role": "private", + "scope_type": null, + "status": "reserved" + }, + { + "description": "Unique Local Addresses (ULA)", + "is_pool": false, + "mark_utilized": false, + "prefix": "fd00::/8", + "role": "private", + "scope_type": null, + "status": "container" + }, + { + "description": "VR1 DC0 metal-admin (ULA metal /60 (admin+internal); D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "fd50:840e:74e2:220::/60", + "role": "metal-admin", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 metal-admin (ULA /64 active; D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "fd50:840e:74e2:220::/64", + "role": "metal-admin", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 metal-internal (ULA /64 active (in metal /60); D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "fd50:840e:74e2:221::/64", + "role": "metal-internal", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 data-tenant (ULA /60; D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "fd50:840e:74e2:230::/60", + "role": "data-tenant", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 data-tenant (ULA /64 active; D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "fd50:840e:74e2:230::/64", + "role": "data-tenant", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 storage (ULA /60; D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "fd50:840e:74e2:240::/60", + "role": "storage", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 storage (ULA /64 active; D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "fd50:840e:74e2:240::/64", + "role": "storage", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 replication (ULA /60; D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "fd50:840e:74e2:250::/60", + "role": "replication", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 replication (ULA /64 active; D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "fd50:840e:74e2:250::/64", + "role": "replication", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC1 metal-admin (ULA metal /60 (admin+internal); D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "fd50:840e:74e2:320::/60", + "role": "metal-admin", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC1 metal-admin (ULA /64 active; D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "fd50:840e:74e2:320::/64", + "role": "metal-admin", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC1 metal-internal (ULA /64 active (in metal /60); D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "fd50:840e:74e2:321::/64", + "role": "metal-internal", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC1 data-tenant (ULA /60; D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "fd50:840e:74e2:330::/60", + "role": "data-tenant", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC1 data-tenant (ULA /64 active; D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "fd50:840e:74e2:330::/64", + "role": "data-tenant", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC1 storage (ULA /60; D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "fd50:840e:74e2:340::/60", + "role": "storage", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC1 storage (ULA /64 active; D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "fd50:840e:74e2:340::/64", + "role": "storage", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC1 replication (ULA /60; D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "fd50:840e:74e2:350::/60", + "role": "replication", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC1 replication (ULA /64 active; D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "fd50:840e:74e2:350::/64", + "role": "replication", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "Tailscale Addresses", + "is_pool": false, + "mark_utilized": true, + "prefix": "fd7a:115c:a1e0::/48", + "role": "vpn", + "scope_type": null, + "status": "active" + }, + { + "description": "Link-Local", + "is_pool": false, + "mark_utilized": false, + "prefix": "fe80::/10", + "role": "link-local", + "scope_type": null, + "status": "reserved" + }, + { + "description": "Public Multicast", + "is_pool": false, + "mark_utilized": false, + "prefix": "ff00::/8", + "role": "multicast", + "scope_type": null, + "status": "reserved" + } + ], + "ipam/rirs": [ + { + "description": "", + "is_private": false, + "name": "ARIN", + "slug": "arin" + }, + { + "description": "", + "is_private": true, + "name": "RFC 1918", + "slug": "rfc-1918" + }, + { + "description": "", + "is_private": true, + "name": "RFC 4193 ULA", + "slug": "rfc-4193-ula" + } + ], + "ipam/roles": [ + { + "description": "Six-plane: provider public API VIPs + FIP/ext_net (GUA). D-052/D-101.", + "name": "Provider Public", + "slug": "provider-public", + "weight": 100 + }, + { + "description": "Six-plane: metal admin API, dual-stack v4+ULA (2026-07-09 amendment). D-052/D-101.", + "name": "Metal Admin", + "slug": "metal-admin", + "weight": 110 + }, + { + "description": "Six-plane: metal internal API endpoints, dual-stack v4+ULA. D-052/D-101.", + "name": "Metal Internal", + "slug": "metal-internal", + "weight": 120 + }, + { + "description": "Six-plane: geneve overlay, ULA-only; tenant GUA delegated separately. D-052/D-101.", + "name": "Data Tenant", + "slug": "data-tenant", + "weight": 130 + }, + { + "description": "Six-plane: Ceph cluster incl. cross-DC leg, ULA-only. D-052/D-101/D-108.", + "name": "Replication Plane", + "slug": "replication", + "weight": 150 + }, + { + "description": "", + "name": "CGNAT", + "slug": "cgnat", + "weight": 1000 + }, + { + "description": "Cloud container", + "name": "Cloud", + "slug": "cloud", + "weight": 1000 + }, + { + "description": "Openstack data plane - shared across datacenters", + "name": "Data", + "slug": "data", + "weight": 1000 + }, + { + "description": "Datacenter container", + "name": "Datacenter", + "slug": "dc", + "weight": 1000 + }, + { + "description": "", + "name": "Discard", + "slug": "discard", + "weight": 1000 + }, + { + "description": "", + "name": "Edge", + "slug": "edge", + "weight": 1000 + }, + { + "description": "Shared infrastructure \u2014 ptp transit, device loopbacks, RR loopbacks, anycast.", + "name": "Infrastructure", + "slug": "infra", + "weight": 1000 + }, + { + "description": "Load-balancer management (Octavia control plane, not dataplane).", + "name": "LBaaS Management", + "slug": "lbaas-mgmt", + "weight": 1000 + }, + { + "description": "", + "name": "Link-Local", + "slug": "link-local", + "weight": 1000 + }, + { + "description": "", + "name": "Localhost", + "slug": "localhost", + "weight": 1000 + }, + { + "description": "", + "name": "Localnet", + "slug": "localnet", + "weight": 1000 + }, + { + "description": "Bare-metal server NICs + bundled infra: OpenStack control plane, in-band switch mgmt (VLAN 50), Edge-eBGP/DDoS sub-ranges (Roosevelt), RR loopback references. Sized as 2x physical server count.", + "name": "Metal", + "slug": "metal", + "weight": 1000 + }, + { + "description": "", + "name": "Multicast", + "slug": "multicast", + "weight": 1000 + }, + { + "description": "Out of band management network", + "name": "OOB", + "slug": "oob", + "weight": 1000 + }, + { + "description": "Office site allocation (/24 within Region0 /20 reserved block).", + "name": "Office", + "slug": "office", + "weight": 1000 + }, + { + "description": "OpenStack tenant pool \u2014 shared across tenants", + "name": "Openstack Tenant", + "slug": "openstack-tenant", + "weight": 1000 + }, + { + "description": "Reserved addresses for private networks", + "name": "Private", + "slug": "private", + "weight": 1000 + }, + { + "description": "Tenant-reachable. Carries ext_net (FIPs, SNAT egress) and OpenStack public API VIPs. Within each /60: first /64 Neutron FIP pool; next /64 charm API VIPs. Neutron allocation_pools must exclude VIPs.", + "name": "Provider", + "slug": "provider", + "weight": 1000 + }, + { + "description": "Public addresses assigned by a RIR", + "name": "Public", + "slug": "public", + "weight": 1000 + }, + { + "description": "", + "name": "Region", + "slug": "region", + "weight": 1000 + }, + { + "description": "RBD mirror for cross-site Ceph replication. Routed via EVPN type-5 between DCs.", + "name": "Replication", + "slug": "repl", + "weight": 1000 + }, + { + "description": "Ceph-Public (L3-routed) + Ceph-Cluster (non-routed VLAN inside /23 L2).", + "name": "Storage", + "slug": "storage", + "weight": 1000 + }, + { + "description": "OpenStack tenant networks (Geneve underlay touchdown). Also absorbs DMZ roles under regional scheme.", + "name": "Tenant", + "slug": "tenant", + "weight": 1000 + }, + { + "description": "", + "name": "Transit", + "slug": "transit", + "weight": 1000 + }, + { + "description": "VPN client pools \u2014 site-independent (10.2.0.0/16 Corp Private).", + "name": "VPN", + "slug": "vpn", + "weight": 1000 + } + ] +} diff --git a/overlays/vr1-dc0-vips.yaml b/overlays/vr1-dc0-vips.yaml index a4926d4..1b7ba15 100644 --- a/overlays/vr1-dc0-vips.yaml +++ b/overlays/vr1-dc0-vips.yaml @@ -33,40 +33,40 @@ applications: keystone: options: - vip: "10.12.4.50 10.12.8.50 10.12.12.50 2602:f3e2:f02:11::50 fd50:840e:74e2:220::50 fd50:840e:74e2:221::50" # B1 front-loaded VIP; IS the catalog endpoint (B5, no os-public-hostname) + vip: "10.12.4.50 10.12.8.50 10.12.12.50 2602:f3e2:f02:11::50 2602:f3e2:f02:20::50 2602:f3e2:f02:21::50" # B1 front-loaded VIP; IS the catalog endpoint (B5, no os-public-hostname) barbican: options: - vip: "10.12.4.51 10.12.8.51 10.12.12.51 2602:f3e2:f02:11::51 fd50:840e:74e2:220::51 fd50:840e:74e2:221::51" # B1 + vip: "10.12.4.51 10.12.8.51 10.12.12.51 2602:f3e2:f02:11::51 2602:f3e2:f02:20::51 2602:f3e2:f02:21::51" # B1 cinder: options: - vip: "10.12.4.52 10.12.8.52 10.12.12.52 2602:f3e2:f02:11::52 fd50:840e:74e2:220::52 fd50:840e:74e2:221::52" # B1 + vip: "10.12.4.52 10.12.8.52 10.12.12.52 2602:f3e2:f02:11::52 2602:f3e2:f02:20::52 2602:f3e2:f02:21::52" # B1 glance: options: - vip: "10.12.4.53 10.12.8.53 10.12.12.53 2602:f3e2:f02:11::53 fd50:840e:74e2:220::53 fd50:840e:74e2:221::53" # B1 + vip: "10.12.4.53 10.12.8.53 10.12.12.53 2602:f3e2:f02:11::53 2602:f3e2:f02:20::53 2602:f3e2:f02:21::53" # B1 magnum: options: - vip: "10.12.4.54 10.12.8.54 10.12.12.54 2602:f3e2:f02:11::54 fd50:840e:74e2:220::54 fd50:840e:74e2:221::54" # B1 + vip: "10.12.4.54 10.12.8.54 10.12.12.54 2602:f3e2:f02:11::54 2602:f3e2:f02:20::54 2602:f3e2:f02:21::54" # B1 neutron-api: options: - vip: "10.12.4.55 10.12.8.55 10.12.12.55 2602:f3e2:f02:11::55 fd50:840e:74e2:220::55 fd50:840e:74e2:221::55" # B1 + vip: "10.12.4.55 10.12.8.55 10.12.12.55 2602:f3e2:f02:11::55 2602:f3e2:f02:20::55 2602:f3e2:f02:21::55" # B1 nova-cloud-controller: options: - vip: "10.12.4.56 10.12.8.56 10.12.12.56 2602:f3e2:f02:11::56 fd50:840e:74e2:220::56 fd50:840e:74e2:221::56" # B1 + vip: "10.12.4.56 10.12.8.56 10.12.12.56 2602:f3e2:f02:11::56 2602:f3e2:f02:20::56 2602:f3e2:f02:21::56" # B1 octavia: options: - vip: "10.12.4.57 10.12.8.57 10.12.12.57 2602:f3e2:f02:11::57 fd50:840e:74e2:220::57 fd50:840e:74e2:221::57" # B1 + vip: "10.12.4.57 10.12.8.57 10.12.12.57 2602:f3e2:f02:11::57 2602:f3e2:f02:20::57 2602:f3e2:f02:21::57" # B1 openstack-dashboard: options: - vip: "10.12.4.58 10.12.8.58 10.12.12.58 2602:f3e2:f02:11::58 fd50:840e:74e2:220::58 fd50:840e:74e2:221::58" # B1 -- browse HTTPS by IP (B5); ALLOWED_HOSTS must permit the VIP IP (verify at deploy) + vip: "10.12.4.58 10.12.8.58 10.12.12.58 2602:f3e2:f02:11::58 2602:f3e2:f02:20::58 2602:f3e2:f02:21::58" # B1 -- browse HTTPS by IP (B5); ALLOWED_HOSTS must permit the VIP IP (verify at deploy) placement: options: - vip: "10.12.4.59 10.12.8.59 10.12.12.59 2602:f3e2:f02:11::59 fd50:840e:74e2:220::59 fd50:840e:74e2:221::59" # B1 + vip: "10.12.4.59 10.12.8.59 10.12.12.59 2602:f3e2:f02:11::59 2602:f3e2:f02:20::59 2602:f3e2:f02:21::59" # B1 ceph-radosgw: options: - vip: "10.12.4.60 10.12.8.60 10.12.12.60 2602:f3e2:f02:11::60 fd50:840e:74e2:220::60 fd50:840e:74e2:221::60" # B1 -- radosgw HA un-deferred for Roosevelt fidelity (decorative HA on testcloud) + vip: "10.12.4.60 10.12.8.60 10.12.12.60 2602:f3e2:f02:11::60 2602:f3e2:f02:20::60 2602:f3e2:f02:21::60" # B1 -- radosgw HA un-deferred for Roosevelt fidelity (decorative HA on testcloud) vault: options: - vip: "10.12.4.61 10.12.8.61 10.12.12.61 2602:f3e2:f02:11::61 fd50:840e:74e2:220::61 fd50:840e:74e2:221::61" # R11 (D-020 amendment) -- was ruled in D-020's own enumeration and never built + vip: "10.12.4.61 10.12.8.61 10.12.12.61 2602:f3e2:f02:11::61 2602:f3e2:f02:20::61 2602:f3e2:f02:21::61" # R11 (D-020 amendment) -- was ruled in D-020's own enumeration and never built designate: options: - vip: "10.12.4.62 10.12.8.62 10.12.12.62 2602:f3e2:f02:11::62 fd50:840e:74e2:220::62 fd50:840e:74e2:221::62" # R11 (D-020 amendment) -- NEW to D-020's enumeration; dnsaas is already provider-bound + vip: "10.12.4.62 10.12.8.62 10.12.12.62 2602:f3e2:f02:11::62 2602:f3e2:f02:20::62 2602:f3e2:f02:21::62" # R11 (D-020 amendment) -- NEW to D-020's enumeration; dnsaas is already provider-bound diff --git a/render/values/vr1-dc0-vips.yaml b/render/values/vr1-dc0-vips.yaml index fedaff3..73b1c61 100644 --- a/render/values/vr1-dc0-vips.yaml +++ b/render/values/vr1-dc0-vips.yaml @@ -12,9 +12,10 @@ source_v4: scripts/lib-net.sh lib_net_select_dc vr1-dc0 prefixes_v6: provider-public: 2602:f3e2:f02:11 - metal-admin: fd50:840e:74e2:220 - metal-internal: fd50:840e:74e2:221 -apex_record: netbox/draft/vr1-office1-current-20260725.json + metal-admin: 2602:f3e2:f02:20 + metal-internal: 2602:f3e2:f02:21 +apex_record: netbox/draft/vr1-office1-current-20260801.json +v6_family: gua apps: - name: keystone octet: 50 diff --git a/scripts/provider-bundle-check.py b/scripts/provider-bundle-check.py index 62acc2e..28da39e 100644 --- a/scripts/provider-bundle-check.py +++ b/scripts/provider-bundle-check.py @@ -220,7 +220,14 @@ out[k] = v return out -def _apex_v6_bands(dc): +def _v6_family(x): + """'ula' for fc00::/7, else 'gua'. Mirrors render-dc-overlays.py:v6_family.""" + n = ipaddress.ip_network(x, strict=False) if "/" in str(x) else \ + ipaddress.ip_network(str(x) + "/128", strict=False) + return "ula" if n.subnet_of(ipaddress.ip_network("fc00::/7")) else "gua" + + +def _apex_v6_bands(dc, leg_addrs=None): """The three v6 VIP-leg /64s for `dc`, read from the NetBox apex record. Returns (bands, None) on success or (None, reason) -- a reason is a REFUSAL @@ -262,20 +269,42 @@ # spare prefix to the apex re-homed every dc0 VIP into a different /64 and the # whole chain went GREEN. Which one won depended on JSON array order, which is # not a contract. - if (role, kind) in found and found[(role, kind)] != pre: - return None, ("apex record %s has TWO %s/%s /64s for %s (%s and %s) -- refusing " + fam = _v6_family(pre) + if (role, kind, fam) in found and found[(role, kind, fam)] != pre: + return None, ("apex record %s has TWO %s %s/%s /64s for %s (%s and %s) -- refusing " "to pick one by array order" - % (rec, role, kind, dc, found[(role, kind)], pre)) - found[(role, kind)] = pre + % (rec, fam, role, kind, dc, found[(role, kind, fam)], pre)) + found[(role, kind, fam)] = pre + # Per-LEG family resolution (2026-08-01). Mid-D-139 the three legs legitimately sit + # in DIFFERENT families: provider-public's VIP /64 is GUA in both worlds (:11::), while + # metal-admin/metal-internal are ULA until their DC's step-1 push lands. Inferring ONE + # family for all three -- which a first cut of this fix did, from the provider leg -- + # asked for GUA bands on a still-ULA DC and refused every dc1 fixture. Caught by the + # harness, not by review. want = (("provider", ("provider-public", "vip")), ("admin", ("metal-admin", "plane")), ("internal", ("metal-internal", "plane"))) bands, missing = {}, [] - for leg, key in want: - if key in found: - bands[leg] = ipaddress.ip_network(found[key]) + for i, (leg, key) in enumerate(want): + fams = sorted({f for (r, k, f) in found if (r, k) == key}) + if leg_addrs and i < len(leg_addrs): + try: + fam = _v6_family(leg_addrs[i]) # the family of THIS leg + except Exception: + fam = None else: - missing.append("%s/%s" % key) + fam = None + if fam is None: + if len(fams) > 1: + return None, ("apex record %s has BOTH families for %s/%s in %s (%s) -- the " + "expected D-139 transition state; the caller must supply the " + "leg being checked. Refusing to pick one by array order" + % (rec, key[0], key[1], dc, ", ".join(fams))) + fam = fams[0] if fams else None + if fam is not None and (key[0], key[1], fam) in found: + bands[leg] = ipaddress.ip_network(found[(key[0], key[1], fam)]) + else: + missing.append("%s/%s%s" % (key[0], key[1], (" (%s)" % fam) if fam else "")) if missing: return None, ("apex record %s carries no v6 prefix for %s in %s -- refusing to " "guess a VIP band" % (rec, ", ".join(missing), dc)) @@ -359,6 +388,7 @@ # A vip is a v4 TRIPLE (3) or, under R2's ruled dual-stack, a dual-family # SEXTET (6) appending the v6 provider/admin/internal legs. v6_bands, v6_refusal = None, None + _bandcache = {} vip_ok = vip_dual = 0 octet_owner = {} @@ -422,8 +452,22 @@ "The v6 VIP legs stay; the option does not -- the LXD containers " "hold only a link-local v6, so a charm that advertises v6 for " "every relation dies in its install hook" % n); continue - if dual and v6_bands is None and v6_refusal is None: - v6_bands, v6_refusal = _apex_v6_bands(args.dc) + if dual: + # Resolved PER APPLICATION and PER LEG, not once for the whole bundle. The + # gate's question is "is this leg inside the apex band for its role", and + # mid-D-139 legs legitimately differ in family -- provider-public's VIP /64 is + # GUA in both worlds while metal-admin/internal are ULA until their DC's step-1 + # push lands. A FIRST cut of this fix resolved the bands ONCE from the first + # app's legs and reused them for all thirteen; that silently graded every later + # app against the first app's families and broke seven dc1 harness cases. + # Caught by the harness, not by review. Cached on the family triple so the + # record is still read once per distinct shape, not once per app. + _famkey = tuple(_v6_family(x) if x else None for x in parts[3:6]) + if _famkey in _bandcache: + v6_bands, v6_refusal = _bandcache[_famkey] + else: + v6_bands, v6_refusal = _apex_v6_bands(args.dc, parts[3:6]) + _bandcache[_famkey] = (v6_bands, v6_refusal) if dual and v6_bands is None: sys.stderr.write("ERROR: cannot evaluate %s's dual-family vip: %s\n" % (n, v6_refusal)) return 2 diff --git a/scripts/render-dc-overlays.py b/scripts/render-dc-overlays.py index 3f68b84..4710f83 100755 --- a/scripts/render-dc-overlays.py +++ b/scripts/render-dc-overlays.py @@ -162,9 +162,29 @@ return dict(l.split("\t") for l in p.stdout.strip().splitlines()) -def apex_v6(dc): +def v6_family(prefix): + """'ula' for fc00::/7, else 'gua'. The ONE place family is decided.""" + return "ula" if ipaddress.ip_network(prefix).subnet_of( + ipaddress.ip_network("fc00::/7")) else "gua" + + +def apex_v6(dc, family=None): """(role, kind) -> v6 /64 for `dc`, from the apex record. + FAMILY (added 2026-08-01). D-139's ruled execution list has the GUA carve + created ALONGSIDE the ULA rows at step 1 and the ULA rows retired only at + step 6, so for the WHOLE migration window every v6-only plane has TWO /64s + under one (role, kind) key. Keyed without a family dimension this function + could only ever REFUSE -- measured live 2026-08-01, immediately after the + step-1 push: "has TWO metal-admin/plane /64s ... refusing to pick one by + array order", rc=2, which made `derive --dual-family` unrunnable for the + entire transition it exists to serve. + + The refusal is KEPT, not weakened. What changes is that the caller can now + SAY which family it wants; ambiguity with no `family` given still refuses, + and two prefixes in the SAME family under one key still refuses -- that is + the original 2026-07-29 defect and it is untouched. + Scope matching is the THREE-WAY form (scope.slug / scope.name / scope_site). The live API returns scope.name as a DISPLAY name with scope.slug as the site key, while the repo dumps flatten to scope_site -- a tool written against one @@ -191,18 +211,29 @@ role = p.get("role") or "" role = role.get("slug") if isinstance(role, dict) else role key = (role, "vip" if "VIP" in str(p.get("description") or "") else "plane") - # REFUSE on a duplicate key. Measured (2026-07-29 chain audit): this loop was - # last-writer-wins, so adding ONE spare prefix to the apex -- routine IPAM work -- - # silently re-homed every dc0 VIP into a different /64 and the whole chain went - # GREEN, because the gate only checks overlay-vs-apex AGREEMENT and both read the - # same wrong value. Which prefix won depended on JSON array order, which is not a - # contract. + fam = v6_family(pre) + if family and fam != family: + continue # caller asked for one family; this is the other + # REFUSE on a duplicate key WITHIN a family. Measured (2026-07-29 chain audit): + # this loop was last-writer-wins, so adding ONE spare prefix to the apex -- routine + # IPAM work -- silently re-homed every dc0 VIP into a different /64 and the whole + # chain went GREEN, because the gate only checks overlay-vs-apex AGREEMENT and both + # read the same wrong value. Which prefix won depended on JSON array order, which is + # not a contract. UNCHANGED by the 2026-08-01 family work. if key in out and out[key] != pre: - die("apex record %s has TWO %s/%s /64s for %s (%s and %s) -- refusing to pick " - "one by array order" % (rec, key[0], key[1], dc, out[key], pre)) + if fam != v6_family(out[key]): + # Cross-FAMILY ambiguity: legitimate mid-D-139, and the caller can resolve it + # by saying which family it wants. Still never guessed. + die("apex record %s has BOTH families for %s/%s in %s (%s and %s) -- this is " + "the expected D-139 transition state; re-run with --v6-family gua|ula. " + "Refusing to pick one by array order." + % (rec, key[0], key[1], dc, out[key], pre)) + die("apex record %s has TWO %s %s/%s /64s for %s (%s and %s) -- refusing to pick " + "one by array order" % (rec, fam, key[0], key[1], dc, out[key], pre)) out[key] = pre if not out: - die("apex record %s carries no /64 prefixes scoped to %s" % (rec, dc)) + die("apex record %s carries no %s/64 prefixes scoped to %s" + % (rec, (family + " ") if family else "", dc)) return out, rec @@ -225,7 +256,7 @@ "source_v4": "scripts/lib-net.sh lib_net_select_dc %s" % a.dc} if a.dual_family: - v6map, rec = apex_v6(a.dc) + v6map, rec = apex_v6(a.dc, a.v6_family) pre6 = {} for leg in LEGS: key = ("provider-public", "vip") if leg == "provider-public" else (leg, "plane") @@ -235,6 +266,10 @@ vals["family"] = "dual" vals["prefixes_v6"] = pre6 vals["apex_record"] = os.path.relpath(rec, REPO) + # Provenance: WHICH family these came from. Without it a values file + # derived mid-D-139 is indistinguishable from one derived before or + # after the transition, and the overlay it renders is the deploy input. + vals["v6_family"] = v6_family(list(v6map.values())[0]) octets = app_octets() if not a.include_unbuilt: @@ -352,6 +387,9 @@ d.add_argument("--dc", required=True, choices=["vr1-dc0", "vr1-dc1"]) d.add_argument("--from-overlay", metavar="FILE", help="lift the comment header verbatim from an existing overlay") + d.add_argument("--v6-family", dest="v6_family", choices=("gua", "ula"), + help="which v6 family to take from the apex when it holds both " + "(the D-139 transition state). Omitted = refuse on ambiguity.") d.add_argument("--dual-family", action="store_true", help="include the v6 legs (R2) -- needs the apex record") d.add_argument("--include-unbuilt", action="store_true", diff --git a/tests/render-dc-overlays/run-tests.sh b/tests/render-dc-overlays/run-tests.sh index ebee5e0..52a17c9 100755 --- a/tests/render-dc-overlays/run-tests.sh +++ b/tests/render-dc-overlays/run-tests.sh @@ -155,6 +155,73 @@ python3 "$R" render "$TMP/bad.yaml" >/dev/null 2>&1 t_eq "T16 a values file missing required keys REFUSES (rc=2)" "$?" "2" +# ---- v6 FAMILY selection (added 2026-08-01) ----------------------------------- +# D-139 creates the GUA carve ALONGSIDE the ULA rows at step 1 and retires the ULA +# rows only at step 6, so for the WHOLE transition every v6-only plane has TWO /64s +# under one (role, kind) key. Measured LIVE on 2026-08-01 minutes after the step-1 +# push: `derive --dual-family` refused outright, making the D-136 pipeline unrunnable +# for exactly the migration it exists to serve. These cases pin the fix AND the +# refusals it deliberately keeps. +mkapex() { # $1 = out path; emits a minimal apex record with the families asked for + python3 - "$1" "$2" <<'PYEOF' +import json, sys +out, mode = sys.argv[1], sys.argv[2] +rows = [{"prefix": "2602:f3e2:f03:11::/64", "scope_site": "vr1-dc1", + "role": "provider-public", "description": "VR1 DC1 provider-public (GUA VIP /64)"}] +if mode in ("ula", "both"): + rows += [{"prefix": "fd50:840e:74e2:320::/64", "scope_site": "vr1-dc1", + "role": "metal-admin", "description": "VR1 DC1 metal-admin (ULA /64 active)"}, + {"prefix": "fd50:840e:74e2:321::/64", "scope_site": "vr1-dc1", + "role": "metal-internal", "description": "VR1 DC1 metal-internal (ULA /64 active)"}] +if mode in ("gua", "both"): + rows += [{"prefix": "2602:f3e2:f03:20::/64", "scope_site": "vr1-dc1", + "role": "metal-admin", "description": "VR1 DC1 metal-admin (GUA /64; D-139)"}, + {"prefix": "2602:f3e2:f03:21::/64", "scope_site": "vr1-dc1", + "role": "metal-internal", "description": "VR1 DC1 metal-internal (GUA /64; D-139)"}] +if mode == "dupsame": + rows += [{"prefix": "2602:f3e2:f03:20::/64", "scope_site": "vr1-dc1", + "role": "metal-admin", "description": "VR1 DC1 metal-admin (GUA /64; D-139)"}, + {"prefix": "2602:f3e2:f03:2f::/64", "scope_site": "vr1-dc1", + "role": "metal-admin", "description": "VR1 DC1 metal-admin (GUA /64 spare)"}] +json.dump({"ipam/prefixes": rows}, open(out, "w")) +PYEOF +} + +# T17 BOTH families present + no --v6-family -> REFUSE, and the message must NAME the +# flag that resolves it. A refusal a reader cannot act on is only half a gate. +mkapex "$TMP/apex-both.json" both +out="$(APEX_RECORD="$TMP/apex-both.json" python3 "$R" derive --dc vr1-dc1 --dual-family 2>&1 >/dev/null)"; rc=$? +t_eq "T17 both families + no flag REFUSES (rc=2)" "$rc" "2" +if printf '%s' "$out" | grep -q -- "--v6-family"; then + ok "T17b the refusal names --v6-family as the resolution" +else + bad "T17b refusal did not name the flag: $out" +fi + +# T18 --v6-family gua picks the GUA /64s out of an apex holding both, and RECORDS +# which family it took -- provenance, because a values file derived mid-transition is +# otherwise indistinguishable from one derived before or after it. +out="$(APEX_RECORD="$TMP/apex-both.json" python3 "$R" derive --dc vr1-dc1 --dual-family --v6-family gua 2>/dev/null)" +if printf '%s' "$out" | grep -q "metal-admin: 2602:f3e2:f03:20" \ + && printf '%s' "$out" | grep -q "v6_family: gua"; then + ok "T18 --v6-family gua selects GUA and records the family" +else + bad "T18 gua selection or provenance missing" +fi + +# T19 the ORIGINAL 2026-07-29 guard is UNTOUCHED: two prefixes in the SAME family under +# one key still refuse. The family work must not become a licence to pick by array order. +mkapex "$TMP/apex-dup.json" dupsame +APEX_RECORD="$TMP/apex-dup.json" python3 "$R" derive --dc vr1-dc1 --dual-family --v6-family gua >/dev/null 2>&1 +t_eq "T19 two SAME-family /64s under one key still REFUSE (rc=2)" "$?" "2" + +# T20 asking for a family the apex cannot satisfy REFUSES rather than inventing one: +# provider-public's VIP /64 is GUA-only, so a pure-ULA ask has nothing to give. +mkapex "$TMP/apex-ula.json" ula +APEX_RECORD="$TMP/apex-ula.json" python3 "$R" derive --dc vr1-dc1 --dual-family --v6-family ula >/dev/null 2>&1 +t_eq "T20 a family the apex cannot satisfy REFUSES, never invents" "$?" "2" + + echo echo "RESULT: PASS=$PASS FAIL=$FAIL" [[ "$FAIL" -eq 0 ]] && { echo "ALL PASS"; exit 0; } || exit 1