diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index fcb395d..3c8279a 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -2457,6 +2457,17 @@ via Office1 -> install+init MAAS snap -> import a PER-DC key, fixing F2). NO runbook yet (sweep F1). lib-hosts carries `vr1-dc1-tailscale-01` (octet 7, MAC `52:54:00:f9:d6:df`); the aux-carve reuses on dc1 once its region exists. + **>>> dc1-region workstream STARTED 2026-08-07 (changelog Item 7). <<<** The `.6` region VM + (`normal-piglet`->`vr1-dc1-maas-01`, power set, recommissioned) is **Ready** in the Office1 + region (bootstrapped BY Office1, like dc0's `hot-kid`; the `.6`/`.7` had Failed commissioning on + unset-power; a transient virsh-login error cleared on retry). REMAINING (next session): (1) 2-leg + CARVE metal-admin `10.12.68.6` + provider-public `10.12.64.6` BEFORE deploy (aux-carve needs a + `-maas-01` extension + `--profile admin`; the hot-kid under-carve lesson); (2) deploy jammy; + (3) **MAAS region install/init -- OPERATOR ONE-SHOT** (verified MAAS 3.7 procedure in changelog + Item 7: `snap install maas --channel=3.7/stable` + external PostgreSQL 16 + `maas init region+rack + --database-uri ... --maas-url http://10.12.68.6:5240/MAAS` + `createadmin` with a PER-DC ssh key + fixing F2); (4) register `vr1-dc1-region`, config via the tested tools (topology/power-key/IPAM/ + DHCP/image-sync); (5) REBUILD the 9 nodes+juju+.7 FRESH into it. F-CV1: designate _admin backend DOWN -- **RESOLVED 2026-08-06 (BUNDLEFIX-056, operator-approved fix EXECUTED + VERIFIED).** Root cause (governing = D-052 + generic binding rule + the D-020 amendment's ruled .62 triple, NOT D-141): designate's bundle bindings OMITTED public + internal, diff --git a/docs/changelog-20260807-dc0-tailscale-provisioning.md b/docs/changelog-20260807-dc0-tailscale-provisioning.md index 5f3d796..d010798 100644 --- a/docs/changelog-20260807-dc0-tailscale-provisioning.md +++ b/docs/changelog-20260807-dc0-tailscale-provisioning.md @@ -168,3 +168,46 @@ REVERT: `maas vr1-dc0-region machine update hostname=` (n4parh<-known-marten, arfr7p<-subtle-grouse); cosmetic MAAS metadata, no functional dependency. + +## Item 7 -- dc1 region-VM `.6` bootstrapped to Ready (LIVE, gated; dc1-region workstream START) + +Operator ruling this session: dc1 node-handling = **"Rebuild fresh into dc1-region"** (build the +region, then power/enlist/commission/deploy the 9 nodes + juju FRESH into it -- NOT the dc0 +delete+re-enlist migration). MEASURED: dc1's full set is in the Office1 `admin` region -- 9 role +nodes + juju `Ready`, the `.6` region VM (`normal-piglet`) and `.7` tailscale (`tight-flea`) BOTH +`Failed commissioning` (`maas-capture-lldpd` timeout, `power_type` UNSET -- the commission-without- +power failure). + +WHAT (the `.6`, in the Office1 region -- it is bootstrapped BY Office1, like dc0's `hot-kid`): +set `power_type=virsh` (`maas-node-power.sh --commit`, Office1 dials the dc1 rack at +`qemu+ssh://jessea123@172.31.0.6/system` -- the address the 9 Ready nodes use); renamed +`normal-piglet` -> **`vr1-dc1-maas-01`** (naming convention, D-134 amdt); recommissioned -> **Ready** +(06:28:44Z). First commission hit a TRANSIENT "Failed to login to virsh console" under MAAS's +power-poll load and dropped to New/error; `query-power-state` then returned `off` on both the `.6` +AND a working node, proving the path -- retry reached Ready cleanly (transient, not config). + +REMAINING for the region VM (NEXT session -- NOT done here): +1. **2-leg CARVE before deploy** -- metal-admin `10.12.68.6` (the region service addr, nodes reach + MAAS at `:5240`) + provider-public `10.12.64.6` gw `10.12.64.1` (egress for image sync). MUST + precede deploy (MAAS refuses interface changes on Deployed; this is the `hot-kid` under-carve + the dc0 migration flagged). The aux-carve tool needs a `-maas-01` extension AND to run against + `--profile admin --expect-rack ` (the `.6` lives in Office1, not a vr1-dc1 region). +2. MAAS-deploy jammy on the `.6`. +3. **MAAS region install/init -- OPERATOR ONE-SHOT** (createadmin sets a SEC-020 superuser; verified + against MAAS 3.7 docs, matches Office1's MAAS 3.7.2 + PostgreSQL 16.14): + `sudo snap install maas --channel=3.7/stable`; `sudo snap install postgresql --channel=16/stable` + + `postgresql.createuser -U postgres -h /tmp -P maas` + `postgresql.createdb -U postgres -h /tmp + -O maas maas`; `sudo maas init region+rack --database-uri "postgres://maas:@localhost/maas" + --maas-url http://10.12.68.6:5240/MAAS`; `sudo maas createadmin --username admin --email ... + --ssh-import ` (external PostgreSQL is REQUIRED; no embedded DB in 3.7). + Source: https://canonical.com/maas/docs/3.7/how-to-guides/get-started/install-maas/ +4. Register the `vr1-dc1-region` profile on voffice1; then the CONFIG steps reuse the tested tools + (`dc-region-topology.sh`, `maas-region-power-key.sh` PER-DC key, `dc-plane-ipam.sh`, + `maas-role-tags.sh`) + DHCP + jammy image sync -- all per the dc0 migration changelog's tooled items. +5. Then REBUILD the 9 nodes + juju + `.7` fresh into `vr1-dc1-region` (the `.7` aux-carve already exists). + +WHY stop at Ready: the carve needs the tool extension + the MAAS init is an operator one-shot; both +are next-session work. The `.6` at Ready is a durable, correct milestone (no half-deployed region). + +REVERT: `maas admin machine release e773tq` (back to Ready is already the state) or set power_type +back to unset; the substrate VM is untouched. diff --git a/docs/session-ledger.md b/docs/session-ledger.md index 7a2dd2a..5d457a1 100644 --- a/docs/session-ledger.md +++ b/docs/session-ledger.md @@ -294,4 +294,5 @@ - OWNED: nearly read the prior close's "powered off" as "not enlisted" (measured `known-marten` first); the advisor caught the unverified provider-public leg (then measured both legs live) and the missing bookend; `run-logged.sh` NOT opened (O3, 2nd consecutive -- a background agent cannot drive its interactive subshell). - Gates: repo-lint 0 fail (1 legacy warn); gauntlet ALL GREEN 101 (docs-only edits since). Sweep: `docs/audit/queued-findings-20260807-dc0-tailscale-provisioning.txt` (F1-F4 FIRST SURFACE: no per-DC MAAS-region-build runbook; the vr1-office1-svc inject vs SEC-012/016; phase-3 aux-deploy DOCFIX). Body: `docs/changelog-20260807-dc0-tailscale-provisioning.md`. - POST-BOOKEND (same session): operator naming correction -> renamed dc0 known-marten->vr1-dc0-tailscale-01 + subtle-grouse->vr1-dc0-juju-01 (all 11 dc0-region names now vr1-dc0-*); recorded the standing convention as **D-134 AMENDMENT 2026-08-07** ("Record that as the preferred naming convention going forward") + lib-hosts comment. dc1 node-handling RULED "Rebuild fresh into dc1-region" (build region, then power/enlist/commission/deploy the 9 nodes+juju FRESH into it -- NOT delete+re-enlist). -- NEXT: **dc1-region workstream** -- author the region-standup runbook (F1; mine `changelog-20260730-dc0-region-migration.md` for the region-VM bootstrap, EXCLUDE migration parts), bootstrap `vr1-dc1-maas-01` (.6, `normal-piglet` Failed-commissioning), init `vr1-dc1-region` with a PER-DC key (fixes F2), then REBUILD the 9 nodes+juju+.7 fresh into it. Separately, dc0 Step 3.3 closes once a TAGGED key + Headscale access -> `site-tailscale.sh install` on dc0 .7 -> browser login `https://10.12.8.58`. Status ONLY in CURRENT-STATE.md. +- dc1-region STARTED: `.6` region VM (`normal-piglet`->`vr1-dc1-maas-01`, power set, recommissioned) is **Ready** in the Office1 region (bootstrapped by Office1 like dc0's hot-kid; transient virsh-login error cleared on retry). MAAS 3.7 install/init RESEARCHED (changelog Item 7; matches Office1 3.7.2 + PostgreSQL 16, external DB required, createadmin=SEC-020 one-shot). +- NEXT (dc1): (1) extend aux-carve for `-maas-01` + carve `.6` metal-admin 10.12.68.6 + provider-public 10.12.64.6 BEFORE deploy (hot-kid under-carve lesson); (2) deploy jammy; (3) MAAS install/init OPERATOR ONE-SHOT (researched cmds in changelog Item 7); (4) register `vr1-dc1-region` + config via tested tools; (5) REBUILD 9 nodes+juju+.7 fresh into it. Separately dc0 Step 3.3 closes on a TAGGED key + Headscale access -> `site-tailscale.sh install` -> browser login `https://10.12.8.58`. Status ONLY in CURRENT-STATE.md.