diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index fea9410..f20f5a1 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -1445,6 +1445,20 @@ mirror's own upstream sync), or a model-level snap proxy setting. **D2 (the upstream UCA) IS STILL UNFIXED AND STILL OWED** -- it stopped being the visible error only because the units that hit it are now blocked earlier on snaps. + **^ BOTH RULED 2026-07-31 (GA-R5), presented together at operator direction ("Yes, both") + and answered SEPARATELY so neither is a batch adoption.** Recorded as a joint D-135 / D-107 + RULING NOTE; OPS under GA-R3, no D-number, D-107 UNAMENDED. + **RULING 1 -- UCA. Operator utterance: "Point origin/source at the mirrored UCA, per-DC + overlay (Recommended)".** dc0 gets an explicit `deb http://10.12.8.4/cloud-archive + jammy-updates/caracal main` in `overlays/vr1-dc0-machines.yaml`; the mirror address is + per-DC so it cannot live in `bundle.yaml`. **dc1 UNCHANGED** -- its proxy forwards the + upstream URL transparently, and that asymmetry is D-135's experiment RESULT. + **RULING 2 -- SNAPS. Operator utterance: "HTTP(S) forward proxy in the DC utility band + + juju snap-https-proxy (Recommended)".** **D-107's "nodes reach NO internet directly" stays + TRUE** -- nodes reach an in-DC proxy, not the store. Closes the D-135 items 2-3 gap for BOTH + DCs with one mechanism instead of widening the mirror-vs-proxy asymmetry. Placement is + build-time engineering; **if it takes its own VM the D-134 octet map needs a ruled octet + FIRST**, since that map is a standing cross-DC standard. **memcached SCALED to 3 in `overlays/dc-ha-scaleup.yaml`** (operator-directed 2026-07-31); its exclusion comment is RE-POINTED rather than left stale. **`ceph-rbd-mirror` is PINNED, NOT SETTLED** -- gap register **item 22** carries four options and the recommendation diff --git a/docs/design-decisions.md b/docs/design-decisions.md index 3cdbfa4..eb295a7 100644 --- a/docs/design-decisions.md +++ b/docs/design-decisions.md @@ -5978,6 +5978,60 @@ --- +### RULING NOTE 2026-07-31 -- D-135 / D-107: node artifact sources point at the IN-DC copy, and snaps get an in-DC forward proxy + +**Status:** TWO rulings, both RULED 2026-07-31 (operator, GA-R5). **Presented together at +operator direction ("Yes, both") and answered SEPARATELY -- each carries its own utterance, so +neither is a batch adoption.** Both are **OPS under GA-R3**: they implement D-107's existing +airgap posture rather than changing it, and no D-number is assigned. + +**RULING 1 -- the UCA source points at the mirrored copy.** +Question as presented: the charms add `deb http://ubuntu-cloud.archive.canonical.com/ubuntu +jammy-updates/caracal main`, MEASURED unreachable from a node (000) while the mirrored copy at +`http://10.12.8.4/cloud-archive` answers 200 with real content. Six apps set it explicitly +across TWO option names -- `openstack-origin` on barbican/magnum/octavia, `source` on +ceph-mon/ceph-osd/ceph-radosgw -- and the rest inherit the charm default `caracal`, which +resolves to the same upstream pocket. Options: point them at the mirrored UCA via the per-DC +overlay, or give nodes narrow egress to the upstream instead. +**Operator answer, exact utterance: "Point origin/source at the mirrored UCA, per-DC overlay +(Recommended)".** +Effect: dc0 gets an explicit deb line in `overlays/vr1-dc0-machines.yaml` (its own header +declares it "the per-DC HAND-MAINTAINED overlay", and it already carries a per-DC value). The +mirror address is per-DC, so this CANNOT live in `bundle.yaml`. **dc1 is UNCHANGED** -- its +apt-cacher-ng forwards whatever URL it is handed, so `cloud:jammy-caracal` keeps working +there. **That asymmetry is D-135's experiment RESULT, not a defect: the full-mirror DC must +rewrite every non-Ubuntu source; the proxy DC rewrites none.** MEASURED precondition: the UCA +signing key is already present on the nodes +(`/etc/apt/trusted.gpg.d/ubuntu-keyring-2012-cloud-archive.gpg`), so a raw `deb` line verifies +with no `|key` suffix. + +**RULING 2 -- snaps reach an IN-DC forward proxy, not the internet.** +Question as presented: `mysql-innodb-cluster` (`snap install mysql-shell`), `ovn-central` +(`prometheus-ovn-exporter`) and `vault` (`core`) all fail because nodes cannot reach +`api.snapcraft.io`. This is the D-135 items 2-3 gap, and it hits dc1 IDENTICALLY since +apt-cacher-ng proxies apt and not snaps. MEASURED: juju exposes `snap-http-proxy`, +`snap-https-proxy`, `snap-store-proxy`, `snap-store-proxy-url`, `snap-store-assertions`; and +the RACK already reaches the snap store. Options: an in-DC forward proxy plus juju's +`snap-https-proxy`; Canonical's Snap Store Proxy; or narrow edge egress for the snap +endpoints. +**Operator answer, exact utterance: "HTTP(S) forward proxy in the DC utility band + juju +snap-https-proxy (Recommended)".** +Effect: **D-107's core statement stays TRUE and UNAMENDED** -- "OpenStack nodes ... reach NO +internet directly" -- because nodes reach an in-DC proxy, not the store. Same +application-layer-vs-routing distinction SEC-010's own justification draws, and the same one +that makes the voffice1->rack MAAS tunnel legitimate. It closes the D-135 items 2-3 gap for +BOTH DCs with one mechanism rather than widening the mirror-vs-proxy asymmetry. Placement (the +rack, which already holds the egress, versus its own utility-band VM needing a ruled octet) +and the service choice are engineering at build time; if it takes its own VM the D-134 octet +map needs a ruled octet first, since that map is a standing cross-DC standard. + +**Both rulings leave the artifact classes honest:** apt from the in-DC mirror (dc0) or proxy +(dc1); UCA from the in-DC mirror (dc0) or proxy (dc1); snaps from the in-DC forward proxy +(both). MAAS boot images still come from `images.maas.io` and are NOT node artifacts under +D-107's C4 amendment, so they are out of scope here. + +--- + ## D-136: NetBox-coupled per-DC render pipeline for bundle overlays and tfvars [ARCH] **Status:** **ADOPTED 2026-07-27 -- option (D)** (GA-R5). Question as presented: options (A)