diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index f34d80b..67ef3ce 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -79,6 +79,23 @@ > (cloud-assert BOM, controller backup, verify-live Ceph); re-IP 3 live-free checks -> present the > re-IP GA-R5 ruling. Rebuild items: wire retrofit `ubuntu-mirror` per-DC in the bundle + give > containerized OVN chassis a v6 data-tenant address. +> +> **UPDATE 2026-08-09 -- geneve-over-v6 root-caused FURTHER + LIVE-CONFIRMED WORKING; v4-forced is OFF the +> table.** The family split (above) stands, but is only HALF the story and NOT the whole blocker. Measured +> live on vr1-dc0 (bounded diagnostic, after a fable advisory caught an invalid localport-sourced test that +> had briefly and wrongly concluded "v6 geneve broken"): the SECOND defect is that `ovn-chassis` 24.03 sets +> the v6 `ovn-encap-ip` **BRACKETED** (`"[2602:f3e2:f02:30::120]"`), which OVS geneve rejects +> (`bad geneve 'remote_ip'`), leaving every v6 tunnel at `ofport -1`. Delivered UNbracketed, the tunnel +> instantiates (`ofport 14`) and a real VM->VM cross-compute ping over geneve-over-IPv6 passed **8/8, 0% +> loss**. So geneve-over-v6 WORKS on this stack (OVS 3.3.0 / OVN 24.03.2 / kernel 5.15.0-186); **v6-only +> data-tenant is viable and v4 is not forced.** Rebuild fix is THREE parts: (i) carve v6 on the +> containerized (octavia LXD) chassis; (ii) deliver `ovn-encap-ip` unbracketed (fixed charm rev or override); +> (iii) neutron `overlay_ip_version=6` (MTU). Test scaffold + the owed `lb-smoke` LB TORN DOWN (dc0 clean). +> Delivered: `scripts/geneve-encap-assert.sh` (+ harness 16/16) asserts encap family consistency AND tunnel +> `ofport>=0`; phase-04 Step 12.2 + Step 6 corrected to use it. Evidence + tested sequence in the root-cause +> record above (LIVE-CONFIRMED 2026-08-09 section). D-number for the containerized-chassis-v6 + bracket +> finding still OWED (amendment vs new-number is the operator's call). Changelog: +> `docs/changelog-20260809-geneve-v6-rootcause-gate.md`. > ## >>> STANDING OPERATOR DIRECTIVE, 2026-07-30: THE NEXT SESSION PROCEEDS TO THE JUJU DEPLOYMENT (STAGE 5). NO MATTER WHAT. <<< > diff --git a/docs/audit/geneve-over-v6-rootcause-20260808.md b/docs/audit/geneve-over-v6-rootcause-20260808.md index ce5c071..2fed5eb 100644 --- a/docs/audit/geneve-over-v6-rootcause-20260808.md +++ b/docs/audit/geneve-over-v6-rootcause-20260808.md @@ -72,6 +72,126 @@ - **Alternative:** flip compute encap to v4 to match control -- REJECTED direction (inverts the geneve-over-v6 design intent, D-101). +## 2026-08-09 -- v6<->v6 datapath: FIRST TEST RETRACTED (invalid instrument); STATUS = STILL UNTESTED + +**RETRACTION.** A first 2026-08-09 attempt concluded "v6<->v6 geneve PROVEN NON-FUNCTIONAL" and inferred +v4-forced. **That conclusion is WITHDRAWN -- the test used an invalid packet source** (fable-advisory +catch; instrument-currency #23 sibling: the test did not bypass a layer that independently produces the +same negative). The raw measurements were real but do not support the conclusion drawn: + +| # | Test | Path | Result | +|---|---|---|---| +| C1 | ping `192.0.2.10` (instance-A) | SAME chassis (compute-01), no geneve | 0% loss (4/4) | +| C2 | ping6 `2602:f3e2:f02:30::121` | v6 UNDERLAY compute-01->compute-02 | 0% loss (4/4) | +| T | ping `192.0.2.20` (instance-B) from `ovnmeta-` namespace | CROSS chassis, v6 geneve | 100% loss | +| T' | `tcpdump -ni enp4s0 udp port 6081` during T | geneve on the wire | 0 packets | + +**Why T/T' prove nothing about v6 geneve.** The `ovnmeta-` namespace port is an OVN **`localport`** +(how ML2/OVN implements metadata -- the same port exists on EVERY chassis). Per OVN architecture, +**traffic to/from a localport is NEVER forwarded over a tunnel** -- ovn-controller installs an explicit +drop for localport-sourced packets destined to a remote chassis. So T=100% loss and T'=0-geneve-emitted +are the **by-design** result for ANY encap family; a fully healthy v4 overlay would show the identical +T/T'. C2 (underlay) and C1 (same-chassis local delivery) are both consistent with a localport source and +do not compensate. The distinguishing test must source from a **real VM VIF port**, not a localport. + +**On the "mixed-family mesh" worry:** NOT a real mechanism -- ovn-controller builds tunnels pairwise, one +per remote-chassis encap, as independent state; a v4 chassis in the SB does not poison a v6<->v6 pair's +flows. The only casualties of the family split are the cross-family (control<->compute) pairs -- that part of +the 2026-08-08 root cause **STANDS UNCHANGED**. + +**CURRENT STATUS: v6<->v6 geneve datapath = STILL UNTESTED.** The "Fix landscape" below is NOT overturned. +Upstream signal (fable + general OVN knowledge): geneve-over-IPv6 is a **supported, production-exercised** +capability (OVS v6 tunnel endpoints since 2.6/2016; neutron `overlay_ip_version=6`; ovn-kubernetes runs +single-stack v6 in production). Item 14 is stale man-page wording + thin test coverage, **not** a +capability denial. Expectation: the corrected test PASSES and the v6-only direction (section 5.1 of the carve +proposal) holds -- but it must be MEASURED, not assumed. + +**Corrected diagnostic sequence (bounded, ~30 min, dc0 throwaway -- do not exceed):** +1. Tunnel-port health on compute-01: `ovs-vsctl --columns=name,ofport,error list interface ovn0-vr1-d-0` + + `ovs-appctl dpif/show | grep geneve`. `ofport>=0`/no error -> kernel made the v6 tunnel; proceed. + `ofport:-1`/error -> real kernel/OVS v6-geneve defect; STOP and rule v4 for the rebuild. +2. THE test: VM->VM cross-chassis ping from a REAL VM (console into instance-A, ping instance-B), tcpdump + `udp 6081` on both computes. Pass + geneve both ways -> VERDICT v6 geneve WORKS; family-split is the sole + LB cause; v6-only fix reinstated. 0 emitted from a real VIF -> go to 3. Emitted, no reply -> underlay + UDP-6081 filtering, check + stop. +3. Only if 2 emits nothing: `ovs-appctl ofproto/trace` from instance-A's in_port (real MAC/IP) -> instance-B. + Ends in `output:` -> flows fine, kernel encap failing (record, rule v4). Ends in drop -> + capture the drop flow (that IS the transferable answer). STOP -- no kernel bisecting on a throwaway cloud. + +**MTU note for the rebuild:** v6 geneve overhead is 20 bytes larger; neutron `overlay_ip_version=6` must be +set so tenant MTU computes to ~1422, else a real *large-packet* failure appears later (different bug). + +### RESOLVED 2026-08-09 -- ROOT CAUSE = BRACKETED v6 `ovn-encap-ip` (charm/OVN format bug); geneve-over-v6 IS viable + +Ran the corrected bounded diagnostic (Step 1 + a self-contained distinguishing test). **geneve-over-v6 is +NOT broken in this stack; a bracket-format bug prevents the tunnel from instantiating.** Measured on +`vr1-dc0-compute-01`, OVS 3.3.0 / OVN 24.03.2 / kernel `5.15.0-186` / geneve.ko 0.6 (kernel datapath): + +- **Step 1 -- v6 tunnel port health:** `ovn0-vr1-d-0` (`remote_ip=[2602:f3e2:f02:30::121]`) -> + **`ofport: -1`, `error: "bad geneve 'remote_ip'"`**. The v6 tunnel is NOT in the datapath + (`dpif/show` shows only the 3 IPv4 tunnels). This -- not the retracted localport test -- is the valid + evidence that cross-compute v6 geneve does not forward today. +- **Distinguishing test (throwaway bridge, cleaned up):** a geneve interface with an **UNbracketed** v6 + `remote_ip=2602:f3e2:f02:30::121` -> **`ofport: 1`, no error**; the **bracketed** `[2602:...::121]` -> + `ofport -1`, same "bad remote_ip"; v4 control -> ofport 2, no error. **So kernel 5.15 + OVS 3.3 DO support + IPv6 geneve endpoints; the brackets are the sole blocker.** +- **Pinpoint:** `ovs-vsctl get open_vswitch . external_ids:ovn-encap-ip` on both computes returns the value + **bracketed** (`"[2602:f3e2:f02:30::120]"` / `"...::121]"`). The `ovn-chassis` 24.03 charm sets the v6 + encap-ip wrapped in `[...]`; that bracketed literal propagates to the OVS geneve `remote_ip`, which OVS + rejects. `juju config ovn-chassis` exposes no encap/ip-family/source-ip lever to override it. + +**VERDICT: geneve-over-IPv6 is achievable on this exact kernel/OVS/OVN; the blocker is the bracketed v6 +`ovn-encap-ip` emitted by ovn-chassis 24.03.** This is a config/charm defect, NOT a kernel or capability +limit and NOT a reason to force v4. + +**Consequence for the fix landscape (below) -- REINSTATED with a correction.** The original durable fix +(give containerized OVN chassis a v6 data-tenant address so encap is v6 cloud-wide) is correct AND +NECESSARY but **NOT SUFFICIENT**: the v6 encap-ip must ALSO be delivered to OVS **unbracketed**, or every +chassis (metal included) gets `ofport -1` and no v6 geneve forms. So the rebuild needs BOTH: (i) v6 on the +LXD chassis' data-tenant leg (carve, not auto-pick), and (ii) an unbracketed v6 `ovn-encap-ip` -- via a +fixed/newer ovn-chassis charm revision, or a verified post-config override. **Owed rebuild investigation:** +is the bracket a known upstream ovn-chassis/OVN bug with a fix revision? (not yet searched). + +**Roosevelt-delta (corrected):** a v6 build must (a) give containerized chassis a carved v6 data-tenant +address, (b) ensure `ovn-encap-ip` reaches OVS unbracketed, and (c) gate on BOTH the encap-family +consistency AND every v6 tunnel port having `ofport >= 0` / empty `error` (the bracket bug is invisible to +a family-only check -- all chassis can be "v6" and still have `ofport -1`). v4-forced is OFF the table. + +### LIVE-CONFIRMED 2026-08-09 -- unbracket fix proven end-to-end (real VM->VM, 0% loss). TESTED SEQUENCE for the rebuild. + +The fix was proven live on dc0 (operator-directed: capture tested settings/steps for the 10.13 rebuild). +Exact tested sequence, run from the dc0 rack (`172.31.0.2`, D-138), all steps captured: + +1. **Diagnose** (per compute): `sudo ovs-vsctl --columns=ofport,error list interface ` -> + `ofport -1`, `error "bad geneve 'remote_ip'"`; `sudo ovs-vsctl get open_vswitch . external_ids:ovn-encap-ip` + -> `"[2602:f3e2:f02:30::120]"` (bracketed = the defect). +2. **Fix** (per compute, unbracketed): `sudo ovs-vsctl set open_vswitch . external_ids:ovn-encap-ip=2602:f3e2:f02:30::120` + (compute-01) and `...::121` (compute-02). ovn-controller rebuilt the tunnels within ~12 s. +3. **Verify tunnel:** `ovn0-vr1-d-0` -> **`ofport 14`, `error []`**, present in `dpif/show` as + `geneve ... remote_ip=2602:f3e2:f02:30::121` (unbracketed). +4. **Verify forwarding** (`ofproto/trace` from a real VM VIF): datapath action + `set(tunnel(ipv6_dst=2602:f3e2:f02:30::121, tp_dst=6081, geneve(...))) -> output to kernel tunnel`. +5. **Live datapath proof:** VM `geneve-proof-c` (compute-01) -> VM `geneve-proof-b` (compute-02, `192.0.2.20`): + **8/8 received, 0% loss, rtt ~3 ms.** Real VM->VM over geneve-over-IPv6. + +**CONCLUSION (measured, not inferred): geneve-over-IPv6 works on OVS 3.3.0 / OVN 24.03.2 / kernel 5.15 +once `ovn-encap-ip` is delivered to OVS UNBRACKETED.** The `ovn-chassis` 24.03 charm's bracketed v6 +`ovn-encap-ip` is the sole defect. `step 2` is a live WORKAROUND (transient -- a charm hook may re-assert +the bracketed value); the DURABLE rebuild fix is a fixed/newer charm revision OR a persistent post-deploy +override. Owed for the rebuild plan (change-delivery loop, not this session): (a) confirm the fixed charm +revision (charm-ovn-chassis IPv6 bracket bug family -- LP #1968355 area; not yet pinned to a fix rev); +(b) add the encap unbracketing + the two verification gates below to the phase-04/phase-01 deploy runbook; +(c) the gate must assert BOTH encap-family consistency AND every tunnel `ofport>=0`/empty `error` (a +family-only check passes while all tunnels sit at `ofport -1`). + +**Also required for a v6 overlay (not re-tested here, carry forward):** the containerized control-plane +chassis (octavia/ovn-chassis-octavia LXD) still need a CARVED v6 data-tenant address (they are v4-only +today -- the original 2026-08-08 family split), AND neutron `overlay_ip_version=6` for correct tenant MTU +(~1422). The unbracket fix is necessary but only sufficient for the metal<->metal path proven here. + +Teardown of `geneve-proof-*` + `lb-smoke` proceeds now (reproduction captured above). The manual step-2 +encap override is left as-is on throwaway dc0 (harmless; not persisted to git/charm). + ## Evidence This session's captured output (transcript): `ovn-sbctl show`, `ovs-vsctl list interface` (bfd_status empty), octavia health-manager log ConnectTimeout, ping6 100% loss, SG rule list, diff --git a/docs/audit/gua-carve-completion-proposal-20260809.md b/docs/audit/gua-carve-completion-proposal-20260809.md new file mode 100644 index 0000000..d1ec3d8 --- /dev/null +++ b/docs/audit/gua-carve-completion-proposal-20260809.md @@ -0,0 +1,199 @@ +# GUA carve completion -- proposal + missing-assignment scan (2026-08-09) + +**Status: DRAFT PROPOSAL. Nothing here is a ruling.** I propose; the operator rules (GA-R5). +Not a status surface (GA-R1) -- stage/gate status lives in `docs/CURRENT-STATE.md` only. +Origin: the geneve-over-v6 LB failure (`docs/audit/geneve-over-v6-rootcause-20260808.md`) -> a NetBox +apex check -> operator direction: "assign the carves ... propose the missing gua carve, scan for any +additional missing assignments, and provide a proposed matrix." **Rev 2** -- incorporates a fable-level +adversarial review (findings folded in below; the review's evidence is cited where it changed a claim). + +**Evidence base.** Current-state figures are from a fresh READ-ONLY apex dump this session: +`netbox/draft/vr1-office1-current-20260809.json` (office1-netbox 10.10.1.10, DOCFIX-195 VR1 working +apex -- 152 prefixes / 27 ip-ranges / 194 ip-addresses; every number below independently re-derived in +the fable review). Rulings cited inline. No mutation performed. + +--- + +## 1. Governing frame (cited, not re-argued) + +- **D-139 ruling A** -- family matrix per DC: `provider-public` + `metal-admin` **dual-stack**; + `metal-internal` / `data-tenant` / `storage` / `replication` IPv6-only (*target*); `lb-mgmt` IPv6-only (new plane). +- **D-139 ruling B** -- **Full GUA on every plane**, from each DC's `/48` (`2602:f3e2:f02::/48` dc0, + `2602:f3e2:f03::/48` dc1). **ULA `/48` `fd50:840e:74e2::/48` RETIRED for VR1.** (Deciding RFC-6724 + reason struck 2026-08-01; ruling stands on Willamette/VR0 conformance + Roosevelt-delta. Ruling B is + **orthogonal** to the v4-keep question -- a GUA dual-stack carve is achievable today.) +- **D-139 "B plus C" narrowing** (changelog-20260731 Items 14/15/16): the v6-only conversion is a + **bounded experiment on `storage` + `replication` TOGETHER** (coupled by `ceph-osd`'s global + `ms_bind_ipv4=False`). **`metal-internal`, `data-tenant`, `lb-mgmt` stay dual-stack.** Item 14 + (measured by charm/doc reading) records the blockers are **upstream charm defects**, not deployment + faults: `metal-internal` (mysql URIs unbracketed-v6-invalid; corosync `ip_version: ipv4`), + and -- the one that bears on data-tenant -- **"OVN documenting the encap column as *'The IPv4 address of + the encapsulation tunnel endpoint'* with zero v6 encap values anywhere in OVN 24.03's test suite"** + (flagged there as a sourced observation, *NOT re-verified*). See section 5 for how this is engaged. +- **D-139 OOB amendments (2026-08-01 a/b)** -- `oob` dual-stack: v6 `f0X:f0::/60`+`/64`; v4 **dc0 + `10.12.40.0/22`, dc1 `10.12.88.0/22`** (RULED, not built). VPN `:e0` deferred to Roosevelt. +- **D-141** -- IPAM allocations authored **dual-stack, status-distinguished**: **v4 `active`**, + **GUA v6 `reserved`** (until the consuming layer is capable; gate = `docs/charm-ip-family-compatibility.md`), + **superseded ULA `deprecated`**; v6 host-numbering mirrors v4. +- **D-134** -- per-plane `/22` v4 octet bands (utility `.4-.49`, VIP `.50-.99`, nodes `.100-.200`); + its 2026-07-27 amendment defines the **v6 bands** -- do not invent v6 host values, read them there. +- **D-139 build constraints (measured):** zero v6 `ip-range` rows are needed/possible (MAAS auto-reserves + `::1`-`::ffff:ffff` per `/64`; node statics live at `::100...`; containers auto-get `:0:1::`). + **A v6-only plane is expressible; dual-stack on a container plane is not** (juju takes one family via + `addrs[0]`, non-deterministic -- LP #1723240; no knob). + +**Re-IP interaction:** the 10.12->10.13 re-IP pivot is **v4-only** (10.12 collides with the live cloud). +**The GUA v6 carve is unaffected** (`f02`/`f03` unchanged) -> completing the v6 GUA apex is **durable, not +throwaway**, and is the apex-drives-deploy direction D-141 requires. Only the **v4** OOB `/22`s move under the re-IP. + +--- + +## 2. Current state -- measured (2026-08-09 apex dump; re-derived in review) + +**DC0 (`f02`) -- GUA carve structurally complete per convention.** +- 9 planes carry GUA prefixes (`:10 :11 :20 :21 :30 :40 :50 :80 :f0`), status `active` (16 rows). +- GUA VIP host-addrs: **39, all `reserved`** (13 each on `:11`/`:20`/`:21`) ok D-141. +- ULA prefixes + ULA VIPs (26): all `deprecated` ok. +- Node v6 statics: 0 apex records -- **correct by convention** (v4 side records no `.100-.200` nodes either). + +**DC1 (`f03`) -- GUA carve INCOMPLETE (headline gap).** +- GUA prefixes: **provider-public only** (`:10 :11`). **MISSING 7 planes / 13 prefix rows** + (`:20 /60+/64`, `:21 /64`, `:30 /60+/64`, `:40 /60+/64`, `:50 /60+/64`, `:80 /60+/64`, `:f0 /60+/64`). +- GUA VIPs: **13 `reserved`** (provider-public only). **metal-admin/internal GUA VIPs MISSING (26).** +- ULA prefixes still **`active`** (5 planes / 9 rows: `320/321/330/340/350`). ULA VIPs (26) still `reserved` + on `:320`/`:321` -- DC1's metal-admin/internal VIPs live **only** on retired-family ULA. + +**Cross-cutting findings (some are ruled-vs-built divergences, not just gaps):** +- **v6 utility host records = 0 on both DCs** -- juju `.5`/maas `.6`/tailscale `.7`/rack `.2` are v4-only. + D-141 rule 1 (author dual-stack) -> v6 `reserved` twins owed. Low consequence (utility is v4-reached). +- **lb-mgmt `:80` prefix `active` on dc0** -- but D-139's G18 annotation (2026-08-08) rules the apex GUA + lb-mgmt **`reserved`** (no charm consumer). **Two rows** exist (`f02:80::/60` AND `::/64`); the G18 text + names only the `/64` -- the `/60`'s status is unspecified and must be asked, not assumed. +- **All 78 v4 VIP host-addrs are `reserved` on BOTH DCs** (not `active`). If dc0's API VIPs are live + (dc0 is deployed, core services active), the apex is **under-promoted** vs D-141 rule 2 -- a divergence to + confirm/correct. If they are not yet verified-live, `reserved` is correct. Not asserted either way here. +- **Utility `.4` (apt-cacher proxy, D-135 + 2026-08-02(b) convergence ruling) has no apex host row** on any + plane, either DC -- a candidate genuinely-missing v4 assignment (verify proxy build state before asserting). + +--- + +## 3. Proposed GUA assignment matrix (both DCs) + +Prefix `active` = the plane object exists (D-139 carve convention). VIP-allocation `reserved` per D-141. +`lb-mgmt` prefix `reserved` per G18. Host-numbering mirrors the v4 octet (D-134 + its v6-band amendment). + +| Plane | v6 `/60` parent | dc0 `/64` | dc1 `/64` | v4 (family) | Prefix status | VIP-alloc status | +|---|---|---|---|---|---|---| +| provider-public | `f0X:10::/60` | `f02:10::/64` | `f03:10::/64` | 10.12.4 / 64 (**dual**) | active | reserved | +| metal-admin | `f0X:20::/60` | `f02:20::/64` | `f03:20::/64` | 10.12.8 / 68 (**dual**) | active | reserved | +| metal-internal | (in `:20::/60`) | `f02:21::/64` | `f03:21::/64` | 10.12.12 / 72 (dual; v6-only *target*, blocked section 5) | active | reserved | +| data-tenant | `f0X:30::/60` | `f02:30::/64` | `f03:30::/64` | 10.12.16 / 76 (dual; **v6-only decision section 5**) | active | -- | +| storage | `f0X:40::/60` | `f02:40::/64` | `f03:40::/64` | 10.12.32 / 80 (v6-only *experiment*, gated) | active | -- | +| replication | `f0X:50::/60` | `f02:50::/64` | `f03:50::/64` | 10.12.36 / 84 (v6-only *experiment*, gated) | active | -- | +| lb-mgmt | `f0X:80::/60` | `f02:80::/64` | `f03:80::/64` | none (v6-only, new) | **reserved** (G18) | -- | +| oob | `f0X:f0::/60` | `f02:f0::/64` | `f03:f0::/64` | **dc0 10.12.40 / dc1 10.12.88** (**dual**) | active | -- | + +*Prefix rows are authored now regardless of family conversion (both families coexist in the apex). "v6-only +experiment" (storage/replication) is a **bounded experiment gated on the still-untaken `network-get` +measurement**, not greenlit deployment.* + +--- + +## 4. Missing-assignment scan -- enumerated + +| # | Missing / divergent assignment | Layer | Tool / step | Note | +|---|---|---|---|---| +| M1 | **DC1 GUA plane prefixes** (7 planes / 13 rows) | apex v6 | `netbox/d139-gua-carve.py --dc vr1-dc1` (CREATE-only; D-139 step 1) | executes ruled D-139 | +| M2 | **DC1 metal-admin + metal-internal GUA VIPs** (26, `reserved`) | apex v6 | D-139 step 6 re-home | **needs its own GA-R5** (section 5.2) -- D-139 ORDERING RULING reserved step 6 | +| M3 | **DC1 ULA retirement** -- 9 prefixes + 26 VIPs -> `deprecated` | apex v6 | D-139 step 6, **AFTER M2** (DEFECT 3) | same GA-R5 as M2 | +| M4 | **OOB v4 `/22`** (dc0 10.12.40, dc1 10.12.88) | apex+MAAS v4 | RULED not built; carve tool is v6-only -> **tool gap** | **moves under re-IP** -> defer (section 5.2) | +| M5 | **lb-mgmt status** -- dc0 `:80` `/64` (and `/60`?) `active`->`reserved`; author dc1 `:80` `reserved` | apex v6 | status edit(s) | **two rows**; `/60` status is an operator question (G18 named only `/64`) | +| M6 | **v6 utility host records** on dual-stack planes | apex v6 | D-141 rule 1; **v6 values from D-134 amendment, not invented** | low consequence | +| M7 | **DC1 v4 utility host records** (thinner than dc0) | apex v4 | at DC1 standup | expected while DC1 held | +| M8 | **`.4` apt-cacher proxy host record** (both DCs) | apex v4 | verify proxy build first | candidate real gap (D-135 / 2026-08-02(b)) | +| S2 | **MAAS GUA subnet carve per DC** (distinct from node statics) | **MAAS** | D-139 step 2 | out of apex-only scope; rack-side; listed so it is not lost | +| S4 | **Octavia v6 IP-SAN reissue + `lib-net.sh` v6 arm** | PKI + repo | D-139 step 4 (`octavia-pki.sh reissue`) | out of apex-only scope | +| S3 | **Node v6 statics in MAAS** (`::100...`/node) | **MAAS** | `dc-node-v6-carve.py` (D-139 step 3) | **NOT asserted absent** -- needs rack access; dc0 data-tenant confirmed carved (`::120/::121`), completeness UNMEASURED | +| S5 | **lb-mgmt VLAN/space/subnet** | MAAS | D-139 step 5 | never carved either family | + +**Overlay/render coupling (from review -- must not be missed):** M2/M3 touch only the apex, but the D-136 +**rendered per-DC VIP overlays** carry DC1's v6 VIPs in the ULA range. Retiring/ re-homing in the apex +without regenerating the overlay consumers would leave a later DC1 deploy pointing at `deprecated` ULA VIPs +(memory #16: enumerate a change's consumers). Enumerate the D-136 consumers as part of M2/M3. + +**Classification:** M1, M5, M6 execute existing D-139/D-141 rulings (gated mutations). **M2/M3 do NOT** -- +see section 5.2. S2-S5 are MAAS/PKI/repo steps outside this apex-only proposal, listed for completeness. + +--- + +## 5. Decisions + +### 5.1 RESOLVED 2026-08-09 -- geneve-over-v6 CONFIRMED working; v6-only data-tenant stands (D-number owed) + +**Governing preference (operator, 2026-08-09; = the standing D-101/D-139 posture):** *"v6-only, when not +possible dual-stack v4/v6, and only if that is not possible v4."* + +**The prerequisite this section used to gate on is now MEASURED, and it PASSED.** geneve-over-IPv6 works on +this exact stack (OVS 3.3.0 / OVN 24.03.2 / kernel 5.15.0-186) -- LIVE-CONFIRMED on vr1-dc0: a real VM->VM +cross-compute ping over a v6 geneve tunnel = **8/8, 0% loss** (evidence + tested sequence: +`docs/audit/geneve-over-v6-rootcause-20260808.md`, LIVE-CONFIRMED section). **So v6-only `data-tenant` is +viable and v4-forced is OFF the table** -- the posture's first rung holds. (A prior same-day test wrongly +concluded "v6 broken"; it sourced pings from an OVN `localport` that never tunnels by design -- retracted.) + +**The v6-only fix is THREE parts, all now understood (it is NOT "just make the plane v6-only"):** +1. **Carve v6 on the containerized (octavia LXD) chassis' data-tenant leg** -- they auto-pick v4 (D-134); the + original 2026-08-08 family split. Carve/assign, not auto-pick. +2. **Deliver `ovn-encap-ip` UNbracketed** -- `ovn-chassis` 24.03 emits it bracketed (`"[2602:...]"`), which + OVS geneve rejects (tunnel `ofport -1`, `bad remote_ip`). Fixed charm revision OR a persistent + post-deploy override. +3. **neutron `overlay_ip_version=6`** -- tenant MTU ~1422 (v6 geneve overhead), else a later large-packet bug. + +**dual-stack is still NOT a viable middle for this plane** (metal v6 + container v4 via `addrs[0]` = the split); +the choice was only ever v6-only vs v4-only, and v6-only is now proven achievable. + +**Ordering hazard (D-139 DEFECT 2, unchanged):** `dc-node-v6-carve.py` needs v4 present (`if not v4: continue`; +host part = v4 last octet). Carve node v6 statics WHILE v4 exists, THEN remove v4 -- or rewrite the script to +pivot on the plane/space. + +**The gate is now BUILT:** `scripts/geneve-encap-assert.sh` (harness 16/16) asserts encap-family consistency +AND every tunnel `ofport>=0` (the family-only check missed the bracket bug); wired into phase-04 Step 12.2. +Run at Stage-5 close before any workload smoke. + +**DECISION for ruling (GA-R5):** ratify **v6-only `data-tenant`** (the fix is understood and proven) and +settle the **D-number** -- the rootcause doc PROPOSED a new number; I lean **D-139 amendment** (parent owns +the family matrix; avoids the mint-a-number trap). The finding is broader than one plane (any LXD-hosted +ovn-chassis + the bracket bug) -- the Roosevelt-delta that argues either way. Operator's call. + +### 5.2 Enumerated, NOT presented for ruling this exchange (recorded so they are not lost) + +1. **DC1 step-6 (M2/M3)** is reserved by D-139's ORDERING RULING for **its own GA-R5 exchange** (steps 4-6 + "were NOT put"; step 6 "needs its own GA-R5 exchange ... NOT inferred"). So M2/M3 are a **future decision**, + not mere execution -- do not run them on this proposal's authority. +2. **OOB v4 timing (M4):** values move to `10.13.*` under the owed re-IP ruling -> defer to it; don't carve + v4 now to renumber later. (OPS/ordering.) +3. **DC1 apex prefixes (M1) now vs fold into rebuild:** recommend **now** -- v6 GUA is re-IP-independent, the + apex is the design source of truth (D-141), and M1 executes D-139 already ruled (gated mutation). + +--- + +## 6. Geneve encap gate -- BUILT 2026-08-09 (was ruled-not-built) + +D-139/D-101 named geneve-over-v6 a verification gate; nothing executable asserted it. **Now delivered:** +`scripts/geneve-encap-assert.sh` (+ `tests/geneve-encap-assert/run-tests.sh`, 16/16) enumerates every chassis +`Encap` IP and asserts **single-family, == the ruled family** (`--expect-family v6`, parameterized -- not a +hardcoded v6) AND **every geneve tunnel `ofport>=0`** (the bracket-bug check the family-only version missed); +proven in both failing directions. Wired into phase-04 Step 12.2. **Still owed** -- D-139's OTHER gate: +**every container's `metal-admin` leg is IPv4** (the D-139 CARRIED RISK; more critical once `data-tenant` goes +v6-only, leaving `metal-admin` the last dual-stack container plane) -- not yet built. + +--- + +## 7. Limits / what I did NOT do + +- Apex-only proposal. **No MAAS-side measurement** (S2/S3/S5 need rack access; not asserted absent). +- The OVN-v6-geneve capability is established generically (web sources); the **deployment-specific datapath + is unproven** and is the section 5.1 gate. The `addrs[0]`<->D-134-auto-pick link is an inference joining two + records, not this incident's independently measured mechanism. +- "0 addresses in the apex" corroborates the 2026-07-31 live "zero ranges" finding (same direction); it is a + design-level read, not a fresh live re-measure. D-139 established zero-ranges != can't-allocate. +- No mutation performed. Every M-item is a gated action awaiting approval; M2/M3 additionally await their own GA-R5. diff --git a/docs/changelog-20260809-geneve-v6-rootcause-gate.md b/docs/changelog-20260809-geneve-v6-rootcause-gate.md new file mode 100644 index 0000000..33ba923 --- /dev/null +++ b/docs/changelog-20260809-geneve-v6-rootcause-gate.md @@ -0,0 +1,54 @@ +# changelog 2026-08-09 -- geneve-over-v6 root cause (bracket bug) LIVE-CONFIRMED + executable gate + +Session body (GA-R2, one per session). Status lives ONLY in `docs/CURRENT-STATE.md`. +Branch `dc-dc-stage5-preconditions`. Live work ran FROM the dc0 rack `172.31.0.2` +(`vvr1-dc0`) via `voffice1` (D-138). dc0 is throwaway (10.13 rebuild follows); live +mutations were test scaffold, all torn down. + +## Item 1 -- geneve-over-v6 ROOT-CAUSED (bracket bug) + LIVE-CONFIRMED working +Extends the 2026-08-08 family-split root cause. Diagnostic (bounded, after a fable advisory +caught an INVALID first test -- pings sourced from an OVN `localport`/ovnmeta namespace, which +OVN never tunnels by design; that wrong "v6 broken" conclusion was retracted). REAL cause of the +v6 tunnel failing: `ovn-chassis` 24.03 sets `external_ids:ovn-encap-ip` BRACKETED +(`"[2602:f3e2:f02:30::120]"`); OVS geneve rejects it (`bad geneve 'remote_ip'`), tunnel +`ofport -1`. Isolated test proved kernel 5.15/OVS 3.3 accept an UNbracketed v6 geneve remote_ip +(ofport valid) and reject the bracketed form. Live fix + confirm on dc0: `ovs-vsctl set +open_vswitch . external_ids:ovn-encap-ip=` on both computes -> `ovn0-vr1-d-0` +ofport `-1`->`14` -> real VM->VM cross-compute ping over geneve-over-IPv6 = 8/8, 0% loss. +**geneve-over-v6 WORKS on this stack; v4-forced is OFF the table.** +- Files: `docs/audit/geneve-over-v6-rootcause-20260808.md` (RETRACTION + RESOLVED + LIVE-CONFIRMED + sections, with the tested sequence), `docs/CURRENT-STATE.md` (section 1 UPDATE 2026-08-09). +- **Revert:** `git checkout -- docs/audit/geneve-over-v6-rootcause-20260808.md docs/CURRENT-STATE.md`. + Live: the manual encap override is transient (charm re-asserts on next hook) and on throwaway dc0; + no revert needed. Test scaffold (`geneve-proof-*`, `lb-smoke`) already deleted. + +## Item 2 -- NEW GATE: scripts/geneve-encap-assert.sh (+ harness 16/16) +Makes the phase-04 "geneve-over-v6 verified" gate EXECUTABLE (was ruled-not-built). Asserts +C1 (all chassis Encap.ip single-family, optional `--expect-family v6` for the D-139 ruled family) +AND C2 (every geneve tunnel `ofport >= 0` -- catches the bracket bug that C1 alone misses). +Offline (fixture-testable) + `--live` (gathers via juju on the rack). Harness proves BOTH failing +directions (split -> C1 FAIL; ofport -1 -> C2 FAIL) + refuse-not-pass on empty + rc-2 usage. +- Files: `scripts/geneve-encap-assert.sh`, `tests/geneve-encap-assert/run-tests.sh` (16 pass). +- **Revert:** `git rm scripts/geneve-encap-assert.sh tests/geneve-encap-assert/run-tests.sh`. + +## Item 3 -- Runbook phase-04 CORRECTED (Step 12.2 gate + Step 6 note) +Step 12.2 was FAMILY-ONLY (would PASS on a bracketed v6 encap with no working tunnel) and cited +the retired ULA (D-139 is full-GUA). Rewrote it to lead with `bash scripts/geneve-encap-assert.sh +--live`, add the C2 tunnel-health check + the bracket-bug fix, and correct ULA->GUA. Step 6's +"geneve family follows the interface once the plane is v6-only" note gained a measured CAVEAT +(necessary-not-sufficient: containerized-chassis v6 carve + unbracketed encap). +- File: `runbooks/dc-dc-phase4-juju-bundle-per-dc.md` (Step 12.2, Step 6). +- **Revert:** `git checkout -- runbooks/dc-dc-phase4-juju-bundle-per-dc.md`. + +## Item 4 -- GUA carve completion proposal (context; superseded framing corrected) +`docs/audit/gua-carve-completion-proposal-20260809.md` (Rev 2, fable-reviewed) carries the DC1 +GUA carve gap + missing-assignment scan + matrix. Its section-5.1 geneve decision is RESOLVED by +Item 1 (v6 viable). Proposal-doc update to reflect the resolution is the next task (operator flow +"A then B"). +- **Revert:** `git rm docs/audit/gua-carve-completion-proposal-20260809.md` (if unwanted). + +## Owed (rebuild / ruling) +- D-number for the containerized-chassis-v6 + bracket finding (amendment vs new -- operator's call). +- Confirm the fixed `ovn-chassis` charm revision (LP charm-ovn-chassis IPv6 bracket family) OR a + persistent post-deploy unbracket override; wire into the deploy. +- neutron `overlay_ip_version=6` (tenant MTU ~1422) for the v6 overlay. diff --git a/netbox/draft/vr1-office1-current-20260809.json b/netbox/draft/vr1-office1-current-20260809.json new file mode 100644 index 0000000..a5c1f2e --- /dev/null +++ b/netbox/draft/vr1-office1-current-20260809.json @@ -0,0 +1,3414 @@ +{ + "_note": "READ-ONLY snapshot of the office1-netbox RECORD (VR1 working apex, DOCFIX-195). IDs discarded; refs by slug/prefix.", + "_source": "http://10.10.1.10:8000", + "dcim/regions": [ + { + "description": "Top-level region for US West metros. Holds Eugene (and future West Coast metros).", + "name": "US West", + "parent": null, + "slug": "us-west" + }, + { + "description": "Region0 \u2014 Eugene, OR metro. Nested under US West. Assigned 10.16.0.0/16 IPv4.", + "name": "Eugene", + "parent": "us-west", + "slug": "eugene" + }, + { + "description": "Virtual Regions for testing", + "name": "Virtual Regions", + "parent": null, + "slug": "virtual-region" + }, + { + "description": "Virtual Region for testing", + "name": "VR0", + "parent": "virtual-region", + "slug": "vr0" + }, + { + "description": "Virtual Region for testing", + "name": "VR1", + "parent": "virtual-region", + "slug": "vr1" + } + ], + "dcim/sites": [ + { + "description": "Primary office \u2014 Office0 at 10.16.4.0/24", + "name": "Charnelton", + "region": "eugene", + "slug": "charnelton", + "status": "active" + }, + { + "description": "Future manufacturing/OT \u2014 Cloud3 at 10.16.64.0/20 (reserved)", + "name": "Cleveland", + "region": "eugene", + "slug": "cleveland", + "status": "planned" + }, + { + "description": "Primary DC and current Internet edge \u2014 Cloud0 at 10.16.16.0/20", + "name": "Roosevelt", + "region": "eugene", + "slug": "roosevelt", + "status": "active" + }, + { + "description": "Future tertiary DC \u2014 Cloud2 at 10.16.48.0/20 (reserved)", + "name": "Stevenson", + "region": "eugene", + "slug": "stevenson", + "status": "planned" + }, + { + "description": "Virtual Site for testing", + "name": "VR0 DC0", + "region": "vr0", + "slug": "vr0-dc0", + "status": "active" + }, + { + "description": "Virtual Site for testing", + "name": "VR0 DC1", + "region": "vr0", + "slug": "vr0-dc1", + "status": "active" + }, + { + "description": "Virtual Site for testing", + "name": "VR0 Off0", + "region": "vr0", + "slug": "vr0-off0", + "status": "active" + }, + { + "description": "Virtual Site for testing", + "name": "VR1 DC0", + "region": "vr1", + "slug": "vr1-dc0", + "status": "active" + }, + { + "description": "Virtual Site for testing", + "name": "VR1 DC1", + "region": "vr1", + "slug": "vr1-dc1", + "status": "active" + }, + { + "description": "", + "name": "VR1 Off1", + "region": "vr1", + "slug": "vr1-off1", + "status": "active" + }, + { + "description": "Secondary DC \u2014 Cloud1 at 10.16.32.0/20. Future Internet edge once ARIN allocation and transit contracts move.", + "name": "Willamette", + "region": "eugene", + "slug": "willamette", + "status": "active" + } + ], + "ipam/aggregates": [ + { + "description": "RFC1918 private IPv4.", + "prefix": "10.0.0.0/8", + "rir": "rfc-1918" + }, + { + "description": "ARIN IPv4 allocation.", + "prefix": "23.157.124.0/24", + "rir": "arin" + }, + { + "description": "RFC1918 private IPv4 (OOB space).", + "prefix": "172.16.0.0/12", + "rir": "rfc-1918" + }, + { + "description": "ARIN IPv6 allocation: the HELD /36 = region-0 of the planned /32 (D-101). Update to /32 after the expand completes.", + "prefix": "2602:f3e2::/36", + "rir": "arin" + }, + { + "description": "Org ULA /48 (internal-only; D-101 literal).", + "prefix": "fd50:840e:74e2::/48", + "rir": "rfc-4193-ula" + } + ], + "ipam/ip-addresses": [ + { + "address": "10.10.1.10/24", + "description": "office1-netbox service (D-120 static band; re-IP from .201)", + "dns_name": "office1-netbox", + "role": null, + "status": "active" + }, + { + "address": "10.10.1.11/24", + "description": "office1-tailscale subnet router (D-120 static band; re-IP from .202)", + "dns_name": "office1-tailscale", + "role": null, + "status": "active" + }, + { + "address": "10.12.4.5/22", + "description": "D-134 utility .5 -- vr1-dc0 Juju controller (D-104 dedicated controller VM) (provider-public leg)", + "dns_name": "vr1-dc0-juju-01", + "role": null, + "status": "active" + }, + { + "address": "10.12.4.6/22", + "description": "D-134 utility .6 -- vr1-dc0 MAAS region+rack VM (D-132 q1 per-DC region) (provider-public leg)", + "dns_name": "vr1-dc0-maas-01", + "role": null, + "status": "active" + }, + { + "address": "10.12.4.7/22", + "description": "D-134 utility .7 -- vr1-dc0 Tailscale subnet router (D-129(iii) amendment) (provider-public leg)", + "dns_name": "vr1-dc0-tailscale-01", + "role": null, + "status": "active" + }, + { + "address": "10.12.4.50/22", + "description": "VIP keystone provider-public (vr1-dc0) -- D-020 octet .50", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.4.51/22", + "description": "VIP barbican provider-public (vr1-dc0) -- D-020 octet .51", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.4.52/22", + "description": "VIP cinder provider-public (vr1-dc0) -- D-020 octet .52", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.4.53/22", + "description": "VIP glance provider-public (vr1-dc0) -- D-020 octet .53", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.4.54/22", + "description": "VIP magnum provider-public (vr1-dc0) -- D-020 octet .54", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.4.55/22", + "description": "VIP neutron-api provider-public (vr1-dc0) -- D-020 octet .55", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.4.56/22", + "description": "VIP nova-cloud-controller provider-public (vr1-dc0) -- D-020 octet .56", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.4.57/22", + "description": "VIP octavia provider-public (vr1-dc0) -- D-020 octet .57", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.4.58/22", + "description": "VIP openstack-dashboard provider-public (vr1-dc0) -- D-020 octet .58", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.4.59/22", + "description": "VIP placement provider-public (vr1-dc0) -- D-020 octet .59", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.4.60/22", + "description": "VIP ceph-radosgw provider-public (vr1-dc0) -- D-020 octet .60", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.4.61/22", + "description": "VIP vault provider-public (vr1-dc0) -- D-020 octet .61", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.4.62/22", + "description": "VIP designate provider-public (vr1-dc0) -- D-020 octet .62", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.8.2/22", + "description": "vr1-dc0 MAAS rack controller (vvr1-dc0) metal-admin static IP (D-124; D-120 static band)", + "dns_name": "vvr1-dc0", + "role": null, + "status": "active" + }, + { + "address": "10.12.8.5/22", + "description": "D-134 utility .5 -- vr1-dc0 Juju controller (D-104 dedicated controller VM) (metal-admin leg)", + "dns_name": "vr1-dc0-juju-01", + "role": null, + "status": "active" + }, + { + "address": "10.12.8.6/22", + "description": "D-134 utility .6 -- vr1-dc0 MAAS region+rack VM (D-132 q1 per-DC region) (metal-admin leg)", + "dns_name": "vr1-dc0-maas-01", + "role": null, + "status": "active" + }, + { + "address": "10.12.8.7/22", + "description": "D-134 utility .7 -- vr1-dc0 Tailscale subnet router (D-129(iii) amendment) (metal-admin leg)", + "dns_name": "vr1-dc0-tailscale-01", + "role": null, + "status": "active" + }, + { + "address": "10.12.8.50/22", + "description": "VIP keystone metal-admin (vr1-dc0) -- D-020 octet .50", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.8.51/22", + "description": "VIP barbican metal-admin (vr1-dc0) -- D-020 octet .51", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.8.52/22", + "description": "VIP cinder metal-admin (vr1-dc0) -- D-020 octet .52", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.8.53/22", + "description": "VIP glance metal-admin (vr1-dc0) -- D-020 octet .53", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.8.54/22", + "description": "VIP magnum metal-admin (vr1-dc0) -- D-020 octet .54", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.8.55/22", + "description": "VIP neutron-api metal-admin (vr1-dc0) -- D-020 octet .55", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.8.56/22", + "description": "VIP nova-cloud-controller metal-admin (vr1-dc0) -- D-020 octet .56", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.8.57/22", + "description": "VIP octavia metal-admin (vr1-dc0) -- D-020 octet .57", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.8.58/22", + "description": "VIP openstack-dashboard metal-admin (vr1-dc0) -- D-020 octet .58", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.8.59/22", + "description": "VIP placement metal-admin (vr1-dc0) -- D-020 octet .59", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.8.60/22", + "description": "VIP ceph-radosgw metal-admin (vr1-dc0) -- D-020 octet .60", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.8.61/22", + "description": "VIP vault metal-admin (vr1-dc0) -- D-020 octet .61", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.8.62/22", + "description": "VIP designate metal-admin (vr1-dc0) -- D-020 octet .62", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.12.50/22", + "description": "VIP keystone metal-internal (vr1-dc0) -- D-020 octet .50", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.12.51/22", + "description": "VIP barbican metal-internal (vr1-dc0) -- D-020 octet .51", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.12.52/22", + "description": "VIP cinder metal-internal (vr1-dc0) -- D-020 octet .52", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.12.53/22", + "description": "VIP glance metal-internal (vr1-dc0) -- D-020 octet .53", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.12.54/22", + "description": "VIP magnum metal-internal (vr1-dc0) -- D-020 octet .54", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.12.55/22", + "description": "VIP neutron-api metal-internal (vr1-dc0) -- D-020 octet .55", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.12.56/22", + "description": "VIP nova-cloud-controller metal-internal (vr1-dc0) -- D-020 octet .56", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.12.57/22", + "description": "VIP octavia metal-internal (vr1-dc0) -- D-020 octet .57", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.12.58/22", + "description": "VIP openstack-dashboard metal-internal (vr1-dc0) -- D-020 octet .58", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.12.59/22", + "description": "VIP placement metal-internal (vr1-dc0) -- D-020 octet .59", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.12.60/22", + "description": "VIP ceph-radosgw metal-internal (vr1-dc0) -- D-020 octet .60", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.12.61/22", + "description": "VIP vault metal-internal (vr1-dc0) -- D-020 octet .61", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.12.62/22", + "description": "VIP designate metal-internal (vr1-dc0) -- D-020 octet .62", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.64.6/22", + "description": "D-134 utility .6 -- vr1-dc1 MAAS region+rack VM (D-132 q1 per-DC region) (provider-public leg)", + "dns_name": "vr1-dc1-maas-01", + "role": null, + "status": "active" + }, + { + "address": "10.12.64.50/22", + "description": "VIP keystone provider-public (vr1-dc1) -- D-020 octet .50", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.64.51/22", + "description": "VIP barbican provider-public (vr1-dc1) -- D-020 octet .51", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.64.52/22", + "description": "VIP cinder provider-public (vr1-dc1) -- D-020 octet .52", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.64.53/22", + "description": "VIP glance provider-public (vr1-dc1) -- D-020 octet .53", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.64.54/22", + "description": "VIP magnum provider-public (vr1-dc1) -- D-020 octet .54", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.64.55/22", + "description": "VIP neutron-api provider-public (vr1-dc1) -- D-020 octet .55", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.64.56/22", + "description": "VIP nova-cloud-controller provider-public (vr1-dc1) -- D-020 octet .56", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.64.57/22", + "description": "VIP octavia provider-public (vr1-dc1) -- D-020 octet .57", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.64.58/22", + "description": "VIP openstack-dashboard provider-public (vr1-dc1) -- D-020 octet .58", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.64.59/22", + "description": "VIP placement provider-public (vr1-dc1) -- D-020 octet .59", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.64.60/22", + "description": "VIP ceph-radosgw provider-public (vr1-dc1) -- D-020 octet .60", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.64.61/22", + "description": "VIP vault provider-public (vr1-dc1) -- D-020 octet .61", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.64.62/22", + "description": "VIP designate provider-public (vr1-dc1) -- D-020 octet .62", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.68.2/22", + "description": "vr1-dc1 MAAS rack controller (vvr1-dc1) metal-admin static IP (D-124 amendment 2026-07-21; D-120 static band)", + "dns_name": "vvr1-dc1", + "role": null, + "status": "active" + }, + { + "address": "10.12.68.6/22", + "description": "D-134 utility .6 -- vr1-dc1 MAAS region+rack VM (D-132 q1 per-DC region) (metal-admin leg)", + "dns_name": "vr1-dc1-maas-01", + "role": null, + "status": "active" + }, + { + "address": "10.12.68.50/22", + "description": "VIP keystone metal-admin (vr1-dc1) -- D-020 octet .50", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.68.51/22", + "description": "VIP barbican metal-admin (vr1-dc1) -- D-020 octet .51", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.68.52/22", + "description": "VIP cinder metal-admin (vr1-dc1) -- D-020 octet .52", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.68.53/22", + "description": "VIP glance metal-admin (vr1-dc1) -- D-020 octet .53", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.68.54/22", + "description": "VIP magnum metal-admin (vr1-dc1) -- D-020 octet .54", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.68.55/22", + "description": "VIP neutron-api metal-admin (vr1-dc1) -- D-020 octet .55", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.68.56/22", + "description": "VIP nova-cloud-controller metal-admin (vr1-dc1) -- D-020 octet .56", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.68.57/22", + "description": "VIP octavia metal-admin (vr1-dc1) -- D-020 octet .57", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.68.58/22", + "description": "VIP openstack-dashboard metal-admin (vr1-dc1) -- D-020 octet .58", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.68.59/22", + "description": "VIP placement metal-admin (vr1-dc1) -- D-020 octet .59", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.68.60/22", + "description": "VIP ceph-radosgw metal-admin (vr1-dc1) -- D-020 octet .60", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.68.61/22", + "description": "VIP vault metal-admin (vr1-dc1) -- D-020 octet .61", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.68.62/22", + "description": "VIP designate metal-admin (vr1-dc1) -- D-020 octet .62", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.72.50/22", + "description": "VIP keystone metal-internal (vr1-dc1) -- D-020 octet .50", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.72.51/22", + "description": "VIP barbican metal-internal (vr1-dc1) -- D-020 octet .51", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.72.52/22", + "description": "VIP cinder metal-internal (vr1-dc1) -- D-020 octet .52", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.72.53/22", + "description": "VIP glance metal-internal (vr1-dc1) -- D-020 octet .53", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.72.54/22", + "description": "VIP magnum metal-internal (vr1-dc1) -- D-020 octet .54", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.72.55/22", + "description": "VIP neutron-api metal-internal (vr1-dc1) -- D-020 octet .55", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.72.56/22", + "description": "VIP nova-cloud-controller metal-internal (vr1-dc1) -- D-020 octet .56", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.72.57/22", + "description": "VIP octavia metal-internal (vr1-dc1) -- D-020 octet .57", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.72.58/22", + "description": "VIP openstack-dashboard metal-internal (vr1-dc1) -- D-020 octet .58", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.72.59/22", + "description": "VIP placement metal-internal (vr1-dc1) -- D-020 octet .59", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.72.60/22", + "description": "VIP ceph-radosgw metal-internal (vr1-dc1) -- D-020 octet .60", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.72.61/22", + "description": "VIP vault metal-internal (vr1-dc1) -- D-020 octet .61", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "10.12.72.62/22", + "description": "VIP designate metal-internal (vr1-dc1) -- D-020 octet .62", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:11::50/64", + "description": "VIP keystone provider-public v6 (vr1-dc0) -- octet mirror ::50", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:11::51/64", + "description": "VIP barbican provider-public v6 (vr1-dc0) -- octet mirror ::51", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:11::52/64", + "description": "VIP cinder provider-public v6 (vr1-dc0) -- octet mirror ::52", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:11::53/64", + "description": "VIP glance provider-public v6 (vr1-dc0) -- octet mirror ::53", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:11::54/64", + "description": "VIP magnum provider-public v6 (vr1-dc0) -- octet mirror ::54", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:11::55/64", + "description": "VIP neutron-api provider-public v6 (vr1-dc0) -- octet mirror ::55", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:11::56/64", + "description": "VIP nova-cloud-controller provider-public v6 (vr1-dc0) -- octet mirror ::56", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:11::57/64", + "description": "VIP octavia provider-public v6 (vr1-dc0) -- octet mirror ::57", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:11::58/64", + "description": "VIP openstack-dashboard provider-public v6 (vr1-dc0) -- octet mirror ::58", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:11::59/64", + "description": "VIP placement provider-public v6 (vr1-dc0) -- octet mirror ::59", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:11::60/64", + "description": "VIP ceph-radosgw provider-public v6 (vr1-dc0) -- octet mirror ::60", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:11::61/64", + "description": "VIP vault provider-public v6 (vr1-dc0) -- octet mirror ::61", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:11::62/64", + "description": "VIP designate provider-public v6 (vr1-dc0) -- octet mirror ::62", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:20::50/64", + "description": "VIP keystone metal-admin v6 (vr1-dc0) -- octet mirror ::50", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:20::51/64", + "description": "VIP barbican metal-admin v6 (vr1-dc0) -- octet mirror ::51", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:20::52/64", + "description": "VIP cinder metal-admin v6 (vr1-dc0) -- octet mirror ::52", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:20::53/64", + "description": "VIP glance metal-admin v6 (vr1-dc0) -- octet mirror ::53", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:20::54/64", + "description": "VIP magnum metal-admin v6 (vr1-dc0) -- octet mirror ::54", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:20::55/64", + "description": "VIP neutron-api metal-admin v6 (vr1-dc0) -- octet mirror ::55", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:20::56/64", + "description": "VIP nova-cloud-controller metal-admin v6 (vr1-dc0) -- octet mirror ::56", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:20::57/64", + "description": "VIP octavia metal-admin v6 (vr1-dc0) -- octet mirror ::57", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:20::58/64", + "description": "VIP openstack-dashboard metal-admin v6 (vr1-dc0) -- octet mirror ::58", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:20::59/64", + "description": "VIP placement metal-admin v6 (vr1-dc0) -- octet mirror ::59", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:20::60/64", + "description": "VIP ceph-radosgw metal-admin v6 (vr1-dc0) -- octet mirror ::60", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:20::61/64", + "description": "VIP vault metal-admin v6 (vr1-dc0) -- octet mirror ::61", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:20::62/64", + "description": "VIP designate metal-admin v6 (vr1-dc0) -- octet mirror ::62", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:21::50/64", + "description": "VIP keystone metal-internal v6 (vr1-dc0) -- octet mirror ::50", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:21::51/64", + "description": "VIP barbican metal-internal v6 (vr1-dc0) -- octet mirror ::51", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:21::52/64", + "description": "VIP cinder metal-internal v6 (vr1-dc0) -- octet mirror ::52", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:21::53/64", + "description": "VIP glance metal-internal v6 (vr1-dc0) -- octet mirror ::53", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:21::54/64", + "description": "VIP magnum metal-internal v6 (vr1-dc0) -- octet mirror ::54", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:21::55/64", + "description": "VIP neutron-api metal-internal v6 (vr1-dc0) -- octet mirror ::55", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:21::56/64", + "description": "VIP nova-cloud-controller metal-internal v6 (vr1-dc0) -- octet mirror ::56", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:21::57/64", + "description": "VIP octavia metal-internal v6 (vr1-dc0) -- octet mirror ::57", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:21::58/64", + "description": "VIP openstack-dashboard metal-internal v6 (vr1-dc0) -- octet mirror ::58", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:21::59/64", + "description": "VIP placement metal-internal v6 (vr1-dc0) -- octet mirror ::59", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:21::60/64", + "description": "VIP ceph-radosgw metal-internal v6 (vr1-dc0) -- octet mirror ::60", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:21::61/64", + "description": "VIP vault metal-internal v6 (vr1-dc0) -- octet mirror ::61", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f02:21::62/64", + "description": "VIP designate metal-internal v6 (vr1-dc0) -- octet mirror ::62", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f03:11::50/64", + "description": "VIP keystone provider-public v6 (vr1-dc1) -- octet mirror ::50", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f03:11::51/64", + "description": "VIP barbican provider-public v6 (vr1-dc1) -- octet mirror ::51", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f03:11::52/64", + "description": "VIP cinder provider-public v6 (vr1-dc1) -- octet mirror ::52", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f03:11::53/64", + "description": "VIP glance provider-public v6 (vr1-dc1) -- octet mirror ::53", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f03:11::54/64", + "description": "VIP magnum provider-public v6 (vr1-dc1) -- octet mirror ::54", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f03:11::55/64", + "description": "VIP neutron-api provider-public v6 (vr1-dc1) -- octet mirror ::55", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f03:11::56/64", + "description": "VIP nova-cloud-controller provider-public v6 (vr1-dc1) -- octet mirror ::56", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f03:11::57/64", + "description": "VIP octavia provider-public v6 (vr1-dc1) -- octet mirror ::57", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f03:11::58/64", + "description": "VIP openstack-dashboard provider-public v6 (vr1-dc1) -- octet mirror ::58", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f03:11::59/64", + "description": "VIP placement provider-public v6 (vr1-dc1) -- octet mirror ::59", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f03:11::60/64", + "description": "VIP ceph-radosgw provider-public v6 (vr1-dc1) -- octet mirror ::60", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f03:11::61/64", + "description": "VIP vault provider-public v6 (vr1-dc1) -- octet mirror ::61", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "2602:f3e2:f03:11::62/64", + "description": "VIP designate provider-public v6 (vr1-dc1) -- octet mirror ::62", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:220::50/64", + "description": "VIP keystone metal-admin v6 (vr1-dc0) -- octet mirror ::50", + "dns_name": "", + "role": null, + "status": "deprecated" + }, + { + "address": "fd50:840e:74e2:220::51/64", + "description": "VIP barbican metal-admin v6 (vr1-dc0) -- octet mirror ::51", + "dns_name": "", + "role": null, + "status": "deprecated" + }, + { + "address": "fd50:840e:74e2:220::52/64", + "description": "VIP cinder metal-admin v6 (vr1-dc0) -- octet mirror ::52", + "dns_name": "", + "role": null, + "status": "deprecated" + }, + { + "address": "fd50:840e:74e2:220::53/64", + "description": "VIP glance metal-admin v6 (vr1-dc0) -- octet mirror ::53", + "dns_name": "", + "role": null, + "status": "deprecated" + }, + { + "address": "fd50:840e:74e2:220::54/64", + "description": "VIP magnum metal-admin v6 (vr1-dc0) -- octet mirror ::54", + "dns_name": "", + "role": null, + "status": "deprecated" + }, + { + "address": "fd50:840e:74e2:220::55/64", + "description": "VIP neutron-api metal-admin v6 (vr1-dc0) -- octet mirror ::55", + "dns_name": "", + "role": null, + "status": "deprecated" + }, + { + "address": "fd50:840e:74e2:220::56/64", + "description": "VIP nova-cloud-controller metal-admin v6 (vr1-dc0) -- octet mirror ::56", + "dns_name": "", + "role": null, + "status": "deprecated" + }, + { + "address": "fd50:840e:74e2:220::57/64", + "description": "VIP octavia metal-admin v6 (vr1-dc0) -- octet mirror ::57", + "dns_name": "", + "role": null, + "status": "deprecated" + }, + { + "address": "fd50:840e:74e2:220::58/64", + "description": "VIP openstack-dashboard metal-admin v6 (vr1-dc0) -- octet mirror ::58", + "dns_name": "", + "role": null, + "status": "deprecated" + }, + { + "address": "fd50:840e:74e2:220::59/64", + "description": "VIP placement metal-admin v6 (vr1-dc0) -- octet mirror ::59", + "dns_name": "", + "role": null, + "status": "deprecated" + }, + { + "address": "fd50:840e:74e2:220::60/64", + "description": "VIP ceph-radosgw metal-admin v6 (vr1-dc0) -- octet mirror ::60", + "dns_name": "", + "role": null, + "status": "deprecated" + }, + { + "address": "fd50:840e:74e2:220::61/64", + "description": "VIP vault metal-admin v6 (vr1-dc0) -- octet mirror ::61", + "dns_name": "", + "role": null, + "status": "deprecated" + }, + { + "address": "fd50:840e:74e2:220::62/64", + "description": "VIP designate metal-admin v6 (vr1-dc0) -- octet mirror ::62", + "dns_name": "", + "role": null, + "status": "deprecated" + }, + { + "address": "fd50:840e:74e2:221::50/64", + "description": "VIP keystone metal-internal v6 (vr1-dc0) -- octet mirror ::50", + "dns_name": "", + "role": null, + "status": "deprecated" + }, + { + "address": "fd50:840e:74e2:221::51/64", + "description": "VIP barbican metal-internal v6 (vr1-dc0) -- octet mirror ::51", + "dns_name": "", + "role": null, + "status": "deprecated" + }, + { + "address": "fd50:840e:74e2:221::52/64", + "description": "VIP cinder metal-internal v6 (vr1-dc0) -- octet mirror ::52", + "dns_name": "", + "role": null, + "status": "deprecated" + }, + { + "address": "fd50:840e:74e2:221::53/64", + "description": "VIP glance metal-internal v6 (vr1-dc0) -- octet mirror ::53", + "dns_name": "", + "role": null, + "status": "deprecated" + }, + { + "address": "fd50:840e:74e2:221::54/64", + "description": "VIP magnum metal-internal v6 (vr1-dc0) -- octet mirror ::54", + "dns_name": "", + "role": null, + "status": "deprecated" + }, + { + "address": "fd50:840e:74e2:221::55/64", + "description": "VIP neutron-api metal-internal v6 (vr1-dc0) -- octet mirror ::55", + "dns_name": "", + "role": null, + "status": "deprecated" + }, + { + "address": "fd50:840e:74e2:221::56/64", + "description": "VIP nova-cloud-controller metal-internal v6 (vr1-dc0) -- octet mirror ::56", + "dns_name": "", + "role": null, + "status": "deprecated" + }, + { + "address": "fd50:840e:74e2:221::57/64", + "description": "VIP octavia metal-internal v6 (vr1-dc0) -- octet mirror ::57", + "dns_name": "", + "role": null, + "status": "deprecated" + }, + { + "address": "fd50:840e:74e2:221::58/64", + "description": "VIP openstack-dashboard metal-internal v6 (vr1-dc0) -- octet mirror ::58", + "dns_name": "", + "role": null, + "status": "deprecated" + }, + { + "address": "fd50:840e:74e2:221::59/64", + "description": "VIP placement metal-internal v6 (vr1-dc0) -- octet mirror ::59", + "dns_name": "", + "role": null, + "status": "deprecated" + }, + { + "address": "fd50:840e:74e2:221::60/64", + "description": "VIP ceph-radosgw metal-internal v6 (vr1-dc0) -- octet mirror ::60", + "dns_name": "", + "role": null, + "status": "deprecated" + }, + { + "address": "fd50:840e:74e2:221::61/64", + "description": "VIP vault metal-internal v6 (vr1-dc0) -- octet mirror ::61", + "dns_name": "", + "role": null, + "status": "deprecated" + }, + { + "address": "fd50:840e:74e2:221::62/64", + "description": "VIP designate metal-internal v6 (vr1-dc0) -- octet mirror ::62", + "dns_name": "", + "role": null, + "status": "deprecated" + }, + { + "address": "fd50:840e:74e2:320::50/64", + "description": "VIP keystone metal-admin v6 (vr1-dc1) -- octet mirror ::50", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:320::51/64", + "description": "VIP barbican metal-admin v6 (vr1-dc1) -- octet mirror ::51", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:320::52/64", + "description": "VIP cinder metal-admin v6 (vr1-dc1) -- octet mirror ::52", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:320::53/64", + "description": "VIP glance metal-admin v6 (vr1-dc1) -- octet mirror ::53", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:320::54/64", + "description": "VIP magnum metal-admin v6 (vr1-dc1) -- octet mirror ::54", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:320::55/64", + "description": "VIP neutron-api metal-admin v6 (vr1-dc1) -- octet mirror ::55", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:320::56/64", + "description": "VIP nova-cloud-controller metal-admin v6 (vr1-dc1) -- octet mirror ::56", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:320::57/64", + "description": "VIP octavia metal-admin v6 (vr1-dc1) -- octet mirror ::57", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:320::58/64", + "description": "VIP openstack-dashboard metal-admin v6 (vr1-dc1) -- octet mirror ::58", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:320::59/64", + "description": "VIP placement metal-admin v6 (vr1-dc1) -- octet mirror ::59", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:320::60/64", + "description": "VIP ceph-radosgw metal-admin v6 (vr1-dc1) -- octet mirror ::60", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:320::61/64", + "description": "VIP vault metal-admin v6 (vr1-dc1) -- octet mirror ::61", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:320::62/64", + "description": "VIP designate metal-admin v6 (vr1-dc1) -- octet mirror ::62", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:321::50/64", + "description": "VIP keystone metal-internal v6 (vr1-dc1) -- octet mirror ::50", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:321::51/64", + "description": "VIP barbican metal-internal v6 (vr1-dc1) -- octet mirror ::51", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:321::52/64", + "description": "VIP cinder metal-internal v6 (vr1-dc1) -- octet mirror ::52", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:321::53/64", + "description": "VIP glance metal-internal v6 (vr1-dc1) -- octet mirror ::53", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:321::54/64", + "description": "VIP magnum metal-internal v6 (vr1-dc1) -- octet mirror ::54", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:321::55/64", + "description": "VIP neutron-api metal-internal v6 (vr1-dc1) -- octet mirror ::55", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:321::56/64", + "description": "VIP nova-cloud-controller metal-internal v6 (vr1-dc1) -- octet mirror ::56", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:321::57/64", + "description": "VIP octavia metal-internal v6 (vr1-dc1) -- octet mirror ::57", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:321::58/64", + "description": "VIP openstack-dashboard metal-internal v6 (vr1-dc1) -- octet mirror ::58", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:321::59/64", + "description": "VIP placement metal-internal v6 (vr1-dc1) -- octet mirror ::59", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:321::60/64", + "description": "VIP ceph-radosgw metal-internal v6 (vr1-dc1) -- octet mirror ::60", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:321::61/64", + "description": "VIP vault metal-internal v6 (vr1-dc1) -- octet mirror ::61", + "dns_name": "", + "role": null, + "status": "reserved" + }, + { + "address": "fd50:840e:74e2:321::62/64", + "description": "VIP designate metal-internal v6 (vr1-dc1) -- octet mirror ::62", + "dns_name": "", + "role": null, + "status": "reserved" + } + ], + "ipam/ip-ranges": [ + { + "description": "D-120 static site-services band (.2-.49) -- MAAS static-assign, outside the dynamic range", + "end_address": "10.10.1.49/24", + "range": "10.10.1.2/24-10.10.1.49/24", + "role": null, + "start_address": "10.10.1.2/24", + "status": "active" + }, + { + "description": "D-120 MAAS dynamic band (.100-.200) -- enlistment/commissioning/PXE/DHCP", + "end_address": "10.10.1.200/24", + "range": "10.10.1.100/24-10.10.1.200/24", + "role": null, + "start_address": "10.10.1.100/24", + "status": "active" + }, + { + "description": "D-120 deployed-node band (.201-.254) -- MAAS auto-assign for compute/OpenStack nodes", + "end_address": "10.10.1.254/24", + "range": "10.10.1.201/24-10.10.1.254/24", + "role": null, + "start_address": "10.10.1.201/24", + "status": "active" + }, + { + "description": "D-134 utility band (vr1-dc0 provider-public) -- .4-.49", + "end_address": "10.12.4.49/22", + "range": "10.12.4.4/22-10.12.4.49/22", + "role": null, + "start_address": "10.12.4.4/22", + "status": "reserved" + }, + { + "description": "D-134 VIP band (vr1-dc0 provider-public) -- .50-.99", + "end_address": "10.12.4.99/22", + "range": "10.12.4.50/22-10.12.4.99/22", + "role": null, + "start_address": "10.12.4.50/22", + "status": "reserved" + }, + { + "description": "D-134 utility band (vr1-dc0 metal-admin) -- .4-.49", + "end_address": "10.12.8.49/22", + "range": "10.12.8.4/22-10.12.8.49/22", + "role": null, + "start_address": "10.12.8.4/22", + "status": "reserved" + }, + { + "description": "D-134 VIP band (vr1-dc0 metal-admin) -- .50-.99", + "end_address": "10.12.8.99/22", + "range": "10.12.8.50/22-10.12.8.99/22", + "role": null, + "start_address": "10.12.8.50/22", + "status": "reserved" + }, + { + "description": "D-134 utility band (vr1-dc0 metal-internal) -- .4-.49", + "end_address": "10.12.12.49/22", + "range": "10.12.12.4/22-10.12.12.49/22", + "role": null, + "start_address": "10.12.12.4/22", + "status": "reserved" + }, + { + "description": "D-134 VIP band (vr1-dc0 metal-internal) -- .50-.99", + "end_address": "10.12.12.99/22", + "range": "10.12.12.50/22-10.12.12.99/22", + "role": null, + "start_address": "10.12.12.50/22", + "status": "reserved" + }, + { + "description": "D-134 utility band (vr1-dc0 data-tenant) -- .4-.49", + "end_address": "10.12.16.49/22", + "range": "10.12.16.4/22-10.12.16.49/22", + "role": null, + "start_address": "10.12.16.4/22", + "status": "reserved" + }, + { + "description": "D-134 VIP band (vr1-dc0 data-tenant) -- .50-.99", + "end_address": "10.12.16.99/22", + "range": "10.12.16.50/22-10.12.16.99/22", + "role": null, + "start_address": "10.12.16.50/22", + "status": "reserved" + }, + { + "description": "D-134 utility band (vr1-dc0 storage) -- .4-.49", + "end_address": "10.12.32.49/22", + "range": "10.12.32.4/22-10.12.32.49/22", + "role": null, + "start_address": "10.12.32.4/22", + "status": "reserved" + }, + { + "description": "D-134 VIP band (vr1-dc0 storage) -- .50-.99", + "end_address": "10.12.32.99/22", + "range": "10.12.32.50/22-10.12.32.99/22", + "role": null, + "start_address": "10.12.32.50/22", + "status": "reserved" + }, + { + "description": "D-134 utility band (vr1-dc0 replication) -- .4-.49", + "end_address": "10.12.36.49/22", + "range": "10.12.36.4/22-10.12.36.49/22", + "role": null, + "start_address": "10.12.36.4/22", + "status": "reserved" + }, + { + "description": "D-134 VIP band (vr1-dc0 replication) -- .50-.99", + "end_address": "10.12.36.99/22", + "range": "10.12.36.50/22-10.12.36.99/22", + "role": null, + "start_address": "10.12.36.50/22", + "status": "reserved" + }, + { + "description": "D-134 utility band (vr1-dc1 provider-public) -- .4-.49", + "end_address": "10.12.64.49/22", + "range": "10.12.64.4/22-10.12.64.49/22", + "role": null, + "start_address": "10.12.64.4/22", + "status": "reserved" + }, + { + "description": "D-134 VIP band (vr1-dc1 provider-public) -- .50-.99", + "end_address": "10.12.64.99/22", + "range": "10.12.64.50/22-10.12.64.99/22", + "role": null, + "start_address": "10.12.64.50/22", + "status": "reserved" + }, + { + "description": "D-134 utility band (vr1-dc1 metal-admin) -- .4-.49", + "end_address": "10.12.68.49/22", + "range": "10.12.68.4/22-10.12.68.49/22", + "role": null, + "start_address": "10.12.68.4/22", + "status": "reserved" + }, + { + "description": "D-134 VIP band (vr1-dc1 metal-admin) -- .50-.99", + "end_address": "10.12.68.99/22", + "range": "10.12.68.50/22-10.12.68.99/22", + "role": null, + "start_address": "10.12.68.50/22", + "status": "reserved" + }, + { + "description": "D-134 utility band (vr1-dc1 metal-internal) -- .4-.49", + "end_address": "10.12.72.49/22", + "range": "10.12.72.4/22-10.12.72.49/22", + "role": null, + "start_address": "10.12.72.4/22", + "status": "reserved" + }, + { + "description": "D-134 VIP band (vr1-dc1 metal-internal) -- .50-.99", + "end_address": "10.12.72.99/22", + "range": "10.12.72.50/22-10.12.72.99/22", + "role": null, + "start_address": "10.12.72.50/22", + "status": "reserved" + }, + { + "description": "D-134 utility band (vr1-dc1 data-tenant) -- .4-.49", + "end_address": "10.12.76.49/22", + "range": "10.12.76.4/22-10.12.76.49/22", + "role": null, + "start_address": "10.12.76.4/22", + "status": "reserved" + }, + { + "description": "D-134 VIP band (vr1-dc1 data-tenant) -- .50-.99", + "end_address": "10.12.76.99/22", + "range": "10.12.76.50/22-10.12.76.99/22", + "role": null, + "start_address": "10.12.76.50/22", + "status": "reserved" + }, + { + "description": "D-134 utility band (vr1-dc1 storage) -- .4-.49", + "end_address": "10.12.80.49/22", + "range": "10.12.80.4/22-10.12.80.49/22", + "role": null, + "start_address": "10.12.80.4/22", + "status": "reserved" + }, + { + "description": "D-134 VIP band (vr1-dc1 storage) -- .50-.99", + "end_address": "10.12.80.99/22", + "range": "10.12.80.50/22-10.12.80.99/22", + "role": null, + "start_address": "10.12.80.50/22", + "status": "reserved" + }, + { + "description": "D-134 utility band (vr1-dc1 replication) -- .4-.49", + "end_address": "10.12.84.49/22", + "range": "10.12.84.4/22-10.12.84.49/22", + "role": null, + "start_address": "10.12.84.4/22", + "status": "reserved" + }, + { + "description": "D-134 VIP band (vr1-dc1 replication) -- .50-.99", + "end_address": "10.12.84.99/22", + "range": "10.12.84.50/22-10.12.84.99/22", + "role": null, + "start_address": "10.12.84.50/22", + "status": "reserved" + } + ], + "ipam/prefixes": [ + { + "description": "Local Subnet", + "is_pool": false, + "mark_utilized": false, + "prefix": "0.0.0.0/8", + "role": "localnet", + "scope_type": null, + "status": "reserved" + }, + { + "description": "Corp Private", + "is_pool": false, + "mark_utilized": false, + "prefix": "10.0.0.0/8", + "role": "private", + "scope_type": null, + "status": "container" + }, + { + "description": "Office (v4) -- /22 per office (D-115)", + "is_pool": false, + "mark_utilized": false, + "prefix": "10.10.0.0/16", + "role": "office", + "scope_type": null, + "status": "container" + }, + { + "description": "VR1 Off1 -- office /22 (D-115)", + "is_pool": false, + "mark_utilized": false, + "prefix": "10.10.0.0/22", + "role": "office", + "scope_site": "vr1-off1", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "VR1 Off1 office1-local LAN -- Kea DHCP on the OPNsense edge (D-115)", + "is_pool": false, + "mark_utilized": false, + "prefix": "10.10.0.0/24", + "role": "office", + "scope_site": "vr1-off1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 Off1 LXD compose net (lxdbr0) -- MAAS DHCP (D-114/D-115)", + "is_pool": false, + "mark_utilized": false, + "prefix": "10.10.1.0/24", + "role": "office", + "scope_site": "vr1-off1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "Virtual Cloud IPs", + "is_pool": false, + "mark_utilized": false, + "prefix": "10.12.0.0/16", + "role": "cloud", + "scope_type": null, + "status": "active" + }, + { + "description": "VR1 DC0 provider-public (v4; D-101)", + "is_pool": false, + "mark_utilized": false, + "prefix": "10.12.4.0/22", + "role": "provider-public", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 metal-admin (v4; D-101)", + "is_pool": false, + "mark_utilized": false, + "prefix": "10.12.8.0/22", + "role": "metal-admin", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 metal-internal (v4; D-101)", + "is_pool": false, + "mark_utilized": false, + "prefix": "10.12.12.0/22", + "role": "metal-internal", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 data-tenant (v4; D-101)", + "is_pool": false, + "mark_utilized": false, + "prefix": "10.12.16.0/22", + "role": "data-tenant", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 storage (v4; D-101)", + "is_pool": false, + "mark_utilized": false, + "prefix": "10.12.32.0/22", + "role": "storage", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 replication (v4; D-101)", + "is_pool": false, + "mark_utilized": false, + "prefix": "10.12.36.0/22", + "role": "replication", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC1 provider-public (v4; D-101)", + "is_pool": false, + "mark_utilized": false, + "prefix": "10.12.64.0/22", + "role": "provider-public", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC1 metal-admin (v4; D-101)", + "is_pool": false, + "mark_utilized": false, + "prefix": "10.12.68.0/22", + "role": "metal-admin", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC1 metal-internal (v4; D-101)", + "is_pool": false, + "mark_utilized": false, + "prefix": "10.12.72.0/22", + "role": "metal-internal", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC1 data-tenant (v4; D-101)", + "is_pool": false, + "mark_utilized": false, + "prefix": "10.12.76.0/22", + "role": "data-tenant", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC1 storage (v4; D-101)", + "is_pool": false, + "mark_utilized": false, + "prefix": "10.12.80.0/22", + "role": "storage", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC1 replication (v4; D-101)", + "is_pool": false, + "mark_utilized": false, + "prefix": "10.12.84.0/22", + "role": "replication", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "Current assignment to Willamette dev cloud", + "is_pool": false, + "mark_utilized": false, + "prefix": "10.16.0.0/16", + "role": "dc", + "scope_type": null, + "status": "deprecated" + }, + { + "description": "Current assignment to Roosevelt dev cloud", + "is_pool": false, + "mark_utilized": false, + "prefix": "10.17.0.0/16", + "role": "dc", + "scope_type": null, + "status": "deprecated" + }, + { + "description": "Public ARIN assignment to Abysius Inc", + "is_pool": false, + "mark_utilized": false, + "prefix": "23.157.124.0/24", + "role": "public", + "scope_type": null, + "status": "container" + }, + { + "description": "CGNAT Reserved", + "is_pool": false, + "mark_utilized": false, + "prefix": "100.64.0.0/10", + "role": "cgnat", + "scope_type": null, + "status": "reserved" + }, + { + "description": "Localhost", + "is_pool": false, + "mark_utilized": false, + "prefix": "127.0.0.0/8", + "role": "localhost", + "scope_type": null, + "status": "reserved" + }, + { + "description": "Link-Local", + "is_pool": false, + "mark_utilized": false, + "prefix": "169.254.0.0/16", + "role": "link-local", + "scope_type": null, + "status": "reserved" + }, + { + "description": "Corp OOB Private", + "is_pool": false, + "mark_utilized": false, + "prefix": "172.16.0.0/12", + "role": "private", + "scope_type": null, + "status": "container" + }, + { + "description": "Edge (v4) -- simulated ISP/WAN segments; mirrors v6 2602:f3e2:fe::/48 (D-115)", + "is_pool": false, + "mark_utilized": false, + "prefix": "172.30.0.0/16", + "role": "edge", + "scope_type": null, + "status": "container" + }, + { + "description": "VR1 Off1 office1-wan -- simulated ISP uplink (D-115)", + "is_pool": false, + "mark_utilized": false, + "prefix": "172.30.1.0/24", + "role": "edge", + "scope_site": "vr1-off1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "vr1-dc0 simulated-ISP edge WAN (D-115)", + "is_pool": false, + "mark_utilized": false, + "prefix": "172.30.2.0/24", + "role": "edge", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "vr1-dc1 simulated-ISP edge WAN (D-115)", + "is_pool": false, + "mark_utilized": false, + "prefix": "172.30.3.0/24", + "role": "edge", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "Transit (v4) -- dedicated per-DC point-to-point transit supernet (D-124, operator-pinned 2026-07-16); UNSCOPED container, each DC's link scoped to its site. Precondition for dc-rack-mgmt-import.", + "is_pool": false, + "mark_utilized": false, + "prefix": "172.31.0.0/24", + "role": "transit", + "scope_type": null, + "status": "container" + }, + { + "description": "office1<->dc0 management transit -- region<->rack MAAS control path (D-124 Scheme A)", + "is_pool": false, + "mark_utilized": false, + "prefix": "172.31.0.0/30", + "role": "transit", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "office1<->dc1 management transit -- region<->rack MAAS control path (D-124 Scheme A)", + "is_pool": false, + "mark_utilized": false, + "prefix": "172.31.0.4/30", + "role": "transit", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "Residential Private", + "is_pool": false, + "mark_utilized": false, + "prefix": "192.168.0.0/16", + "role": "private", + "scope_type": null, + "status": "reserved" + }, + { + "description": "Public Multicast", + "is_pool": false, + "mark_utilized": false, + "prefix": "224.0.0.0/4", + "role": "multicast", + "scope_type": null, + "status": "reserved" + }, + { + "description": "Public Reserved - Enterprise Private", + "is_pool": false, + "mark_utilized": false, + "prefix": "240.0.0.0/4", + "role": "private", + "scope_type": null, + "status": "container" + }, + { + "description": "Localhost", + "is_pool": false, + "mark_utilized": false, + "prefix": "::1/128", + "role": "localhost", + "scope_type": null, + "status": "reserved" + }, + { + "description": "Discard Prefix", + "is_pool": false, + "mark_utilized": false, + "prefix": "100::/64", + "role": "discard", + "scope_type": null, + "status": "reserved" + }, + { + "description": "Public ARIN assignment to Abysius Inc", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2::/36", + "role": "public", + "scope_type": null, + "status": "container" + }, + { + "description": "Inter-Regional Infrastructure", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2::/40", + "role": "infra", + "scope_type": null, + "status": "container" + }, + { + "description": "Inter-Regional Site to Site Links", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2::/48", + "role": "infra", + "scope_type": null, + "status": "container" + }, + { + "description": "Edge Networks", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:fe::/48", + "role": null, + "scope_type": null, + "status": "container" + }, + { + "description": "Private cloud tenant reservation", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:ff::/48", + "role": "openstack-tenant", + "scope_type": null, + "status": "reserved" + }, + { + "description": "Eugene Region; Sites receive /24 allocations starting at fc01:0100::/24", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:100::/40", + "role": "region", + "scope_region": "eugene", + "scope_type": "dcim.region", + "status": "container" + }, + { + "description": "Eugene Regional Infrastructure", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:100::/48", + "role": "infra", + "scope_region": "eugene", + "scope_type": "dcim.region", + "status": "container" + }, + { + "description": "Eugene Site to Site Links", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:100::/56", + "role": "infra", + "scope_region": "eugene", + "scope_type": "dcim.region", + "status": "container" + }, + { + "description": "Eugene Regional Offices; Offices are allocated /32 subnets", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:101::/48", + "role": "office", + "scope_region": "eugene", + "scope_type": "dcim.region", + "status": "container" + }, + { + "description": "Reserved for fun and profit", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:101::/56", + "role": "office", + "scope_region": "eugene", + "scope_type": "dcim.region", + "status": "reserved" + }, + { + "description": "Charnelton", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:101:100::/56", + "role": "office", + "scope_site": "charnelton", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "Willamette Site", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102::/48", + "role": "dc", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "Omega Cloud", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102::/56", + "role": "cloud", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102:10::/60", + "role": "provider", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102:10::/64", + "role": "provider", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "Willamette Omega Cloud \u2014 Provider API VIPs (charm-managed via hacluster; excluded from Neutron pools)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102:11::/64", + "role": "provider", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102:20::/60", + "role": "metal", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102:20::/64", + "role": "metal", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102:30::/60", + "role": "data", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102:30::/64", + "role": "data", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102:40::/60", + "role": "storage", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102:40::/64", + "role": "storage", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102:50::/60", + "role": "repl", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102:50::/64", + "role": "repl", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102:80::/60", + "role": "lbaas-mgmt", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102:80::/64", + "role": "lbaas-mgmt", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102:e0::/60", + "role": "vpn", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102:f0::/60", + "role": "oob", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102:f0::/64", + "role": "oob", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "Psi Cloud", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102:100::/56", + "role": "cloud", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "Beta Cloud", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102:1600::/56", + "role": "cloud", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "Alpha Cloud", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:102:1700::/56", + "role": "cloud", + "scope_site": "willamette", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "Roosevelt Site", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:103::/48", + "role": "dc", + "scope_site": "roosevelt", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "Second Region", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:200::/40", + "role": "region", + "scope_type": null, + "status": "reserved" + }, + { + "description": "Third Region", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:300::/40", + "role": "region", + "scope_type": null, + "status": "reserved" + }, + { + "description": "Virtual Region 0 (VR0)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e00::/40", + "role": "region", + "scope_region": "vr0", + "scope_type": "dcim.region", + "status": "container" + }, + { + "description": "Virtual Region 0 (VR0) Infrastructure", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e00::/48", + "role": "infra", + "scope_region": "vr0", + "scope_type": "dcim.region", + "status": "container" + }, + { + "description": "VR0 Site to Site Links", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e00::/56", + "role": "infra", + "scope_region": "vr0", + "scope_type": "dcim.region", + "status": "active" + }, + { + "description": "VR0 DC1 to DC0 Site to Site Link", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e00:1::/127", + "role": "infra", + "scope_region": "vr0", + "scope_type": "dcim.region", + "status": "active" + }, + { + "description": "VR0 Off0 to DC0 Site to Site Link", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e00:2::/127", + "role": "infra", + "scope_region": "vr0", + "scope_type": "dcim.region", + "status": "active" + }, + { + "description": "Virtual Region 0 (VR0) Offices", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e01::/48", + "role": "office", + "scope_region": "vr0", + "scope_type": "dcim.region", + "status": "container" + }, + { + "description": "Virtual Region 0 (VR0) Offices; Reserved for fun and profit", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e01::/56", + "role": "office", + "scope_region": "vr0", + "scope_type": "dcim.region", + "status": "reserved" + }, + { + "description": "Virtual Region 0 (VR0) Office 0 (Off0)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e01:100::/56", + "role": "office", + "scope_site": "vr0-off0", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "VR0 Off0 Office Subnet", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e01:100::/64", + "role": "office", + "scope_site": "vr0-off0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "Virtual Region 0 (VR0) Datacenter 0 (DC0)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e02::/48", + "role": "dc", + "scope_site": "vr0-dc0", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "VR0 DC0 Omega Cloud", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e02::/56", + "role": "cloud", + "scope_site": "vr0-dc0", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "VR0 DC0 Omega Cloud Provider Prefix", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e02:10::/60", + "role": "provider", + "scope_site": "vr0-dc0", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "VR0 DC0 Omega Cloud Provider Subnet", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e02:10::/64", + "role": "provider", + "scope_site": "vr0-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR0 DC0 Omega Cloud \u2014 Provider API VIPs (charm-managed via hacluster; excluded from Neutron pools)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e02:11::/64", + "role": "provider", + "scope_site": "vr0-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR0 DC0 Omega Cloud Metal Prefix", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e02:20::/60", + "role": "metal", + "scope_site": "vr0-dc0", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "VR0 DC0 Omega Cloud Metal Subnet", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e02:20::/64", + "role": "metal", + "scope_site": "vr0-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR0 DC0 Omega Cloud Data Prefix", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e02:30::/60", + "role": "data", + "scope_site": "vr0-dc0", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "VR0 DC0 Omega Cloud Data Subnet", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e02:30::/64", + "role": "data", + "scope_site": "vr0-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR0 DC0 Omega Cloud Storage Prefix", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e02:40::/60", + "role": "storage", + "scope_site": "vr0-dc0", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "VR0 DC0 Omega Cloud Storage Subnet", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e02:40::/64", + "role": "storage", + "scope_site": "vr0-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR0 DC0 Omega Cloud Replication Prefix", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e02:50::/60", + "role": "repl", + "scope_site": "vr0-dc0", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "VR0 DC0 Omega Cloud Replication Subnet", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e02:50::/64", + "role": "repl", + "scope_site": "vr0-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR0 DC0 Omega Cloud LBaaS Management Prefix", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e02:80::/60", + "role": "lbaas-mgmt", + "scope_site": "vr0-dc0", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "VR0 DC0 Omega Cloud LBaaS Management Subnet", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e02:80::/64", + "role": "lbaas-mgmt", + "scope_site": "vr0-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR0 DC0 Omega Cloud VPN Prefix", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e02:e0::/60", + "role": "vpn", + "scope_site": "vr0-dc0", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "VR0 DC0 Omega Cloud OOB Prefix", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e02:f0::/60", + "role": "oob", + "scope_site": "vr0-dc0", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "VR0 DC0 Omega Cloud OOB Subnet", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e02:f0::/64", + "role": "oob", + "scope_site": "vr0-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "Virtual Region 0 (VR0) Datacenter 1 (DC1)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:e03::/48", + "role": "dc", + "scope_site": "vr0-dc1", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "Virtual Region 1 (VR1)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f00::/40", + "role": "region", + "scope_region": "vr1", + "scope_type": "dcim.region", + "status": "container" + }, + { + "description": "Virtual Region 1 (VR1) Infrastructure", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f00::/48", + "role": "infra", + "scope_region": "vr1", + "scope_type": "dcim.region", + "status": "container" + }, + { + "description": "VR1 Site to Site Links", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f00::/56", + "role": "infra", + "scope_region": "vr1", + "scope_type": "dcim.region", + "status": "active" + }, + { + "description": "Virtual Region 1 (VR1) Offices", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f01::/48", + "role": "office", + "scope_region": "vr1", + "scope_type": "dcim.region", + "status": "container" + }, + { + "description": "Virtual Region 1 (VR1) Offices; Reserved for fun and profit", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f01::/56", + "role": "office", + "scope_region": "vr1", + "scope_type": "dcim.region", + "status": "reserved" + }, + { + "description": "VR1 Off1 (D-115) -- mirrors VR0 Off0 e01:100::/56", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f01:100::/56", + "role": "office", + "scope_site": "vr1-off1", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "VR1 Off1 office subnet -- NOT YET DEPLOYED (v6 does not egress the lab)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f01:100::/64", + "role": "office", + "scope_site": "vr1-off1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "Virtual Region 1 (VR1) Datacenter 0 (DC0)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f02::/48", + "role": "dc", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "VR1 DC0 provider-public (GUA /60; D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f02:10::/60", + "role": "provider-public", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 provider-public (GUA /64 active; D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f02:10::/64", + "role": "provider-public", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 provider-public (GUA VIP /64; D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f02:11::/64", + "role": "provider-public", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 metal-admin (GUA /60; D-139)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f02:20::/60", + "role": "metal-admin", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 metal-admin (GUA /64; D-139)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f02:20::/64", + "role": "metal-admin", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 metal-internal (GUA /64; D-139)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f02:21::/64", + "role": "metal-internal", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 data-tenant (GUA /60; D-139)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f02:30::/60", + "role": "data-tenant", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 data-tenant (GUA /64; D-139)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f02:30::/64", + "role": "data-tenant", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 storage (GUA /60; D-139)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f02:40::/60", + "role": "storage", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 storage (GUA /64; D-139)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f02:40::/64", + "role": "storage", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 replication (GUA /60; D-139)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f02:50::/60", + "role": "replication", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 replication (GUA /64; D-139)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f02:50::/64", + "role": "replication", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 lb-mgmt (GUA /60; D-139)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f02:80::/60", + "role": "lbaas-mgmt", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 lb-mgmt (GUA /64; D-139)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f02:80::/64", + "role": "lbaas-mgmt", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 oob (GUA /60; D-139)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f02:f0::/60", + "role": "oob", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC0 oob (GUA /64; D-139)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f02:f0::/64", + "role": "oob", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "Virtual Region 1 (VR1) Datacenter 1 (DC1)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f03::/48", + "role": "dc", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "container" + }, + { + "description": "VR1 DC1 provider-public (GUA /60; D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f03:10::/60", + "role": "provider-public", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC1 provider-public (GUA /64 active; D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f03:10::/64", + "role": "provider-public", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC1 provider-public (GUA VIP /64; D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "2602:f3e2:f03:11::/64", + "role": "provider-public", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "Centrally assigned ULA (Not Active)", + "is_pool": false, + "mark_utilized": false, + "prefix": "fc00::/8", + "role": "private", + "scope_type": null, + "status": "reserved" + }, + { + "description": "Unique Local Addresses (ULA)", + "is_pool": false, + "mark_utilized": false, + "prefix": "fd00::/8", + "role": "private", + "scope_type": null, + "status": "container" + }, + { + "description": "VR1 DC0 metal-admin (ULA metal /60 (admin+internal); D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "fd50:840e:74e2:220::/60", + "role": "metal-admin", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "deprecated" + }, + { + "description": "VR1 DC0 metal-admin (ULA /64 active; D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "fd50:840e:74e2:220::/64", + "role": "metal-admin", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "deprecated" + }, + { + "description": "VR1 DC0 metal-internal (ULA /64 active (in metal /60); D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "fd50:840e:74e2:221::/64", + "role": "metal-internal", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "deprecated" + }, + { + "description": "VR1 DC0 data-tenant (ULA /60; D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "fd50:840e:74e2:230::/60", + "role": "data-tenant", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "deprecated" + }, + { + "description": "VR1 DC0 data-tenant (ULA /64 active; D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "fd50:840e:74e2:230::/64", + "role": "data-tenant", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "deprecated" + }, + { + "description": "VR1 DC0 storage (ULA /60; D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "fd50:840e:74e2:240::/60", + "role": "storage", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "deprecated" + }, + { + "description": "VR1 DC0 storage (ULA /64 active; D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "fd50:840e:74e2:240::/64", + "role": "storage", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "deprecated" + }, + { + "description": "VR1 DC0 replication (ULA /60; D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "fd50:840e:74e2:250::/60", + "role": "replication", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "deprecated" + }, + { + "description": "VR1 DC0 replication (ULA /64 active; D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "fd50:840e:74e2:250::/64", + "role": "replication", + "scope_site": "vr1-dc0", + "scope_type": "dcim.site", + "status": "deprecated" + }, + { + "description": "VR1 DC1 metal-admin (ULA metal /60 (admin+internal); D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "fd50:840e:74e2:320::/60", + "role": "metal-admin", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC1 metal-admin (ULA /64 active; D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "fd50:840e:74e2:320::/64", + "role": "metal-admin", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC1 metal-internal (ULA /64 active (in metal /60); D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "fd50:840e:74e2:321::/64", + "role": "metal-internal", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC1 data-tenant (ULA /60; D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "fd50:840e:74e2:330::/60", + "role": "data-tenant", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC1 data-tenant (ULA /64 active; D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "fd50:840e:74e2:330::/64", + "role": "data-tenant", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC1 storage (ULA /60; D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "fd50:840e:74e2:340::/60", + "role": "storage", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC1 storage (ULA /64 active; D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "fd50:840e:74e2:340::/64", + "role": "storage", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC1 replication (ULA /60; D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "fd50:840e:74e2:350::/60", + "role": "replication", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "VR1 DC1 replication (ULA /64 active; D-101/D-111)", + "is_pool": false, + "mark_utilized": false, + "prefix": "fd50:840e:74e2:350::/64", + "role": "replication", + "scope_site": "vr1-dc1", + "scope_type": "dcim.site", + "status": "active" + }, + { + "description": "Tailscale Addresses", + "is_pool": false, + "mark_utilized": true, + "prefix": "fd7a:115c:a1e0::/48", + "role": "vpn", + "scope_type": null, + "status": "active" + }, + { + "description": "Link-Local", + "is_pool": false, + "mark_utilized": false, + "prefix": "fe80::/10", + "role": "link-local", + "scope_type": null, + "status": "reserved" + }, + { + "description": "Public Multicast", + "is_pool": false, + "mark_utilized": false, + "prefix": "ff00::/8", + "role": "multicast", + "scope_type": null, + "status": "reserved" + } + ], + "ipam/rirs": [ + { + "description": "", + "is_private": false, + "name": "ARIN", + "slug": "arin" + }, + { + "description": "", + "is_private": true, + "name": "RFC 1918", + "slug": "rfc-1918" + }, + { + "description": "", + "is_private": true, + "name": "RFC 4193 ULA", + "slug": "rfc-4193-ula" + } + ], + "ipam/roles": [ + { + "description": "Six-plane: provider public API VIPs + FIP/ext_net (GUA). D-052/D-101.", + "name": "Provider Public", + "slug": "provider-public", + "weight": 100 + }, + { + "description": "Six-plane: metal admin API, dual-stack v4+ULA (2026-07-09 amendment). D-052/D-101.", + "name": "Metal Admin", + "slug": "metal-admin", + "weight": 110 + }, + { + "description": "Six-plane: metal internal API endpoints, dual-stack v4+ULA. D-052/D-101.", + "name": "Metal Internal", + "slug": "metal-internal", + "weight": 120 + }, + { + "description": "Six-plane: geneve overlay, ULA-only; tenant GUA delegated separately. D-052/D-101.", + "name": "Data Tenant", + "slug": "data-tenant", + "weight": 130 + }, + { + "description": "Six-plane: Ceph cluster incl. cross-DC leg, ULA-only. D-052/D-101/D-108.", + "name": "Replication Plane", + "slug": "replication", + "weight": 150 + }, + { + "description": "", + "name": "CGNAT", + "slug": "cgnat", + "weight": 1000 + }, + { + "description": "Cloud container", + "name": "Cloud", + "slug": "cloud", + "weight": 1000 + }, + { + "description": "Openstack data plane - shared across datacenters", + "name": "Data", + "slug": "data", + "weight": 1000 + }, + { + "description": "Datacenter container", + "name": "Datacenter", + "slug": "dc", + "weight": 1000 + }, + { + "description": "", + "name": "Discard", + "slug": "discard", + "weight": 1000 + }, + { + "description": "", + "name": "Edge", + "slug": "edge", + "weight": 1000 + }, + { + "description": "Shared infrastructure \u2014 ptp transit, device loopbacks, RR loopbacks, anycast.", + "name": "Infrastructure", + "slug": "infra", + "weight": 1000 + }, + { + "description": "Load-balancer management (Octavia control plane, not dataplane).", + "name": "LBaaS Management", + "slug": "lbaas-mgmt", + "weight": 1000 + }, + { + "description": "", + "name": "Link-Local", + "slug": "link-local", + "weight": 1000 + }, + { + "description": "", + "name": "Localhost", + "slug": "localhost", + "weight": 1000 + }, + { + "description": "", + "name": "Localnet", + "slug": "localnet", + "weight": 1000 + }, + { + "description": "Bare-metal server NICs + bundled infra: OpenStack control plane, in-band switch mgmt (VLAN 50), Edge-eBGP/DDoS sub-ranges (Roosevelt), RR loopback references. Sized as 2x physical server count.", + "name": "Metal", + "slug": "metal", + "weight": 1000 + }, + { + "description": "", + "name": "Multicast", + "slug": "multicast", + "weight": 1000 + }, + { + "description": "Out of band management network", + "name": "OOB", + "slug": "oob", + "weight": 1000 + }, + { + "description": "Office site allocation (/24 within Region0 /20 reserved block).", + "name": "Office", + "slug": "office", + "weight": 1000 + }, + { + "description": "OpenStack tenant pool \u2014 shared across tenants", + "name": "Openstack Tenant", + "slug": "openstack-tenant", + "weight": 1000 + }, + { + "description": "Reserved addresses for private networks", + "name": "Private", + "slug": "private", + "weight": 1000 + }, + { + "description": "Tenant-reachable. Carries ext_net (FIPs, SNAT egress) and OpenStack public API VIPs. Within each /60: first /64 Neutron FIP pool; next /64 charm API VIPs. Neutron allocation_pools must exclude VIPs.", + "name": "Provider", + "slug": "provider", + "weight": 1000 + }, + { + "description": "Public addresses assigned by a RIR", + "name": "Public", + "slug": "public", + "weight": 1000 + }, + { + "description": "", + "name": "Region", + "slug": "region", + "weight": 1000 + }, + { + "description": "RBD mirror for cross-site Ceph replication. Routed via EVPN type-5 between DCs.", + "name": "Replication", + "slug": "repl", + "weight": 1000 + }, + { + "description": "Ceph-Public (L3-routed) + Ceph-Cluster (non-routed VLAN inside /23 L2).", + "name": "Storage", + "slug": "storage", + "weight": 1000 + }, + { + "description": "OpenStack tenant networks (Geneve underlay touchdown). Also absorbs DMZ roles under regional scheme.", + "name": "Tenant", + "slug": "tenant", + "weight": 1000 + }, + { + "description": "", + "name": "Transit", + "slug": "transit", + "weight": 1000 + }, + { + "description": "VPN client pools \u2014 site-independent (10.2.0.0/16 Corp Private).", + "name": "VPN", + "slug": "vpn", + "weight": 1000 + } + ] +} diff --git a/runbooks/dc-dc-phase4-juju-bundle-per-dc.md b/runbooks/dc-dc-phase4-juju-bundle-per-dc.md index 6c0fce9..38a93e7 100644 --- a/runbooks/dc-dc-phase4-juju-bundle-per-dc.md +++ b/runbooks/dc-dc-phase4-juju-bundle-per-dc.md @@ -903,7 +903,18 @@ `prefer-ipv6` + `ceph-public-network`/`ceph-cluster-network` (a clean switch-to-v6-only, correct for the ULA-only planes); NO entry for OVN (confirmed no such charm-config option exists -- geneve family follows the -bound interface automatically once the plane itself is ULA-only). +bound interface automatically once the plane itself is v6-only). +**CAVEAT (measured 2026-08-09, do NOT read "follows the interface" as "just +works"):** a v6-only data-tenant is NECESSARY but NOT SUFFICIENT for +geneve-over-v6. Two extra conditions must hold, both verified at Step 12.2: +(i) the CONTAINERIZED chassis (octavia LXD) must actually take a v6 data-tenant +address -- they auto-picked v4 on vr1-dc0 (D-134), so carve/assign v6, do not +rely on auto-pick; and (ii) `ovn-chassis` 24.03 emits the v6 `ovn-encap-ip` +BRACKETED (`"[2602:...]"`), which OVS geneve rejects (`bad remote_ip`, tunnel +`ofport -1`) -- it must reach OVS UNbracketed (fixed charm rev or post-deploy +override). geneve-over-v6 IS confirmed working on this stack (OVS 3.3 / OVN +24.03 / kernel 5.15) once both hold. Full evidence + tested sequence: +`docs/audit/geneve-over-v6-rootcause-20260808.md`. **This is an INCREMENTAL ADD against the LIVE `$DC_MODEL` Step 4 already deployed -- not a fresh deploy.** It re-passes the SAME overlay set Step 4 used @@ -1079,33 +1090,45 @@ only ever return empty and read as "nothing wrong". Assert what is actually observable on a chassis instead: -**Name the unit first, then probe it.** `ovn-chassis` is a SUBORDINATE (to -nova-compute -- `bundle.yaml:450,453`), and whether `/leader` resolves for a -subordinate is NOT verified from this repo. The precedent that IS established -here uses a NAMED unit, not `/leader` -(`runbooks/phase-05-octavia-enablement.md:93` -> `--unit octavia/0`). So: +**FAMILY CONSISTENCY IS NECESSARY BUT NOT SUFFICIENT -- both were learned the +hard way on vr1-dc0 (`docs/audit/geneve-over-v6-rootcause-20260808.md`).** A +family-only check PASSES on a v6 encap whose tunnel never instantiated. Two +distinct failures were measured, so the gate asserts BOTH: +- **C1 family split** (2026-08-08): the containerized control chassis (octavia + LXD) took IPv4 data-tenant addresses while metal compute took IPv6 -> no + cross-family tunnel forms -> 100% cross-node loss. +- **C2 bracketed encap** (2026-08-09): `ovn-chassis` 24.03 emits the v6 + `ovn-encap-ip` BRACKETED (`"[2602:...]"`), which OVS geneve REJECTS + (`bad geneve 'remote_ip'`), leaving every v6 tunnel at `ofport -1`. C1 alone + reads PASS while no traffic passes. Live-CONFIRMED fix: the encap delivered + UNbracketed -> tunnel `ofport 14` -> real VM->VM 0% loss. +**PRIMARY GATE (executable):** ```bash -# 1. list this DC's chassis units and pick one that is on a COMPUTE host: -juju status -m "$DC_MODEL" ovn-chassis -# 2. probe THAT unit by name (substitute for ovn-chassis/0): -juju exec -m "$DC_MODEL" --unit ovn-chassis/0 -- \ - 'sudo ovs-vsctl get Open_vSwitch . external_ids' = 0). +bash scripts/geneve-encap-assert.sh --live "$DC_MODEL" --expect-family v6 ``` -Repeat for each chassis unit -- one chassis tunnelling on the wrong family is -still a defect, and checking one unit does not clear the others. +PASS only if it prints `geneve-encap-assert: PASS` (exit 0). A `C1 ... SPLIT` +FAIL = the family split; a `C2 ... ofport -1` FAIL = the bracket bug (apply the +unbracket fix -- fixed charm revision, or per-chassis +`sudo ovs-vsctl set open_vswitch . external_ids:ovn-encap-ip=` -- +then re-run). Note the encap prefix is **GUA** `2602:f3e2:f0X:30::/64` (D-139 +retired the ULA); a check citing "data-tenant ULA" is stale. -**GATE -- three outcomes, and only one passes:** -- An encapsulation address is reported and it is an IPv6 address inside THIS - DC's data-tenant ULA prefix (`scripts/lib-net.sh` `PLANE_NAME` -> - `data-tenant`, after `lib_net_select_dc "$DC"`) -> PASS. -- An encapsulation address is reported and it is IPv4, or outside that prefix - -> FAIL. The chassis is tunnelling on the wrong plane or the wrong family. -- No encapsulation entry appears at all, or the command errors -> **REFUSE, do - not pass.** "Could not look" is never "nothing there". Record the raw output, - confirm the unit name from step 1 is one juju actually lists, and check Step 6 - was APPLIED rather than only dry-run. If it still shows nothing, this gate is - BLOCKED and is recorded as BLOCKED -- never as a pass. +**MANUAL back-up probe** (if the script cannot run): `ovn-chassis` is a +SUBORDINATE (to nova-compute -- `bundle.yaml:450,453`); name a unit on a COMPUTE +host, do not assume `/leader`. Check the Encap.ip family AND the tunnel ofport: +```bash +juju status -m "$DC_MODEL" ovn-chassis +juju exec -m "$DC_MODEL" --unit ovn-central/leader -- \ + 'sudo ovn-sbctl --columns=chassis_name,ip list encap' =0, error [] +``` +Repeat C2 per chassis unit. No encap entry / a command error -> **REFUSE, do not +pass** ("could not look" is never "nothing there"); an `ofport -1`/error is a +FAIL, not a skip; confirm Step 6 was APPLIED, else record BLOCKED (never a pass). ### 12.3 -- The four VERIFY-LIVE gates diff --git a/scripts/geneve-encap-assert.sh b/scripts/geneve-encap-assert.sh new file mode 100755 index 0000000..5ae7cc6 --- /dev/null +++ b/scripts/geneve-encap-assert.sh @@ -0,0 +1,126 @@ +#!/usr/bin/env bash +# scripts/geneve-encap-assert.sh +# +# GATE: OVN geneve underlay is HEALTHY and FAMILY-CONSISTENT across all chassis. +# Makes the phase-04 "geneve-over-v6 verified" gate EXECUTABLE (D-101 named it a +# verification gate; nothing asserted it -- ruled-not-built). Backed by the +# 2026-08-09 live root cause: docs/audit/geneve-over-v6-rootcause-20260808.md. +# +# TWO checks, both learned from measured failures on vr1-dc0: +# C1 FAMILY CONSISTENCY -- every chassis Encap.ip is the SAME address family. +# A split (containerized control v4 + metal compute v6) means cross-family +# tunnels never form (the 2026-08-08 root cause). Optional --expect-family +# v6|v4 also pins the family to the ruled one (parameterised, not hardcoded, +# so a legitimately v4-consistent cloud does not false-fail). +# C2 TUNNEL HEALTH -- every geneve tunnel interface has ofport >= 0. An ofport +# of -1 is an INVALID tunnel: the 2026-08-09 root cause was ovn-chassis 24.03 +# emitting a BRACKETED v6 ovn-encap-ip ("[2602:...]") that OVS geneve rejects +# ("bad geneve 'remote_ip'"), leaving every v6 tunnel at ofport -1 while a +# family-only check (C1) still passes. C2 catches exactly that class. +# +# OFFLINE (testable): feed captured command output as files -- +# --encap-ips FILE one chassis Encap.ip per line +# (live: ovn-sbctl --data=bare --no-heading --columns=ip list encap) +# --tunnel-ofports FILE one geneve-tunnel ofport per line, across ALL chassis +# (live: ovs-vsctl --data=bare --no-heading --columns=ofport find interface type=geneve) +# LIVE (integration): --live [MODEL] gathers both via juju on the DC rack (D-138). +# --expect-family v6|v4 optional: also assert the consistent family is this one. +# +# Usage: +# scripts/geneve-encap-assert.sh --encap-ips E.txt --tunnel-ofports T.txt [--expect-family v6] +# scripts/geneve-encap-assert.sh --live [MODEL] [--expect-family v6] # from the DC rack +# Exit: 0 all pass | 1 any FAIL | 2 usage/precondition. ASCII + LF. + +set -uo pipefail + +ENCAP_FILE=""; OFPORT_FILE=""; EXPECT_FAMILY=""; LIVE=0; MODEL="openstack" +FAIL=0 +fail() { echo "FAIL: $*" >&2; FAIL=1; } +pass() { echo "PASS: $*"; } +die() { echo "USAGE: $*" >&2; exit 2; } + +while [ $# -gt 0 ]; do + case "$1" in + --encap-ips) ENCAP_FILE="${2:-}"; shift 2 ;; + --tunnel-ofports) OFPORT_FILE="${2:-}"; shift 2 ;; + --expect-family) EXPECT_FAMILY="${2:-}"; shift 2 ;; + --live) LIVE=1; shift + # optional bare MODEL arg may follow + if [ $# -gt 0 ] && [ "${1#--}" = "$1" ]; then MODEL="$1"; shift; fi ;; + -h|--help) grep -E '^#' "$0" | sed 's/^# \{0,1\}//'; exit 2 ;; + *) die "unknown arg: $1" ;; + esac +done + +[ -n "$EXPECT_FAMILY" ] && [ "$EXPECT_FAMILY" != v6 ] && [ "$EXPECT_FAMILY" != v4 ] \ + && die "--expect-family must be v6 or v4 (got '$EXPECT_FAMILY')" + +# strip a surrounding [ ] and any quotes; return v4|v6|"" for an address string +fam_of() { + local a="$1" + a="${a//\"/}"; a="${a#[}"; a="${a%]}" + [ -z "$a" ] && { echo ""; return; } + case "$a" in *:*) echo v6 ;; *.*) echo v4 ;; *) echo "" ;; esac +} + +if [ "$LIVE" -eq 1 ]; then + command -v juju >/dev/null 2>&1 || die "juju not found (run from the DC rack, D-138)" + ENCAP_FILE="$(mktemp)"; OFPORT_FILE="$(mktemp)" + trap 'rm -f "$ENCAP_FILE" "$OFPORT_FILE"' EXIT + juju exec -m "$MODEL" --unit ovn-central/leader -- \ + sudo ovn-sbctl --data=bare --no-heading --columns=ip list encap /dev/null \ + | tr -d '\r' | grep -vE '^\s*$' > "$ENCAP_FILE" || true + # ovn-chassis lives on nova-compute (subordinate) and octavia (ovn-chassis-octavia) + for app in nova-compute octavia; do + juju exec -m "$MODEL" --application "$app" -- \ + sudo ovs-vsctl --data=bare --no-heading --columns=ofport find interface type=geneve \ + /dev/null | tr -d '\r' | grep -E '^-?[0-9]+$' >> "$OFPORT_FILE" || true + done +fi + +[ -n "$ENCAP_FILE" ] && [ -r "$ENCAP_FILE" ] || die "need --encap-ips FILE (or --live)" +[ -n "$OFPORT_FILE" ] && [ -r "$OFPORT_FILE" ] || die "need --tunnel-ofports FILE (or --live)" + +# ---- C1: family consistency (+ optional expected family) -------------------- +families=""; nencap=0 +while IFS= read -r line; do + line="${line%%$'\r'}"; [ -z "${line// }" ] && continue + nencap=$((nencap + 1)) + f="$(fam_of "$line")" + [ -z "$f" ] && { fail "C1: unparseable Encap.ip '$line'"; continue; } + case " $families " in *" $f "*) : ;; *) families="$families $f" ;; esac +done < "$ENCAP_FILE" + +if [ "$nencap" -eq 0 ]; then + fail "C1: no chassis Encap.ip found -- cannot assert (refuse, not pass)" +else + nfam=$(echo $families | wc -w) + if [ "$nfam" -gt 1 ]; then + fail "C1: geneve encap SPLIT across families ($(echo $families)) over $nencap chassis -- cross-family tunnels cannot form" + else + pass "C1: all $nencap chassis Encap.ip are single-family ($(echo $families))" + if [ -n "$EXPECT_FAMILY" ] && [ "$(echo $families | tr -d ' ')" != "$EXPECT_FAMILY" ]; then + fail "C1: encap family is '$(echo $families | tr -d ' ')' but --expect-family=$EXPECT_FAMILY (ruled family)" + fi + fi +fi + +# ---- C2: tunnel health (ofport >= 0 for every geneve tunnel) ---------------- +ntun=0; bad=0 +while IFS= read -r of; do + of="${of%%$'\r'}"; [ -z "${of// }" ] && continue + case "$of" in ''|*[!0-9-]*) fail "C2: unparseable ofport '$of'"; continue ;; esac + ntun=$((ntun + 1)) + [ "$of" -lt 0 ] && bad=$((bad + 1)) +done < "$OFPORT_FILE" + +if [ "$ntun" -eq 0 ]; then + fail "C2: no geneve tunnel interfaces found -- cannot assert (refuse, not pass)" +elif [ "$bad" -gt 0 ]; then + fail "C2: $bad of $ntun geneve tunnels have ofport -1 (INVALID -- e.g. bracketed v6 ovn-encap-ip OVS rejects; see geneve-over-v6-rootcause-20260808.md)" +else + pass "C2: all $ntun geneve tunnel interfaces have ofport >= 0" +fi + +if [ "$FAIL" -eq 0 ]; then echo "geneve-encap-assert: PASS"; exit 0; fi +echo "geneve-encap-assert: FAIL" >&2; exit 1 diff --git a/tests/HARNESS-MANIFEST b/tests/HARNESS-MANIFEST index 4d4e42d..ba41f7b 100644 --- a/tests/HARNESS-MANIFEST +++ b/tests/HARNESS-MANIFEST @@ -38,6 +38,7 @@ dc-snap-proxy dc-util-hosts-import g3-domain-manager-probe +geneve-encap-assert juju-spaces-check keystone-policy-drift ledger-scan diff --git a/tests/geneve-encap-assert/run-tests.sh b/tests/geneve-encap-assert/run-tests.sh new file mode 100755 index 0000000..8c4648c --- /dev/null +++ b/tests/geneve-encap-assert/run-tests.sh @@ -0,0 +1,71 @@ +#!/usr/bin/env bash +# tests/geneve-encap-assert/run-tests.sh -- offline harness for +# scripts/geneve-encap-assert.sh. Self-contained: fixtures are written to a +# temp dir; the pure assertion logic (C1 family consistency, C2 tunnel ofport +# health) runs for real against them. Every check is proven in its FAILING +# direction (a checker that cannot fail is not a gate). Exit: 0 all pass | 1 any +# case failed. ASCII + LF. +set -uo pipefail +HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +SCRIPT="$HERE/../../scripts/geneve-encap-assert.sh" +TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT +PASS=0; FAIL=0 + +run() { # run