diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index c20cb30..c9989c7 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -2424,11 +2424,28 @@ **PER-DC TAILSCALE BUILD STATUS (2026-08-07):** rulings a-d RULED (D-129(iii) amdt); tooling built (`scripts/site-tailscale.sh` + harness); the `.7` subnet-router VMs are APPLIED via tofu on BOTH DCs and MACs pinned (`vr1-dc0-tailscale-01`; `vr1-dc1-tailscale-01`; AND `vr1-dc1-maas-01` - the dc1 region VM, applied full per operator "dc1 full") -- all three POWERED OFF (autostart=false), - tofu No-changes. OWED next: start -> MAAS enlist/commission/deploy -> carve `.7` metal-admin + - provider-public -> install tailscale; then the Headscale-side join (tagged authkey / autoApprovers - / star ACL / Office1-untagged fix) which is BLOCKED on control-plane access; then the browser-login - confirm closes Step 3.3. dc1 region VM also owes its full region SETUP workstream. + the dc1 region VM, applied full per operator "dc1 full"). + **>>> dc0 `.7` DRIVEN TO CARVED-AND-READY 2026-08-07 (commit `d36d815` + this session; changelog + `docs/changelog-20260807-dc0-tailscale-provisioning.md`). <<<** MEASURED corrections (C2): the dc0 + `.7` VM had ALREADY self-enlisted as `known-marten` (n4parh) in `vr1-dc0-region`, New/power-unset; + the prior "powered off" omitted the enlisted part. Done, all gated: (1) power set + (`maas-node-power.sh`, DC-region-reachable `10.12.8.2`, proven by live query); (2) commissioned -> + Ready; (3) NEW aux-carve tooling (`dc-node-carve.sh` `is_tailscale_host`/`is_two_plane_host` + + lib-hosts `CARVE_AUX_HOSTS`, harness 58/0, gauntlet ALL GREEN 101 -- `docs/audit/gauntlet-20260807-tailscale-carve.txt`); + (4) carve applied + verified `pass=8 fail=0` (metal-admin `10.12.8.7`, provider-public `10.12.4.7` + VLAN 5002, NO br-ex); (5) MAAS-deployed jammy -> **Deployed**, sshd live on `10.12.8.7`. The `.7` + router is NOT juju-managed so it MUST be MAAS-deployed (DOCFIX-200's "stay Ready" is juju-only). + **TWO JOIN PREREQUISITES REMAIN, both off-session:** (a) a TAGGED pre-auth key + Headscale + autoApprovers/star-ACL (operator's key is PLAIN -- ruled 2026-08-07; a plain key cannot authorise + `tag:subnet-router`, so the join was deliberately NOT attempted -- an untagged first-advertise is + the office1 defect); (b) SSH access to the VM -- the region injects only `vr1-office1-svc`, held by + the operator (neither voffice1's default nor `vr1-dc0_svc` authenticates; NOT fished). Then + `site-tailscale.sh install` + browser-login `https://10.12.8.58` closes Step 3.3. + **dc1 RULED 2026-08-07 (GA-R5, verbatim "No migration. Build region on DC1 correctly."):** dc1 + `.7` is GATED behind building the dedicated `vr1-dc1-region` on `vr1-dc1-maas-01` (N3; MEASURED: + `vr1-dc1-region` NOT registered, dc1 rack `nmpcq4` + 9 nodes still in the Office1 `admin` region) -- + do NOT enlist dc1 `.7` into the Office1 region. lib-hosts already carries `vr1-dc1-tailscale-01` + (octet 7, MAC `52:54:00:f9:d6:df`) so the aux-carve reuses on dc1 once its region exists. F-CV1: designate _admin backend DOWN -- **RESOLVED 2026-08-06 (BUNDLEFIX-056, operator-approved fix EXECUTED + VERIFIED).** Root cause (governing = D-052 + generic binding rule + the D-020 amendment's ruled .62 triple, NOT D-141): designate's bundle bindings OMITTED public + internal, diff --git a/docs/changelog-20260807-dc0-tailscale-provisioning.md b/docs/changelog-20260807-dc0-tailscale-provisioning.md index 4307484..23d70a7 100644 --- a/docs/changelog-20260807-dc0-tailscale-provisioning.md +++ b/docs/changelog-20260807-dc0-tailscale-provisioning.md @@ -82,3 +82,67 @@ REVERT: `git revert` this commit -- removes `CARVE_AUX_HOSTS`, the tailscale predicates, and the harness cases; `dc-node-carve.sh` returns to role+juju only. lib-hosts map keys become inert. No live-cloud effect (this item is repo tooling; the carve APPLY is a separate gated mutation). + +## Item 3 -- dc0 .7 VM: 2-leg carve applied + verified (LIVE, gated) + +WHAT: `dc-node-carve.sh apply vr1-dc0 --profile vr1-dc0-region --expect-rack hot-kid +--host vr1-dc0-tailscale-01 --commit` -> 4 mutations, each read back: + - enp1s0: unlinked the commissioning `auto` link (id 1219) -> STATIC `10.12.8.7` on + metal-admin (VLAN 5001, already correct -- move skipped); + - enp2s0: -> VLAN 5002 (provider-public) -> STATIC `10.12.4.7`. +Post-apply `check` = **pass=8 fail=0**: both legs static on the right VLANs, enp3s0..enp6s0 +carry NO plane link, NO br-ex. Dry-run check beforehand FAILED (uncarved) and the dry-run +plan matched exactly -- verify-before-mutate. + +WHY: MAAS renders netplan from these links at deploy time; the carve must land while Ready +(MAAS refuses interface changes on a Deployed machine). metal-admin is gatewayless (advertised +plane); provider-public carries the subnet gateway 10.12.4.1 (the node default route -> egress +to Headscale). br-ex is deliberately absent (not an OVN node). + +REVERT: re-link enp1s0/enp2s0 to `auto`/`link_up` via `maas vr1-dc0-region interface +link-subnet`/`unlink-subnet`, or release+recommission the machine (returns interfaces to the +commissioning state). No downstream consumer depends on the .7 statics yet. + +## Item 4 -- dc0 .7 VM: MAAS-deployed jammy (LIVE, gated) + +WHAT: `maas vr1-dc0-region machine deploy n4parh distro_series=jammy` -> polled Deploying -> +**Deployed** at 03:27:05Z, power on. The .7 router is NOT in the juju model, so it must be +MAAS-deployed to carry an OS (DOCFIX-200's "stay Ready" applies only to juju-managed nodes). +jammy chosen = the established DC image (role nodes) and confirmed deployable +(`boot-resources read`: ubuntu/jammy + ubuntu/noble). Set distro_series explicitly (hard rule 2). + +READ-BACK: the VM's sshd answers on metal-admin `10.12.8.7` (a ProxyJump via the rack reached +`Permission denied (publickey)` = the leg is live + sshd up). In-VM route/egress NOT verified -- +see Item 5. + +REVERT: `maas vr1-dc0-region machine release n4parh` -> back to Ready (the carve persists). + +## Item 5 -- carved-and-ready state + the two remaining JOIN prerequisites (FINDING) + +STATE reached this session: dc0 `.7` router = **Deployed (jammy) + carved (verified) + sshd +live on 10.12.8.7**. This is "carved-and-ready": the provisioning is complete; only the +Tailscale join remains. Two prerequisites, BOTH outside this session: + +1. **Tagged pre-auth key + Headscale-side policy (N1).** The operator's key is PLAIN (not + tag-scoped); `site-tailscale.sh install` advertises `--advertise-tags=tag:subnet-router`, + which a plain key cannot authorise, and the route needs autoApprovers/manual approval + the + star ACL on `tailscale.baldurkeep.com`. Deliberately NOT attempted with the plain key: a + botched first advertise joins the node UNTAGGED (the office1 key-expiry defect, R5) and + burns the autoApprovers window (Headscale does not approve retroactively). N4 SEC row (per-DC + Tailscale key custody) opens at tagged-key mint. + +2. **SSH access to the .7 VM for the install.** MEASURED: `vr1-dc0-region` injected only the + `vr1-office1-svc` key (region `sshkeys read`); neither voffice1's default identity nor the + per-DC `~/vr1-dc0-creds/vr1-dc0_svc_ed25519` authenticate as `ubuntu@10.12.8.7` (both + `Permission denied (publickey)`). The working path for `site-tailscale.sh install` is the + holder of `vr1-office1-svc` over `ssh -J voffice1, ubuntu@10.12.8.7` (the operator has + this Office1 key; I did not fish for it -- secrets discipline). OBSERVATION (logged, not + actioned -- hard rule 1): the region injecting the Office1 service key rather than a per-DC + key is a cross-DC key-reuse pattern in tension with SEC-012/SEC-016 (per-DC key isolation); + it affects ALL dc0-region deploys, is pre-existing, and is a custody-hygiene item for the + D-137 fork, not a deploy blocker. + +WHY carved-and-ready is the right stop: the join cannot complete without (1), which is the +operator's Headscale work. The session leaves the VM one `tailscale up` from the Horizon close. + +REVERT: n/a (finding + state record).