diff --git a/bundle.yaml b/bundle.yaml index da4028a..fdba8ba 100644 --- a/bundle.yaml +++ b/bundle.yaml @@ -952,6 +952,13 @@ # public REST API above, NOT a replacement for it # (the prior comment here wrongly treated it as one). ha: metal-internal + # BUNDLEFIX-058 (2026-08-06): conformance repair -- amqp + cluster were on the '' + # metal-admin FALLBACK, deviating from the generic svc-to-svc rule (14 apps bind + # amqp+cluster to metal-internal). Benign (designate served metal-admin so nothing + # broke) but off-plane; the 2026-08-06 binding-conformance sweep flagged the designate + # stack. Proven live (no regression: designate haproxy 0 DOWN, amqp still connected). + amqp: metal-internal + cluster: metal-internal constraints: arch=amd64 designate-mysql-router: @@ -973,6 +980,7 @@ bindings: '': metal-admin dns-backend: metal-internal + cluster: metal-internal # BUNDLEFIX-058: peer on the generic svc plane (was '' metal-admin) constraints: arch=amd64 # ===================================================================== diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index aa2e9d6..29077d9 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -2426,6 +2426,12 @@ VIP IPs incl 10.12.8.58 (resolves AH01909); 3 units active/idle. Config-of-record: bundle cluster metal-internal, binding-reference exception RETIRED. dc1 inherits it via the shared bundle (no rebind). Sweep: docs/audit/queued-findings-20260806-phase03-coreverify.txt. + **BINDING-CONFORMANCE SWEEP 2026-08-06 (operator-requested):** after F-CV1/F-CV3, the only + remaining ACTIVE svc-endpoint deviations were the designate stack -- designate amqp+cluster + + designate-bind cluster on the metal-admin default (benign; served metal-admin so nothing broke). + REPAIRED to metal-internal (BUNDLEFIX-058, proven live, no regression). ceph-rbd-mirror + certificates/cluster are UNBOUND (Stage-6) -> recorded as sweep O9 STAGE-6 WATCH. No other + active deviations found. **NAMED-GATE DEFECT found by measurement -- `phase-03-core-verify.md` Step 3.1 asserts expected non-active/idle = 1 (octavia only); the VR1 roster yields 4 deferred-by-design + gss.** That gate is STALE for VR1 and a DOCFIX is owed (also owed on that runbook: `-m openstack` -> `-m vr1-dc0` diff --git a/docs/audit/queued-findings-20260806-phase03-coreverify.txt b/docs/audit/queued-findings-20260806-phase03-coreverify.txt index d09211d..9a584ba 100644 --- a/docs/audit/queued-findings-20260806-phase03-coreverify.txt +++ b/docs/audit/queued-findings-20260806-phase03-coreverify.txt @@ -65,6 +65,14 @@ (-m openstack -> -m vr1-dc0; run-from-rack per D-138; the settle count). O7 rack kernel 6.8.0-136 running vs 6.8.0-137 available -- reboot NOT taken (would bounce the rack + libvirt + all nodes); a maintenance-window item, logged. +O9 >>> STAGE-6 WATCH ITEM (record so it is not lost) <<< ceph-rbd-mirror carries + `certificates` / `cluster` / `public` on the metal-admin default -- UNBOUND today (Stage-6 + DR wiring not yet connected), so no active deviation NOW. When rbd-mirror is wired at + Stage-6 (dc-dc-phase5-dr-failover-drill), `certificates: metal-admin` could reproduce a + TLS-cert-plane issue (the F-CV1/F-CV3 class). PRE-CHECK at Stage-6 before wiring: bind + certificates->metal-internal + cluster->replication (ceph) as needed, per the generic rule. + Surfaced by the 2026-08-06 binding-conformance sweep. + O8 OBSERVATION (NOT verified as a defect -- do the D-NNN check first): designate's `amqp` endpoint is bound to metal-admin, while the generic rule (network-space-binding-reference line 57) + glance put amqp on metal-internal. Surfaced during the BUNDLEFIX-056 bind output. diff --git a/docs/changelog-20260806-phase03-coreverify.md b/docs/changelog-20260806-phase03-coreverify.md index bc38817..da2b20a 100644 --- a/docs/changelog-20260806-phase03-coreverify.md +++ b/docs/changelog-20260806-phase03-coreverify.md @@ -106,6 +106,28 @@ dc1 inherits via the shared bundle -> correct-by-deploy, no rebind. **Revert.** `juju bind openstack-dashboard cluster=metal-admin` (live) + `git revert` this commit. +## Item 8 -- BUNDLEFIX-058: designate-stack binding conformance (amqp/cluster -> metal-internal) +**What.** Binding-conformance sweep (operator-requested) found the designate stack was the +only place with ACTIVE svc-to-svc endpoints on the metal-admin default: designate `amqp` +(->rabbitmq) + `cluster` (peer), and designate-bind `cluster` (peer). Generic rule (14 apps) +puts amqp+cluster on metal-internal; no ruled exception covers designate -> conformance repair, +no new D-number. + - `bundle.yaml`: designate `+amqp: metal-internal +cluster: metal-internal`; designate-bind + `+cluster: metal-internal`. + - `network-space-binding-reference.md`: matrix rows (designate m-internal 7->9; designate-bind 1->2). + - LIVE (proven, same method): `juju bind designate amqp=metal-internal cluster=metal-internal` + + `juju bind designate-bind cluster=metal-internal` (individually gated). +**Why.** Benign but off-plane: designate served metal-admin so nothing broke (unlike F-CV1/F-CV3), +but svc traffic on the mgmt plane deviates from the generic rule. Fixing before Stage-5 close so +dc1 inherits a fully-conformant bundle. +**Verify.** bindings now metal-internal; designate stays Stage-7-blocked (nameservers) only, NOT +amqp/cluster-broken; designate-bind active/idle; designate haproxy 0 DOWN (F-CV1 intact). No +harness asserts these bindings. +**Revert.** `juju bind designate amqp=metal-admin cluster=metal-admin` + `juju bind designate-bind +cluster=metal-admin` + `git revert`. +**Watch item recorded (O9, sweep):** ceph-rbd-mirror certificates/cluster on metal-admin are +UNBOUND today; PRE-CHECK at Stage-6 before DR wiring. + ## Findings logged (NOT executed -- hard rule 1) - **F-CV1** designate-api plaintext on :8991 vs haproxy `check-ssl` -> backend DOWN -- **RESOLVED this session, see Item 6 (BUNDLEFIX-056).** designate-api is UP; the diff --git a/docs/network-space-binding-reference.md b/docs/network-space-binding-reference.md index da3fb84..969a5df 100644 --- a/docs/network-space-binding-reference.md +++ b/docs/network-space-binding-reference.md @@ -85,8 +85,8 @@ | cinder-hacluster | **metal-admin** | | 4 | | | | | | cinder-mysql-router | **metal-admin** | | 3 | | | | | | dashboard-mysql-router | **metal-admin** | | 3 | | | | | -| designate | **metal-admin** | 2 | 7 | | | | | -| designate-bind | **metal-admin** | | 1 | | | | | +| designate | **metal-admin** | 2 | 9 | | | | | +| designate-bind | **metal-admin** | | 2 | | | | | | designate-hacluster | **metal-admin** | | 4 | | | | | | designate-mysql-router | **metal-admin** | | 3 | | | | | | glance | **metal-admin** | 1 | 11 | 1 | | | |