uca-origin-asbuilt-comparison-20260802.txt ========================================== Comparison requested by the operator: "You have the past deployment yaml values to refer to ... review what has worked successfully previously to compare against the current yaml file values." SOURCES (all in-repo, no inference): asbuilt/20260706-224851/bundle-exported.yaml -- `juju export-bundle` of the VR0 testcloud that DEPLOYED SUCCESSFULLY (five other asbuilt/ captures agree exactly) bundle.yaml -- the VR1 base deployed 2026-08-02 overlays/vr1-dc0-machines.yaml -- the 2026-07-31 UCA repoint overlays/vr1-dc1-machines.yaml -- the proxy DC's overlay NOTE ON INSTRUMENT: the as-built export cannot be PyYAML-parsed -- juju writes `**` for redacted values, which the parser reads as an alias. Extracted textually with awk instead. -------------------------------------------------------------------------------------- apps setting value form key copies of an origin option key material -------------------------------------------------------------------------------------- AS-BUILT (VR0, 6 cloud:jammy-caracal none 0 deployed OK) bundle.yaml (VR1) 6 cloud:jammy-caracal none 0 defined ONCE via YAML anchors &openstack-origin / *ceph-source vr1-dc1 overlay 0 (inherits base; proxy forwards none 0 (PROXY arm) whatever URL it is handed) vr1-dc0 overlay 15 raw `deb http://10.12.8.4/...` 3 ceph 15 x 29 lines (MIRROR arm, mine) -------------------------------------------------------------------------------------- FINDING 1 -- THE ONLY CONFIGURATION THIS PROJECT HAS EVER DEPLOYED SUCCESSFULLY IS `cloud:jammy-caracal` ON SIX APPS. Exactly barbican / magnum / octavia (`openstack-origin`) and ceph-mon / ceph-osd / ceph-radosgw (`source`). ZERO raw `deb` lines and ZERO `key:` options appear anywhere in any as-built capture. FINDING 2 -- THE 2026-07-31 REPOINT CHANGED TWO THINGS AT ONCE, AND NEITHER HAS EVER DEPLOYED. It moved the app count 6 -> 15 (justified: under the D-107 airgap the other nine inherit the charm default `caracal`, which resolves to the same unreachable upstream pocket) AND changed the value FORM from `cloud:` to a raw `deb` line. The form change is what dropped the signing key: the `cloud:` path installs `ubuntu-cloud-keyring` as a side effect, a raw `deb` line does not. The app-count change is sound; the form change is what cost the deploy. FINDING 3 -- THE PROXY ARM KEEPS THE PROVEN CONFIGURATION AND NEEDS NO OVERRIDE AT ALL. dc1 carries no origin block because apt-cacher-ng forwards whatever URL it is handed, so `cloud:jammy-caracal` -- the as-built value -- keeps working there unmodified. This is a GENUINE D-135 EXPERIMENT RESULT and it is now sharper than when it was recorded: the MIRROR arm is what forces divergence from the only known-good configuration, and that divergence has now cost one failed deploy and introduced permanent key-rotation surface. FINDING 4 -- MY OVERLAY EDIT VIOLATES THE BASE BUNDLE'S OWN CONVENTION. `bundle.yaml` deliberately defines its origin ONCE (`&openstack-origin`, `&ceph-source`) and aliases it. I duplicated a 29-line armored key FIFTEEN times. YAML anchors demonstrably work in this bundle -- the base uses them -- so even if the raw-deb direction is kept, the key belongs behind a single anchor, not in fifteen copies. Fifteen copies is fifteen places to miss at the next key rotation. FINDING 5 -- THE OPERATOR HAS ALREADY RULED THE DIRECTION THAT DISSOLVES THIS. D-135 AMENDMENT 2026-08-02, exact utterance: "if we have to rebuild in dc0 for any reason we will be using a proxy rather than a full mirror rebuild." Both DCs then run the same strategy. Under the proxy arm the origin block is DELETED, not fixed, and dc0 returns to the as-built-proven `cloud:jammy-caracal`. The amendment's stated trigger is a REBUILD of dc0's artifact service and the mirror currently stands, so whether this situation fires that trigger is the operator's call, not mine. -------------------------------------------------------------------------------------- THE FORK, for a GA-R5 ruling. Both are real; I am not choosing. -------------------------------------------------------------------------------------- (A) CONVERGE dc0 ON THE PROXY NOW. Stand up `scripts/dc-cache-proxy.sh` on dc0's D-134 utility `.4` (built, and PROVEN on dc1), set `juju model-config apt-http-proxy`, and DELETE the overlay origin block entirely -- all 15 apps return to the as-built configuration. ELIMINATES the signing-key problem rather than working around it, removes 15 copies of key material, retires a 953 GB mirror and its nightly window, and executes the direction already ruled. COST: it is a build, not a config edit, and it pauses the deploy while it is stood up. (B) KEEP THE MIRROR, FIX THE KEY. Restructure my overlay edit to the base bundle's anchor convention so the armored key appears ONCE, then apply via the Step-7 pattern. Fastest path to an unblocked deploy. COST: keeps dc0 diverged from the only proven configuration, and keeps per-DC key rotation as standing surface.