# changelog 2026-08-08 (part 3) -- amphora build FIXED + geneve-over-v6 wrap-gate ROOT-CAUSED Session body (GA-R2, one per session). Status lives ONLY in `docs/CURRENT-STATE.md`. Branch `dc-dc-stage5-preconditions`. dc0 activation checkpoint (throwaway; 10.13 rebuild follows). All cloud reads/mutations run FROM the dc0 rack `172.31.0.2` (host `vvr1-dc0`) via `voffice1` (D-138). Live-mutation items carry a REVERT; dc0 is throwaway so most reverts are "torn down with the cloud". ## Item 1 -- DELIVERY (operator-authorized: "Push 4 + commit bookend residue") Pushed the prior session's 4 commits `f85daa7..a6340e6` (origin was at `a25ed99`). Then landed the prior part-2 GA-R4 bookend residue + this session's dc0-activation progress in `8e2b18b` (session-ledger part-2 close, 2026-08-08 ledger rotation to archive/, the part-2 sweep file, CURRENT-STATE progress touch clearing repo-lint L10). geneve root cause in `cd1f9cd` + correction `f5daadd`. voffice1 pulled to `f5daadd` at close. **Revert:** `git revert ` per commit (records only; the live mutations are Items 2/4). ## Item 2 -- Amphora image build FIXED (D-021 pipeline complete on dc0) Part-2 left the amphora build as an INCIDENT (octavia-diskimage-retrofit exit 1). Root-caused this session as TWO layers, both MEASURED: - **(a) No loop devices in the LXD container.** octavia-diskimage-retrofit/0 is a subordinate on `1/lxd/1` (an LXD container on vr1-dc0-control-02). dib needs loop devices; the container had none (`losetup -f` -> "No such device"). **FIX (live, gated):** hot-plugged the host's loop devices into the container on machine 1: `sudo lxc config device add juju-d4f45a-1-lxd-1 loop-control unix-char path=/dev/loop-control` and `loop0..loop7` as `unix-block`. losetup roundtrip then works (no privileged escalation needed). **REVERT:** `sudo lxc config device remove juju-d4f45a-1-lxd-1 loop-control loop0 loop1 loop2 loop3 loop4 loop5 loop6 loop7` (run on machine 1). **HAZARD (rebuild finding):** this is host-local LXD state, NOT in git/juju/bundle -- it does NOT survive container recreation, and loop0-4 are the host's live snap mounts (pass-through gives the container access to them; a rebuild should narrow to loop5-7 or place the retrofit's principal on metal). - **(b) dib build's apt targeted UNREACHABLE public archives.** With loop fixed, dib got into the libguestfs appliance and failed at install-packages (returncode 100): `E: Unable to locate package amphora-agent` + universe pkgs; measured cause = apt hitting `http://archive.ubuntu.com` / `security.ubuntu.com` -> "Network is unreachable" from the isolated node. The build does NOT inherit the model `apt-http-proxy=http://10.12.8.4:3142`, and the retrofit charm's `ubuntu-mirror`/`uca-mirror`/`retrofit-uca-pocket` were all empty/unset. **FIX (live, gated):** `juju config octavia-diskimage-retrofit ubuntu-mirror=<3 deb lines at http://10.12.8.4/ubuntu jammy{,-updates,-security} main universe>` (the dc0 D-135 full mirror, reachable 200, carries main+universe incl. amphora-agent). `retrofit-uca-pocket` left UNSET deliberately -> the build takes the jammy-universe (yoga-era) amphora-agent; caracal-matched agent is a rebuild refinement (NOT the LB blocker -- see Item 4). **REVERT:** `juju config octavia-diskimage-retrofit --reset ubuntu-mirror`. - **RESULT:** rebuilt via the tested `phase-05-amphora-pipeline.sh` (sha256-verified staged copy; `MODEL=vr1-dc0`). Image `775ebeba-32af-4d99-a304-d7b7795a4740` ACTIVE, `disk_format=raw`, tags `[octavia-diskimage-retrofit, octavia-amphora]` (two-sourced: script confirm + `openstack image list --tag octavia-amphora`). Leftover glance base `04c982c2...` harmless. **REVERT:** `openstack image delete 775ebeba...` (torn down with the cloud). - **REBUILD FINDING:** the retrofit `ubuntu-mirror` (and, for caracal, `uca-mirror`/ `retrofit-uca-pocket`) must be wired PER-DC in the bundle so the isolated-DC amphora build uses the in-DC mirror. Not currently in `bundle.yaml`. Tied to D-021 + D-135. NO tool exists for retrofit/dib diagnosis (appendix-A has no symptom) -> appendix-A entry + optional tool owed. ## Item 3 -- G18 OWED#3 (o-hm0 MTU, LP#2018998): PASS (read-only) lb-mgmt-net MTU = 1442; all three octavia units' `o-hm0` = 1442. No mismatch. Record-only, no fix. (G18 OWED#1 prefix + #2 router-isolation were done in part 2.) G18 obligations now all discharged. ## Item 4 -- 1 test LB smoke test: amphora BOOTS but blocked by the geneve-over-v6 overlay Created a throwaway VIP net/subnet + LB (installed `python3-octaviaclient 3.7.0` on the rack -- NOTE: from `archive.ubuntu.com noble/main` direct, i.e. the OUTER host `vvr1-dc0` has egress; this is NOT dc0-mirror evidence, correcting part-2 sweep F4). **LIVE OBJECTS, LEFT UP per operator (savegame-now):** `lb-smoke-net` `917899c9-ea33-43b3-bc0d-20dd925d2c26`, `lb-smoke-subnet` `45cfc927-...` (198.51.100.0/24), LB `24bd326f-611c-4a8c-a348-e9c67f5d156c` (VIP 198.51.100.21, stuck PENDING_CREATE), amphora nova instance `66542b9f-...` (ACTIVE -> image validated). **TEARDOWN (owed next session):** `openstack loadbalancer delete 24bd326f... --cascade; openstack subnet delete 45cfc927...; openstack network delete 917899c9...`. The amphora nova-boots fine (image good) but Octavia can't complete the agent handshake -> Item 5. ## Item 5 -- geneve-over-v6 wrap-gate: FAIL, ROOT-CAUSED (full record in audit file) octavia HM log = `ConnectTimeout` to `[fc00:...:9473]:9443` (not ssl/cert -> not a version/agent issue); SG correctly allows v6 tcp/9443 + icmp; ping6 o-hm0 -> amphora (same /64) = 100% loss. **Root cause (measured):** OVN geneve encap IPs SPLIT ACROSS FAMILIES -- containerized control-node chassis (octavia LXD) have v4-only data-tenant addresses (`10.12.16.x`; D-134 auto-picked) -> IPv4 encap; carved compute METAL uses IPv6 (`2602:f3e2:f02:30::x`). Same dual-stack `data-tenant` plane (`lib-net.sh` PLANE_CIDRS), so it's an address-family SELECTION defect, not a mis-binding. Cross-family geneve tunnels don't pass traffic (verified on compute-01, the amphora's host) -> 100% cross-node loss -> amphora unreachable. **Roosevelt-delta:** v6 builds must give containerized OVN chassis a v6 data-tenant address; warrants a D-number (assigned at ruling). **Fix NOT applied** (substantial + rebuild-relevant; operator chose savegame over a live dc0 workaround). Full record: `docs/audit/geneve-over-v6-rootcause-20260808.md`. **Revert:** N/A (record only; no fix applied). ## Not done (deliberate) Designate real-Stage-7 `4a` depth measurement, the wrap gates (cloud-assert BOM, controller backup, verify-live Ceph), and the re-IP live-free checks -- all deferred to next session (operator chose savegame). The geneve fix + the LB teardown are owed next session.