Runbook folder updates

Updated runbook

Runbook updates

repo: sanitation sweep -- canonical phase-NN runbook + appendices; design-decisions D-001..D-042; canonical bundle; superseded files moved to remove/ for review

bundle: Section-G hardening (subset-rule bindings, Ceph public/cluster, raw amphora)

Update review-bundle.py

BUNDLEFIX-007: drop cinder loop block-device storage (Ceph-backed cinder; loop incompatible with LXD container placement)

Create review-bundle.py

repo: gitignore timestamped bundle backups

repo: gitignore timestamped bundle backups; drop superseded fix-api-bindings.py

bundle: dual provider+metal HA VIPs on API charms (BUNDLEFIX-006, D-020)

bundle: add memcached + nova-cc relation (BUNDLEFIX-004)

bundle: bind mysql-router subordinates to metal (BUNDLEFIX-005)

fix(bundle): cluster_count=1 on testcloud haclusters (BUNDLEFIX-003) ...

Single-unit principals can't reach the default 3-peer quorum; haclusters
blocked 'insufficient peers'. cluster_count=1 forms a 1-node cluster and
brings up the (public->provider, reachable) VIP. Matches the runtime
juju config already applied. Roosevelt's 3-unit bundle keeps the default.

fix(bundle): api-bindings minimal + de-HA vault for v1 (Option A) ...

- &api-bindings -> {":metal, public:provider}; drop 7 redundant metal keys
  that broke keystone/ceph-radosgw/openstack-dashboard at deploy
- vault: *internal-bindings, drop options(vip 10.12.4.236 provider / hostname),
  comment vault-hacluster + vault:ha. vault is metal-only single-unit on the
  testcloud; provider VIP unreachable from metal & pointless at 1 unit.
  HA restored at Roosevelt (3 units, metal VIP via NetBox).
Counts: VIPs 11->10, apps 51->50, relations 98->97.

gitignore: octavia PKI artifacts and overlay (v1-do-doc-02 §4)

docs/netbox-vip-queue: flip Designate VIP to Reserved per D-019 ...

Designate is deferred to v2 (D-019). The .227 entry flips from
               Active to Reserved with DNS name set to em-dash, matching the
               existing .225 ceph-radosgw v2-deferred row pattern.

               Active VIP count: 12 -> 11. Reserved VIP count: 1 -> 2.

               When v2 work re-introduces Designate, the .227 row status flips
               Reserved -> Active and gets its DNS name back.

README: refresh stale runbook references, reflect D-019 scope reduction ...

The v1 deployment order block referenced runbooks 00-08 which are
               being moved to deprecated/ in favor of v1-do-doc-NN execution documents.
               Replaces the order block with a pointer to the do-document set.

               Also reflects D-019: Designate deferred to v2; v1 tenant resolvers use
               public DNS. Adds the netbox-vip-queue.md reference. Updates the design-
               decisions D-range from D-001-D-016 to D-001-D-019.

docs/design-decisions: add D-019, amend D-008/D-011 (DNS scope reduction) ...

D-019 captures the Designate deferral to v2 with rationale grounded in
               the 2026-05-27 testcloud topology investigation: outside-in DNS not
               needed (corporate clients use openstack.baldurkeep.com HTTPS chain);
               edge nginx cannot route to cloud-internal anyway; inside-out is
               satisfied by tenant --dns-nameserver pointing at public DNS.

               D-008 (DNS architecture) marked superseded; original text preserved
               for audit trail.

               D-011 validation bar amended to remove "Designate resolves" criterion;
               v2 will reinstate a calibrated DNS criterion.

bundle: remove Designate per D-019 (deferred to v2) ...

Removes the designate, designate-bind, designate-mysql-router,
               and designate-hacluster applications, plus all seven designate-
               related relations. Updates header comments to reflect the deferral.

               Rationale per D-019: v1 testcloud topology investigation confirmed
               outside-in DNS is not needed (corporate clients reach the cloud via
               the openstack.baldurkeep.com HTTPS proxy chain, not via *.cloud.
               neumatrix.local FQDNs). Tenant subnets use public DNS directly via
               --dns-nameserver. FIP DNS auto-registration is not load-bearing for
               any v1 acceptance criterion.

               VIP 10.12.4.227 becomes unused space in 10.12.4.224-.254 (same
               status as 10.12.4.225 reserved for v2 ceph-radosgw HA).

docs/design-decisions: D-014 update repo path after move to OpenStack group ...

Repository moved from jesse.austin/openstack-caracal-ipv4 to the
               OpenStack group on 2026-05-27. GitBucket does not redirect, so the
               prior path is dead.

docs/design-decisions: D-002 drop vault from OpenStack-core channel row ...

Vault uses 1.8/stable per the Canonical charm delivery table, not the
               2024.1/stable OpenStack-core track. The bundle.yaml already reflects
               this; the design-decisions D-002 description had a stale token.

bundle: remove ceph-osd storage block to match expected-osd-count ...

The storage: block declared a second osd-devices entry (loop,1024M)
               which is additive to options.osd-devices per the charm config. That
               produced 8 OSDs against expected-osd-count: 4 on ceph-mon, with
               1 GB loopback OSDs as the asymmetric secondaries - a CRUSH-weighting
               anti-pattern.

               Real production storage (DB/WAL on actual SSDs) will be declared on
               Roosevelt. For the testcloud, BlueStore co-locates DB/WAL on the data
               device which is the documented default for single-device setups.

               osd-journals is unused under BlueStore.

runbooks/deprecated: add README explaining the deprecation scope ...

Includes the deprecated -> replacement mapping for operators who arrive
  via git log searches or stale internal references.

runbooks: move superseded files to runbooks/deprecated/ ...

These are replaced by v1-do-doc-NN-*.md execution documents (added in
  a prior commit). The 01-destroy-model.md runbook stays in place - it's
  referenced by v1-do-doc-03 as a conditional sub-procedure.

  07-dns-zones.md is deferred to v2 per D-019 with no v1 replacement
  (Designate is no longer in v1 scope).

  History preserved via filesystem rename (git rename detection at
  commit time).

Add v1 execution documents and pre-deploy change list ...

Adds the eight v1-do-doc-NN-*.md execution documents covering the v1
  deploy from pre-flight through Magnum CAPI driver graft (Batches A/B/C
  of the do-doc drafting work). Final two documents (tenant + validate)
  follow in Batch D.

  Also adds docs/v1-pre-deploy-fixes.md (v2) - the 9-commit change list
  that brings the repo into its pre-deploy hygiene state. Subsequent
  commits in this push implement that change list.

Updates

Updates

Updated yaml and doc netbox ...

bundle: activate hacluster HA stack with API VIPs (workstream 2)

12 HA-eligible charms get VIPs from provider /22 range 10.12.4.224-.254
per D-003. ceph-radosgw HA deferred to v2 (.225 reserved).

Per-charm additions to options:
  barbican             vip 10.12.4.224  fqdn barbican.omega.dc0.vr0.cloud.neumatrix.local
  cinder               vip 10.12.4.226  fqdn cinder.omega.dc0.vr0...
  designate            vip 10.12.4.227  fqdn designate.omega.dc0.vr0...
  glance               vip 10.12.4.228  fqdn glance.omega.dc0.vr0...
  keystone             vip 10.12.4.229  fqdn keystone.omega.dc0.vr0...
  magnum               vip 10.12.4.230  fqdn magnum.omega.dc0.vr0...
  neutron-api          vip 10.12.4.231  fqdn neutron.omega.dc0.vr0...
  nova-cloud-controller vip 10.12.4.232 fqdn nova.omega.dc0.vr0...
  octavia              vip 10.12.4.233  fqdn octavia.omega.dc0.vr0...
  openstack-dashboard  vip 10.12.4.234  fqdn horizon.omega.dc0.vr0...
  placement            vip 10.12.4.235  fqdn placement.omega.dc0.vr0...
  vault                vip 10.12.4.236  fqdn vault.omega.dc0.vr0...

Structural fixes:
- vault, keystone, glance, placement: options: {} → options:
  (previous form would have failed YAML parse when vip was added)

Atomic uncomments:
- 12 hacluster subordinate apps (channel 2.4/stable per D-002)
- 12 :ha relations

v2-deferred (per workstream-2 decision):
- ceph-radosgw-hacluster app (commented)
- ceph-radosgw:ha relation (commented)
- 10.12.4.225 reserved as VIP slot for v2

NetBox VIP records queued post-deploy (engineer review on
ipv4-prefixes-import.py still pending). Tracked in
docs/netbox-vip-queue.md.

D-010 NetBox-upstream rule relaxed for v1 testcloud; will be
enforced for Roosevelt.

Update design doc ...

docs: D-002 hacluster row added + D-007 driver pin corrected

D-002: add hacluster | 2.4/stable row (Canonical Charm Delivery table,
       verified against Charmhub 2026-05-22). Update Verification
       source paragraph with rev confirmations.

D-007: Layer B driver pin stackhpc/magnum-capi-helm v0.13.0 →
       openstack/magnum-capi-helm 1.1.0 from PyPI. stackhpc fork
       archived Dec 2024; canonical project moved to opendev/PyPI.
       1.1.0 is last Caracal-cycle release. Note ASCII-only conf.d.
       Add explicit supersedes note for old pin.