# DOCFIX-064 -- phase-08 runbook change-list (DRAFT, 2026-07-01)

RESERVED number: DOCFIX-064 (per changelog next-free note). This is the accumulated
phase-08 operator-runbook (single-consumer acceptance) sweep. Written as a change-LIST with
exact anchors + evidence so the edit is mechanical when phase-08 is finalized. NOT yet applied
to runbooks/phase-08-workload-cluster-acceptance.md.

Scope note: these are fixes to the OPERATOR single-consumer acceptance path (capi-test-1 in
capi-mgmt scope). The multi-tenant tenant->cluster flow is a SEPARATE deliverable
(tenant-onboarding-v2-DRAFT.md). Some items overlap (image --public, image-by-UUID, template
ownership scope) because both paths hit them.

--------------------------------------------------------------------------------
## Items
--------------------------------------------------------------------------------

1. IMAGE SEED MUST create the image `--public`  [Step 8.0, image create]
   Evidence: a shared/owner-only kube image causes magnum cluster/template create to fail with
   `Cluster type (vm, Unset, kubernetes) not supported` -- a non-owner (or the driver acting in
   another project) cannot read `os_distro`, so type-derivation returns Unset. Fix: the seed
   `openstack image create ... --public` (and re-verify visibility=public post-create).

2. SEED HARDENING  [Step 8.0]
   - curl with retry + connect/max timeout (fail loud on partial/hung download).
   - sha512 verify against the published manifest is a hard GATE (already present -- keep).
   - poll image to `active` as a hard-gate loop (not a fixed sleep).
   - POST-active property re-verify: kube_version, os_distro, visibility=public, disk_format.

3. IMAGE-ABSENT PRESENCE GUARD  [Step 8.0]
   Explicitly branch "image present -> verify props" vs "absent -> seed", so a re-run does not
   double-seed and a present-but-wrong-visibility image is caught (ties to item 1).

4. IMAGE BY UUID, not name  [Step 8.0 template create; 8.1]
   Evidence: a doubled-quoted image NAME resolved to the literal `'name'` (no image) -> Unset
   type -> 400. Passing the resolved UUID removes the quoting/resolution surface. Gate the UUID
   with `grep -qE '^[0-9a-f-]{36}$'` before use.

5. TEMPLATE CREATE -- OWNER PROJECT SCOPE  [Step 8.0]
   Evidence: `coe cluster template create/show` and `cluster create --cluster-template <name>`
   resolve the template within the CALLER'S project (templates are visible by ownership).
   A private template created in capi-mgmt is NOT selectable by name from admin scope (create
   404s while `template list` still shows it). Fix: run the template create AND the cluster
   create in the SAME project scope that owns the template (capi-mgmt for the operator path).
   Add the capi-mgmt scope preamble (resolve `capi-mgmt` --domain capi dynamically; export
   OS_PROJECT_ID) before both.

6. FLAVOR-FLOOR PRE-CHECK  [Step 8.0 template create]
   Magnum requires master/node flavors >= 2 vcpu and >= 2048 MB. Pre-check the chosen flavors
   against the floor and fail loud, rather than surfacing an opaque driver error later.

7. OCTAVIA PREREQ -- CAPTURE REAL EXIT  [Prerequisites / Step 8.0]
   The octavia-healthy probe must capture the actual command result and test it, NOT
   `... | head || echo` (which masks failure -- head succeeds on empty input). Same
   capture-and-test-result discipline applied across the onboarding v2 blocks.

8. 8.1 PRE-CHECKS -- D-039 role + keypair  [Step 8.1]
   Before cluster create, assert (a) the trustor holds member + load-balancer_member (+ reader)
   on the cluster project (D-039 -- else CAPO 403s at the Octavia LB step), and (b) the keypair
   exists in the creating scope. Fail loud pre-create.

9. POLICYD ZIP PATH UNDER $HOME (snap confinement)  [appendix-C section C.3]
   Evidence: `juju attach-resource ... /tmp/overrides.zip` failed "no such file or directory"
   though the shell saw the file -- the confined juju snap cannot read /tmp. Build the zip under
   $HOME. Also: `zip` is absent on the jumphost -- build via python3 zipfile (arcname=top-level).
   Fix appendix-C C.3 to use a $HOME path and the python3 zipfile method (currently shows
   `zip -j /tmp/overrides.zip`).

--------------------------------------------------------------------------------
## Cross-doc corrections (already staged in this package)
--------------------------------------------------------------------------------
- appendix-C: manager domain-enumeration is own-domain-only on this cloud (2.5d finding);
  the cloud-wide names-only leak does NOT manifest. (Applied in appendix-C-identity-rbac.md here.)
- appendix-D: cluster-create trust model; D.7 status updated (Stages 1-4 validated, Stage 6
  create_trust outstanding). Needs committing (was packaged, not yet in repo).

--------------------------------------------------------------------------------
## Sequencing
--------------------------------------------------------------------------------
Apply items 1-8 to phase-08 and item 9 to appendix-C only AFTER Stage 6 (create_trust) is
resolved -- if the multi-tenant trust step surfaces a further phase-08-relevant fix (e.g. a
CONF.trust.roles pin), fold it into the same DOCFIX-064 sweep rather than reopening.