3e43385639
Some checks failed
VLAN 2 IPv6 live on both routers and in the model. IPv4 untouched (6 MASTER / 6 BACKUP, default route on bond0.53, watchdog 0 reverts, 5/5 Ready). worker0 and worker2 hold their reserved ::23/::25; the two arm64 nodes are the open item. Watchdog disarmed. Full handoff at the top of window-evidence/2026-09-06-final.txt. vyos002 showing internet DOWN is the correct resting state of the gated backup, not a fault. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DMVzWZgiKW2wquf5z8S1yH
55 lines
2.2 KiB
Plaintext
55 lines
2.2 KiB
Plaintext
=== MAINTENANCE WINDOW 2026-09-06 (unattended) — HANDOFF ===
|
|
|
|
WHAT HAPPENED
|
|
VLAN 2 (the k8s VLAN) now has IPv6, applied to both routers and pinned in the
|
|
Pulumi model. Addressing only, NOT egress (default-lifetime 0 -- routers are
|
|
not v6 default routers yet). IPv4 untouched the whole time; a watchdog was
|
|
armed on both routers and never reverted (0 reverts).
|
|
|
|
The window's open question is ANSWERED: production NetworkManager nodes take a
|
|
DHCPv6 lease from the managed flag, and MAC-keyed reservations match. worker0
|
|
and worker2 hold their exact reserved ::23 / ::25.
|
|
|
|
WHAT DID NOT WORK (for you to decide, attended)
|
|
The two arm64 nodes -- worker1 (Asahi) and spark-2935 (DGX) -- ran a DHCPv6
|
|
transaction but did not bind an address. Per-node client issue, not the
|
|
reservation scheme (two x86 nodes prove the scheme). Untouched, deliberately.
|
|
|
|
A mistake worth knowing about: I first committed "MAC reservations do NOT work"
|
|
after checking before a full RA cycle. My own timed observation caught it and
|
|
it is corrected in git (lab@d9f74aa, k8s-deployment@75af36d) and in
|
|
2026-09-06-dhcpv6.txt. The scheme works.
|
|
|
|
WHAT IS NEXT
|
|
- decide the two arm64 nodes' DHCPv6 (why they don't bind), and whether to keep
|
|
MAC keys or move to DUID / dynamic+discovery for uniformity.
|
|
- THEN egress: flip default-lifetime 0 -> 1800 + a default-preference pair,
|
|
WITH the tunnel throughput measured (1480/1472). One line, attended.
|
|
- the cluster steps (Cilium IPAM switch, k3s dual CIDRs, Cilium IPv6) were
|
|
deliberately NOT started -- they need someone watching and the 3-server etcd
|
|
rehearsal harness still to be built.
|
|
|
|
Nothing here is load-bearing yet: no node depends on its v6 address, so this is
|
|
fully reversible with migration/vlan2-v6-apply revert.
|
|
|
|
=== FINAL STATE 2026-09-06T22:51:14+01:00 ===
|
|
--- 10.0.1.252 ---
|
|
vyos001
|
|
internet/ipv6: UP/UP
|
|
vrrp: 6 MASTER
|
|
route: default via 87.192.96.1 dev bond0.53 proto failover metric 1
|
|
bond0.2 v6: 2001:470:187e:2::1/64
|
|
--- 10.0.1.253 ---
|
|
vyos002
|
|
internet/ipv6: DOWN/DOWN
|
|
vrrp: 6 BACKUP
|
|
route:
|
|
bond0.2 v6: 2001:470:187e:2::2/64
|
|
--- nodes v6 ---
|
|
192.168.8.23 2001:470:187e:2::23
|
|
192.168.8.13
|
|
192.168.8.25 2001:470:187e:2::25
|
|
192.168.8.12
|
|
--- cluster ---
|
|
5 Ready
|