joshsiv-mulga aa10c19aef fix(ovn): pin OVS system-id to hostname for IPsec cert identity match ...

ovs-monitor-ipsec uses chassis-id as the IKEv2 `@<name>` peer identity in
the strongSwan config it generates. Our per-node IPsec peer cert
(admin.GenerateIPSecPeerCert) carries the node name as CN + dnsName SAN.
With chassis-id left at the package-generated UUID, charon validates
`@<UUID>` against a cert with dnsName=<hostname> — mismatch returns
AUTHENTICATION_FAILED and no xfrm SAs are negotiated.

Pin system-id to hostname (which equals the node name on Mulga clusters)
by writing both the on-disk source of truth (/etc/openvswitch/system-id.conf,
read by ovs-ctl on boot) and the running OVS DB value. Writing only one
would drift on the next reboot — the original "do not override" comment
was right about that hazard, just wrong about the resolution.

Cross-link the invariant in admin/ipsec.go: changing the cert identity
without updating setup-ovn.sh (or vice versa) breaks IKE silently.

Refs: mulga-siv-136

2026-05-25 20:02:45 +10:00

..

ansible

feat(ansible): require --external-pool, drop NAT, forward EXTRA_VARS

2026-05-25 09:33:53 +10:00

demo

feat: Updated GPU-Passthrough - AMD support, GPU images, /demo folder (#217)

2026-05-13 11:07:13 +10:00

iac

chore: bump debian and ubuntu images

2026-05-20 09:48:26 +10:00

images

refactor: strip legacy lb-alpine AMI build path post-microvm-merge

2026-05-19 22:02:00 +10:00

build-microvm-image.sh

ci: prune rootless docker + trap container leaks in microvm build

2026-05-22 16:52:38 +10:00

build-system-image.sh

feat: flip images to UEFI default (#237)

2026-05-20 12:34:51 +10:00

check-coverage.sh

feat: daemon and vm tests (#218)

2026-05-13 11:46:20 +10:00

clone-deps.sh

feat: extract helpers (#109)

2026-04-02 10:25:01 +11:00

create-multi-node.sh

feat: formation join token (#141)

2026-04-15 16:55:55 +10:00

dev-install.sh

feat: spx admin images remove (#239)

2026-05-20 16:20:09 +10:00

dev-setup.sh

feat: privilege separation (#114)

2026-04-07 16:22:19 +10:00

diff-coverage.sh

chore: fix diff-coverage

2026-05-13 09:00:17 +10:00

disk-performance.sh

Latest changes

2026-01-27 08:17:06 +10:00

launch-gpu.sh

feat: Updated GPU-Passthrough - AMD support, GPU images, /demo folder (#217)

2026-05-13 11:07:13 +10:00

reset-dev-env.sh

refactor(vpcd): remove macvlan bridge mode

2026-05-24 21:08:52 +10:00

run-bench.sh

feat: ubuntu 26.04 image

2026-05-05 09:32:29 +10:00

run-instance.sh

feat: ubuntu 26.04 image

2026-05-05 09:32:29 +10:00

setup-ovn.sh

fix(ovn): pin OVS system-id to hostname for IPsec cert identity match

2026-05-25 20:02:45 +10:00

setup.sh

fix(daemon): flip NB_Global.ipsec=true on management node

2026-05-25 16:48:56 +10:00

smoke-test.sh

feat: flip images to UEFI default (#237)

2026-05-20 12:34:51 +10:00

start-dev.sh

feat(predastore): aes 256 encryption at rest

2026-05-12 16:06:16 +10:00

start-multi-node.sh

feat: fix silent failures across spinifex (P2 audit H-25 through H-43)

2026-03-19 13:37:41 +10:00

start-then-terminate-pending.sh

feat: ubuntu 26.04 image

2026-05-05 09:32:29 +10:00

stop-dev.sh

feat: veth pair bridge — link Linux bridge to OVS without conversion

2026-03-25 10:01:37 +10:00

test-ddil-phase1.sh

feat(daemon): DDIL Tier 1 — daemon-local-autonomy phase 1 (#204)

2026-05-10 10:08:12 +10:00

workload-performance.sh

chore: use go 1.26.3

2026-05-08 09:21:12 +10:00