feat(routeros): manage sw-core01 with opentofu - #11
Merged
Conversation
Manage the CRS309 core switch from GilmanLab/networking with a pinned local CA, ROS_* env credentials, and adoption import blocks.
Add operator plan/apply tasks and pin just plus tofu so CI can run the offline fmt/init/validate check.
- fill live import IDs; drop broken ip_service imports (provider Name-ID importer defect; adopt-by-create /set semantics instead) - defer-then-restore sfpplus5-7 port rows around the defconf purge - user group is runbook-owned: svc-tofu lacks the policy permission by design - hermetic offline check via dedicated TF_DATA_DIR - drop the dead sw-core01 DHCP reservation from the gw01 template (static)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the OpenTofu root
routeros/sw-core01/(terraform-routeros v1.99.1, REST over pinned device-local CA, creds via SOPS→ROS_* env) and wiresrouteros-checkinto moon CI.Executed live today: bootstrap (svc-tofu account, re-minted CA/leaf certs, secrets#27), adoption of the v1-kept objects (12 imports, 0 replacements), convergence (identity sw-core01, factory port names + PHY comments, service hardening, NTP), Safe/off-path purge of the defconf bridge, VLANs 30/50/60, and the legacy cert, and the full v2 port set.
tofu planis empty against the live device;moon run network:checkpasses.Notes:
routeros_ip_serviceimport is broken upstream (Name-ID importer resolves to *HEX); adopted via create=/set semantics instead.sw-core01DHCP static-mapping (address is static on-device per ADR discussion); deploy via the normal vyos sync at leisure — drift until then is a benign unused reservation.