Installation Manual - 73 Old Vault stale DNS cleanup

Removal of the final stale old Vault seed DNS record after old VM and disk deletion.

This chapter records the DNS cleanup gate that removed the last stale old Vault node record after the old lost-custody Vault VM definitions and disks were deleted.

Governance

FieldValue
IssueOP-GF-VAULTRECOVERY-1 / #389
MilestoneWorkspace Governance
ADRADR 0028: Greenfield Vault Replacement After Custody Loss
Existing controlsADR 0016 and ADR 0025

The previous gate removed the old Vault VM definitions and disk images. This gate removed the final stale DNS reference to the deleted old seed VM.

Scope

Removed from PowerDNS zone v7.comptech-lab.com:

RecordPrevious value
gf-ocp-vault-seed-01.v7.comptech-lab.com30.30.200.30

Preserved:

RecordValue
vault.v7.comptech-lab.com30.30.200.35, 30.30.200.36, 30.30.200.37

Out of scope for this gate:

  • no replacement R1 Vault VM was changed;
  • no Vault R1 configuration or token material was changed;
  • no OpenShift, GitOps, MinIO IAM, OADP, RHACS, or External Secrets object was changed.

Preflight

PowerDNS preflight:

CheckResult
PowerDNS hostgf-ocp-pdns-01
Zonev7.comptech-lab.com
Zone serial before change44
Stale seed recordpresent
Old main Vault recordsabsent
Stable Vault recordR1 IPs only

DNS preflight from dl385-2 and gf-ocp-bootstrap-01 confirmed:

  • vault.v7.comptech-lab.com resolved to 30.30.200.35-.37;
  • gf-ocp-vault-seed-01.v7.comptech-lab.com still resolved to 30.30.200.30;
  • gf-ocp-vault-01-.03.v7.comptech-lab.com had no A records.

R1 Vault health with standbyok=true returned HTTP 200 on:

30.30.200.35
30.30.200.36
30.30.200.37

OpenShift preflight:

ClusterOpenShiftNodesClusterOperatorsDPABSL
hub-dc-v74.20.183/3 ReadysteadyReconciledAvailable
spoke-dc-v74.20.186/6 ReadysteadyReconciledAvailable

Latest backups before the DNS cleanup remained Completed:

ClusterBackupItemsWarningsErrors
hub-dc-v7platform-resource-daily-2026051806334710122/1012200
spoke-dc-v7platform-resource-daily-2026051806342316808/1680800

ExternalSecrets were 6/6 Ready on both clusters, and the R1-backed ClusterSecretStores were Ready/Valid:

  • vault-r1-eso-smoke;
  • vault-r1-oadp;
  • vault-r1-rhacs.

Change

PowerDNS command summary:

pdnsutil delete-rrset v7.comptech-lab.com gf-ocp-vault-seed-01 A
pdnsutil increase-serial v7.comptech-lab.com
rec_control wipe-cache gf-ocp-vault-seed-01.v7.comptech-lab.com v7.comptech-lab.com

Zone serial advanced from 44 to 45.

The dl385-2 local systemd-resolved cache still served the old answer briefly after authoritative DNS was updated. The resolver cache was restarted on dl385-2 for validation, after public and lab DNS no longer returned the old A record.

Validation

PowerDNS authoritative zone after the change:

RecordResult
gf-ocp-vault-seed-01.v7.comptech-lab.comabsent
gf-ocp-vault-01.v7.comptech-lab.comabsent
gf-ocp-vault-02.v7.comptech-lab.comabsent
gf-ocp-vault-03.v7.comptech-lab.comabsent
vault.v7.comptech-lab.com30.30.200.35, 30.30.200.36, 30.30.200.37
zone serial45

Resolver validation:

SourceSeed recordStable Vault record
PowerDNS authoritative zoneabsentR1 IPs
gf-ocp-bootstrap-01NO_RECORDR1 IPs
dl385-2 after local resolver cache restartNO_RECORDR1 IPs
public resolvers checked from dl385-2no A answerR1 IPs

OpenShift validation after DNS cleanup:

ClusterOpenShiftNodesClusterOperatorsDPABSL
hub-dc-v74.20.183/3 ReadysteadyReconciledAvailable
spoke-dc-v74.20.186/6 ReadysteadyReconciledAvailable

OADP schedules remained normal:

ClusterSchedule
hub-dc-v715 2 * * *
spoke-dc-v745 2 * * *

Latest backups after the DNS cleanup:

ClusterBackupPhaseItemsWarningsErrors
hub-dc-v7platform-resource-daily-20260518063347Completed10122/1012200
spoke-dc-v7platform-resource-daily-20260518063423Completed16808/1680800

External Secrets remained Ready:

ClusterResult
hub6/6 ExternalSecrets Ready
spoke6/6 ExternalSecrets Ready

Argo CD final state:

ApplicationSyncHealthRevision
hub-dc-v7-bootstrapSyncedHealthy0bb0cca
spoke-dc-v7-cluster-configSyncedHealthy0bb0cca

RHACS remained healthy:

  • no non-running StackRox pods were found on hub or spoke.

Result

The last stale old Vault DNS record was removed. The DNS footprint now points only at the replacement R1 service endpoint for active Vault access, and the deleted old Vault VMs no longer have node-specific A records in v7.comptech-lab.com.

The Vault replacement phase is ready for a final read-only closeout check and issue closure.