Failover exercise

This exercise stops and restores one owned CE and one independent FRR relay in sequence. All three CEs are deployed in Canada Central. It tests node withdrawal and recovery within that region; Canada East is an allowed source input, not a second deployed recovery region.

A CE stop withdraws that node’s paths. An FRR stop removes one relay next hop from the client route. Surviving routes carry the internal application path, while the public path still depends on the reserved RE allocation, country policy and Canadian origin pool. After restart, the expected six CE-to-FRR and four FRR-to-Route-Server sessions and both relay next hops return.

The useful observations are route withdrawal, changed next hops, expected-origin traffic during the interruption, and restored sessions. Internal success alone does not establish public country authorization. Public success must be observed from an XC-classified Canadian source. The traffic-path checks put these results alongside the other controls.

Supplied exercise

The existing verifier stops and restarts owned nodes, using the subscription and exact deployed source commit from protected inputs. It is an infrastructure-changing lab exercise.

bash scripts/verify-azure-failover.sh --terraform-dir terraform \
  --evidence-dir "$CANADA_PRIVATE/failover-receipts" \
  --subscription "$CANADA_SUBSCRIPTION" --source-commit "$CANADA_SOURCE_COMMIT"

Normal verification after recovery checks the restored inventory and traffic. The exercise does not measure a comprehensive availability objective, origin-region failure, or cross-region redundancy. Those need a separate topology and acceptance design.