refactor(vyos): replace vyos-build with manual Stream ISO installation

.mergify.yml

@@ -1,6 +1,3 @@
-# TODO: Once vyos-build workflow is implemented, add check-success condition
-# to verify the VyOS build before auto-merging image update PRs.
-
 pull_request_rules:
   - name: Auto-merge automated image updates
     conditions:

docs/architecture/05_building_blocks/02_tinkerbell_provisioning.md

@@ -9,10 +9,10 @@ Tinkerbell handles **Day Zero** operations — the initial bootstrap of physical
 
 | Target | What Tinkerbell Installs | Result |
 |:---|:---|:---|
-| **VP6630** | VyOS (vyos-build image) | Lab router with VLANs and DHCP relay |
-| **UM760** | Talos Linux | Node joins the Platform Cluster |
 | **MS-02 (x3)** | Harvester OS | Nodes join the Harvester HCI cluster |
 
+> **Note:** The VP6630 (VyOS router) and UM760 (first platform node) are bootstrapped manually before Tinkerbell is available. VyOS is installed from the Stream ISO with configuration loaded from USB. The UM760 boots from a Talos ISO with embedded machine configuration. See [Appendix B: Bootstrap Procedure](../appendices/B_bootstrap_procedure.md) for details.
+
 After initial provisioning, Tinkerbell's role is complete. Ongoing lifecycle management is handled by VyOS CI/CD (for router config), Harvester (for HCI), and CAPI (for Kubernetes clusters).
 
 ## Components

docs/architecture/06_runtime_view.md

@@ -6,42 +6,40 @@ This section describes key runtime scenarios — how the system's building block
 
 ## 1. Genesis Bootstrap
 
-The "Genesis" sequence bootstraps the entire infrastructure from bare metal to a fully operational Platform Cluster.
+The "Genesis" sequence bootstraps the entire infrastructure from bare metal to a fully operational Platform Cluster using an embedded configuration ISO approach that eliminates the need for a temporary seed cluster.
 
 ### Prerequisites
 - Physical hardware cabled and powered
-- VyOS image built with vyos-build (baked-in configuration)
-- Synology NAS available with Talos VM capability
+- VyOS Stream ISO downloaded via `labctl images sync`
+- Talos ISO with embedded machine configuration (built via `labctl images sync`)
+- USB drives for VyOS and Talos installation
 
 ### Sequence
 
 ```mermaid
 sequenceDiagram
-    participant NAS as Synology NAS
-    participant Seed as Seed Cluster
-    participant Tink as Tinkerbell
     participant VyOS as VP6630 (VyOS)
     participant UM as UM760
+    participant Argo as Argo CD
+    participant Tink as Tinkerbell
     participant MS as MS-02 (x3)
     participant Harv as Harvester
-    participant Argo as Argo CD
     participant Plat as Platform Cluster
 
-    Note over NAS: Phase 1: Seed
-    NAS->>Seed: Bootstrap single-node Talos VM
-    Seed->>Argo: Deploy Argo CD (Helm)
-    Seed->>Tink: Deploy Tinkerbell stack
-    VyOS->>Tink: PXE boot request
-    Tink->>VyOS: Provision VyOS (lab networking)
-    Note over VyOS: VLANs + DHCP relay active
+    Note over VyOS: Phase 1: Direct Boot
+    VyOS->>VyOS: Boot from Stream ISO (USB)
+    VyOS->>VyOS: Load gateway.conf from USB
+    Note over VyOS: VLANs + NAT + DHCP relay active
+
+    UM->>UM: Boot from embedded Talos ISO (USB)
+    Note over UM: Config embedded in ISO
+    UM->>UM: Install to disk, bootstrap cluster
+    UM->>Argo: Deploy Argo CD (Helm)
 
     Note over UM: Phase 2: Single-Node Platform
-    UM->>Tink: PXE boot request (via VyOS DHCP relay)
-    Tink->>UM: Provision Talos
-    UM->>Seed: Join cluster
-    Seed->>UM: Migrate workloads (Tinkerbell, Argo)
-    NAS->>NAS: Shutdown Seed VM
+    Argo->>UM: Sync clusters/platform/
     UM->>UM: Deploy Crossplane + XRDs
+    UM->>Tink: Deploy Tinkerbell via XRs
 
     Note over MS: Phase 3: Harvester Online
     MS->>Tink: PXE boot (x3)
@@ -52,7 +50,9 @@ sequenceDiagram
 
     Note over Plat: Phase 4: Full Platform
     Harv->>Harv: Create CP-2, CP-3 VMs
-    Harv-->>UM: VMs PXE boot and join
+    Harv-->>Tink: VMs PXE boot
+    Tink->>Harv: Provision Talos on VMs
+    Harv-->>UM: VMs join platform cluster
     UM->>Plat: 3-node Platform Cluster formed
     Plat->>Plat: Deploy remaining services
 ```
@@ -61,10 +61,10 @@ sequenceDiagram
 
 | Phase | Action | Result |
 |:---|:---|:---|
-| **1. Seed** | Bootstrap temporary Talos on NAS, provision VyOS | Tinkerbell + Argo CD + VyOS networking operational |
-| **2. Single-Node Platform** | Provision UM760, migrate from NAS | Single-node platform with Crossplane |
-| **3. Harvester Online** | Provision 3x MS-02, register with Argo CD | HCI cluster managed by Argo CD |
-| **4. Full Platform** | Add 2 Harvester VMs to UM760 | 3-node HA Platform Cluster |
+| **1. Direct Boot** | Install VyOS from ISO, boot UM760 from embedded ISO, deploy Argo CD | Single-node platform with VyOS networking |
+| **2. Single-Node Platform** | Deploy Crossplane + Tinkerbell via GitOps | Platform ready to provision hardware |
+| **3. Harvester Online** | Provision 3x MS-02 via Tinkerbell, register with Argo CD | HCI cluster managed by Argo CD |
+| **4. Full Platform** | Add 2 Harvester VMs to platform cluster | 3-node HA Platform Cluster |
 
 ---
 

docs/architecture/07_deployment_view.md

@@ -79,7 +79,7 @@ This section describes the physical and virtual infrastructure topology — how
 
 | Node | Operating System | Deployment Method |
 |:---|:---|:---|
-| **VP6630** | VyOS | Tinkerbell PXE (vyos-build image) |
+| **VP6630** | VyOS | Manual install from Stream ISO |
 | **MS-02 (x3)** | Harvester (Elemental OS) | Tinkerbell PXE |
 | **UM760** | Talos Linux | Tinkerbell PXE |
 | **Platform VMs (x2)** | Talos Linux | CAPI + Harvester |

docs/architecture/09_design_decisions/003_vyos_gitops.md

@@ -92,9 +92,9 @@ jobs:
         run: ansible-playbook infrastructure/vyos/ansible/playbooks/deploy.yml --syntax-check
       - name: Validate VyOS config syntax
         run: |
-          # Use vyos-config-validator or docker container
-          docker run --rm -v $PWD/infrastructure/vyos/configs:/config vyos/vyos-build \
-            /opt/vyatta/sbin/vyatta-config-validator /config/vyos.conf
+          # Use vyos container for config validation
+          docker run --rm -v $PWD/infrastructure/network/vyos/configs:/config vyos/vyos:current \
+            /opt/vyatta/sbin/vyatta-config-validator /config/gateway.conf
 ```
 
 ### Workflow: Deploy on Merge
@@ -182,10 +182,10 @@ To validate configuration changes before they reach production, we use [Containe
 
 #### How It Works
 
-1. **Container Image Build**: The vyos-build pipeline produces a squashfs filesystem which is converted to a container image using `sqfs2tar` and a minimal Dockerfile.
+1. **Container Image**: Uses the official VyOS container image from Docker Hub (`vyos/vyos:current`)
 
 2. **Topology Simulation**: Containerlab deploys a test topology with:
-   - VyOS gateway container (same rootfs as production)
+   - VyOS gateway container
    - Simulated network clients for WAN, MGMT, and Platform networks
 
 3. **Test Suite**: pytest with scrapli validates:
@@ -199,11 +199,11 @@ To validate configuration changes before they reach production, we use [Containe
 
 ```
 infrastructure/network/vyos/
-├── Dockerfile.containerlab      # Container build from squashfs
 └── tests/
     ├── topology.clab.yml        # Containerlab topology
     ├── conftest.py              # pytest fixtures
     ├── test_gateway.py          # Test suite
+    ├── render-config-boot.sh    # Generate config.boot with injected SSH key
     └── requirements.txt         # Python dependencies
 ```
 
@@ -221,7 +221,7 @@ The test environment uses simplified interface mapping:
 
 Integration tests run automatically on PRs modifying `infrastructure/network/vyos/**`:
 
-1. `build-container` job builds VyOS container from squashfs
+1. `render-config-boot.sh` generates test config with SSH key injection
 2. `integration-test` job deploys topology and runs pytest suite
 3. Tests must pass before merge
 

docs/architecture/09_design_decisions/007_image_pipeline_s3_intermediary.md

@@ -5,10 +5,7 @@
 
 ## Context
 
-The lab requires machine images (Talos, VyOS, Harvester) to be available on the Synology NAS for PXE provisioning via Tinkerbell. Images come from two sources:
-
-1. **HTTP downloads** — Pre-built images from vendors (Talos Factory, Rancher)
-2. **vyos-build** — Custom VyOS images built via Docker with configuration baked in (VyOS gateway)
+The lab requires machine images (Talos, VyOS, Harvester) to be available on the Synology NAS for PXE provisioning via Tinkerbell and for manual bootstrap. Images are primarily obtained via HTTP downloads from vendors (Talos Factory, Rancher, VyOS community builds).
 
 We need a GitOps-friendly pipeline to:
 - Declaratively define required images in Git
@@ -60,8 +57,9 @@ Store images as GitHub Release assets. Script on NAS polls for new releases.
 │  │  1. Build labctl CLI                                             │   │
 │  │  2. Parse images/images.yaml                                     │   │
 │  │  3. For each image:                                              │   │
-│  │     - HTTP: Download → Verify → Decompress                       │   │
-│  │     - vyos-build: Build in container → Collect artifact          │   │
+│  │     - Download from vendor (HTTP)                                │   │
+│  │     - Verify checksum                                            │   │
+│  │     - Decompress if needed                                       │   │
 │  │  4. Upload to iDrive e2                                          │   │
 │  └──────────────────────────────────────────────────────────────────┘   │
 └─────────────────────────────────┬──────────────────────────────────────┘