Migrate gateway DHCP service from ISC DHCP to Kea

[Grotax]

Description

Our gateway deployment currently uses ISC DHCP and custom service overrides in roles/dhcp/tasks/main.yml with config template roles/dhcp/templates/dhcp.conf.
ISC DHCP is aging and should be replaced with Kea for better maintainability, future package support, and cleaner operations.

Goals

1. Replace isc-dhcp-server with kea-dhcp4-server on gateways.
2. Preserve existing lease behavior and address ranges.
3. Keep static lease integration currently sourced from dhcp-static.
4. Provide a safe phased rollout with rollback path.

Scope

1. Create a new role (or migrate existing dhcp role) for Kea install and configuration.
2. Generate kea-dhcp4.conf from Ansible variables currently used by the DHCP role:
   • dhcp_range
   • ffsh_ipv4_address
3. Replace ISC service management and overrides with Kea service management.
4. Ensure the gateway still serves DHCP on bat0.
5. Keep tagging and playbook behavior compatible with current deployment flow in setup.yml.

Implementation Outline

1. Add Kea package installation and service enable/restart tasks.
2. Add Kea config template equivalent to current subnet/range/router/DNS behavior.
3. Migrate static lease input:
   • Option A: render Kea reservations directly from source data.
   • Option B: keep dhcp-static repo but transform output into Kea-compatible reservations include.
4. Add config validation step before restart to prevent broken rollout.
5. Stop and disable isc-dhcp-server once Kea is validated.

Acceptance Criteria

1. Fresh gateway deploy results in active kea-dhcp4 service.
2. Existing clients receive leases within configured range.
3. Static reservations still work.
4. DHCP traffic remains bound to bat0 network behavior expected today.
5. No dependency on isc-dhcp-server after migration.
6. gw-services and operational docs reflect the new DHCP service name.

Rollout Plan

1. Implement role and test on one non-critical gateway first.
2. Run a side-by-side validation window (functional checks and logs).
3. Roll out host by host with current serial deployment strategy.
4. Keep rollback task path to reinstall and restore ISC DHCP config if needed.

Risks and Notes

1. Static reservation migration is the most sensitive part.
2. Service naming and monitoring checks must be updated where they reference isc-dhcp-server.
3. Config syntax and option naming differ between ISC and Kea, so direct template copy is not enough.