From b45264da488c1594334a9b9ac15941fb17085f30 Mon Sep 17 00:00:00 2001
From: Mat Kowalski <mko@redhat.com>
Date: Thu, 9 Jul 2026 15:38:20 +0200
Subject: [PATCH] Add optional top-of-rack BGP speaker for the baremetal
 network

ENABLE_BGP_TOR deploys an FRR container on the host network that accepts
dynamic BGP sessions from cluster nodes on the external subnet and
installs learned routes on the hypervisor. Primary consumer is BGP-based
VIP management (openshift/enhancements#1982): the cluster advertises API
and Ingress VIPs to this speaker and the host reaches them over the BGP
paths. ASNs and the FRR image are configurable; teardown is wired into
host_cleanup.
---
 02_configure_host.sh     |   5 ++
 bgp/cleanup_bgp_tor.sh   |  20 ++++++++
 bgp/configure_bgp_tor.sh | 101 +++++++++++++++++++++++++++++++++++++++
 common.sh                |   7 +++
 config_example.sh        |  19 ++++++++
 host_cleanup.sh          |   3 ++
 6 files changed, 155 insertions(+)
 create mode 100755 bgp/cleanup_bgp_tor.sh
 create mode 100755 bgp/configure_bgp_tor.sh

diff --git a/02_configure_host.sh b/02_configure_host.sh
index f6bcb1a97..c8aa4bdf1 100755
--- a/02_configure_host.sh
+++ b/02_configure_host.sh
@@ -512,3 +512,8 @@ if [ "${PERSISTENT_IMAGEREG}" == true ] ; then
     sudo systemctl start nfs-server
     sudo exportfs -a
 fi
+
+# Optionally run a top-of-rack BGP speaker on the baremetal network
+if [[ -n "${ENABLE_BGP_TOR:-}" ]]; then
+    bgp/configure_bgp_tor.sh
+fi
diff --git a/bgp/cleanup_bgp_tor.sh b/bgp/cleanup_bgp_tor.sh
new file mode 100755
index 000000000..2ffd907e6
--- /dev/null
+++ b/bgp/cleanup_bgp_tor.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+set -euxo pipefail
+
+bgp_dir="$(dirname "$(readlink -f "$0")")"
+# shellcheck disable=SC1091
+source "${bgp_dir}/../common.sh"
+
+# Tears down the optional top-of-rack BGP speaker deployed by
+# configure_bgp_tor.sh. Tolerant of a missing container / firewall rule so
+# it can run unconditionally from host_cleanup.sh.
+
+BGP_TOR_NAME="bgp-tor"
+BGP_TOR_DIR="${WORKING_DIR}/bgp-tor"
+
+sudo podman rm -f "${BGP_TOR_NAME}" || true
+
+sudo firewall-cmd --zone=libvirt --permanent --remove-port=179/tcp || true
+sudo firewall-cmd --zone=libvirt --remove-port=179/tcp || true
+
+rm -rf "${BGP_TOR_DIR}"
diff --git a/bgp/configure_bgp_tor.sh b/bgp/configure_bgp_tor.sh
new file mode 100755
index 000000000..ae6be3cb0
--- /dev/null
+++ b/bgp/configure_bgp_tor.sh
@@ -0,0 +1,101 @@
+#!/usr/bin/env bash
+set -euxo pipefail
+
+bgp_dir="$(dirname "$(readlink -f "$0")")"
+# shellcheck disable=SC1091
+source "${bgp_dir}/../common.sh"
+# shellcheck disable=SC1091
+source "${bgp_dir}/../network.sh"
+
+# Deploys an FRR container on the host network acting as a top-of-rack BGP
+# speaker for the baremetal network. Cluster nodes (e.g. BGP-based VIP
+# management, enhancement openshift/enhancements#1982) peer with it via
+# dynamic neighbors; learned routes are installed into the host kernel by
+# zebra, so the hypervisor reaches advertised VIPs over the BGP paths.
+
+BGP_TOR_NAME="bgp-tor"
+BGP_TOR_DIR="${WORKING_DIR}/bgp-tor"
+
+mkdir -p "${BGP_TOR_DIR}"
+
+if [[ -n "${EXTERNAL_SUBNET_V4:-}" ]]; then
+    ROUTER_ID="$(nth_ip "${EXTERNAL_SUBNET_V4}" 1)"
+else
+    # BGP router IDs are always in IPv4 dotted-quad format; use a fixed
+    # documentation-range ID for IPv6-only deployments.
+    ROUTER_ID="192.0.2.1"
+fi
+
+# Accept dynamic BGP sessions from anywhere on the external subnet(s) and
+# only activate the address families a peer could exist on.
+LISTEN_RANGES=""
+ADDRESS_FAMILIES=""
+if [[ -n "${EXTERNAL_SUBNET_V4:-}" ]]; then
+    LISTEN_RANGES+=" bgp listen range ${EXTERNAL_SUBNET_V4} peer-group CLUSTER
+"
+    ADDRESS_FAMILIES+=" !
+ address-family ipv4 unicast
+  neighbor CLUSTER activate
+ exit-address-family
+"
+fi
+if [[ -n "${EXTERNAL_SUBNET_V6:-}" ]]; then
+    LISTEN_RANGES+=" bgp listen range ${EXTERNAL_SUBNET_V6} peer-group CLUSTER
+"
+    ADDRESS_FAMILIES+=" !
+ address-family ipv6 unicast
+  neighbor CLUSTER activate
+ exit-address-family
+"
+fi
+
+# "no bgp ebgp-requires-policy" relaxes RFC 8212; without it FRR 8+ refuses
+# to exchange routes with eBGP peers unless explicit policies are configured.
+cat > "${BGP_TOR_DIR}/frr.conf" <<EOF
+frr defaults traditional
+hostname ${BGP_TOR_NAME}
+log stdout informational
+!
+router bgp ${BGP_TOR_ASN}
+ bgp router-id ${ROUTER_ID}
+ bgp log-neighbor-changes
+ no bgp ebgp-requires-policy
+ neighbor CLUSTER peer-group
+ neighbor CLUSTER remote-as ${BGP_CLUSTER_ASN}
+${LISTEN_RANGES}${ADDRESS_FAMILIES}!
+EOF
+
+cat > "${BGP_TOR_DIR}/daemons" <<EOF
+zebra=yes
+bgpd=yes
+ospfd=no
+ospf6d=no
+ripd=no
+ripngd=no
+isisd=no
+pimd=no
+ldpd=no
+nhrpd=no
+eigrpd=no
+babeld=no
+sharpd=no
+pbrd=no
+bfdd=no
+fabricd=no
+vrrpd=no
+pathd=no
+
+vtysh_enable=yes
+zebra_options="  -A 127.0.0.1 -s 90000000"
+bgpd_options="   -A 127.0.0.1"
+EOF
+
+sudo firewall-cmd --zone=libvirt --permanent --add-port=179/tcp
+sudo firewall-cmd --zone=libvirt --add-port=179/tcp
+
+sudo podman run -d --replace --name "${BGP_TOR_NAME}" --net host --privileged \
+    -v "${BGP_TOR_DIR}/frr.conf:/etc/frr/frr.conf:z" \
+    -v "${BGP_TOR_DIR}/daemons:/etc/frr/daemons:z" \
+    "${BGP_TOR_IMAGE}"
+
+echo "BGP ToR speaker running: AS ${BGP_TOR_ASN}, router-id ${ROUTER_ID}, listening on port 179"
diff --git a/common.sh b/common.sh
index 8576ad241..caaffa451 100644
--- a/common.sh
+++ b/common.sh
@@ -708,3 +708,10 @@ if [ "${OPENSHIFT_CI}" == true ] ; then
 fi
 
 export ENABLE_CAPI_E2E=${ENABLE_CAPI_E2E:-}
+
+# Optional top-of-rack BGP speaker on the baremetal network
+# (see config_example.sh)
+export ENABLE_BGP_TOR=${ENABLE_BGP_TOR:-}
+export BGP_TOR_ASN=${BGP_TOR_ASN:-64513}
+export BGP_CLUSTER_ASN=${BGP_CLUSTER_ASN:-64512}
+export BGP_TOR_IMAGE=${BGP_TOR_IMAGE:-quay.io/frrouting/frr:9.1.0}
diff --git a/config_example.sh b/config_example.sh
index f9dbd4b8f..170ae8f45 100755
--- a/config_example.sh
+++ b/config_example.sh
@@ -222,6 +222,25 @@ set -x
 #export METALLB_IMAGE_BASE=
 #export METALLB_IMAGE_TAG=
 
+# ENABLE_BGP_TOR -
+# Deploy an FRR container on the host network acting as a top-of-rack BGP
+# speaker for the baremetal network. Cluster nodes can peer with it (e.g.
+# BGP-based VIP management, enhancement 1982) via dynamic neighbors; routes
+# learned from the cluster are installed on the host, so VIPs advertised
+# over BGP are reachable from the hypervisor.
+# The speaker listens on the whole external subnet; set the ASNs to match
+# your cluster's install-config platform.baremetal.bgpVIPConfig.
+# Default is unset.
+#
+#export ENABLE_BGP_TOR=true
+#
+# ASN of the ToR speaker (default 64513) and expected cluster ASN (64512):
+#export BGP_TOR_ASN=64513
+#export BGP_CLUSTER_ASN=64512
+#
+# FRR container image:
+#export BGP_TOR_IMAGE=quay.io/frrouting/frr:9.1.0
+
 # PERSISTENT_IMAGEREG
 # Default: false
 # Enables dev-scripts to setup and use nfs on the host as persistent storage
diff --git a/host_cleanup.sh b/host_cleanup.sh
index 7963c5318..2bc1d9fe5 100755
--- a/host_cleanup.sh
+++ b/host_cleanup.sh
@@ -83,3 +83,6 @@ sudo pkill -f oc.*proxy
 
 # Remove image-reg nfsshare
 sudo rm -rf /etc/exports.d/dev-scripts.exports /opt/dev-scripts/nfsshare
+
+# Remove the optional top-of-rack BGP speaker
+bgp/cleanup_bgp_tor.sh || true