Skip to content

Enable BGP next-hop-self - #666

Open
nikatza wants to merge 2 commits into
mainfrom
bgp-nexthop-self
Open

nikatza wants to merge 2 commits into
mainfrom
bgp-nexthop-self

Conversation

@nikatza

@nikatza nikatza commented Oct 22, 2026 •

Copy link
Copy Markdown
Contributor

See commit message for design and implementation details.

Enable nexthop-self via flag in BGPPeer (1st commit)

---
apiVersion: networking.metal.ironcore.dev/v1alpha1
kind: BGPPeer
metadata:
  labels:
    app.kubernetes.io/name: network-operator
    app.kubernetes.io/managed-by: kustomize
  name: leaf1-spine1-next-hop-self
spec:
  deviceRef:
    name: leaf1
  bgpRef:
    name: bgp
  address: 10.0.0.4
  asNumber: 65000
  localAddress:
    interfaceRef:
      name: lo0
  addressFamilies:
    ipv4Unicast:
      enabled: true
      nextHopSelf: true
 

Tested with a cisco nxos device yields:

router bgp 65000
  router-id 10.0.0.10
  address-family ipv4 unicast
    maximum-paths 4
  address-family ipv6 unicast
    maximum-paths 2
  address-family l2vpn evpn
    retain route-target all
  template peer __operator-managed--default__
  neighbor 10.0.0.4
    remote-as 65000
    update-source loopback0
    address-family ipv4 unicast
      next-hop-self

Set nexthop via RoutingPolicy (2nd commit)

(notice how both settings co-exist)

apiVersion: networking.metal.ironcore.dev/v1alpha1
kind: RoutingPolicy
metadata:
  labels:
    app.kubernetes.io/name: network-operator
    app.kubernetes.io/managed-by: kustomize
  name: bgp-next-hop-self
spec:
  deviceRef:
    name: leaf1
  name: BGP-NEXT-HOP-SELF
  statements:
    - sequence: 10
      actions:
        routeDisposition: AcceptRoute
        bgpActions:
          setNextHop:
            ipAddr: 10.0.0.
---
apiVersion: networking.metal.ironcore.dev/v1alpha1
kind: BGPPeer
metadata:
  labels:
    app.kubernetes.io/name: network-operator
    app.kubernetes.io/managed-by: kustomize
  name: leaf1-spine1-next-hop-self
spec:
  deviceRef:
    name: leaf1
  bgpRef:
    name: bgp
  address: 10.0.0.4
  asNumber: 65000
  localAddress:
    interfaceRef:
      name: lo0
  addressFamilies:
    ipv4Unicast:
      enabled: true
      nextHopSelf: true
      outboundRoutingPolicyRef:
          name: bgp-next-hop-self

yields

route-map BGP-NEXT-HOP-SELF permit 10
  set ip next-hop 10.0.0.1
  
router bgp 65000
  router-id 10.0.0.10
  address-family ipv4 unicast
    maximum-paths 4
  address-family ipv6 unicast
    maximum-paths 2
  address-family l2vpn evpn
    retain route-target all
  template peer __operator-managed--default__
  neighbor 10.0.0.4
    remote-as 65000
    update-source loopback0
    address-family ipv4 unicast
      route-map BGP-NEXT-HOP-SELF out
      next-hop-self

@felix-kaestner felix-kaestner added the review-scheduled The PR is being reviewed. label Oct 22, 2026
@nikatza
nikatza force-pushed the bgp-nexthop-self branch 7 times, most recently from f4c55e7 to ce1c9a6 Compare October 27, 2026 10:23
@github-actions github-actions Bot added size/XXL and removed size/XL labels Oct 27, 2026
@nikatza
nikatza force-pushed the bgp-nexthop-self branch 7 times, most recently from 6bb9e48 to ba22390 Compare October 27, 2026 15:47
@nikatza

nikatza commented Oct 27, 2026 •

Copy link
Copy Markdown
Contributor Author

Edited and deleted this comment because it does not hold anymore as per re-design to simplify the implementation.

@nikatza
nikatza marked this pull request as ready for review October 27, 2026 15:54
@nikatza
nikatza marked this pull request as draft October 28, 2026 17:40
@nikatza
nikatza force-pushed the bgp-nexthop-self branch 4 times, most recently from e896b84 to c43fdfb Compare October 30, 2026 13:54
@nikatza
nikatza force-pushed the bgp-nexthop-self branch 11 times, most recently from 34f97e8 to 1fc0bb5 Compare November 1, 2026 13:19
@github-actions github-actions Bot added size/XL and removed size/XXL labels Nov 1, 2026
@nikatza
nikatza marked this pull request as ready for review November 1, 2026 13:30
This commit introduces a way to control the next-hop for
advertised routes. Vendors like Cisco support a `nexthop-self` knob in
the peers address-family configuration. This is however not modeled in
OpenConfig, for which the same can be achieved by configuring routing
policies (and so for every vendor). The configuration via policies is
not addressed in this commit: only configuration via the nexthop-self
is.

As most vendors support this kind of knob, we extend the `BGPPeer`
resource with a flag that models the same. This is also in line with the
existing flag to enable route-reflector client behavior. It is the
responsibility of each provider to signalize that the feature is not
supported, as shown here in the OpenConfig provider. While NXOS is
implemented in this commit, IOSXR and Nokia need a follow up.

Cisco exposes the NX-OS peer address-family controls as a typed bitmask.
As we now use multiple control flags in this mask we have updated the
provider to handle properly the comma-separated gNMI values returned by
the device and avoid unnecessary device writes due to different order.

For consistency with other resources naming we renamed the `bgp_peer` to
`bgppeer`.

Signed-off-by: Pujol <enric.pujol@sap.com>
OpenConfig and some vendors do not offer a way to coarsely configure the
nexthop with its own address in the advertised routes (`nexthop-self`).
The same functionality can be achieved by defining a routing policy,
attach it to a neighbor, and define the nexthop in an action within a
statement. This approach allows more fine grained control than the
`nexthop-self` knob we just introduced.

In this commit we add a new BGP action in the RoutingPolicy that allows
to define an IP address that should be used as nexthop (any kind of
reference to `self` is not considered in the API as in OpenConfig). We
update the NXOS provider, and change all other providers to signalize
that this is not implemented yet for them.

Signed-off-by: Pujol <enric.pujol@sap.com>
@github-actions

github-actions Bot commented Nov 2, 2026

Copy link
Copy Markdown

Caution

No coverage for base commit 527448a was found, so this report compares against its ancestor 0147768 (1 commit earlier)

Merging this branch changes the coverage (4 decrease, 5 increase)

Impacted Packages Coverage Δ 🤖
github.com/ironcore-dev/network-operator/api/core/v1alpha1 2.37% (-0.01%) 👎
github.com/ironcore-dev/network-operator/internal/controller/cisco/nx 65.67% (+0.35%) 👍
github.com/ironcore-dev/network-operator/internal/controller/core 62.28% (+0.09%) 👍
github.com/ironcore-dev/network-operator/internal/controller/evpn 80.75% (+0.60%) 👍
github.com/ironcore-dev/network-operator/internal/controller/overlay 70.91% (+10.91%) 🎉
github.com/ironcore-dev/network-operator/internal/controller/pool 72.15% (-2.32%) 👎
github.com/ironcore-dev/network-operator/internal/provider 1.75% (ø)
github.com/ironcore-dev/network-operator/internal/provider/cisco/iosxr 40.12% (-0.27%) 👎
github.com/ironcore-dev/network-operator/internal/provider/cisco/nxos 18.50% (+0.73%) 👍
github.com/ironcore-dev/network-operator/internal/provider/openconfig 9.42% (-0.09%) 👎
Coverage details

Compared to commit 0147768 (run #41300423041)

Changed File Coverage Δ Total Covered Missed 🤖
github.com/ironcore-dev/network-operator/api/core/v1alpha1/bgppeer_types.go 11.11% (+11.11%) 9 (+9) 1 (+1) 8 (+8) 🎉
github.com/ironcore-dev/network-operator/api/core/v1alpha1/routingpolicy_types.go 12.50% (ø) 8 1 7
github.com/ironcore-dev/network-operator/api/core/v1alpha1/zz_generated.deepcopy.go 0.00% (ø) 2991 (+11) 0 2991 (+11)
github.com/ironcore-dev/network-operator/internal/controller/core/bgppeer_controller.go 59.67% (+59.67%) 367 (+367) 219 (+219) 148 (+148) 🌟
github.com/ironcore-dev/network-operator/internal/provider/cisco/iosxr/provider.go 17.50% (-0.25%) 280 (+4) 49 231 (+4) 👎
github.com/ironcore-dev/network-operator/internal/provider/cisco/iosxr/route_policies.go 72.63% (-0.49%) 95 (+2) 69 (+1) 26 (+1) 👎
github.com/ironcore-dev/network-operator/internal/provider/cisco/nxos/bgp.go 41.54% (+20.61%) 130 (+44) 54 (+36) 76 (+8) 🌟
github.com/ironcore-dev/network-operator/internal/provider/cisco/nxos/provider.go 4.30% (-0.01%) 2537 (+7) 109 2428 (+7) 👎
github.com/ironcore-dev/network-operator/internal/provider/cisco/nxos/routemap.go 92.31% (-2.43%) 39 (+1) 36 3 (+1) 👎
github.com/ironcore-dev/network-operator/internal/provider/openconfig/bgppeer.go 2.56% (-0.14%) 78 (+4) 2 76 (+4) 👎
github.com/ironcore-dev/network-operator/internal/provider/openconfig/routingpolicy.go 0.00% (ø) 26 (+2) 0 26 (+2)
github.com/ironcore-dev/network-operator/internal/provider/provider.go 1.75% (ø) 57 1 56

Please note that the "Total", "Covered", and "Missed" counts above refer to code statements instead of lines of code. The value in brackets refers to the test coverage of that file in the old version of the code.

Changed unit test files:

  • github.com/ironcore-dev/network-operator/internal/controller/core/bgppeer_controller_test.go
  • github.com/ironcore-dev/network-operator/internal/provider/cisco/nxos/bgp_test.go

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

review-scheduled The PR is being reviewed. size/XL

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants