Implement VRF route leaking

.github/workflows/ci.yaml

@@ -173,6 +173,7 @@ jobs:
           if [ "${{ matrix.ip-family }}" == "ipv4" ]; then SKIP="$SKIP\|IPV6\|DUALSTACK"; fi
           if [ "${{ matrix.ip-family }}" == "dual" ]; then SKIP="$SKIP\|IPV6"; fi
           if [ "${{ matrix.ip-family }}" == "ipv6" ]; then SKIP="$SKIP\|IPV4\|DUALSTACK"; fi
+          SKIP="$SKIP\|Leaked.*advertising" # TODO fixed by frr 10.0, remove this when https://github.com/metallb/frr-k8s/issues/165 is fixed
           GINKGO_ARGS="--skip $SKIP" TEST_ARGS="--report-path=/tmp/kind_logs" make e2etests
 
       - name: Export kind logs

API-DOCS.md

@@ -222,6 +222,22 @@ _Appears in:_
 | `lastReloadResult` _string_ | LastReloadResult represents the status of the last configuration update operation by FRR, contains "success" or an error. |  |  |
 
 
+#### Import
+
+
+
+Import represents the possible imported VRFs to a given router.
+
+
+
+_Appears in:_
+- [Router](#router)
+
+| Field | Description | Default | Validation |
+| --- | --- | --- | --- |
+| `vrf` _string_ | Vrf is the vrf we want to import from |  |  |
+
+
 #### LocalPrefPrefixes
 
 
@@ -339,6 +355,7 @@ _Appears in:_
 | `vrf` _string_ | VRF is the host vrf used to establish sessions from this router. |  |  |
 | `neighbors` _[Neighbor](#neighbor) array_ | Neighbors is the list of neighbors we want to establish BGP sessions with. |  |  |
 | `prefixes` _string array_ | Prefixes is the list of prefixes we want to advertise from this router instance. |  |  |
+| `imports` _[Import](#import) array_ | Imports is the list of imported VRFs we want for this router / vrf. |  |  |
 
 
 #### SecretReference

api/v1beta1/frrconfiguration_types.go

@@ -79,6 +79,17 @@ type Router struct {
 	// Prefixes is the list of prefixes we want to advertise from this router instance.
 	// +optional
 	Prefixes []string `json:"prefixes,omitempty"`
+
+	// Imports is the list of imported VRFs we want for this router / vrf.
+	// +optional
+	Imports []Import `json:"imports,omitempty"`
+}
+
+// Import represents the possible imported VRFs to a given router.
+type Import struct {
+	// Vrf is the vrf we want to import from
+	// +optional
+	VRF string `json:"vrf,omitempty"`
 }
 
 // Neighbor represents a BGP Neighbor we want FRR to connect to.

charts/frr-k8s/charts/crds/templates/frrk8s.metallb.io_frrconfigurations.yaml

@@ -132,6 +132,18 @@ spec:
                         id:
                           description: ID is the BGP router ID
                           type: string
+                        imports:
+                          description: Imports is the list of imported VRFs we want
+                            for this router / vrf.
+                          items:
+                            description: Import represents the possible imported VRFs
+                              to a given router.
+                            properties:
+                              vrf:
+                                description: Vrf is the vrf we want to import from
+                                type: string
+                            type: object
+                          type: array
                         neighbors:
                           description: Neighbors is the list of neighbors we want
                             to establish BGP sessions with.

config/all-in-one/frr-k8s-prometheus.yaml

@@ -147,6 +147,18 @@ spec:
                         id:
                           description: ID is the BGP router ID
                           type: string
+                        imports:
+                          description: Imports is the list of imported VRFs we want
+                            for this router / vrf.
+                          items:
+                            description: Import represents the possible imported VRFs
+                              to a given router.
+                            properties:
+                              vrf:
+                                description: Vrf is the vrf we want to import from
+                                type: string
+                            type: object
+                          type: array
                         neighbors:
                           description: Neighbors is the list of neighbors we want
                             to establish BGP sessions with.

config/all-in-one/frr-k8s.yaml

@@ -147,6 +147,18 @@ spec:
                         id:
                           description: ID is the BGP router ID
                           type: string
+                        imports:
+                          description: Imports is the list of imported VRFs we want
+                            for this router / vrf.
+                          items:
+                            description: Import represents the possible imported VRFs
+                              to a given router.
+                            properties:
+                              vrf:
+                                description: Vrf is the vrf we want to import from
+                                type: string
+                            type: object
+                          type: array
                         neighbors:
                           description: Neighbors is the list of neighbors we want
                             to establish BGP sessions with.

config/crd/bases/frrk8s.metallb.io_frrconfigurations.yaml

@@ -132,6 +132,18 @@ spec:
                         id:
                           description: ID is the BGP router ID
                           type: string
+                        imports:
+                          description: Imports is the list of imported VRFs we want
+                            for this router / vrf.
+                          items:
+                            description: Import represents the possible imported VRFs
+                              to a given router.
+                            properties:
+                              vrf:
+                                description: Vrf is the vrf we want to import from
+                                type: string
+                            type: object
+                          type: array
                         neighbors:
                           description: Neighbors is the list of neighbors we want
                             to establish BGP sessions with.

e2etests/pkg/address/address.go

@@ -0,0 +1,32 @@
+// SPDX-License-Identifier:Apache-2.0
+
+package address
+
+import (
+	"net"
+
+	"go.universe.tf/e2etest/pkg/ipfamily"
+)
+
+func FilterForFamily(ips []string, family ipfamily.Family) []string {
+	if family == ipfamily.DualStack {
+		return ips
+	}
+	var res []string
+	for _, ip := range ips {
+		parsedIP, _, _ := net.ParseCIDR(ip)
+		if parsedIP == nil {
+			panic("invalid ip") // it's a test after all, should never happen
+		}
+		isV4 := (parsedIP.To4() != nil)
+		if family == ipfamily.IPv4 && isV4 {
+			res = append(res, ip)
+			continue
+		}
+		if family == ipfamily.IPv6 && !isV4 {
+			res = append(res, ip)
+			continue
+		}
+	}
+	return res
+}

e2etests/pkg/routes/routes.go

@@ -4,7 +4,6 @@ package routes
 
 import (
 	"bytes"
-	"errors"
 	"fmt"
 	"net"
 
@@ -18,55 +17,52 @@ import (
 
 // PodHasPrefixFromContainer tells if the given frr-k8s pod has recevied a route for
 // the given prefix from the given container.
-func PodHasPrefixFromContainer(pod *v1.Pod, frr frrcontainer.FRR, prefix string) bool {
+func PodHasPrefixFromContainer(pod *v1.Pod, frr frrcontainer.FRR, vrf, prefix string) bool {
 	_, cidr, _ := net.ParseCIDR(prefix)
 	ipFamily := ipfamily.ForCIDR(cidr)
 	nextHop := frr.Ipv4
 	if ipFamily == ipfamily.IPv6 {
 		nextHop = frr.Ipv6
 	}
-	vrf := frr.RouterConfig.VRF
 	return hasPrefix(pod, ipFamily, cidr, nextHop, vrf)
 }
 
 // CheckNeighborHasPrefix tells if the given frr container has a route toward the given prefix
 // via the set of node passed to this function.
-func CheckNeighborHasPrefix(neighbor frrcontainer.FRR, prefix string, nodes []v1.Node) (bool, error) {
+func CheckNeighborHasPrefix(neighbor frrcontainer.FRR, vrf, prefix string, nodes []v1.Node) error {
 	routesV4, routesV6, err := frr.Routes(neighbor)
 	if err != nil {
-		return false, err
+		return err
 	}
 
 	_, cidr, err := net.ParseCIDR(prefix)
 	if err != nil {
-		return false, err
+		return err
 	}
 
 	route, err := routeForCIDR(cidr, routesV4, routesV6)
-	var notFound RouteNotFoundError
-	if errors.As(err, &notFound) {
-		return false, nil
-	}
 	if err != nil {
-		return false, err
+		return err
 	}
 
 	cidrFamily := ipfamily.ForCIDR(cidr)
-	err = frr.RoutesMatchNodes(nodes, route, cidrFamily, neighbor.RouterConfig.VRF)
+	err = frr.RoutesMatchNodes(nodes, route, cidrFamily, vrf)
 	if err != nil {
-		return false, nil
+		return err
 	}
-	return true, nil
+	return nil
 }
 
 func cidrsAreEqual(a, b *net.IPNet) bool {
 	return a.IP.Equal(b.IP) && bytes.Equal(a.Mask, b.Mask)
 }
 
-type RouteNotFoundError string
+type RouteNotFoundError struct {
+	Route string
+}
 
 func (e RouteNotFoundError) Error() string {
-	return string(e)
+	return fmt.Sprintf("route not found %s", e.Route)
 }
 
 func routeForCIDR(cidr *net.IPNet, routesV4 map[string]frr.Route, routesV6 map[string]frr.Route) (frr.Route, error) {
@@ -80,7 +76,7 @@ func routeForCIDR(cidr *net.IPNet, routesV4 map[string]frr.Route, routesV6 map[s
 			return route, nil
 		}
 	}
-	return frr.Route{}, RouteNotFoundError(fmt.Sprintf("route %s not found", cidr))
+	return frr.Route{}, RouteNotFoundError{Route: cidr.String()}
 }
 
 func hasPrefix(pod *v1.Pod, pairingFamily ipfamily.Family, prefix *net.IPNet, nextHop, vrf string) bool {

e2etests/tests/graceful_restart.go

@@ -105,10 +105,9 @@ var _ = ginkgo.Describe("Establish BGP session with EnableGracefulRestart", func
 
 			check := func() error {
 				for _, p := range peersConfig.Peers() {
-					found, err := routes.CheckNeighborHasPrefix(p.FRR, prefix, nodes)
-					Expect(err).NotTo(HaveOccurred())
-					if !found {
-						return fmt.Errorf("Neigh %s does not have prefix %s", p.FRR.Name, prefix)
+					err := routes.CheckNeighborHasPrefix(p.FRR, p.FRR.RouterConfig.VRF, prefix, nodes)
+					if err != nil {
+						return fmt.Errorf("Neigh %s does not have prefix %s: %w", p.FRR.Name, prefix, err)
 					}
 				}
 				return nil