Skip to content
This repository was archived by the owner on Oct 20, 2025. It is now read-only.

Commit 487d04c

Browse files
coutinhopcoutinhop
authored
Merge pull request #647 from coutinhop/pedro-CORE-7109
Don't export BGP routes for IP pools that have disableBGPExport==true
2 parents dd6f8c7 + f47054e commit 487d04c

File tree

12 files changed

+434
-5
lines changed

12 files changed

+434
-5
lines changed

‎Makefile‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -44,10 +44,10 @@ K8S_VERSION=v1.17.0
4444

4545
test: ut test-kdd test-etcd
4646

47-
CALICOCTL_VER=master
48-
CALICOCTL_CONTAINER_NAME=calico/ctl:$(CALICOCTL_VER)-$(ARCH)
49-
TYPHA_VER=master
50-
TYPHA_CONTAINER_NAME=calico/typha:$(TYPHA_VER)-$(ARCH)
47+
CALICOCTL_VER?=master
48+
CALICOCTL_CONTAINER_NAME?=calico/ctl:$(CALICOCTL_VER)-$(ARCH)
49+
TYPHA_VER?=master
50+
TYPHA_CONTAINER_NAME?=calico/typha:$(TYPHA_VER)-$(ARCH)
5151
LOCAL_IP_ENV?=$(shell ip route get 8.8.8.8 | head -1 | awk '{print $$7}')
5252

5353
LDFLAGS=-ldflags "-X $(PACKAGE_NAME)/pkg/buildinfo.GitVersion=$(GIT_DESCRIPTION)"

‎etc/calico/confd/templates/bird6_ipam.cfg.template‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,10 +14,14 @@ filter calico_export_to_bgp_peers {
1414
{{- end}}
1515
{{- end}}
1616
{{range ls "/v1/ipam/v6/pool"}}{{$data := json (getv (printf "/v1/ipam/v6/pool/%s" .))}}
17+
{{- if $data.disableBGPExport}}
18+
# Skip {{$data.cidr}} as BGP export is disabled for it
19+
{{- else}}
1720
if ( net ~ {{$data.cidr}} ) then {
1821
accept;
1922
}
20-
{{end}}
23+
{{- end}}
24+
{{- end}}
2125
reject;
2226
}
2327

‎etc/calico/confd/templates/bird_ipam.cfg.template‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,13 @@ filter calico_export_to_bgp_peers {
1414
{{- end}}
1515
{{- end}}
1616
{{range ls "/v1/ipam/v4/pool"}}{{$data := json (getv (printf "/v1/ipam/v4/pool/%s" .))}}
17+
{{- if $data.disableBGPExport}}
18+
# Skip {{$data.cidr}} as BGP export is disabled for it
19+
{{- else}}
1720
if ( net ~ {{$data.cidr}} ) then {
1821
accept;
1922
}
23+
{{- end}}
2024
{{- end}}
2125
reject;
2226
}

‎tests/compiled_templates/mesh/bgp-export/bird.cfg‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
function apply_communities ()
2+
{
3+
}
4+
5+
# Generated by confd
6+
include "bird_aggr.cfg";
7+
include "bird_ipam.cfg";
8+
9+
router id 10.192.0.2;
10+
11+
# Configure synchronization between routing tables and kernel.
12+
protocol kernel {
13+
learn; # Learn all alien routes from the kernel
14+
persist; # Don't remove routes on bird shutdown
15+
scan time 2; # Scan kernel routing table every 2 seconds
16+
import all;
17+
export filter calico_kernel_programming; # Default is export none
18+
graceful restart; # Turn on graceful restart to reduce potential flaps in
19+
# routes when reloading BIRD configuration. With a full
20+
# automatic mesh, there is no way to prevent BGP from
21+
# flapping since multiple nodes update their BGP
22+
# configuration at the same time, GR is not guaranteed to
23+
# work correctly in this scenario.
24+
merge paths on; # Allow export multipath routes (ECMP)
25+
}
26+
27+
# Watch interface up/down events.
28+
protocol device {
29+
debug { states };
30+
scan time 2; # Scan interfaces every 2 seconds
31+
}
32+
33+
protocol direct {
34+
debug { states };
35+
interface -"cali*", -"kube-ipvs*", "*"; # Exclude cali* and kube-ipvs* but
36+
# include everything else. In
37+
# IPVS-mode, kube-proxy creates a
38+
# kube-ipvs0 interface. We exclude
39+
# kube-ipvs0 because this interface
40+
# gets an address for every in use
41+
# cluster IP. We use static routes
42+
# for when we legitimately want to
43+
# export cluster IPs.
44+
}
45+
46+
47+
# Template for all BGP clients
48+
template bgp bgp_template {
49+
debug { states };
50+
description "Connection to BGP peer";
51+
local as 64512;
52+
multihop;
53+
gateway recursive; # This should be the default, but just in case.
54+
import all; # Import all routes, since we don't know what the upstream
55+
# topology is and therefore have to trust the ToR/RR.
56+
export filter calico_export_to_bgp_peers; # Only want to export routes for workloads.
57+
add paths on;
58+
graceful restart; # See comment in kernel section about graceful restart.
59+
connect delay time 2;
60+
connect retry time 5;
61+
error wait time 5,30;
62+
}
63+
64+
# ------------- Node-to-node mesh -------------
65+
66+
67+
68+
69+
70+
# For peer /host/kube-master/ip_addr_v4
71+
# Skipping ourselves (10.192.0.2)
72+
73+
74+
75+
# For peer /host/kube-node-1/ip_addr_v4
76+
protocol bgp Mesh_10_192_0_3 from bgp_template {
77+
neighbor 10.192.0.3 as 64512;
78+
source address 10.192.0.2; # The local address we use for the TCP connection
79+
passive on; # Mesh is unidirectional, peer will connect to us.
80+
}
81+
82+
83+
84+
# For peer /host/kube-node-2/ip_addr_v4
85+
protocol bgp Mesh_10_192_0_4 from bgp_template {
86+
neighbor 10.192.0.4 as 64512;
87+
source address 10.192.0.2; # The local address we use for the TCP connection
88+
passive on; # Mesh is unidirectional, peer will connect to us.
89+
}
90+
91+
92+
93+
# ------------- Global peers -------------
94+
# No global peers configured.
95+
96+
97+
# ------------- Node-specific peers -------------
98+
99+
# No node-specific peers configured.
100+

‎tests/compiled_templates/mesh/bgp-export/bird6.cfg‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
function apply_communities ()
2+
{
3+
}
4+
5+
# Generated by confd
6+
include "bird6_aggr.cfg";
7+
include "bird6_ipam.cfg";
8+
9+
router id 10.192.0.2; # Use IPv4 address since router id is 4 octets, even in MP-BGP
10+
11+
# Configure synchronization between routing tables and kernel.
12+
protocol kernel {
13+
learn; # Learn all alien routes from the kernel
14+
persist; # Don't remove routes on bird shutdown
15+
scan time 2; # Scan kernel routing table every 2 seconds
16+
import all;
17+
export filter calico_kernel_programming; # Default is export none
18+
graceful restart; # Turn on graceful restart to reduce potential flaps in
19+
# routes when reloading BIRD configuration. With a full
20+
# automatic mesh, there is no way to prevent BGP from
21+
# flapping since multiple nodes update their BGP
22+
# configuration at the same time, GR is not guaranteed to
23+
# work correctly in this scenario.
24+
merge paths on; # Allow export multipath routes (ECMP)
25+
}
26+
27+
# Watch interface up/down events.
28+
protocol device {
29+
debug { states };
30+
scan time 2; # Scan interfaces every 2 seconds
31+
}
32+
33+
protocol direct {
34+
debug { states };
35+
interface -"cali*", -"kube-ipvs*", "*"; # Exclude cali* and kube-ipvs* but
36+
# include everything else. In
37+
# IPVS-mode, kube-proxy creates a
38+
# kube-ipvs0 interface. We exclude
39+
# kube-ipvs0 because this interface
40+
# gets an address for every in use
41+
# cluster IP. We use static routes
42+
# for when we legitimately want to
43+
# export cluster IPs.
44+
}
45+
46+
# IPv6 disabled on this node.
47+

‎tests/compiled_templates/mesh/bgp-export/bird6_aggr.cfg‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# Generated by confd
2+
3+
# No IP blocks or static routes for this host.
4+
5+
# Aggregation of routes on this host; export the block, nothing beneath it.
6+
function calico_aggr ()
7+
{
8+
}

‎tests/compiled_templates/mesh/bgp-export/bird6_ipam.cfg‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# Generated by confd
2+
filter calico_export_to_bgp_peers {
3+
# filter code terminates when it calls `accept;` or `reject;`, call apply_communities() before calico_aggr()
4+
apply_communities();
5+
calico_aggr();
6+
7+
if ( net ~ 2002:101::/64 ) then {
8+
accept;
9+
}
10+
# Skip 2002:102::/64 as BGP export is disabled for it
11+
if ( net ~ 2002:103::/64 ) then {
12+
accept;
13+
}
14+
reject;
15+
}
16+
17+
filter calico_kernel_programming {
18+
accept;
19+
}

‎tests/compiled_templates/mesh/bgp-export/bird_aggr.cfg‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# Generated by confd
2+
3+
protocol static {
4+
# IP blocks for this host.
5+
route 10.0.0.0/30 blackhole;
6+
route 10.1.0.0/24 blackhole;
7+
route 192.168.221.0/26 blackhole;
8+
route 192.168.221.192/26 blackhole;
9+
route 192.168.221.64/26 blackhole;
10+
}
11+
12+
13+
# Aggregation of routes on this host; export the block, nothing beneath it.
14+
function calico_aggr ()
15+
{
16+
# Block 10.0.0.0/30 is implicitly confirmed.
17+
if ( net = 10.0.0.0/30 ) then { accept; }
18+
if ( net ~ 10.0.0.0/30 ) then { reject; }
19+
# Block 10.1.0.0/24 is implicitly confirmed.
20+
if ( net = 10.1.0.0/24 ) then { accept; }
21+
if ( net ~ 10.1.0.0/24 ) then { reject; }
22+
# Block 10.2.0.1/32 is implicitly confirmed.
23+
if ( net = 10.2.0.1/32 ) then { accept; }
24+
if ( net ~ 10.2.0.1/32 ) then { reject; }
25+
# Block 192.168.221.0/26 is pending
26+
# Block 192.168.221.192/26 is implicitly confirmed.
27+
if ( net = 192.168.221.192/26 ) then { accept; }
28+
if ( net ~ 192.168.221.192/26 ) then { reject; }
29+
# Block 192.168.221.64/26 is confirmed
30+
if ( net = 192.168.221.64/26 ) then { accept; }
31+
if ( net ~ 192.168.221.64/26 ) then { reject; }
32+
}

‎tests/compiled_templates/mesh/bgp-export/bird_ipam.cfg‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
# Generated by confd
2+
filter calico_export_to_bgp_peers {
3+
# filter code terminates when it calls `accept;` or `reject;`, call apply_communities() before calico_aggr()
4+
apply_communities();
5+
calico_aggr();
6+
7+
if ( net ~ 192.168.1.0/24 ) then {
8+
accept;
9+
}
10+
# Skip 192.168.2.0/24 as BGP export is disabled for it
11+
if ( net ~ 192.168.3.0/24 ) then {
12+
accept;
13+
}
14+
reject;
15+
}
16+
17+
18+
filter calico_kernel_programming {
19+
20+
if ( net ~ 192.168.1.0/24 ) then {
21+
krt_tunnel = "";
22+
accept;
23+
}
24+
25+
if ( net ~ 192.168.2.0/24 ) then {
26+
krt_tunnel = "";
27+
accept;
28+
}
29+
30+
if ( net ~ 192.168.3.0/24 ) then {
31+
krt_tunnel = "";
32+
accept;
33+
}
34+
35+
accept;
36+
}

‎tests/mock_data/calicoctl/mesh/bgp-export/delete.yaml‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
kind: IPPool
2+
apiVersion: projectcalico.org/v3
3+
metadata:
4+
name: ippool-1
5+
spec:
6+
cidr: 192.168.1.0/24
7+
ipipMode: Never
8+
natOutgoing: true
9+
10+
---
11+
12+
kind: IPPool
13+
apiVersion: projectcalico.org/v3
14+
metadata:
15+
name: ippool-2
16+
spec:
17+
cidr: 192.168.2.0/24
18+
ipipMode: Never
19+
natOutgoing: true
20+
disableBGPExport: true
21+
22+
---
23+
24+
kind: IPPool
25+
apiVersion: projectcalico.org/v3
26+
metadata:
27+
name: ippool-3
28+
spec:
29+
cidr: 192.168.3.0/24
30+
ipipMode: Never
31+
natOutgoing: true
32+
disableBGPExport: false
33+
34+
---
35+
36+
kind: IPPool
37+
apiVersion: projectcalico.org/v3
38+
metadata:
39+
name: ippool-v6-1
40+
spec:
41+
cidr: 2002:101::/64
42+
ipipMode: Never
43+
vxlanMode: Never
44+
natOutgoing: true
45+
46+
---
47+
48+
kind: IPPool
49+
apiVersion: projectcalico.org/v3
50+
metadata:
51+
name: ippool-v6-2
52+
spec:
53+
cidr: 2002:102::/64
54+
ipipMode: Never
55+
vxlanMode: Never
56+
natOutgoing: true
57+
disableBGPExport: true
58+
59+
---
60+
61+
kind: IPPool
62+
apiVersion: projectcalico.org/v3
63+
metadata:
64+
name: ippool-v6-3
65+
spec:
66+
cidr: 2002:103::/64
67+
ipipMode: Never
68+
vxlanMode: Never
69+
natOutgoing: true
70+
disableBGPExport: false

0 commit comments

Comments
 (0)