Bird: add bgp/evpn support with vxlan and anycast gateway by jbemmel · Pull Request #3475 · ipspace/netlab

jbemmel · 2026-06-14T00:56:51Z

This depends on #3470 for the new 2.19.1 release

Adds support for evpn, vxlan and gateway (anycast) modules
Reusing FRR logic/scripts for VLAN and VXLAN provisioning

Couple of highlights:

Needed a way to sync daemon startup with Netlab running config scripts -> bird-specific config script touches a 'done' file that the container waits for
Had to make frr scripts more idempotent and reusable in some places
Retains bird :ns provisioning
Putting bird error log on stderr so that docker logs shows it - including when using older version with EVPN
bird/vlan.j2 is a bash script while bird/vxlan.j2 is config, might benefit from cleaner separation (but then lookup paths need to be changed)

device-module-test: 4 new cases OK

./device-module-test -d bird -p clab evpn
Pre-test cleanup: 
* 19:53:59 evpn/01-vxlan-bridging.yml: create(ok) up(ok) config(ok) validate(ok) cleanup(ok) OK
* 19:54:26 evpn/02-vxlan-asymmetric-irb.yml: create(ok) up(ok) config(ok) validate(ok) cleanup(ok) OK
19:54:48 evpn/03-vxlan-symmetric-irb.yml: create(FAIL) 
19:54:48 evpn/04-vxlan-central-routing.yml: create(FAIL) 
19:54:49 evpn/05-vxlan-l3only.yml: create(FAIL) 
19:54:50 evpn/06-vxlan-bridging-vlan-bundle.yml: create(FAIL) 
19:54:50 evpn/10-vxlan-rr.yml: create(ok) up(FAIL) cleanup(ok)
* 19:54:52 evpn/11-vxlan-ebgp.yml: create(ok) up(ok) config(ok) validate(ok) cleanup(ok) OK
* 19:55:13 evpn/12-vxlan-ibgp-ebgp.yml: create(ok) up(ok) config(ok) validate(ok) cleanup(ok) OK
19:55:22 evpn/13-vxlan-ebgp-allowas.yml: create(FAIL) 
19:55:23 evpn/14-vxlan-ebgp-ebgp.yml: create(FAIL) 
19:55:23 evpn/15-vxlan-ebgp-unnumbered.yml: create(FAIL) 
19:55:24 evpn/20-vxlan-irb-ospf.yml: create(FAIL) 
19:55:25 evpn/21-bgp-ce-router.yml: create(FAIL) 
19:55:25 evpn/22-ospf-ce-router.yml: create(FAIL) 
19:55:26 evpn/30-cs-bridging.yml: create(FAIL) 
19:55:26 evpn/41-vxlan-ipv6-bridging.yml: create(FAIL) 
19:55:27 evpn/51-mpls-bridging.yml: create(FAIL) 
19:55:28 evpn/52-mpls-asymmetric-irb.yml: create(FAIL) 
19:55:28 evpn/53-evpn-l3only.yml: create(FAIL) 
19:55:29 evpn/54-evpn-l3vpn.yml: create(FAIL) 
19:55:29 evpn/61-sr-bridging.yml: create(FAIL)

Most failures are due to missing vrf support; 10 fails because I don't have cEOS locally

Enable EVPN and VXLAN on the bird daemon, split L2 eth tables into a vxlan module config, and fold VXLAN interface setup into the vlan startup script. Co-authored-by: Cursor <cursoragent@cursor.com>

Run netlab config scripts before BIRD starts, make VXLAN setup idempotent, and activate EVPN on the existing BGP session instead of a duplicate peer. Co-authored-by: Cursor <cursoragent@cursor.com>

Enable gateway recursive and next-hop keep on EBGP EVPN channels for route reflectors, and export OSPF routes into BGP so PE devices can resolve remote VTEP addresses. Co-authored-by: Cursor <cursoragent@cursor.com>

Generate the EVPN/VXLAN startup script in Dockerfile.v2_from_src.j2 so clab build no longer needs supplemental files, and restore simple CMD startup for package-based bird and bird.v3 images. Co-authored-by: Cursor <cursoragent@cursor.com>

Containerlab connects routing protocols over lab interfaces, so Docker port publishing is not used for BGP, OSPF, or BFD. Co-authored-by: Cursor <cursoragent@cursor.com>

Keep VXLAN kernel setup with the vxlan module template and nest EVPN eth-table generation under a single vxlan guard. Co-authored-by: Cursor <cursoragent@cursor.com>

Use vxlan.j2 for kernel interface setup and vxlan@config.j2 for EVPN eth-table generation, matching the vlan.j2 versus bgp@session pattern. Co-authored-by: Cursor <cursoragent@cursor.com>

Use vxlan@mod in bird.yml to match bgp.mod.conf naming while keeping Box-safe daemon_config keys. Co-authored-by: Cursor <cursoragent@cursor.com>

Wait for netlab initial to finish before starting BIRD, create VXLAN interfaces after VLAN bridges are ready, and keep an upstream EVPN patch on file without applying it in the Docker build. Co-authored-by: Cursor <cursoragent@cursor.com>

Include the session type in each BGP protocol instance name so EVPN IBGP and link EBGP sessions to the same neighbor no longer collide. Co-authored-by: Cursor <cursoragent@cursor.com>

Set the SVI bridge MAC when the bridge is created, not on every script run. Co-authored-by: Cursor <cursoragent@cursor.com>

Drop EVPN interface polling, config pre-checks, and verbose startup logging; start BIRD once the netlab-config-done marker appears. Co-authored-by: Cursor <cursoragent@cursor.com>

Docker creates /etc/config on file bind mounts and /var/run already exists in the base image. Co-authored-by: Cursor <cursoragent@cursor.com>

Remove the single-use config_done_marker helper. Co-authored-by: Cursor <cursoragent@cursor.com>

Remove evpn-bridge-master.patch from the branch and gitignore the patches directory so it can stay local only. Co-authored-by: Cursor <cursoragent@cursor.com>

Use existing deploy success/failure state instead of a separate ran_executable flag. Co-authored-by: Cursor <cursoragent@cursor.com>

Keep patch directory handling out of the branch; local ignores can stay uncommitted. Co-authored-by: Cursor <cursoragent@cursor.com>

jbemmel · 2026-06-14T01:01:04Z

Could add a version check that aborts when the image isn't 2.19.0 or newer

Co-authored-by: Cursor <cursoragent@cursor.com>

ipspace

Nice one, but I think a bunch of things might have to be changed.

Split VRRP/anycast interface creation out of frr.j2 so BIRD can reuse the data-plane script without pulling in VRRP daemon configuration. Co-authored-by: Cursor <cursoragent@cursor.com>

Drop clab-side docker exec touch logic and have every clab BIRD node run a simple config-done script that touches /var/run/netlab-config-done. Co-authored-by: Cursor <cursoragent@cursor.com>

BIRD startup now waits for netlab deploy scripts via the config-done marker, so the initial template no longer needs to poll for eth1. Co-authored-by: Cursor <cursoragent@cursor.com>

Use the same startup script in the package and v3 images so BIRD waits for netlab initial before launching the daemon. Co-authored-by: Cursor <cursoragent@cursor.com>

Inherit linux :ns deploy mode, restore host-side initial setup, slim BIRD images, and touch the config-done marker via docker exec. Co-authored-by: Cursor <cursoragent@cursor.com>

Use the provider-specific template name so containerlab initial config is selected like other clab devices. Co-authored-by: Cursor <cursoragent@cursor.com>

jbemmel · 2026-06-19T04:22:02Z

+#!/bin/bash
+#
+set -e
+docker exec {{ ansible_host }} touch /var/run/netlab-config-done


Alternative: See #3498 where this is done after initial/bird-clab.j2 without requiring this odd 'config-done' quasi-plugin

ipspace

I've seen hacks before, but this one is a winner. Including VXLAN configs into VLAN script, and then generating EVPN configs in VXLAN template -- seriously?

You've stretched the definition of what a daemon is way beyond the original intent. No problem with that. However, now we have to figure out how to do data-plane configuration before the daemon is started. Reusing the same code in three Dockerfiles, templates that configure something other than what they're supposed to do, and quick hacks like your "config-done" sort-of plugin are not exactly a stellar first implementation of that concept.

I don't have much confidence in your AI friend generating a decent solution to a problem we obviously have a hard time defining. Please leave the PR as-is; I'll try to figure out a nicer way to make things work.

ipspace · 2026-06-19T06:49:24Z


-CMD [ "bird", "-c", "/etc/bird/bird.conf", "-d" ]
+# Wait for netlab initial to execute bound /etc/config scripts, then start BIRD.
+RUN cat >/entrypoint.sh <<'ENTRYPOINT'


Embedding the same script into three Dockerfiles is a perfect recipe for reusable code :(( More later...

"Plain" Dockerfiles and Jinja2 templates get built differently, making it harder to implement a 'universal' wait mechanism. Including the same bash script in each was the easiest way to get the consistency that was asked for - but I agree a more general core mechanism would be nicer

ipspace · 2026-06-19T06:50:10Z

@@ -0,0 +1,4 @@
+{% include 'vlan/frr.j2' +%}
+{% if 'vxlan' in module|default([]) %}


Why do you need this dirty hack???

Because daemons have 2 types of template files: Bash scripts and config file snippets

vxlan.j2 is already mapped as a config snippet, so it cannot also be a Bash script. This was a workaround to get both without core changes

If we move the logic from vxlan.j2 into evpn.j2, it frees up that file to include vxlan/frr.j2 instead and we can remove this

ipspace · 2026-06-19T06:51:01Z

@@ -0,0 +1,5 @@
+{% if vxlan.flooding|default('') == 'evpn' %}


If this thing generates content only when EVPN is enabled, don't you think it belongs to the EVPN config?

It does fit better in evpn.j2, which already has the check

ipspace · 2026-06-19T06:51:20Z

@@ -1,11 +1,14 @@
 ---
 description: BIRD Internet Routing Daemon
+parent: linux


Why exactly do you need this?

'linux' is the implicit default so it's not strictly needed

'linux' is the implicit default so it's not strictly needed

So why did you add it?

ipspace · 2026-06-19T06:51:35Z

 ---
 description: BIRD Internet Routing Daemon
+parent: linux
+role: router


And why have you changed the default role?

See #3499 as to what triggered it - I agree it would be better to fix that specific test

It could make sense that a "Routing Daemon" would have a default "router" role - but we can leave it out

Although it's not defined (precisely) anywhere in the documentation, the daemon devices were designed to provide control-plane-only functionality (for example, BGP RR). That's also the most common BIRD use case (IXP BGP route server)

Although it's not defined (precisely) anywhere in the documentation, the daemon devices were designed to provide control-plane-only functionality (for example, BGP RR). That's also the most common BIRD use case (IXP BGP route server)

ok, so in my mind that is a "router" role more than a "host" role. Looking at the codebase, I now realize that Linux daemons are explicitly exempted from requiring a loopback interface - is that the more common way BIRD gets deployed?

ipspace · 2026-06-19T06:52:08Z

    ospf: RTS_OSPF
    connected: RTS_DEVICE
    static: RTS_STATIC_DEVICE,RTS_STATIC
+  netlab_initial: always


Isn't this relevant only with configuration reload?

I initially modeled the Bird config after frr, hence this got copied - but you are right that it currently isn't used

ipspace · 2026-06-19T06:52:30Z

    netlab_show_command: [ birdc, 'show $@' ]
    docker_shell: bash -il
-    netlab_config_mode: sh
+    netlab_config_mode: ns


Isn't this inherited from Linux?

no, but individual clab.node_config entries are

no, but individual clab.node_config entries are

So???

jbemmel and others added 17 commits June 13, 2026 09:01

Add BIRD EVPN/VXLAN configuration templates.

1bf6d25

Enable EVPN and VXLAN on the bird daemon, split L2 eth tables into a vxlan module config, and fold VXLAN interface setup into the vlan startup script. Co-authored-by: Cursor <cursoragent@cursor.com>

Fix BIRD EVPN/VXLAN container startup and BGP session handling.

17853b7

Run netlab config scripts before BIRD starts, make VXLAN setup idempotent, and activate EVPN on the existing BGP session instead of a duplicate peer. Co-authored-by: Cursor <cursoragent@cursor.com>

Fix BIRD EVPN route reflection over EBGP sessions.

c855257

Enable gateway recursive and next-hop keep on EBGP EVPN channels for route reflectors, and export OSPF routes into BGP so PE devices can resolve remote VTEP addresses. Co-authored-by: Cursor <cursoragent@cursor.com>

Remove unused EXPOSE from BIRD source-build Dockerfile.

209eb66

Containerlab connects routing protocols over lab interfaces, so Docker port publishing is not used for BGP, OSPF, or BFD. Co-authored-by: Cursor <cursoragent@cursor.com>

Move BIRD VXLAN interface setup from vlan.j2 to vxlan.j2.

ce10613

Keep VXLAN kernel setup with the vxlan module template and nest EVPN eth-table generation under a single vxlan guard. Co-authored-by: Cursor <cursoragent@cursor.com>

Split BIRD VXLAN shell setup from daemon configuration.

f5345c2

Use vxlan.j2 for kernel interface setup and vxlan@config.j2 for EVPN eth-table generation, matching the vlan.j2 versus bgp@session pattern. Co-authored-by: Cursor <cursoragent@cursor.com>

Rename BIRD VXLAN daemon template to vxlan.mod.j2.

c0b88e7

Use vxlan@mod in bird.yml to match bgp.mod.conf naming while keeping Box-safe daemon_config keys. Co-authored-by: Cursor <cursoragent@cursor.com>

Fix duplicate BIRD BGP protocol names in IBGP-over-EBGP labs.

e1dff3a

Include the session type in each BGP protocol instance name so EVPN IBGP and link EBGP sessions to the same neighbor no longer collide. Co-authored-by: Cursor <cursoragent@cursor.com>

Revert FRR VLAN bridge MAC address setup change.

e68e756

Set the SVI bridge MAC when the bridge is created, not on every script run. Co-authored-by: Cursor <cursoragent@cursor.com>

Simplify BIRD container entrypoint to wait for netlab initial only.

ebe51df

Drop EVPN interface polling, config pre-checks, and verbose startup logging; start BIRD once the netlab-config-done marker appears. Co-authored-by: Cursor <cursoragent@cursor.com>

Remove redundant runtime directory creation from BIRD image.

621c9f0

Docker creates /etc/config on file bind mounts and /var/run already exists in the base image. Co-authored-by: Cursor <cursoragent@cursor.com>

Inline netlab config done marker lookup in mark_config_done.

e3db717

Remove the single-use config_done_marker helper. Co-authored-by: Cursor <cursoragent@cursor.com>

Stop tracking local BIRD source patches in git.

9ca1373

Remove evpn-bridge-master.patch from the branch and gitignore the patches directory so it can stay local only. Co-authored-by: Cursor <cursoragent@cursor.com>

Mark clab config done only after all deploy scripts succeed.

62ba689

Use existing deploy success/failure state instead of a separate ran_executable flag. Co-authored-by: Cursor <cursoragent@cursor.com>

Revert .gitignore change for local BIRD patches.

584641a

Keep patch directory handling out of the branch; local ignores can stay uncommitted. Co-authored-by: Cursor <cursoragent@cursor.com>

Fix ruff I001 import formatting in clab configs.

fe39d5b

Co-authored-by: Cursor <cursoragent@cursor.com>

ipspace requested changes Jun 15, 2026

View reviewed changes

jbemmel marked this pull request as draft June 15, 2026 23:27

jbemmel and others added 6 commits June 15, 2026 18:30

Extract gateway data-plane setup into a shared FRR template.

ea25b48

Split VRRP/anycast interface creation out of frr.j2 so BIRD can reuse the data-plane script without pulling in VRRP daemon configuration. Co-authored-by: Cursor <cursoragent@cursor.com>

Move BIRD config-done marker into a container deploy script.

7c1ac05

Drop clab-side docker exec touch logic and have every clab BIRD node run a simple config-done script that touches /var/run/netlab-config-done. Co-authored-by: Cursor <cursoragent@cursor.com>

Remove interface wait loop from BIRD initial config template.

10502ae

BIRD startup now waits for netlab deploy scripts via the config-done marker, so the initial template no longer needs to poll for eth1. Co-authored-by: Cursor <cursoragent@cursor.com>

Add config-done wait entrypoint to all BIRD Dockerfiles.

ff02050

Use the same startup script in the package and v3 images so BIRD waits for netlab initial before launching the daemon. Co-authored-by: Cursor <cursoragent@cursor.com>

Configure BIRD clab data plane from the host netns.

0706caf

Inherit linux :ns deploy mode, restore host-side initial setup, slim BIRD images, and touch the config-done marker via docker exec. Co-authored-by: Cursor <cursoragent@cursor.com>

Rename BIRD clab initial template to bird-clab.j2.

d71130d

Use the provider-specific template name so containerlab initial config is selected like other clab devices. Co-authored-by: Cursor <cursoragent@cursor.com>

jbemmel marked this pull request as ready for review June 16, 2026 01:09

jbemmel mentioned this pull request Jun 19, 2026

Feature: bird vrf support including bgp, ospf and route leaking #3498

Open

jbemmel commented Jun 19, 2026

View reviewed changes

ipspace requested changes Jun 19, 2026

View reviewed changes

Remove invalid fallback logic hack

3f711e8

		@@ -0,0 +1,4 @@
		{% include 'vlan/frr.j2' +%}
		{% if 'vxlan' in module\|default([]) %}

		@@ -0,0 +1,5 @@
		{% if vxlan.flooding\|default('') == 'evpn' %}

Conversation

jbemmel commented Jun 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jbemmel commented Jun 14, 2026

Uh oh!

ipspace left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ipspace left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jbemmel commented Jun 14, 2026 •

edited

Loading