Conversation
Allow a BGPPeer to name an Interface instead of a peer address, so an eBGP session can run over the peers' IPv6 link-local addresses and the transit link needs no addressing of its own. The referenced Interface must set spec.ipv6.useLinkLocalOnly. spec.address becomes optional and is mutually exclusive with the new spec.interfaceRef; spec.localAddress is meaningless for such a peer. Both rules are enforced by CEL and by the webhook. A peer's identity, its address, interfaceRef or bgpRef, is immutable, as the finalizer only knows the current identity and would leave the previous peer behind on the device. spec.asNumber accepts the sentinel "external" for dynamic AS discovery, which only applies to interface-based peers. On NX-OS the peer maps to a PeerIf object under peerif-items, keyed by the interface name. The device reports an empty asn with asnType external, which the omitempty payload matches, so reconciliation stays idempotent. The device-level interface name is recorded in status.peerInterface, so the finalizer can still remove the peer after its Interface was deleted. The openconfig and iosxr providers reject interfaceRef as unsupported and skip the deletion of such peers as they were never configured on the device. The BGPPeer controller now watches Interfaces through a field index covering both interface references, so a peer converges as soon as its Interface appears instead of waiting for the periodic requeue. The NX-OS interface address items are replaced instead of merged, so addresses removed from the spec, such as global addresses when switching to link-local only, are removed from the device. As a gNMI Set applies replace before update operations, they are sent in a separate Set after the interface itself has been created. Signed-off-by: Oliver Frommel <oliver.frommel@bwi.de>
* Add handling of firmware upgrades for nxos
- adds new DeviceMaintenance key "firmware-upgrade"
- pauses reconciliation while upgrade is running
- adds DeviceMaintenanceFirmwareTargetAnnotation to
specify the target firmware version
nxos provider impletementation
- ensure enough space, extends NX-API
timeout during upgrade.
- image is copied & verified.
- show incompatibility-all nxos & show install all
impact nxos are run to check software & hw
- after install & reload the device is checked for
version. When boot image matches the target image
the upgrade is considered done.
Signed-off-by: Ivo Gosemann <ivo.gosemann@sap.com>
* incoporate PR review
Signed-off-by: Ivo Gosemann <ivo.gosemann@sap.com>
* use moq for nxos api client
Signed-off-by: Ivo Gosemann <ivo.gosemann@sap.com>
---------
Signed-off-by: Ivo Gosemann <ivo.gosemann@sap.com>
ofrzeta
marked this pull request as draft
September 18, 2026 09:50
hardikdr
added
the
area/switch-automation
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add spec.ipv6 to the NX-OS InterfaceConfig with suppressRouterAdvertisement and routerAdvertisementInterval (4s to 30m). Neighbor Discovery is only managed while spec.ipv6 is set, and only the suppress-ra flag is touched, so settings configured by other means stay as they are.
Verified on a Nexus 9300v (10.3(9)) against a VyOS peer: with a 4s interval the session recovered in 13s, against 852s with the default.
"ip forward" is not included, as IPv6-only peering doesn't need it.