Migration & testnet rollout

[ben-malbeclabs]

End-to-end rollout of flex-algo to testnet using a dummy color and a small set of links. Must be completed and signed off before any production deployment.

Milestone: RFC-18: Migration & Testnet Rollout
RFC: #3288

---

Size: Large

Pre-requisites:

• Migration command deployed and verified
• Controller features.yaml staged with enabled: false
• All Vpnv4 loopbacks confirmed migrated

Test plan:

1. Run migration — doublezero-admin migrate flex-algo-node-segments. Verify every Vpnv4 loopback has flex_algo_node_segment_idx set. Verify no existing node_segment_idx values changed.

2. Create UNICAST-DEFAULT color — Verify LinkColorInfo PDA created with bit 0, flex-algo 128, EOS color 1. Verify controller generates no device config (enabled: false).

3. Create dummy test color — test-dummy, constraint include-any. Verify bit 1, flex-algo 129, EOS color 2. Will be deleted at end of plan.

4. Tag a small set of links — Select 2–3 testnet links forming a connected path. Tag with UNICAST-DEFAULT. Verify link_colors[0] set onchain. Verify no device config yet.

5. Enable topology config only — Set enabled: true, community_stamping.all: false. Restart controller. Verify show traffic-engineering administrative-group shows UNICAST-DEFAULT group 0 on tagged devices. Verify show isis flex-algo shows algo 128 with only tagged links. Verify show tunnel rib system-colored-tunnel-rib brief shows (endpoint, color 1) entries.

6. Verify multicast unaffected — Verify PIM RPF paths unchanged. Verify RPF resolving via algo 0 (all links).

7. Enable stamping on a single test tenant — Set community_stamping.tenants: [<test-tenant-pubkey>]. Restart. Verify RM-USER-<test-tenant>-IN contains set extcommunity color 1. Verify VPN-IPv4 routes carry Color:CO(00):1. Verify next-hop resolves via color 1 tunnel. Verify other tenants have no color community.

8. Enable stamping for all tenants — Set community_stamping.all: true. Restart. Verify all unicast tenant route-maps contain set extcommunity color 1. Verify multicast unaffected.

9. Test deletion and revert — Clear and delete test-dummy. Verify alias and flex-algo 129 removed from all devices. Verify admin-group bit 1 not reused on next create.

10. Full revert — Set enabled: false. Restart. Verify no router traffic-engineering on all devices. Verify no flex-algo IS-IS config. Verify no set extcommunity color in any route-map. Verify traffic continues normally.

Sign-off: All 10 steps pass with no traffic disruption before proceeding to production.

Blockers: All previous milestones complete and passing