OPNET-787: Add optional top-of-rack BGP speaker for the baremetal network

[mkowalski]

What

ENABLE_BGP_TOR=true deploys an FRR container on the hypervisor host network that acts as a top-of-rack BGP speaker for the baremetal (ostestbm) network:

• accepts dynamic BGP sessions from cluster nodes anywhere on the external subnet (bgp listen range, so DHCP node addresses need no per-peer config)
• installs routes learned from the cluster into the host kernel via zebra, so prefixes advertised by the cluster (e.g. VIPs) are reachable from the hypervisor over the BGP paths
• no bgp ebgp-requires-policy (RFC 8212 relaxation), required for route exchange with FRR ≥ 8 defaults

Deployment happens at the end of 02_configure_host.sh (the network exists by then and the speaker survives ocp_cleanup, matching its ToR role); teardown is wired into host_cleanup.sh. Follows the metallb/ add-on layout. ASNs and the FRR image are configurable, defaults documented in config_example.sh:

export ENABLE_BGP_TOR=true
#export BGP_TOR_ASN=64513         # speaker ASN
#export BGP_CLUSTER_ASN=64512     # expected cluster ASN
#export BGP_TOR_IMAGE=quay.io/frrouting/frr:9.1.0

Listen ranges and address-family activation are derived from EXTERNAL_SUBNET_V4/V6 (dual-stack aware; families without a subnet are omitted).

Why

Primary consumer is BGP-based VIP management (openshift/enhancements#1982, OPNET-595): the cluster advertises API/Ingress VIPs via BGP and needs an external peer playing the ToR role. Also generally useful for any BGP-on-baremetal testing (e.g. MetalLB BGP mode without the e2e harness, OVN-K route advertisements).

Validation

• Live-tested against a running BGP-VIP cluster: 3 control-plane FRR sessions re-establish within ~1 min of (re)deploying the speaker; advertised VIP /32s are ECMP-installed on the host; full cleanup→configure cycle verified (container, $WORKING_DIR/bgp-tor, firewall port).
• bash -n + shellcheck clean on the new scripts.
• Rendered v4-only frr.conf is byte-identical to the config used throughout the enhancement-1982 demo runs.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign derekhiggins for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@mkowalski: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-metal-ipi-ovn-ipv4-bond	b45264d	link	false	/test e2e-metal-ipi-ovn-ipv4-bond
ci/prow/e2e-metal-ipi-ovn-ipv4	b45264d	link	true	/test e2e-metal-ipi-ovn-ipv4
ci/prow/e2e-metal-ovn-arbiter	b45264d	link	false	/test e2e-metal-ovn-arbiter

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.