feat/implement frr system extension for BGP routing on the host

[abckey]

FRR (Free Range Routing) Extension for Talos

This extension provides FRR for BGP routing on Talos hosts, with built-in MetalLB VRF integration for advertising Kubernetes LoadBalancer IPs via BGP.

Overview

Purpose

1. FRR (Free Range Routing) for BGP routing on Talos hosts
2. MetalLB VRF integration with a veth pair for Kubernetes LoadBalancer IP advertisement
3. Private IPv6 point-to-point connection (fd00::/8) between FRR and MetalLB speaker
4. Dynamic configuration via Jinja2 template (frr.conf.j2) rendered using jinja2-cli
5. Interface discovery from MAC addresses specified in FE_MACS environment variable

Architecture

• FRR runs in host network namespace and manages both:

  • Fabric-facing BGP peering (eBGP with leaf switches via physical interfaces)
  • MetalLB-facing BGP peering (eBGP with node local MetalLB BGP speaker in VRF metallb)

• MetalLB speaker runs with hostNetwork: true, connects to FRR via a veth pair:

  • veth-metallb interface: in host namespace - MetalLB speaker binds here
  • veth-frr interface: in VRF metallb - FRR listens here for MetalLB connections

• Route flow: MetalLB advertises LoadBalancer IPs → FRR VRF BGP → imported to default VRF → advertised to fabric

Network Topology

┌──────────────────────────────────────────────────────────────────┐
│                         Talos Host                                │
│                                                                   │
│  ┌─────────────────────────────────────────────────────────────┐ │
│  │                     Default VRF (Host)                       │ │
│  │                                                              │ │
│  │  ┌──────────────────────────┐                               │ │
│  │  │   MetalLB BGP Speaker    │                               │ │
│  │  │   (hostNetwork: true)    │                               │ │
│  │  │   ASN: 4000099999        │                               │ │
│  │  │                          │                               │ │
│  │  │   Binds to veth-metallb  │                               │ │
│  │  │   fda1:...:0001::1/127   │                               │ │
│  │  └────────────┬─────────────┘                               │ │
│  │               │                                              │ │
│  │   veth-metallb (in host ns)                                  │ │
│  │   fda1:...:0001::1/127                                       │ │
│  │               │ veth                                         │ │
│  └───────────────┼──────────────────────────────────────────────┘ │
│                  │                                                │
│  ┌───────────────┼──────────────────────────────────────────────┐ │
│  │               │         VRF: metallb (table 88)              │ │
│  │               ▼                                               │ │
│  │   veth-frr (in VRF)                                          │ │
│  │   fda1:...:0001::0/127                                       │ │
│  │               │                                               │ │
│  │   ┌───────────▼─────────────────────────────────────────┐    │ │
│  │   │              FRR                                     │    │ │
│  │   │   router bgp 4000099998 vrf metallb                  │    │ │
│  │   │   - Listens passively on veth-frr:179                │    │ │
│  │   │   - Receives LB IP routes from MetalLB               │    │ │
│  │   │                                                      │    │ │
│  │   │   router bgp 65001 (default VRF)                     │    │ │
│  │   │   - Peers with fabric via FE_MACS/FE_PORT_NAMES ifaces│    │ │
│  │   │   - Imports routes from VRF metallb                  │    │ │
│  │   │   - Advertises LB IPs to fabric                      │    │ │
│  │   └──────────────────────────────────────────────────────┘    │ │
│  └───────────────────────────────────────────────────────────────┘ │
│                                                                   │
│  Physical Interfaces (resolved from FE_MACS or from FE_PORT_NAMES)│
│  ├── eth0 ──► Leaf Switch 1 (eBGP unnumbered, IPv6 link-local)   │
│  └── eth1 ──► Leaf Switch 2 (eBGP unnumbered, IPv6 link-local)   │
└───────────────────────────────────────────────────────────────────┘

[github-actions]

This PR is stale because it has been open 45 days with no activity.