From 886fd9aa8e55481eace35801a0ade8e4bb2508b1 Mon Sep 17 00:00:00 2001 From: Benjamin Ritter Date: Wed, 20 May 2026 21:25:33 +0200 Subject: [PATCH 01/13] feat: add sonic-vpp image --- .github/workflows/base-image.yaml | 1 + Makefile | 1 + images/sonic/Dockerfile | 4 ++-- images/sonic/base-202511-vpp/Dockerfile | 25 +++++++++++++++++++++++++ 4 files changed, 29 insertions(+), 2 deletions(-) create mode 100644 images/sonic/base-202511-vpp/Dockerfile diff --git a/.github/workflows/base-image.yaml b/.github/workflows/base-image.yaml index 039e6f01..83ca6040 100644 --- a/.github/workflows/base-image.yaml +++ b/.github/workflows/base-image.yaml @@ -16,6 +16,7 @@ jobs: - name: 202311 - name: 202411 - name: 202505 + - name: 202511-vpp steps: - name: Log in to the container registry diff --git a/Makefile b/Makefile index bd059e06..c6b4e1b6 100644 --- a/Makefile +++ b/Makefile @@ -429,6 +429,7 @@ build-sonic-base: docker build -t ghcr.io/metal-stack/mini-lab-sonic-base:202311 images/sonic/base-202311 docker build -t ghcr.io/metal-stack/mini-lab-sonic-base:202411 images/sonic/base-202411 docker build -t ghcr.io/metal-stack/mini-lab-sonic-base:202505 images/sonic/base-202505 + docker build -t ghcr.io/metal-stack/mini-lab-sonic-base:202511 images/sonic/base-202511-vpp ## DEV TARGETS ## diff --git a/images/sonic/Dockerfile b/images/sonic/Dockerfile index 9565c738..44ad5a43 100644 --- a/images/sonic/Dockerfile +++ b/images/sonic/Dockerfile @@ -14,8 +14,8 @@ RUN apt-get update && \ qemu-system-x86 \ telnet -COPY --from=ghcr.io/metal-stack/mini-lab-sonic-base:202505 /sonic-vs.img /sonic-vs.img -COPY --from=ghcr.io/metal-stack/mini-lab-sonic-base:202505 /frr-pythontools.deb /frr-pythontools.deb +COPY --from=ghcr.io/metal-stack/mini-lab-sonic-base:202511-vpp /sonic-vs.img /sonic-vs.img +COPY --from=ghcr.io/metal-stack/mini-lab-sonic-base:202511-vpp /frr-pythontools.deb /frr-pythontools.deb ENTRYPOINT ["/launch.py"] diff --git a/images/sonic/base-202511-vpp/Dockerfile b/images/sonic/base-202511-vpp/Dockerfile new file mode 100644 index 00000000..32daf97e --- /dev/null +++ b/images/sonic/base-202511-vpp/Dockerfile @@ -0,0 +1,25 @@ +# Check: https://sonic-build.azurewebsites.net/ui/sonic/pipelines +ARG SONIC_BASE_URL=https://sonic-build.azurewebsites.net/api/sonic/artifacts?branchName=202511&definitionId=2818&artifactName=sonic-buildimage.vpp +ARG SONIC_IMG_URL=${SONIC_BASE_URL}&target=target%2Fsonic-vpp.img.gz +ARG FRR_RELOAD_URL=${SONIC_BASE_URL}&target=target%2Fdebs%2Fbookworm%2Ffrr-pythontools_10.4.1-sonic-0_all.deb + +FROM docker.io/library/busybox:stable AS download + +ARG SONIC_IMG_URL +ARG FRR_RELOAD_URL + +ADD "${SONIC_IMG_URL}" /sonic-vs.img.gz +ADD "${FRR_RELOAD_URL}" /frr-pythontools.deb + +RUN gunzip /sonic-vs.img.gz + +FROM scratch + +ARG SONIC_IMG_URL +ARG FRR_RELOAD_URL + +LABEL sonic-img-url=${SONIC_IMG_URL} \ + frr-reload-url=${FRR_RELOAD_URL} + +COPY --from=download /frr-pythontools.deb /frr-pythontools.deb +COPY --from=download /sonic-vs.img /sonic-vs.img From 4284272ec32086bee4c189fc472f2e8518575df6 Mon Sep 17 00:00:00 2001 From: Benjamin Ritter Date: Sat, 23 May 2026 10:59:08 +0200 Subject: [PATCH 02/13] feat: booting sonic-vpp Signed-off-by: Benjamin Ritter --- Makefile | 4 +- deploy_partition.yaml | 6 +- images/sonic/README.md | 8 ++ images/sonic/launch.py | 145 +++++++++++++++++------- images/sonic/port_config.ini | 125 +------------------- inventories/group_vars/leaves/main.yaml | 2 +- mini-lab.sonic.yaml | 8 +- roles/sonic/tasks/main.yaml | 22 ++-- 8 files changed, 134 insertions(+), 186 deletions(-) create mode 100644 images/sonic/README.md diff --git a/Makefile b/Makefile index c6b4e1b6..68409109 100644 --- a/Makefile +++ b/Makefile @@ -28,7 +28,7 @@ ANSIBLE_DISPLAY_SKIPPED_HOSTS=false MINI_LAB_FLAVOR := $(or $(MINI_LAB_FLAVOR),sonic) MINI_LAB_VM_IMAGE := $(or $(MINI_LAB_VM_IMAGE),ghcr.io/metal-stack/mini-lab-vms:latest) -MINI_LAB_SONIC_IMAGE := $(or $(MINI_LAB_SONIC_IMAGE),ghcr.io/metal-stack/mini-lab-sonic:latest) +MINI_LAB_SONIC_IMAGE := $(or $(MINI_LAB_SONIC_IMAGE),ghcr.io/metal-stack/mini-lab-sonic:202511-vpp) MINI_LAB_DELL_SONIC_VERSION := $(or $(MINI_LAB_DELL_SONIC_VERSION),4.5.1) MINI_LAB_INTERNAL_NETWORK=mini_lab_internal @@ -429,7 +429,7 @@ build-sonic-base: docker build -t ghcr.io/metal-stack/mini-lab-sonic-base:202311 images/sonic/base-202311 docker build -t ghcr.io/metal-stack/mini-lab-sonic-base:202411 images/sonic/base-202411 docker build -t ghcr.io/metal-stack/mini-lab-sonic-base:202505 images/sonic/base-202505 - docker build -t ghcr.io/metal-stack/mini-lab-sonic-base:202511 images/sonic/base-202511-vpp + docker build -t ghcr.io/metal-stack/mini-lab-sonic-base:202511-vpp images/sonic/base-202511-vpp ## DEV TARGETS ## diff --git a/deploy_partition.yaml b/deploy_partition.yaml index 2ad4de4d..295355e8 100644 --- a/deploy_partition.yaml +++ b/deploy_partition.yaml @@ -7,7 +7,7 @@ - name: Wait for system to become reachable ansible.builtin.wait_for_connection: delay: 10 - timeout: 50 + timeout: 120 roles: - name: ansible-common tags: always @@ -161,10 +161,6 @@ hosts: dell_sonic any_errors_fatal: true become: true - pre_tasks: - - name: Wait some time - pause: - seconds: 120 roles: - name: ansible-common tags: always diff --git a/images/sonic/README.md b/images/sonic/README.md new file mode 100644 index 00000000..bdec0df1 --- /dev/null +++ b/images/sonic/README.md @@ -0,0 +1,8 @@ +# Virtual Sonic Images + +We use sonic-vpp to emulate SONiC switches. It is running in kvm inside a containerlab container. To provide better emulation accuracy we use sonic-vpp, which used the Vector Package Processor to emulate somthing like a switch ASIC, like the Broadcom Tomahawk 3 used in our Edgecore Accton AS7726-X32 workhorse we use in production. We migrated to sonic-vpp because the sonic-vs image used mostly netlink primitives, which behaved differently than an ASIC driven through SONiCs SAI layer. It's slower but still sane. + + +# Configuration knobs + +You can edit the port_config.ini to add more ports. Keep the number as low as possible. It will put less strain on your system because it will spawn fewer VPP worker threads. You will have to set up the switch from scratch afterwards, since VPP will generate some configuration on first startup. \ No newline at end of file diff --git a/images/sonic/launch.py b/images/sonic/launch.py index 41926f3c..9682214b 100755 --- a/images/sonic/launch.py +++ b/images/sonic/launch.py @@ -10,6 +10,7 @@ import struct import subprocess import sys +import telnetlib import time from typing import Callable @@ -48,7 +49,15 @@ def guestfs(self) -> GuestFS: g = guestfs.GuestFS(python_return_dict=True) g.add_drive_opts(filename=self._disk, format="qcow2", readonly=False) g.launch() - g.mount('/dev/sda3', '/') + # SONiC stores its rootfs as a read-only squashfs at /image-*/fs.squashfs; + # the sibling rw/ tree only holds overlay overrides. Use mkmountpoint so + # we can expose both: the writable partition under /disk and the base + # rootfs (loop-mounted from fs.squashfs) under /rootfs. + g.mkmountpoint('/disk') + g.mkmountpoint('/rootfs') + g.mount('/dev/sda3', '/disk') + image = g.glob_expand('/disk/image-*')[0] + g.mount_loop(image + 'fs.squashfs', '/rootfs') return g def start(self) -> None: @@ -78,7 +87,7 @@ def start(self) -> None: with open(f'/sys/class/net/{iface}/address', 'r') as f: mac = f.read().strip() cmd.append('-device') - cmd.append(f'virtio-net-pci,netdev=hn{i},mac={mac}') + cmd.append(f'virtio-net-pci,netdev=hn{i},mac={mac},mq=off,host_mtu=9216') cmd.append(f'-netdev') cmd.append(f'tap,id=hn{i},ifname=tap{i},script=/mirror_tap_to_front_panel.sh,downscript=no') @@ -89,9 +98,9 @@ def wait(self) -> None: def initial_configuration(g: GuestFS, hwsku: str) -> None: - image = g.glob_expand('/image-*')[0] + image = g.glob_expand('/disk/image-*')[0] - g.rm(image + 'platform/firsttime') + # g.rm(image + 'platform/firsttime') systemd_system = image + 'rw/etc/systemd/system/' sonic_target_wants = systemd_system + 'sonic.target.wants/' @@ -101,38 +110,36 @@ def initial_configuration(g: GuestFS, hwsku: str) -> None: g.copy_in(localpath='/frr-pythontools.deb', remotedir=image + 'rw/') # Workaround: Speed up lldp startup by remove hardcoded wait of 90 seconds - g.ln_s(linkname=systemd_system + 'aaastatsd.timer', target='/dev/null') # Radius - # NOTE: featured.timer and hostcfgd.timer are intentionally NOT masked. They run - # SONiC's feature-manager and host-config reconciliation and provide the startup - # ordering that EVPN/FRR bring-up relies on. Masking them raced the remote L3VNI - # VTEP RMAC programming on the leaves, which then required a manual - # `systemctl restart bgp` to recover. lldp/pmon are still hand-wired below so they - # start immediately instead of waiting for featured's delayed timer. - g.ln_s(linkname=systemd_system + 'rasdaemon.timer', target='/dev/null') # After boot Host configuration - g.ln_s(linkname=systemd_system + 'tacacs-config.timer', target='/dev/null') # After boot Host configuration + # g.ln_s(linkname=systemd_system + 'aaastatsd.timer', target='/dev/null') # Radius + # g.ln_s(linkname=systemd_system + 'featured.timer', target='/dev/null') # Feature handling not necessary + # g.ln_s(linkname=systemd_system + 'hostcfgd.timer', target='/dev/null') # After boot Host configuration + # g.ln_s(linkname=systemd_system + 'rasdaemon.timer', target='/dev/null') # After boot Host configuration + # g.ln_s(linkname=systemd_system + 'tacacs-config.timer', target='/dev/null') # After boot Host configuration # Started by featured - g.ln_s(linkname=sonic_target_wants + 'lldp.service', target='/lib/systemd/system/lldp.service') - g.ln_s(linkname=systemd_system + 'pmon.service', target='/lib/systemd/system/pmon.service') - g.ln_s(linkname=sonic_target_wants + 'pmon.service', target='/lib/systemd/system/pmon.service') + # g.ln_s(linkname=sonic_target_wants + 'lldp.service', target='/lib/systemd/system/lldp.service') + # g.ln_s(linkname=systemd_system + 'pmon.service', target='/lib/systemd/system/pmon.service') + # g.ln_s(linkname=sonic_target_wants + 'pmon.service', target='/lib/systemd/system/pmon.service') # Workaround: Only useful for BackEndToRRouter - g.ln_s(linkname=systemd_system + 'backend-acl.service', target='/dev/null') + # g.ln_s(linkname=systemd_system + 'backend-acl.service', target='/dev/null') # Workaround: We don't need LACP - g.ln_s(linkname=systemd_system + 'teamd.service', target='/dev/null') + # g.ln_s(linkname=systemd_system + 'teamd.service', target='/dev/null') # Workaround: Python module sonic_platform not present on vs images g.ln_s(linkname=systemd_system + 'system-health.service', target='/dev/null') g.ln_s(linkname=systemd_system + 'watchdog-control.service', target='/dev/null') sonic_share = image + 'rw/usr/share/sonic/' - hwsku_dir = image + 'rw' + VS_DEVICES_PATH + hwsku - g.mkdir_p(hwsku_dir) - - g.write(path=image + 'rw' + VS_DEVICES_PATH + 'default_sku', content=f'{hwsku} empty'.encode('utf-8')) - g.ln_s(linkname=sonic_share + 'hwsku', target=VS_DEVICES_PATH + hwsku) - g.ln_s(linkname=sonic_share + 'platform', target=VS_DEVICES_PATH) + platform_dir = image + 'rw' + VS_DEVICES_PATH + hwsku_dir_rw = image + 'rw' + VS_DEVICES_PATH + hwsku + g.mkdir_p(platform_dir) + g.write(path=platform_dir + '/default_sku', content=f'{hwsku} empty'.encode('utf-8')) + # The lanemap.ini file is used by the virtual switch image to assign front panels to the Linux interfaces ethX. + # This assignment will later also be used by the script mirror_tap_to_front_panel.sh. + # g.download(remotefilename=hwsku_dir + '/port_config.ini', filename='/port_config.ini') + # g.download(remotefilename=hwsku_dir + '/lanemap.ini', filename='/lanemap.ini') ifaces = get_ethernet_interfaces() # The port_config.ini file contains the assignment of front panels to lanes. port_config = parse_port_config() @@ -142,20 +149,21 @@ def initial_configuration(g: GuestFS, hwsku: str) -> None: with open('/lanemap.ini', 'w') as f: f.write('\n'.join(lanemap)) - g.copy_in(localpath='/lanemap.ini', remotedir=hwsku_dir) - g.copy_in(localpath='/port_config.ini', remotedir=hwsku_dir) + g.mkdir_p(hwsku_dir_rw) + g.copy_in(localpath='/lanemap.ini', remotedir=hwsku_dir_rw) + g.copy_in(localpath='/port_config.ini', remotedir=hwsku_dir_rw) etc_sonic = image + 'rw/etc/sonic/' g.mkdir_p(etc_sonic) - sonic_version = image.removeprefix('/image-').removesuffix('/') - sonic_environment = f''' - SONIC_VERSION=${sonic_version} - PLATFORM=x86_64-kvm_x86_64-r0 - HWSKU={hwsku} - DEVICE_TYPE=LeafRouter - ASIC_TYPE=vs - '''.encode('utf-8') - g.write(path=etc_sonic + 'sonic-environment', content=sonic_environment) + # sonic_version = image.removeprefix('/image-').removesuffix('/') + # sonic_environment = f''' + # SONIC_VERSION=${sonic_version} + # PLATFORM=x86_64-kvm_x86_64-r0 + # HWSKU={hwsku} + # DEVICE_TYPE=LeafRouter + # ASIC_TYPE=vpp + # '''.encode('utf-8') + # g.write(path=etc_sonic + 'sonic-environment', content=sonic_environment) config_db = create_config_db(hwsku) ports = {} @@ -168,7 +176,7 @@ def initial_configuration(g: GuestFS, hwsku: str) -> None: config_db['PORT'] = ports config_db_json = json.dumps(config_db, indent=4, sort_keys=True) - g.write(path=etc_sonic + 'config_db.json', content=config_db_json.encode('utf-8')) + g.write(path=image + 'rw/golden_config_db.json', content=config_db_json.encode('utf-8')) if os.path.exists('/authorized_keys'): g.mkdir_p(image + 'rw/root/.ssh') @@ -185,8 +193,8 @@ def main(): logger = logging.getLogger() name = os.getenv('CLAB_LABEL_CLAB_NODE_NAME', default='switch') - smp = os.getenv('QEMU_SMP', default='2') - memory = os.getenv('QEMU_MEMORY', default='2048') + smp = os.getenv('QEMU_SMP', default='4') + memory = os.getenv('QEMU_MEMORY', default='4096') interfaces = int(os.getenv('CLAB_INTFS', 0)) + 1 hwsku = os.getenv('HWSKU', default='Accton-AS7726-32X') @@ -207,6 +215,8 @@ def main(): logger.info('Start QEMU') vm.start() + apply_golden_config_via_serial(logger) + # Readiness: wait until SONiC forwards its own LLDP out a *front-panel* port, not just # mgmt eth0. LLDP egress on a front-panel port requires PortConfigDone AND the port to # be programmed/oper-up in the (v)ASIC dataplane, so this signals dataplane readiness @@ -229,6 +239,57 @@ def handle_exit(signal, frame): sys.exit(0) +def apply_golden_config_via_serial(logger) -> None: + logger.info('Connecting to SONiC serial console on 127.0.0.1:5000') + while True: + try: + tn = telnetlib.Telnet('127.0.0.1', 5000, timeout=600) + break + except ConnectionRefusedError: + time.sleep(1) + + def send(data: bytes, *, redact: bool = False) -> None: + display = '***' if redact else data.rstrip(b'\n').decode('utf-8', errors='replace') + logger.info(f'serial> {display}') + tn.write(data) + + def read_until(marker: bytes, timeout: int) -> str: + text = tn.read_until(marker, timeout=timeout).decode('utf-8', errors='replace') + for line in text.splitlines(): + stripped = line.rstrip() + if stripped: + logger.info(f'serial< {stripped}') + return text + + logger.info('Waiting for login prompt') + read_until(b'login: ', timeout=600) + send(b'admin\n') + + read_until(b'Password: ', timeout=60) + send(b'YourPaSsWoRd\n', redact=True) + + read_until(b'$ ', timeout=60) + + # hacked together system readiness check since show system-health does not work in virtual sonic + # stolen from https://github.com/sonic-net/sonic-utilities/blob/master/config/main.py + logger.info('Waiting for systemctl is-system-running to return running') + while True: + send(b'sudo systemctl is-system-running\n') + text = read_until(b'$ ', timeout=30) + if any(line.strip() == 'running' for line in text.splitlines()): + break + time.sleep(5) + + logger.info('Installing golden config_db.json') + send(b'sudo config reload -f -y /golden_config_db.json \n') + read_until(b'$ ', timeout=60) + + #logger.info('Rebooting SONiC to apply golden config') + #send(b'sudo reboot\n') + + tn.close() + + def wait_until_all_interfaces_are_connected(interfaces: int) -> None: while True: i = 0 @@ -367,11 +428,13 @@ def create_config_db(hwsku: str) -> dict: 'admin_status': 'up' } }, - 'VERSIONS': { - 'DATABASE': { - 'VERSION': 'version_202311_03' + 'LLDP': { + 'GLOBAL': { + 'enabled': 'true', + 'hello_time': '10' } } + } diff --git a/images/sonic/port_config.ini b/images/sonic/port_config.ini index acc1f3d2..2dfa3d87 100644 --- a/images/sonic/port_config.ini +++ b/images/sonic/port_config.ini @@ -1,123 +1,4 @@ # name lanes alias index speed -Ethernet0 1 Eth1/1 1 25000 -Ethernet1 2 Eth1/2 1 25000 -Ethernet2 3 Eth1/3 1 25000 -Ethernet3 4 Eth1/4 1 25000 -Ethernet4 5 Eth2/1 2 25000 -Ethernet5 6 Eth2/2 2 25000 -Ethernet6 7 Eth2/3 2 25000 -Ethernet7 8 Eth2/4 2 25000 -Ethernet8 9 Eth3/1 3 25000 -Ethernet9 10 Eth3/2 3 25000 -Ethernet10 11 Eth3/3 3 25000 -Ethernet11 12 Eth3/4 3 25000 -Ethernet12 13 Eth4/1 4 25000 -Ethernet13 14 Eth4/2 4 25000 -Ethernet14 15 Eth4/3 4 25000 -Ethernet15 16 Eth4/4 4 25000 -Ethernet16 17 Eth5/1 5 25000 -Ethernet17 18 Eth5/2 5 25000 -Ethernet18 19 Eth5/3 5 25000 -Ethernet19 20 Eth5/4 5 25000 -Ethernet20 21 Eth6/1 6 25000 -Ethernet21 22 Eth6/2 6 25000 -Ethernet22 23 Eth6/3 6 25000 -Ethernet23 24 Eth6/4 6 25000 -Ethernet24 25 Eth7/1 7 25000 -Ethernet25 26 Eth7/2 7 25000 -Ethernet26 27 Eth7/3 7 25000 -Ethernet27 28 Eth7/4 7 25000 -Ethernet28 29 Eth8/1 8 25000 -Ethernet29 30 Eth8/2 8 25000 -Ethernet30 31 Eth8/3 8 25000 -Ethernet31 32 Eth8/4 8 25000 -Ethernet32 33 Eth9/1 9 25000 -Ethernet33 34 Eth9/2 9 25000 -Ethernet34 35 Eth9/3 9 25000 -Ethernet35 36 Eth9/4 9 25000 -Ethernet36 37 Eth10/1 10 25000 -Ethernet37 38 Eth10/2 10 25000 -Ethernet38 39 Eth10/3 10 25000 -Ethernet39 40 Eth10/4 10 25000 -Ethernet40 41 Eth11/1 11 25000 -Ethernet41 42 Eth11/2 11 25000 -Ethernet42 43 Eth11/3 11 25000 -Ethernet43 44 Eth11/4 11 25000 -Ethernet44 45 Eth12/1 12 25000 -Ethernet45 46 Eth12/2 12 25000 -Ethernet46 47 Eth12/3 12 25000 -Ethernet47 48 Eth12/4 12 25000 -Ethernet48 49 Eth13/1 13 25000 -Ethernet49 50 Eth13/2 13 25000 -Ethernet50 51 Eth13/3 13 25000 -Ethernet51 52 Eth13/4 13 25000 -Ethernet52 53 Eth14/1 14 25000 -Ethernet53 54 Eth14/2 14 25000 -Ethernet54 55 Eth14/3 14 25000 -Ethernet55 56 Eth14/4 14 25000 -Ethernet56 57 Eth15/1 15 25000 -Ethernet57 58 Eth15/2 15 25000 -Ethernet58 59 Eth15/3 15 25000 -Ethernet59 60 Eth15/4 15 25000 -Ethernet60 61 Eth16/1 16 25000 -Ethernet61 62 Eth16/2 16 25000 -Ethernet62 63 Eth16/3 16 25000 -Ethernet63 64 Eth16/4 16 25000 -Ethernet64 65 Eth17/1 17 25000 -Ethernet65 66 Eth17/2 17 25000 -Ethernet66 67 Eth17/3 17 25000 -Ethernet67 68 Eth17/4 17 25000 -Ethernet68 69 Eth18/1 18 25000 -Ethernet69 70 Eth18/2 18 25000 -Ethernet70 71 Eth18/3 18 25000 -Ethernet71 72 Eth18/4 18 25000 -Ethernet72 73 Eth19/1 19 25000 -Ethernet73 74 Eth19/2 19 25000 -Ethernet74 75 Eth19/3 19 25000 -Ethernet75 76 Eth19/4 19 25000 -Ethernet76 77 Eth20/1 20 25000 -Ethernet77 78 Eth20/2 20 25000 -Ethernet78 79 Eth20/3 20 25000 -Ethernet79 80 Eth20/4 20 25000 -Ethernet80 81 Eth21/1 21 25000 -Ethernet81 82 Eth21/2 21 25000 -Ethernet82 83 Eth21/3 21 25000 -Ethernet83 84 Eth21/4 21 25000 -Ethernet84 85 Eth22/1 22 25000 -Ethernet85 86 Eth22/2 22 25000 -Ethernet86 87 Eth22/3 22 25000 -Ethernet87 88 Eth22/4 22 25000 -Ethernet88 89 Eth23/1 23 25000 -Ethernet89 90 Eth23/2 23 25000 -Ethernet90 91 Eth23/3 23 25000 -Ethernet91 92 Eth23/4 23 25000 -Ethernet92 93 Eth24/1 24 25000 -Ethernet93 94 Eth24/2 24 25000 -Ethernet94 95 Eth24/3 24 25000 -Ethernet95 96 Eth24/4 24 25000 -Ethernet96 97 Eth25/1 25 25000 -Ethernet97 98 Eth25/2 25 25000 -Ethernet98 99 Eth25/3 25 25000 -Ethernet99 100 Eth25/4 25 25000 -Ethernet100 101 Eth26/1 26 25000 -Ethernet101 102 Eth26/2 26 25000 -Ethernet102 103 Eth26/3 26 25000 -Ethernet103 104 Eth26/4 26 25000 -Ethernet104 105 Eth27/1 27 25000 -Ethernet105 106 Eth27/2 27 25000 -Ethernet106 107 Eth27/3 27 25000 -Ethernet107 108 Eth27/4 27 25000 -Ethernet108 109 Eth28/1 28 25000 -Ethernet109 110 Eth28/2 28 25000 -Ethernet110 111 Eth28/3 28 25000 -Ethernet111 112 Eth28/4 28 25000 -Ethernet112 113 Eth29/1 29 25000 -Ethernet113 114 Eth29/2 29 25000 -Ethernet114 115 Eth29/3 29 25000 -Ethernet115 116 Eth29/4 29 25000 -Ethernet116 117 Eth30/1 30 25000 -Ethernet117 118 Eth30/2 30 25000 -Ethernet118 119 Eth30/3 30 25000 -Ethernet119 120 Eth30/4 30 25000 -Ethernet120 121,122,123,124 Eth31 31 100000 -Ethernet124 125,126,127,128 Eth32 32 100000 +Ethernet0 1,2,3,4 Eth1 1 100000 +Ethernet4 5,6,7,8 Eth2 2 100000 +Ethernet8 121,122,123,124 Eth3 3 100000 \ No newline at end of file diff --git a/inventories/group_vars/leaves/main.yaml b/inventories/group_vars/leaves/main.yaml index e1d1e596..765c3bec 100644 --- a/inventories/group_vars/leaves/main.yaml +++ b/inventories/group_vars/leaves/main.yaml @@ -4,7 +4,7 @@ dhcp_listening_interfaces: metal_core_cidr_mask: 25 metal_core_spine_uplinks: - - Ethernet120 + - Ethernet8 sonic_config_docker_routing_config_mode: split-unified sonic_config_frr_render: false diff --git a/mini-lab.sonic.yaml b/mini-lab.sonic.yaml index a14ad7e0..c29fd11a 100644 --- a/mini-lab.sonic.yaml +++ b/mini-lab.sonic.yaml @@ -58,7 +58,7 @@ topology: mtu: 9000 - endpoints: ["leaf01:Ethernet0", "machine01:lan0"] - endpoints: ["leaf02:Ethernet0", "machine01:lan1"] - - endpoints: ["leaf01:Ethernet1", "machine02:lan0"] - - endpoints: ["leaf02:Ethernet1", "machine02:lan1"] - - endpoints: ["leaf01:Ethernet120", "exit:eth1"] - - endpoints: ["leaf02:Ethernet120", "exit:eth2"] + - endpoints: ["leaf01:Ethernet4", "machine02:lan0"] + - endpoints: ["leaf02:Ethernet4", "machine02:lan1"] + - endpoints: ["leaf01:Ethernet8", "exit:eth1"] + - endpoints: ["leaf02:Ethernet8", "exit:eth2"] diff --git a/roles/sonic/tasks/main.yaml b/roles/sonic/tasks/main.yaml index c8ee8460..444c7367 100644 --- a/roles/sonic/tasks/main.yaml +++ b/roles/sonic/tasks/main.yaml @@ -2,15 +2,15 @@ - name: Install frr-pythontools ansible.builtin.import_tasks: frr-reload.yaml -- name: Fix Network Performance - ansible.builtin.import_tasks: fix-network-performance.yaml +# - name: Fix Network Performance +# ansible.builtin.import_tasks: fix-network-performance.yaml -- name: Set lldp tx-interval to 10 - ansible.builtin.command: lldpcli configure lldp tx-interval 10 - retries: 10 - delay: 3 - register: result - until: result.rc == 0 +# - name: Set lldp tx-interval to 10 +# ansible.builtin.command: lldpcli configure lldp tx-interval 10 +# retries: 10 +# delay: 3 +# register: result +# until: result.rc == 0 - name: Activate IP MASQUERADE on eth0 ansible.builtin.iptables: @@ -26,9 +26,9 @@ sysctl_set: yes value: "1" -# We need to fill some values for the sonic-exporter (uses the STATE_DB) -- name: Mock sonic platform for kvm - ansible.builtin.import_tasks: mock-platform.yaml +# # We need to fill some values for the sonic-exporter (uses the STATE_DB) +# - name: Mock sonic platform for kvm +# ansible.builtin.import_tasks: mock-platform.yaml # ntp restarting for monitoring -> otherwise some NodeTimeOutOfSync error - name: restart chrony From f524136caa04c31e9372bd3dcb18de6b0c4b4217 Mon Sep 17 00:00:00 2001 From: Benjamin Ritter Date: Tue, 26 May 2026 07:42:58 +0200 Subject: [PATCH 03/13] feat: wire up SONiC DHCP relay Signed-off-by: Benjamin Ritter From a8574f7ce6a12144b3be66e43ca2dc18e6ca7a36 Mon Sep 17 00:00:00 2001 From: Benjamin Ritter Date: Thu, 28 May 2026 11:24:24 +0200 Subject: [PATCH 04/13] feat: use sonic-vpp master branch build includes https://github.com/sonic-net/sonic-platform-vpp/pull/212 and https://github.com/sonic-net/sonic-platform-vpp/pull/220 for troubleshooting reasons Signed-off-by: Benjamin Ritter --- images/sonic/Dockerfile | 4 ++-- images/sonic/{base-202511-vpp => base-vpp}/Dockerfile | 5 +++-- 2 files changed, 5 insertions(+), 4 deletions(-) rename images/sonic/{base-202511-vpp => base-vpp}/Dockerfile (81%) diff --git a/images/sonic/Dockerfile b/images/sonic/Dockerfile index 44ad5a43..09b4ebc0 100644 --- a/images/sonic/Dockerfile +++ b/images/sonic/Dockerfile @@ -14,8 +14,8 @@ RUN apt-get update && \ qemu-system-x86 \ telnet -COPY --from=ghcr.io/metal-stack/mini-lab-sonic-base:202511-vpp /sonic-vs.img /sonic-vs.img -COPY --from=ghcr.io/metal-stack/mini-lab-sonic-base:202511-vpp /frr-pythontools.deb /frr-pythontools.deb +COPY --from=ghcr.io/metal-stack/mini-lab-sonic-base:master-vpp /sonic-vs.img /sonic-vs.img +COPY --from=ghcr.io/metal-stack/mini-lab-sonic-base:master-vpp /frr-pythontools.deb /frr-pythontools.deb ENTRYPOINT ["/launch.py"] diff --git a/images/sonic/base-202511-vpp/Dockerfile b/images/sonic/base-vpp/Dockerfile similarity index 81% rename from images/sonic/base-202511-vpp/Dockerfile rename to images/sonic/base-vpp/Dockerfile index 32daf97e..277cda85 100644 --- a/images/sonic/base-202511-vpp/Dockerfile +++ b/images/sonic/base-vpp/Dockerfile @@ -1,7 +1,8 @@ # Check: https://sonic-build.azurewebsites.net/ui/sonic/pipelines -ARG SONIC_BASE_URL=https://sonic-build.azurewebsites.net/api/sonic/artifacts?branchName=202511&definitionId=2818&artifactName=sonic-buildimage.vpp +ARG SONIC_BRANCH=master +ARG SONIC_BASE_URL=https://sonic-build.azurewebsites.net/api/sonic/artifacts?branchName=${SONIC_BRANCH}&definitionId=2818&artifactName=sonic-buildimage.vpp ARG SONIC_IMG_URL=${SONIC_BASE_URL}&target=target%2Fsonic-vpp.img.gz -ARG FRR_RELOAD_URL=${SONIC_BASE_URL}&target=target%2Fdebs%2Fbookworm%2Ffrr-pythontools_10.4.1-sonic-0_all.deb +ARG FRR_RELOAD_URL=${SONIC_BASE_URL}&target=target%2Fdebs%2Fbookworm%2Ffrr-pythontools_10.5.4-sonic-0_all.deb FROM docker.io/library/busybox:stable AS download From 0df9bce17a83c176793fc98c749471160a468768 Mon Sep 17 00:00:00 2001 From: Benjamin Ritter Date: Thu, 28 May 2026 13:09:39 +0200 Subject: [PATCH 05/13] feat: clean up sonic launch.py Removed hacks, that just about worked in sonic-vs but broke in sonic-vpp - sonic-vpp requires first time init to generate VPP config files from hwsku lanemap and port config. If skipped the syncd container, in which vpp runs, will crash immediately - /etc/sonic/sonic-environment is generated on first boot from /usr/share/sonic/device/x86_64-kvm_x86_64-r0/default_sku, so writing it serves no purpose as we reenabled firstboot - switch to telnetlib3, due to telnetlib being deprecated Signed-off-by: Benjamin Ritter --- images/sonic/Dockerfile | 4 +++ images/sonic/launch.py | 64 +++++++---------------------------- images/sonic/requirements.txt | 1 + 3 files changed, 17 insertions(+), 52 deletions(-) create mode 100644 images/sonic/requirements.txt diff --git a/images/sonic/Dockerfile b/images/sonic/Dockerfile index 09b4ebc0..c4339242 100644 --- a/images/sonic/Dockerfile +++ b/images/sonic/Dockerfile @@ -9,11 +9,15 @@ RUN apt-get update && \ iproute2 \ linux-image-cloud-amd64 \ python3 \ + python3-pip \ python3-guestfs \ python3-scapy \ qemu-system-x86 \ telnet +COPY requirements.txt / +RUN pip install --break-system-packages -r requirements.txt + COPY --from=ghcr.io/metal-stack/mini-lab-sonic-base:master-vpp /sonic-vs.img /sonic-vs.img COPY --from=ghcr.io/metal-stack/mini-lab-sonic-base:master-vpp /frr-pythontools.deb /frr-pythontools.deb diff --git a/images/sonic/launch.py b/images/sonic/launch.py index 9682214b..0f704634 100755 --- a/images/sonic/launch.py +++ b/images/sonic/launch.py @@ -10,7 +10,7 @@ import struct import subprocess import sys -import telnetlib +import telnetlib3 import time from typing import Callable @@ -99,72 +99,35 @@ def wait(self) -> None: def initial_configuration(g: GuestFS, hwsku: str) -> None: image = g.glob_expand('/disk/image-*')[0] - - # g.rm(image + 'platform/firsttime') - - systemd_system = image + 'rw/etc/systemd/system/' - sonic_target_wants = systemd_system + 'sonic.target.wants/' - g.mkdir_p(sonic_target_wants) - # Copy frr-pythontools into the image + g.mkdir_p(image + 'rw/') g.copy_in(localpath='/frr-pythontools.deb', remotedir=image + 'rw/') - # Workaround: Speed up lldp startup by remove hardcoded wait of 90 seconds - # g.ln_s(linkname=systemd_system + 'aaastatsd.timer', target='/dev/null') # Radius - # g.ln_s(linkname=systemd_system + 'featured.timer', target='/dev/null') # Feature handling not necessary - # g.ln_s(linkname=systemd_system + 'hostcfgd.timer', target='/dev/null') # After boot Host configuration - # g.ln_s(linkname=systemd_system + 'rasdaemon.timer', target='/dev/null') # After boot Host configuration - # g.ln_s(linkname=systemd_system + 'tacacs-config.timer', target='/dev/null') # After boot Host configuration - # Started by featured - # g.ln_s(linkname=sonic_target_wants + 'lldp.service', target='/lib/systemd/system/lldp.service') - # g.ln_s(linkname=systemd_system + 'pmon.service', target='/lib/systemd/system/pmon.service') - # g.ln_s(linkname=sonic_target_wants + 'pmon.service', target='/lib/systemd/system/pmon.service') - - # Workaround: Only useful for BackEndToRRouter - # g.ln_s(linkname=systemd_system + 'backend-acl.service', target='/dev/null') - - # Workaround: We don't need LACP - # g.ln_s(linkname=systemd_system + 'teamd.service', target='/dev/null') - # Workaround: Python module sonic_platform not present on vs images + systemd_system = image + 'rw/etc/systemd/system/' + g.mkdir_p(systemd_system) g.ln_s(linkname=systemd_system + 'system-health.service', target='/dev/null') g.ln_s(linkname=systemd_system + 'watchdog-control.service', target='/dev/null') sonic_share = image + 'rw/usr/share/sonic/' platform_dir = image + 'rw' + VS_DEVICES_PATH - hwsku_dir_rw = image + 'rw' + VS_DEVICES_PATH + hwsku g.mkdir_p(platform_dir) g.write(path=platform_dir + '/default_sku', content=f'{hwsku} empty'.encode('utf-8')) # The lanemap.ini file is used by the virtual switch image to assign front panels to the Linux interfaces ethX. # This assignment will later also be used by the script mirror_tap_to_front_panel.sh. - # g.download(remotefilename=hwsku_dir + '/port_config.ini', filename='/port_config.ini') - # g.download(remotefilename=hwsku_dir + '/lanemap.ini', filename='/lanemap.ini') + # Dynamic breakouts are not implemented in sonic-vs/sonic-vpp ifaces = get_ethernet_interfaces() - # The port_config.ini file contains the assignment of front panels to lanes. port_config = parse_port_config() - # The lanemap.ini file is used by the virtual switch image to assign front panels to the Linux interfaces ethX. - # This assignment will later also be used by the script mirror_tap_to_front_panel.sh. lanemap = create_lanemap(port_config, ifaces) with open('/lanemap.ini', 'w') as f: f.write('\n'.join(lanemap)) + hwsku_dir_rw = image + 'rw' + VS_DEVICES_PATH + hwsku g.mkdir_p(hwsku_dir_rw) g.copy_in(localpath='/lanemap.ini', remotedir=hwsku_dir_rw) g.copy_in(localpath='/port_config.ini', remotedir=hwsku_dir_rw) - etc_sonic = image + 'rw/etc/sonic/' - g.mkdir_p(etc_sonic) - # sonic_version = image.removeprefix('/image-').removesuffix('/') - # sonic_environment = f''' - # SONIC_VERSION=${sonic_version} - # PLATFORM=x86_64-kvm_x86_64-r0 - # HWSKU={hwsku} - # DEVICE_TYPE=LeafRouter - # ASIC_TYPE=vpp - # '''.encode('utf-8') - # g.write(path=etc_sonic + 'sonic-environment', content=sonic_environment) - config_db = create_config_db(hwsku) ports = {} for iface in ifaces: @@ -176,7 +139,7 @@ def initial_configuration(g: GuestFS, hwsku: str) -> None: config_db['PORT'] = ports config_db_json = json.dumps(config_db, indent=4, sort_keys=True) - g.write(path=image + 'rw/golden_config_db.json', content=config_db_json.encode('utf-8')) + g.write(path=image + 'rw/init_config_db.json', content=config_db_json.encode('utf-8')) if os.path.exists('/authorized_keys'): g.mkdir_p(image + 'rw/root/.ssh') @@ -215,7 +178,7 @@ def main(): logger.info('Start QEMU') vm.start() - apply_golden_config_via_serial(logger) + apply_init_config_via_serial(logger) # Readiness: wait until SONiC forwards its own LLDP out a *front-panel* port, not just # mgmt eth0. LLDP egress on a front-panel port requires PortConfigDone AND the port to @@ -239,11 +202,11 @@ def handle_exit(signal, frame): sys.exit(0) -def apply_golden_config_via_serial(logger) -> None: +def apply_init_config_via_serial(logger) -> None: logger.info('Connecting to SONiC serial console on 127.0.0.1:5000') while True: try: - tn = telnetlib.Telnet('127.0.0.1', 5000, timeout=600) + tn = telnetlib3.Telnet('127.0.0.1', 5000, timeout=600) break except ConnectionRefusedError: time.sleep(1) @@ -280,13 +243,10 @@ def read_until(marker: bytes, timeout: int) -> str: break time.sleep(5) - logger.info('Installing golden config_db.json') - send(b'sudo config reload -f -y /golden_config_db.json \n') + logger.info('Installing intial config_db.json') + send(b'sudo config reload -f -y /init_config_db.json \n') read_until(b'$ ', timeout=60) - #logger.info('Rebooting SONiC to apply golden config') - #send(b'sudo reboot\n') - tn.close() diff --git a/images/sonic/requirements.txt b/images/sonic/requirements.txt new file mode 100644 index 00000000..4973e51b --- /dev/null +++ b/images/sonic/requirements.txt @@ -0,0 +1 @@ +telnetlib3~=4.0.4 \ No newline at end of file From 7d7b6969b72bf81958dd78903e96c8cd311432ec Mon Sep 17 00:00:00 2001 From: Benjamin Ritter Date: Fri, 29 May 2026 15:30:54 +0200 Subject: [PATCH 06/13] fix: add more documentation Signed-off-by: Benjamin Ritter --- images/sonic/README.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/images/sonic/README.md b/images/sonic/README.md index bdec0df1..ecc5d770 100644 --- a/images/sonic/README.md +++ b/images/sonic/README.md @@ -5,4 +5,8 @@ We use sonic-vpp to emulate SONiC switches. It is running in kvm inside a contai # Configuration knobs -You can edit the port_config.ini to add more ports. Keep the number as low as possible. It will put less strain on your system because it will spawn fewer VPP worker threads. You will have to set up the switch from scratch afterwards, since VPP will generate some configuration on first startup. \ No newline at end of file +You can edit the port_config.ini to add more ports. + + +# Boot process +The switch will boot with a default first-boot configuration. This is required since first boot will generate some required configuration for VPP. After a short while the configuration that is generated in launch.py is injected and the sonic is reloaded. After the new configuration is loaded the container will be marked ready. Check the docker logs for errors if bootup takes more than a minute. \ No newline at end of file From 17fd94511df922c8cf6bf7049e5deefacd29580a Mon Sep 17 00:00:00 2001 From: Benjamin Ritter Date: Sun, 19 Jul 2026 16:15:36 +0200 Subject: [PATCH 07/13] feat: implement internet egress via exit node --- files/exit/frr.conf | 5 +++++ files/exit/network.sh | 16 ++++++++++++++++ mini-lab.sonic.yaml | 1 - 3 files changed, 21 insertions(+), 1 deletion(-) diff --git a/files/exit/frr.conf b/files/exit/frr.conf index 5a94dc6b..bf16e1dd 100644 --- a/files/exit/frr.conf +++ b/files/exit/frr.conf @@ -35,6 +35,11 @@ router bgp 4200000021 ! address-family ipv4 unicast redistribute connected route-map LOOPBACKS + ! PXE egress: hand the leaves a default so machine traffic routes over the fabric to us, and we + ! NAT it out eth0 (mgmt). NB this default is also installed into each leaf's KERNEL, which + ! redirects the leaf's OWN egress (pixiecore -> github/DNS) through us sourced from its loopback + ! -- that only works because network.sh MASQUERADEs everything leaving eth0. Don't drop that NAT. + neighbor FABRIC default-originate exit-address-family ! address-family ipv6 unicast diff --git a/files/exit/network.sh b/files/exit/network.sh index 6ad64477..ca5800db 100644 --- a/files/exit/network.sh +++ b/files/exit/network.sh @@ -27,3 +27,19 @@ bridge vlan add vid 1000 untagged pvid dev vniInternet ip link set up dev vniInternet sysctl -w net.ipv6.conf.all.forwarding=1 + +# PXE egress return-path NAT. Traffic reaching us over the fabric keeps its original source -- +# machines are 10.0.1.0/24, and the leaves' own traffic is sourced from their 10.0.0.0/24 +# loopbacks. The mgmt docker bridge only NATs 172.42.0.0/16, so anything we forward out eth0 must +# be SNAT'd or the replies have no path back. Masquerade the whole interface rather than a single +# prefix, so both the machine and leaf-originated ranges are covered. +# The frr image ships no iptables; bounded + non-fatal on purpose, since this script runs under +# `set -o errexit` and must never block exit bring-up if the package mirror is unreachable. +for _ in 1 2 3 4 5; do + if apk add --no-cache iptables; then + iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE + break + fi + echo "apk could not reach the mirror (iptables); retrying ..." + sleep 2 +done || true diff --git a/mini-lab.sonic.yaml b/mini-lab.sonic.yaml index c29fd11a..44d7e8fd 100644 --- a/mini-lab.sonic.yaml +++ b/mini-lab.sonic.yaml @@ -10,7 +10,6 @@ topology: nodes: exit: image: quay.io/frrouting/frr:10.3.0 - network-mode: none binds: - files/exit/daemons:/etc/frr/daemons - files/exit/frr.conf:/etc/frr/frr.conf From 80755a3b68c417b92609bf964ede32626a8e9b4a Mon Sep 17 00:00:00 2001 From: Benjamin Ritter Date: Sun, 19 Jul 2026 16:15:44 +0200 Subject: [PATCH 08/13] fix: add workaround for isc not binding to Vlan4000 Signed-off-by: Benjamin Ritter --- deploy_partition.yaml | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/deploy_partition.yaml b/deploy_partition.yaml index 295355e8..5ae172d7 100644 --- a/deploy_partition.yaml +++ b/deploy_partition.yaml @@ -199,6 +199,35 @@ - name: Wait until no route entries have "queued" include_tasks: tasks/check_queued.yaml +- name: Work around isc-dhcp/Vlan4000 startup race (Community SONiC) + hosts: leaves:!dell_sonic + any_errors_fatal: true + gather_facts: false + tasks: + # dhcpd binds Vlan4000 at boot, before the SVI has carrier. Its LPF receive socket then dies + # ("receive_packet failed on Vlan4000: Network is down") while dhcpd stays up holding + # 0.0.0.0:67 -- so it answers nothing and PXE clients loop DISCOVER forever, never getting a + # lease. Restarting it once the underlay is up rebinds the socket, hence the placement after + # the underlay wait above. + # + # The probe solicits a real broadcast DISCOVER rather than poking 10.0.1.1:67, because the UDP + # socket stays healthy even when the LPF path is dead -- a unicast check would report a false + # pass. Restart and probe are deliberately one task: a retry must re-do the restart, not just + # re-probe, and `until` only retries a single task. + - name: Restart isc-dhcp-server until it serves an offer on Vlan4000 + ansible.builtin.shell: | + systemctl restart isc-dhcp-server + sleep 2 + dhcp-server-detector Vlan4000 --exit-on-first-offer --duration 10 + args: + executable: /bin/bash + when: dhcp_subnets is defined + register: dhcp_offer_check + until: dhcp_offer_check.rc == 0 + retries: 10 + delay: 5 + changed_when: true + - name: Configure IPv6 and LLDP ports (Enterprise SONiC) hosts: dell_sonic any_errors_fatal: true From 659d067b695237d299020409cb98a28adeadb2ed Mon Sep 17 00:00:00 2001 From: Benjamin Ritter Date: Sun, 19 Jul 2026 16:17:25 +0200 Subject: [PATCH 09/13] fix: fix zebra handing over invalid next-hop groups to fpmsyncd Signed-off-by: Benjamin Ritter --- files/sonic_frr_with_fpm.tpl | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/files/sonic_frr_with_fpm.tpl b/files/sonic_frr_with_fpm.tpl index 7019b34d..cab4f8a6 100644 --- a/files/sonic_frr_with_fpm.tpl +++ b/files/sonic_frr_with_fpm.tpl @@ -3,6 +3,12 @@ frr defaults datacenter # This is the only line changed from upstream: https://github.com/metal-stack/metal-core/blob/master/cmd/internal/switcher/templates/tpl/sonic_frr.tpl # Follow-up issue: https://github.com/metal-stack/metal-core/issues/199 fpm address 127.0.0.1 +# SONiC default (upstream ships this in its zebra config; the metal-core template dropped it). +# With next-hop-groups enabled (FRR's default under FPM), zebra hands fpmsyncd an NHG id instead +# of inline nexthops, and the EVPN encap attrs (vni_label/router_mac, carried as RTA_ENCAP) are +# lost -> ROUTE_TABLE loses vni_label/router_mac -> RouteOrch builds a plain IP nexthop instead of +# TUNNEL_ENCAP. +no fpm use-next-hop-groups hostname {{ .Name }} password zebra enable password zebra From 430e80341059d02806f22d0d1d1aa86f80784899 Mon Sep 17 00:00:00 2001 From: Benjamin Ritter Date: Mon, 27 Jul 2026 09:47:24 +0200 Subject: [PATCH 10/13] fix: improve reliability of front panel port mapping Signed-off-by: Benjamin Ritter --- images/sonic/mirror_tap_to_front_panel.sh | 32 +++++++++++++---------- 1 file changed, 18 insertions(+), 14 deletions(-) diff --git a/images/sonic/mirror_tap_to_front_panel.sh b/images/sonic/mirror_tap_to_front_panel.sh index 4f8c6aa9..4b4a2f02 100755 --- a/images/sonic/mirror_tap_to_front_panel.sh +++ b/images/sonic/mirror_tap_to_front_panel.sh @@ -4,23 +4,27 @@ # Read it for better understanding TAP_IF=$1 -# get interface index number up to 3 digits (everything after first three chars) -# tap0 -> 0 -# tap123 -> 123 +# tap0 -> 0 ... tap123 -> 123 ; tap$INDEX is guest interface eth$INDEX INDEX=${TAP_IF:3:3} -# tap$INDEX corresponds to eth$INDEX in the virtual machine -# The virtual switch assigns lanes to the Linux interface ethX. The assignment is specified in the lanemap.ini file in the following format: ethX:. -LANES=$(grep ^eth$INDEX: /lanemap.ini | cut -d':' -f2) -# Identify the front panel using the lanes. -FRONT_PANEL=$(grep -E "^Ethernet[0-9]+\s+$LANES\s+Eth" /port_config.ini | cut -d' ' -f1) +# sonic-vpp assigns guest NICs to front panels strictly by their order in +# port_config.ini: guest eth$INDEX is the $INDEX-th front panel. Mirror this tap +# to the clab link (named after that front panel) using the SAME order. This is +# independent of how interface names happen to sort (Ethernet4 vs Ethernet12/16, +# breakout sub-ports, ...), which is what the lanemap-based lookup got wrong. +FRONT_PANEL=$(awk '$1 ~ /^Ethernet/ {print $1}' /port_config.ini | sed -n "${INDEX}p") -ip link set $TAP_IF up -ip link set $TAP_IF mtu 65000 +if [ -z "$FRONT_PANEL" ]; then + echo "mirror_tap_to_front_panel: no port_config.ini entry #${INDEX} for ${TAP_IF}" >&2 + exit 1 +fi + +ip link set "$TAP_IF" up +ip link set "$TAP_IF" mtu 65000 # create tc Ethernet<->tap redirect rules -tc qdisc add dev $FRONT_PANEL ingress -tc filter add dev $FRONT_PANEL parent ffff: protocol all u32 match u8 0 0 action mirred egress redirect dev $TAP_IF +tc qdisc add dev "$FRONT_PANEL" ingress +tc filter add dev "$FRONT_PANEL" parent ffff: protocol all u32 match u8 0 0 action mirred egress redirect dev "$TAP_IF" -tc qdisc add dev $TAP_IF ingress -tc filter add dev $TAP_IF parent ffff: protocol all u32 match u8 0 0 action mirred egress redirect dev $FRONT_PANEL +tc qdisc add dev "$TAP_IF" ingress +tc filter add dev "$TAP_IF" parent ffff: protocol all u32 match u8 0 0 action mirred egress redirect dev "$FRONT_PANEL" From 5973e7981341d8751036be3498c22da9a38f6450 Mon Sep 17 00:00:00 2001 From: Benjamin Ritter Date: Mon, 27 Jul 2026 12:21:33 +0200 Subject: [PATCH 11/13] feat: split `sonic` flavor into `sonic_vs` and `sonic_vpp` - Split pipelines to build sonic_vs and sonic_vpp images - Rename sonic flavor to sonic_vs - Add sonic-vpp as sonic_vpp flavor - Run integration tests for sonic_vpp Signed-off-by: Benjamin Ritter --- .github/workflows/integration.yaml | 58 +++++++++++++++++++--- Makefile | 14 ++++-- README.md | 9 ++-- images/sonic/Dockerfile.vpp | 30 +++++++++++ images/sonic/{Dockerfile => Dockerfile.vs} | 4 +- images/sonic/base-vpp/Dockerfile | 10 +++- images/sonic/port_config.ini | 5 +- 7 files changed, 110 insertions(+), 20 deletions(-) create mode 100644 images/sonic/Dockerfile.vpp rename images/sonic/{Dockerfile => Dockerfile.vs} (80%) diff --git a/.github/workflows/integration.yaml b/.github/workflows/integration.yaml index 448a52da..45fae115 100644 --- a/.github/workflows/integration.yaml +++ b/.github/workflows/integration.yaml @@ -53,8 +53,8 @@ jobs: cache-from: type=registry,ref=${{ env.MINI_LAB_VM_IMAGE }} cache-to: type=inline - build-mini-lab-sonic-image: - name: Build mini-lab-sonic image + build-mini-lab-sonic-vs-image: + name: Build mini-lab-sonic-vs image runs-on: ubuntu-latest steps: @@ -73,8 +73,8 @@ jobs: IMAGE_TAG=$([ "${GITHUB_EVENT_NAME}" == 'pull_request' ] && echo ${GITHUB_HEAD_REF##*/} || echo "latest") SHA_TAG=${COMMIT_SHA::8} - echo "MINI_LAB_SONIC_IMAGE=ghcr.io/metal-stack/mini-lab-sonic:${IMAGE_TAG}" >> $GITHUB_ENV - echo "MINI_LAB_SONIC_IMAGE_SHA=ghcr.io/metal-stack/mini-lab-sonic:${SHA_TAG}" >> $GITHUB_ENV + echo "MINI_LAB_SONIC_IMAGE=ghcr.io/metal-stack/mini-lab-sonic-vs:${IMAGE_TAG}" >> $GITHUB_ENV + echo "MINI_LAB_SONIC_IMAGE_SHA=ghcr.io/metal-stack/mini-lab-sonic-vs:${SHA_TAG}" >> $GITHUB_ENV env: COMMIT_SHA: ${{ github.event.pull_request.head.sha || github.sha }} @@ -88,24 +88,68 @@ jobs: pull: true push: true sbom: true + file: images/sonic/Dockerfile.vs tags: | ${{ env.MINI_LAB_SONIC_IMAGE }} ${{ env.MINI_LAB_SONIC_IMAGE_SHA }} cache-from: type=registry,ref=${{ env.MINI_LAB_SONIC_IMAGE }} cache-to: type=inline + build-mini-lab-sonic-vpp-image: + name: Build mini-lab-sonic-vpp image + runs-on: ubuntu-latest + + steps: + - name: Log in to the container registry + uses: docker/login-action@v3 + with: + registry: ${{ env.REGISTRY }} + username: ${{ secrets.DOCKER_REGISTRY_USER }} + password: ${{ secrets.DOCKER_REGISTRY_TOKEN }} + + - name: Checkout + uses: actions/checkout@v4 + + - name: Make tag + run: | + IMAGE_TAG=$([ "${GITHUB_EVENT_NAME}" == 'pull_request' ] && echo ${GITHUB_HEAD_REF##*/} || echo "latest") + SHA_TAG=${COMMIT_SHA::8} + + echo "MINI_LAB_SONIC_IMAGE=ghcr.io/metal-stack/mini-lab-sonic-vpp:${IMAGE_TAG}" >> $GITHUB_ENV + echo "MINI_LAB_SONIC_IMAGE_SHA=ghcr.io/metal-stack/mini-lab-sonic-vpp:${SHA_TAG}" >> $GITHUB_ENV + env: + COMMIT_SHA: ${{ github.event.pull_request.head.sha || github.sha }} + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Build and push mini-lab-sonic container + uses: docker/build-push-action@v6 + with: + context: ./images/sonic + pull: true + push: true + sbom: true + file: images/sonic/Dockerfile.vpp + tags: | + ${{ env.MINI_LAB_SONIC_IMAGE }} + ${{ env.MINI_LAB_SONIC_IMAGE_SHA }} + cache-from: type=registry,ref=${{ env.MINI_LAB_SONIC_IMAGE }} + cache-to: type=inline test: name: Run tests runs-on: self-hosted needs: - build-mini-lab-vms-image - - build-mini-lab-sonic-image + - build-mini-lab-sonic-vs-image + - build-mini-lab-sonic-vpp-image continue-on-error: true strategy: matrix: flavors: - - name: sonic + - name: sonic_vs + - name: sonic_vpp - name: gardener - name: dell_sonic @@ -140,7 +184,7 @@ jobs: IMAGE_TAG=$([ "${GITHUB_EVENT_NAME}" == 'pull_request' ] && echo ${GITHUB_HEAD_REF##*/} || echo "latest") echo "MINI_LAB_VM_IMAGE=ghcr.io/metal-stack/mini-lab-vms:${IMAGE_TAG}" >> $GITHUB_ENV - echo "MINI_LAB_SONIC_IMAGE=ghcr.io/metal-stack/mini-lab-sonic:${IMAGE_TAG}" >> $GITHUB_ENV + echo "MINI_LAB_SONIC_IMAGE_TAG=${IMAGE_TAG}" >> $GITHUB_ENV - name: Run integration tests shell: bash diff --git a/Makefile b/Makefile index 68409109..005b2c08 100644 --- a/Makefile +++ b/Makefile @@ -26,10 +26,10 @@ ANSIBLE_EXTRA_VARS_FILE := $(or $(ANSIBLE_EXTRA_VARS_FILE),) # do not show skipped ansible tasks ANSIBLE_DISPLAY_SKIPPED_HOSTS=false -MINI_LAB_FLAVOR := $(or $(MINI_LAB_FLAVOR),sonic) +MINI_LAB_FLAVOR := $(or $(MINI_LAB_FLAVOR),sonic_vs) MINI_LAB_VM_IMAGE := $(or $(MINI_LAB_VM_IMAGE),ghcr.io/metal-stack/mini-lab-vms:latest) -MINI_LAB_SONIC_IMAGE := $(or $(MINI_LAB_SONIC_IMAGE),ghcr.io/metal-stack/mini-lab-sonic:202511-vpp) MINI_LAB_DELL_SONIC_VERSION := $(or $(MINI_LAB_DELL_SONIC_VERSION),4.5.1) +MINI_LAB_SONIC_IMAGE_TAG := $(or $(MINI_LAB_SONIC_IMAGE_TAG),latest) MINI_LAB_INTERNAL_NETWORK=mini_lab_internal # define this here as well so that kind picks up the network on a clean checkout, @@ -40,9 +40,14 @@ MACHINE_OS=debian-13.0 MAX_RETRIES := 30 # Machine flavors -ifeq ($(MINI_LAB_FLAVOR),sonic) +ifeq ($(MINI_LAB_FLAVOR),sonic_vs) LAB_TOPOLOGY=mini-lab.sonic.yaml MONITORING_ENABLED := $(or $(MONITORING_ENABLED),true) +MINI_LAB_SONIC_IMAGE := $(or $(MINI_LAB_SONIC_IMAGE),ghcr.io/metal-stack/mini-lab-sonic-vs:$(MINI_LAB_SONIC_IMAGE_TAG)) +else ifeq ($(MINI_LAB_FLAVOR),sonic_vpp) +LAB_TOPOLOGY=mini-lab.sonic.yaml +MONITORING_ENABLED := $(or $(MONITORING_ENABLED),true) +MINI_LAB_SONIC_IMAGE := $(or $(MINI_LAB_SONIC_IMAGE),ghcr.io/metal-stack/mini-lab-sonic-vpp:$(MINI_LAB_SONIC_IMAGE_TAG)) else ifeq ($(MINI_LAB_FLAVOR),dell_sonic) LAB_TOPOLOGY=mini-lab.dell_sonic.yaml MINI_LAB_SONIC_IMAGE=r.metal-stack.io/vrnetlab/dell_sonic:$(MINI_LAB_DELL_SONIC_VERSION) @@ -52,11 +57,13 @@ MINI_LAB_SONIC_IMAGE=r.metal-stack.io/vrnetlab/dell_sonic:$(MINI_LAB_DELL_SONIC_ else ifeq ($(MINI_LAB_FLAVOR),kamaji) LAB_TOPOLOGY=mini-lab.kamaji.yaml KAMAJI_ENABLED=true +MINI_LAB_SONIC_IMAGE := $(or $(MINI_LAB_SONIC_IMAGE),ghcr.io/metal-stack/mini-lab-sonic-vs:$(MINI_LAB_SONIC_IMAGE_TAG)) else ifeq ($(MINI_LAB_FLAVOR),gardener) GARDENER_ENABLED=true # usually gardener restricts the maximum version for k8s: K8S_VERSION=1.35.5 LAB_TOPOLOGY=mini-lab.sonic.yaml +MINI_LAB_SONIC_IMAGE := $(or $(MINI_LAB_SONIC_IMAGE),ghcr.io/metal-stack/mini-lab-sonic-vs:$(MINI_LAB_SONIC_IMAGE_TAG)) else $(error Unknown flavor $(MINI_LAB_FLAVOR)) endif @@ -429,7 +436,6 @@ build-sonic-base: docker build -t ghcr.io/metal-stack/mini-lab-sonic-base:202311 images/sonic/base-202311 docker build -t ghcr.io/metal-stack/mini-lab-sonic-base:202411 images/sonic/base-202411 docker build -t ghcr.io/metal-stack/mini-lab-sonic-base:202505 images/sonic/base-202505 - docker build -t ghcr.io/metal-stack/mini-lab-sonic-base:202511-vpp images/sonic/base-202511-vpp ## DEV TARGETS ## diff --git a/README.md b/README.md index c376a0db..3d273f3f 100644 --- a/README.md +++ b/README.md @@ -238,16 +238,17 @@ make up All available mini-lab flavors are listed below: -- `sonic`: runs two Community SONiC switches +- `sonic_vs`: runs two Community SONiC switches with the kernel based virtual switch dataplane +- `sonic_vpp`: runs two Community SONiC switches with the [VPP](https://fd.io) dataplane - `dell_sonic`: runs two Enterprise SONiC switches with a [locally built vrnetlab image](https://github.com/srl-labs/vrnetlab/tree/master/dell/dell_sonic) - `capms_dell_sonic`: runs the `dell_sonic` flavor but with four instead of two machines (this is used for [cluster-provider-metal-stack](https://github.com/metal-stack/cluster-api-provider-metal-stack) in order to have dedicated hosts for control plane / worker / firewall) -- `kamaji`: runs a variation of the `sonic` flavor. The working example is available at the [cluster-provider-metal-stack](https://github.com/metal-stack/cluster-api-provider-metal-stack)'s `capi-lab`. -- `gardener`: runs the `sonic` flavor and installs the [Gardener](https://gardener.cloud) in the mini-lab +- `kamaji`: runs a variation of the `sonic_vs` flavor. The working example is available at the [cluster-provider-metal-stack](https://github.com/metal-stack/cluster-api-provider-metal-stack)'s `capi-lab`. +- `gardener`: runs the `sonic_vs` flavor and installs the [Gardener](https://gardener.cloud) in the mini-lab In order to start specific flavor, you can define the flavor as follows: ```bash -export MINI_LAB_FLAVOR=sonic +export MINI_LAB_FLAVOR=sonic_vs make ``` diff --git a/images/sonic/Dockerfile.vpp b/images/sonic/Dockerfile.vpp new file mode 100644 index 00000000..b0659514 --- /dev/null +++ b/images/sonic/Dockerfile.vpp @@ -0,0 +1,30 @@ +FROM docker.io/library/debian:bookworm-backports + +ENV LIBGUESTFS_BACKEND=direct + +RUN apt-get update && \ + apt-get --no-install-recommends install --yes \ + curl \ + libpcap0.8 \ + iproute2 \ + linux-image-cloud-amd64 \ + python3 \ + python3-pip \ + python3-guestfs \ + python3-scapy \ + qemu-system-x86 \ + telnet + +COPY requirements.txt / +RUN pip install --break-system-packages -r requirements.txt + +COPY --from=docker.io/l0wl3vel/mini-lab-sonic-base:vpp-integration /sonic-vs.img /sonic-vs.img +COPY --from=docker.io/l0wl3vel/mini-lab-sonic-base:vpp-integration /frr-pythontools.deb /frr-pythontools.deb + +ENTRYPOINT ["/launch.py"] + +COPY mirror_tap_to_eth.sh mirror_tap_to_front_panel.sh port_config.ini launch.py / + +# Readiness now waits for the dataplane (front-panel LLDP), which converges later than the +# mgmt plane, so allow more time before the container is considered unhealthy. +HEALTHCHECK --start-period=30s --interval=5s --retries=40 CMD test -f /healthy diff --git a/images/sonic/Dockerfile b/images/sonic/Dockerfile.vs similarity index 80% rename from images/sonic/Dockerfile rename to images/sonic/Dockerfile.vs index c4339242..0831bc40 100644 --- a/images/sonic/Dockerfile +++ b/images/sonic/Dockerfile.vs @@ -18,8 +18,8 @@ RUN apt-get update && \ COPY requirements.txt / RUN pip install --break-system-packages -r requirements.txt -COPY --from=ghcr.io/metal-stack/mini-lab-sonic-base:master-vpp /sonic-vs.img /sonic-vs.img -COPY --from=ghcr.io/metal-stack/mini-lab-sonic-base:master-vpp /frr-pythontools.deb /frr-pythontools.deb +COPY --from=ghcr.io/metal-stack/mini-lab-sonic-base:202505 /sonic-vs.img /sonic-vs.img +COPY --from=ghcr.io/metal-stack/mini-lab-sonic-base:202505 /frr-pythontools.deb /frr-pythontools.deb ENTRYPOINT ["/launch.py"] diff --git a/images/sonic/base-vpp/Dockerfile b/images/sonic/base-vpp/Dockerfile index 277cda85..fd0de804 100644 --- a/images/sonic/base-vpp/Dockerfile +++ b/images/sonic/base-vpp/Dockerfile @@ -9,8 +9,14 @@ FROM docker.io/library/busybox:stable AS download ARG SONIC_IMG_URL ARG FRR_RELOAD_URL -ADD "${SONIC_IMG_URL}" /sonic-vs.img.gz -ADD "${FRR_RELOAD_URL}" /frr-pythontools.deb +# TODO: There is no pipeline for +# https://github.com/l0wl3vel/sonic-buildimage/tree/vpp-integration. Build it. Place the +# sonic-vpp.img.gz and frr-pythontools_10.5.4-sonic-0_all.deb artifacts here. +# If you need sonic-vpp source code changes yell at @l0wl3vel to push a fresh image: +# docker build -t docker.io/l0wl3vel/mini-lab-sonic-base:vpp-integration images/sonic/base-vpp +# docker push docker.io/l0wl3vel/mini-lab-sonic-base:vpp-integration +ADD ./sonic-vpp.img.gz /sonic-vs.img.gz +ADD ./frr-pythontools_10.5.4-sonic-0_all.deb /frr-pythontools.deb RUN gunzip /sonic-vs.img.gz diff --git a/images/sonic/port_config.ini b/images/sonic/port_config.ini index 2dfa3d87..0aeca974 100644 --- a/images/sonic/port_config.ini +++ b/images/sonic/port_config.ini @@ -1,4 +1,7 @@ +# sonic-vpp uses a simple script to generate vpp interfaces from the port_config.init on first boot +# No breakouts are supported and it always expects Ethernet$(4*n) as port names +# Just continue the pattern if you want vpp to not crash # name lanes alias index speed Ethernet0 1,2,3,4 Eth1 1 100000 Ethernet4 5,6,7,8 Eth2 2 100000 -Ethernet8 121,122,123,124 Eth3 3 100000 \ No newline at end of file +Ethernet8 9,10,11,12 Eth3 3 100000 \ No newline at end of file From 325cf0039c6852ecf0b15334ad09e387a9d2217e Mon Sep 17 00:00:00 2001 From: Benjamin Ritter Date: Mon, 27 Jul 2026 16:13:19 +0200 Subject: [PATCH 12/13] feat: add memory balloon Signed-off-by: Benjamin Ritter --- images/sonic/launch.py | 1 + 1 file changed, 1 insertion(+) diff --git a/images/sonic/launch.py b/images/sonic/launch.py index 0f704634..bf849dda 100755 --- a/images/sonic/launch.py +++ b/images/sonic/launch.py @@ -73,6 +73,7 @@ def start(self) -> None: '-m', self._memory, '-drive', f'if=virtio,format=qcow2,file={self._disk}', '-serial', 'telnet:127.0.0.1:5000,server,nowait', + '-device', 'virtio-balloon', ] with open(f'/sys/class/net/eth0/address', 'r') as f: From 538d04e10083b72030a68eb5eb42f7a959c86cde Mon Sep 17 00:00:00 2001 From: Benjamin Ritter Date: Tue, 28 Jul 2026 12:22:31 +0200 Subject: [PATCH 13/13] fix: remove conditional restart of isc-dhcp-server due to missing binary fixes sonic_vs with older (202505) image Signed-off-by: Benjamin Ritter --- deploy_partition.yaml | 33 +++++++-------------------------- 1 file changed, 7 insertions(+), 26 deletions(-) diff --git a/deploy_partition.yaml b/deploy_partition.yaml index 5ae172d7..0b3eab76 100644 --- a/deploy_partition.yaml +++ b/deploy_partition.yaml @@ -198,35 +198,16 @@ pre_tasks: - name: Wait until no route entries have "queued" include_tasks: tasks/check_queued.yaml - -- name: Work around isc-dhcp/Vlan4000 startup race (Community SONiC) + +- name: "Hack: Work around isc-dhcp/Vlan4000 startup race (Community SONiC)" hosts: leaves:!dell_sonic - any_errors_fatal: true gather_facts: false tasks: - # dhcpd binds Vlan4000 at boot, before the SVI has carrier. Its LPF receive socket then dies - # ("receive_packet failed on Vlan4000: Network is down") while dhcpd stays up holding - # 0.0.0.0:67 -- so it answers nothing and PXE clients loop DISCOVER forever, never getting a - # lease. Restarting it once the underlay is up rebinds the socket, hence the placement after - # the underlay wait above. - # - # The probe solicits a real broadcast DISCOVER rather than poking 10.0.1.1:67, because the UDP - # socket stays healthy even when the LPF path is dead -- a unicast check would report a false - # pass. Restart and probe are deliberately one task: a retry must re-do the restart, not just - # re-probe, and `until` only retries a single task. - - name: Restart isc-dhcp-server until it serves an offer on Vlan4000 - ansible.builtin.shell: | - systemctl restart isc-dhcp-server - sleep 2 - dhcp-server-detector Vlan4000 --exit-on-first-offer --duration 10 - args: - executable: /bin/bash - when: dhcp_subnets is defined - register: dhcp_offer_check - until: dhcp_offer_check.rc == 0 - retries: 10 - delay: 5 - changed_when: true + - name: Restart isc-dhcp-server + ansible.builtin.service: + name: isc-dhcp-server + state: restarted + when: true - name: Configure IPv6 and LLDP ports (Enterprise SONiC) hosts: dell_sonic