Add Arrcus ArcOS as a containerlab device (best-effort) #3681
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,54 @@ | ||
| # Installing Arrcus ArcOS | ||
|
Owner
There was a problem hiding this comment. This file should be in docs/labs. The "docs/install" directory is for netlab installation, the "docs/labs" directory is for providers and devices.
Owner
There was a problem hiding this comment. Also, add "(build-arcos)=" or "(labs-arcos)=" anchor so you don't have to hyperlink to a file name. |
||
|
|
||
| netlab runs **Arrcus ArcOS** as a [containerlab](clab.md)-provisioned device. ArcOS is a | ||
| **native** containerlab kind (`arrcus_arcos`) -- no vrnetlab packaging -- and only the **clab** | ||
| provider is supported (no Vagrant box). | ||
|
|
||
| ## Container image | ||
|
|
||
| ArcOS is a commercial NOS; there is no public image. Obtain an ArcOS container image and tag it as | ||
| the device expects (or point `clab.image` at your own tag): | ||
|
|
||
| ``` | ||
| defaults.devices.arcos.clab.image: arcos:8.2.1A.P2 | ||
| ``` | ||
|
|
||
| The device sets clab `kind: arrcus_arcos`. Verified against the **8.2.1A.P2** container image. | ||
|
|
||
| ## First-boot bootstrap | ||
|
|
||
| The tested image boots with SSH, NETCONF, and gNMI disabled, and ArcOS refuses to enable | ||
| interfaces until the factory-default admin-user password is changed. netlab handles both | ||
| automatically with the native `netlab_start_exec` group variable (containerlab's post-start | ||
| `exec:`): it enables `ssh-server`, sets the admin-user password, and creates an AAA user before any | ||
| configuration is deployed. No manual steps are required. | ||
|
|
||
| ## Configuration deployment | ||
|
|
||
| ArcOS uses netlab's native containerlab **"sh" config mode** | ||
| ([Linux configuration scripts](../dev/config/deploy.md)): each configuration module is rendered into | ||
| `/config/netlab/NN-<module>.sh` with a `#!/config/netlab/netlab-config.sh` shebang and deployed with | ||
| `docker exec`, which hands the rendered config to the mapped wrapper | ||
| `netsim/templates/provider/clab/arcos/netlab-config.j2` to load through `confd_cli` | ||
| (`load merge` / `commit`). No Ansible is used to deploy configuration -- this is the same | ||
| mapped-script pattern Juniper cRPD uses. `ansible_connection: docker` is retained only for the | ||
| validation/collect path. | ||
|
|
||
| ArcOS also ships the official `arrcus.arcos` `network_cli` collection (the project-recommended | ||
| interactive model), but every published version hangs against this image; see the | ||
| [ArcOS caveats](caveats-arcos). No extra Ansible collection is required. | ||
|
|
||
| ## Supported configuration modules | ||
|
|
||
| `initial`, `ospf` (v2/v3), `bgp`, `isis`, `vrf` (+ospf/isis/bgp), `vlan`, `lag`, `gateway` (VRRP), | ||
| `dhcp`/relay, `bfd`, `routing` (static/prefix-set/policy), `mpls` (LDP), `sr` (SR-MPLS via IS-IS), | ||
| `srv6`, `vxlan`, and `evpn` (L2VNI). See `netsim/devices/arcos.yml` `features:` for the | ||
| authoritative list; support level is **best-effort** (see [caveats](caveats-arcos)). | ||
|
|
||
| ## Validation | ||
|
|
||
| `netlab validate` reads ArcOS device state over the same docker-exec path used to deploy config | ||
| (`show <path> | display json | confd_cli`, parsed as OpenConfig JSON by | ||
| `netsim/validate/**/arcos.py`) -- netlab's standard device-side show-command validation, with no | ||
| SSH/NETCONF/gNMI and no `ansible` validation action. ArcOS is exercised with netlab's regular | ||
| [integration tests](../dev/integration-tests.md). | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,7 +1,16 @@ | ||
| --- | ||
| # Fetch the ArcOS running-config over ansible_connection: docker. The tested container build has | ||
| # SSH/NETCONF/gNMI disabled, so confd_cli over docker exec is the only reachable CLI (config | ||
| # DEPLOY uses netlab's native sh-mode wrapper -- see netsim/devices/arcos.yml; this collect path | ||
| # stays on the docker connection, the same pattern netsim/devices/frr.yml + cRPD keep). | ||
| - name: "confd_cli: show running-config" | ||
| # confd_cli has no "-c <command>" one-shot flag (-c is --cwd, not "run this command"), so the | ||
| # command is fed non-interactively over stdin instead. | ||
| shell: printf 'show running-config\n' | confd_cli -C -u admin | ||
| args: | ||
| executable: /bin/bash | ||
| register: arcos_run_config | ||
| changed_when: false | ||
|
|
||
| - set_fact: | ||
| ansible_net_config: "{{ arcos_run_config.stdout }}" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| {# | ||
| ArcOS BFD template. Global `bfd profile <NAME>` with enable + timers; protocols reference the | ||
| profile (OSPF area-interface `bfd enabled true` is rendered by the ospf template). The GLOBAL | ||
| profile is the implicit default and "must have been explicitly configured" -- so we always | ||
| create it. | ||
| #} | ||
| bfd profile GLOBAL | ||
| enable | ||
| required-minimum-receive {{ bfd.min_rx|default(500) }} | ||
| desired-minimum-tx-interval {{ bfd.min_tx|default(500) }} | ||
| detection-multiplier {{ bfd.multiplier|default(3) }} | ||
| exit | ||
| ! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,61 @@ | ||
| {# | ||
| ArcOS BGP. eBGP session reaches ESTABLISHED; allow ~60-90s to converge (ArcOS's connect-retry | ||
| timer). Dual-stack peers get TWO separate BGP sessions (one keyed on the IPv4 transport | ||
| address, one on IPv6) rather than one session carrying both AFs. | ||
|
|
||
| iBGP-over-loopback: without an explicit `neighbor X transport local-address <loopback>`, an | ||
| iBGP session addressed at the peer's loopback stays IDLE forever -- ArcOS does not auto-source | ||
| from the interface with the best route to the peer. | ||
|
|
||
| The bgp.session plugin (per-neighbor password/gtsm/timers/passive/bfd) is a separate template | ||
| and is not yet supported. | ||
| #} | ||
| network-instance default protocol BGP b1 | ||
| global as {{ bgp.as }} | ||
| global router-id {{ bgp.router_id }} | ||
| global afi-safi IPV4_UNICAST | ||
|
Owner
There was a problem hiding this comment. You might want to use "if bgp.ipv4 is defined" as well. |
||
| {% if bgp.ipv6|default(false) %} | ||
|
Owner
There was a problem hiding this comment. Nit: Nothing wrong with this, but it would be easier to use "if bgp.ipv6 is defined". It is never set to False. |
||
| global afi-safi IPV6_UNICAST | ||
| {% endif %} | ||
| {% for a in bgp.advertise|default([]) %} | ||
| {% if a.ipv4 is defined %} | ||
| global afi-safi IPV4_UNICAST network {{ a.ipv4 }} | ||
| {% endif %} | ||
| {% if a.ipv6 is defined %} | ||
| global afi-safi IPV6_UNICAST network {{ a.ipv6 }} | ||
| {% endif %} | ||
| {% endfor %} | ||
| {% for n in bgp.neighbors|default([]) %} | ||
| {% if n.ipv4 is defined %} | ||
|
Owner
There was a problem hiding this comment. Hint: Instead of repeating the same code snippet (which can lead to nasty problems once you start adding functionality), you could just add an inner loop iterating of "ipv4","ipv6" and have a local dictionary (or even device group variable) to map AF into afi-safi instance name (or use something like |
||
| neighbor {{ n.ipv4 }} peer-as {{ n.as }} | ||
| {% if n.local_as is defined %} | ||
| neighbor {{ n.ipv4 }} ebgp-local-as local-as {{ n.local_as }} | ||
| {% endif %} | ||
| {% if n.type|default("") == "ibgp" and n._source_intf is defined and n._source_intf.ipv4 is defined %} | ||
|
Owner
There was a problem hiding this comment. Nits: A) _source_intf is defined only when needed (IBGP or multihop EBGP), so there's no need to check BGP neighbor type. |
||
| neighbor {{ n.ipv4 }} transport local-address {{ n._source_intf.ipv4 | ansible.utils.ipaddr('address') }} | ||
| {% endif %} | ||
| neighbor {{ n.ipv4 }} afi-safi IPV4_UNICAST | ||
| {% endif %} | ||
| {% if n.ipv6 is defined %} | ||
| neighbor {{ n.ipv6 }} peer-as {{ n.as }} | ||
| {% if n.local_as is defined %} | ||
| neighbor {{ n.ipv6 }} ebgp-local-as local-as {{ n.local_as }} | ||
| {% endif %} | ||
| {% if n.type|default("") == "ibgp" and n._source_intf is defined and n._source_intf.ipv6 is defined %} | ||
| neighbor {{ n.ipv6 }} transport local-address {{ n._source_intf.ipv6 | ansible.utils.ipaddr('address') }} | ||
| {% endif %} | ||
| neighbor {{ n.ipv6 }} afi-safi IPV6_UNICAST | ||
| {% endif %} | ||
| {% endfor %} | ||
|
|
||
| {# Redistribution into BGP via OpenConfig table-connections (bgp.import): | ||
| STATIC->BGP with src-dst-instance <static-inst> <bgp-inst> + import-policy. Static protocol | ||
| instance is "default" (routing template), BGP instance is "b1". connected/ospf/isis import | ||
| are not exercised here -> feature declares import: [ static ] only. #} | ||
| {% for proto, imp in bgp.import|default({})|dictsort %} | ||
| {% if proto == 'static' %} | ||
| network-instance default table-connection STATIC BGP IPV4 src-dst-instance default b1{% if imp is mapping and imp.policy is defined %} import-policy [ {{ imp.policy }}-ipv4 ]{% else %} default-import-policy ACCEPT_ROUTE{% endif %} | ||
|
|
||
| ! | ||
| {% endif %} | ||
| {% endfor %} | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I would just point to the labs/arcos.md document instead of repeating the points already made there.