Components · Networking

OVN-BGP-Agent

Announces over BGP the VM and floating IPs reachable through the node.

Go FRR and OVNopenkeel-ovn-bgp-agent

The module

OpenKeel's Go implementation of OpenStack ovn-bgp-agent (stable/2026.2, f770768b41dc), written from the reverse-spec reverse-spec-ovn-bgp-agent/.

The agent runs on every node whose FRR peers with the BGP fabric. It watches the OVN Northbound database (read-only) and, for every IP reachable through this node, it does two things:

it wires the kernel and OVS so that traffic reaches OVN: ip rule and route in a per-bridge routing table, permanent neighbour, NDP proxy, and the MAC-tweak flow (cookie 999);
it announces the IP by adding it to the dummy bgp-nic in VRF bgp-vrf, which the local FRR redistributes.

The IPs it covers are provider-network VM IPs, floating IPs (distributed and centralized, switched at run time by NB_Global external_ids:neutron:fip-distributed), router gateways, tenant subnets (host or subnet advertisement, SNAT filter, address scopes, GUA-only), OVN load-balancer VIPs and VIP-FIPs, and port-forwarding FIPs.


Module	`github.com/openkeel/openkeel-ovn-bgp-agent`
Executable	`ovn-bgp-agent` (`cmd/ovn-bgp-agent`)
Driver / exposing method	`nb_ovn_bgp_driver` / `underlay` (the others are refused at start: `docs/CONFORMANCE.md`)
API	none; `:9750` serves `/healthz`, `/readyz`, `/metrics`
State	none (derived from OVN and the node); `/etc/iproute2/rt_tables` keeps the table numbers
Delivery	DaemonSet, host network, `NET_ADMIN` `SYS_ADMIN` `DAC_OVERRIDE` (`docs/SECURITY.md`)

Excerpt from openkeel-ovn-bgp-agent/README.md (in English).

How compatibility is tested

The agent has no REST API, so compatibility is checked with event-match vectors and node side-effect scenarios recorded from the Python agent, and on a real kernel.

Unit and golden tests

Event-match vectors

The Northbound event filters match exactly the OVN row changes the Python agent reacts to.

How it runs

make test-vectors on cases-event-match_stable-2026.2.json, Python Mock semantics reproduced.

Latest result 122 / 122 in scope (SB and EVPN cases out of scope); 20 / 20 hand-written cases for filters without vectors.

Source: openkeel-ovn-bgp-agent/docs/CONFORMANCE.md

Scenario

Side-effect scenarios

Addresses, links, neighbours, routes, rules, flows and FRR text left on the node match the recorded Python final state.

How it runs

internal/reconcile/scenarios_test.go on side-effects_stable-2026.2.json, make test-vectors.

Latest result 10 / 10 in scope; 1 out of scope (SB EVPN). Three Python defects deliberately not reproduced.

Source: openkeel-ovn-bgp-agent/docs/CONFORMANCE.md

Unit and golden tests

Takeover of a Python-configured node

Ordering rules, leftovers and idempotence hold, and the agent takes over a node configured by the Python agent.

How it runs

internal/reconcile/reconcile_test.go.

Latest result Pass.

Source: openkeel-ovn-bgp-agent/docs/CONFORMANCE.md

Unit and golden tests

Real kernel wiring

Wiring, idempotence and withdrawal through rtnetlink on a real kernel (OVS and FRR faked).

How it runs

make test-linux in a disposable network namespace.

Latest result Pass.

Source: openkeel-ovn-bgp-agent/docs/CONFORMANCE.md

Left out of the rewrite

The BGP agent implements the Northbound driver with underlay exposure only, as one reconciling process, and refuses the Southbound, EVPN and stretched L2 modes.

Internal machinery simplified

Southbound, EVPN and stretched L2 drivers

Why it was left out

Scope of the rewrite: only nb_ovn_bgp_driver with underlay exposure, which OpenKeel's Neutron writes the keys for.

Why the solution is not affected

Provider IPs, floating IPs, router gateways, tenant subnets and load balancer VIPs are announced. EVPN (vrf) and stretched L2 are refused at start.

Source: openkeel-ovn-bgp-agent/docs/CONFORMANCE.md

Obsolete or unused upstream

l2vni and dynamic exposing methods

Why it was left out

The Python agent has no wiring for them either.

Why the solution is not affected

None in practice: they did not work upstream; they are now refused at start.

Source: openkeel-ovn-bgp-agent/docs/CONFORMANCE.md

Internal machinery simplified

privsep daemons and oslo.concurrency

Taken over by Kubernetes DaemonSet

Why it was left out

One process with the needed capabilities runs in a DaemonSet, and a single goroutine writes the node.

Why the solution is not affected

Same device names, routing tables, flows and FRR text, so a node configured by the Python agent can be taken over.

Source: openkeel-ovn-bgp-agent/docs/CONFORMANCE.md

Only what was left out by design is listed here; the work not done yet is in the Known gaps of the module's docs/CONFORMANCE.md. Every module

Specifications

Services

ovn-bgp-agent

Branch stable-2026.2 · 8 files

Read the reverse-spec

Also in Networking

Neutron

Networks, subnets, ports, routers and security groups written to the OVN Northbound database; IPv4 and IPv6.

GoOVN and Open vSwitch

Octavia (OVN)

The Octavia v2 API served by neutron-api; OVN load balancers, enabled by default.

GoOVN load balancers

Neutron-FWaaS

Firewall groups, policies and rules (FWaaS v2).

GoOVN ACLs

Neutron-VPNaaS

Site-to-site IPsec VPN: IKE, IPsec policies, connections.

GoIPsec agent