Re: [PATCH pve-network 08/13] evpn controller: add route_map_{in,out} parameter

[Hannes Laimer <h.laimer@proxmox.com>]

in `generate_zone_frr_config` we probably also want to use the newly
introduced `route-map-[in|out]` parameter, not the hard coded ones


On 2026-03-25 10:42, Stefan Hanreich wrote:
> This parameter allows overriding the default MAP_VTEP_{IN,OUT} route
> maps by specifying a custom route map configured in route-maps.cfg.
> This can be used for filtering incoming and outgoing routes, e.g. for
> only advertising type-5 routes to external peers or only allow
> importing routes with specific route targets.
> 
> Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
> ---
>  src/PVE/Network/SDN/Controllers/EvpnPlugin.pm | 19 +++++++++++++------
>  src/PVE/Network/SDN/Controllers/Plugin.pm     | 14 ++++++++++++++
>  2 files changed, 27 insertions(+), 6 deletions(-)
> 
> diff --git a/src/PVE/Network/SDN/Controllers/EvpnPlugin.pm b/src/PVE/Network/SDN/Controllers/EvpnPlugin.pm
> index 3e643b1..d7b838b 100644
> --- a/src/PVE/Network/SDN/Controllers/EvpnPlugin.pm
> +++ b/src/PVE/Network/SDN/Controllers/EvpnPlugin.pm
> @@ -45,6 +45,8 @@ sub options {
>          'asn' => { optional => 0 },
>          'peers' => { optional => 1 },
>          'fabric' => { optional => 1 },
> +        'route-map-in' => { optional => 1 },
> +        'route-map-out' => { optional => 1 },
>      };
>  }
>  
> @@ -153,23 +155,28 @@ sub generate_frr_config {
>  
>      push @{ $bgp_router->{neighbor_groups} }, $neighbor_group;
>  
> +    my $route_map_in = $plugin_config->{'route-map-in'} // 'MAP_VTEP_IN';
> +    my $route_map_out = $plugin_config->{'route-map-out'} // 'MAP_VTEP_OUT';
> +
>      # Configure l2vpn evpn address family
>      $bgp_router->{address_families}->{l2vpn_evpn} //= {
>          neighbors => [{
>              name => "VTEP",
> -            route_map_in => 'MAP_VTEP_IN',
> -            route_map_out => 'MAP_VTEP_OUT',
> +            route_map_in => $route_map_in,
> +            route_map_out => $route_map_out,
>          }],
>          advertise_all_vni => 1,
>      };
>  
>      $bgp_router->{address_families}->{l2vpn_evpn}->{autort_as} = $autortas if $autortas;
>  
> -    my $routemap_in = { seq => 1, action => "permit" };
> -    my $routemap_out = { seq => 1, action => "permit" };
> +    if ($route_map_in eq 'MAP_VTEP_IN' && !$config->{frr}->{routemaps}->{'MAP_VTEP_IN'}) {
> +        push($config->{frr}->{routemaps}->{'MAP_VTEP_IN'}->@*, { seq => 1, action => "permit" });
> +    }
>  
> -    push($config->{frr}->{routemaps}->{'MAP_VTEP_IN'}->@*, $routemap_in);
> -    push($config->{frr}->{routemaps}->{'MAP_VTEP_OUT'}->@*, $routemap_out);
> +    if ($route_map_out eq 'MAP_VTEP_OUT' && !$config->{frr}->{routemaps}->{'MAP_VTEP_OUT'}) {
> +        push($config->{frr}->{routemaps}->{'MAP_VTEP_OUT'}->@*, { seq => 1, action => "permit" });
> +    }
>  
>      return $config;
>  }
> diff --git a/src/PVE/Network/SDN/Controllers/Plugin.pm b/src/PVE/Network/SDN/Controllers/Plugin.pm
> index d70e518..5f9f1ef 100644
> --- a/src/PVE/Network/SDN/Controllers/Plugin.pm
> +++ b/src/PVE/Network/SDN/Controllers/Plugin.pm
> @@ -7,6 +7,8 @@ use PVE::Tools;
>  use PVE::JSONSchema;
>  use PVE::Cluster;
>  
> +use PVE::Network::SDN::RouteMaps;
> +
>  use PVE::JSONSchema qw(get_standard_option);
>  use base qw(PVE::SectionConfig);
>  
> @@ -51,6 +53,18 @@ my $defaultData = {
>              'pve-sdn-controller-id',
>              { completion => \&PVE::Network::SDN::complete_sdn_controller },
>          ),
> +        'route-map-in' => {
> +            description => "Route Map that should be applied for incoming routes",
> +            type => 'string',
> +            format => 'pve-sdn-route-map-id',
> +            optional => 1,
> +        },
> +        'route-map-out' => {
> +            description => "Route Map that should be applied for outgoing routes",
> +            type => 'string',
> +            format => 'pve-sdn-route-map-id',
> +            optional => 1,
> +        },
>      },
>  };
>