BGP cloud connector

Kubernetes operator for OpenShift that automates L3 direct routing between CUDN Pod networks and external networks via BGP. Replaces the manual in-cluster steps from the rosa-bgp PoC.

The operator is cloud platform aware. When platform configuration is provided (e.g. AWS), the operator auto-discovers cloud BGP infrastructure (Route Server endpoints, neighbor IPs, remote ASN, AZ mapping) and manages cloud-side networking resources (Route Server peers, SourceDestCheck) to keep BGP peering and traffic forwarding current for node changes.

┌──────────────────────────────────────────────────────────────────────┐
│  Cloud Infrastructure (Terraform provisions once)                    │
│  VPC / subnets / route server / TGW / etc.                           │
│  Terraform outputs: Route Server IDs, local BGP ASN, AWS region      │
└──────────────────────────────────┬───────────────────────────────────┘
                                   │ user copies terraform outputs into CR spec
                                   ▼
┌──────────────────────────────────────────────────────────────────────┐
│  In-Cluster (Operator)                                               │
│  BGPCloudConfiguration CR (singleton — BGP infra)                    │
│  └── enables FRR, discovers cloud endpoints, reconciles peering      │
│  BGPRouting CR (one per network)                                     │
│  └── ClusterUserDefinedNetwork + shared RouteAdvertisements          │
└──────────────────────────────────────────────────────────────────────┘

Documentation

Doc	What it covers
Architecture	The two-layer (cloud + in-cluster) model and the CRD ownership split.
Cloud platform integration	How the operator peers with a cloud BGP service, per-cloud actions, auto-discovery, and the AWS/Azure/GCP mapping.
AWS authentication	AWS credentials — the recommended CCO path and the IRSA alternative.
Azure authentication	Azure credentials — Workload Identity, and the ARO cross-resource-group identity.
GCP authentication	GCP credentials — Workload Identity Federation / Application Default Credentials.
Manual platform	platform: Manual — bring your own BGP router with explicit peer groups, no cloud integration.
Custom resources	BGPCloudConfiguration and BGPRouting reference, field tables, and operator-generated resources.
Controller reconciliation	Reconciliation phases, status conditions, watches, and drift recovery.
Development and deployment	Build, deploy, and test the operator; OLM bundle install; OLM packaging.
Test strategy	Test layers, make targets, and per-area test plans.
KubeVirt VM testing	UDN binding requirements for VMs and MTV migration testing.

Quick start

Requires an OCP 4.21+ cluster. See Development and deployment for the full flow (image build, registry setup, cleanup).

1. Deploy the operator (from a published image or a locally built one — see the deployment doc).

2. On a cloud platform, set up credentials — AWS, Azure, or GCP. (Skip for platform: Manual.)

3. Create the shared BGP configuration (BGPCloudConfiguration, singleton named cluster) — set spec.platform and the matching cloud block (spec.aws / spec.azure / spec.gcp), or platform: Manual with explicit spec.bgp.peerGroups:

   $EDITOR config/samples/networking_v1beta1_bgpcloudconfiguration.yaml
   oc apply -f config/samples/networking_v1beta1_bgpcloudconfiguration.yaml

4. Create a labeled namespace and a routing CR (BGPRouting, one per network):

   cat <<EOF | oc apply -f -
   apiVersion: v1
   kind: Namespace
   metadata:
     name: app1
     labels:
       k8s.ovn.org/primary-user-defined-network: ""
       cluster-udn: prod
   EOF
   oc apply -f config/samples/networking_v1beta1_bgprouting.yaml

5. Verify both CRs reach phase: Ready:

   oc get bgpcloudconfiguration cluster -o jsonpath='{.status.phase}'
   oc get bgprouting cudn1 -o jsonpath='{.status.phase}'

See Custom resources for the CR schema and the platform: Manual (no cloud integration) variant.