From 846259f2580cc621a870223e3d390e8c1377e8e5 Mon Sep 17 00:00:00 2001
From: Mat Kowalski <mko@redhat.com>
Date: Thu, 30 Jul 2026 23:12:28 +0200
Subject: [PATCH] Add BGP_VIP_MANAGEMENT one-click knob

When set, render platform.baremetal.bgpVIPConfig into the generated
install-config so the cluster advertises its API/ingress VIPs over BGP
(enhancement 1982, DevPreview) instead of managing them with keepalived.
The local/peer ASNs and the peer address default to the ENABLE_BGP_TOR
speaker's configuration (BGP_CLUSTER_ASN/BGP_TOR_ASN, ToR address on the
external subnet), overridable via BGP_VIP_PEER_ADDRESS.

Deploy validation fails fast when the knob is set without ENABLE_BGP_TOR
(nothing to peer with) or without a FEATURE_SET that enables the
BGPBasedVIPManagement gate.

Assisted-By: Claude Fable 5
Signed-off-by: Mat Kowalski <mko@redhat.com>
---
 config_example.sh  | 15 +++++++++++++++
 ocp_install_env.sh | 15 +++++++++++++++
 validation.sh      | 19 +++++++++++++++++++
 3 files changed, 49 insertions(+)

diff --git a/config_example.sh b/config_example.sh
index f99617c35..101ea96d6 100755
--- a/config_example.sh
+++ b/config_example.sh
@@ -238,6 +238,21 @@ set -x
 #export BGP_TOR_ASN=64513
 #export BGP_CLUSTER_ASN=64512
 #
+
+# BGP_VIP_MANAGEMENT -
+# Render platform.baremetal.bgpVIPConfig into the install-config so the
+# cluster advertises its API/ingress VIPs over BGP instead of managing them
+# with keepalived (enhancement 1982, DevPreview). Requires ENABLE_BGP_TOR
+# (the peer the cluster speaks to) and a FEATURE_SET that enables the
+# BGPBasedVIPManagement gate (DevPreviewNoUpgrade). The local ASN defaults
+# to BGP_CLUSTER_ASN, the peer ASN to BGP_TOR_ASN, and the peer address to
+# the ToR address on the external subnet; override the peer address with
+# BGP_VIP_PEER_ADDRESS if your topology differs.
+# Default is unset.
+#
+#export BGP_VIP_MANAGEMENT=true
+#export BGP_VIP_PEER_ADDRESS=
+#
 # FRR container image:
 #export BGP_TOR_IMAGE=quay.io/frrouting/frr:9.1.0
 
diff --git a/ocp_install_env.sh b/ocp_install_env.sh
index f81a8f090..09d96075a 100644
--- a/ocp_install_env.sh
+++ b/ocp_install_env.sh
@@ -198,6 +198,20 @@ EOF
     fi
 }
 
+function bgp_vip_config() {
+    if [[ "${BGP_VIP_MANAGEMENT:-false}" == "true" ]]; then
+        local peer_address
+        peer_address="${BGP_VIP_PEER_ADDRESS:-$(nth_ip "${EXTERNAL_SUBNET_V4}" 1)}"
+cat <<EOF
+    bgpVIPConfig:
+      localASN: ${BGP_CLUSTER_ASN:-64512}
+      peers:
+      - peerAddress: ${peer_address}
+        peerASN: ${BGP_TOR_ASN:-64513}
+EOF
+    fi
+}
+
 function featureSet() {
     if [[ -n "${FEATURE_SET:-}" ]]; then
 cat <<EOF
@@ -445,6 +459,7 @@ $(setVIPs apivips)
 $(setVIPs ingressvips)
 $(dnsvip)
 $(loadbalancer_type)
+$(bgp_vip_config)
     hosts:
 EOF
 
diff --git a/validation.sh b/validation.sh
index 9acf02e83..ef75316dd 100644
--- a/validation.sh
+++ b/validation.sh
@@ -54,6 +54,7 @@ function early_deploy_validation() {
     CHECK_OC_TOOL_PRESENCE=${1:-"false"}
 
     early_either_validation
+    early_bgp_vip_validation
 
     if [ ! -s "${PERSONAL_PULL_SECRET}" ] && [ "${OPENSHIFT_RELEASE_TYPE}" != "okd" ]; then
         error "${PERSONAL_PULL_SECRET} is missing or empty"
@@ -93,6 +94,24 @@ function early_deploy_validation() {
     fi
 }
 
+function early_bgp_vip_validation() {
+    if [[ "${BGP_VIP_MANAGEMENT:-false}" != "true" ]]; then
+        return 0
+    fi
+    if [[ "${ENABLE_BGP_TOR:-false}" != "true" ]]; then
+        error "BGP_VIP_MANAGEMENT needs a BGP peer for the cluster to talk to; set ENABLE_BGP_TOR=true"
+        exit 1
+    fi
+    case "${FEATURE_SET:-}" in
+        DevPreviewNoUpgrade|CustomNoUpgrade)
+            ;;
+        *)
+            error "BGP_VIP_MANAGEMENT requires the BGPBasedVIPManagement feature gate; set FEATURE_SET=DevPreviewNoUpgrade (or CustomNoUpgrade with the gate enabled)"
+            exit 1
+            ;;
+    esac
+}
+
 # Perform validation steps that we only want done when trying to clean
 # up.
 function early_cleanup_validation() {