obmp-portability-test/terraform/cloud-init/bmpgen.cloud-init.yaml.tftpl

#cloud-config
# BMP-gen VM cloud-init: install docker, drop a gobgpd.conf that reports
# BMP to the store VM, run gobgp as a container. GoBGP keeps retrying
# the BMP session until the store's collector accepts it, so ordering
# between the two VMs' cloud-init is not required.

hostname: ${hostname}
manage_etc_hosts: true

users:
  - name: ${ssh_username}
    groups: [sudo, docker]
    shell: /bin/bash
    sudo: "ALL=(ALL) NOPASSWD:ALL"
    ssh_authorized_keys:
      - ${ssh_public_key}

package_update: true
package_upgrade: false

packages:
  - ca-certificates
  - curl
  - gnupg
  - lsb-release
  - qemu-guest-agent

write_files:
  # GoBGP config. Local AS is the test private ASN; BMP target is the
  # store VM's ROUTER_FACING_IP + ROUTER_FACING_PORT. We inject a small
  # synthetic route set so obmp's ip_rib has non-zero rows to assert on.
  - path: /etc/gobgp/gobgpd.conf
    owner: root:root
    permissions: '0644'
    content: |
      [global.config]
        as = ${local_asn}
        router-id = "10.99.99.99"
        # Non-privileged BGP listener port. Default 179 requires root+cap_net_bind_service
        # inside the container; Ubuntu 24.04 + docker denies this even with
        # --network host despite the default cap set including NET_BIND_SERVICE.
        # We're not accepting BGP peers here anyway -- only the BMP session out.
        port = 1179

      [[bmp-servers]]
        [bmp-servers.config]
          address = "${store_ip_addr}"
          port = ${router_facing_port}
          route-monitoring-policy = "pre-policy"

      # No BGP peers -- the assertion only requires that (a) BMP session
      # comes up and reports at least a router-init, and (b) the collector
      # sees a peer. Adding synthetic prefixes needs at least one BGP
      # peer or a manual `gobgp global rib add` after boot; the run-test
      # script handles the manual add so ip_rib gets rows.

  # Convenience: script that adds synthetic prefixes into gobgp's global
  # RIB after start. run-test.sh SSHes in and executes this.
  - path: /usr/local/bin/inject-synthetic-routes.sh
    owner: root:root
    permissions: '0755'
    content: |
      #!/bin/bash
      set -euo pipefail
      # Add a couple of synthetic prefixes; the docker exec targets the
      # gobgp container we started in runcmd.
      for i in 1 2 3 4 5; do
        docker exec obmp-gobgp gobgp global rib add "203.0.113.$((i * 8))/29" origin igp
      done
      echo "injected 5 synthetic prefixes"

runcmd:
  # --- 1. install docker-ce (same pattern as store VM) -------------------
  - install -m 0755 -d /etc/apt/keyrings
  - curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
  - chmod a+r /etc/apt/keyrings/docker.gpg
  - |
    echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" \
      > /etc/apt/sources.list.d/docker.list
  - apt-get update
  - apt-get install -y docker-ce docker-ce-cli containerd.io
  - systemctl enable --now docker qemu-guest-agent
  - usermod -aG docker ${ssh_username}

  # --- 2. start gobgp container ----------------------------------------
  - |
    docker run -d --restart unless-stopped --name obmp-gobgp \
      --network host \
      -v /etc/gobgp:/etc/gobgp:ro \
      jauderho/gobgp:v4.5.0 \
      gobgpd -f /etc/gobgp/gobgpd.conf

  # --- 3. mark done ------------------------------------------------------
  - |
    echo "gobgp_running=$(docker inspect -f {{.State.Running}} obmp-gobgp)"    > /var/lib/cloud/portability-test.done
    echo "bmp_target=${store_ip_addr}:${router_facing_port}"                  >> /var/lib/cloud/portability-test.done
    echo "finished_at=$(date -Is)"                                             >> /var/lib/cloud/portability-test.done

final_message: "obmp-bmpgen cloud-init done after $UPTIME seconds. gobgp running."