ovn-agent needs access to /run/frr to get access to vtysh socket

.github/workflows/molecule.yaml

@@ -33,7 +33,6 @@ jobs:
         - edpm_network_config
         - edpm_neutron_dhcp
         - edpm_neutron_metadata
-        - edpm_neutron_ovn
         - edpm_neutron_sriov
         - edpm_nftables
         - edpm_nodes_validation

roles/edpm_neutron_ovn/defaults/main.yml

@@ -24,6 +24,7 @@ edpm_neutron_ovn_common_volumes:
   - "{{ edpm_neutron_ovn_agent_lib_dir }}:/var/lib/neutron:shared,z"
   - "{{ edpm_neutron_ovn_agent_lib_dir }}/ovn_agent_haproxy_wrapper:/usr/local/bin/haproxy:ro"
   - "{{ edpm_neutron_ovn_agent_lib_dir }}/kill_scripts:/etc/neutron/kill_scripts:ro"
+  - /run/frr:/run/frr:shared,z
 
 # Sidecar containers settings
 edpm_neutron_ovn_agent_sidecar_debug: false
@@ -70,3 +71,12 @@ edpm_neutron_ovn_agent_bgp_peer_bridges: ''
 # BGP interconnect bridge for the ovn-bgp extension.
 # Set this variable when the ovn-agent is configured with the ovn-bgp extension.
 edpm_neutron_ovn_agent_bgp_interconnect_bridge: "{{ neutron_physical_bridge_name | default('br-ex') }}"
+
+# ovn-evpn extension options. Set edpm_neutron_ovn_agent_agent_extensions to include
+# 'ovn-evpn' to load the extension and render the [ovn_evpn] section.
+edpm_neutron_ovn_agent_ovn_evpn_bgp_as: ''
+edpm_neutron_ovn_agent_ovn_evpn_bgp_local_interface: ''
+edpm_neutron_ovn_agent_ovn_evpn_child_vxlan_port: '49152'
+edpm_neutron_ovn_agent_frr_vty_socket: '/run/frr'
+edpm_neutron_ovn_evpn_local_ip: ''
+edpm_neutron_ovn_evpn_vxlan_port: 4789

roles/edpm_neutron_ovn/meta/argument_specs.yml

@@ -85,6 +85,7 @@ argument_specs:
           - /run/openvswitch:/run/openvswitch:z
           - '{{ edpm_neutron_ovn_agent_config_dir }}:/etc/neutron.conf.d:z'
           - /var/lib/kolla/config_files/ovn_agent.json:/var/lib/kolla/config_files/config.json:ro
+          - /run/frr:/run/frr:shared,z
         description: Volume mounts for Neutron OVN agent
         type: list
       edpm_neutron_ovn_tls_enabled:
@@ -117,3 +118,42 @@ argument_specs:
           Defaults to neutron_physical_bridge_name (br-ex if unset).
           Set this variable when the ovn-agent is configured with the ovn-bgp extension.
         type: str
+      edpm_neutron_ovn_agent_ovn_evpn_bgp_as:
+        default: ''
+        description: >
+          'BGP Autonomous System number for EVPN.
+          Used when edpm_neutron_ovn_agent_agent_extensions includes 'ovn-evpn'.
+        type: str
+      edpm_neutron_ovn_agent_ovn_evpn_bgp_local_interface:
+        default: ''
+        description: >
+          The local interface name (e.g. eth2) on which to establish BGP peer session.
+          Used when edpm_neutron_ovn_agent_agent_extensions includes 'ovn-evpn'.
+        type: str
+      edpm_neutron_ovn_agent_ovn_evpn_child_vxlan_port:
+        default: '49152'
+        description: >
+          UDP port for the child VxLAN device used by EVPN.
+          Used when edpm_neutron_ovn_agent_agent_extensions includes 'ovn-evpn'.
+          This port is only used between the vxlan device and the vtep and not for any encapsulation.
+        type: str
+      edpm_neutron_ovn_agent_frr_vty_socket:
+        default: '/run/frr'
+        description: >
+          Path to the vtysh socket directory. Passed as --vty_socket to the vtysh command.
+          Used when edpm_neutron_ovn_agent_agent_extensions includes 'ovn-evpn'.
+        type: str
+      edpm_neutron_ovn_evpn_local_ip:
+        default: ''
+        description: >
+          IP address written to OVS external-ids:ovn-evpn-local-ip, used as the source
+          for EVPN traffic egressing through the VXLAN tunnel.
+          When empty, defaults to the BGP IPv4 source network IP on the host.
+        type: str
+      edpm_neutron_ovn_evpn_vxlan_port:
+        default: 4789
+        description: >
+          UDP port written to OVS external-ids:ovn-evpn-vxlan-ports.
+          Used when edpm_neutron_ovn_agent_agent_extensions includes 'ovn-evpn'.
+          This port is used by vxlan tunnels used for encapsulation.
+        type: int

roles/edpm_neutron_ovn/molecule/bgp_custom_interconnect_bridge/verify.yml

@@ -2,6 +2,7 @@
 - name: Verify
   hosts: all
   gather_facts: false
+  become: true
   tasks:
     - name: Verify neutron-bgp-peer-bridges
       ansible.builtin.shell: >

roles/edpm_neutron_ovn/molecule/bgp_disabled/molecule.yml

@@ -4,26 +4,25 @@ dependency:
   options:
     role-file: collections.yml
 driver:
-  name: podman
+  name: delegated
+  options:
+    managed: false
+    ansible_connection_options:
+      ansible_connection: local
 platforms:
-- command: /sbin/init
-  dockerfile: ../../../../molecule/common/Containerfile.j2
-  image: ${EDPM_ANSIBLE_MOLECULE_IMAGE:-"ubi9/ubi-init"}
-  name: instance
-  privileged: true
-  registry:
-    url: ${EDPM_ANSIBLE_MOLECULE_REGISTRY:-"registry.access.redhat.com"}
-  ulimits:
-  - host
+  - name: compute-1
+    groups:
+      - compute
 provisioner:
   log: true
   name: ansible
+  playbooks:
+    cleanup: ../common/cleanup.yml
   inventory:
-    hosts:
-      all:
-        hosts:
-          instance:
-            canonical_hostname: edpm-0.localdomain
+    host_vars:
+      compute-1:
+        ctlplane_ip: "10.0.0.1"
+        canonical_hostname: edpm-0.localdomain
 scenario:
   test_sequence:
   - dependency
@@ -32,6 +31,7 @@ scenario:
   - prepare
   - converge
   - verify
+  - cleanup
   - destroy
 verifier:
   name: ansible

roles/edpm_neutron_ovn/molecule/bgp_disabled/verify.yml

@@ -2,6 +2,7 @@
 - name: Verify
   hosts: all
   gather_facts: false
+  become: true
   tasks:
     - name: Check neutron-bgp-peer-bridges is not set
       ansible.builtin.shell: >

roles/edpm_neutron_ovn/molecule/bgp_enabled/verify.yml

@@ -2,6 +2,7 @@
 - name: Verify
   hosts: all
   gather_facts: false
+  become: true
   tasks:
     - name: Verify neutron-bgp-peer-bridges
       ansible.builtin.shell: >

roles/edpm_neutron_ovn/molecule/common/cleanup.yml

@@ -0,0 +1,50 @@
+---
+# Copyright 2026 Red Hat, LLC.
+# All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+- name: Cleanup after edpm_neutron_ovn molecule scenario
+  hosts: all
+  gather_facts: false
+  become: true
+  tasks:
+    - name: Stop ovn_agent systemd service
+      ansible.builtin.systemd:
+        name: edpm_ovn_agent.service
+        state: stopped
+      failed_when: false
+
+    - name: Remove ovn_agent container
+      ansible.builtin.command:
+        cmd: /usr/bin/podman rm -f ovn_agent
+      register: _edpm_neutron_ovn_cleanup_ovn_agent
+      changed_when: _edpm_neutron_ovn_cleanup_ovn_agent.rc == 0
+      failed_when: false
+
+    - name: Remove neutron-haproxy sidecar containers
+      ansible.builtin.shell: |
+        set -o pipefail
+        /usr/bin/podman ps -a --filter name=neutron-haproxy- --format '{{ '{{' }}.ID{{ '}}' }}' |
+          xargs -r /usr/bin/podman rm -f
+      changed_when: false
+      failed_when: false
+
+    - name: Clear BGP and EVPN external IDs from Open_vSwitch
+      ansible.builtin.command:
+        cmd: >-
+          ovs-vsctl --if-exists remove Open_vSwitch . external_ids
+          neutron-bgp-peer-bridges
+          neutron-bgp-interconnect-bridge
+      changed_when: false
+      failed_when: false

roles/edpm_neutron_ovn/molecule/default/molecule.yml

@@ -4,26 +4,28 @@ dependency:
   options:
     role-file: collections.yml
 driver:
-  name: podman
+  name: delegated
+  options:
+    managed: false
+    ansible_connection_options:
+      ansible_connection: local
 platforms:
-- command: /sbin/init
-  dockerfile: ../../../../molecule/common/Containerfile.j2
-  image: ${EDPM_ANSIBLE_MOLECULE_IMAGE:-"ubi9/ubi-init"}
-  name: instance
-  privileged: true
-  registry:
-    url: ${EDPM_ANSIBLE_MOLECULE_REGISTRY:-"registry.access.redhat.com"}
-  ulimits:
-  - host
+  - name: compute-1
+    groups:
+      - compute
 provisioner:
   log: true
   name: ansible
+  playbooks:
+    cleanup: ../common/cleanup.yml
   inventory:
-    hosts:
-      all:
-        hosts:
-          instance:
-            canonical_hostname: edpm-0.localdomain
+    host_vars:
+      compute-1:
+        ctlplane_ip: "10.0.0.1"
+        canonical_hostname: edpm-0.localdomain
+        # Containers and config under /var/lib/ are managed as root via
+        # systemd; testinfra must escalate to inspect podman and host files.
+        ansible_become: true
 scenario:
   test_sequence:
   - dependency
@@ -32,6 +34,7 @@ scenario:
   - prepare
   - converge
   - verify
+  - cleanup
   - destroy
 verifier:
   name: testinfra

roles/edpm_neutron_ovn/molecule/default/prepare.yml

@@ -1,5 +1,5 @@
 ---
-# Copyright 2023 Red Hat, Inc.
+# Copyright 2026 Red Hat, LLC.
 # All Rights Reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License"); you may
@@ -24,19 +24,82 @@
         - openvswitch
         - iproute
         - podman
+
 - name: Prepare
   hosts: all
   gather_facts: false
+  vars:
+    edpm_download_cache_podman_auth_file: ""
   tasks:
     - ansible.builtin.include_role:
         name: osp.edpm.env_data
 
-    # The openvswitch kernel module needs to be loaded on the host
-    - name: install and modprobe openvswitch
-      shell: |
-        sudo dnf -y install openvswitch
-        sudo modprobe openvswitch
-      delegate_to: localhost
-      run_once: true
+    - name: Install and modprobe openvswitch
+      ansible.builtin.shell: |
+        set -eux
+        dnf -y install openvswitch
+        modprobe openvswitch
+      become: true
+      changed_when: true
+
+    - name: Force systemd to reread configs
+      ansible.builtin.systemd:
+        daemon_reload: true
+      become: true
+
+    - name: Download required role packages
+      ansible.builtin.import_role:
+        name: osp.edpm.edpm_bootstrap
+        tasks_from: download_cache.yml
+
+    - name: Include edpm_bootstrap
+      ansible.builtin.import_role:
+        name: osp.edpm.edpm_bootstrap
+        tasks_from: bootstrap.yml
+      become: true
+
+    - name: Download edpm_neutron_ovn container images
+      ansible.builtin.import_role:
+        name: osp.edpm.edpm_neutron_ovn
+        tasks_from: download_cache.yml
+      become: true
+
+    - name: Install os-net-config
+      ansible.builtin.package:
+        name: os-net-config
+        state: present
+      become: true
+
+    - name: Download edpm_frr container images
+      ansible.builtin.include_role:
+        name: osp.edpm.edpm_frr
+        tasks_from: download_cache.yml
+
+    - name: Create firewall directory
+      become: true
+      ansible.builtin.file:
+        path: /var/lib/edpm-config/firewall
+        state: directory
+        owner: root
+        group: root
+        mode: "0750"
+
+    - name: open port 22 (edpm_nftables will active this later)
+      become: true
+      ansible.builtin.copy:
+        dest: /var/lib/edpm-config/firewall/sshd-networks.yaml
+        content: |
+          - rule_name: 003 Allow SSH
+            rule:
+              proto: tcp
+              dport: 22
 
-  post_tasks: []
+    - name: Running FRR
+      vars:
+        edpm_frr_bgp_peers:
+          - 10.64.0.1
+          - 10.65.0.1
+      ansible.builtin.include_role:
+        name: osp.edpm.edpm_frr
+        apply:
+          become: true

roles/edpm_neutron_ovn/molecule/default/tests/test_neutron_ovn.py

@@ -64,7 +64,7 @@ class TestNeutronOvn(unittest.TestCase):
 
     def setUp(self):
         self.host = testinfra.get_host(
-            "ansible://instance?ansible_inventory=%s" %
+            "ansible://compute-1?ansible_inventory=%s" %
             os.environ['MOLECULE_INVENTORY_FILE'])
 
     def tearDown(self):

roles/edpm_neutron_ovn/molecule/evpn_disabled/collections.yml

@@ -0,0 +1,3 @@
+---
+collections:
+- name: community.general

roles/edpm_neutron_ovn/molecule/evpn_disabled/converge.yml

@@ -0,0 +1,28 @@
+---
+# Copyright 2026 Red Hat, LLC
+# All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+- name: Converge
+  hosts: all
+  gather_facts: false
+  become: true
+  tasks:
+    - ansible.builtin.include_role:
+        name: "osp.edpm.edpm_neutron_ovn"
+      vars:
+        tenant_ip: "{{ ansible_host }}"
+        edpm_ovn_dbs:
+          - "{{ ansible_host }}"
+        edpm_neutron_ovn_config_src: "{{lookup('env', 'MOLECULE_SCENARIO_DIRECTORY')}}/test-data"

roles/edpm_neutron_ovn/molecule/evpn_disabled/molecule.yml

@@ -0,0 +1 @@
+../evpn_enabled/molecule.yml