EVPN fabric, deployed by CI/CD

Two spines, four leaves, two borders and an ISP, running in containerlab on this server. Nobody configures a router by hand: a change is a pull request, GitHub proves it, and the deploy agent here rolls it out. This page shows what the network sees right now.

Loading the latest status

The fabric

  • Cable up
  • BGP down
  • Cable down
  • prod
  • storage
The routers, servers and cables of the fabric, colored by their current state

What runs now

Last game day

Every night at 03:30 UTC the failure tests run again on this lab: a spine is frozen, a spine loses every cable, a border goes down. Measured, not estimated.

Failover times from the last game day

Who reaches whom

Every 30 s each server pings every other server and the internet. A tenant is its own VRF: prod reaches prod and the internet, storage reaches only storage.

Routers

BGP sessions and BFD as each router reports them, against what the intent says it must have.

RouterASNLoopbackBGPBFDState

Deploys and repairs

What the deploy agent and the game day did, newest first.

Internet edge

The borders announce one summary per tenant with internet access, and accept only a default route. Storage never leaves the fabric.

Default route on each leaf

LeafTenantNext hops

How a change reaches this network

  1. Intent

    One YAML file describes the fabric: switches and their AS numbers, tenants, VLANs, servers and their ports, the ISP policy, BFD timers. Nothing else is written by hand.

  2. Render

    Python and Jinja turn the intent into an FRR config and a Linux script for every device. Both are committed, so a pull request shows the exact config lines it changes.

  3. Static proofs

    FRR parses every config. Batfish then models the whole network from the configs alone and proves the intent: every session, route targets, tenant isolation, only summaries to the ISP.

  4. Live lab on GitHub

    The fabric boots in containerlab on GitHub's machine. 58 tests check sessions, BFD, ECMP, EVPN, routing tables and every ping, then freeze a spine, cut cables and stop a border, timing the failover.

  5. Deploy agent

    This server pulls main once all three checks are green; GitHub holds no key to it. Configs go out with frr-reload one router at a time, canary first, each checked before the next. Any failure rolls back.

  6. Every minute, every night

    Every minute the agent compares each router with Git and undoes anything typed by hand. Every night the failure tests run again here, and the numbers above come from that run.

Built by Touseef Ahmed, www.touseefahmed.com. Source, configs and tests: github.com/ahmed-touseef/evpn-fabric-cicd