Frontier Platform Engineering Agent — OpenStack to SONiC
One OpenStack network on Netris and SONiC at once: the Platform Engineering Agent configures SONiC leaves through MCP, with traffic, isolation and drift checks.
The Frontier Platform Engineering Agent drives more than one fabric from the same OpenStack desired state. In this test, one agent running in-cluster configured Netris and SONiC at the same time. SONiC is an open-source network operating system hosted by the Linux Foundation. It has no fabric controller, so the SONiC MCP server acts as the controller: it applies each change on every leaf and reads the state back from each leaf.
Caveats
- Topology: two virtual SONiC leaves wired back to back, with no spine and no hardware switches.
- Traffic: ICMP and ARP only. Throughput, scale and convergence under load were not measured.
- Healing: drift is reported, and it was repaired by a manual reconcile. The deployed agent does not auto-heal.
- Not built on SONiC: IPv6 gateways, ACLs, NAT, LAG / MC-LAG / ESI multihoming and symmetric IRB (asymmetric IRB only).
- Port links came from Neutron port tags, not from Ironic.
- SONiC MCP server runs next to the switches, not yet in-cluster.
- CAPO: Kubernetes clusters built through Cluster API Provider OpenStack were not tested through this path.
How it works
%%{init: {'theme':'base','themeVariables':{'primaryColor':'#0c332d','primaryTextColor':'#e6edf3','primaryBorderColor':'#2dd4bf','lineColor':'#8b949e','secondaryColor':'#11203a','tertiaryColor':'#161b22','fontSize':'14px'}}}%%
graph TD
A["Neutron (VitroAI, ML2/OVN)"] --> B["OpenStack MCP server"]
B --> C["Listener and desired state"]
C --> D["Contract engine
plan/apply · scope guard · audit · drift detection"] D --> E["Netris adapter"] --> F["Netris MCP server"] --> G["Netris controller"] D --> H["SONiC adapter"] --> I["SONiC MCP server"] --> J["SONiC leaf 1 and leaf 2"]
plan/apply · scope guard · audit · drift detection"] D --> E["Netris adapter"] --> F["Netris MCP server"] --> G["Netris controller"] D --> H["SONiC adapter"] --> I["SONiC MCP server"] --> J["SONiC leaf 1 and leaf 2"]
The fabric contract on SONiC
| Contract operation | SONiC realization (on every leaf) |
|---|---|
| Ensure VRF | A VRF with a short, hashed name (VRF names are capped at 15 characters) |
| Ensure segment | A VLAN from a pool, a VLAN-to-VNI map for VXLAN, and an interface in the tenant VRF with the gateway IP and one anycast MAC shared by both leaves. EVPN advertises the segment |
| Attach port | The switch port joins the VLAN, untagged (access) or tagged |
| Delete segment | Detach ports, clear learned addresses, then remove the map, interface and VLAN |
| Delete VRF | Refused while any segment is still bound to it |
| Read state | An object counts as present only when it is complete on every leaf; gaps are reported per leaf |
Ownership. The SONiC MCP server records an ownership claim for every object before it creates it, and reads and deletes act only on claimed objects. Existing VLANs on the leaves were reported as unmanaged and never touched.
Test results
| Test | Result |
|---|---|
| One OpenStack network on both fabrics | Pass. A new network appeared as a Netris segment in about 3 s and on both SONiC leaves in about 5 s |
| Port attachment | Pass. Neutron ports carrying a fabric-port tag became access and tagged port memberships on SONiC. On Netris, the port step is skipped, because Netris has no port tools yet |
| Traffic and tenant isolation | Pass, 13 of 13 checks. L2 across leaves for two tenants, the anycast gateway on both leaves, and routed traffic inside a tenant VRF across leaves all worked. There was no L2 or L3 path between tenants |
| Drift from hand changes on a leaf | Pass. A deleted VXLAN map and a changed gateway were reported in about 9 and 18 seconds, naming the leaf and the object. A manual reconcile restored both, and drift was then empty |
| Delete | Pass. Deleting a network removed it from Netris in a few seconds and from SONiC in under 10 s. Tearing down two whole tenants left the leaves matching their pre-test backup, apart from objects still present in OpenStack |
Defects found and fixed
- A segment delete could leave the VRF and VLAN stuck on the switch. The SONiC MCP server now clears neighbors and waits before removing them.
- Stale learned addresses survived a VLAN delete. Segment deletes now clear them.
- The anycast gateway sent duplicate replies on the virtual switch image. The server now adds the missing entry and reports it if it goes missing. This defect is specific to the virtual switch.
- A half-finished network delete could be planned as a new network. The listener now waits for two matching snapshots before planning. This fix is unit-tested and not yet re-tested live.
Not yet built or tested on SONiC
- Symmetric IRB, IPv6 gateways, ACLs, NAT, LAG / MC-LAG / ESI multihoming
- SONiC MCP server packaged to run in-cluster
- Auto-heal on the deployed agent
- Port links written by Ironic
- CAPO clusters through this path
- Hardware leaves, a spine, traffic other than ICMP and ARP, scale and convergence
For which OpenStack changes reach the fabric at all, see When the Platform Engineering Agent Touches the Underlay.