fix: allow full-width route targets on BGPVRFInstance - #19
Merged
Conversation
A route target's local administrator is a four-byte value when paired with a two-byte ASN, so it needs ten digits. The CEL rule capped both halves at nine, which rejects everything from 1000000000 up -- about three quarters of the range. Callers that derive the value from the low 32 bits of an identifier hit this constantly. galactic's CNI does exactly that, and a VPC whose low word lands above 1e9 fails its attachment with "value must be in ASN:NN or IP:NN format" even though the value it built is a legal route target. Widen both halves to ten digits. MaxLength=21 already accommodates the longest legal pair. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
privateip
approved these changes
Aug 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A BGP route target's local administrator is a four-byte value when paired with a two-byte ASN, so it needs ten digits. The
RouteTargetCEL rule capped both halves at nine, which rejects every value from1000000000up — roughly three quarters of theuint32range.Callers that derive the value from the low 32 bits of an identifier hit this constantly.
How this surfaced
galactic's CNI builds the route target ininternal/cnibgp/bgp.go:routeTarget()asfmt.Sprintf("%d:%d", asNumber, uint32(v))— deliberately the low 32 bits of the VPC identifier, so every node in a VRF agrees on it.On
us-central-1-staging-lab, a VPC with the base62 idky6BQyqUdecodes to72369556180860. Its low word is3652210556, giving the route target33438:3652210556— ten digits, legal BGP, rejected by the rule. Instance attachment fails with:The value galactic built is correct; the schema was too narrow.
Change
Both halves widen to ten digits.
MaxLength=21already accommodates the longest legal pair (4294967295:4294967295). The dottedIP:NNalternative is untouched.Adds a chainsaw case asserting
65000:4294967295is accepted, which fails before this change.Verified against the live cluster: patching the rule to the widened form let the CR be created (
41d1d9b04f7c-psi-puborr, vrfID 1) and the instance's VPC interface attached.Related