OCPBUGS-98619: Bump frr-k8s MAX_FDS from 1024 to 65536

[jcaamano]

bfdd opens 5 (2 IPv4 + 3 IPv6) UDP sockets against each VRF even if BFD has not been explicitly enabled on them. When using RouteAdvertisements with OVN-K CUDNs, this limits the scalability to ~200 of them assuming a default file descriptor limit of 1024. Bump it to 65536 which is in any case a much more reasonable limit for production network daemons.

[openshift-ci-robot]

@jcaamano: This pull request references Jira Issue OCPBUGS-98619, which is invalid:

• expected the bug to target the "5.0.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

bfdd opens 5 (2 IPv4 + 3 IPv6) UDP sockets against each VRF even if BFD has not been explicitly enabled on them. When using RouteAdvertisements with OVN-K CUDNs, this limits the scalability to ~200 of them assuming a default file descriptor limit of 1024. Bump it to 65536 which is in any case a much more reasonable limit for production network daemons.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[coderabbitai]

Walkthrough

The FRR-K8s startup configuration now actively sets MAX_FDS to 65536 and documents the need for higher limits when BFD uses multiple sockets per VRF.

Changes

FRR-K8s startup configuration

Layer / File(s)	Summary
Configure startup file descriptor limit bindata/network/frr-k8s/config.yaml	The daemons startup configuration enables MAX_FDS=65536 and adds comments describing BFD’s file descriptor usage in high-scale production environments.

Estimated code review effort: 1 (Trivial) | ~2 minutes

---

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

• Ignore

❌ Failed checks (4 errors)

Check name	Status	Explanation	Resolution
Pr Quality	❌ Error	Small change, but the PR body is only a paragraph; it lacks explicit Why/What/Testing sections and CI verification details.	Rewrite the PR body with Why, What, and automated Testing/CI lanes; add user impact and rollback notes if applicable.
Commit Message Quality	❌ Error	The sole PR commit has a good body, but its subject isn’t component-prefixed as required (Bump frr-k8s... instead of frr-k8s: ...).	Rewrite the commit subject with a component prefix, e.g. frr-k8s: Bump MAX_FDS from 1024 to 65536, and keep the rationale body unchanged.
Unit Tests For Go Changes	❌ Error	bindata/network/frr-k8s/config.yaml changed, but no *_test.go files were added or modified in the PR.	Add or update corresponding tests, or document why tests are unnecessary in 'How to verify it' and then use '@coderabbitai ignore pre-merge checks' if appropriate.
Title check	❌ Error	The title is relevant and imperative, but it lacks the required affected-component prefix.	Change it to something like 'frr-k8s: Bump MAX_FDS from 1024 to 65536'.

✅ Passed checks (20 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
E2e Tests For Feature Changes	✅ Passed	Only bindata/network/frr-k8s/config.yaml changed; no pkg/cmd Go behavior change, so the E2E requirement doesn’t apply.
Rbac Least Privilege	✅ Passed	Only bindata/network/frr-k8s/config.yaml changed, updating a ConfigMap; no ClusterRole/Role rules were added or modified.
Docs For Feature And Behavior Changes	✅ Passed	Commit only updates bindata/network/frr-k8s/config.yaml to raise MAX_FDS; no docs/ files were added or modified, and this is a bug fix/internal config change.
Stale Project Docs And Config	✅ Passed	No docs/AGENTS/ARCHITECTURE or .coderabbit.yaml reference the old MAX_FDS value or any renamed frr-k8s paths; only the config manifest changed.
Go And Test Code Quality	✅ Passed	Only bindata/network/frr-k8s/config.yaml changed; no Go or test code was added or modified, so the Go/Test checks do not apply.
Ai-Generated Code Smell	✅ Passed	Only a small config update and explanatory comments were added; no verbose code, auto-generated tests, or AI-tool references were found.
Stable And Deterministic Test Names	✅ Passed	Diff only touches bindata/network/frr-k8s/config.yaml; no tests or Ginkgo titles changed, so the check is not applicable.
Test Structure And Quality	✅ Passed	No Ginkgo test files or test logic changed; PR only updates bindata/network/frr-k8s/config.yaml, so the test-quality check is not applicable.
Microshift Test Compatibility	✅ Passed	Only a FRR ConfigMap was changed; no new Ginkgo tests, contexts, or OpenShift API usage were added, so MicroShift compatibility is not implicated.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS: The PR only changes bindata/network/frr-k8s/config.yaml to raise MAX_FDS; no new Ginkgo tests or SNO-sensitive assumptions were added.
Topology-Aware Scheduling Compatibility	✅ Passed	Only MAX_FDS in a ConfigMap changed; no nodeSelector, affinity, anti-affinity, replicas, or topology-spread settings were added.
Ote Binary Stdout Contract	✅ Passed	Only bindata/network/frr-k8s/config.yaml changed; no process-level code or stdout writes were introduced.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Only bindata/network/frr-k8s/config.yaml changed; no Ginkgo e2e tests or network-using code were added.
No-Weak-Crypto	✅ Passed	The PR only changes frr-k8s MAX_FDS/commentary; no weak-crypto primitives, custom crypto, or secret comparisons appear in the diff.
Container-Privileges	✅ Passed	Only bindata/network/frr-k8s/config.yaml changed, and it contains no privileged, hostPID/Network/IPC, SYS_ADMIN, root, or allowPrivilegeEscalation=true settings.
No-Sensitive-Data-In-Logs	✅ Passed	The PR only changes a config comment and MAX_FDS value; no new logging or exposed sensitive data appears in the diff.
Description check	✅ Passed	The description matches the change and explains why the FD limit is being increased.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[jcaamano]

/jira refresh

[openshift-ci-robot]

@jcaamano: This pull request references Jira Issue OCPBUGS-98619, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[venkataanil]

I have tested with this change and able to create 250 CUDNs (i.e 250 VRFs on a worker node). Without this change, bfdd is crashing with below error for the same number of 250 CUDNs (i.e 250 VRFs)

2026/07/15 03:53:59 BFD: [XCQPZ-40HX4] echov6-socket: socket: Too many open files
2026/07/15 03:53:59 BFD: bfdd/bfd_packet.c:2140: bp_initv6_socket(): assertion (!"echov6-socket: socket: %s") failed
BFD: Received signal 6 at 1784087639 (si_addr 0x3e60000db44, PC 0x7f42a12be4bc); aborting...
BFD: /usr/lib64/frr/libfrr.so.0(zlog_backtrace_sigsafe+0x71) [0x7f42a1534d11]
BFD: /usr/lib64/frr/libfrr.so.0(zlog_signal+0xf5) [0x7f42a1534f15]
BFD: /usr/lib64/frr/libfrr.so.0(+0x101a55) [0x7f42a156fa55]
BFD: /lib64/libc.so.6(+0x3fc60) [0x7f42a1270c60]
BFD: /lib64/libc.so.6(+0x8d4bc) [0x7f42a12be4bc]
BFD: /lib64/libc.so.6(raise+0x16) [0x7f42a1270bb6]
BFD: /lib64/libc.so.6(abort+0xd3) [0x7f42a125a873]
BFD: /usr/lib64/frr/libfrr.so.0(_zlog_assert_failed+0xed) [0x7f42a159f05d]
BFD: /usr/libexec/frr/bfdd(bp_initv6_socket+0xe9) [0x55d104bcb2c9]
BFD: /usr/libexec/frr/bfdd(+0x274a8) [0x55d104bc44a8]
BFD: /usr/lib64/frr/libfrr.so.0(vrf_enable+0x59) [0x7f42a1586959]
BFD: /usr/lib64/frr/libfrr.so.0(+0x128a7b) [0x7f42a1596a7b]
BFD: /usr/lib64/frr/libfrr.so.0(+0x13ad3c) [0x7f42a15a8d3c]
BFD: /usr/lib64/frr/libfrr.so.0(event_call+0x9f) [0x7f42a1585ccf]
BFD: /usr/lib64/frr/libfrr.so.0(frr_run+0xd8) [0x7f42a152b798]
BFD: /usr/libexec/frr/bfdd(main+0x1e2) [0x55d104bb5a02]
BFD: /lib64/libc.so.6(+0x2a610) [0x7f42a125b610]
BFD: /lib64/libc.so.6(__libc_start_main+0x80) [0x7f42a125b6c0]
BFD: /usr/libexec/frr/bfdd(_start+0x25) [0x55d104bb5dd5]
BFD: in thread zclient_read scheduled from lib/zclient.c:4959 zclient_event()

[fedepaol]

/lgtm

[openshift-merge-bot]

Scheduling required tests:
/test e2e-aws-ovn-upgrade-ipsec
/test e2e-gcp-ovn-techpreview

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test frrk8s-e2e
/test e2e-aws-ovn-fdp-qe
/test e2e-aws-ovn-hypershift-conformance
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-aws-ovn-upgrade
/test e2e-aws-ovn-windows
/test e2e-azure-ovn-upgrade
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upgrade
/test e2e-metal-ipi-ovn-dualstack-bgp
/test e2e-metal-ipi-ovn-dualstack-bgp-local-gw
/test e2e-metal-ipi-ovn-ipv6
/test e2e-metal-ipi-ovn-ipv6-ipsec
/test e2e-ovn-ipsec-step-registry
/test hypershift-e2e-aks

[venkataanil]

/verified by @venkataanil

[openshift-ci-robot]

@venkataanil: This PR has been marked as verified by @venkataanil.

Details

In response to this:

/verified by @venkataanil

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[jtaleric]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: fedepaol, jcaamano, jtaleric, venkataanil

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• bindata/network/frr-k8s/OWNERS [fedepaol,jcaamano]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@jcaamano: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-ovn-fdp-qe	79bbb49	link	true	/test e2e-aws-ovn-fdp-qe
ci/prow/e2e-azure-ovn-upgrade	79bbb49	link	true	/test e2e-azure-ovn-upgrade
ci/prow/e2e-metal-ipi-ovn-dualstack-bgp	79bbb49	link	true	/test e2e-metal-ipi-ovn-dualstack-bgp
ci/prow/e2e-gcp-ovn	79bbb49	link	true	/test e2e-gcp-ovn
ci/prow/e2e-aws-ovn-upgrade	79bbb49	link	true	/test e2e-aws-ovn-upgrade
ci/prow/e2e-ovn-ipsec-step-registry	79bbb49	link	true	/test e2e-ovn-ipsec-step-registry
ci/prow/e2e-gcp-ovn-techpreview	79bbb49	link	true	/test e2e-gcp-ovn-techpreview
ci/prow/5.0-upgrade-from-stable-4.22-e2e-gcp-ovn-upgrade	79bbb49	link	false	/test 5.0-upgrade-from-stable-4.22-e2e-gcp-ovn-upgrade
ci/prow/5.0-upgrade-from-stable-4.22-e2e-aws-ovn-upgrade	79bbb49	link	false	/test 5.0-upgrade-from-stable-4.22-e2e-aws-ovn-upgrade
ci/prow/5.0-upgrade-from-stable-4.22-e2e-azure-ovn-upgrade	79bbb49	link	false	/test 5.0-upgrade-from-stable-4.22-e2e-azure-ovn-upgrade
ci/prow/e2e-metal-ipi-ovn-ipv6-ipsec	79bbb49	link	true	/test e2e-metal-ipi-ovn-ipv6-ipsec
ci/prow/e2e-metal-ipi-ovn-dualstack-bgp-local-gw	79bbb49	link	true	/test e2e-metal-ipi-ovn-dualstack-bgp-local-gw
ci/prow/e2e-aws-ovn-upgrade-ipsec	79bbb49	link	true	/test e2e-aws-ovn-upgrade-ipsec

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.