M2: netlink, IPAM/handler wiring, BIRD sidecar, CNI installer

Code (Linux build, with no-op stubs for macOS dev):
- pkg/agent/netns_linux.go: ensureVeth → host-side configure (addrgenmode
  none, fe80::1/64, proxy_arp, forwarding) → move peer to pod ns →
  configure pod side (addr, default route via fe80::1, v4 169.254.1.1
  on-link gateway) → host /128 + /32 routes. Idempotent.
- pkg/agent/hostiface.go: deterministic host iface name flock<8hex> from
  FNV-1a-32(containerID).
- pkg/agent/annotations.go: parse flock.fritzlab.net/{ipv6,ipv4,cidr6,
  cidr4,ip-algo,anycast} with design-doc defaults; ParseCNIArgs for the
  K8S_POD_* keys kubelet sets.
- pkg/agent/podinfo.go: shared informer scoped to spec.nodeName==NODE,
  WaitForPod helper for ADD-vs-informer-sync race.
- pkg/agent/handlers.go: PodHandler does
    cache lookup → annotations → IPAM → store(pending) → SetupFunc →
    store(committed) → Result. Idempotent on retry. Del symmetric.
- pkg/routing/bird/config.go: text/template render with stable ordering;
  golden tests for host001 + anycast injection + sort stability.
- pkg/agent/bird.go: writes /etc/flock/bird/bird.conf, debounces 500ms,
  execs `birdc -s /run/flock/bird.ctl configure`. Installs blackhole
  kernel routes for the node summary CIDRs so BIRD's protocol kernel
  imports them.
- pkg/agent/runtime_linux.go: at startup, waits up to 60s for the per-
  node NodeConfig, reconciles committed allocations into IPAM.used,
  garbage-collects pending entries, builds PodHandler, swaps RPC
  handlers in.
- cmd/flock-installer: init-container binary that copies /opt/cni/bin/
  flock and writes 01-flock.conflist (lex-first so kubelet picks it
  over Calico's 10-calico.conflist on flock-labeled nodes).

Deploy:
- Dockerfile: alpine + iproute2 + bird2; multi-binary image.
- deploy/daemonset.yaml: install-cni init container; bird sidecar
  sharing /etc/flock/bird + /run/flock with the agent; ConfigMap-seeded
  bootstrap bird.conf so the sidecar boots before the agent renders.
  Privileged on flock-agent + install-cni; bird sidecar uses
  NET_ADMIN/RAW only.
- RBAC: pods + networkpolicies get/list/watch (the latter is reserved
  for M8 — harmless to grant now).

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

pkg/routing/bird/config.go

@@ -0,0 +1,151 @@
+// Package bird renders BIRD2 configuration for flock-agent. The agent
+// writes the rendered file to a shared volume; the bird sidecar reads it,
+// and the agent calls birdc reload (over the shared birdc unix socket) on
+// changes.
+package bird
+
+import (
+	"bytes"
+	"fmt"
+	"net"
+	"sort"
+	"text/template"
+)
+
+// NodeBGP describes the inputs needed to render a node's BIRD config.
+type NodeBGP struct {
+	NodeName string
+	RouterID string // IPv4 (any usable v4 on the node, typically the host's)
+	LocalASN uint32
+	Peers    []Peer
+	// CIDR6 / CIDR4 are the per-node summary aggregates the agent wants
+	// advertised. The agent installs blackhole kernel routes for each so
+	// BIRD's protocol kernel imports them.
+	CIDR6 []string
+	CIDR4 []string
+	// Anycast6/4 are the currently-Ready anycast /128 and /32 addresses.
+	Anycast6 []string
+	Anycast4 []string
+}
+
+type Peer struct {
+	// Family is "v6" or "v4".
+	Family  string
+	Address string
+	ASN     uint32
+}
+
+const tpl = `# Generated by flock-agent. DO NOT EDIT.
+log syslog all;
+router id {{.RouterID}};
+
+protocol device { scan time 10; }
+protocol direct { interface "lo"; }
+
+protocol kernel kernel6 {
+  ipv6 {
+    import all;
+    export all;
+  };
+}
+protocol kernel kernel4 {
+  ipv4 {
+    import all;
+    export all;
+  };
+}
+{{range $i, $p := .Peers}}{{if eq $p.Family "v6"}}
+protocol bgp upstream6_{{$i}} {
+  local as {{$.LocalASN}};
+  neighbor {{$p.Address}} as {{$p.ASN}};
+  graceful restart;
+  ipv6 {
+    import all;
+    export filter {
+      {{range $cidr := $.CIDR6}}if net = {{$cidr}} then accept;
+      {{end}}{{range $a := $.Anycast6}}if net = {{$a}}/128 then accept;
+      {{end}}reject;
+    };
+  };
+}
+{{else if eq $p.Family "v4"}}
+protocol bgp upstream4_{{$i}} {
+  local as {{$.LocalASN}};
+  neighbor {{$p.Address}} as {{$p.ASN}};
+  graceful restart;
+  ipv4 {
+    import all;
+    export filter {
+      {{range $cidr := $.CIDR4}}if net = {{$cidr}} then accept;
+      {{end}}{{range $a := $.Anycast4}}if net = {{$a}}/32 then accept;
+      {{end}}reject;
+    };
+  };
+}
+{{end}}{{end}}`
+
+// Render produces the bird.conf text.
+func Render(in NodeBGP) (string, error) {
+	if in.RouterID == "" {
+		return "", fmt.Errorf("RouterID is required")
+	}
+	if in.LocalASN == 0 {
+		return "", fmt.Errorf("LocalASN is required")
+	}
+	// Stable order — important so config changes only when something real
+	// changes (avoids needless birdc reloads).
+	in = normalize(in)
+
+	t, err := template.New("bird").Parse(tpl)
+	if err != nil {
+		return "", err
+	}
+	var buf bytes.Buffer
+	if err := t.Execute(&buf, in); err != nil {
+		return "", err
+	}
+	return buf.String(), nil
+}
+
+func normalize(in NodeBGP) NodeBGP {
+	cp := in
+	cp.CIDR6 = sortedUnique(in.CIDR6)
+	cp.CIDR4 = sortedUnique(in.CIDR4)
+	cp.Anycast6 = sortedUnique(in.Anycast6)
+	cp.Anycast4 = sortedUnique(in.Anycast4)
+	cp.Peers = append([]Peer(nil), in.Peers...)
+	sort.SliceStable(cp.Peers, func(i, j int) bool {
+		if cp.Peers[i].Family != cp.Peers[j].Family {
+			return cp.Peers[i].Family < cp.Peers[j].Family
+		}
+		return cp.Peers[i].Address < cp.Peers[j].Address
+	})
+	return cp
+}
+
+func sortedUnique(s []string) []string {
+	if len(s) == 0 {
+		return nil
+	}
+	cp := append([]string(nil), s...)
+	sort.Strings(cp)
+	out := cp[:0]
+	for i, v := range cp {
+		if i == 0 || v != cp[i-1] {
+			out = append(out, v)
+		}
+	}
+	return out
+}
+
+// FamilyOf returns "v6" or "v4" for a peer address string.
+func FamilyOf(addr string) string {
+	ip := net.ParseIP(addr)
+	if ip == nil {
+		return ""
+	}
+	if ip.To4() != nil {
+		return "v4"
+	}
+	return "v6"
+}

pkg/routing/bird/config_test.go

@@ -0,0 +1,88 @@
+package bird
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestRender_Host001(t *testing.T) {
+	out, err := Render(NodeBGP{
+		NodeName: "host001",
+		RouterID: "172.25.25.101",
+		LocalASN: 65101,
+		Peers: []Peer{
+			{Family: "v6", Address: "2602:817:3000:a25::1", ASN: 65000},
+			{Family: "v4", Address: "172.25.25.1", ASN: 65000},
+		},
+		CIDR6: []string{"2602:817:3000:f001::/64"},
+		CIDR4: []string{"172.25.210.0/24"},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, want := range []string{
+		"router id 172.25.25.101",
+		"local as 65101;",
+		"neighbor 2602:817:3000:a25::1 as 65000;",
+		"neighbor 172.25.25.1 as 65000;",
+		"if net = 2602:817:3000:f001::/64 then accept;",
+		"if net = 172.25.210.0/24 then accept;",
+		"graceful restart;",
+	} {
+		if !strings.Contains(out, want) {
+			t.Errorf("missing %q in output:\n%s", want, out)
+		}
+	}
+}
+
+func TestRender_AnycastInjection(t *testing.T) {
+	out, err := Render(NodeBGP{
+		RouterID: "10.0.0.1",
+		LocalASN: 65101,
+		Peers:    []Peer{{Family: "v6", Address: "2001:db8::1", ASN: 65000}},
+		CIDR6:    []string{"2001:db8:f001::/64"},
+		Anycast6: []string{"2001:db8:a::1"},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(out, "if net = 2001:db8:a::1/128 then accept;") {
+		t.Fatalf("anycast /128 not advertised:\n%s", out)
+	}
+}
+
+func TestRender_StableOutput(t *testing.T) {
+	in := NodeBGP{
+		RouterID: "10.0.0.1",
+		LocalASN: 65101,
+		Peers: []Peer{
+			{Family: "v4", Address: "10.0.0.2", ASN: 65000},
+			{Family: "v6", Address: "2001:db8::1", ASN: 65000},
+		},
+		CIDR6: []string{"2001:db8:f002::/64", "2001:db8:f001::/64"},
+		CIDR4: []string{"10.1.1.0/24", "10.0.1.0/24"},
+	}
+	a, _ := Render(in)
+	b, _ := Render(in)
+	if a != b {
+		t.Fatalf("render not deterministic")
+	}
+	// Sorted ordering of CIDR6.
+	i1 := strings.Index(a, "2001:db8:f001::/64")
+	i2 := strings.Index(a, "2001:db8:f002::/64")
+	if !(i1 < i2) {
+		t.Fatalf("CIDR6 not sorted")
+	}
+}
+
+func TestFamilyOf(t *testing.T) {
+	if FamilyOf("2001:db8::1") != "v6" {
+		t.Fatal("v6 detection broken")
+	}
+	if FamilyOf("10.0.0.1") != "v4" {
+		t.Fatal("v4 detection broken")
+	}
+	if FamilyOf("not-an-ip") != "" {
+		t.Fatal("garbage should return empty")
+	}
+}