RPKI support for VRF?

[Hawkins-Sherpherd]

It works fine with default routing table, but didn't show up in BGP instance working with VRF.
If it's not yet implemented, does RPKI support for VRF in roadmap?

FRR Version: 10.0.1

[ton31337]

How are you trying to configure it? It should be under the VRF's stanza, e.g.:

vrf test
 rpki
  rpki cache tcp ssh donatas.net preference 1
 exit
exit-vrf

[f0o]

@ton31337 This just caught me, I noticed that since we updated to 10.x we got RPKI invalid routes in our VRF tables. We got the rpki config without VRFs and this used to work prior.

Is there a way to leak/share RPKI caches across VRFs? It seems wasteful to create multiple rpki cache tcp localhost blocks (i.e. per VRF).

[ton31337]

At the moment - no.

[f0o]

Oh well no biggie, I'll set up multiple RPKI blocks. Thanks for the quick answer! :)

[f0o]

@ton31337

I got a config like:

vrf RED
 rpki
  rpki polling_period 300
  rpki retry_interval 1
  rpki cache tcp 127.0.0.1 3323 preference 1
 exit
exit-vrf
!
vrf GREEN
 rpki
  rpki polling_period 300
  rpki retry_interval 1
  rpki cache tcp 127.0.0.1 3323 preference 1
 exit
exit-vrf
!
vrf BLUE
 rpki
  rpki polling_period 300
  rpki retry_interval 1
  rpki cache tcp 127.0.0.1 3323 preference 1
 exit
exit-vrf
!
rpki
 rpki polling_period 300
 rpki retry_interval 1
 rpki cache tcp 127.0.0.1 3323 preference 1
exit

when I do:

# do show rpki cache-connection
Connected to group 1
rpki tcp cache 127.0.0.1 3323 pref 1 (connected)

All seems well but then the VRF specific one does not show at all:

# do show rpki cache-connection vrf BLUE
No connection to RPKI cache server.

Could this be some collision on the reuse of 127.0.0.1?

//EDIT:
do show rpki config vrf GREEN does show something and do sh rpki cache-server vrf GREEN shows the correct server.

I'm pretty sure Linux can always connect to localhost regardless of the (non-netns) VRF.

//EDIT2:

NEVER MIND! I am/was a doofus, the cache is indeed not reachable through the VRFs.