OpenPERouter: Turning Your Kubernetes Nodes into a Provide Edge Router#

Miguel Duarte, Federico Paolinelli (Red Hat)

• Why: Bridges the PM's two worlds directly: it moves VPN/EVPN termination from the ToR leaves onto Kubernetes nodes, resolving the classic "who configures the fabric" friction between networking and cloud teams.
• What: A lightweight open-source Provider Edge router running on Linux hosts / K8s nodes in a separate network namespace, with FRR as the control plane. The host sees normal interfaces and BGP peers — anything that can talk to a router can talk to OpenPERouter. Configuration is CR-driven (Underlay, L3VNI, L2VNI CRDs).
• How: EVPN-VXLAN tunnels are created dynamically per VNI; L3 routes (including MetalLB's, translated to EVPN Type 5) propagate over the corresponding veth session; L2 domains are exposed as veth legs bridgeable to any virtual switch. Underlay to the ToR is set up either by moving the interface into the namespace or via Multus. The result: leaves get "dumber" — no per-network tunnel config, no networking-team ticket for each new overlay.
• Where applicable: Bare-metal K8s clusters that need L3VPN/L2VPN integration with an existing EVPN fabric. Integrations documented for MetalLB, Calico, and KubeVirt. Roadmap: SR-IOV interface handling, a Day-0 standalone systemd mode, SRv6 as just another VPN type, and a pluggable faster datapath (kernel today, DPDK-based Grout later).