vyos-documentation.git/docs/vpp/configuration/dataplane, branch secure-boot

docs: vpp: update common configuration physmem (#2245)

2026-09-28T10:46:21+00:00

docs: VPP IPsec remove lcp and netlink configuration (#2243)

2026-09-28T10:42:29+00:00

* docs: vpp: remove netlink and lcp IPsec options Removed netlink and lcp options from the VPP IPsec documentation (dataplane/ipsec.md) as they were removed from the CLI. Also updated the IPsec configuration page (vpp/configuration/ipsec.md): - Clarified that the IPsec option can be configured in the VPP configuration section - Removed the netlink rx-buffer-size and lcp ignore-kernel-routes options from the configuration example Co-Authored-By: Claude Sonnet 5 * docs: vpp: fix wording and broken anchor after netlink removal - Restore "VPN configuration section" wording (was accidentally changed to "VPP configuration section", which contradicts the linked page and the fact that IPsec tunnels are configured via the ordinary vpn ipsec tree, not a VPP-specific section). - Fix broken anchor in the "disable the kernel routes synchronization" link: lcp.md's real anchor is vpp_config_dataplane_lcp_ignore_kernel_routes, not vpp-lcp-configuration. - Remove leftover blank line left after deleting the netlink section. Co-Authored-By: Claude Sonnet 5 * docs: vpp: fix lcp.md link path and wrap long line - The link target anchor lives in docs/vpp/configuration/dataplane/lcp.md, not a sibling docs/vpp/configuration/lcp.md, so the relative path needs the dataplane/ prefix. - Convert to a shortcut reference link to keep the visible line under the 80-character doc-lint limit; the long URL moves to a reference definition at the bottom of the file, suppressed with stop/start_vyoslinter per the documented convention for unavoidably long lines. Verified locally with `python3 scripts/doc-linter.py '["docs/vpp/configuration/ipsec.md"]'` (exit 0, no warnings). Co-Authored-By: Claude Sonnet 5 * add ignore-kernel-routes.md --------- Co-authored-by: Claude Sonnet 5

docs: vpp: document that kernel prerequisites need their own commit and reboot (#2233)

2026-09-15T10:47:32+00:00

* docs: vpp: document that kernel prerequisites need their own commit and reboot VPP depends on hugepages and, since T8460, on isolated CPUs. Both are configured under "system option kernel", take effect only after a reboot, and are validated by VPP against the running kernel. Because "vpp" is committed at priority 295 and "system option" at 9999, the two can never be applied in the same commit - the VPP part is always rejected with "Not enough free memory to start VPP!" or "Not enough isolated CPU cores available", both of which point back at the very command the user just issued. This is independent of the NIC: the checks that fail take no interface or PCI information and run before the NIC validation. It was reproduced both with an unsupported NIC and with a validated one. Such a commit is also partial: the "system option kernel" part is applied even though the commit is reported as failed, while the "set vpp ..." statements are discarded and have to be re-entered after the reboot. The "Optimal Configuration Example" showed exactly this failing one-shot form, mixing "set system option kernel ..." and "set vpp settings ..." in a single block. Split it into the two stages that actually work and state why, and add hugepages to it so the example covers every prerequisite. Also: * add a short "Kernel Configuration" item to the requirements page, which is what a first-time user reads and which had no pointer to the kernel settings at all * document the isolated-CPU requirement on the cpu-cores page, which did not mention "isolate-cpus" * add the missing 1af4:1041 (virtio modern ID) row to the validated NIC table - it is present in SUPPORTED_PCI_IDS but was absent here * correct the allow-unsupported-nics note, which said the check is bypassed "for the specified devices". There are no specified devices: _is_device_allowed() returns True for every interface as soon as the option is set, including interfaces attached later. That wording is a leftover from the per-PCI-ID form originally proposed in T8315, which was merged as a single boolean. Verified by building the docs; the three changed pages produce no Sphinx warnings. Claude-Session: https://claude.ai/code/session_01EQsKVSw5hhDu7jPq1YzQvj * docs: vpp: correct what a failed VPP commit leaves behind Two corrections to the pages added earlier in this PR. The partial-commit note claimed that the "set vpp ..." statements are "discarded". They are not. Verified on VyOS 2026.03: after the commit fails, "compare" still shows them staged in the configuration session. [vpp settings] + resource-allocation { + memory { + main-heap-size "6G" + } + } What actually happens is worse than the previous wording suggested and worth stating precisely: the statements are neither applied nor written by "save", because "save" writes the running configuration - which "system_option.py" has already updated with the kernel options while the VPP part was rejected. The session does not survive the reboot, so the VPP statements are lost there rather than at commit time. The isolated-CPU requirement was also described as if it only applied once "cpu-cores" is raised. It applies at the default of "cpu-cores 1" as well: verify_vpp_cpu_cores() rejects the commit whenever fewer CPUs are isolated than requested, and VPP takes its main core from the isolated set. The project's own test_01_vpp_basic relies on this - it never sets "cpu-cores" and still expects "main-core" to be taken from /sys/devices/system/cpu/isolated. Without this, a reader doing a minimal setup would conclude that CPU isolation is optional for them. Claude-Session: https://claude.ai/code/session_016gXeKHVBq2N8qRAMQkrdM6

chore: remove RST swap mechanism, archive rst-*.rst under docs/_rst_legacy/

2026-05-10T14:19:31+00:00

The swap mechanism (RST-as-fallback for migrated MD pages) is dormant — docs/_rst_overrides.txt has been empty since the MyST flip trio (#1899/#1900/#1901) landed in May 2026. The mechanism's surface area (scripts/swap_sources.py, its 245-line test, RTD pre/post hooks, Makefile glue, conf.py dynamic loader) is dead weight, and the rst-*.rst shadows scattered across the source tree cause Context7's parser to misclassify the project as RST. Changes: - Move 253 rst-*.rst shadow files into docs/_rst_legacy/ preserving subdirectory structure. They remain in the repo for reference; Sphinx excludes the folder via exclude_patterns; Context7 excludes it via excludeFolders. - Strip swap_sources.py invocation from docs/Makefile (swap/restore targets, : swap deps, trap chains). - Strip jobs: pre_build/post_build block from .readthedocs.yml. - Strip rst-*.rst exclude entry and the _md_exclude.txt loader from docs/conf.py; replace with a single _rst_legacy exclude. - Delete scripts/swap_sources.py, tests/test_swap_sources.py, docs/_rst_overrides.txt. - Update context7.json: add docs/_rst_legacy to excludeFolders; fix stale "Branch current tracks…" rule to "Branch rolling tracks…" (default branch was renamed 2026-05-10). - Update AGENTS.md: drop the "RST override mechanism" section and the test-runner snippet for the deleted test; describe _rst_legacy as archive only. Verified: sphinx-build -b html with --keep-going produces identical warning set (68 unique), identical sitemap entry count (257), identical llms.txt entry count (22), zero rst-* URLs in any artifact. 🤖 Generated by [robots](https://vyos.io)

feat: flip swap mechanism — MD as primary, RST as override (Phase 1)

2026-05-06T17:42:32+00:00

This is the first of three phases inverting the per-page swap mechanism so MD becomes the canonical primary and RST becomes the rare override. Phase 1 — file renames + conf.py exclude_patterns flip only: - Rename docs/**/md-.md to docs/**/.md (drop md- prefix) for all 254 stems previously listed in docs/_swap.txt - Rename docs/**/.rst to docs/**/rst-.rst (add rst- prefix) for the same 254 stems - Repurpose docs/_swap.txt as docs/_rst_overrides.txt; initially empty comment-only since no pages need the RST fallback right now - conf.py exclude_patterns flipped: rst-*.rst is now excluded by default instead of md-*.md - conf.py runtime-artifact references updated to _rst_override_state.json and _md_exclude.txt (Phase 2 will rewrite swap_sources.py to produce these names; for now no swap script runs because overrides list is empty) Phase 2 (next commit on this branch) will rewrite scripts/swap_sources.py with inverted rename direction, delete scripts/import_myst.py + tests, and update tests/test_swap_sources.py for the new semantics. Phase 3 will be the cleanup pass and ready-for-review flip. Generated by robots https://vyos.io

refactor(swap): rename imported .md files to md- prefix for swap mechanism

2026-05-06T13:18:03+00:00

Restore the canary file naming convention that swap_sources.py expects: the imported MyST pages now live as docs//md-.md alongside the existing docs//.rst, so swap_sources.py --swap can rename them into place at build time. - 254 .md files renamed (every page with a matching .rst counterpart) - 2 MyST-only pages left at their final names (no .rst exists, no swap needed): docs/copyright.md, docs/automation/terraform/terraformvyos.md All 114 stems listed in docs/_swap.txt now have a corresponding md-.md source file ready to swap in. 🤖 Generated by [robots](https://vyos.io)

docs: address Copilot review feedback on imported MyST pages

2026-05-06T13:18:03+00:00

Fix issues flagged by Copilot review on PR #1857 (the same content lives in myst/current as the canonical source): Real bugs: - site-2-site-cisco.md: replace curly quote (U+2019) with ASCII apostrophe - rsa-keys.md: fix typo "key-pair nam>>" → "key-pair name>" - vmware.md: lowercase admonition directive (:::{NOTE} → :::{note}) - vpp/configuration/nat/index.md: remove blank line inside {include} fence Grammar: - vpp/configuration/interfaces/loopback.md: "bounded" → "bound" - vpp/configuration/sflow.md: "VyOS support" → "VyOS supports" - vpp/requirements.md: "bypass" → "bypasses" - vpp/configuration/dataplane/interface.md: "configures" → "configure" CI linter (IP addresses): - nmp.md: wrap 8.8.8.8 example with stop/start_vyoslinter - lac-lns.md: wrap LNS config block (contains 8.8.8.8) - wan-load-balancing.md: wrap whole file (illustrative non-RFC IPs) - policy/examples.md: replace 192.0.1.1 with RFC 5737 192.0.2.1 🤖 Generated by [robots](https://vyos.io)

chore(swap): remove canary md-*.md files and docs/superpowers

2026-05-06T13:18:03+00:00

- Remove 115 canary md-*.md files (incremental swap helpers no longer needed) - Remove 8 files under docs/superpowers (project planning/design docs that shouldn't ship in the documentation tree) 🤖 Generated by [robots](https://vyos.io)

feat(swap): import .md files and webp transition from myst/current

2026-05-06T13:18:03+00:00

Selective import from origin/myst/current (cf9c9b34): - Add/update 255 .md files (full MyST conversion plus webp ref updates) - Delete 175 PNG/JPG from docs/_static/images (webp twins already present) - Delete 5 autotest topology.png (webp twins already present) Preserved on swap (untouched): - All .rst files (incremental swap pattern) - conf.py, _ext/, _include/*.txt, .gitignore - 115 canary md-*.md files - 7 superpowers/specs/*.md design docs - Logos vyos-logo.png / vyos-logo-icon.png (referenced by conf.py) 🤖 Generated by [robots](https://vyos.io)

fix: re-add md-lcp.md and md-memory.md (deleted by 870c9e7e)

2026-05-06T13:18:03+00:00

Same disaster pattern as 242b334a: a swap-restore cycle left unprefixed *.md files in the working tree, and the subsequent git add staged deletions instead of modifications. Restoring the two affected md-*.md files from origin/myst/current 079fa786 (which has the dual underscore+dash anchors needed for the swap-active build). 🤖 Generated by [robots](https://vyos.io)