[privateip]

The gobgp CLI in the debug image couldn't reach galactic-router, because the router served no API for it. The router now serves a read-only API to root on each node, so on-call can read the live BGP tables from a debug pod and can't write to them. Every router pod restarts on rollout, since the DaemonSet gains a host directory for the socket. The commit messages have the design.

Test plan

• New tests: reads work, writes are refused, and the socket survives a crash and repeated reconfiguration. They fail on main.
• The real gobgp tool reads neighbors and refuses a write
• Lint, unit, docs and Kind e2e pass
• After release, gobgp works from a debug pod on a staging node

Fixes #1157

[privateip]

Both review passes ran on head 7feeecc and agreed, so this PR is marked ready and set to auto-merge.

First pass, at 3cd2226: pr-adversary returned merge, with one warning and one decision. The warning was a fixed 5s server-start wait when the API socket could not bind; the fix pass skipped that wait when no API is served and added a test for it. The decision was that the reviewer could not run the real gobgp CLI or the Kind e2e itself. The author ran both locally, and a person chose to proceed on that basis. pr-conventions-reviewer returned merge, with three warnings and two nits: split the commit, state the shared-base rollout, check the renovate.json overlap with #1114, plus identifiers in the test plan and a title that did not match the subject. The fix pass split the work into two signed commits, stated that the router pods restart, reworded the test plan, and matched the title to the commit. The #1114 overlap is in a different hunk, so both can land.

Second pass, at 7feeecc: pr-rereviewer returned merge and confirmed all five fixes. It reverted the server-start guard in a scratch worktree, and the new test failed after the 5s wait. It found nothing new. pr-conventions-reviewer returned merge with no findings. It rendered the base and both router overlays and found no collision with #1114 or #1109.

CI on 7feeecc: all required checks passed, including Build, Lint, Manifests, Unit Tests, Unit Tests (root), Documentation, and E2E Tests.

Merge method: merge, the only method the main ruleset allows. Auto-merge waits for one approving review from a code owner, and the push dismisses stale approvals. Code owners were requested.

[ecv]

Approve.

Read-only is enforced by an allowlist of 16 Get*/List*/WatchEvent methods in both a unary and a stream interceptor, so every other RPC, including any a GoBGP bump adds, gets PermissionDenied. The socket is a unix socket only, in a root-only 0700 directory, with no TCP listener.

• api.go readOnlyMethods: TestReadOnlyMethodCoversService walks GoBgpService_ServiceDesc Methods and Streams and fails on any method not classified, so a bump of the pinned v4.10.0 forces a decision. TestAPISocketRefusesWrites covers a unary write and the client-streaming AddPathStream.
• root.go prepareGoBGPAPIDir: MkdirAll plus an explicit Chmod(0700) handles the world-readable dir that DirectoryOrCreate makes. The router runs as uid 0 with drop: ALL, which is enough to own and chmod a dir it created. Only host root (or a privileged pod mounting the host) reaches the sockets.
• Without GALACTIC_ROUTER_GOBGP_API_DIR set, no gRPC listener starts, so no API appears on any other deployment.
• Rollout risk, plainly: the DaemonSet gains a hostPath volume, so every galactic-router pod, plain and rr, restarts on the rollout. The DaemonSet sets no updateStrategy, so the default RollingUpdate with maxUnavailable: 1 applies per DaemonSet. Each restart drops that node's BGP sessions, and nothing in internal/runtime/gobgp configures graceful restart, so routes withdraw until the sessions re-establish. When the bundle version carrying this reaches edge sites via infra, roll one site at a time and watch peer-state metrics between sites. Do not let it ride a tag with other edge changes.
• Version match is right: go.mod has github.com/osrg/gobgp/v4 v4.10.0 and the debug image GOBGP_VERSION=v4.10.0. The renovate custom manager regex matches the # renovate: comment followed by the ARG line, and the packageRule groups both into "Go dependencies".
• The API returns full routing state, including peer passwords and TCP-AO keys, as the docs already say. Root on the node could read these anyway, so acceptable.

Follow-ups:

• Add updateStrategy with an explicit maxUnavailable and a minReadySeconds to the router DaemonSet so a rollout paces itself by session re-establishment rather than pod readiness.
• Configure BGP graceful restart on the embedded GoBGP peers so a router restart stops being a route withdrawal.
• Confirm the Renovate regex with a dry run (renovate --platform=local or the Dependency Dashboard) after merge. The go datasource lookup for a /v4 module path is not exercised by CI here.