refactor(vyos): rewrite integration tests for functional validation

images/images.yaml

@@ -4,10 +4,8 @@ metadata:
   name: lab-images
 spec:
   images:
-    - name: vyos-iso
+    - name: vyos-stream
       source:
-        # VyOS rolling nightly build
-        # Note: Update checksum after downloading and verifying the ISO
-        url: https://github.com/vyos/vyos-nightly-build/releases/download/2025.12.20-0020-rolling/vyos-2025.12.20-0020-rolling-generic-amd64.iso
-        checksum: sha256:7f9eb1d6d9aacbd8fb684bb384cf2251d987097993fe7dbead8653ffbde31d04
-      destination: vyos/vyos-2025.12.20-0020-rolling-generic-amd64.iso
+        url: https://community-downloads.vyos.dev/stream/2025.11/vyos-2025.11-generic-amd64.iso
+        checksum: sha256:f60a2d7dd3bdf2e370a45c04ed4fc3b195691694ca3b8546adf4c5983e70d96e
+      destination: vyos/vyos-2025.11-generic-amd64.iso

infrastructure/network/vyos/justfile

@@ -1,36 +1,36 @@
 set shell := ["bash", "-euo", "pipefail", "-c"]
 
-SQUASHFS := "build/live/filesystem.squashfs"
-ROOTFS := "rootfs.tar"
 IMAGE := "vyos-gateway:test"
 TOPO := "tests/topology.clab.yml"
 KEY := "tests/.vyos-test-key"
 
+# Generate SSH key for testing
 key:
     test -f "{{KEY}}" || ssh-keygen -t ed25519 -f "{{KEY}}" -N "" -C "vyos-ci"
 
+# Render test config.boot from gateway.toml template
 config: key
     tests/render-config-boot.sh "$(cat {{KEY}}.pub)"
 
-rootfs:
-    test -f "{{SQUASHFS}}"
-    sqfs2tar "{{SQUASHFS}}" > "{{ROOTFS}}"
-
-image: rootfs
-    docker build -t "{{IMAGE}}" -f Dockerfile.containerlab .
+# Build container image from VyOS ISO
+container ISO:
+    scripts/iso-to-container.sh "{{ISO}}" "{{IMAGE}}"
 
+# Deploy the Containerlab topology
 deploy: config
     sudo containerlab deploy -t "{{TOPO}}"
 
+# Destroy the Containerlab topology
 destroy:
     sudo containerlab destroy -t "{{TOPO}}" --cleanup
 
+# Run pytest tests
 pytest:
     pytest -v tests
 
-test:
-    just deploy
-    just pytest
+# Full test cycle (requires container image to be built first)
+test: deploy pytest
 
+# Clean up test artifacts
 clean:
-    rm -f "{{ROOTFS}}"
+    rm -f tests/config.boot tests/.vyos-test-key tests/.vyos-test-key.pub

infrastructure/network/vyos/scripts/iso-to-container.sh

@@ -0,0 +1,94 @@
+#!/bin/bash
+#
+# iso-to-container.sh - Convert a VyOS ISO to a Docker container image
+#
+# Usage: iso-to-container.sh <iso-path> [image-name:tag]
+#
+# This script extracts the squashfs filesystem from a VyOS ISO and builds
+# a Docker container image suitable for use with Containerlab.
+#
+# Requirements:
+#   - 7z (p7zip-full package)
+#   - sqfs2tar (squashfs-tools-ng package)
+#   - docker
+#
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+DOCKERFILE="${SCRIPT_DIR}/../Dockerfile.containerlab"
+
+usage() {
+    echo "Usage: $0 <iso-path> [image-name:tag]"
+    echo ""
+    echo "Converts a VyOS ISO to a Docker container image."
+    echo ""
+    echo "Arguments:"
+    echo "  iso-path      Path to VyOS ISO file"
+    echo "  image-tag     Docker image name:tag (default: vyos-gateway:test)"
+    echo ""
+    echo "Requirements:"
+    echo "  - 7z (p7zip-full package)"
+    echo "  - sqfs2tar (squashfs-tools-ng package)"
+    echo "  - docker"
+    exit 1
+}
+
+if [[ $# -lt 1 ]]; then
+    usage
+fi
+
+ISO_PATH="$1"
+IMAGE_TAG="${2:-vyos-gateway:test}"
+WORK_DIR="${TMPDIR:-/tmp}/vyos-container-$$"
+
+if [[ ! -f "${ISO_PATH}" ]]; then
+    echo "ERROR: ISO file not found: ${ISO_PATH}"
+    exit 1
+fi
+
+if [[ ! -f "${DOCKERFILE}" ]]; then
+    echo "ERROR: Dockerfile not found: ${DOCKERFILE}"
+    exit 1
+fi
+
+for cmd in 7z sqfs2tar docker; do
+    if ! command -v "${cmd}" &>/dev/null; then
+        echo "ERROR: Required command not found: ${cmd}"
+        exit 1
+    fi
+done
+
+cleanup() {
+    rm -rf "${WORK_DIR}"
+}
+trap cleanup EXIT
+
+mkdir -p "${WORK_DIR}"
+
+echo "Extracting squashfs from ISO..."
+7z x -o"${WORK_DIR}" "${ISO_PATH}" "live/filesystem.squashfs" -y >/dev/null
+
+SQUASHFS="${WORK_DIR}/live/filesystem.squashfs"
+if [[ ! -f "${SQUASHFS}" ]]; then
+    echo "ERROR: filesystem.squashfs not found in ISO"
+    echo "Contents of ${WORK_DIR}:"
+    find "${WORK_DIR}" -type f
+    exit 1
+fi
+
+echo "Converting squashfs to rootfs.tar..."
+ROOTFS_TAR="${WORK_DIR}/rootfs.tar"
+sqfs2tar "${SQUASHFS}" > "${ROOTFS_TAR}"
+echo "rootfs.tar size: $(ls -lh "${ROOTFS_TAR}" | awk '{print $5}')"
+
+echo "Building container image: ${IMAGE_TAG}..."
+BUILD_CONTEXT="${WORK_DIR}/build"
+mkdir -p "${BUILD_CONTEXT}"
+cp "${ROOTFS_TAR}" "${BUILD_CONTEXT}/rootfs.tar"
+cp "${DOCKERFILE}" "${BUILD_CONTEXT}/Dockerfile"
+
+docker build -t "${IMAGE_TAG}" -f "${BUILD_CONTEXT}/Dockerfile" "${BUILD_CONTEXT}"
+
+echo "Container image built successfully: ${IMAGE_TAG}"
+docker images "${IMAGE_TAG%%:*}" --format "table {{.Repository}}\t{{.Tag}}\t{{.Size}}"

infrastructure/network/vyos/vyos-build/build-flavors/gateway.toml → infrastructure/network/vyos/templates/gateway.toml

@@ -60,10 +60,8 @@ firewall {
             rule 10 {
                 action accept
                 description "Allow established/related"
-                state {
-                    established
-                    related
-                }
+                state established
+                state related
             }
             rule 20 {
                 action drop
@@ -73,19 +71,15 @@ firewall {
                         network-group HOME_NETWORK
                     }
                 }
-                state {
-                    new
-                }
+                state new
             }
         }
         name LOCAL {
             default-action drop
             rule 10 {
                 action accept
-                state {
-                    established
-                    related
-                }
+                state established
+                state related
             }
             rule 20 {
                 action accept
@@ -163,10 +157,8 @@ firewall {
             rule 10 {
                 action accept
                 description "Allow established/related"
-                state {
-                    established
-                    related
-                }
+                state established
+                state related
             }
             rule 20 {
                 action accept
@@ -291,6 +283,7 @@ service {
     }
     dhcp-server {
         shared-network-name LAB_MGMT {
+            interface eth5.10
             subnet 10.10.10.0/24 {
                 lease 86400
                 option {