[bgp] Add bgpd.aggregate.conf.j2 template and sonic-cfggen test cases for BGP_AGGREGATE_ADDRESS bootstrap rendering

[Copilot]

Adds the bgpd.aggregate.conf.j2 bootstrap template that renders BGP_AGGREGATE_ADDRESS entries into FRR's bgpd.conf before any BGP session is established, closing the transient route-leak window on cold boot / restart bgp. Also adds sonic-cfggen golden tests covering the new template's rendering logic.

Why I did it

On a T1 aggregation router, AggregateAddressMgr installs suppression only after bgpd is running. Without a bootstrap aggregate, contributing more-specifics escape to T2 peers between session bring-up and manager reconciliation. This template-only fix pre-renders the aggregate config so suppression exists before any peer reaches Established.

Work item tracking

• Microsoft ADO (number only):

How I did it

New template dockers/docker-fpm-frr/frr/bgpd/bgpd.aggregate.conf.j2:

• Iterates BGP_AGGREGATE_ADDRESS from CONFIG_DB and emits prefix-list and aggregate-address stanzas mirroring managers_aggregate_address.py byte-for-byte (idempotent reconcile)
• Safety gates:
  • Strict prefix validation — rejects host bits (validate_prefix(strict=True) parity)
  • BBR gate — bbr-required=true entries only rendered when BGP_BBR|all status == "enabled" is explicitly present (no constants.yml fallback)
  • seq >= 10 on prefix-list entries to avoid collision with policy.conf.j2 anchor at seq 5

Updated dockers/docker-fpm-frr/frr/bgpd/bgpd.conf.j2: includes the new template before bgpd.main.conf.j2, guarded by BGP_AGGREGATE_ADDRESS is defined.

New sonic-cfggen tests under src/sonic-bgpcfgd/tests/data/sonic-cfggen/bgpd.aggregate.conf.j2/:

Test	Scenario
ipv4_basic	IPv4 aggregate + prefix-lists + summary-only
ipv6_basic	IPv6 aggregate + prefix-lists
bbr_required_enabled	bbr-required=true with BGP_BBR enabled → rendered
bbr_required_disabled	bbr-required=true, no BGP_BBR → excluded (empty output)

Four corresponding test functions added to test_sonic-cfggen.py.

How to verify it

cd src/sonic-bgpcfgd
pytest tests/test_sonic-cfggen.py -k "aggregate"

Expected: all four test_bgpd_aggregate_conf_* tests pass.

Which release branch to backport (provide reason below if selected)

• 202305
• 202311
• 202405
• 202411
• 202505
• 202511
• 202512
• 202605
• 202608

Tracking issue/work item for backport/cherry-pick request (GitHub issue or Microsoft ADO):
Failure type:

Tested branch

• master
• 202305
• 202311
• 202405
• 202411
• 202505
• 202511
• 202512
• 202605
• 202608
• N/A

Test result

Template rendering verified locally via ConfigMgr.to_canonical() comparison across all four test vectors.

Description for the changelog

Add bgpd.aggregate.conf.j2 template to render BGP_AGGREGATE_ADDRESS into bootstrap bgpd.conf, eliminating transient route-leak window on BGP restart; add sonic-cfggen golden tests.

Link to config_db schema for YANG module changes

A picture of a cute animal (not mandatory but encouraged)

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[mssonicbld]

/azp run Azure.sonic-buildimage

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[azure-pipelines]

Azure Pipelines:
1 pipeline(s) were filtered out due to trigger conditions.

[mssonicbld]

Hi, there are workflow run(s) waiting for approval, you may be first-time contributor. I will notify maintainers to help approve once PR is approved. Thanks!

_{---Powered by SONiC BuildBot}

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[mssonicbld]

/azp run Azure.sonic-buildimage

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).