I changed the stop script to this:

#!/bin/vbash

Just checked with the current rolling release 1.5-rolling-202404141045. After committing set high-availability disable, keepalived is successfully stopped and the logs show that the transition script seems to be executed:

Just to make sure: This change is part of the current nightly build, right?

I see, looks like a way more streamlined approach. Thank you for the information and the quick response!

Good to hear that this was implemented, thank you! Could you elaborate in which release this feature will be available?

Hmm, fair enough. Maybe just executing the stop script and then committing set high-availability disable is enough for maintenance periods.
One general question though out of curiosity: What are the circumstances in which the stop script is executed in the first place?

Just tested again with 1.3.3. When setting set firewall send-redirects enable, ICMP redirects work fine until I reboot the router.
Before rebooting:

root@vyos:~# sysctl -a | grep send_redirect
net.ipv4.conf.all.send_redirects = 1
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.eth0.send_redirects = 0
net.ipv4.conf.eth1.send_redirects = 0
net.ipv4.conf.eth2.send_redirects = 0
net.ipv4.conf.eth3.send_redirects = 0
net.ipv4.conf.lo.send_redirects = 0
net.ipv4.conf.wg0.send_redirects = 0

After rebooting:

root@vyos:~# sysctl -a | grep send_redirect
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.eth0.send_redirects = 0
net.ipv4.conf.eth1.send_redirects = 0
net.ipv4.conf.eth2.send_redirects = 0
net.ipv4.conf.eth3.send_redirects = 0
net.ipv4.conf.lo.send_redirects = 1
net.ipv4.conf.wg0.send_redirects = 0

Sorry to write on a closed task, but without specifying a vrf (or some kind of identifier for that matter), how will the DHCP server decide which shared network to use since they have identical subnets configured?

Looking at the regex it seems that . (dot) is also allowed. Is that right? If so, the error message should be altered accordingly.

I can confirm that after adding the aforementioned code block to my scripts everything works as expected.

I'll take a look at the guidelines to contribute, thank you!

Thank you for the clarification, I will edit my scripts accordingly. I was under the impression that VRRP transition scripts are called with the vyattacfg group out of the box, since there is an example in the documentation which has the sg part missing: https://docs.vyos.io/en/latest/automation/command-scripting.html#run-configuration-commands