iproute2 versions since v4.10.0 (which are not yet in Debian) have the 'ip vrf exec' subcommand, which needs CONFIG_CGROUP_BPF as well.