Skip to content

Commit 0d030b4

Browse files
hellthellt
authored
EDA grpc config for SR Linux nodes (srl-labs#2368)
* added eda config blocks * use env var CLAB_EDA_MODE to change the TLS profile from clab-profile to EDA for EDA management * Revert "use env var CLAB_EDA_MODE to change the TLS profile from clab-profile to EDA for EDA management" This reverts commit 90dcbad. * add both env var based and default eda management configs
1 parent dc316b3 commit 0d030b4

File tree

4 files changed

+99
-3
lines changed

4 files changed

+99
-3
lines changed

‎nodes/srl/eda.go‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
package srl
2+
3+
// edaDiscoveryServerConfig contains configuration for the EDA discovery server.
4+
const edaDiscoveryServerConfig = `!!! EDA Discovery gRPC server
5+
set / system grpc-server eda-discovery services [ gnmi gnsi ]
6+
set / system grpc-server eda-discovery admin-state enable
7+
set / system grpc-server eda-discovery port 50052
8+
set / system grpc-server eda-discovery rate-limit 65535
9+
set / system grpc-server eda-discovery session-limit 1024
10+
set / system grpc-server eda-discovery metadata-authentication true
11+
set / system grpc-server eda-discovery default-tls-profile true
12+
set / system grpc-server eda-discovery network-instance mgmt
13+
14+
!!! ACL rules allowing incoming tcp/50052 for the eda-discovery grpc server
15+
set / acl acl-filter cpm type ipv4 entry 355 description "Containerlab-added rule: Accept incoming gRPC over port 50052 for the eda-discovery gRPC server"
16+
set / acl acl-filter cpm type ipv4 entry 355 match ipv4 protocol tcp
17+
set / acl acl-filter cpm type ipv4 entry 355 match transport destination-port operator eq
18+
set / acl acl-filter cpm type ipv4 entry 355 match transport destination-port value 50052
19+
set / acl acl-filter cpm type ipv4 entry 355 action accept
20+
21+
set / acl acl-filter cpm type ipv6 entry 365 description "Containerlab-added rule: Accept incoming gRPC over port 50052 for the eda-discovery gRPC server"
22+
set / acl acl-filter cpm type ipv6 entry 365 match ipv6 next-header tcp
23+
set / acl acl-filter cpm type ipv6 entry 365 match transport destination-port operator eq
24+
set / acl acl-filter cpm type ipv6 entry 365 match transport destination-port value 50052
25+
set / acl acl-filter cpm type ipv6 entry 365 action accept`
26+
27+
// edaCustomMgmtServerConfig contains configuration for the EDA management servers
28+
// running over custom ports.
29+
const edaCustomMgmtServerConfig = `!!! EDA Management gRPC server
30+
set / system grpc-server eda-mgmt services [ gnmi gnoi gnsi ]
31+
set / system grpc-server eda-mgmt admin-state enable
32+
set / system grpc-server eda-mgmt port 57410
33+
set / system grpc-server eda-mgmt rate-limit 65535
34+
set / system grpc-server eda-mgmt session-limit 1024
35+
set / system grpc-server eda-mgmt metadata-authentication true
36+
set / system grpc-server eda-mgmt tls-profile EDA
37+
set / system grpc-server eda-mgmt network-instance mgmt
38+
39+
!!! ACL rules allowing incoming tcp/57410 for the eda-discovery grpc server
40+
set / acl acl-filter cpm type ipv4 entry 356 description "Containerlab-added rule: Accept incoming gRPC over port 57410 for the eda-mgmt gRPC server"
41+
set / acl acl-filter cpm type ipv4 entry 356 match ipv4 protocol tcp
42+
set / acl acl-filter cpm type ipv4 entry 356 match transport destination-port operator eq
43+
set / acl acl-filter cpm type ipv4 entry 356 match transport destination-port value 57410
44+
set / acl acl-filter cpm type ipv4 entry 356 action accept
45+
46+
set / acl acl-filter cpm type ipv6 entry 366 description "Containerlab-added rule: Accept incoming gRPC over port 57410 for the eda-mgmt gRPC server"
47+
set / acl acl-filter cpm type ipv6 entry 366 match ipv6 next-header tcp
48+
set / acl acl-filter cpm type ipv6 entry 366 match transport destination-port operator eq
49+
set / acl acl-filter cpm type ipv6 entry 366 match transport destination-port value 57410
50+
set / acl acl-filter cpm type ipv6 entry 366 action accept
51+
52+
!!! EDA Management (insecure) gRPC server
53+
set / system grpc-server eda-insecure-mgmt services [ gnmi gnoi gnsi ]
54+
set / system grpc-server eda-insecure-mgmt admin-state enable
55+
set / system grpc-server eda-insecure-mgmt port 57411
56+
set / system grpc-server eda-insecure-mgmt rate-limit 65535
57+
set / system grpc-server eda-insecure-mgmt session-limit 1024
58+
set / system grpc-server eda-insecure-mgmt metadata-authentication true
59+
set / system grpc-server eda-mgmt network-instance mgmt
60+
61+
!!! ACL rules allowing incoming tcp/57411 for the eda-discovery grpc server
62+
set / acl acl-filter cpm type ipv4 entry 357 description "Containerlab-added rule: Accept incoming gRPC over port 57411 for the eda-mgmt gRPC server"
63+
set / acl acl-filter cpm type ipv4 entry 357 match ipv4 protocol tcp
64+
set / acl acl-filter cpm type ipv4 entry 357 match transport destination-port operator eq
65+
set / acl acl-filter cpm type ipv4 entry 357 match transport destination-port value 57411
66+
set / acl acl-filter cpm type ipv4 entry 357 action accept
67+
68+
set / acl acl-filter cpm type ipv6 entry 367 description "Containerlab-added rule: Accept incoming gRPC over port 57411 for the eda-mgmt gRPC server"
69+
set / acl acl-filter cpm type ipv6 entry 367 match ipv6 next-header tcp
70+
set / acl acl-filter cpm type ipv6 entry 367 match transport destination-port operator eq
71+
set / acl acl-filter cpm type ipv6 entry 367 match transport destination-port value 57411
72+
set / acl acl-filter cpm type ipv6 entry 367 action accept`
73+
74+
// edaDefaultMgmtServerConfig is the configuration blob that sets EDA TLS profile
75+
// for the `mgmt` grpc server running over port 57400,
76+
// it is applied when CLAB_EDA_USE_DEFAULT_GRPC_SERVER is set.
77+
const edaDefaultMgmtServerConfig = `set / system grpc-server mgmt metadata-authentication true
78+
set / system grpc-server mgmt tls-profile EDA`

‎nodes/srl/srl.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -535,6 +535,8 @@ type srlTemplateData struct {
535535
ACLConfig string
536536
// NetconfConfig is a string containing Netconf server configuration
537537
NetconfConfig string
538+
// EDAConfig is a string containing EDA configuration
539+
EDAConfig string
538540
}
539541

540542
// tplIFace template interface struct.

‎nodes/srl/srl_default_config.go.tpl‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@ set / system tls server-profile clab-profile authenticate-client false
1313

1414
{{ .GRPCConfig }}
1515

16+
{{ .EDAConfig }}
17+
1618
{{- if .EnableGNMIUnixSockServices }}
1719
system gnmi-server unix-socket services [ gnmi gnoi ] admin-state enable
1820
{{- end }}

‎nodes/srl/version.go‎

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ package srl
22

33
import (
44
"context"
5+
"os"
56
"regexp"
67

78
log "github.com/sirupsen/logrus"
@@ -61,11 +62,11 @@ set / acl acl-filter cpm type ipv6 entry 188 match transport destination-port va
6162
set / acl acl-filter cpm type ipv6 entry 188 action accept`
6263

6364
// grpc contains the grpc server(s) configuration for srlinux versions >= 24.3.
64-
// It consists of the gNMI, gNOI, gRIBI, and p4RT services enabled on the `mgmt`
65+
// It consists of the gNMI, gNOI, gNSI, gRIBI, and p4RT services enabled on the `mgmt`
6566
// grpc server instance with a custom TLS profile.
6667
// And in addition to the TLS secured services, the `insecure-mgmt` server instance
6768
// is created that provides the same services but without TLS.
68-
grpcConfig = `set / system grpc-server mgmt services [ gnmi gnoi gribi p4rt ]
69+
grpcConfig = `set / system grpc-server mgmt services [ gnmi gnoi gnsi gribi p4rt ]
6970
set / system grpc-server mgmt tls-profile clab-profile
7071
set / system grpc-server mgmt rate-limit 65000
7172
set / system grpc-server mgmt network-instance mgmt
@@ -74,7 +75,7 @@ set / system grpc-server mgmt unix-socket admin-state enable
7475
set / system grpc-server mgmt admin-state enable
7576
delete / system grpc-server mgmt default-tls-profile
7677
77-
set / system grpc-server insecure-mgmt services [ gnmi gnoi gribi p4rt ]
78+
set / system grpc-server insecure-mgmt services [ gnmi gnoi gnsi gribi p4rt ]
7879
set / system grpc-server insecure-mgmt port 57401
7980
set / system grpc-server insecure-mgmt rate-limit 65000
8081
set / system grpc-server insecure-mgmt network-instance mgmt
@@ -189,4 +190,17 @@ func (n *srl) setVersionSpecificParams(tplData *srlTemplateData) {
189190

190191
tplData.GRPCConfig = grpcConfigPre24_3
191192
}
193+
194+
// in srlinux >= v24.10+ we add EDA configuration.
195+
if semver.Compare(v, "v24.10") >= 0 || n.swVersion.Major == "0" {
196+
cfg := edaDiscoveryServerConfig
197+
198+
if os.Getenv("CLAB_EDA_USE_DEFAULT_GRPC_SERVER") != "" {
199+
cfg = cfg + "\n" + edaDefaultMgmtServerConfig
200+
} else {
201+
cfg = cfg + "\n" + edaCustomMgmtServerConfig
202+
}
203+
204+
tplData.EDAConfig = cfg
205+
}
192206
}

0 commit comments

Comments
 (0)