Skip to content

Commit 84e8ae5

Browse files
mssonicbldmssonicbld
committed
Add gNSI Authz, Certz, and Pathz YANG models
This PR introduces the new YANG models for gNSI Authz, Certz, Pathz and Credentialz. And, updates the list to include the new models. **Dependency Chain for Merge** Please follow this merge order, 1. Current PR: sonic-mgmt-common #[183 ](sonic-net#183 be merged first) 2. Incremental PR: sonic-mgmt-common #[184](sonic-net#184) 3. Frontend: sonic-gnmi #[508](sonic-net/sonic-gnmi#508)
1 parent 6205cd7 commit 84e8ae5

File tree

5 files changed

+943
-0
lines changed

5 files changed

+943
-0
lines changed

‎config/transformer/models_list‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,3 +11,7 @@ openconfig-if-aggregate.yang
1111
openconfig-mclag.yang
1212
openconfig-mclag-annot.yang
1313
openconfig-vlan.yang
14+
gnsi-authz.yang
15+
gnsi-pathz.yang
16+
gnsi-certz.yang
17+
gnsi-credentialz.yang

‎models/yang/gnsi-authz.yang‎

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
module gnsi-authz {
2+
yang-version 1.1;
3+
namespace "https://github.com/openconfig/gnsi/authz/yang";
4+
prefix gnsi-authz;
5+
import openconfig-system {
6+
prefix oc-sys;
7+
}
8+
import openconfig-system-grpc {
9+
prefix oc-sys-grpc;
10+
}
11+
import openconfig-types {
12+
prefix oc-types;
13+
}
14+
import openconfig-yang-types {
15+
prefix oc-yang;
16+
}
17+
organization
18+
"Google LLC";
19+
contact
20+
"Google LLC";
21+
description
22+
"This module provides a data model for the metadata of the gRPC
23+
authorization policies installed on a networking device.";
24+
revision 2022-10-30 {
25+
description
26+
"Adds success/failure counters.";
27+
reference "0.3.0";
28+
}
29+
revision 2022-08-01 {
30+
description
31+
"Single authz policy.";
32+
reference "0.2.0";
33+
}
34+
revision 2022-01-17 {
35+
description
36+
"Initial revision.";
37+
reference "0.1.0";
38+
}
39+
typedef version {
40+
type string;
41+
description
42+
"The version ID of the gRPC authorization policy as provided by
43+
the gRPC Authorization Policy Manager when the policy was pushed.
44+
This leaf persists through a reboot.";
45+
}
46+
typedef created-on {
47+
type oc-types:timeticks64;
48+
description
49+
"The creation time of the gRPC authorization policy as reported by
50+
the gRPC Authorization Policy manager when the policy was pushed
51+
to the device. This value is reported as nanoseconds since epoch
52+
(January 1st, 1970 00:00:00 GMT). This leaf persists through
53+
a reboot.";
54+
}
55+
// gRPC server authorization policy related definitions.
56+
grouping counters {
57+
description
58+
"A collection of counters that were collected by the gNSI.authz
59+
module while evaluating access to a RPC.";
60+
leaf access-rejects {
61+
type oc-yang:counter64;
62+
description
63+
"The total number of times the gNSI.authz module denied access
64+
to a RPC.";
65+
}
66+
leaf last-access-reject {
67+
type oc-types:timeticks64;
68+
description
69+
"A timestamp of the last time the gNSI.authz denied access to
70+
a RPC.";
71+
}
72+
leaf access-accepts {
73+
type oc-yang:counter64;
74+
description
75+
"The total number of times the gNSI.authz module allowed access
76+
to a RPC.";
77+
}
78+
leaf last-access-accept {
79+
type oc-types:timeticks64;
80+
description
81+
"A timestamp of the last time the gNSI.authz allowed access to
82+
a RPC.";
83+
}
84+
}
85+
grouping grpc-server-user-authz-policy-success-failure-counters {
86+
description
87+
"A collection of counters collected by the gNSI.authz module.";
88+
container rpcs {
89+
description
90+
"A collection of counters collected by the gNSI.authz module
91+
for each RPC separately.";
92+
list rpc {
93+
description
94+
"A collection of counters collected by the gNSI.authz module
95+
for a RPC identified by the `name`.";
96+
key name;
97+
leaf name {
98+
type leafref {
99+
path "../state/name";
100+
}
101+
description
102+
"The name of the RPC the counters were collected for.";
103+
}
104+
container state {
105+
leaf name {
106+
type string;
107+
description
108+
"The name of the RPC the counters were collected
109+
for.";
110+
}
111+
uses counters;
112+
}
113+
}
114+
}
115+
}
116+
grouping grpc-server-authz-policy-success-failure-counters {
117+
description
118+
"A collection of counters collected by the gNSI.authz module.";
119+
container authz-policy-counters {
120+
description
121+
"A collection of counters collected by the gNSI.authz module.";
122+
config false;
123+
uses grpc-server-user-authz-policy-success-failure-counters;
124+
}
125+
}
126+
grouping grpc-server-authz-policy-state {
127+
description
128+
"gNMI server's gRPC authorization policy freshness-related data.";
129+
leaf grpc-authz-policy-version {
130+
type version;
131+
description
132+
"The version of the gRPC authorization policy that is used by
133+
this system.";
134+
}
135+
leaf grpc-authz-policy-created-on {
136+
type created-on;
137+
description
138+
"The timestamp of the moment when the gRPC authorization policy
139+
that is currently used by this system was created.";
140+
}
141+
}
142+
// Augments section.
143+
augment "/oc-sys:system/oc-sys:aaa/oc-sys:authorization/" +
144+
"oc-sys:state" {
145+
description
146+
"A system's gRPC authorization policy freshness information.";
147+
uses grpc-server-authz-policy-state;
148+
}
149+
augment "/oc-sys:system/oc-sys-grpc:grpc-servers/oc-sys-grpc:grpc-server" {
150+
description
151+
"Counters collected while evaluating access to a gRPC server using
152+
the gNSI.authz authorization policy.";
153+
uses grpc-server-authz-policy-success-failure-counters;
154+
}
155+
}

‎models/yang/gnsi-certz.yang‎

Lines changed: 187 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,187 @@
1+
module gnsi-certz {
2+
yang-version 1.1;
3+
namespace "https://github.com/openconfig/gnsi/certz/yang";
4+
prefix gnsi-certz;
5+
6+
import openconfig-system {
7+
prefix oc-sys;
8+
}
9+
import openconfig-system-grpc {
10+
prefix oc-sys-grpc;
11+
}
12+
import openconfig-types {
13+
prefix oc-types;
14+
}
15+
import openconfig-yang-types {
16+
prefix oc-yang;
17+
}
18+
organization
19+
"Google LLC";
20+
21+
contact
22+
"Google LLC";
23+
24+
description
25+
"This module provides a data model for the metadata of gRPC credentials
26+
installed on a networking device.";
27+
28+
revision 2023-02-13 {
29+
description
30+
"rename access/reject counters";
31+
reference "0.5.0";
32+
}
33+
34+
revision 2023-08-24 {
35+
description
36+
"Adds ssl-profile-id leaf";
37+
reference "0.4.0";
38+
}
39+
40+
revision 2023-05-10 {
41+
description
42+
"Adds authentication policy freshness information.";
43+
reference "0.3.0";
44+
}
45+
46+
revision 2022-10-30 {
47+
description
48+
"Adds success/failure counters.";
49+
reference "0.2.0";
50+
}
51+
52+
revision 2022-09-20 {
53+
description
54+
"Initial revision.";
55+
reference "0.1.0";
56+
}
57+
58+
typedef version {
59+
type string;
60+
description
61+
"The version ID of the credential as provided by the credential
62+
manager when the credential was pushed. This leaf persists through
63+
a reboot.";
64+
}
65+
66+
typedef created-on {
67+
type oc-types:timeticks64;
68+
description
69+
"The creation time of the credential as reported by the credential
70+
manager when the credential was pushed to the device. This value is
71+
reported as nanoseconds since epoch (January 1st, 1970 00:00:00 GMT).
72+
This leaf persists through a reboot.";
73+
}
74+
// gRPC server related definitions.
75+
// Success/failure counters.
76+
grouping counters {
77+
description
78+
"A collection of counters that were collected while attempting
79+
to establish connections to the gRPC server.";
80+
81+
container counters {
82+
config false;
83+
description
84+
"A collection of counters that were collected by the gRPC during
85+
the authentication process.";
86+
87+
leaf connection-rejects {
88+
type oc-yang:counter64;
89+
description
90+
"The total number of times that gRPC clients have failed
91+
in establishing a connection to the server.";
92+
}
93+
leaf last-connection-reject {
94+
type oc-types:timeticks64;
95+
description
96+
"A timestamp of the last time a gRPC client failed
97+
in establishing a connection to the server.";
98+
}
99+
leaf connection-accepts {
100+
type oc-yang:counter64;
101+
description
102+
"The total number of times that gRPC clients have succeeded
103+
in establishing a connection to the server.";
104+
}
105+
leaf last-connection-accept {
106+
type oc-types:timeticks64;
107+
description
108+
"A timestamp of the last time a gRPC client succeeded
109+
in establishing a connection to the server.";
110+
}
111+
}
112+
}
113+
114+
grouping grpc-server-credentials-state {
115+
description
116+
"gRPC server credentials freshness-related data.";
117+
118+
leaf certificate-version {
119+
type version;
120+
description
121+
"The version of the certificate (and associated
122+
private key) that is used by this gRPC server.";
123+
}
124+
leaf certificate-created-on {
125+
type created-on;
126+
description
127+
"The timestamp of the moment when the certificate
128+
(and associated private key) that is currently used
129+
by this gRPC server was created.";
130+
}
131+
leaf ca-trust-bundle-version {
132+
type version;
133+
description
134+
"The version of the bundle of the Certificate
135+
Authority certificates a.k.a. trust bundle used by
136+
this gRPC server.";
137+
}
138+
leaf ca-trust-bundle-created-on {
139+
type created-on;
140+
description
141+
"The timestamp of the moment when the bundle of
142+
the Certificate Authority certificates (a.k.a.
143+
trust bundle) was created.";
144+
}
145+
leaf certificate-revocation-list-bundle-version {
146+
type version;
147+
description
148+
"The version of the Certificate Revocation List bundle used by
149+
this gRPC server.";
150+
}
151+
leaf certificate-revocation-list-bundle-created-on {
152+
type created-on;
153+
description
154+
"The timestamp of the moment when the Certificate Revocation
155+
List bundle was created.";
156+
}
157+
leaf authentication-policy-version {
158+
type version;
159+
description
160+
"The version of the authentication policy that is used by
161+
this gRPC server.";
162+
}
163+
leaf authentication-policy-created-on {
164+
type created-on;
165+
description
166+
"The timestamp of the moment when the authentication policy
167+
that is currently used by this gRPC server was created.";
168+
}
169+
leaf ssl-profile-id {
170+
type string;
171+
description
172+
"The ID of this gRPC server's SSL profile
173+
as used by the gNSI Certz service";
174+
}
175+
}
176+
177+
// Augments section.
178+
179+
augment "/oc-sys:system/oc-sys-grpc:grpc-servers/oc-sys-grpc:grpc-server/" +
180+
"oc-sys-grpc:state" {
181+
description
182+
"A gRPC server credentials freshness information.";
183+
184+
uses grpc-server-credentials-state;
185+
uses counters;
186+
}
187+
}

0 commit comments

Comments
 (0)