Bind default namespace database container to midplane ip #23837

manish1-arista · 2025-08-28T09:20:14Z

This feature has been tracked at: sonic-net/SONiC#2020

Why I did it

On a linecard, the default namespace database container is only bound to localhost (127.0.0.1).
This prevents other components in the chassis, such as the supervisor card,
from accessing the linecard's default namespace database over the midplane network to aggregate the VOQ counters for Single ASIC Linecards.

Work item tracking

Microsoft ADO (number only):

How I did it

Set the protected-mode no and bind the linecard's eth1-midplane IP address to the default namespace database container, allowing for remote access from the supervisor to collect the VOQ counters.

How to verify it

Check1: Default Namespace Database container on LC should not be in protected Mode

Before:

docker exec -it database redis-cli config get protected-mode

##### Command Output #####
1) "protected-mode"
2) "yes"
#########################

After:

docker exec -it database redis-cli config get protected-mode

##### Command Output #####
1) "protected-mode"
2) "no"
#########################

Check2: Default Namespace Database container on LC bind with a midplane IP
Before:

# Command to check the midplane IPs binded to the redis DB
docker exec -it database redis-cli config get bind

##### Command Output #####
1) "bind"
2) "127.0.0.1"
#########################

After:

# Command to check the midplane IPs binded to the redis DB
docker exec -it database redis-cli config get bind

##### Command Output #####
1) "bind"
2) "127.0.0.1 127.100.3.1"
#########################

Check3: No database container on supervisor is affected(protection mode or midplane IPs)

Before:

---Config for: 'database5' ---
  protected-mode: no
  bind: 127.0.0.1 240.127.1.13
---Config for: 'database11' ---
  protected-mode: no
  bind: 127.0.0.1 240.127.1.9
---Config for: 'database8' ---
  protected-mode: no
  bind: 127.0.0.1 240.127.1.12
---Config for: 'database6' ---
  protected-mode: no
  bind: 127.0.0.1 240.127.1.10
---Config for: 'database7' ---
  protected-mode: no
  bind: 127.0.0.1 240.127.1.11
---Config for: 'database0' ---
  protected-mode: no
  bind: 127.0.0.1 240.127.1.8
---Config for: 'database9' ---
  protected-mode: no
  bind: 127.0.0.1 240.127.1.4
---Config for: 'database1' ---
  protected-mode: no
  bind: 127.0.0.1 240.127.1.6
---Config for: 'database2' ---
  protected-mode: no
  bind: 127.0.0.1 240.127.1.7
---Config for: 'database3' ---
  protected-mode: no
  bind: 127.0.0.1 240.127.1.5
---Config for: 'database4' ---
  protected-mode: no
  bind: 127.0.0.1 240.127.1.3
---Config for: 'database10' ---
  protected-mode: no
  bind: 127.0.0.1 240.127.1.2
---Config for: 'database' ---
  protected-mode: yes
  bind: 127.0.0.1
--- Config for: 'database-chassis' ---
  protected-mode: no
  bind: redis_chassis.server

After:

---Config for: 'database5' ---
  protected-mode: no
  bind: 127.0.0.1 240.127.1.13
---Config for: 'database11' ---
  protected-mode: no
  bind: 127.0.0.1 240.127.1.9
---Config for: 'database8' ---
  protected-mode: no
  bind: 127.0.0.1 240.127.1.12
---Config for: 'database6' ---
  protected-mode: no
  bind: 127.0.0.1 240.127.1.10
---Config for: 'database7' ---
  protected-mode: no
  bind: 127.0.0.1 240.127.1.11
---Config for: 'database0' ---
  protected-mode: no
  bind: 127.0.0.1 240.127.1.8
---Config for: 'database9' ---
  protected-mode: no
  bind: 127.0.0.1 240.127.1.4
---Config for: 'database1' ---
  protected-mode: no
  bind: 127.0.0.1 240.127.1.6
---Config for: 'database2' ---
  protected-mode: no
  bind: 127.0.0.1 240.127.1.7
---Config for: 'database3' ---
  protected-mode: no
  bind: 127.0.0.1 240.127.1.5
---Config for: 'database4' ---
  protected-mode: no
  bind: 127.0.0.1 240.127.1.3
---Config for: 'database10' ---
  protected-mode: no
  bind: 127.0.0.1 240.127.1.2
---Config for: 'database' ---
  protected-mode: yes
  bind: 127.0.0.1
--- Config for: 'database-chassis' ---
  protected-mode: no
  bind: redis_chassis.server

Check4: Aggregate VOQ command is working properly for the Single ASIC Linecards on supervisor

## Working on Supervisor for single Asic LC 

###### OUTPUT ######
admin@cmp312:~$ show queue counters "cmp312-3|Asic0|Ethernet156" --voq
                      Port    Voq    Counter/pkts    Counter/bytes    Drop/pkts    Drop/bytes    Credit-WD-Del/pkts
--------------------------  -----  --------------  ---------------  -----------  ------------  --------------------
cmp312-3|Asic0|Ethernet156   VOQ0              19              950            0             0                     0
cmp312-3|Asic0|Ethernet156   VOQ1               0                0            0             0                     0
cmp312-3|Asic0|Ethernet156   VOQ2               0                0            0             0                     0
cmp312-3|Asic0|Ethernet156   VOQ3               0                0            0             0                     0
cmp312-3|Asic0|Ethernet156   VOQ4              19              950            0             0                     0
cmp312-3|Asic0|Ethernet156   VOQ5               0                0            0             0                     0
cmp312-3|Asic0|Ethernet156   VOQ6               0                0            0             0                     0
cmp312-3|Asic0|Ethernet156   VOQ7             173            52706            0             0                     0

Check5: Fixed systems the database container is on protected mode

Before:

# Command to check the protection mode
docker exec -it database redis-cli config get protected-mode


##### Command Output #####
1) "protected-mode"
2) "yes"
#########################


# Command to check the midplane Ips binded to the redis DB
docker exec -it database redis-cli config get bind

##### Command Output #####
1) "bind"
2) "127.0.0.1"
#########################

After:

# Command to check the protection mode
docker exec -it database redis-cli config get protected-mode


##### Command Output #####
1) "protected-mode"
2) "yes"
#########################


# Command to check the midplane Ips binded to the redis DB
docker exec -it database redis-cli config get bind

##### Command Output #####
1) "bind"
2) "127.0.0.1"
#########################

Which release branch to backport (provide reason below if selected)

Tested branch (Please provide the tested image version)

Master

Description for the changelog

Link to config_db schema for YANG module changes

A picture of a cute animal (not mandatory but encouraged)

mssonicbld · 2025-08-28T09:20:21Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2025-08-28T09:20:39Z

Azure Pipelines successfully started running 1 pipeline(s).

vivekverma-arista · 2025-08-28T17:06:42Z

@qiluo-msft @arlakshm @judyjoseph please review. This is a continuation of: #20803 for single ASIC linecards

cc @kenneth-arista @pandurangan-arista @vmittal-msft

abdosi · 2025-09-17T17:26:53Z

can we update PR subject as this is more of infrastructure change

vmittal-msft · 2025-09-24T00:18:08Z

@manish1-arista Did we make sure it is not impacting exiting T2 VoQ stats aggregation? Also, please update subject as per Abhishek comment.

manish1-arista · 2025-09-24T09:21:31Z

can we update PR subject as this is more of infrastructure change

Updated

manish1-arista · 2025-09-24T09:25:41Z

@manish1-arista Did we make sure it is not impacting exiting T2 VoQ stats aggregation? Also, please update subject as per Abhishek comment.

Yes, we have verified this. The changes do not cause any regressions to the existing T2 VoQ stats aggregation.

files/build_templates/docker_image_ctl.j2

judyjoseph · 2025-10-08T16:44:11Z

@manish1-arista, please add to PR description(How did you verify) before and after test results of this change in communication between LC host database <--> chassis db in sup

judyjoseph · 2025-10-08T16:44:22Z

/azp run

judyjoseph · 2025-10-08T16:44:37Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2025-10-08T16:44:38Z

Azure Pipelines successfully started running 1 pipeline(s).

azure-pipelines · 2025-10-08T16:44:48Z

Azure Pipelines successfully started running 1 pipeline(s).

On a linecard, the database container is bound to localhost (127.0.0.1) by default. This prevents other components in the chassis, such as the supervisor card, from accessing the linecard's database over the midplane network. This change exposes the database instance to the midplane, allowing for remote access from the supervisor. Signed-off-by: manish <[email protected]>

mssonicbld · 2025-10-29T06:39:41Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2025-10-29T06:39:54Z

Azure Pipelines successfully started running 1 pipeline(s).

manish1-arista · 2025-11-10T05:43:23Z

@manish1-arista, please add to PR description(How did you verify) before and after test results of this change in communication between LC host database <--> chassis db in sup

Updated the PR Description(How did you verify) with the detailed testing done for all the database containers on SUP and LC

vmittal-msft

@manish1-arista is there a way to do protected mode == on after binding midplane ip to database container ?

vivekverma-arista · 2025-11-11T06:34:22Z

@rlhui @judyjoseph please help in merging

manish1-arista · 2025-11-11T08:26:51Z

@manish1-arista is there a way to do protected mode == on after binding midplane ip to database container ?

Yes, protected-mode can be set to yes by this command
docker exec -it database redis-cli config set protected-mode yes

If we set it to yes, then midplane IP will still be binded but database cannot be accessed over midplane due to protected-mode

rlhui · 2025-11-11T16:50:33Z

@rlhui @judyjoseph please help in merging

PR build is not passing, could you please check why/address?

mssonicbld · 2025-11-13T06:09:57Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2025-11-13T06:10:09Z

Azure Pipelines successfully started running 1 pipeline(s).

mssonicbld · 2025-11-18T07:46:55Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2025-11-18T07:47:10Z

Azure Pipelines successfully started running 1 pipeline(s).

vivekverma-arista · 2025-11-18T19:10:46Z

@rlhui PR checks have passed

manish1-arista requested a review from lguohan as a code owner August 28, 2025 09:20

This was referenced Aug 28, 2025

Support aggregation of VOQ counters for single ASIC linecards sonic-net/SONiC#2020

Open

Add HLD for aggregate VOQ counters. sonic-net/SONiC#1957

Merged

kenneth-arista added this to SONiC Chassis Sep 10, 2025

abdosi requested review from anamehra, eswaran-nexthop and mlok-nokia September 17, 2025 17:27

manish1-arista changed the title ~~Add Aggregate VOQ counters support for single ASIC linecards~~ Bind default namespace database container to midplane ip Sep 24, 2025

rlhui requested a review from judyjoseph October 2, 2025 05:07

rlhui assigned manish1-arista Oct 2, 2025

judyjoseph reviewed Oct 8, 2025

View reviewed changes

files/build_templates/docker_image_ctl.j2 Outdated Show resolved Hide resolved

judyjoseph reviewed Oct 8, 2025

View reviewed changes

files/build_templates/docker_image_ctl.j2 Show resolved Hide resolved

manish1-arista force-pushed the bind_linecard_db_to_midplane_ip branch from fcde75e to d23b8db Compare October 29, 2025 06:39

vmittal-msft approved these changes Nov 10, 2025

View reviewed changes

Merge branch 'sonic-net:master' into bind_linecard_db_to_midplane_ip

f38bfb7

Merge branch 'sonic-net:master' into bind_linecard_db_to_midplane_ip

3c3c358

judyjoseph approved these changes Nov 21, 2025

View reviewed changes

Bind default namespace database container to midplane ip #23837

Are you sure you want to change the base?

Bind default namespace database container to midplane ip #23837

Uh oh!

Conversation

manish1-arista commented Aug 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why I did it

Work item tracking

How I did it

How to verify it

Which release branch to backport (provide reason below if selected)

Tested branch (Please provide the tested image version)

Description for the changelog

Link to config_db schema for YANG module changes

A picture of a cute animal (not mandatory but encouraged)

Uh oh!

mssonicbld commented Aug 28, 2025

Uh oh!

azure-pipelines bot commented Aug 28, 2025

Uh oh!

vivekverma-arista commented Aug 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

abdosi commented Sep 17, 2025

Uh oh!

vmittal-msft commented Sep 24, 2025

Uh oh!

manish1-arista commented Sep 24, 2025

Uh oh!

manish1-arista commented Sep 24, 2025

Uh oh!

Uh oh!

Uh oh!

judyjoseph commented Oct 8, 2025

Uh oh!

judyjoseph commented Oct 8, 2025

Uh oh!

judyjoseph commented Oct 8, 2025

Uh oh!

azure-pipelines bot commented Oct 8, 2025

Uh oh!

azure-pipelines bot commented Oct 8, 2025

Uh oh!

mssonicbld commented Oct 29, 2025

Uh oh!

azure-pipelines bot commented Oct 29, 2025

Uh oh!

manish1-arista commented Nov 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vmittal-msft left a comment

Choose a reason for hiding this comment

Uh oh!

vivekverma-arista commented Nov 11, 2025

Uh oh!

manish1-arista commented Nov 11, 2025

Uh oh!

rlhui commented Nov 11, 2025

Uh oh!

mssonicbld commented Nov 13, 2025

Uh oh!

azure-pipelines bot commented Nov 13, 2025

Uh oh!

mssonicbld commented Nov 18, 2025

Uh oh!

azure-pipelines bot commented Nov 18, 2025

Uh oh!

vivekverma-arista commented Nov 18, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

manish1-arista commented Aug 28, 2025 •

edited

Loading

vivekverma-arista commented Aug 28, 2025 •

edited

Loading

manish1-arista commented Nov 10, 2025 •

edited

Loading