Skip to content

Commit b5f84b0

Browse files
mssonicbldmssonicbld
authored
Add gNSI Authz, Certz, and Pathz YANG models (#199)
This PR introduces the new YANG models for gNSI Authz, Certz, Pathz and Credentialz. And, updates the list to include the new models. **Dependency Chain for Merge** Please follow this merge order, 1. Current PR: sonic-mgmt-common #[183 ](#183 be merged first) 2. Incremental PR: sonic-mgmt-common #[184](#184) 3. Frontend: sonic-gnmi #[508](sonic-net/sonic-gnmi#508)
1 parent 6205cd7 commit b5f84b0

File tree

5 files changed

+943
-0
lines changed

5 files changed

+943
-0
lines changed

‎config/transformer/models_list‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,3 +11,7 @@ openconfig-if-aggregate.yang
1111
openconfig-mclag.yang
1212
openconfig-mclag-annot.yang
1313
openconfig-vlan.yang
14+
gnsi-authz.yang
15+
gnsi-pathz.yang
16+
gnsi-certz.yang
17+
gnsi-credentialz.yang

‎models/yang/gnsi-authz.yang‎

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
module gnsi-authz {
2+
yang-version 1.1;
3+
namespace "https://github.com/openconfig/gnsi/authz/yang";
4+
prefix gnsi-authz;
5+
import openconfig-system {
6+
prefix oc-sys;
7+
}
8+
import openconfig-system-grpc {
9+
prefix oc-sys-grpc;
10+
}
11+
import openconfig-types {
12+
prefix oc-types;
13+
}
14+
import openconfig-yang-types {
15+
prefix oc-yang;
16+
}
17+
organization
18+
"Google LLC";
19+
contact
20+
"Google LLC";
21+
description
22+
"This module provides a data model for the metadata of the gRPC
23+
authorization policies installed on a networking device.";
24+
revision 2022-10-30 {
25+
description
26+
"Adds success/failure counters.";
27+
reference "0.3.0";
28+
}
29+
revision 2022-08-01 {
30+
description
31+
"Single authz policy.";
32+
reference "0.2.0";
33+
}
34+
revision 2022-01-17 {
35+
description
36+
"Initial revision.";
37+
reference "0.1.0";
38+
}
39+
typedef version {
40+
type string;
41+
description
42+
"The version ID of the gRPC authorization policy as provided by
43+
the gRPC Authorization Policy Manager when the policy was pushed.
44+
This leaf persists through a reboot.";
45+
}
46+
typedef created-on {
47+
type oc-types:timeticks64;
48+
description
49+
"The creation time of the gRPC authorization policy as reported by
50+
the gRPC Authorization Policy manager when the policy was pushed
51+
to the device. This value is reported as nanoseconds since epoch
52+
(January 1st, 1970 00:00:00 GMT). This leaf persists through
53+
a reboot.";
54+
}
55+
// gRPC server authorization policy related definitions.
56+
grouping counters {
57+
description
58+
"A collection of counters that were collected by the gNSI.authz
59+
module while evaluating access to a RPC.";
60+
leaf access-rejects {
61+
type oc-yang:counter64;
62+
description
63+
"The total number of times the gNSI.authz module denied access
64+
to a RPC.";
65+
}
66+
leaf last-access-reject {
67+
type oc-types:timeticks64;
68+
description
69+
"A timestamp of the last time the gNSI.authz denied access to
70+
a RPC.";
71+
}
72+
leaf access-accepts {
73+
type oc-yang:counter64;
74+
description
75+
"The total number of times the gNSI.authz module allowed access
76+
to a RPC.";
77+
}
78+
leaf last-access-accept {
79+
type oc-types:timeticks64;
80+
description
81+
"A timestamp of the last time the gNSI.authz allowed access to
82+
a RPC.";
83+
}
84+
}
85+
grouping grpc-server-user-authz-policy-success-failure-counters {
86+
description
87+
"A collection of counters collected by the gNSI.authz module.";
88+
container rpcs {
89+
description
90+
"A collection of counters collected by the gNSI.authz module
91+
for each RPC separately.";
92+
list rpc {
93+
description
94+
"A collection of counters collected by the gNSI.authz module
95+
for a RPC identified by the `name`.";
96+
key name;
97+
leaf name {
98+
type leafref {
99+
path "../state/name";
100+
}
101+
description
102+
"The name of the RPC the counters were collected for.";
103+
}
104+
container state {
105+
leaf name {
106+
type string;
107+
description
108+
"The name of the RPC the counters were collected
109+
for.";
110+
}
111+
uses counters;
112+
}
113+
}
114+
}
115+
}
116+
grouping grpc-server-authz-policy-success-failure-counters {
117+
description
118+
"A collection of counters collected by the gNSI.authz module.";
119+
container authz-policy-counters {
120+
description
121+
"A collection of counters collected by the gNSI.authz module.";
122+
config false;
123+
uses grpc-server-user-authz-policy-success-failure-counters;
124+
}
125+
}
126+
grouping grpc-server-authz-policy-state {
127+
description
128+
"gNMI server's gRPC authorization policy freshness-related data.";
129+
leaf grpc-authz-policy-version {
130+
type version;
131+
description
132+
"The version of the gRPC authorization policy that is used by
133+
this system.";
134+
}
135+
leaf grpc-authz-policy-created-on {
136+
type created-on;
137+
description
138+
"The timestamp of the moment when the gRPC authorization policy
139+
that is currently used by this system was created.";
140+
}
141+
}
142+
// Augments section.
143+
augment "/oc-sys:system/oc-sys:aaa/oc-sys:authorization/" +
144+
"oc-sys:state" {
145+
description
146+
"A system's gRPC authorization policy freshness information.";
147+
uses grpc-server-authz-policy-state;
148+
}
149+
augment "/oc-sys:system/oc-sys-grpc:grpc-servers/oc-sys-grpc:grpc-server" {
150+
description
151+
"Counters collected while evaluating access to a gRPC server using
152+
the gNSI.authz authorization policy.";
153+
uses grpc-server-authz-policy-success-failure-counters;
154+
}
155+
}

‎models/yang/gnsi-certz.yang‎

Lines changed: 187 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,187 @@
1+
module gnsi-certz {
2+
yang-version 1.1;
3+
namespace "https://github.com/openconfig/gnsi/certz/yang";
4+
prefix gnsi-certz;
5+
6+
import openconfig-system {
7+
prefix oc-sys;
8+
}
9+
import openconfig-system-grpc {
10+
prefix oc-sys-grpc;
11+
}
12+
import openconfig-types {
13+
prefix oc-types;
14+
}
15+
import openconfig-yang-types {
16+
prefix oc-yang;
17+
}
18+
organization
19+
"Google LLC";
20+
21+
contact
22+
"Google LLC";
23+
24+
description
25+
"This module provides a data model for the metadata of gRPC credentials
26+
installed on a networking device.";
27+
28+
revision 2023-02-13 {
29+
description
30+
"rename access/reject counters";
31+
reference "0.5.0";
32+
}
33+
34+
revision 2023-08-24 {
35+
description
36+
"Adds ssl-profile-id leaf";
37+
reference "0.4.0";
38+
}
39+
40+
revision 2023-05-10 {
41+
description
42+
"Adds authentication policy freshness information.";
43+
reference "0.3.0";
44+
}
45+
46+
revision 2022-10-30 {
47+
description
48+
"Adds success/failure counters.";
49+
reference "0.2.0";
50+
}
51+
52+
revision 2022-09-20 {
53+
description
54+
"Initial revision.";
55+
reference "0.1.0";
56+
}
57+
58+
typedef version {
59+
type string;
60+
description
61+
"The version ID of the credential as provided by the credential
62+
manager when the credential was pushed. This leaf persists through
63+
a reboot.";
64+
}
65+
66+
typedef created-on {
67+
type oc-types:timeticks64;
68+
description
69+
"The creation time of the credential as reported by the credential
70+
manager when the credential was pushed to the device. This value is
71+
reported as nanoseconds since epoch (January 1st, 1970 00:00:00 GMT).
72+
This leaf persists through a reboot.";
73+
}
74+
// gRPC server related definitions.
75+
// Success/failure counters.
76+
grouping counters {
77+
description
78+
"A collection of counters that were collected while attempting
79+
to establish connections to the gRPC server.";
80+
81+
container counters {
82+
config false;
83+
description
84+
"A collection of counters that were collected by the gRPC during
85+
the authentication process.";
86+
87+
leaf connection-rejects {
88+
type oc-yang:counter64;
89+
description
90+
"The total number of times that gRPC clients have failed
91+
in establishing a connection to the server.";
92+
}
93+
leaf last-connection-reject {
94+
type oc-types:timeticks64;
95+
description
96+
"A timestamp of the last time a gRPC client failed
97+
in establishing a connection to the server.";
98+
}
99+
leaf connection-accepts {
100+
type oc-yang:counter64;
101+
description
102+
"The total number of times that gRPC clients have succeeded
103+
in establishing a connection to the server.";
104+
}
105+
leaf last-connection-accept {
106+
type oc-types:timeticks64;
107+
description
108+
"A timestamp of the last time a gRPC client succeeded
109+
in establishing a connection to the server.";
110+
}
111+
}
112+
}
113+
114+
grouping grpc-server-credentials-state {
115+
description
116+
"gRPC server credentials freshness-related data.";
117+
118+
leaf certificate-version {
119+
type version;
120+
description
121+
"The version of the certificate (and associated
122+
private key) that is used by this gRPC server.";
123+
}
124+
leaf certificate-created-on {
125+
type created-on;
126+
description
127+
"The timestamp of the moment when the certificate
128+
(and associated private key) that is currently used
129+
by this gRPC server was created.";
130+
}
131+
leaf ca-trust-bundle-version {
132+
type version;
133+
description
134+
"The version of the bundle of the Certificate
135+
Authority certificates a.k.a. trust bundle used by
136+
this gRPC server.";
137+
}
138+
leaf ca-trust-bundle-created-on {
139+
type created-on;
140+
description
141+
"The timestamp of the moment when the bundle of
142+
the Certificate Authority certificates (a.k.a.
143+
trust bundle) was created.";
144+
}
145+
leaf certificate-revocation-list-bundle-version {
146+
type version;
147+
description
148+
"The version of the Certificate Revocation List bundle used by
149+
this gRPC server.";
150+
}
151+
leaf certificate-revocation-list-bundle-created-on {
152+
type created-on;
153+
description
154+
"The timestamp of the moment when the Certificate Revocation
155+
List bundle was created.";
156+
}
157+
leaf authentication-policy-version {
158+
type version;
159+
description
160+
"The version of the authentication policy that is used by
161+
this gRPC server.";
162+
}
163+
leaf authentication-policy-created-on {
164+
type created-on;
165+
description
166+
"The timestamp of the moment when the authentication policy
167+
that is currently used by this gRPC server was created.";
168+
}
169+
leaf ssl-profile-id {
170+
type string;
171+
description
172+
"The ID of this gRPC server's SSL profile
173+
as used by the gNSI Certz service";
174+
}
175+
}
176+
177+
// Augments section.
178+
179+
augment "/oc-sys:system/oc-sys-grpc:grpc-servers/oc-sys-grpc:grpc-server/" +
180+
"oc-sys-grpc:state" {
181+
description
182+
"A gRPC server credentials freshness information.";
183+
184+
uses grpc-server-credentials-state;
185+
uses counters;
186+
}
187+
}

0 commit comments

Comments
 (0)