Skip to content

[202405] Enable gnmi/telemetry user authorization by config_db (#21363) #23249

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bingwang-ms merged 1 commit into from
Jul 10, 2025
Merged

[202405] Enable gnmi/telemetry user authorization by config_db (#21363) #23249

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
53 changes: 41 additions & 12 deletions dockers/docker-sonic-gnmi/gnmi-native.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,11 @@
EXIT_TELEMETRY_VARS_FILE_NOT_FOUND=1
INCORRECT_TELEMETRY_VALUE=2
TELEMETRY_VARS_FILE=/usr/share/sonic/templates/telemetry_vars.j2
ESCAPE_QUOTE="'\''"

extract_field() {
echo $(echo $1 | jq -r $2)
}

if [ ! -f "$TELEMETRY_VARS_FILE" ]; then
echo "Telemetry vars template file not found"
Expand All @@ -21,30 +26,29 @@ TELEMETRY_ARGS=" -logtostderr"
export CVL_SCHEMA_PATH=/usr/sbin/schema

if [ -n "$CERTS" ]; then
SERVER_CRT=$(echo $CERTS | jq -r '.server_crt')
SERVER_KEY=$(echo $CERTS | jq -r '.server_key')
SERVER_CRT=$(extract_field "$CERTS" '.server_crt')
SERVER_KEY=$(extract_field "$CERTS" '.server_key')
if [ -z $SERVER_CRT ] || [ -z $SERVER_KEY ]; then
TELEMETRY_ARGS+=" --insecure"
else
TELEMETRY_ARGS+=" --server_crt $SERVER_CRT --server_key $SERVER_KEY "
fi

CA_CRT=$(echo $CERTS | jq -r '.ca_crt')
CA_CRT=$(extract_field "$CERTS" '.ca_crt')
if [ ! -z $CA_CRT ]; then
TELEMETRY_ARGS+=" --ca_crt $CA_CRT"
fi

TELEMETRY_ARGS+=" --config_table_name GNMI_CLIENT_CERT"
elif [ -n "$X509" ]; then
SERVER_CRT=$(echo $X509 | jq -r '.server_crt')
SERVER_KEY=$(echo $X509 | jq -r '.server_key')
SERVER_CRT=$(extract_field "$X509" '.server_crt')
SERVER_KEY=$(extract_field "$X509" '.server_key')
if [ -z $SERVER_CRT ] || [ -z $SERVER_KEY ]; then
TELEMETRY_ARGS+=" --insecure"
else
TELEMETRY_ARGS+=" --server_crt $SERVER_CRT --server_key $SERVER_KEY "
fi

CA_CRT=$(echo $X509 | jq -r '.ca_crt')
CA_CRT=$(extract_field "$X509" '.ca_crt')
if [ ! -z $CA_CRT ]; then
TELEMETRY_ARGS+=" --ca_crt $CA_CRT"
fi
Expand All @@ -56,16 +60,21 @@ fi
if [ -z "$GNMI" ]; then
PORT=8080
else
PORT=$(echo $GNMI | jq -r '.port')
PORT=$(extract_field "$GNMI" '.port')
if ! [[ $PORT =~ ^[0-9]+$ ]]; then
echo "Incorrect port value ${PORT}, expecting positive integers" >&2
exit $INCORRECT_TELEMETRY_VALUE
fi
fi

TELEMETRY_ARGS+=" --port $PORT"

CLIENT_AUTH=$(echo $GNMI | jq -r '.client_auth')
CLIENT_AUTH=$(extract_field "$GNMI" '.client_auth')
if [ -z $CLIENT_AUTH ] || [ $CLIENT_AUTH == "false" ]; then
TELEMETRY_ARGS+=" --allow_no_client_auth"
fi

LOG_LEVEL=$(echo $GNMI | jq -r '.log_level')
LOG_LEVEL=$(extract_field "$GNMI" '.log_level')
if [[ $LOG_LEVEL =~ ^[0-9]+$ ]]; then
TELEMETRY_ARGS+=" -v=$LOG_LEVEL"
else
Expand All @@ -79,7 +88,7 @@ if [[ x"${LOCALHOST_SUBTYPE}" == x"SmartSwitch" ]]; then
fi

# Server will handle threshold connections consecutively
THRESHOLD_CONNECTIONS=$(echo $GNMI | jq -r '.threshold')
THRESHOLD_CONNECTIONS=$(extract_field "$GNMI" '.threshold')
if [[ $THRESHOLD_CONNECTIONS =~ ^[0-9]+$ ]]; then
TELEMETRY_ARGS+=" --threshold $THRESHOLD_CONNECTIONS"
else
Expand All @@ -92,7 +101,7 @@ else
fi

# Close idle connections after certain duration (in seconds)
IDLE_CONN_DURATION=$(echo $GNMI | jq -r '.idle_conn_duration')
IDLE_CONN_DURATION=$(extract_field "$GNMI" '.idle_conn_duration')
if [[ $IDLE_CONN_DURATION =~ ^[0-9]+$ ]]; then
TELEMETRY_ARGS+=" --idle_conn_duration $IDLE_CONN_DURATION"
else
Expand All @@ -104,4 +113,24 @@ else
fi
fi

USER_AUTH=$(extract_field "$GNMI" '.user_auth')
if [ ! -z "$USER_AUTH" ] && [ $USER_AUTH != "null" ]; then
TELEMETRY_ARGS+=" --client_auth $USER_AUTH"

if [ $USER_AUTH == "cert" ]; then
TELEMETRY_ARGS+=" --config_table_name GNMI_CLIENT_CERT"

ENABLE_CRL=$(echo $GNMI | jq -r '.enable_crl')
if [ $ENABLE_CRL == "true" ]; then
TELEMETRY_ARGS+=" --enable_crl"
fi

CRL_EXPIRE_DURATION=$(extract_field "$GNMI" '.crl_expire_duration')
if [ ! -z "$CRL_EXPIRE_DURATION" ] && [ $CRL_EXPIRE_DURATION != "null" ]; then
TELEMETRY_ARGS+=" --crl_expire_duration $CRL_EXPIRE_DURATION"
fi
fi
fi

echo "gnmi args: $TELEMETRY_ARGS"
exec /usr/sbin/telemetry ${TELEMETRY_ARGS}
55 changes: 41 additions & 14 deletions dockers/docker-sonic-telemetry/telemetry.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,11 @@
EXIT_TELEMETRY_VARS_FILE_NOT_FOUND=1
INCORRECT_TELEMETRY_VALUE=2
TELEMETRY_VARS_FILE=/usr/share/sonic/templates/telemetry_vars.j2
ESCAPE_QUOTE="'\''"

extract_field() {
echo $(echo $1 | jq -r $2)
}

if [ ! -f "$TELEMETRY_VARS_FILE" ]; then
echo "Telemetry vars template file not found"
Expand All @@ -22,31 +27,28 @@ export CVL_SCHEMA_PATH=/usr/sbin/schema
export GOTRACEBACK=crash

if [ -n "$CERTS" ]; then
SERVER_CRT=$(echo $CERTS | jq -r '.server_crt')
SERVER_KEY=$(echo $CERTS | jq -r '.server_key')
SERVER_CRT=$(extract_field "$CERTS" '.server_crt')
SERVER_KEY=$(extract_field "$CERTS" '.server_key')
if [ -z $SERVER_CRT ] || [ -z $SERVER_KEY ]; then
TELEMETRY_ARGS+=" --insecure"
else
TELEMETRY_ARGS+=" --server_crt $SERVER_CRT --server_key $SERVER_KEY "
fi

CA_CRT=$(echo $CERTS | jq -r '.ca_crt')
CA_CRT=$(extract_field "$CERTS" '.ca_crt')
if [ ! -z $CA_CRT ]; then
TELEMETRY_ARGS+=" --ca_crt $CA_CRT"
fi

# Reuse GNMI_CLIENT_CERT for telemetry service
TELEMETRY_ARGS+=" --config_table_name GNMI_CLIENT_CERT"
elif [ -n "$X509" ]; then
SERVER_CRT=$(echo $X509 | jq -r '.server_crt')
SERVER_KEY=$(echo $X509 | jq -r '.server_key')
SERVER_CRT=$(extract_field "$X509" '.server_crt')
SERVER_KEY=$(extract_field "$X509" '.server_key')
if [ -z $SERVER_CRT ] || [ -z $SERVER_KEY ]; then
TELEMETRY_ARGS+=" --insecure"
else
TELEMETRY_ARGS+=" --server_crt $SERVER_CRT --server_key $SERVER_KEY "
fi

CA_CRT=$(echo $X509 | jq -r '.ca_crt')
CA_CRT=$(extract_field "$X509" '.ca_crt')
if [ ! -z $CA_CRT ]; then
TELEMETRY_ARGS+=" --ca_crt $CA_CRT"
fi
Expand All @@ -58,16 +60,20 @@ fi
if [ -z "$GNMI" ]; then
PORT=8080
else
PORT=$(echo $GNMI | jq -r '.port')
PORT=$(extract_field "$GNMI" '.port')
if ! [[ $PORT =~ ^[0-9]+$ ]]; then
echo "Incorrect port value ${PORT}, expecting positive integers" >&2
exit $INCORRECT_TELEMETRY_VALUE
fi
fi
TELEMETRY_ARGS+=" --port $PORT"

CLIENT_AUTH=$(echo $GNMI | jq -r '.client_auth')
CLIENT_AUTH=$(extract_field "$GNMI" '.client_auth')
if [ -z $CLIENT_AUTH ] || [ $CLIENT_AUTH == "false" ]; then
TELEMETRY_ARGS+=" --allow_no_client_auth"
fi

LOG_LEVEL=$(echo $GNMI | jq -r '.log_level')
LOG_LEVEL=$(extract_field "$GNMI" '.log_level')
if [[ $LOG_LEVEL =~ ^[0-9]+$ ]]; then
TELEMETRY_ARGS+=" -v=$LOG_LEVEL"
else
Expand All @@ -83,7 +89,7 @@ if [ ! -z "$SAVE_ON_SET" ]; then
fi

# Server will handle threshold connections consecutively
THRESHOLD_CONNECTIONS=$(echo $GNMI | jq -r '.threshold')
THRESHOLD_CONNECTIONS=$(extract_field "$GNMI" '.threshold')
if [[ $THRESHOLD_CONNECTIONS =~ ^[0-9]+$ ]]; then
TELEMETRY_ARGS+=" --threshold $THRESHOLD_CONNECTIONS"
else
Expand All @@ -96,7 +102,7 @@ else
fi

# Close idle connections after certain duration (in seconds)
IDLE_CONN_DURATION=$(echo $GNMI | jq -r '.idle_conn_duration')
IDLE_CONN_DURATION=$(extract_field "$GNMI" '.idle_conn_duration')
if [[ $IDLE_CONN_DURATION =~ ^[0-9]+$ ]]; then
TELEMETRY_ARGS+=" --idle_conn_duration $IDLE_CONN_DURATION"
else
Expand All @@ -109,4 +115,25 @@ else
fi
TELEMETRY_ARGS+=" -gnmi_native_write=false"

USER_AUTH=$(extract_field "$GNMI" '.user_auth')
if [ ! -z "$USER_AUTH" ] && [ $USER_AUTH != "null" ]; then
TELEMETRY_ARGS+=" --client_auth $USER_AUTH"

if [ $USER_AUTH == "cert" ]; then
# Reuse GNMI_CLIENT_CERT for telemetry service
TELEMETRY_ARGS+=" --config_table_name GNMI_CLIENT_CERT"

ENABLE_CRL=$(echo $GNMI | jq -r '.enable_crl')
if [ $ENABLE_CRL == "true" ]; then
TELEMETRY_ARGS+=" --enable_crl"
fi

CRL_EXPIRE_DURATION=$(extract_field "$GNMI" '.crl_expire_duration')
if [ ! -z "$CRL_EXPIRE_DURATION" ] && [ $CRL_EXPIRE_DURATION != "null" ]; then
TELEMETRY_ARGS+=" --crl_expire_duration $CRL_EXPIRE_DURATION"
fi
fi
fi

echo "telemetry args: $TELEMETRY_ARGS"
exec /usr/sbin/telemetry ${TELEMETRY_ARGS}
7 changes: 6 additions & 1 deletion src/sonic-yang-models/yang-models/sonic-gnmi.yang
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,14 +71,19 @@ module sonic-gnmi {
description "Port gnmi runs on.";
}

leaf user_auth {
type string {
pattern 'password|jwt|cert';
}
description "GNMI service user authorization type.";
}
}
}

container GNMI_CLIENT_CERT {
description "GNMI client cert list";

list GNMI_CLIENT_CERT_LIST {
max-elements 8;
key "cert_cname";

leaf cert_cname {
Expand Down
6 changes: 6 additions & 0 deletions src/sonic-yang-models/yang-models/sonic-telemetry.yang
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,12 @@ module sonic-telemetry {
description "Port gnmi runs on.";
}

leaf user_auth {
type string {
pattern 'password|jwt|cert';
}
description "Telemetry service user authorization type.";
}
}

}
Expand Down
Loading