Add TELEMETRY_WATCHDOG_CERT_PROBE_ENABLED function into watchdog by FengPan-Frank · Pull Request #24743 · sonic-net/sonic-buildimage

FengPan-Frank · 2025-12-04T12:42:18Z

Why I did it

Support cname based authorization in telemetry. Fixed the config DB key used by telemetry.

Work item tracking

Microsoft ADO (number only):

How I did it

Turn on telemetry side gnmi_client_role in sidecar, and add watchdog probe functionality.

How to verify it

Before added, no cname check

After added.
known cname cert could visit SHOW

unknown cname cert will be blocked:

two watchdog prob as below:

Which release branch to backport (provide reason below if selected)

Tested branch (Please provide the tested image version)

Description for the changelog

Link to config_db schema for YANG module changes

A picture of a cute animal (not mandatory but encouraged)

mssonicbld · 2025-12-04T12:42:26Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2025-12-04T12:42:39Z

Azure Pipelines successfully started running 1 pipeline(s).

Copilot

Pull request overview

This pull request adds certificate authentication validation capabilities to the telemetry watchdog health check system. The feature introduces a new probe that tests both positive and negative certificate authentication scenarios by making gNMI calls with different certificate configurations to verify that authentication is working correctly.

Key changes:

Added a new TELEMETRY_WATCHDOG_CERT_PROBE_ENABLED environment variable to control certificate probe functionality (enabled by default)
Implemented dual certificate probes: one with "bad" credentials expected to fail, and one with "good" credentials expected to succeed
Added certificate-related constants for CA certificates, server certificates, keys, and target names for both test scenarios

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

dockers/docker-telemetry-watchdog/watchdog/src/main.rs

Copilot · 2025-12-04T12:48:55Z

dockers/docker-telemetry-watchdog/watchdog/src/main.rs

+// BAD (expected fail) probe
+const DEFAULT_BAD_CA: &str = "/etc/sonic/telemetry/dsmsroot.cer";
+const DEFAULT_BAD_CERT: &str = "/etc/sonic/telemetry/streamingtelemetryserver.cer";
+const DEFAULT_BAD_KEY: &str = "/etc/sonic/telemetry/streamingtelemetryserver.key";
+const DEFAULT_BAD_TNAME: &str = "server.ndastreaming.ap.gbl";
+
+// GOOD (expected success) probe
+const DEFAULT_GOOD_CA: &str = "/etc/sonic/credentials/AME_ROOT_CERTIFICATE.pem";
+const DEFAULT_GOOD_CERT: &str = "/etc/sonic/credentials/sonick8sclient2.crt";
+const DEFAULT_GOOD_KEY: &str = "/etc/sonic/credentials/sonick8sclient2.key";
+const DEFAULT_GOOD_TNAME: &str = "SonicK8sDashboard.NETWORK-test-bl6p.bl6p.ap.gbl";
+


The hardcoded certificate paths and target names (DEFAULT_BAD_CA, DEFAULT_BAD_CERT, etc.) appear to be environment-specific and may not exist on all systems. Consider making these configurable via environment variables (similar to how other probes can be configured) or Redis configuration to make the probe more flexible across different deployments.

Suggested change

// BAD (expected fail) probe

const DEFAULT_BAD_CA: &str = "/etc/sonic/telemetry/dsmsroot.cer";

const DEFAULT_BAD_CERT: &str = "/etc/sonic/telemetry/streamingtelemetryserver.cer";

const DEFAULT_BAD_KEY: &str = "/etc/sonic/telemetry/streamingtelemetryserver.key";

const DEFAULT_BAD_TNAME: &str = "server.ndastreaming.ap.gbl";

// GOOD (expected success) probe

const DEFAULT_GOOD_CA: &str = "/etc/sonic/credentials/AME_ROOT_CERTIFICATE.pem";

const DEFAULT_GOOD_CERT: &str = "/etc/sonic/credentials/sonick8sclient2.crt";

const DEFAULT_GOOD_KEY: &str = "/etc/sonic/credentials/sonick8sclient2.key";

const DEFAULT_GOOD_TNAME: &str = "SonicK8sDashboard.NETWORK-test-bl6p.bl6p.ap.gbl";

// BAD (expected fail) probe environment variable names

const BAD_CA_ENV_VAR: &str = "TELEMETRY_WATCHDOG_BAD_CA";

const BAD_CERT_ENV_VAR: &str = "TELEMETRY_WATCHDOG_BAD_CERT";

const BAD_KEY_ENV_VAR: &str = "TELEMETRY_WATCHDOG_BAD_KEY";

const BAD_TNAME_ENV_VAR: &str = "TELEMETRY_WATCHDOG_BAD_TNAME";

// GOOD (expected success) probe environment variable names

const GOOD_CA_ENV_VAR: &str = "TELEMETRY_WATCHDOG_GOOD_CA";

const GOOD_CERT_ENV_VAR: &str = "TELEMETRY_WATCHDOG_GOOD_CERT";

const GOOD_KEY_ENV_VAR: &str = "TELEMETRY_WATCHDOG_GOOD_KEY";

const GOOD_TNAME_ENV_VAR: &str = "TELEMETRY_WATCHDOG_GOOD_TNAME";

// BAD (expected fail) probe defaults

const DEFAULT_BAD_CA: &str = "/etc/sonic/telemetry/dsmsroot.cer";

const DEFAULT_BAD_CERT: &str = "/etc/sonic/telemetry/streamingtelemetryserver.cer";

const DEFAULT_BAD_KEY: &str = "/etc/sonic/telemetry/streamingtelemetryserver.key";

const DEFAULT_BAD_TNAME: &str = "server.ndastreaming.ap.gbl";

// GOOD (expected success) probe defaults

const DEFAULT_GOOD_CA: &str = "/etc/sonic/credentials/AME_ROOT_CERTIFICATE.pem";

const DEFAULT_GOOD_CERT: &str = "/etc/sonic/credentials/sonick8sclient2.crt";

const DEFAULT_GOOD_KEY: &str = "/etc/sonic/credentials/sonick8sclient2.key";

const DEFAULT_GOOD_TNAME: &str = "SonicK8sDashboard.NETWORK-test-bl6p.bl6p.ap.gbl";

// Helper functions to get BAD/GOOD probe values from env or default

fn get_bad_ca() -> String {

std::env::var(BAD_CA_ENV_VAR).unwrap_or_else(|_| DEFAULT_BAD_CA.to_string())

}

fn get_bad_cert() -> String {

std::env::var(BAD_CERT_ENV_VAR).unwrap_or_else(|_| DEFAULT_BAD_CERT.to_string())

}

fn get_bad_key() -> String {

std::env::var(BAD_KEY_ENV_VAR).unwrap_or_else(|_| DEFAULT_BAD_KEY.to_string())

}

fn get_bad_tname() -> String {

std::env::var(BAD_TNAME_ENV_VAR).unwrap_or_else(|_| DEFAULT_BAD_TNAME.to_string())

}

fn get_good_ca() -> String {

std::env::var(GOOD_CA_ENV_VAR).unwrap_or_else(|_| DEFAULT_GOOD_CA.to_string())

}

fn get_good_cert() -> String {

std::env::var(GOOD_CERT_ENV_VAR).unwrap_or_else(|_| DEFAULT_GOOD_CERT.to_string())

}

fn get_good_key() -> String {

std::env::var(GOOD_KEY_ENV_VAR).unwrap_or_else(|_| DEFAULT_GOOD_KEY.to_string())

}

fn get_good_tname() -> String {

std::env::var(GOOD_TNAME_ENV_VAR).unwrap_or_else(|_| DEFAULT_GOOD_TNAME.to_string())

}

dockers/docker-telemetry-watchdog/watchdog/src/main.rs

Copilot · 2025-12-04T12:48:56Z

dockers/docker-telemetry-watchdog/watchdog/src/main.rs

+fn is_cert_probe_enabled() -> bool {
+    match env::var(CERT_PROBE_ENV_VAR) {
+        Ok(v) if v.eq_ignore_ascii_case("false") => false,
+        _ => true, // default enabled
+    }
+}


The cert probe is enabled by default and relies on hardcoded file paths (e.g., /etc/sonic/credentials/AME_ROOT_CERTIFICATE.pem). If these files don't exist in all deployment environments, the probe will fail on every health check, which could cause monitoring alerts. Consider either: 1) making the probe default to disabled (like the serial number probe), or 2) checking if the certificate files exist before running the probe, or 3) documenting the required file locations clearly.

Copilot · 2025-12-04T12:48:56Z

dockers/docker-telemetry-watchdog/watchdog/src/main.rs

@@ -382,6 +403,41 @@ fn main() {
                            let timeout = read_timeout();
                            let target_name = get_target_name();

+                            // Certificate probes on reboot-cause/history API


[nitpick] The comment describes "Certificate probes on reboot-cause/history API" but doesn't explain the purpose or rationale. Consider adding context about why this specific endpoint is used for certificate testing (e.g., "Tests certificate validation using the reboot-cause/history endpoint as a representative gNMI query").

Suggested change

// Certificate probes on reboot-cause/history API

// Certificate probes using the reboot-cause/history API.

// This endpoint is used as a representative gNMI query to test certificate validation.

mssonicbld · 2025-12-04T21:33:33Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2025-12-04T21:33:44Z

Azure Pipelines successfully started running 1 pipeline(s).

mssonicbld · 2025-12-05T03:05:35Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2025-12-05T03:05:45Z

Azure Pipelines successfully started running 1 pipeline(s).

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 4 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

dockers/docker-telemetry-watchdog/watchdog/src/main.rs

Copilot · 2025-12-05T03:10:04Z

dockers/docker-telemetry-watchdog/watchdog/src/main.rs

+const CERT_PROBE_ENV_VAR: &str = "TELEMETRY_WATCHDOG_CERT_PROBE_ENABLED";
+
+// BAD (expected fail) probe
+const DEFAULT_BAD_CA: &str = "/etc/sonic/telemetry/dsmsroot.cer";
+const DEFAULT_BAD_CERT: &str = "/etc/sonic/telemetry/streamingtelemetryserver.cer";
+const DEFAULT_BAD_KEY: &str = "/etc/sonic/telemetry/streamingtelemetryserver.key";
+const DEFAULT_BAD_TNAME: &str = "server.ndastreaming.ap.gbl";
+
+// GOOD (expected success) probe
+const DEFAULT_GOOD_CA: &str = "/etc/sonic/credentials/AME_ROOT_CERTIFICATE.pem";
+const DEFAULT_GOOD_CERT: &str = "/etc/sonic/credentials/sonick8sclient2.crt";
+const DEFAULT_GOOD_KEY: &str = "/etc/sonic/credentials/sonick8sclient2.key";
+const DEFAULT_GOOD_TNAME: &str = "SonicK8sDashboard.NETWORK-test-bl6p.bl6p.ap.gbl";


Missing documentation for the new certificate probe feature. Consider adding a comment block before the constants (lines 47-59) explaining the purpose of these certificate probes, what "BAD" and "GOOD" mean in this context, and when/why this feature should be enabled or disabled. This would help future maintainers understand the testing strategy being implemented.

Copilot · 2025-12-05T03:10:05Z

dockers/docker-telemetry-watchdog/watchdog/src/main.rs

+                            // Certificate probes on reboot-cause/history API
+                            // 1) BAD cert: expect failure
+                            // 2) GOOD cert: expect success


[nitpick] The comment states "Certificate probes on reboot-cause/history API" but doesn't explain the testing strategy. The comment should clarify that this is testing certificate validation by: 1) Attempting to connect with known invalid certificates (expecting failure) and 2) Attempting to connect with valid certificates (expecting success). This helps readers understand that this is a negative/positive test pair for certificate authentication.

Suggested change

// Certificate probes on reboot-cause/history API

// 1) BAD cert: expect failure

// 2) GOOD cert: expect success

// Certificate validation probes on reboot-cause/history API.

// This tests certificate authentication with a negative/positive test pair:

// 1) Attempt to connect with a known invalid (BAD) certificate and expect failure (negative test).

// 2) Attempt to connect with a known valid (GOOD) certificate and expect success (positive test).

mssonicbld · 2025-12-11T10:27:36Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2025-12-11T10:27:50Z

Azure Pipelines successfully started running 1 pipeline(s).

mssonicbld · 2025-12-12T10:42:52Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2025-12-12T10:43:07Z

Azure Pipelines successfully started running 1 pipeline(s).

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

dockers/docker-telemetry-watchdog/watchdog/src/main.rs

Copilot · 2025-12-12T10:46:18Z

dockers/docker-telemetry-watchdog/watchdog/src/main.rs

+                                let xpath_rc = "reboot-cause/history";
+
+                                let bad_sec = TelemetrySecurityConfig {
+                                    use_client_auth: true,
+                                    ca_crt: DEFAULT_BAD_CA.to_string(),
+                                    server_crt: DEFAULT_BAD_CERT.to_string(),
+                                    server_key: DEFAULT_BAD_KEY.to_string(),
+                                };
+                                let mut res_bad = run_gnmi_for_xpath(&xpath_rc, port, &bad_sec, DEFAULT_BAD_TNAME, timeout, "SHOW");


The BAD cert probe inverts the expected outcome but doesn't invert the xpath field in the CommandResult. The xpath field will show "reboot-cause/history" for both BAD and GOOD tests, making it difficult to distinguish them in the JSON output. Consider using a more descriptive xpath value like "reboot-cause/history (BAD cert)" and "reboot-cause/history (GOOD cert)" to make the test results clearer.

mssonicbld · 2026-01-05T08:53:57Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2026-01-05T08:54:09Z

Azure Pipelines successfully started running 1 pipeline(s).

mssonicbld · 2026-01-15T10:58:19Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2026-01-15T10:58:31Z

Azure Pipelines successfully started running 1 pipeline(s).

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-01-15T11:00:54Z

dockers/docker-telemetry-watchdog/watchdog/src/main.rs

+// BAD (expected fail) probe
+const DEFAULT_BAD_CA: &str = "/etc/sonic/telemetry/dsmsroot.cer";
+const DEFAULT_BAD_CERT: &str = "/etc/sonic/telemetry/streamingtelemetryserver.cer";
+const DEFAULT_BAD_KEY: &str = "/etc/sonic/telemetry/streamingtelemetryserver.key";
+const DEFAULT_BAD_TNAME: &str = "server.ndastreaming.ap.gbl";


The 'BAD' certificate constants are identical to the default certificate constants (lines 41-43), which undermines the purpose of testing certificate validation. If these paths point to the same valid certificates as the defaults, the 'BAD' probe won't actually test failure scenarios. Consider using truly invalid certificate paths, or add a comment explaining why these are expected to fail.

Suggested change

// BAD (expected fail) probe

const DEFAULT_BAD_CA: &str = "/etc/sonic/telemetry/dsmsroot.cer";

const DEFAULT_BAD_CERT: &str = "/etc/sonic/telemetry/streamingtelemetryserver.cer";

const DEFAULT_BAD_KEY: &str = "/etc/sonic/telemetry/streamingtelemetryserver.key";

const DEFAULT_BAD_TNAME: &str = "server.ndastreaming.ap.gbl";

// BAD (expected fail) probe: use clearly invalid/non-existent certificate paths and target name

const DEFAULT_BAD_CA: &str = "/etc/sonic/telemetry/invalid_bad_probe_ca.pem";

const DEFAULT_BAD_CERT: &str = "/etc/sonic/telemetry/invalid_bad_probe_cert.pem";

const DEFAULT_BAD_KEY: &str = "/etc/sonic/telemetry/invalid_bad_probe_key.pem";

const DEFAULT_BAD_TNAME: &str = "invalid.bad-probe.local";

Copilot · 2026-01-15T11:00:54Z

dockers/docker-telemetry-watchdog/watchdog/src/main.rs

+                                let mut res_bad = run_gnmi_for_xpath(&xpath_rc, port, &bad_sec, DEFAULT_BAD_TNAME, timeout, "SHOW");
+                                if res_bad.success {
+                                    res_bad.success = false;
+                                    let msg = "Expected FAILURE with BAD cert but command SUCCEEDED".to_string();
+                                    res_bad.error = Some(match res_bad.error.take() {
+                                        Some(existing) => format!("{existing}; {msg}"),
+                                        None => msg,
+                                    });
+                                    http_status = "HTTP/1.1 500 Internal Server Error";
+                                }


The logic of inverting success/failure for the 'BAD' cert probe adds complexity. The probe mutates res_bad.success after the fact, which could be confusing for debugging. Consider adding a comment explaining that this is a negative test case, or create a dedicated field in CommandResult to distinguish between positive and negative test cases.

…t#23432) (sonic-net#25491) The ctrmgr_iptables_test.py test_table test fails intermittently on ARM64 build machines because it relies on real DNS resolution via socket.gethostbyname(). Root cause: test case 4 uses hostname 'www.google.comx' expecting DNS to fail (return empty string). On build machines with DNS hijacking or NXDOMAIN redirection, this resolves to a real IP (e.g., the proxy IP 45.54.28.15), causing the assertion 'assert ret == ""' to fail with the unexpected destination '45.54.28.15:3128'. Similarly, test case 3 uses 'www.google.com' relying on live DNS which can fail in air-gapped build environments. Fix: - Mock socket.gethostbyname with deterministic results: known test hostnames return fixed IPs, unknown hostnames raise gaierror - Replace 'www.google.comx' with 'host.invalid' (RFC 6761 reserved TLD, guaranteed to never resolve) for invalid-hostname test cases - Add explicit 'ret' assertion to test case 3 (was previously unchecked) with the deterministic mock IP Signed-off-by: Rustiqly <[email protected]> Co-authored-by: Rustiqly <[email protected]> Signed-off-by: Feng Pan <[email protected]>

) Signed-off-by: Roy Wen <[email protected]> Co-authored-by: saravanan sellappa <[email protected]> Signed-off-by: Feng Pan <[email protected]>

Root cause: On UpstreamLC/UpperSpineRouter devices, the TO_BGP_PEER route-map sequence 60 was missing "on-match next", causing it to stop processing and preventing sequence 100 (CHECK_IDF_ISOLATION) from being reached. Route → Seq 50 (tag contributing routes) → on-match next → Seq 60 (strip local anchor community) → STOP (no on-match next) → Seq 100 (CHECK_IDF_ISOLATION) ← NEVER REACHED! This caused: - IDF isolation to not work (no-export community not added) - test_seq_idf_isolation.py to fail on disaggregated T2 Resolution: Add "on-match next" to sequence 60 in TO_BGP_PEER_V4/V6 route-maps to allow processing to continue to sequence 100 (CHECK_IDF_ISOLATION). Route → Seq 50 (tag contributing routes) → on-match next → Seq 60 (strip local anchor community) → on-match next → Seq 100 (CHECK_IDF_ISOLATION) ← NOW REACHABLE Tested the below testcases with this fix and it is passing. - test_seq_idf_isolation.py - test_prefix_list.py - test_ipv6_nlri_over_ipv4.py - test_bgp_update_timer.py - test_route_flap.py Signed-off-by: selva <[email protected]> Signed-off-by: Feng Pan <[email protected]>

…onic-net#25864) What is the motivation for this PR: This PR combines changes from sonic-net#25594 and sonic-net#25306 to update sonic-platform-common and align the BMC reset_root_password unit test with new min password length functionality. How did you do it: Cherry-picked both PRs, updated sonic-platform-common submodule, and refreshed test_bmc.py mocks for redfish_api_get_min_password_length and redfish_api_set_min_password_length. How did you verify/test it: UT execution of test_bmc.py. Signed-off-by: Ying Xie <[email protected]> Signed-off-by: Ben Levi <[email protected]> Signed-off-by: Feng Pan <[email protected]>

What is the motivation for this PR: To fix a regression on agera2 gearbox after merge of sonic-sairedis#1758; gbsyncd crashes due to missing sai_query_stats_st_capability. How did you do it: Updated the PAI header to include the missing API definition. How did you verify/test it: Validated port bringup on a device with agera2 gearbox. Signed-off-by: Tejaswini Chadaga <[email protected]> Signed-off-by: Feng Pan <[email protected]>

…e memory footprints (sonic-net#24656) Why I did it System ready - Update from MultiProcessing to MultiThreading to reduce memory footprints Work item tracking Microsoft ADO (number only): How I did it Change Multiprocessing to Multithreading in sysmonitor code Signed-off-by: Feng Pan <[email protected]>

…net#25643) * [build] Add build timing report and dependency analysis tools Add three scripts for build performance instrumentation: - scripts/build-timing-report.sh: Parse per-package timing from build logs (HEADER/FOOTER timestamps), generate sorted duration table, phase breakdown, parallelism timeline, and CSV export. - scripts/build-dep-graph.py: Parse rules/*.mk dependency graph, compute critical path, fan-out/fan-in bottleneck analysis, and generate DOT/JSON output for visualization. - scripts/build-resource-monitor.sh: Sample CPU, memory, disk I/O, and Docker container count during builds for resource utilization analysis. Add "make build-report" target to slave.mk that runs the timing report and dependency analysis after a build completes. Example output from a VS build on 24-core/30GB machine: - 210 packages built in 53m wall time (173m CPU) - Max concurrency: 5 (with SONIC_CONFIG_BUILD_JOBS=4) - Critical path: 14 packages deep (libnl -> libswsscommon -> utilities) - Top bottleneck: LIBSWSSCOMMON with 48 downstream dependents Signed-off-by: Rustiqly <[email protected]> * Address Copilot review: fix 17 bugs in build analysis scripts - Use free -m with division instead of free -g to avoid rounding (sonic-net#1) - Add = and ?= to Makefile dependency regex patterns (sonic-net#2, sonic-net#7) - CPU calculation now uses /proc/stat delta (two reads) (sonic-net#3, sonic-net#14) - Fix misleading 'critical path estimate' comment (sonic-net#4) - Fix parallelism timeline comment (60s not 10s) (sonic-net#5) - Include after-relationship packages in fan stats (sonic-net#6) - Guard disk I/O division by zero when INTERVAL<=1 (sonic-net#8) - Remove unused elapsed_line variable (sonic-net#9) - Remove redundant LIBSWSSCOMMON_DBG check (sonic-net#10) - Remove active_make_jobs from CSV header comment (sonic-net#11) - Wire up _RDEPENDS parsing to build reverse deps (sonic-net#12) - Remove unnecessary 'if v' filter on rdeps JSON (sonic-net#13) - Remove unused REPORT_FORMAT parameter (sonic-net#15) - Add cycle detection to critical path algorithm (sonic-net#16) - Add execute permission check for companion scripts (sonic-net#17) Signed-off-by: Rustiqly <[email protected]> --------- Signed-off-by: Rustiqly <[email protected]> Co-authored-by: Rustiqly <[email protected]> Signed-off-by: Feng Pan <[email protected]>

…et#25752) SONiC patch 0014 adds zebra_vrf_config_write() as a void function but uses 'return 0;' at the end. GCC 12 (bookworm) treats -Wreturn-mismatch as a warning, but GCC 14 (trixie) promotes it to an error, breaking the FRR build under BLDENV=trixie. Fix: change 'return 0;' to 'return;' in the patch. Signed-off-by: Rustiqly <[email protected]> Co-authored-by: Rustiqly <[email protected]> Signed-off-by: Feng Pan <[email protected]>

…D automatically (sonic-net#25905) #### Why I did it src/sonic-platform-daemons ``` * 6ab20ec - (HEAD -> master, origin/master, origin/HEAD) Refactor media-settings parser (sonic-net#762) (7 hours ago) [Prince George] ``` #### How I did it #### How to verify it #### Description for the changelog Signed-off-by: Feng Pan <[email protected]>

…et#25370) Use local built libsnmp-dev related packages instead of debian in sonic-slave-bookworm. It will avoid snmp related packages breaking reproducible build. --------- Signed-off-by: Yijing Yan <[email protected]> Signed-off-by: Feng Pan <[email protected]>

Signed-off-by: Yan Markman <[email protected]> Co-authored-by: Lihua Yuan <[email protected]> Signed-off-by: Feng Pan <[email protected]>

* marvell-prestera: SMDEP ignore symlink Signed-off-by: Yan Markman <[email protected]> * [mrvl-prestera] fix BGP irq, no sonic-ext.target Fix BGP IRQ loss amd64: ethDriver.c force DMA_BIT_MASK 32bits Signed-off-by: Yan Markman <[email protected]> --------- Signed-off-by: Yan Markman <[email protected]> Signed-off-by: Feng Pan <[email protected]>

Fix for issue sonic-net#24771 syncd supervisor-proc-exit-listener FATAL under startup and high CPU loading Signed-off-by: Yan Markman <[email protected]> Signed-off-by: Feng Pan <[email protected]>

Signed-off-by: Tejaswini Chadaga <[email protected]> Signed-off-by: Feng Pan <[email protected]>

* Upgrade docker in Trixie slave container to Docker 28 This was missed in the initial Trixie upgrade, but as of right now, this has no impact on anything. This upgrades the Docker daemon in the Trixie slave container to Docker 28. Docker 29 is the latest version, but due to changes in how containers are built and possible memory usage increases, I'm keeping it at 28 for now. Signed-off-by: Saikrishna Arcot <[email protected]> * Update Docker version in final image as well Signed-off-by: Saikrishna Arcot <[email protected]> * Fix containerd.io version Signed-off-by: Saikrishna Arcot <[email protected]> * Replace with variable Signed-off-by: Saikrishna Arcot <[email protected]> --------- Signed-off-by: Saikrishna Arcot <[email protected]> Signed-off-by: Feng Pan <[email protected]>

…tomatically (sonic-net#25872) #### Why I did it src/sonic-linux-kernel ``` * dac5f90 - (HEAD -> master, origin/master, origin/HEAD) DTS file as a patch for Nexthop bmc card (sonic-net#537) (29 hours ago) [Chandrasekaran Swaminathan] * 2afef96 - Add a patch for printing the AMD Zen CPU reset reason (sonic-net#514) (29 hours ago) [lotus-nexthop] ``` #### How I did it #### How to verify it #### Description for the changelog Signed-off-by: Feng Pan <[email protected]>

mssonicbld · 2026-03-06T04:40:47Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2026-03-06T04:40:54Z

Azure Pipelines will not run the associated pipelines, because the pull request was updated after the run command was issued. Review the pull request again and issue a new run command.

linux-foundation-easycla · 2026-03-06T04:41:09Z

✅ login: abelamit / name: Amit Abel (edf8714)
✅ login: AnantKishorSharma / name: Anant (722d891)
✅ login: AntonHryshchuk / name: Anton Hryshchuk (74339aa)
✅ login: arista-hpandya / name: HP (0d98b67, 16fc575, da476c6, f874941, ff81735)
✅ login: arista-nwolfe / name: arista-nwolfe (1a79c1d, a264481)
✅ login: aronovic / name: aronovic (e600641)
✅ login: arpit-nexthop / name: arpit-nexthop (b2ee618)
✅ login: ashutosh-agrawal / name: Ashutosh Agrawal (722d891, fe9afd1)
✅ login: auspham / name: Austin (Thang Pham) (4e083ba)
✅ login: benle7 / name: Ben Levi (15c86b4, 1ef8b03, 7136e6b, 8359bf6, d4839cd, d860fcb)
✅ login: bgallagher-nexthop / name: Brian Gallagher (b2ee618)
✅ login: bhouse-nexthop / name: Brad House - NextHop (dda14b5)
✅ login: bhouse-nexthop / name: Brad House - Nexthop (e35b9c7, f65f119)
✅ login: Blueve / name: Jing Kan (512e866)
✅ login: bobby-nexthop / name: Bobby McGonigle (8711d35)
✅ login: Bojun-Feng / name: Bojun Feng (2693aa8, e178673)
✅ login: BYGX-wcr / name: Changrong Wu (478d563)
✅ login: byu343 / name: byu343 (3d01f6c, a746bee, a9bb4cd, f48fc14, f755a46)
✅ login: ccroy-arista / name: Chris (aaf4e15)
✅ login: Chiranjeevi-U-ML / name: Chiranjeevi U - MapleLabs (7370be0)
✅ login: Copilot / name: Copilot (398638f, 722d891, 784ee1e, d9b2284, f809989, a3827fa)
✅ login: croos12 / name: Connor Roos (1dccc82, bdbfd83, ccbdd89)
✅ login: cscarpitta / name: Carmine Scarpitta (ace215d)
✅ login: cshivashgit / name: Shivashankar C R (722d891)
✅ login: cyw233 / name: Chenyang Wang (28bb102)
✅ login: dakotac-arista / name: dakotac-arista (cf53142, fdfcecb)
✅ login: DavidZagury / name: DavidZagury (2ff2366, c895ecc)
✅ login: deepak-singhal0408 / name: Deepak Singhal (83ba9f0)
✅ login: dgsudharsan / name: Sudharsan Dhamal Gopalarathnam (049fcda, 166d414, 2e7812e, f88ec80)
✅ login: dhanasekar-arista / name: Dhanasekar Rathinavel (1bcacf8, a9b9959)
✅ login: divyagayathri-hcl / name: divyagayathri-hcl (ecae6e0)
✅ login: domingo-nexthop / name: domingo-nexthop (467c23d)
✅ login: eddieruan-alibaba / name: Eddie Ruan (b039bad)
✅ login: FengPan-Frank / name: Feng-msft (0da80ec, 21be0d1, 2abe24d, 4b84c51, b116a9b, ea963fb)
✅ login: fzhou-nokia / name: Fei Zhou (330046e)
✅ login: Gfrom2016 / name: zitingguo-ms (28bc474, 28c4e21, 8da17cd, aa7ff7f, e4d48a9, f05104e)
✅ login: Gnanapriya27 / name: Gnanapriya [Marvell] (89babfc)
✅ login: gordon-nexthop / name: gordon-nexthop (f3c4260)
✅ login: gpunathilell / name: Gagan Punathil Ellath (03ce37d, 166d414, 2e7812e, 407c089, 8c077fc, ddf98c7, e06654c)
✅ login: hdwhdw / name: Dawei Huang (b24a934, d9b2284, e804865)
✅ login: Janetxxx / name: Janet Cui (213f282, 4202c43, 958faa5, ec9d00f)
✅ login: jasper-hou-micas / name: Jasper Hou (d8f9f83)
✅ login: jianyuewu / name: Jianyue Wu (2a99421, 5b32ad1, 69d23a1)
✅ login: jon-nokia / name: Jon Goldberg (17a2824, bdb306b)
✅ login: jostar-yang / name: jostar-yang (04fc18b)
✅ login: Junchao-Mellanox / name: Junchao-Mellanox (645a2e5, d1b1062, fbab701)
✅ login: justin-oliver / name: Justin Oliver (2cea8b9, ea94281)
✅ login: keboliu / name: Kebo Liu (656eb53)
✅ login: Keshavg-marvell / name: Keshav Gupta (da8b35d)
✅ login: kewei-arista / name: kewei-arista (1d44e7f, 239a0be)
✅ login: Leyza / name: Leyza (dc42828)
✅ login: liat-grozovik / name: Liat Grozovik (d7cd443)
✅ login: lihuay / name: Lihua Yuan (2a86475, 338f16a, 40a2ad4, 5f7d407, 7765028, 88f1f5d, 89babfc, 8b09a51)
✅ login: LijoJos / name: LijoJos (2f9ae6f)
✅ login: lipxu / name: Liping Xu (1f98af8, 3d47555, 8d51bd5, c634aaa)
✅ login: liuh-80 / name: Hua Liu (65dcb31, b1f176d, eda0b2a)
✅ login: liushilongbuaa / name: Liu Shilong (06c6e59, 164c254, 20584f1, 398638f, 6bc4f2f, 784ee1e, a8a71cb, e9d5d8b, f08f1cb)
✅ login: louis-nexthop / name: louis-nexthop (467c23d, 95d9314)
✅ login: maipbui / name: Mai Bui (6b52f7c)
✅ login: manamand2020 / name: manamand2020 (8cd88f7)
✅ login: manish1-arista / name: manish1-arista (9dfee8d)
✅ login: matofeder / name: Matej Feder (5fb04d7)
✅ login: mihirpat1 / name: mihirpat1 (23c7630)
✅ login: mlok-nokia / name: Marty Y. Lok (a1c60c7)
✅ login: mramezani95 / name: mramezani95 (048265c, 5349641, 5abd831)
✅ login: mssonicbld / name: mssonicbld (00cee53, 0180658, 01f7868, 02c2711, 04d974b, 0590cb5, 06cdd73, 06d6bec, 06e10d2, 0929ced, 09eedbc, 0c04041, 0ca7f83, 102c730, 1068223, 1176beb, 11a4279, 131a8f7, 1359d02, 145db20, 18ac2de, 21912f6, 2204b77, 275b520, 282a0ee, 2aa9af2, 2bca41c, 2ca21a7, 2d6a4bf, 2d793c3, 2e1ee6f, 30141ea, 349b66c, 39e51ee, 3b66090, 3e3371f, 3f21fb9, 44887c6, 449ecf8, 4621e4b, 463e5d3, 481da4f, 49500cc, 498e05d, 4b1bca0, 4bfe2bb, 4d75f62, 4de75b0, 4df5632, 5073abe, 52084a3, 5293b5f, 52c1ab5, 5555bc4, 592f08c, 59b1417, 5c3c91d, 5e5efa7, 5eced62, 5fb1a47, 63bd2c3, 63e6772, 6468875, 6c66dcd, 7085892, 71d6968, 798561f, 7afd5e8, 7ccec67, 7cd8242, 81bdc3c, 82dcd29, 8422fdc, 8626554, 88c8e47, 8e3cad3, 91e6564, 992e46f, 9b0a20f, 9d834a9, 9eb5d37, a4dd5cc, a740032, ad21512, ae464b6, ae5068a, afac45e, b2a6d0f, b3a3378, b4476d3, b668b88, b8d6567, b94c380, ba922db, be8e47b, c0119ea, c193e84, c329075, c4e6fba, c5d9f7f, c66782a, c74c62e, caf9d85, ce2c6b2, cf2cf38, d25a4b4, d39ddd3, d43fd69, d54d54a, d7873b4, d7c5f10, dba3896, e056c0f, e0a65e0, e616b14, e839366, e87c35a, e8b4801, e8cc829, e952b8f, ef3551b, f3e4519, f611feb, fd23fb6, fdbb227, fe744b4)
✅ login: mssonicbld / name: sonicbld (b1f176d, eda0b2a)
✅ login: nate-nexthop / name: nate-nexthop (7ffd340, b65ce59, be38c32, dede994, f13d29a)
✅ login: NavdhaJindal / name: Navdha Jindal (3a35757, ba45b83)
✅ login: Naveen-Rampuram / name: Naveen Rampuram (7f5ae56)
✅ login: nazariig / name: Nazarii Hnydyn (5e211f7)
✅ login: nmoray / name: nmoray (5ff1170)
✅ login: noaOrMlnx / name: Noa Or (d093807)
✅ login: nonodark / name: Nonodark Huang (01b6b0e)
✅ login: oleksandrivantsiv / name: Oleksandr Ivantsiv (0037c41, 7622f74, 80036d1, 98903b6, b4c33e0)
✅ login: Pavan-Nokia / name: Pavan Prakash (2a86475, 86b7dc0)
✅ login: pavannaregundi / name: Pavan Naregundi (20b0aa9, 40a2ad4, 7f5ae56, df0f085, 6ab0c88)
✅ login: peterbailey-arista / name: Peter Bailey (3ada36e)
✅ login: prabhataravind / name: prabhataravind (d89618c)
✅ login: prgeor / name: Prince George (79eba3e)
✅ login: Pterosaur / name: Ze Gan (19cf232, 9b7fb41, ec9d00f, ed7fb00)
✅ login: qiluo-msft / name: Qi Luo (0b30482, 0d552a0, 0d8decd, 2457303, 44b288e, 466e603, 46ecd14, 5ead8d1, 8dc97b6, 949f6ad, 9f9bc37, af681de, d276137, d8abd67, e46a0e3, f647a50)
✅ login: rajkumar1-arista / name: rajkumar1-arista (b5621d2)
✅ login: rameshraghupathy / name: rameshraghupathy (cf055f2, d787db3)
✅ login: rchandramouli / name: Ramasamy Chandramouli (64cf695, cec2663)
✅ login: rhalstea / name: rhalstea (ecae6e0)
✅ login: rick-arista / name: rick-arista (55d88e8)
✅ login: rminnikanti / name: Ravi Minnikanti(Marvell) (8b09a51)
✅ login: rohinikumart / name: Tharigonda Rohini Kumar (32909d9)
✅ login: roy-nexthop / name: roy-nexthop (7d1e1a3, 856467d, ae7a825, ba6b59c, ea60dfa)
✅ login: rustiqly / name: Rustiqly (0337a33, 10b235e, 2454920, 262b3ef, 2e2312c, 338f16a, 3432d5a, 3b34a02, 3dc5d66, 5f7d407, 61bdb2f, 7765028, 784ff21, 96eb88d, 99c8f26, a3c82b6, a74c741, ab8d5c5, c9f7bda, e3ed0b0, eb3e40c, ff72e59, ffffe6b)
✅ login: rustiqly / name: Rustiqly (agent of lihuay) (0337a33, 10b235e, 2454920, 262b3ef, 2e2312c, 338f16a, 3432d5a, 3b34a02, 3dc5d66, 5f7d407, 61bdb2f, 7765028, 784ff21, 96eb88d, 99c8f26, a3c82b6, a74c741, ab8d5c5, c9f7bda, e3ed0b0, eb3e40c, ff72e59, ffffe6b)
✅ login: ryanzhu706 / name: ryanzhu706 (f809989)
✅ login: SahilChaudhari / name: Sahil Chaudhari (d7b338f)
✅ login: saiarcot895 / name: Saikrishna Arcot (0157b90, 09d38df, 0ac7374, 2ca852b, 51ac8bf, 58f5de3, 6587f1d, 65dcb31, 6aee3fe, 6d6590c, 6f396cd, 7aeb5eb, 859be53, 8a2de68, 8d6842c, 99dc220, c13c854, cb29c7a, d4d9442, d53053e, dda14b5, f0bd820, f372acf, fd0e469)
✅ login: saksarav-nokia / name: saksarav-nokia (02586e7)
✅ login: saravanan-nexthop / name: saravanan sellappa (467c23d, 6a2d21c, 7d1e1a3, 856467d, 8711d35, 95d9314, 9fc37e1, a628692, b2ee618, ea60dfa)
✅ login: sdszhang / name: Dashuai Zhang (c19f14f)
✅ login: selva-nexthop / name: Selva (068e693)
✅ login: sg893052 / name: Senthil Kumar Guruswamy (3083b08)
✅ login: snider-nokia / name: snider-nokia (f098359)
✅ login: sonikajindal / name: sonikajindal (f13d29a)
✅ login: sreeiyer-1 / name: Sree Iyer (8aff4bf, a17872c)
✅ login: Staphylo / name: Samuel Angebault (049113d, 72a8e1f)
✅ login: stepanblyschak / name: Stepan Blyschak (049fcda)
✅ login: stephenxs / name: Stephen Sun (2abebef, bdc0309)
✅ login: StormLiangMS / name: StormLiangMS (722d891, 784ee1e)
✅ login: tirupatihemanth / name: Hemanth Kumar Tirupati (0441f5e, 09d38df, 3e6fef5, 4e377a5, 6f396cd, 7aeb5eb, 7bb43f6, 857f03b, 8d7baf7, 93ecccf, b1f1dd7, bfd0cee, dda14b5, e26aa9d, f0bd820, fede4f1)
✅ login: tjchadaga / name: Tejaswini Chadaga (014ed42, 2ba1b8f, 2eb5c56, 470a816, 6640b89, 804b772, c1af17e, c237368, ed0306b, eee9c39)
✅ login: venky-nexthop / name: venky-nexthop (29142b0, 857aed6)
✅ login: venu-nexthop / name: Venu (9fc37e1)
✅ login: vganesan-nokia / name: vganesan-nokia (55b612d)
✅ login: vivekrnv / name: Vivek (049fcda, 223560a, 6853de2, 985451f, b4785b0, c0fb37e)
✅ login: vivekverma-arista / name: Vivek Verma (bf726ec)
✅ login: vmittal-msft / name: Vineet Mittal (0a55276, 239a0be, 29142b0, 2ba1b8f, 398638f, 56b4aea, 6a2d21c, 6ed4a5b, 8da17cd, a264481, a628692, a79114d, c1af17e, fc95d63)
✅ login: volodymyrsamotiy / name: Volodymyr Samotiy (0bfe707, 25bad00, 38149a3, 8a98c86, 952c154, bfd0cee, c737e31, eb391db, f83f044)
✅ login: wangxin / name: Xin Wang (52d97b9, 55f2218)
✅ login: wsycqyz / name: ShiyanWangMS (56b4aea)
✅ login: wumiaont / name: wumiao_nokia (7df8b82)
✅ login: xincunli-sonic / name: Xincun Li (f80fc87)
✅ login: xwjiang-ms / name: xwjiang-ms (38cb93d, 423ec25, 9378ab4, cc05e47, f8f17d6)
✅ login: YairRaviv / name: Yair Raviv (2e2f970, 9c8ba49, 9e08990, ea5b19c)
✅ login: Yakiv-Huryk / name: Yakiv Huryk (8a6760d, ab93982)
✅ login: yanmarkman / name: Yan Markman (309acf9, 6ab0c88, 88f1f5d, e0d19b2, f6f0a2e, 09d38df)
✅ login: yejianquan / name: Jianquan Ye (6bc4f2f)
✅ login: yifan-nexthop / name: YiFan Wang (a31cc61)
✅ login: yijingyan2 / name: yijingyan2 (653d044, 6f6beba, 7abf1ee, 8d87e64, 91da4ef, b8150ef, d80a77a, df8491b, e4d14f1, e682873, eced40f, ed20dad)
✅ login: ymd-arista / name: Mohan Yelugoti (2d0f254)
✅ login: ysmanman / name: Song Yuan (0ee53c8)
✅ login: yuazhe / name: Yuanzhe (1c119b7, 51068a3, 7263872, cf055f2, d6b05f1)
✅ login: yue-fred-gao / name: yue-fred-gao (1119f21, 3a81d58, 9e2e035)
✅ login: yxieca / name: Ying Xie (a3827fa, a8f2de7, f809989)
✅ login: ZhaohuiS / name: Zhaohui Sun (1a3b91d, f08a274)
✅ login: zili11720 / name: ‪Zili Bombach‬‏ (781586f, d7cd443)
✅ login: zjswhhh / name: Jing Zhang (216e1fe, f81dfa9)
❌ The email address for the commit (64cf695, cec2663, 0441f5e, 3e6fef5) is not linked to the GitHub account, preventing the EasyCLA check. Consult this Help Article and GitHub Help to resolve. (To view the commit's email address, add .patch at the end of this PR page's URL.) For further assistance with EasyCLA, please submit a support request ticket.

One or more co-authors of this pull request were not found. You must specify co-authors in commit message trailer via:

Co-authored-by: name <email>

Supported Co-authored-by: formats include:

Anything <[email protected]> - it will locate your GitHub user by id part.
Anything <[email protected]> - it will locate your GitHub user by login part.
Anything <public-email> - it will locate your GitHub user by public-email part. Note that this email must be made public on Github.
Anything <other-email> - it will locate your GitHub user by other-email part but only if that email was used before for any other CLA as a main commit author.
login <any-valid-email> - it will locate your GitHub user by login part, note that login part must be at least 3 characters long.

Please update your commit message(s) by doing git commit --amend and then git push [--force] and then request re-running CLA check via commenting on this pull request:

/easycla

mssonicbld · 2026-03-06T04:42:37Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2026-03-06T04:42:50Z

Azure Pipelines successfully started running 1 pipeline(s).

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

Copilot · 2026-03-06T04:43:15Z

build_debug_docker_j2.sh

apt is not recommended in non-interactive Docker builds (more likely to produce prompts/unstable CLI output). Prefer apt-get (and keep update/install in the same layer when possible) to make the build deterministic.

Suggested change

RUN apt-get install -f -y \

Copilot · 2026-03-06T04:43:16Z

Makefile.work

The test [ $(ENABLE_DOCKER_BASE_PULL) == y ] will emit a shell error when ENABLE_DOCKER_BASE_PULL is empty/unset (common for optional env vars). Quote the variable and/or use [[ ... ]] to avoid noisy failures and to ensure the pull path behaves predictably.

Copilot · 2026-03-06T04:43:16Z

Makefile

Multi-distro dispatch is inconsistent: bullseye/bookworm route through the distro target with EXTRA_DOCKER_TARGETS, while trixie forwards $@ directly. This increases the risk that trixie behaves differently (e.g., missing shared distro setup steps). Consider using the same dispatch pattern for trixie for consistency.

Suggested change

$(MAKE_WITH_RETRY) EXTRA_DOCKER_TARGETS=$(notdir $@) BLDENV=trixie -f Makefile.work trixie

Copilot · 2026-03-06T04:43:16Z

README.md

Piping a remote script directly into bash is a supply-chain risk (users can't inspect what will run, and it executes whatever the server returns at that moment). Prefer documenting a safer flow: download to a file, review it, optionally pin to a commit hash/tag, then execute.

Suggested change

curl -sSL -o prerequisites.sh https://raw.githubusercontent.com/sonic-net/sonic-buildimage/master/scripts/prerequisites.sh

# Optionally, inspect the script before running it:

less prerequisites.sh

bash prerequisites.sh

Copilot · 2026-03-06T04:43:16Z

device/arista/x86_64-arista_7060x6_16pe_384c/sensors.conf

Correct spelling in the sensor label: 'Ambiant' → 'Ambient'.

Suggested change

label temp4 "Inlet Ambient Air"

FengPan-Frank · 2026-03-09T04:40:37Z

use #25962 instead of this PR

FengPan-Frank requested a review from lguohan as a code owner December 4, 2025 12:42

Copilot AI review requested due to automatic review settings December 4, 2025 12:42

Copilot started reviewing on behalf of FengPan-Frank December 4, 2025 12:42 View session

FengPan-Frank requested a review from make1980 December 4, 2025 12:44

Copilot finished reviewing on behalf of FengPan-Frank December 4, 2025 12:46

Copilot AI reviewed Dec 4, 2025

View reviewed changes

Copilot AI review requested due to automatic review settings December 5, 2025 03:05

Copilot started reviewing on behalf of FengPan-Frank December 5, 2025 03:06 View session

Copilot finished reviewing on behalf of FengPan-Frank December 5, 2025 03:09

Copilot AI reviewed Dec 5, 2025

View reviewed changes

Copilot AI review requested due to automatic review settings December 12, 2025 10:42

Copilot started reviewing on behalf of FengPan-Frank December 12, 2025 10:43 View session

Copilot AI reviewed Dec 12, 2025

View reviewed changes

Copilot AI review requested due to automatic review settings January 15, 2026 10:58

Copilot started reviewing on behalf of FengPan-Frank January 15, 2026 10:58 View session

Copilot AI reviewed Jan 15, 2026

View reviewed changes

rustiqly and others added 16 commits March 6, 2026 04:40

Support fallback value for VOUT_MODE in PDDF PSU driver (sonic-net#25160

ea60dfa

) Signed-off-by: Roy Wen <[email protected]> Co-authored-by: saravanan sellappa <[email protected]> Signed-off-by: Feng Pan <[email protected]>

marvell-prestera: sai-1.17.1-1 (sonic-net#24945)

88f1f5d

Signed-off-by: Yan Markman <[email protected]> Co-authored-by: Lihua Yuan <[email protected]> Signed-off-by: Feng Pan <[email protected]>

marvell-prestera: raise syncd nice -8 priority (sonic-net#24946)

f6f0a2e

Fix for issue sonic-net#24771 syncd supervisor-proc-exit-listener FATAL under startup and high CPU loading Signed-off-by: Yan Markman <[email protected]> Signed-off-by: Feng Pan <[email protected]>

Update DNX SAI version to 14.1.0.1.0.0.13.1 (sonic-net#25901)

470a816

Signed-off-by: Tejaswini Chadaga <[email protected]> Signed-off-by: Feng Pan <[email protected]>

Copilot AI review requested due to automatic review settings March 6, 2026 04:40

FengPan-Frank force-pushed the watchcert branch from e4330fb to 0180658 Compare March 6, 2026 04:40

FengPan-Frank requested review from qiluo-msft and xumia as code owners March 6, 2026 04:40

Merge branch 'master' into watchcert

2abe24d

Copilot AI reviewed Mar 6, 2026

View reviewed changes

FengPan-Frank mentioned this pull request Mar 9, 2026

Add TELEMETRY_WATCHDOG_CERT_PROBE_ENABLED function into watchdog and fix #25962

Merged

8 tasks

FengPan-Frank closed this Mar 9, 2026

-// BAD (expected fail) probe
-const DEFAULT_BAD_CA: &str = "/etc/sonic/telemetry/dsmsroot.cer";
-const DEFAULT_BAD_CERT: &str = "/etc/sonic/telemetry/streamingtelemetryserver.cer";
-const DEFAULT_BAD_KEY: &str = "/etc/sonic/telemetry/streamingtelemetryserver.key";
-const DEFAULT_BAD_TNAME: &str = "server.ndastreaming.ap.gbl";
-// GOOD (expected success) probe
-const DEFAULT_GOOD_CA: &str = "/etc/sonic/credentials/AME_ROOT_CERTIFICATE.pem";
-const DEFAULT_GOOD_CERT: &str = "/etc/sonic/credentials/sonick8sclient2.crt";
-const DEFAULT_GOOD_KEY: &str = "/etc/sonic/credentials/sonick8sclient2.key";
-const DEFAULT_GOOD_TNAME: &str = "SonicK8sDashboard.NETWORK-test-bl6p.bl6p.ap.gbl";
+// BAD (expected fail) probe environment variable names
+const BAD_CA_ENV_VAR: &str = "TELEMETRY_WATCHDOG_BAD_CA";
+const BAD_CERT_ENV_VAR: &str = "TELEMETRY_WATCHDOG_BAD_CERT";
+const BAD_KEY_ENV_VAR: &str = "TELEMETRY_WATCHDOG_BAD_KEY";
+const BAD_TNAME_ENV_VAR: &str = "TELEMETRY_WATCHDOG_BAD_TNAME";
+// GOOD (expected success) probe environment variable names
+const GOOD_CA_ENV_VAR: &str = "TELEMETRY_WATCHDOG_GOOD_CA";
+const GOOD_CERT_ENV_VAR: &str = "TELEMETRY_WATCHDOG_GOOD_CERT";
+const GOOD_KEY_ENV_VAR: &str = "TELEMETRY_WATCHDOG_GOOD_KEY";
+const GOOD_TNAME_ENV_VAR: &str = "TELEMETRY_WATCHDOG_GOOD_TNAME";
+// BAD (expected fail) probe defaults
+const DEFAULT_BAD_CA: &str = "/etc/sonic/telemetry/dsmsroot.cer";
+const DEFAULT_BAD_CERT: &str = "/etc/sonic/telemetry/streamingtelemetryserver.cer";
+const DEFAULT_BAD_KEY: &str = "/etc/sonic/telemetry/streamingtelemetryserver.key";
+const DEFAULT_BAD_TNAME: &str = "server.ndastreaming.ap.gbl";
+// GOOD (expected success) probe defaults
+const DEFAULT_GOOD_CA: &str = "/etc/sonic/credentials/AME_ROOT_CERTIFICATE.pem";
+const DEFAULT_GOOD_CERT: &str = "/etc/sonic/credentials/sonick8sclient2.crt";
+const DEFAULT_GOOD_KEY: &str = "/etc/sonic/credentials/sonick8sclient2.key";
+const DEFAULT_GOOD_TNAME: &str = "SonicK8sDashboard.NETWORK-test-bl6p.bl6p.ap.gbl";
+// Helper functions to get BAD/GOOD probe values from env or default
+fn get_bad_ca() -> String {
+    std::env::var(BAD_CA_ENV_VAR).unwrap_or_else(|_| DEFAULT_BAD_CA.to_string())
+}
+fn get_bad_cert() -> String {
+    std::env::var(BAD_CERT_ENV_VAR).unwrap_or_else(|_| DEFAULT_BAD_CERT.to_string())
+}
+fn get_bad_key() -> String {
+    std::env::var(BAD_KEY_ENV_VAR).unwrap_or_else(|_| DEFAULT_BAD_KEY.to_string())
+}
+fn get_bad_tname() -> String {
+    std::env::var(BAD_TNAME_ENV_VAR).unwrap_or_else(|_| DEFAULT_BAD_TNAME.to_string())
+}
+fn get_good_ca() -> String {
+    std::env::var(GOOD_CA_ENV_VAR).unwrap_or_else(|_| DEFAULT_GOOD_CA.to_string())
+}
+fn get_good_cert() -> String {
+    std::env::var(GOOD_CERT_ENV_VAR).unwrap_or_else(|_| DEFAULT_GOOD_CERT.to_string())
+}
+fn get_good_key() -> String {
+    std::env::var(GOOD_KEY_ENV_VAR).unwrap_or_else(|_| DEFAULT_GOOD_KEY.to_string())
+}
+fn get_good_tname() -> String {
+    std::env::var(GOOD_TNAME_ENV_VAR).unwrap_or_else(|_| DEFAULT_GOOD_TNAME.to_string())
+}

	// Certificate probes on reboot-cause/history API
	// Certificate probes using the reboot-cause/history API.
	// This endpoint is used as a representative gNMI query to test certificate validation.

-                            // Certificate probes on reboot-cause/history API
-                            // 1) BAD cert: expect failure
-                            // 2) GOOD cert: expect success
+                            // Certificate validation probes on reboot-cause/history API.
+                            // This tests certificate authentication with a negative/positive test pair:
+                            // 1) Attempt to connect with a known invalid (BAD) certificate and expect failure (negative test).
+                            // 2) Attempt to connect with a known valid (GOOD) certificate and expect success (positive test).


	$(MAKE_WITH_RETRY) EXTRA_DOCKER_TARGETS=$(notdir $@) BLDENV=trixie -f Makefile.work trixie

+curl -sSL -o prerequisites.sh https://raw.githubusercontent.com/sonic-net/sonic-buildimage/master/scripts/prerequisites.sh
+# Optionally, inspect the script before running it:
+less prerequisites.sh
+bash prerequisites.sh

Conversation

FengPan-Frank commented Dec 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why I did it

Work item tracking

How I did it

How to verify it

Which release branch to backport (provide reason below if selected)

Tested branch (Please provide the tested image version)

Description for the changelog

Link to config_db schema for YANG module changes

A picture of a cute animal (not mandatory but encouraged)

Uh oh!

mssonicbld commented Dec 4, 2025

Uh oh!

azure-pipelines bot commented Dec 4, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI Dec 4, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Dec 4, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 4, 2025

Choose a reason for hiding this comment

Uh oh!

mssonicbld commented Dec 4, 2025

Uh oh!

azure-pipelines bot commented Dec 4, 2025

Uh oh!

mssonicbld commented Dec 5, 2025

Uh oh!

azure-pipelines bot commented Dec 5, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI Dec 5, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 5, 2025

Choose a reason for hiding this comment

Uh oh!

mssonicbld commented Dec 11, 2025

Uh oh!

azure-pipelines bot commented Dec 11, 2025

Uh oh!

mssonicbld commented Dec 12, 2025

Uh oh!

azure-pipelines bot commented Dec 12, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI Dec 12, 2025

Choose a reason for hiding this comment

Uh oh!

mssonicbld commented Jan 5, 2026

Uh oh!

azure-pipelines bot commented Jan 5, 2026

Uh oh!

mssonicbld commented Jan 15, 2026

Uh oh!

azure-pipelines bot commented Jan 15, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

FengPan-Frank commented Dec 4, 2025 •

edited

Loading

linux-foundation-easycla bot commented Mar 6, 2026 •

edited

Loading