Add policy-forwarding network-instance attachment point #1224
+181
−13
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,8 +1,8 @@ | ||
| - name: openconfig-policy-forwarding | ||
| docs: | ||
| - yang/policy-forwarding/openconfig-pf-srte.yang | ||
| - yang/policy-forwarding/openconfig-policy-forwarding.yang | ||
| build: | ||
| - yang/policy-forwarding/openconfig-pf-srte.yang | ||
| - yang/policy-forwarding/openconfig-policy-forwarding.yang | ||
| run-ci: true |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,133 @@ | ||
| submodule openconfig-pf-network-instances { | ||
| belongs-to openconfig-policy-forwarding { | ||
| prefix "oc-pf"; | ||
| } | ||
|
|
||
| import openconfig-extensions { | ||
| prefix "oc-ext"; | ||
| } | ||
| include openconfig-pf-forwarding-policies; | ||
|
|
||
| organization | ||
| "OpenConfig working group"; | ||
|
|
||
| contact | ||
| "OpenConfig working group | ||
| www.openconfig.net"; | ||
|
|
||
| description | ||
| "This submodule contains groupings to attach | ||
| a policy-forwarding policy to one or more network-instances. | ||
|
|
||
| When attached to a network-instance, the policy-forwarding rules | ||
| should be evaluated against packets in the specified | ||
| network-instances."; | ||
|
|
||
| oc-ext:openconfig-version "0.8.0"; | ||
|
|
||
| revision "2024-11-26" { | ||
| description | ||
| "Add network-instance as an attachment point."; | ||
| reference | ||
| "0.8.0"; | ||
| } | ||
|
|
||
| grouping pf-network-instances-structural { | ||
| description | ||
| "Structural grouping for network-instances to forwarding policy | ||
| bindings within the policy-forwarding model."; | ||
|
|
||
| container network-instances { | ||
| description | ||
| "Configuration and operational state relating policy | ||
| forwarding on interfaces."; | ||
|
|
||
| list network-instance { | ||
| key "name"; | ||
|
|
||
| description | ||
| "Configuration and operationals state relating to the | ||
| relationship between network-instances and policy-based | ||
| forwarding rules."; | ||
|
|
||
| leaf name { | ||
| type leafref { | ||
| path "../config/name"; | ||
| } | ||
| description | ||
| "A reference to the name of the network-instance | ||
| being referenced by the policy."; | ||
| } | ||
|
|
||
| container config { | ||
| description | ||
| "Configuration parameters relating to a network-instance to | ||
| policy forwarding rule binding."; | ||
|
|
||
| uses pf-network-instance-config; | ||
| } | ||
|
|
||
| container state { | ||
| config false; | ||
| description | ||
| "Operational state parameters relating to a network-instance to | ||
| policy forwarding rule binding."; | ||
|
|
||
| uses pf-network-instance-config; | ||
| } | ||
| } | ||
| } | ||
| } | ||
|
|
||
| grouping pf-network-instance-config { | ||
| description | ||
| "Configuration parameters relating to an interface to policy | ||
| forwarding rule binding."; | ||
|
|
||
| leaf name { | ||
| type leafref { | ||
| path "/network-instances/network-instance/" + | ||
| "config/name"; | ||
| // path "/oc-netinst:network-instances/oc-netinst:network-instance/" + | ||
| // "oc-netinst:config/oc-netinst:name"; | ||
| } | ||
| description | ||
| "A unique identifier for the network-instance."; | ||
| } | ||
|
|
||
| leaf apply-forwarding-policy { | ||
| type leafref { | ||
| // We are at /network-instances/network-instance/ | ||
| // policy-forwarding/network-instances/network-instance/config/ | ||
| // apply-forwarding-policy | ||
| path "../../../../policies/policy/config/policy-id"; | ||
| } | ||
| description | ||
| "The policy to be applied on the network-instance. Packets ingress | ||
| on the referenced interface should be compared to the match | ||
| criteria within the specified policy, and in the case that | ||
| these criteria are met, the forwarding actions specified | ||
| applied. These policies should be applied following quality of | ||
| service classification, and ACL actions if such entities are | ||
| referenced by the corresponding interface."; | ||
| } | ||
|
Comment on lines
+105
to
+113
There was a problem hiding this comment. This description still talks about the "referenced interface". |
||
|
|
||
| leaf apply-vrf-selection-policy { | ||
| type leafref { | ||
| // We are at /network-instances/network-instance/ | ||
| // policy-forwarding/network-instances/network-instance/config/ | ||
| // apply-vrf-selection-policy | ||
| path "../../../../policies/policy/config/policy-id"; | ||
| } | ||
| description | ||
| "Apply the specific VRF selection policy on the network-instance. | ||
|
|
||
| The referenced policy MUST be of the type VRF_SELECTION_POLICY. | ||
| The VRF selection policy may coexist with a policy-forwarding policy. | ||
|
|
||
| The policy specified in this leaf is used to specifically choose the | ||
| L3VRF network instance that is used for specific input criteria of | ||
| packets."; | ||
| } | ||
| } | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Similar comment to what I left in the previous PR #1150: what are the "packets in the specified network-instances"?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The operational use case motivating this PR is for packets ingress to the device which arrive on interfaces (including virtual interfaces) which are mapped to a network-instance.
I am not aware of an operational use case that we have for packets re-directed from another network-instance.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Policy forwarding entries are already defined within a network instance, so what does the enclosing network instance mean?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thus, in terms of functionality, this configuration will be fully equivalent to applying a policy to all interfaces associated with the network-instance? We just adding a "simpler" way to configure this?
Can this be explicitly stated in the description? Thanks
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes, that is correct. I will make this explicit in the description
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It is true, but without any "apply-policy" configuration, it is ambiguous where the policy is applied? Further, since OC has a way to apply-policy to interfaces, if none are specified, what should the behavior be?
I'd prefer an explicit leaf for this.
I will change the name/description from a leaf-ref to network-instance instead to a boolean like 'all-interfaces'. In our use case, we only want to apply the policy to the same network-instance the policy is defined in, and not some different network-instance.