Re: [netmod] system configuration sync mechanism

Kent Watsen <kent+ietf@watsen.net> Mon, 02 August 2021 22:32 UTC

Return-Path: <0100017b08feb7ef-71cbbcaa-256f-4947-ab27-9fdd40f2993a-000000@amazonses.watsen.net>
X-Original-To: netmod@ietfa.amsl.com
Delivered-To: netmod@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EBE043A1F6F for <netmod@ietfa.amsl.com>; Mon, 2 Aug 2021 15:32:04 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.895
X-Spam-Level:
X-Spam-Status: No, score=-1.895 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=amazonses.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IWwVQ3nrxGyu for <netmod@ietfa.amsl.com>; Mon, 2 Aug 2021 15:31:58 -0700 (PDT)
Received: from a8-83.smtp-out.amazonses.com (a8-83.smtp-out.amazonses.com [54.240.8.83]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 52BD83A1F5E for <netmod@ietf.org>; Mon, 2 Aug 2021 15:31:58 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=ug7nbtf4gccmlpwj322ax3p6ow6yfsug; d=amazonses.com; t=1627943517; h=From:Message-Id:Content-Type:Mime-Version:Subject:Date:In-Reply-To:Cc:To:References:Feedback-ID; bh=LdVxDxkwRxR2bKBwrN2bAqilXoBH4S1hZmShzhhsIpo=; b=C6ibJ4SEN3MaMl5SppOfMFzAhmDpNtgfjQiihWhb4YBpzRyomLfBw+Kca1REQIet cCEul9Lun5CK0ABfuPaAAYB/Dcw1D6s0yNlROs/SkeOOs4U527jypmQWaATJES4aQxO QZ8TDoD16NS4r0acejxkvd+i+fnkh5LCBtZ7r2OU=
From: Kent Watsen <kent+ietf@watsen.net>
Message-ID: <0100017b08feb7ef-71cbbcaa-256f-4947-ab27-9fdd40f2993a-000000@email.amazonses.com>
Content-Type: multipart/alternative; boundary="Apple-Mail=_AE36BCB5-7AFD-4C56-8D60-C6ED2D7C41E1"
Mime-Version: 1.0 (Mac OS X Mail 14.0 \(3654.100.0.2.22\))
Date: Mon, 02 Aug 2021 22:31:56 +0000
In-Reply-To: <CABCOCHT6yGFj84ryK9wghFnO52uQoLydKm-OU9M5+gqqs4jAzA@mail.gmail.com>
Cc: Balázs Lengyel <balazs.lengyel=40ericsson.com@dmarc.ietf.org>, "maqiufang (A)" <maqiufang1@huawei.com>, "netmod@ietf.org" <netmod@ietf.org>
To: Andy Bierman <andy@yumaworks.com>
References: <5b76dae2175545959f0006b036efd647@huawei.com> <2d1262bc90fc49d08eb641365b959ea4@huawei.com> <0100017aab854793-eb989e55-8496-451b-84de-7f17cb0720d5-000000@email.amazonses.com> <add2ee3bb9094e1da6a3160824d5fdff@huawei.com> <0100017aee17493f-6b9b747c-f0f1-4a70-b929-aaa0350a555f-000000@email.amazonses.com> <aa3dfdb471f0430aa50c4e35b9672fb1@huawei.com> <AM8PR07MB823008D0A83507EFCBD2DDA3F0ED9@AM8PR07MB8230.eurprd07.prod.outlook.com> <CABCOCHT6yGFj84ryK9wghFnO52uQoLydKm-OU9M5+gqqs4jAzA@mail.gmail.com>
X-Mailer: Apple Mail (2.3654.100.0.2.22)
Feedback-ID: 1.us-east-1.DKmIRZFhhsBhtmFMNikgwZUWVrODEw9qVcPhqJEI2DA=:AmazonSES
X-SES-Outgoing: 2021.08.02-54.240.8.83
Archived-At: <https://mailarchive.ietf.org/arch/msg/netmod/yb_L3ETF5cFajeZZoUnooj504DM>
Subject: Re: [netmod] system configuration sync mechanism
X-BeenThere: netmod@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: NETMOD WG list <netmod.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/netmod>, <mailto:netmod-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/netmod/>
List-Post: <mailto:netmod@ietf.org>
List-Help: <mailto:netmod-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/netmod>, <mailto:netmod-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 02 Aug 2021 22:32:14 -0000

Hi Balazs, Andy, Quifang,

> I agree a new datastore will just add complexity without any value.
> Your solution approach is better, but I think it would require a new YANG version
> to allow config node XPath to reference non-config nodes.

In no case is there a need for a config Xpath to ref non-config.


> Another solution is to model the referenced node as config=true, but setup
> automatic NACM rules so no user editing is allowed. This works well for
> setting up an initial config that gets saved and not changed unless a reset is done.

I don’t like the NACM dependency.


> What if <intended> is what is NV-stored?  When that occurs, the config changes from system to user config.
> Routers have been saving the combined config for decades. IMO the standards
> intentionally avoid discussing the conversion of a datastore to/from NV-storage.

I’m unsure about this point, but a don’t see any dependency on an NV-store needing to use a particular encoding or format.

> As I see it this is the same problem that we discussed in https://github.com/netmod-wg/yang-next/issues/41 <https://github.com/netmod-wg/yang-next/issues/41>.
> 
> I know this is a radical change, but I think using a new YANG extension to create a read-only config=true datatype is a much cleaner solution. One which some companies have already implemented.
> 
> +1
> 
> Actually, separate running and system would be a radical change, not this.
> Cleaner and less disruptive. 

I disagree with the need to resolve issue #41 here, and I disagree a <system> datastore would be a radical change, or even complicated.

That said, something like RFC 6243 (with-defaults) but called “with-system” could work.  That is, the “system" config is like <running> config that is hidden until asked to be revealed. It would be interesting to discuss if “with-defaults" returns all of the system config, or just the parts that are used, assuming we define “used” appropriately.   Presumably system-defined ordered-list entries cannot be ordered by user, or used as before/after pivots.

We could even do both: have a read-only <system> datastore *and* a "with-system" interaction API.  Each complimenting the other.

FWIW, a "with-system <running>” still may not pass validation if, e.g., templates need to be expanded.  Of course, any controller/orchestrator can expand the templates themselves to resolve that concern.  Such a system could also fetch <system> without skipping a beat.

Thought exercise: a controller is managing 1000 endpoints all running the same software version.  Is it better for the controller to get "with-system <running>” 1000 times, or get <system> once and have knowledge for how its merged in?

K.