Update openconfig-system-grpc.yang by danielbarney · Pull Request #1531 · openconfig/public

danielbarney · 2026-08-03T21:27:34Z

Parameter Mapping

Device Configuration	OpenConfig YANG Path	Type / Range	Configured Value	Default Value
`tls mutual`	`/system/grpc-servers/grpc-server/config/tls-mutual`	`boolean`	`true`	`false`
`keepalive time 5`	`/system/grpc-servers/grpc-server/keepalive/config/time`	`uint32` (range `1..max`, seconds)	`5`	Unset / system default
`keepalive min-keepalive-interval 5`	`/system/grpc-servers/grpc-server/keepalive/config/min-keepalive-interval`	`uint32` (range `1..max`, seconds)	`5`	Unset / system default
`max-concurrent-streams 128`	`/system/grpc-servers/grpc-server/config/max-concurrent-streams`	`uint32` (range `1..max`)	`128`	Unset / system default

Configuration Example

{
  "openconfig-system:system": {
    "openconfig-system-grpc:grpc-servers": {
      "grpc-server": [
        {
          "name": "gnxi-mgmt",
          "config": {
            "name": "gnxi-mgmt",
            "port": 9339,
            "transport-security": true,
            "tls-mutual": true,
            "max-concurrent-streams": 128,
          },
          "keepalive": {
            "config": {
              "time": 5,
              "min-keepalive-interval": 5
            }
          }
        }
      ]
    }
  }
}

 module: openconfig-system-grpc
 
   augment /oc-sys:system:
     +--rw grpc-servers
        +--rw grpc-server* [name]
           +--rw name          -> ../config/name
           +--rw config
           |  +--rw name?                      string
           |  +--rw services*                  identityref
           |  +--rw enable?                    boolean
           |  +--rw port?                      oc-inet:port-number
           |  +--rw transport-security?        boolean
+          |  +--rw tls-mutual?                boolean
           |  +--rw certificate-id?            string
           |  +--rw metadata-authentication?   boolean
+          |  +--rw max-concurrent-streams?    uint32
           |  +--rw listen-addresses*          union
           |  +--rw network-instance?          oc-ni:network-instance-ref
           +--ro state
           |  +--ro name?                      string
           |  +--ro services*                  identityref
           |  +--ro enable?                    boolean
           |  +--ro port?                      oc-inet:port-number
           |  +--ro transport-security?        boolean
+          |  +--ro tls-mutual?                boolean
           |  +--ro certificate-id?            string
           |  +--ro metadata-authentication?   boolean
+          |  +--ro max-concurrent-streams?    uint32
           |  +--ro listen-addresses*          union
           |  +--ro network-instance?          oc-ni:network-instance-ref
+          +--rw keepalive
+          |  +--rw config
+          |  |  +--rw time?                   uint32
+          |  |  +--rw min-keepalive-interval? uint32
+          |  |  +--rw timeout?                uint32
+          |  +--ro state
+          |     +--ro time?                   uint32
+          |     +--ro min-keepalive-interval? uint32
+          |     +--ro timeout?                uint32
           +--ro connections
              +--ro connection* [address port]
                 +--ro address     -> ../state/address
                 +--ro port        -> ../state/port
                 +--ro state
                 |  +--ro address?    oc-inet:ip-address
                 |  +--ro port?       oc-inet:port-number
                 |  +--ro counters
                 |     +--ro bytes-sent?        oc-yang:counter64
                 |     +--ro packets-sent?      oc-yang:counter64
                 |     +--ro data-send-error?   oc-yang:counter64
                 +--ro counters
                    +--ro bytes-sent?        oc-yang:counter64
                    +--ro packets-sent?      oc-yang:counter64
                    +--ro data-send-error?   oc-yang:counter64

Nokia Implementation

Nokia implementation relays on TLS profile being configured with authenticate-client

{
  "system": {
    "tls": {
      "profile": [
        {
          "name": "tls",
          "key": " ... ",
          "certificate": "-----BEGIN CERTIFICATE-----\n ... \n-----END CERTIFICATE-----",
          "authenticate-client": true      <<<<<<<<<<< mTLS enabled
        }
      ]
    },
    "grpc-server": [
      {
        "name": "mgmt",
        "admin-state": "enable",
        "rate-limit": 65000,
        "session-limit": 1024,
        "metadata-authentication": true,
        "yang-models": "openconfig",
        "tls-profile": "tls",
        "network-instance": "mgmtVrf",
        "port": 9339,
        "services": [
          "gnmi",
          "gnoi",
          "gnsi"
        ],
        "gnmi": {
          "commit-save": true
        },
        "unix-socket": {
          "admin-state": "enable"
        }
      }
    ]
  }
}

Cisco Implementation

Cisco implementations relays not just on having the profile saved to harddisk (the configuration of the profile does not shows in the configuration) rather the gRPC server needs to be aligned to the content of the profile and adding mtls dual under each server configuration.

grpc 
server gnxi-mgmt
  vrf mgmtVrf
  dscp cs4
  port 9339
  tls mutual <<<<<<<  + Profile in harddisk
  services GNMI
  services GNOI
  services GNSI
  services ATTESTZ
  services ENROLLZ
  ssl-profile-id tls
  metadata-authentication disable
 !

Arista implementation

management security
   ssl profile tls
      certificate eea339da.10.crt key eea339da.10.key
      trust certificate a69360bc.11.crt
      chain certificate 377050fb.9.crt
!
management api gnmi
   transport grpc default
      ssl profile tls
      port 9339
      vrf mgmtVrf
      qos dscp 32
      accounting requests
      aaa config-commands disabled
      authentication username priority x509-spiffe x509-common-name

Adding gRPC knobs to support

gemini-code-assist

Code Review

This pull request updates the openconfig-system-grpc YANG module to version 1.2.0, introducing support for mutual TLS, max concurrent streams, and gRPC server keepalive configurations. The feedback suggests adding a must constraint to ensure tls-mutual is only enabled when transport-security is active. Additionally, it recommends improving the keepalive configuration by clarifying the min-keepalive-interval description, enforcing that timeout is less than time via a must constraint, and adding a permit-without-stream parameter to prevent rate-limiting on idle connections.

danielbarney · 2026-08-05T04:27:22Z

What is the suggested naming for enforcing mTLS under the grpc-server

/system/grpc-servers/grpc-server/authenticate-client
/system/grpc-servers/grpc-server/tls-mutual

macb2625 · 2026-08-05T18:10:06Z

        are not supported, such as lab testing.";
    }

+    leaf tls-mutual {  


i would add one more container "tls" under config so that we can extend it to add ssl/tls-profile(certz reference) and other TLS specific configs which can help me control version, ciphers, signature algorithms etc. Please check the feasibility of this approach

@navaneethyv What do you think?

As it stands, this leaf is not enough for mutual auth. The schema needs to be mindful of both any gNSI approaches as well as schema-driven profiles/references (the latter being the predominant deployment across secured gRPC transports today)

Agree that TLS is in need of its own hierarchy to consolidate all TLS related parameters

e.g. JUNOS/EVO

# set system services http servers server S1 tls ? Possible completions: <[Enter]> Execute this command + apply-groups Groups from which to inherit configuration data + apply-groups-except Don't inherit configuration data from these groups local-certificate Name of local X.509 certificate to use > mutual-authentication Enable TLS mutual authentication | Pipe through a command [edit] # set system services http servers server S1 tls mutual-authentication ? Possible completions: <[Enter]> Execute this command + apply-groups Groups from which to inherit configuration data + apply-groups-except Don't inherit configuration data from these groups authentication-type Specify requirements for client certificate certificate-authority Certificate authority profile | Pipe through a command [edit] # set system services http servers server S1 tls mutual-authentication authentication-type ? Possible completions: dont-request-cert Client certificate is not requested request-cert-but-dont-verify Request certificate from client, do not verify request-cert-and-verify Request certificate from client, verify if provided request-and-require-cert-but-dont-verify Client certificate is mandatory, do not verify request-and-require-cert-and-verify Client certificate is mandatory, certificate is verified

earies · 2026-08-05T22:39:05Z

        are not supported, such as lab testing.";
    }

+    leaf tls-mutual {  


As it stands, this leaf is not enough for mutual auth. The schema needs to be mindful of both any gNSI approaches as well as schema-driven profiles/references (the latter being the predominant deployment across secured gRPC transports today)

Agree that TLS is in need of its own hierarchy to consolidate all TLS related parameters

e.g. JUNOS/EVO

# set system services http servers server S1 tls ? Possible completions: <[Enter]> Execute this command + apply-groups Groups from which to inherit configuration data + apply-groups-except Don't inherit configuration data from these groups local-certificate Name of local X.509 certificate to use > mutual-authentication Enable TLS mutual authentication | Pipe through a command [edit] # set system services http servers server S1 tls mutual-authentication ? Possible completions: <[Enter]> Execute this command + apply-groups Groups from which to inherit configuration data + apply-groups-except Don't inherit configuration data from these groups authentication-type Specify requirements for client certificate certificate-authority Certificate authority profile | Pipe through a command [edit] # set system services http servers server S1 tls mutual-authentication authentication-type ? Possible completions: dont-request-cert Client certificate is not requested request-cert-but-dont-verify Request certificate from client, do not verify request-cert-and-verify Request certificate from client, verify if provided request-and-require-cert-but-dont-verify Client certificate is mandatory, do not verify request-and-require-cert-and-verify Client certificate is mandatory, certificate is verified

earies · 2026-08-05T23:00:29Z

+        is detected.";  
+    }  
+
+    leaf min-keepalive-interval {  


Suggested change

leaf min-keepalive-interval {

leaf min-interval {

Already under keepalive container

earies · 2026-08-05T23:05:35Z

+    leaf tls-mutual {  
+      type boolean;  
+      default false;  
+      must "not(../transport-security) or ../transport-security = 'true'" {  


This might be the time to question transport-security defaulting to true. Great idea to enforce secure channels but there are dependencies that need to be fulfilled prior to that assumption.

This should be able to be conveyed with just:

Suggested change

must "not(../transport-security) or ../transport-security = 'true'" {

must "../transport-security = 'true'" {

However default=true is imo problematic in reality

earies · 2026-08-05T23:05:59Z

+    description  
+      "Configuration parameters relating to gRPC server keepalive.";  
+
+    leaf time {  


Suggested change

leaf time {

leaf interval {

LimeHat · 2026-08-06T19:29:53Z

        are not supported, such as lab testing.";
    }

+    leaf tls-mutual {  


In two of the referenced implementations (Nokia and Arista), mTLS is configured exclusively at the TLS-profile level.

Although a case can be made for placing it at the per-server level, I don’t see any rationale for choosing this approach in the description.

LimeHat · 2026-08-06T21:00:12Z

+
+    leaf time {  
+      type uint32 {  
+        range "1..max";  


This probably can start at 0 (where 0 means disabled)?

Update openconfig-system-grpc.yang

9198bd0

Adding gRPC knobs to support

danielbarney requested a review from a team as a code owner August 3, 2026 21:27

github-project-automation Bot added this to OC Operator Review Aug 3, 2026

gemini-code-assist Bot reviewed Aug 3, 2026

View reviewed changes

Comment thread release/models/system/openconfig-system-grpc.yang Outdated

Comment thread release/models/system/openconfig-system-grpc.yang Outdated

adding changes code-review suggested

2039aa9

macb2625 reviewed Aug 5, 2026

View reviewed changes

earies reviewed Aug 5, 2026

View reviewed changes

LimeHat suggested changes Aug 6, 2026

View reviewed changes

LimeHat reviewed Aug 6, 2026

View reviewed changes

Navigation Menu

Uh oh!

Update openconfig-system-grpc.yang - #1531

Update openconfig-system-grpc.yang#1531
danielbarney wants to merge 2 commits into
openconfig:masterfrom
danielbarney:danielbarney/grpc-knobs

danielbarney commented Aug 3, 2026 •

edited

Loading

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

Uh oh!

Uh oh!

danielbarney commented Aug 5, 2026

Uh oh!

macb2625 Aug 5, 2026

Uh oh!

danielbarney Aug 5, 2026

Uh oh!

earies Aug 5, 2026

Uh oh!

earies Aug 5, 2026

Uh oh!

earies Aug 5, 2026

Uh oh!

earies Aug 5, 2026

Uh oh!

earies Aug 5, 2026

Uh oh!

LimeHat Aug 6, 2026

Uh oh!

LimeHat Aug 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

	must "not(../transport-security) or ../transport-security = 'true'" {
	must "../transport-security = 'true'" {

Uh oh!

Conversation

danielbarney commented Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Parameter Mapping

Configuration Example

Nokia Implementation

Cisco Implementation

Arista implementation

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

danielbarney commented Aug 5, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

danielbarney commented Aug 3, 2026 •

edited

Loading