From 9198bd0bfe597541317381034298fc82719a2565 Mon Sep 17 00:00:00 2001 From: Daniel Barney Date: Mon, 3 Aug 2026 14:19:39 -0700 Subject: [PATCH 1/2] Update openconfig-system-grpc.yang Adding gRPC knobs to support --- .../models/system/openconfig-system-grpc.yang | 88 ++++++++++++++++++- 1 file changed, 87 insertions(+), 1 deletion(-) diff --git a/release/models/system/openconfig-system-grpc.yang b/release/models/system/openconfig-system-grpc.yang index 6560806c1b..a91dadae40 100644 --- a/release/models/system/openconfig-system-grpc.yang +++ b/release/models/system/openconfig-system-grpc.yang @@ -23,10 +23,17 @@ module openconfig-system-grpc { to be included in the list."; - oc-ext:openconfig-version "1.1.0"; + oc-ext:openconfig-version "1.2.0"; oc-ext:catalog-organization "openconfig"; oc-ext:origin "openconfig"; + revision "2026-08-03" { + description + "Add support for mutual TLS, keepalive settings, and + max concurrent streams configuration on gRPC servers."; + reference "1.2.0"; + } + revision "2024-05-29" { description "Add support for gRPC connections."; @@ -104,6 +111,7 @@ module openconfig-system-grpc { "Operational state relating to the gRPC service."; uses grpc-server-config; } + uses grpc-server-keepalive-top; uses connections-top; } } @@ -167,6 +175,15 @@ module openconfig-system-grpc { are not supported, such as lab testing."; } + leaf tls-mutual { + type boolean; + default false; + description + "When set to true, mutual TLS (mTLS) client certificate verification + is enforced on the gRPC server. The client must present a certificate + validated against the trusted certificate authority."; + } + leaf certificate-id { type string; description @@ -184,6 +201,15 @@ module openconfig-system-grpc { https://github.com/openconfig/reference/blob/master/rpc/gnmi/gnmi-authentication.md#credentials-and-authentication."; } + leaf max-concurrent-streams { + type uint32 { + range "1..max"; + } + description + "Maximum number of concurrent streams permitted per gRPC session + or connection."; + } + leaf-list listen-addresses { type union { type oc-inet:ip-address; @@ -208,6 +234,66 @@ module openconfig-system-grpc { } } + grouping grpc-server-keepalive-config { + description + "Configuration parameters relating to gRPC server keepalive."; + + leaf time { + type uint32 { + range "1..max"; + } + units "seconds"; + description + "Interval in seconds at which the server will send keepalive PING + frames to the client to verify connection health when no activity + is detected."; + } + + leaf min-keepalive-interval { + type uint32 { + range "1..max"; + } + units "seconds"; + description + "Minimum interval in seconds that the server permits a client to wait + between sending keepalive PING frames without receiving a GOAWAY frame + (too_many_pings)."; + } + + leaf timeout { + type uint32 { + range "1..max"; + } + units "seconds"; + description + "Time in seconds the server waits for a keepalive PING response + before closing the connection."; + } + } + + grouping grpc-server-keepalive-top { + description + "Structural grouping for gRPC keepalive parameters."; + + container keepalive { + description + "Parameters for gRPC keepalive probes and rate limits."; + + container config { + description + "Configuration parameters for gRPC keepalive."; + uses grpc-server-keepalive-config; + } + + container state { + config false; + description + "Operational state parameters for gRPC keepalive."; + uses grpc-server-keepalive-config; + } + } + } + grouping grpc-counters { description "Top-level container for gRPC counters."; From 2039aa9f1f6a710906ae41ae6f8b54049b8e0c8c Mon Sep 17 00:00:00 2001 From: Daniel Barney Date: Tue, 4 Aug 2026 21:24:53 -0700 Subject: [PATCH 2/2] adding changes code-review suggested --- .../models/system/openconfig-system-grpc.yang | 95 ++++++++++--------- 1 file changed, 51 insertions(+), 44 deletions(-) diff --git a/release/models/system/openconfig-system-grpc.yang b/release/models/system/openconfig-system-grpc.yang index a91dadae40..6b407fd075 100644 --- a/release/models/system/openconfig-system-grpc.yang +++ b/release/models/system/openconfig-system-grpc.yang @@ -175,14 +175,17 @@ module openconfig-system-grpc { are not supported, such as lab testing."; } - leaf tls-mutual { - type boolean; - default false; - description - "When set to true, mutual TLS (mTLS) client certificate verification - is enforced on the gRPC server. The client must present a certificate - validated against the trusted certificate authority."; - } + leaf tls-mutual { + type boolean; + default false; + must "not(../transport-security) or ../transport-security = 'true'" { + error-message "Mutual TLS requires transport-security to be enabled."; + } + description + "When set to true, mutual TLS (mTLS) client certificate verification + is enforced on the gRPC server. The client must present a certificate + validated against the trusted certificate authority."; + } leaf certificate-id { type string; @@ -234,42 +237,46 @@ module openconfig-system-grpc { } } - grouping grpc-server-keepalive-config { - description - "Configuration parameters relating to gRPC server keepalive."; - - leaf time { - type uint32 { - range "1..max"; - } - units "seconds"; - description - "Interval in seconds at which the server will send keepalive PING - frames to the client to verify connection health when no activity - is detected."; - } - - leaf min-keepalive-interval { - type uint32 { - range "1..max"; - } - units "seconds"; - description - "Minimum interval in seconds that the server permits a client to wait - between sending keepalive PING frames without receiving a GOAWAY frame - (too_many_pings)."; - } - - leaf timeout { - type uint32 { - range "1..max"; - } - units "seconds"; - description - "Time in seconds the server waits for a keepalive PING response - before closing the connection."; - } - } + grouping grpc-server-keepalive-config { + description + "Configuration parameters relating to gRPC server keepalive."; + + leaf time { + type uint32 { + range "1..max"; + } + units "seconds"; + description + "Interval in seconds at which the server will send keepalive PING + frames to the client to verify connection health when no activity + is detected."; + } + + leaf min-keepalive-interval { + type uint32 { + range "1..max"; + } + units "seconds"; + description + "Minimum interval in seconds that the server permits between client + keepalive PING frames. If a client sends PING frames more frequently + than this interval, the server will send a GOAWAY frame with + 'too_many_pings' and close the connection."; + } + + leaf timeout { + type uint32 { + range "1..max"; + } + units "seconds"; + must "not(../time) or . < ../time" { + error-message "Keepalive timeout must be less than the keepalive time interval."; + } + description + "Time in seconds the server waits for a keepalive PING response + before closing the connection."; + } + } grouping grpc-server-keepalive-top { description