YANG Modules for Service AssuranceHuaweibenoit.claise@huawei.comIndependentjean@quilbeuf.netNTTSiriusdreef 70-72HoofddorpWT2132Netherlandspaolo@ntt.netTIM S.p.Avia G. Reiss Romoli, 27410148 TorinoItalypaolo2.fasano@telecomitalia.itCisco Systems, Inc.Milpitas (California)United Statestarumuga@cisco.com
OPS
OPSAWG
This document proposes YANG modules for the Service Assurance for Intent-based Networking Architecture.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL
NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED",
"MAY", and "OPTIONAL" in this document are to be interpreted as
described in BCP 14
when, and only when, they appear in all capitals, as shown here.
The terms used in this document are defined in draft-claise-opsawg-service-assurance-architecture IETF draft.
The "Service Assurance for Intent-based Networking Architecture" draft-claise-opsawg-service-assurance-architecture, specifies the framework and all of its components for service assurance. This document complements the architecture by providing open interfaces between components. More specifically, the goal is to provide YANG modules for the purpose of service assurance in a format that is:
machine readablevendor independentaugmentable
The main YANG module, ietf-service-assurance, defines objects for assuring network services based on their decomposition into so-called subservices. The subservices are hierarchically organised by dependencies. The subservices, along with the dependencies, constitute an assurance graph. This module should be supported by an agent, able to interact with the devices in order to produce a health status and symptoms for each subservice in the assurance graph.
This module is intended for the following use cases:
Assurance graph configuration:
Subservices: configure a set of subservices to assure, by specifying their types and parameters.
Dependencies: configure the dependencies between the subservices, along with their type.
Assurance telemetry: export the health status of the subservices, along with the observed symptoms.
The second YANG module, ietf-service-assurance-device, extends the ietf-service-assurance module to add support for the subservice DeviceHealthy. Additional subservice types might be added the same way.
The third YANG module, example-service-assurance-device-acme, extends the ietf-service-assurance-device module as an example to add support for the subservice DeviceHealthy, with specifics for the fictional ACME Corporation. Additional vendor-specific parameters might be added the same way.
The following tree diagram
provides an overview of the ietf-service-assurance data model.
/subservices/subservice/type
+--rw id -> /subservices/subservice[type=current()/../type]/id
+--rw dependency-type? identityref
]]>
The ietf-service-assurance YANG model assumes an identified number of subservices, to be assured independently. A subservice is a feature or a subpart of the network system that a given service instance might depend on. Example of subservices include:
DeviceHealthy: whether a device is healthy, and if not, what are the symptoms. Potential symptoms are "CPU overloaded", "Out of RAM", or "Out of TCAM".
ConnectivityHealthy: given two IP addresses owned by two devices, what is the quality of the connection between them. Potential symptoms are "No route available" or "ECMP Imbalance".
The first example is a subservice representing a subpart of the network system, while the second is a subservice representing a feature of the network, In both cases, these subservices might depend on other subservices, for instance, the connectivity might depend on a subservice representing the routing mechanism and on a subservice representing ECMP.
The symptoms are listed for each subservice. Each symptom is specified by a unique id and contains a health-score-weight (the impact to the health score incurred by this symptom), a label (text describing what the symptom is), and dates and times at which the symptom was detected and stopped being detected. While the unique id is sufficient as an unique key list, the start-date-time second key help sorting and retrieving relevant symptoms.
The assurance of a given service instance can be obtained by composing the assurance of the subservices that it depends on, via the dependency relations.
In order to declare a subservice MUST provide:
A type: identity inheriting of the base identity for subservice,
An id: string uniquely identifying the subservice among those with the same identity,
Some parameters, which should be specified in an augmenting model, as described in the next sections.
The type and id uniquely identify a given subservice. They are used to indicate the dependencies. Dependencies have types as well. Two types are specified in the model:
Impacting: such a dependency indicates an impact on the health of the dependent,Informational: such a dependency might explain why the dependent has issues but does not impact its health.
To illustrate the difference between "impacting" and "informational", consider the subservice InterfaceHealthy, representing a network interface. If the device to which the network interface belongs goes down, the network interface will transition to a down state as well. Therefore, the dependency of InterfaceHealthy towards DeviceHealthy is "impacting". On the other hand, as a the dependency towards the ECMPLoad subservice, which checks that the load between ECMP remains ce remains stable throughout time, is only "informational". Indeed, services might be perfectly healthy even if the load distribution between ECMP changed. However, such an instability might be a relevant symptom for diagnosing the root cause of a problem.
Service instances MUST be modeled as a particular type of subservice with two parameters, a type and an instance name. The type is the name of the service defined in the network orchestrator, for instance "point-to-point-l2vpn". The instance name is the name assigned to the particular instance that we are assuring, for instance the name of the customer using that instance.
The "under-maintenance" and "maintenance-contact" flags inhibit the emission of symptoms for that subservice and subservices that depend on them. See Section 3.7 of for a more detailed discussion.
By specifying service instances and their dependencies in terms of subservices, one defines the whole assurance to apply for them. An assurance agent supporting this model should then produce telemetry in return with, for each subservice: a health-status indicating how healthy the subservice is and when the subservice is not healthy, a list of symptoms explaining why the subservice is not healthy.
<CODE BEGINS> file "ietf-service-assurance@2020-01-13.yang"
WG List:
Author: Benoit Claise
Author: Jean Quilbeuf ";
description
"This module defines objects for assuring network services based on
their decomposition into so-called subservices, according to the SAIN
(Service Assurance for Intent-based Networking) architecture.
The subservices hierarchically organised by dependencies constitute an
assurance graph. This module should be supported by an assurance agent,
able to interact with the devices in order to produce a health status
and symptoms for each subservice in the assurance graph.
This module is intended for the following use cases:
* Assurance graph configuration:
* subservices: configure a set of subservices to assure, by specifying
their types and parameters.
* dependencies: configure the dependencies between the subservices,
along with their type.
* Assurance telemetry: export the health status of the subservices, along
with the observed symptoms.
The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL',
'SHALL NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED',
'NOT RECOMMENDED', 'MAY', and 'OPTIONAL' in this document
are to be interpreted as described in BCP 14 (RFC 2119)
(RFC 8174) when, and only when, they appear in all
capitals, as shown here.
Copyright (c)2020 IETF Trust and the persons identified as
authors of the code. All rights reserved.
Redistribution and use in source and binary forms, with or
without modification, is permitted pursuant to, and subject
to the license terms contained in, the Simplified BSD License
set forth in Section 4.c of the IETF Trust's Legal Provisions
Relating to IETF Documents
(https://trustee.ietf.org/license-info).
This version of this YANG module is part of RFC XXXX; see the
RFC itself for full legal notices.
TO DO:
- Better type (IETF or OC) for device-id, interface-id, etc.
- Have a YANG module for IETF and one for OC?";
revision 2020-01-13 {
description
"Added the maintenance window concept.";
reference
"RFC xxxx: Title to be completed";
}
revision 2019-11-16 {
description
"Initial revision.";
reference
"RFC xxxx: Title to be completed";
}
identity subservice-idty {
description
"Root identity for all subservice types.";
}
identity service-instance-idty {
base subservice-idty;
description
"Identity representing a service instance.";
}
identity dependency-type {
description
"Base identity for representing dependency types.";
}
identity informational-dependency {
base dependency-type;
description
"Indicates that symptoms of the dependency might be of interest for the
dependent, but the status of the dependency should not have any
impact on the dependent.";
}
identity impacting-dependency {
base dependency-type;
description
"Indicates that the status of the dependency directly impacts the status
of the dependent.";
}
grouping symptom {
description
"Contains the list of symptoms for a specific subservice.";
leaf id {
type string;
description
"A unique identifier for the symptom.";
}
leaf health-score-weight {
type uint8 {
range "0 .. 100";
}
description
"The weight to the health score incurred by this symptom. The higher the
value, the more of an impact this symptom has. If a subservice health
score is not 100, there must be at least one symptom with a health
score weight larger than 0.";
}
leaf description {
type string;
description
"Description of the symptom, i.e. text describing what the symptom is, to
be computer-consumable and be displayed on a human interface. ";
}
leaf start-date-time {
type yang:date-and-time;
description
"Date and time at which the symptom was detected.";
}
leaf stop-date-time {
type yang:date-and-time;
description
"Date and time at which the symptom stopped being detected.";
}
}
grouping subservice-dependency {
description
"Represent a dependency to another subservice.";
leaf type {
type leafref {
path "/subservices/subservice/type";
}
description
"The type of the subservice to refer to (e.g. DeviceHealthy).";
}
leaf id {
type leafref {
path "/subservices/subservice[type=current()/../type]/id";
}
description
"The identifier of the subservice to refer to.";
}
leaf dependency-type {
type identityref {
base dependency-type;
}
description
"Represents the type of dependency (i.e. informational, impacting).";
}
// augment here if more info are needed (i.e. a percentage) depending on the dependency type.
}
leaf assurance-graph-version {
type yang:counter32;
mandatory true;
config false;
description
"The assurance graph version, which increases by 1 for each new version, after the changes
(dependencies and/or maintenance windows parameters) are applied to the subservice(s).";
}
leaf assurance-graph-last-change {
type yang:date-and-time;
mandatory true;
config false;
description
"Date and time at which the assurance graph last changed after the changes (dependencies
and/or maintenance windows parameters) are applied to the subservice(s). These date and time
must be more recent or equal compared to the more recent value of any changed subservices
last-change";
}
container subservices {
description
"Root container for the subservices.";
list subservice {
key "type id";
description
"List of subservice configured.";
leaf type {
type identityref {
base subservice-idty;
}
description
"Name of the subservice, e.g. DeviceHealthy.";
}
leaf id {
type string;
description
"Unique identifier of the subservice instance, for each type.";
}
leaf last-change {
type yang:date-and-time;
config false;
description
"Date and time at which the assurance graph for this subservice
instance last changed, i.e. dependencies and/or maintenance windows parameters.";
}
leaf label {
type string;
config false;
description
"Label of the subservice, i.e. text describing what the subservice is to
be displayed on a human interface.";
}
leaf under-maintenance {
type boolean;
default false;
description
"An optional flag indicating whether this particular subservice is under
maintenance. Under this circumstance, the subservice symptoms and the
symptoms of its dependencies in the assurance graph should not be taken
into account. Instead, the subservice should send a 'Under Maintenance'
single symptom.
The operator changing the under-maintenance value must set the
maintenance-contact variable.
When the subservice is not under maintenance any longer, the
under-maintenance flag must return to its default value and
the under-maintenance-owner variable deleted.";
}
leaf maintenance-contact {
when "../under-maintenance = 'true'";
type string;
mandatory true;
description
"A string used to model an administratively assigned name of the
resource that changed the under-maintenance value to 'true.
It is suggested that this name contain one or more of the following:
IP address, management station name, network manager's name, location,
or phone number. In some cases the agent itself will be the owner of
an entry. In these cases, this string shall be set to a string
starting with 'monitor'.";
}
choice parameter {
description
"Specify the required parameters per subservice type.";
container service-instance-parameter {
when "derived-from-or-self(../type, 'service-assurance:service-instance-idty')";
description
"Specify the parameters of a service instance.";
leaf service {
type string;
description "Name of the service.";
}
leaf instance-name{
type string;
description "Name of the instance for that service.";
}
}
// Other modules can augment their own cases into here
}
leaf health-score {
type uint8 {
range "0 .. 100";
}
config false;
description
"Score value of the subservice health. A value of 100 means that
subservice is healthy. A value of 0 means that the subservice is
broken. A value between 0 and 100 means that the subservice is
degraded.";
}
leaf symptoms-history-start {
type yang:date-and-time;
config false;
description
"Date and time at which the symptoms history starts for this
subservice instance, either because the subservice instance
started at that date and time or because the symptoms before that
were removed due to a garbage collection process.";
}
container symptoms {
description
"Symptoms for the subservice.";
list symptom {
key "start-date-time id";
config false;
description
"List of symptoms the subservice. While the start-date-time key is not
necessary per se, this would get the entries sorted by start-date-time
for easy consumption.";
uses symptom;
}
}
container dependencies {
description
"configure the dependencies between the subservices, along with their types.";
list dependency {
key "type id";
description
"List of soft dependencies of the subservice.";
uses subservice-dependency;
}
}
}
}
}
]]><CODE ENDS>
The following tree diagram
provides an overview of the ietf-service-assurance-device data model.
The following tree diagram
provides an overview of the ietf-service-assurance and ietf-service-assurance-device data models.
/subservices/subservice/type
+--rw id -> /subservices/subservice[type=current()/../type]/id
+--rw dependency-type? identityref
]]>
As the number of subservices will grow over time, the YANG module is designed to be extensible. A new subservice type requires the precise specifications of its type and expected parameters. Let us illustrate the example of the new DeviceHealthy subservice type. As the name implies, it monitors and reports the device health, along with some symptoms in case of degradation.
For our DeviceHealthy subservice definition, the new device-idty is specified, as an inheritance from the base identity for subservices. This indicates to the assurance agent that we are now assuring the health of a device.
The typical parameter for the configuration of the DeviceHealthy subservice is the name of the device that we want to assure. By augmenting the parameter choice from ietf-service-assurance YANG module for the case of the device-idty subservice type, this new parameter is specified.
<CODE BEGINS> file "ietf-service-assurance-device@2020-01-13.yang"
WG List:
Author: Benoit Claise
Author: Jean Quilbeuf ";
description
"This module extends the ietf-service-assurance module to add
support for the subservice DeviceHealthy.
Checks whether a network device is healthy.
The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL',
'SHALL NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED',
'NOT RECOMMENDED', 'MAY', and 'OPTIONAL' in this document
are to be interpreted as described in BCP 14 (RFC 2119)
(RFC 8174) when, and only when, they appear in all
capitals, as shown here.
Copyright (c) 2020 IETF Trust and the persons identified as
authors of the code. All rights reserved.
Redistribution and use in source and binary forms, with or
without modification, is permitted pursuant to, and subject
to the license terms contained in, the Simplified BSD License
set forth in Section 4.c of the IETF Trust's Legal Provisions
Relating to IETF Documents
(https://trustee.ietf.org/license-info).
This version of this YANG module is part of RFC XXXX; see the
RFC itself for full legal notices. ";
revision 2020-01-13 {
description
"Added the maintenance window concept.";
reference
"RFC xxxx: Title to be completed";
}
revision 2019-11-16 {
description
"Initial revision.";
reference
"RFC xxxx: Title to be completed";
}
identity device-idty {
base service-assurance:subservice-idty;
description "Network Device is healthy.";
}
augment /service-assurance:subservices/service-assurance:subservice/service-assurance:parameter {
description
"Specify the required parameters for a new subservice type";
container device-idty{
when "derived-from-or-self(../service-assurance:type, 'device-idty')";
description
"Specify the required parameters for the device-idty subservice type";
leaf device {
type string;
description "The device to monitor.";
}
}
}
}
]]><CODE ENDS>
The following tree diagram
provides an overview of the ietf-service-assurance-interface data model.
The following tree diagram
provides an overview of the ietf-service-assurance, ietf-service-assurance-device, and
ietf-service-assurance-interface data models.
/subservices/subservice/type
+--rw id -> /subservices/subservice[type=current()/../type]/id
+--rw dependency-type? identityref
]]>
For our InterafaceHealthy subservice definition, the new interface-idty is specified, as an inheritance from the base identity for subservices. This indicates to the assurance agent that we are now assuring the health of an interface.
The typical parameters for the configuration of the InterfaceHealthy subservice are the name of the device and, on that specific device, a specific interface. By augmenting the parameter choice from ietf-service-assurance YANG module for the case of the interface-idty subservice type, those two new parameter are specified.
<CODE BEGINS> file "ietf-service-assurance-interface@2020-01-13.yang"
WG List:
Author: Benoit Claise
Author: Jean Quilbeuf ";
description
"This module extends the ietf-service-assurance module to add
support for the subservice InterfaceHealthy.
Checks whether an interface is healthy.
The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL',
'SHALL NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED',
'NOT RECOMMENDED', 'MAY', and 'OPTIONAL' in this document
are to be interpreted as described in BCP 14 (RFC 2119)
(RFC 8174) when, and only when, they appear in all
capitals, as shown here.
Copyright (c) 2020 IETF Trust and the persons identified as
authors of the code. All rights reserved.
Redistribution and use in source and binary forms, with or
without modification, is permitted pursuant to, and subject
to the license terms contained in, the Simplified BSD License
set forth in Section 4.c of the IETF Trust's Legal Provisions
Relating to IETF Documents
(https://trustee.ietf.org/license-info).
This version of this YANG module is part of RFC XXXX; see the
RFC itself for full legal notices. ";
revision 2020-01-13 {
description
"Initial revision.";
reference
"RFC xxxx: Title to be completed";
}
identity interface-idty {
base service-assurance:subservice-idty;
description "Checks whether an interface is healthy.";
}
augment /service-assurance:subservices/service-assurance:subservice/service-assurance:parameter {
when "derived-from-or-self(service-assurance:type, 'interface-idty')";
description
"Specify the required parameters for the interface-idty subservice type";
leaf device {
type string;
description "Device supporting the interface.";
}
leaf interface {
type string;
description "Name of the interface.";
}
}
}
]]><CODE ENDS>
The following tree diagram
provides an overview of the example-service-assurance-device-acme data model.
The following tree diagram
provides an overview of the ietf-service-assurance, ietf-service-assurance-device, and example-service-assurance-device-acme data models.
/subservices/subservice/type
+--rw id -> /subservices/subservice[type=current()/../type]/id
+--rw dependency-type? identityref
]]>
Under some circumstances, vendor-specific subservice types might be required. As an example of this vendor-specific implementation, this section shows how to augment the ietf-service-assurance-device module to add support for the subservice DeviceHealthy, specific to the ACME Corporation. The new parameter is acme-specific-parameter.
WG List:
Author: Benoit Claise
Author: Jean Quilbeuf ";
description
"This module extends the ietf-service-assurance-device module to add
support for the subservice DeviceHealthy, specific to the ACME Corporation.
ACME Network Device is healthy.
The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL',
'SHALL NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED',
'NOT RECOMMENDED', 'MAY', and 'OPTIONAL' in this document
are to be interpreted as described in BCP 14 (RFC 2119)
(RFC 8174) when, and only when, they appear in all
capitals, as shown here.
Copyright (c) 2019 IETF Trust and the persons identified as
authors of the code. All rights reserved.
Redistribution and use in source and binary forms, with or
without modification, is permitted pursuant to, and subject
to the license terms contained in, the Simplified BSD License
set forth in Section 4.c of the IETF Trust's Legal Provisions
Relating to IETF Documents
(https://trustee.ietf.org/license-info).
This version of this YANG module is part of RFC XXXX; see the
RFC itself for full legal notices. ";
revision 2020-01-13 {
description
"Added the maintenance window concept.";
reference
"RFC xxxx: Title to be completed";
}
revision 2019-11-16 {
description
"Initial revision.";
reference
"RFC xxxx: Title to be completed";
}
identity device-acme-idty {
base service-assurance-device:device-idty;
description "Network Device is healthy.";
}
augment /service-assurance:subservices/service-assurance:subservice/service-assurance:parameter {
description
"Specify the required parameters for a new subservice type";
container acme-device-idty{
when "derived-from-or-self(../service-assurance:type, 'device-acme-idty')";
description
"Specify the required parameters for the device-acme-idty subservice type";
leaf device {
type string;
description "The device to monitor.";
}
leaf acme-specific-parameter {
type string;
description "The ACME Corporation sepcific parameter.";
}
}
}
}
]]>
The YANG module specified in this document defines a schema for data
that is designed to be accessed via network management protocols such
as NETCONF or RESTCONF . The lowest NETCONF layer is the secure transport layer, and the mandatory-to-implement secure transport is Secure Shell (SSH) . The lowest RESTCONF layer is HTTPS, and the mandatory-to-implement secure transport is TLS .
The Network Configuration Access Control Model (NACM)
provides the means to restrict access for particular NETCONF or
RESTCONF users to a preconfigured subset of all available NETCONF or
RESTCONF protocol operations and content.
There are a number of data nodes defined in this YANG module that are writable/
creatable/deletable (i.e., config true, which is the default). These data nodes may be considered sensitive or vulnerable in some network environments. Write operations (e.g., edit-config) to these data nodes without proper protection can have a negative effect on network operations. These are the subtrees and data nodes and their sensitivity/vulnerability:
/subservices/subservice/type/subservices/subservice/id/subservices/subservice/under-maintenance/subservices/subservice/maintenance-contactThis document registers two URIs in the IETF XML
registry . Following the format in
, the following registrations are
requested:
URI: urn:ietf:params:xml:ns:yang:ietf-service-assurance
Registrant Contact: The NETCONF WG of the IETF.
XML: N/A, the requested URI is an XML namespace.
URI: urn:ietf:params:xml:ns:yang:ietf-service-assurance-device
Registrant Contact: The NETCONF WG of the IETF.
XML: N/A, the requested URI is an XML namespace.
URI: urn:ietf:params:xml:ns:yang:ietf-service-assurance-interface
Registrant Contact: The NETCONF WG of the IETF.
XML: N/A, the requested URI is an XML namespace.
This document registers three YANG modules in the
YANG Module Names registry .
Following the format in , the
the following registrations are requested:
name: ietf-service-assurance
namespace: urn:ietf:params:xml:ns:yang:ietf-service-assurance
prefix: inc
reference: RFC XXXX
name: ietf-service-assurance-device
namespace: urn:ietf:params:xml:ns:yang:ietf-service-assurance-device
prefix: inc
reference: RFC XXXX
name: ietf-service-assurance-interface
namespace: urn:ietf:params:xml:ns:yang:ietf-service-assurance-interface
prefix: inc
reference: RFC XXXX
-Nonedraft-claise-opsawg-service-assurance-architectureCisco SystemsCisco Systemsv04 - v05
Added the concept of symptoms-history-startChanged label to description, under symptoms. This was
confusing as there was two labels in the modelsv03 - v04
Add the interface subservice, with two parametersv02 - v03
Added the maintenace window conceptsv01 - v02
Improved leaf namingClarified some concepts: symptoms, dependencyv00 - v01
Terminology clarificationsProvide example of impacting versus impacted dependenciesThe authors would like to thank Jan Lindblad for his help during the design of these YANG modules. The authors would like to thank Stephane Litkowski and Charles Eckel for their reviews.