Add load_minigraph option to include TSA during config migration #11403
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
yxieca
approved these changes
Jul 10, 2022
qiluo-msft
pushed a commit
that referenced
this pull request
Jul 27, 2022
yxieca
pushed a commit
that referenced
this pull request
Jul 28, 2022
skbarista
pushed a commit
to skbarista/sonic-buildimage
that referenced
this pull request
Aug 17, 2022
liushilongbuaa
pushed a commit
to liushilongbuaa/sonic-buildimage
that referenced
this pull request
Sep 23, 2022
Related work items: sonic-net#284, sonic-net#288, sonic-net#624, sonic-net#630, sonic-net#640, sonic-net#2164, sonic-net#2206, sonic-net#2207, sonic-net#2233, sonic-net#2234, sonic-net#2238, sonic-net#8857, sonic-net#10034, sonic-net#10519, sonic-net#10685, sonic-net#10711, sonic-net#10987, sonic-net#10990, sonic-net#11047, sonic-net#11070, sonic-net#11117, sonic-net#11186, sonic-net#11207, sonic-net#11213, sonic-net#11215, sonic-net#11220, sonic-net#11221, sonic-net#11257, sonic-net#11291, sonic-net#11298, sonic-net#11301, sonic-net#11326, sonic-net#11333, sonic-net#11335, sonic-net#11341, sonic-net#11344, sonic-net#11347, sonic-net#11359, sonic-net#11366, sonic-net#11368, sonic-net#11370, sonic-net#11372, sonic-net#11375, sonic-net#11385, sonic-net#11386, sonic-net#11394, sonic-net#11397, sonic-net#11401, sonic-net#11402, sonic-net#11403, sonic-net#11405, sonic-net#11414
9 tasks
StormLiangMS
pushed a commit
that referenced
this pull request
Apr 28, 2023
Why I did it Support for SONIC chassis isolation using TSA and un-isolation using TSB from supervisor module Work item tracking Microsoft ADO (number only): 17826134 How I did it When TSA is run on the supervisor, it triggers TSA on each of the linecards using the secure rexec infrastructure introduced in sonic-net/sonic-utilities#2701. User password is requested to allow secure login to linecards through ssh, before execution of TSA/TSB on the linecards TSA of the chassis withdraws routes from all the external BGP neighbors on each linecard, in order to isolate the entire chassis. No route withdrawal is done from the internal BGP sessions between the linecards to prevent transient drops during internal route deletion. With these changes, complete isolation of a single linecard using TSA will not be possible (a separate CLI/script option will be introduced at a later time to achieve this) Changes also include no-stats option with TSC for quick retrieval of the current system isolation state This PR also reverts changes in #11403 How to verify it These changes have a dependency on sonic-net/sonic-utilities#2701 for testing Run TSA from supervisor module and ensure transition to Maintenance mode on each linecard Verify that all routes are withdrawn from eBGP neighbors on all linecards Run TSB from supervisor module and ensure transition to Normal mode on each linecard Verify that all routes are re-advertised from eBGP neighbors on all linecards Run TSC no-stats from supervisor and verify that just the system maintenance state is returned from all linecards
mssonicbld
pushed a commit
to mssonicbld/sonic-buildimage
that referenced
this pull request
Apr 28, 2023
Why I did it Support for SONIC chassis isolation using TSA and un-isolation using TSB from supervisor module Work item tracking Microsoft ADO (number only): 17826134 How I did it When TSA is run on the supervisor, it triggers TSA on each of the linecards using the secure rexec infrastructure introduced in sonic-net/sonic-utilities#2701. User password is requested to allow secure login to linecards through ssh, before execution of TSA/TSB on the linecards TSA of the chassis withdraws routes from all the external BGP neighbors on each linecard, in order to isolate the entire chassis. No route withdrawal is done from the internal BGP sessions between the linecards to prevent transient drops during internal route deletion. With these changes, complete isolation of a single linecard using TSA will not be possible (a separate CLI/script option will be introduced at a later time to achieve this) Changes also include no-stats option with TSC for quick retrieval of the current system isolation state This PR also reverts changes in sonic-net#11403 How to verify it These changes have a dependency on sonic-net/sonic-utilities#2701 for testing Run TSA from supervisor module and ensure transition to Maintenance mode on each linecard Verify that all routes are withdrawn from eBGP neighbors on all linecards Run TSB from supervisor module and ensure transition to Normal mode on each linecard Verify that all routes are re-advertised from eBGP neighbors on all linecards Run TSC no-stats from supervisor and verify that just the system maintenance state is returned from all linecards
tjchadaga
added a commit
to tjchadaga/sonic-buildimage
that referenced
this pull request
Apr 28, 2023
…g config migration (sonic-net#11403)" This reverts commit 0c7f0aa.
10 tasks
mlok-nokia
pushed a commit
to mlok-nokia/sonic-buildimage
that referenced
this pull request
Jun 5, 2024
Why I did it Support for SONIC chassis isolation using TSA and un-isolation using TSB from supervisor module Work item tracking Microsoft ADO (number only): 17826134 How I did it When TSA is run on the supervisor, it triggers TSA on each of the linecards using the secure rexec infrastructure introduced in sonic-net/sonic-utilities#2701. User password is requested to allow secure login to linecards through ssh, before execution of TSA/TSB on the linecards TSA of the chassis withdraws routes from all the external BGP neighbors on each linecard, in order to isolate the entire chassis. No route withdrawal is done from the internal BGP sessions between the linecards to prevent transient drops during internal route deletion. With these changes, complete isolation of a single linecard using TSA will not be possible (a separate CLI/script option will be introduced at a later time to achieve this) Changes also include no-stats option with TSC for quick retrieval of the current system isolation state This PR also reverts changes in sonic-net#11403 How to verify it These changes have a dependency on sonic-net/sonic-utilities#2701 for testing Run TSA from supervisor module and ensure transition to Maintenance mode on each linecard Verify that all routes are withdrawn from eBGP neighbors on all linecards Run TSB from supervisor module and ensure transition to Normal mode on each linecard Verify that all routes are re-advertised from eBGP neighbors on all linecards Run TSC no-stats from supervisor and verify that just the system maintenance state is returned from all linecards
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Why I did it
To keep LeafRouter and Dualtor devices isolated with traffic-shift-away after new image is installed (with no prior config) and the device is configured using load_minigraph
How I did it
Using load_minigraph with --traffic_shift_away option introduced in sonic-net/sonic-utilities#2240 for these device types.
How to verify it
Two ways-
Which release branch to backport (provide reason below if selected)
Description for the changelog
Link to config_db schema for YANG module changes
A picture of a cute animal (not mandatory but encouraged)