Subject: [yang-doctors] Review of draft-ietf-netconf-zerotouch-15

From: Dean Bogdanovic <[email-masked]>
Date: Fri, 18 Aug 2017 15:02:36 -0400

Reviewer: Dean Bogdanovic
Review result: Ready with caveat

Modules:
ietf-zerotouch-information.yang
ietf-zerotouch-bootstrap-server.yang

YANG Usage:

I did not find anything wrong in any module, but there are no tools to valid usage of YANG data, which is used by ietf-zerotouch-information.yang module.
So couldn’t get full validation of the module with pyang and lintyang tools.

Comments:
1. As stated above, couldn’t get the full validation with the tools of the modules, but looking through the code and the draft, the authors are following the general recommendations by draft-dsdt-nmda-guidelines. Saying that, am fine with moving the draft along, but this is an issues that has to be addressed very soon, as there will be more drafts using YANG data that will not be able to get validated.

2. I couldn’t see how this modules would work well with draft-ietf-rtgwg-lne-model. That draft describes how different virtual systems with different administrators can run on the same HW. How can we boot different versions of SW (lnes) to run on the HW? Or should it state that this draft has no plans to support use cases described in draft-ietf-rtgwg-lne-model.

Regards,

Dean

---

From: Kent Watsen <[email-masked]>
Date: Mon, 21 Aug 2017 15:35:32 +0000

[CC-ing netconf]

Hi Dean,

Thanks for your review.

1) validating yang-data examples directly is currently not possible.  Neither is validating RESTCONF examples.  But my knowledge is limited to `pyang` (which doesn't validate 1.1-examples at all) and `yanglint` (which has fairly complete validation ability)

2) the need for zerotouch support for LNEs needs to be discussed by the WG.   My personal experience is that only the host-system needs zerotouch bootstrapping, but I can imagine zerotouch being useful to support VNFs, or virtual-machines in general.   Supporting VMs is possible with the current draft, but it entails the hypervisor being able to verify the VM image ("secure boot") and allocate a virtual IDevID certificate to the VM, both of which are out of scope for this draft.   Do you think we should add an "applicability statement" in the beginning, or perhaps to Section 5.1, something like this:

   This document primarily regards physical devices, where the setting
   of the initial "factory default" state occurs during the device's
   manufacturing process.  However, the zerotouch solution may be
   extensible to virtual machines whereby, for instance, the host-system
   has an IDevID certificate and some ability to verify the virtual
   machine's image before loading it and also provision a just-in-time
   IDevID certificate.  Details for how this may be accomplished can be
   defined in future work.

Thoughts?

Kent

On 8/18/17, 3:02 PM, "yang-doctors on behalf of Dean Bogdanovic" <[email-masked]<mailto:[email-masked]> on behalf of [email-masked]<mailto:[email-masked]>> wrote:

Modules:

YANG Usage:

Comments:

Regards,

Dean

---

From: Dean Bogdanovic <[email-masked]>
Date: Mon, 21 Aug 2017 13:17:04 -0400

Kent,

> On Aug 21, 2017, at 11:35 AM, Kent Watsen <[email-masked]> wrote:
> 
> [CC-ing netconf]
>  
> Hi Dean,
>  
> Thanks for your review.
>  

Yes, I agree with this comment, as is specify more narrowly the intention on how to use the modules.

Dean

>  
> Thoughts?
>  
> Kent
>  
>  
> On 8/18/17, 3:02 PM, "yang-doctors on behalf of Dean Bogdanovic" <[email-masked] <mailto:[email-masked]> on behalf of [email-masked] <mailto:[email-masked]>> wrote:
>