Manage resource allocation in NSO.
The NSO Resource Manager package contains both an API for generic resource pool handling called the resource allocator
, and the two applications (id-allocator
andipaddress-allocator
) utilizing the API. The applications are explained separately in the following sections below:
This version of NSO Resource Manager is 4.2.8 and was released together with NSO version 6.4.
NSO is often used to provision services in the networking layer. It is not unusual that these services require network-level information that is not (or cannot be) part of the instance data provided by the northbound system, so it needs to be fetched from, and eventually released back to a separate system. A common example of this is IP addresses used for layer-3 VPN services. The orchestrator tool is not aware of the blocks of IP addresses assigned to the network but relies on lower layers to fulfill this need.
Some customers have software systems to manage these types of temporary assets. E.g., for IP-addresses, they are usually known as IP Address Management (IPAM) systems. There is a whole industry of solutions for such systems, ranging from simple open-source solutions to entire suites integrated with DNS management. See IP address management for more on this.
There are customers that either don't have an IPAM system for services that are planned for NSO or are not planning to get one for this single purpose. They usually don't want the operational overhead of another system and/or don't see the need for a separate investment. These customers are looking for NSO to provide basic resource allocation and lifecycle management for the assets required for services managed by NSO. They appreciate the fact that NSO is not an appropriate platform to provide more advanced features from the IPAM world like capacity planning nor to integrate with DNS and DHCP platforms. This means that the NSO Resource Manager does not compete with full-blown systems but is rather a complementary feature.
The NSO Resource Manager interface, the resource allocator
, provides a generic resource allocation mechanism that works well with services and in a high availability (HA) configuration. Expected is implementations of specific resource allocators implemented as separate NSO packages. A service will then have the possibility to use allocator implementations dedicated to different resources.
The YANG model of the resource allocator (resource-allocator.yang
) can be augmented with different resource pools, as is the case for the two applications id-allocator
and ipaddress-allocator
. Each pool has an allocation list where services are expected to create instances to signal that they request an allocation. Request parameters are stored in the request
container and the allocation response is written in the response
container.
Since the allocation request may fail the response container contains a choice where one case is for error and one for success.
Each allocation list entry also contains an allocating-service
leaf-list. These are instance identifiers that point to the services that requested the resource. These are the services that will be redeployed when the resource has been allocated.
The resource allocation packages should subscribe to several points in this resource-pool
tree. First, they must detect when a new resource pool is created or deleted. Secondly, they must detect when an allocation request is created or deleted. A package may also augment the pool definition with additional parameters, for example, an IP address allocator may wish to add configuration parameters for defining the available subnets to allocate from, in which case it must also subscribe to changes to these settings.
The installation of this package is done as with any other package, as described in the NSO Packages section of the Administration Guide.
The API of the resource allocator is defined in this YANG data model:
Looking at High Availability, there are two things we need to consider - the allocator state needs to be replicated, and the allocation needs only to be performed on one node.
The easiest way to replicate the state is to write it into CDB-oper and let CDB perform the replication. This is what we do in the ipaddress-allocator
.
We only want the allocator to allocate addresses on the primary node. Since the allocations are written into CDB they will be visible on both primary and secondary nodes, and the CDB subscriber will be notified on both nodes. In this case, we only want the allocator on the primary node to perform the allocation.
We therefore read the HA mode leaf from CDB to determine which HA mode the current subscriber is running in; if HA mode is not enabled, or if HA mode is enabled and the current node is primary we proceed with the allocation.
This synchronized allocation API request uses a reactive fastmap, so the user can allocate resources and still keep a synchronous interface. It allocates resources in the create callback, at that moment everything we modify in the database is part of the service intent and fast map. We need to guarantee that we have used a stable resource and communicate to other services, which resources we have used. So, during the create callback, we store what we have allocated. Other services that are evaluated within the same transaction which runs subsequent to ours will see allocations, when our service is redeployed, it will not have to create the allocations again.
When an allocation raises an exception in case the pool is exhausted, or if the referenced pool does not exist in the CDB, commit
will get aborted. Synchronous allocation doesn't require service re-deploy
to read allocation. The same transaction can read allocation, commit dry-run
or get-modification
should show up the allocation details as output.
Synchronous allocation is only supported through the Java and Python APIs provided by the Resource Manager.
This section explores deployment information and procedures for the NSO ID Allocator (id-allocator
). The NSO Resource ID Allocator is an extension of the generic resource allocation mechanism called the NSO Manager. It can allocate integers which can serve for instance as VLAN identifiers.
The ID Allocator can host any number of ID pools. Each pool contains a certain number of IDs that can be allocated. They are specified by a range, and potentially broken into several ranges by a list of excluded ranges.
The ID allocator YANG models are divided into a configuration data-specific model (idallocator.yang
), and an operational data-specific model (id-allocator-oper.yang
). Users of this package will request allocations in the configuration tree. The operational tree serves as an internal data structure of the package.
An ID request can allocate either the lowest possible ID in a pool or a specified (by the user) value, such as 5 or 1000.
Allocation requests can be synchronized between pools. This synchronization is based on the ID of the allocation request itself (such as for instance allocation1
), the result is that the allocations will have the same allocated value across pools.
This section presents some simple use cases of the NSO presented using Cisco-style CLI.
The NSO ID Allocator requires a username to be configured by the service application when creating an allocation request. This username will be used to redeploy the service application once a resource has been allocated. Default NACM rules deny all standard users access to the /ralloc:resource-pools
list. These default settings are provided in the (initial_data/aaa_init.xml
) file of the resource-manager package.
It is up to the administrator to add a rule that allows the user to perform the service re-deploy.
The administrator's instructions on how to write these rules are detailed in the AAA Infrastructure.
There are two alarms associated with the ID Allocator:
Empty Alarm: This alarm is raised when the pool is empty, and there are no available IDs for further allocation.
Low threshold Reached Alarm: This alarm is raised when the pool is nearing empty, e.g., there is only 10% or fewer left in the pool.
Since the Resource Manager's version 4.0.0, the operational data model is not compatible with the previous version. In version 4.0.0 Yang model, there is a new element called allocationId
added for /Id-allocator/pool/allocation
to support sync ID allocation. The system will run the upgrade script automatically (when the Resource Manager of the new version is loaded) if there is a Yang model change in the new version. Users can also run the script manually for Resource Manager from 3.5.6 (or any version below 4.0.0) to version 4.0.0 or above; the script will add the missing allocationId
element in the CDB operational data path /id-allocator/pool/allocation
. The upgrade Python script is located in the Resource Manager package: python/resource_manager/rm_upgrade_nso.py
.
After running the script manually to update CDB, the user must request package reload
or restart ncs
to reload new CBD data into the ID Pool java object in memory. For example, in the NSO CLI console: admin@ncs> request packages reload force
.
id-allocator-tool
ActionA set of debug and data tools (contained in rm-action/id-allocator-tool
action) is available to help admin or support to operate on RM data. Two parameters in the id-allocator-tool
action can be provided: operation
, pool
. All the process info and results will be logged in ncs-java-vm.log
, and the action itself just returns the result. Here is a list of the valid operation values for the id-allocator-tool
action:
check_missing_report
: Scan the current resource pool and ID pool in the system, and identify and report the missing element for each id-allocator entry without fixing.
fix_missing_allocation_id
: Add the missing allocation ID for each ID allocator entry.
fix_missing_owner
: Add the missing owner info for each ID allocator entry.
fix_missing_allocation
: Create the missing allocation entry in the ID allocator for each ID pool allocation response/id.
fix_response_id
: Scan the ID pool and check if the allocation contains an invalid allocation request ID, and release the allocation from the ID pool if found. It happens for sync allocation when the device configuration fails after a successful ID allocation and then causes a service transaction fail. This leaves the ID pool containing successfully allocated ID while the allocation request response doesn't exist
persistAll
: Manually sync from ID pool in memory to ID allocator in CDB.
printIdPool
: Print the current ID pool data in ncs-java-vm.log
for debugging purposes.
Note that when a pool parameter is provided, the operation will be on this specific ID pool, and if no pool is provided, the operation will be running on all ID pools in the system.
This section contains deployment information and procedures for the Tail-f NSO IP Adress Allocator (ipaddress-allocator
) application.
The NSO IP Address Allocator application contains an IP address allocator that use the Resource Manager API to provide IP address allocation. It uses a RAM-based allocation algorithm that stores its state in CDB as oper data.
The file resource-manager/src/java/src/com/tailf/pkg/ipaddressallocator/IPAddressAllocator.java
contains the part that deals with the resource manager APIs whereas the RAM-based IP address allocator resides under resource-manager/src/java/src/com/tailf/ pkg/ipam
.
The IPAddressAllocator
class subscribes to five points in the DB:
/ralloc:resource-pools/ip-address-pool
: To be notified when new pools are created/deleted. It needs to create/delete instances of the IPAddressPool class. Each instance of the IPAddressPool handles one pool.
/ralloc:resource-pools/ip-address-pool/subnet
: To be notified when subnets are added/removed from an existing address pool. When a new subnet is added, it needs to invoke the addToAvailable
method of the right IPAddressPool
instance. When a pool is removed, it needs to reset all existing allocations from the pool, create new allocations, and re-deploy the services that had the allocations.
/ralloc:resource-pols/ip-address-pool/exclude
: To detect when new exclusions are added and when old exclusions are removed.
/ralloc:resource-pols/ip-address-pool/range
: To be notified when ranges are added to or removed from an address pool.
/ralloc:resource-pols/ip-address-pool/allocation
: To detect when new allocation requests are added and when old allocations are released. When a new request is added, the right size of the subnet is allocated from the IPAddressPool
instance and the result is written to the response/subnet leaf, and finally, the service is redeployed.
This section presents some simple use cases of the NSO IP Address Allocator. It uses the C-style CLI.
The NSO IP Address Allocator requires a username to be configured by the service applications when creating an allocation request. This username will be used to redeploy the service applications once a resource has been allocated. The default NACM rules deny all standard users access to the / ralloc:resource-pools
list. These default settings are provided in the (initial_data/ aaa_init.xml
) file of the Resource Manager package.
There are two alarms associated with the IP Address Allocator:
Empty Alarm: This alarm is raised when the pool is empty, and there are no available IPs that can be allocated.
Low Threshold Reached Alarm: This alarm is raised when the pool is nearing empty, e.g., there are only 10% or fewer separate IPs left in the pool.
ip-allocator-tool
ActionA set of debug and data tools contained in the rm-action/ip-allocator-tool
action is available to help the admin or support personnel to operate on the RM data. Two parameters in the ip-allocator-tool
action can be provided: operation
, pool
. All the process info and the results will be logged in ncs-java-vm.log
, and the action itself just returns the result. Here is a list of the valid operation values for the ip-allocator-tool
action.
fix_response_ip
: Scan the IP pool to check if the allocation contains an invalid allocation request ID, and release the allocation from the IP pool, if found. It happens for sync allocation when the device configuration fails after a successful IP allocation and then causes a service transaction to fail. This leaves the IP pool to contain successfully allocated IP while the allocation request response doesn't exist.
printIpPool
: Print the current IP pool data in the ncs-java-vm.log
for debugging purposes.
Note that when a pool parameter is provided, the operation will be on this specific IP pool.
This section covers the NSO Resource Manager data models.
The NSO Packages section in the NSO Administration Guide.
The AAA Infrastructure section in the NSO Administration Guide.
Description of the APIs exposed by the Resource Manager package.
About this Guide
This NSO Resource Manager (RM) API Guide describes the APIs exposed by the Resource Manager package that you can use to allocate IPs from the IP resource pool and to allocate the IDs from ID resource pools.
Intended Audience
This guide is intended for Cisco advanced services developers, network engineers, and system engineers to install the RM package inside NSO and then utilize the APIs exposed by the RM package to allocate and manage IP subnets and IDs as required by other CFPs installed alongside this RM package inside NSO.
Additional Documentation
This documentation requires the reader to have a good understanding of NSO and its usage as described in the following NSO documentation:
The APIs exposed by the Resource Manager package are used to allocate IP subnets and IDs from the IP and ID resource pools respectively by the applications requesting the resources. The APIs help to allocate, update, or deallocate the resources. You can make API calls to the resource pools as long as the pool is not exhausted of the resources. If the pool is exhausted of resources or if the referenced pool does not exist in the database when there is a request, the allocation raises an exception.
When a service makes multiple resource allocations from a single pool, the optional ‘name’ parameter allows the service to distinguish the different allocations. By default, the parameter value is an empty string.
Resource allocation can be synchronous or asynchronous.
The synchronized allocation API request uses a Reactive-Fast-Map to allocate resources and still manages the interface to look synchronous. This means that as you create any allocation request from Northbound, you can see the allocation results, such as the requested IP subnet/ID in the same transaction. If a NB is making an allocation request, and in the same transaction a configuration is being applied to a specific device, the commit dry run receives the request response, and the response is processed by the RM and the configurations are pushed to the device in the same transaction. Thus, the NB user can see the get modification in the commit dry run.
During a resource request, the resource is allocated and stored in the create callback. This allocation is visible to other services that are run in the same or subsequent transactions and therefore avoids the recreation of resource when the service is redeployed. Synchronous allocation does not require service re-deploy to read allocation. The same transaction can read allocation. Commit dry-run or get-modification displays the allocation details as output.
The following is an example for a Northbound service callback passed with required API parameters for both synchronous and asynchronous IPv4 allocations. The example uses pool-example
package as a reference. The request describes the details it uses, such as the pool, device. Each allocation has an allocation ID. In the following example, the allocating service pulls one IPv4 address from the IPv4 resource pool. The requesting service then uses this allocated IP address to set the interface address on the device southbound to NSO.
The payloads below demonstrate the Northbound service allocation request using the Resource Manager synchronous and asynchronous flows. The API pulls one IP address from the IPv4 resource pool and sets the returned IP address on the interface IOS1 device. The payloads demonstrate both synchronous and asynchronous flows.
IPv4 and IPv6 have separate IP pool types; there is no mixed IP pool. You can specify a prefixlen
parameter for IP pools to allocate a net of a given size. The default value is the maximum prefix length of 32 and 128 for IPv4 and IPv6, respectively.
The following APIs are used in IPv4 and IPv6 allocations.
Resource Manager exposes the API calls to request IPv4 and IPv6 subnet allocations from the resource pool. These requests can be synchronous or asynchronous. This topic discusses the APIs for these flows.
The NSO Resource Manager interface and the resource allocator provide a generic resource allocation mechanism that works well with services. Each pool has an allocation list where services are expected to create instances to signal that they request an allocation. The request parameters are stored in the request container, and the allocation response is written in the response container.
The APIs exposed by RM are implemented in Python as well as Java, so the NB user can configure the service to be a Java package or a Python package and call the allocator API as per the implementation. The NB user can also use NSO CLI to make an allocation request to the IP allocator RM package.
This section covers the Java APIs exposed by the RM package to the NB user to make IP subnet allocation requests.
The asynchronous subnet allocation requests can be created for a requesting service with:
The redeploy type set to default
type or set to redeployType
.
The CIDR mask length can be set to invert the subnet mask length for Boolean
operations with IP addresses or set not to be able to invert the subnet mask length.
Pass the starting IP address of the subnet to the requesting service redeploy type
(default
/redeployType
).
The following are the Java APIs for asynchronous IP allocation requests.
Common Exceptions Raised by Java APIs for Allocation Not Successful
The API throws the following exception error if the requested resource pool does not exist: ResourceErrorException
The API throws the following exception error if the requested resource pool is exhausted: AddressPoolException
The API throws the following exception error if the requested netmask is invalid: InvalidNetmaskException
The sync_alloc
parameter in the API determines if the allocation request is for a synchronous or asynchronous mode. Set the sync_alloc
parameter to true for synchronous flow.
The subnet allocation requests can be created for a requesting service with:
The redeploy type set to default type or redeployType
type.
The CIDR mask length can be set to invert the subnet mask length for Boolean operations with IP addresses or set to not be able to invert the subnet mask length.
Pass the starting IP address of the subnet to the requesting service redeploy type (default
/redeploytype
).
The following are the Java APIs for synchronous or asynchronous IP allocation requests.
Common Exceptions Raised by Java APIs for Allocation Not Successful
The API throws the following exception error if the requested resource pool does not exist: ResourceErrorException
The API throws the following exception error if the requested resource pool is exhausted: AddressPoolException
The API throws the following exception error if the requested netmask is invalid: InvalidNetmaskException
Once the requesting service requests allocation through an API call, you can verify if the corresponding response is ready. The responses return the properties based on the request.
The following APIs help you to check if the response for the allocation request is ready.
Common Exceptions Raised by Java APIs for Errors
ResourceErrorException
: If the allocation has failed, the request does not exist, or the pool does not exist.
ConfException
: When there are format errors in the API request call.
IOException
: When the I/O operations fail or are interrupted.
The following API reads the allocated IP subnet from the resource pool once the allocation request response is ready.
This non-service IP address allocation API is created from Resource Manager 4.2.8.
Common Exceptions Raised by Java APIs for Errors
ResourceErrorException
: If the allocation has failed, the request does not exist, or the pool does not exist.
ResourceWaitException
: If the allocation is not ready.
The RM package exposes Python APIs to manage allocation for IP subnet from the resource pool.
Below is the list of Python APIs exposed by the RM package.
The RM package exposes Python APIs to manage non-service allocation for IP subnet from the resource pool. Below is the list of Python APIs exposed by the RM package.
RM package exposes APIs to manage ID allocation from the ID resource pool. The APIs are available to request ID, check if the allocation is ready and also to read the allocation once ready.
The following are the asynchronous old Java APIs for ID allocation from the RM resource pool.
The following API is used to create or update an ID allocation request with non-service.
Common Exceptions Raised by Java APIs for Errors
The API may throw the below exception if no pool resource exists for the requested allocation: ResourceErrorException
.
The API may throw the below exception if the ID request conflicts with another allocation or does not match the previous allocation in case of multiple owner requests: AllocationException
.
RM package exposes responseReady
Java API to verify if the ID allocation request is ready or not.
The following APIs are used to verify if the response is ready for an ID allocation request.
Common Exceptions Raised by Java APIs for Errors
The API may throw the below exception if no pool resource exists for the requested allocation: ResourceException
.
The API may throw the below exception when there are format errors in the API request call: ConfException
.
The API may throw the below exception when the I/O operations fail or are interrupted: IOException
.
The following API reads information about specific allocation requests made by the API call. The response returns the allocated ID from the ID pool.
The following are the synchronous/asynchronous new Java APIs exposed by the RM package for ID allocation from the resource pool.
Common Exceptions Raised by Java APIs for Errors
The API may throw the below exception if no pool resource exists for the requested allocation: ResourceErrorException
.
The API may throw the below exception if the ID request conflicts with another allocation or does not match the previous allocation in case of multiple owner requests: AllocationException
.
The RM package also exposed Python APIs to request ID allocation from a resource pool. The below APIs are Python APIs exposed by RM for ID allocation.
The RM package also exposes Python APIs to request ID allocation from a resource pool by passing the maapi object and transaction handle instead of the service. The below APIs are Python APIs for non-service ID allocation.
Use the module resource_manager.id_allocator
.
Set the Java Debug
Check the Log File
RM processing logs are in the file ncs-java-vm.log
. Here is the example RM API entry point msg called from the services:
Use the RM Action Tool