[doc] MACsec: add MKA operational state and key rotation HLD - #2545
Open
liamkearney-msft wants to merge 5 commits into
Open
liamkearney-msft wants to merge 5 commits into
liamkearney-msft wants to merge 5 commits into
Conversation
|
|
Collaborator
|
/azp run |
|
No pipelines are associated with this pull request. |
Add the SONiC-side design for publishing MKA operational state, validating safe primary and fallback CAK rotation, actioning remove-then-add rollover, and exposing the state through show macsec --mka. Signed-off-by: Liam Kearney <liamkearney@microsoft.com>
liamkearney-msft
force-pushed
the
liamkearney-msft-macsec-mka-state-hld
branch
from
September 15, 2026 11:17
2c3be17 to
8731fb4
Compare
Collaborator
|
/azp run |
|
No pipelines are associated with this pull request. |
Contributor
|
can we add the PRs needed for this feature? thanks |
Document the final namespace-local collection schedule, query deadlines, freshness threshold, compact Status/Age output, and companion implementation pull requests. Signed-off-by: Liam Kearney <liamkearney@microsoft.com>
Collaborator
|
/azp run |
|
No pipelines are associated with this pull request. |
Define healthy protected operation as authenticated false and secured true, reject authenticated-only or inconsistent states during rotation, and clarify operator-facing status labels. Signed-off-by: Liam Kearney <liamkearney@microsoft.com>
Collaborator
|
/azp run |
|
No pipelines are associated with this pull request. |
Keep compact Status limited to query health, configuration consistency, and age while presenting Controlled Port protection through Secured and detailed diagnostics. Signed-off-by: Liam Kearney <liamkearney@microsoft.com>
Collaborator
|
/azp run |
|
No pipelines are associated with this pull request. |
Present the raw KaY Controlled Port fields as one ordered detailed mode while preserving raw STATE_DB values, rotation predicates, and compact Secured output. Signed-off-by: Liam Kearney <liamkearney@microsoft.com>
Collaborator
|
/azp run |
|
No pipelines are associated with this pull request. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Define the final SONiC-side design for publishing MKA operational state, validating safe primary/fallback CAK rotation, and displaying that state through
show macsec --mka.The design:
MACSEC_MKA_SESSION_TABLEandMACSEC_MKA_PARTICIPANT_TABLEpublication to macsecmgrd;macsec_mka_listquery and per-port failure isolation;last_updated,query_status,config_status, and optional redactedconfig_errorvalues, while deriving freshness only at consumption time;kay_status=active,authenticated=false,secured=true, andfailed=false—the WPAAuthenticatedfield indicates authenticated-only, unprotected mode rather than successful MKA authentication;show macsec --mkaoutput with natural interface sorting, a separateSecuredcolumn, andStatusderived only from query/config/age health;Controlled port modevalue from the raw KaY fields:secured,authenticated-only,failed,inactive,inconsistent, orunknown; andCompanion implementation
Scope
Documentation only. The HLD covers SONiC-side schema ownership, status collection, safe rotation preflight/actioning, failure reconciliation, namespace behavior, CLI presentation, and validation. WPA fallback behavior and control/status interfaces are consumed as the existing companion dependency.
Validation
authenticated=false,secured=true; authenticated-only or contradictory Controlled Port combinations are explicitly rejected.Statusis limited to query health, configuration consistency, and age;Securedremains the separate compact protected/unprotected indication.Controlled port modethrough an ordered mapping while preserving the raw STATE_DB fields and rotation-safety tuple.