[authz] Add direct CONFIG_DB policy source

[hdwhdw]

Why I did it

In sonic-gnmi, grpc-go A43 method authorization accepts only a policy file. Deployments that publish policy to CONFIG_DB need a direct source. The source must not create an intermediate policy file.

How I did it

Policy loading

• This PR separates policy loading from authorization interceptor creation.
• The file source keeps the existing file watcher.
• The config_db source reads GRPC_AUTHZ_PRINCIPAL and GRPC_AUTHZ_RULE.
• The config_db source expands roles into literal principals and creates deterministic A43 JSON in memory.
• sonic-gnmi uses authz.NewStatic to validate the policy before installing unary and streaming interceptors.

Startup and policy ownership

• --authorization_policy_source accepts file and config_db. The default is file.
• When authorization is enabled, sonic-gnmi rejects startup configurations that set insecure, noTLS, or allow_no_client_auth.
• In config_db mode, sonic-gnmi authenticates gNSI Authz.Rotate requests before rejecting them.
• Integration CI installs coverage tools with a project-local GOPATH. This isolates tool installation from the inherited Go checksum cache.
• The Authz.Rotate rejection preserves the CONFIG_DB publisher as the sole policy writer.
• Policy-source and interceptor startup errors propagate through runTelemetry. telemetry exits with a nonzero status.

The config_db source loads policy once during startup. Restart the service to apply policy changes.

This PR does not configure a launcher to select config_db. Live reload for config_db requires separate work. Atomic publication across GRPC_AUTHZ_PRINCIPAL and GRPC_AUTHZ_RULE also requires separate work.

Launcher enablement, data processing unit forwarding, Unix domain socket enforcement, gNMI Pathz authorization, and image qualification are outside this PR.

How to verify it

• make -f pure.mk ci PACKAGES=pkg/authzpolicy passed. Package coverage was 86.6%.
• go test -race -count=10 ./pkg/authzpolicy passed.
• go vet ./pkg/authzpolicy ./pkg/interceptors passed.
• A SONiC trixie builder compiled gnmi_server and telemetry with generated swsscommon and ocbinds code.
• The builder passed focused policy-source selection, startup-failure propagation, and Authz.Rotate authentication and rejection tests.
• An inherited Go checksum cache with root-owned files reproduced the CI failure. Both coverage tools installed with the project-local GOPATH.

Which release branch to backport

No release branch is selected.

Tested branch

• master

Test result

• master: All listed checks passed. Full image qualification is pending.

Description for the changelog

Add a direct CONFIG_DB source for grpc-go A43 method authorization policies.

Link to config_db schema for YANG module changes

This PR does not change YANG files. The proposed CONFIG_DB schema is in sonic-buildimage PR #29087.

A picture of a cute animal

Not included.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[mssonicbld]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[hdwhdw]

Verification

Source tests and focused SONiC build checks passed.

Environment

• The checks ran in a SONiC trixie builder with generated swsscommon code and sonic-mgmt-common OpenConfig bindings.
• The builder included libyang3 and swsscommon development packages.

Source checks

• make -f pure.mk ci PACKAGES=pkg/authzpolicy passed with race detection and 86.6% coverage.
• go test -race -count=10 ./pkg/authzpolicy passed.
• go vet ./pkg/authzpolicy ./pkg/interceptors passed.
• A real mutual TLS (mTLS) client/server test passed unary allow, streaming allow, unmatched-method deny, and unknown-principal deny cases.

SONiC checks

• gnmi_server and telemetry compiled with generated SONiC dependencies.
• Focused telemetry tests passed for file and config_db source selection and the default file source.
• Focused telemetry tests confirmed that certificate guards require a verified client certificate.
• Focused telemetry tests confirmed startup error propagation and a nonzero process exit.
• Focused server tests loaded the file source and rejected authenticated gNSI Authz.Rotate requests in config_db mode.

Verification boundary

• The CONFIG_DB source loads policy only at startup.
• Restart the service to apply policy changes.
• Full SONiC integration tests and image qualification remain pending.
• Verification does not cover policy enforcement for data processing unit (DPU) or Unix domain socket (UDS) requests.
• Verification does not cover launcher enablement, live reload, OpenConfig Pathz, or atomic publication across the two CONFIG_DB policy tables.

[Copilot]

Pull request overview

This PR adds a new authorization policy source backed directly by SONiC CONFIG_DB for grpc-go A43 method authorization, and refactors policy loading so telemetry/gnmi_server can install interceptors from either a watched policy file or a compiled in-memory policy.

Changes:

• Add pkg/authzpolicy with pluggable policy sources (file, config_db) and deterministic compilation from GRPC_AUTHZ_PRINCIPAL / GRPC_AUTHZ_RULE.
• Extend telemetry flags/config to select --authorization_policy_source and enforce verified client-cert transport when authz policy is enabled; propagate startup failures to a non-zero exit.
• Update gnmi_server to load authz policy via the new source abstraction, close policy resources on shutdown, and disable gNSI Authz.Rotate when CONFIG_DB owns policy.

Reviewed changes

Copilot reviewed 12 out of 13 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
telemetry/telemetry.go	Adds policy-source flag/validation and propagates server startup errors to runTelemetry/main exit status.
telemetry/telemetry_test.go	Adds coverage for new exit behavior, startup-failure propagation, and policy-source flag handling.
pkg/authzpolicy/source.go	Introduces a policy source interface and file-based source preserving grpc-go file watcher behavior.
pkg/authzpolicy/source_test.go	Tests file-source loading and close idempotence plus invalid initial policy rejection.
pkg/authzpolicy/enforcement_test.go	End-to-end enforcement test for CONFIG_DB-compiled policy against unary and streaming RPCs.
pkg/authzpolicy/configdb.go	Implements CONFIG_DB table reading, policy compilation, and static interceptor creation/validation.
pkg/authzpolicy/configdb_test.go	Unit tests for table reading, determinism, validation failures, and source loading.
go.mod	Updates glog and adds explicit golang.org/x/time dependency.
go.sum	Records new module checksums.
gnmi_server/server.go	Switches from direct file watcher to loaded authzpolicy.PolicyInterceptor with proper shutdown cleanup.
gnmi_server/gnsi_authz.go	Disables Authz freshness/policy file handling and rejects Authz.Rotate in CONFIG_DB policy mode (after authn).
gnmi_server/authz_policy.go	Adds shared policy-loading helper and CONFIG_DB source wiring (Redis + sonic_db_config).
gnmi_server/authz_policy_test.go	Adds tests for policy source selection and CONFIG_DB Authz.Rotate authn-before-reject behavior.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[mssonicbld]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[mssonicbld]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).