[yang-models] required service field for control plane ACL table

[qiluo-msft]

Description

This issue is found by config apply-patch development.

I see the difference in redis monitor log:

$ sudo config load -y config_add_table.json
[4 unix:/var/run/redis/redis.sock] "HMSET" "ACL_TABLE|V8_SSH_ONLY" "policy_desc" "V8_SSH_ONLY" "services@" "SSH" "stage" "ingress" "type" "CTRLPLANE"

$ sudo config apply-patch patch_add_table.json
[4 127.0.0.1:47474] "HMSET" "ACL_TABLE|V8_SSH_ONLY" "type" "CTRLPLANE"
[4 127.0.0.1:47474] "HMSET" "ACL_TABLE|V8_SSH_ONLY" "policy_desc" "V8_SSH_ONLY" "type" "CTRLPLANE"
[4 127.0.0.1:47474] "HMSET" "ACL_TABLE|V8_SSH_ONLY" "policy_desc" "V8_SSH_ONLY" "services@" "SSH" "type" "CTRLPLANE"
[4 127.0.0.1:47474] "HMSET" "ACL_TABLE|V8_SSH_ONLY" "policy_desc" "V8_SSH_ONLY" "services@" "SSH" "stage" "ingress" "type" "CTRLPLANE"

Checking the source code src/sonic-host-services/scripts/caclmgrd, it subscribes ACL_TABLE_TABLE and ACL_RULE_TABLE. I believe the non-atomic HMSET operations by config apply-patch mess the caclmgrd logic.

Steps to reproduce the issue:

Describe the results you received:

Describe the results you expected:

Output of show version:

(paste your output here)

Output of show techsupport:

(paste your output here or download and attach the file here )

Additional information you deem important (e.g. issue happens only occasionally):

[ghooo]

The patch-applier command produces the following steps:

Patch Applier: The patch was sorted into 4 changes:
Patch Applier:   * [{"op": "add", "path": "/ACL_TABLE/V8_SSH_ONLY", "value": {"type": "CTRLPLANE"}}]
Patch Applier:   * [{"op": "add", "path": "/ACL_TABLE/V8_SSH_ONLY/policy_desc", "value": "ACTRLPLANETABLE"}]
Patch Applier:   * [{"op": "add", "path": "/ACL_TABLE/V8_SSH_ONLY/services", "value": ["SSH"]}]
Patch Applier:   * [{"op": "add", "path": "/ACL_TABLE/V8_SSH_ONLY/stage", "value": "ingress"}]

Although the config on the switch are valid after each application of the above steps according to YANG models. There is a problem with src/sonic-host-services/scripts/caclmgrd, specifically this code snippet:

            # Ignore non-control-plane ACL tables
            if table_data["type"] != self.ACL_TABLE_TYPE_CTRLPLANE:
                continue

            acl_services = table_data["services"]

caclmgrd expect services to exist in case the ACL type is CTRLPLANE, it does not do any validation. So when the patch-applier is applying the first change above caclmgrd breaks and it does not recover fast enough for the rest of the steps.

There are 2 ways to fix this issue:

• Fix caclmgrd to actually check if services exist in table_data otherwise assume there is 0 services.
• Validate using YANG models that whenever the ACL type is CTRLPLANE, the services must exist .. this is the option implemented in [yang-models] Validating 'services' exist if ACL type is 'CTRLPLANE' #9295

@qiluo-msft please let me know if my understanding is not correct, or if you have any concerns

[ghooo]

Fixed by #9295