{"id":17796984,"url":"https://github.com/karimra/srl-grpc-tunnel","last_synced_at":"2025-08-16T22:33:46.991Z","repository":{"id":65198532,"uuid":"471845832","full_name":"karimra/srl-grpc-tunnel","owner":"karimra","description":"SR Linux NDK application adding Openconfig gRPC tunnel support","archived":false,"fork":false,"pushed_at":"2024-03-11T19:20:47.000Z","size":311,"stargazers_count":3,"open_issues_count":4,"forks_count":0,"subscribers_count":4,"default_branch":"main","last_synced_at":"2025-07-19T11:45:24.952Z","etag":null,"topics":["gnmi","gnoi","grpc","grpc-go","ndk","nokia","openconfig","srl","telemetry","tunnel"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/karimra.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-03-20T00:46:22.000Z","updated_at":"2025-07-10T13:42:09.000Z","dependencies_parsed_at":"2023-01-11T23:00:46.191Z","dependency_job_id":"4f4a6069-71b5-471a-be8c-950afc2b033f","html_url":"https://github.com/karimra/srl-grpc-tunnel","commit_stats":{"total_commits":42,"total_committers":2,"mean_commits":21.0,"dds":"0.45238095238095233","last_synced_commit":"00ef485efdd87ba78996a1cada84a87cd284b3cd"},"previous_names":[],"tags_count":10,"template":false,"template_full_name":null,"purl":"pkg:github/karimra/srl-grpc-tunnel","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/karimra%2Fsrl-grpc-tunnel","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/karimra%2Fsrl-grpc-tunnel/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/karimra%2Fsrl-grpc-tunnel/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/karimra%2Fsrl-grpc-tunnel/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/karimra","download_url":"https://codeload.github.com/karimra/srl-grpc-tunnel/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/karimra%2Fsrl-grpc-tunnel/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":270781198,"owners_count":24643804,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-16T02:00:11.002Z","response_time":91,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["gnmi","gnoi","grpc","grpc-go","ndk","nokia","openconfig","srl","telemetry","tunnel"],"created_at":"2024-10-27T11:50:27.570Z","updated_at":"2025-08-16T22:33:46.966Z","avatar_url":"https://github.com/karimra.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# srl-grpc-tunnel\n\nSRL gRPC Tunnel is an [SR Linux](https://learn.srlinux.dev/) [NDK](https://learn.srlinux.dev/ndk/intro/) application that adds support for [Openconfig gRPC tunnel](https://github.com/openconfig/grpctunnel) to SR Linux.\n\nIt acts as a gRPC tunnel client to allow access to locally configured targets (gNMI server, gNOI server, SSH server...)\n\nIt connects to a gRPC tunnel server such as [gNMIc](https://gnmic.openconfig.net/user_guide/tunnel_server/).\n\n## Features\n\n* gRPC tunnel client handles gNMI, SSH and custom targets\n\n* Both secure and insecure connections are supported\n\n* Multiple destinations per tunnel (all active)\n\n* Multiple targets per tunnel\n\n* Predefined target ID (node-name, user-agent, mac-address)\n\n* Predefined target type (gNMI server, SSH server)\n\n* Custom target ID and Type, either a user defined string or a Go template.\n\n## Installation\n\n### Automated install with lab\n\nFor an automated lab deployment with 2 SR Linux, 2 gNMIc (tunnel server), a Prometheus server and a consul server see [here](https://github.com/karimra/srl-grpc-tunnel/tree/main/example#readme)\n\n### Manual installation\n\nDownload the pre build .deb file from the repo's [release page](https://github.com/karimra/srl-grpc-tunnel/releases), or run:\n\n```bash\nversion=0.1.8\nwget https://github.com/karimra/srl-grpc-tunnel/releases/download/v${version}/srl-grpc-tunnel_${version}_Linux_x86_64.deb\n```\n\nCopy the .deb file to your SR Linux instance and run (from bash)\n\n```bash\nsudo dpkg -i srl-grpc-tunnel_${version}_Linux_x86_64.deb\n```\n\nReload the application manager\n\n```bash\nsr_cli tools system app-management application app_mgr reload\n```\n\nCheck that the `grpc-tunnel` application is running\n\n```bash\n--{ + running }--[  ]--                                                                   \nA:srl1# show system application grpc-tunnel                                               \n  +-------------+------+---------+----------------+--------------------------+\n  |    Name     | PID  |  State  |    Version     |       Last Change        |\n  +=============+======+=========+================+==========================+\n  | grpc-tunnel | 2837 | running | v0.1.0-42f4b74 | 2022-03-30T05:21:57.649Z |\n  +-------------+------+---------+----------------+--------------------------+\n--{ + running }--[  ]--                                                                   \nA:srl1#     \n```\n\n## Configuration\n\nThis application relies on SRL's gNMI server unix socket to serve sessions towards GNMI_GNOI targets. It should be enabled before starting the grpc-tunnel application.\n\n```shell\nenter candidate\n# enable the gnmi-server unix-socket\n/ system gnmi-server unix-socket admin-state enable\n# disable authentication (optional)\n/ system gnmi-server unix-socket use-authentication false\n# enable gNMI and gNOI (optional) services\n/ system gnmi-server unix-socket services [ gnmi gnoi ]\n# commit\ncommit now\n```\n\nThe application configuration has 3 sections; its `admin-state`, the list of `destinations` and the `tunnels`\n\n``` shell\n--{ + running }--[ system grpc-tunnel ]--                                                 \nA:srl1#                                                                                   \nLocal commands:\n  admin-state*      Administrative state of the gRPC tunnel application\n  destination       list of gRPC tunnel destinations, i.e gRPC tunnel servers\n  tunnel            gRPC tunnel(s)\n```\n\n### Destinations (gRPC Tunnel servers)\n\n```shell\n--{ + running }--[ system grpc-tunnel ]--                                                 \nA:srl1# destination d1                                                                    \nusage: destination \u003cname\u003e\n\nlist of gRPC tunnel destinations, i.e gRPC tunnel servers\n\nPositional arguments:\n  name              [string] destination name\n\nLocal commands:\n  address*          destination address\n  description*      destination description\n  network-instance*\n                    Reference to a configured network-instance used to establish the gRPC\n                    tunnel from.\n  no-tls*           when true the connection to this destination will be insecure\n  port*             destination port number\n  tls-profile*      NOT IMPLEMENTED: Reference to the TLS profile to use when initiating\n                    connections to this destination.\n```\n\nSetting a tls-profile on the client side is not implemented yet, by default the tunnel client will use a one-way TLS connection. TLS can be disabled by setting `no-tls true`\n\n#### CLI\n\nTo configure a gRPC tunnel destination `d1` run the below commands:\n\n```shell\nenter candidate\n# create destination d1\n/ system grpc-tunnel destination d1 \n# set an address and a port number for d1\n/ system grpc-tunnel destination d1 address 172.20.20.2 port 57401 # (default port 57401)\n# use a non secure connection for d1\n/ system grpc-tunnel destination d1 no-tls true\n# use network-instance mgmt to connect to destination d1 (default: mgmt)\n/ system grpc-tunnel destination d1 network-instance mgmt # default\ncommit now\n```\n\n```text\n--{ + running }--[ system grpc-tunnel destination d1 ]--                                  \nA:srl1# info                                                                              \n    address 172.20.20.2\n    port 57401\n    network-instance mgmt\n    no-tls true\n--{ + running }--[ system grpc-tunnel destination d1 ]--                                  \nA:srl1#\n```\n\n#### gNMI\n\n```shell\ngnmic -a clab-grpc-tunnel-srl1 -u admin -p admin --skip-verify set \\\n    --update /system/grpc-tunnel/destination[name=d1]/address:::json_ietf:::172.20.20.2 \\\n    --update /system/grpc-tunnel/destination[name=d1]/port:::json_ietf:::57401 \\\n    --update /system/grpc-tunnel/destination[name=d1]/network-instance:::json_ietf:::mgmt \\\n    --update /system/grpc-tunnel/destination[name=d1]/no-tls:::json_ietf:::true\n```\n\n### Tunnel (gRPC Tunnel)\n\nCreate a Tunnel `t1` and link the destination `d1` to it.\n\nA max of 16 tunnels can be created, To each one, 16 destinations can be linked.\n\n#### CLI\n\nTo configure a gRPC tunnel `t1` run the below commands:\n\n```shell\nenter candidate\n# create tunnel d1\n/ system grpc-tunnel tunnel t1\n# link destination d1 to tunnel t1\n/ system grpc-tunnel tunnel t1 destination d1\ncommit now\n```\n\n#### gNMI\n\n```shell\ngnmic -a clab-grpc-tunnel-srl1 -u admin -p admin --skip-verify set \\\n    --update /system/grpc-tunnel/tunnel[name=t1]:::json_ietf:::'{\"destination\":{\"name\":\"d1\"}}'\n```\n\n### Targets\n\n```text\n--{ + running }--[ system grpc-tunnel tunnel t1 ]--                                       \nA:srl1# target tg1                                                                        \nusage: target \u003cname\u003e\n\nPositional arguments:\n  name              [string, length 1..256] target local name\n\nLocal commands:\n  id                target ID\n  local-address*    local address to dial for an established tunnel towards this target\n  type              target type\n```\n\nThe `id` and `type` are the unique identifiers used to register the target with the gRPC tunnel server.\nThe `local-address` is used to customize the local handler behavior by changing the dialed address when a request is received through the tunnel.\n\nThe target `id` values are:\n\n* `node-name`: The configure node host-name under `system name host-name`\n* `user-agent`: A custom string in the format `\u003cnode-name\u003e:nokia-srl:\u003cchassis\u003e:\u003csw-version\u003e`\n* `mac-address`: The node chassis mac address\n* `custom \u003cstring\u003e`: A user defined string, or a Go template that uses the systemInfo struct as input.\n\nThe target `type` values are:\n\n* `grpc-server`: This sets the target type to `GNMI_GNOI` when registering the target with the gRPC tunnel server. In this case, the `local-address` defaults to `unix:///opt/srlinux/var/run/sr_gnmi_server`.\n* `ssh-server`: This sets the target type to `SSH` when registering the target with the gRPC tunnel server. In this case, the `local-address` defaults to `localhost:22`.\n* `custom`: Sets a custom string or Go template as the target `type`. In this case setting the `local-address` is mandatory.\n\nE.g: Add a target called tg1, type `grpc-server` with ID `node-name`\n\n#### CLI\n\n```shell\nenter candidate\n# add target with type `grpc-server`\n/ system grpc-tunnel tunnel t1 target tg1 type grpc-server \n# set target ID to `node-name`\n/ system grpc-tunnel tunnel t1 target tg1 id node-name\ncommit now\n```\n\n#### gNMI\n\n```shell\ngnmic -a clab-grpc-tunnel-srl1 -u admin -p admin --skip-verify set \\\n    --update /system/grpc-tunnel/tunnel[name=t1]/target[name=tg1]/type/grpc-server:::json_ietf:::'[null]' \\\n    --update /system/grpc-tunnel/tunnel[name=t1]/target[name=tg1]/id/node-name:::json_ietf:::'[null]'\n```\n\n### Enable Tunnel\n\n#### CLI\n\n```shell\nenter candidate\n# enable tunnel t1\n/ system grpc-tunnel tunnel t1 admin-state enable\ncommit now\n```\n\n#### gNMI\n\n```bash\ngnmic -a clab-grpc-tunnel-srl1 -u admin -p admin --skip-verify set \\\n    --update /system/grpc-tunnel/tunnel[name=t1]/admin-state:::json_ietf:::enable\n```\n\n## State\n\n```text\n--{ + running }--[ system grpc-tunnel ]--                                                 \nA:srl1# info from state                                                                   \n    admin-state enable\n    oper-state up\n    destination d1 {\n        address 172.20.20.2\n        port 57401\n        network-instance mgmt\n        no-tls true\n    }\n    tunnel t1 {\n        admin-state enable\n        oper-state up\n        oper-state-down-reason \"\"\n        destination d1 {\n            oper-state up\n            oper-state-down-reason \"\"\n            target srl1 type GNMI_GNOI {\n                oper-state up\n                oper-state-down-reason \"\"\n            }\n        }\n        target tg1 {\n            id {\n                node-name\n            }\n            type {\n                grpc-server\n            }\n        }\n    }\n--{ + running }--[ system grpc-tunnel ]--   \n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkarimra%2Fsrl-grpc-tunnel","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkarimra%2Fsrl-grpc-tunnel","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkarimra%2Fsrl-grpc-tunnel/lists"}