search

NLnetLabs / krill

RPKI Certificate Authority and Publication Server written in Rust
https://nlnetlabs.nl/projects/routing/krill/
Mozilla Public License 2.0
295 stars 42 forks source link

Various Feature Enhancement Considerations #1029

Open chazh83 opened 1 year ago

chazh83 commented 1 year ago

Hello NLNet Labs ~

We've had a bumpy time within our team for the past 2 years, and we have always planned the move to Krill, but there are few things we'd appreciate to have considered for Feature Enhancements, and was informed this may be the forum to present them.

Mostly we're looking for enhancements in the Web UI, however, we'd also like to consider some of the backend features. I'm happy to discuss any of this with you directly, and we are not looking for any type of immediate response. We do believe that many of these could benefit most or all users of Krill. If there is a better forum for this, please advise.

Thanks in advance for your consideration,

Chuck H Charter Communications

Krill Web UI / Reporting/Monitoring

  1. NLnet - Currently there is an option to download to CSV, this downloads only the current page of ROAs. We would like to see an option to “download current page”, and “download all”. The “download all” should download whatever is filtered by searching.

  2. NLnet - The search feature has prefix, ASN, and state filter capability. We would like to have ORGID added to the search.

  3. NLnet - Currently the IP ranges available to Krill to create ROAs is listed on the right navigation. As we know we have 56,951,552 IPv4 IP addresses, we would like to see this value published on the page to identify and verify the count Krill has coincides with our count. For IPv6 it we would like to see the number of /48 equivalents (or larger if value is extreme).

  4. NLnet – The feature in Krill to “Analyse my ROAs” is very helpful. We would like to see the feature to download or export the list of candidates in CSV so we can do further analysis outside of Krill.

  5. NLnet – When a prefix listed is INVALID, provide a twisty in front with the detail showing the ROA(s) that invalidates the prefix.

  6. NLnet – In the ROA Analysis list, provide an option to “Ignore” selected items. Also include a button to ‘Reveal ignored items’.

Prometheus server for Krill is already stood up, we will just need to add functionality: https://krill.netops.charter.com/prometheus/

Archiving / Audit Trail

  1. NLnet - We understand that Krill has an Archiving function that could be used for an audit trail. https://krill.docs.nlnetlabs.nl/en/stable/architecture.html?highlight=audit#archiving We understand there is currently an open issue to utilize this archive to “recreate” the ROA state with this archive, we would like to see this tooling established under: https://github.com/NLnetLabs/krill/issues/331

BGP Input Sources

  1. NLnet - Allow for additional input sources of BGP data, including our own json, csv, BMP source, and/or direct peering router command query (Cisco & Juniper).
chazh83 commented 1 year ago

I suspect NLNet Labs has heard, ARIN recently started a new feature to create IRR route(6) objects while generating ROAs. Could this be another feature add for those RIR's that have API's to support this? Or perhaps for an IRR service such as RADb? I realize passwords and/or API-keys will need to be collected and stored to accomplish this.

timbru commented 1 year ago

I plan to review the issue list after the coming 0.14.0-rc1 release. The list is disorganised at the moment, containing many things that have been done, things that are not needed, and lacking ideas that we have in mind but have not created any issues for.

We have no shortage of ideas, but we do not have the resources to implement them all in the short term. Our first priority is working on issues/features requested by organisations that have a support contract or a funding relationship with us. That's how we pay the bills, after all. Other issues get done eventually, but it may take time. If you are willing to fund, we can talk more, as this would allow us to scale up resources.

On the latest suggestion of integration with the IRR. I can see some value from an operator perspective. However, it gets pretty complicated if we need to support the various IRR implementations and authorisation schemes out there. It may be better, in this case, to use your own automation to manage ROAs in Krill and route objects in the IRR through their respective APIs.