]> Watsen Networks

kent+ietf@watsen.net

Huawei

101 Software Avenue, Yuhua District Jiangsu 210012 China maqiufang1@huawei.com

Nokia

India deepak.rajaram@nokia.com

Operations and Management Network Modeling YANG template NMDA NETCONF and RESTCONF protocols provide programmatic interfaces for accessing configuration data modeled by YANG. This document defines the use of a YANG-based configuration template mechanism whereby configuration data can be defined in one or more templates and applied repeatedly. This avoids the redundant definition of identical configuration and ensures the consistency of it, thus allowing configuration data to be managed more conveniently and efficiently. Discussion Venues Discussion of this document takes place on the Network Modeling Working Group mailing list (netmod@ietf.org), which is archived at . Source for this draft and an issue tracker can be found at .

Introduction This document considers the case of a datastore that contains multiple subtrees with similar or identical nodes within them, such that the datastore contains repetitive data with limited variation. If a client has to repeatedly configure the same nodes for each subtree, this can become complex and error-prone. This document proposes a solution to improve this, called "Configuration Templates". A configuration template is a fragment of configuration that the server is instructed to replicate multiple times to generate copies of the configuration. This allows repetitive subtrees of configuration to be written only once, in the template. When needed, individual instantiations of a template can override the values of nodes, or add new instance-specific nodes. NMDA allows the configuration templates to be defined in <running> and expanded in <intended>, but it does not specify details about how configuration templates could be created and applied. This document defines the use of configuration templates in the context of YANG-driven network management protocols such as NETCONF and RESTCONF . Configuration templates can be used with any YANG data model, this document doesn't make any assumption on the YANG data model design, i.e., it does not rely on a shared profile/group being defined in the YANG data model.

Editorial Note (To be removed by RFC Editor) Note to the RFC Editor: This section is to be removed prior to publication. This document contains placeholder values that need to be replaced with finalized values at the time of publication. This note summarizes all of the substitutions that are needed. No other RFC Editor instructions are specified elsewhere in this document. Please apply the following replacements:

• XXXX --> the assigned RFC number for this draft
• 2026-07-03 --> the actual date of the publication of this document

Conventions and Definitions The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here. The meanings of the symbols in tree diagrams are defined in . This document uses the terminology defined in and . This document uses the following terminology in :

• configuration data

Besides, this document defines the following terminology:

configuration template:

A chunk of reusable configuration data that could be applied to the configuration repeatedly, in order to simplify the delivery of network configuration and ensure the consistency of it. A configuration template is referred to interchangeably as "template" or "YANG template" throughout this document.

Requirements This section describes requirements that the configuration templates solution must satisfy. A general theme of the configuration template work is to come up with a "Minimal Viable Product (MVP)" that delivers a baseline solution with essential functionality but avoids excessive complexity. More advanced features could be considered as extensions in future work.

Defining and Managing Templates Templates can be defined with any YANG module. They contain nodes of configuration data, and are stored in the running datastore of the server after creation. A client can view and manipulate a template in <running>. System may generate a template in <system> (). In this sense, a template and its contents behave like any other configuration data.

Applying Templates A template can be applied to zero or more nodes in the running datastore. Each node can have zero or more templates applied to it, and the order specified by the client determines the precedence with which templates are applied within that node. Templates can be applied at multiple nodes in the hierachy. When viewing the contents of <running>, there is a mechanism to see which templates have been applied to each node, and in which order.

Producing the Intended Datastore The server's intended datastore is the result of combining all the applications of templates together with non-template configuration (i.e., configuration explicitly created by clients rather than derived from applied templates) in <running> and <system> (see ). This is called template expansion. The intended configuration inside a subtree is the result of taking the relevant contents of every template applied to the subtree's root node and its ancestors, and combining it with the (non-template) data nodes inside the subtree. A node inside a subtree may be present in multiple templates that have been applied, and/or it may be present as non-template configuration inside the subtree. The requirements for template expansion are as follows:

• The value of a node in <intended> is determined by using precedence rule to decide where to take the value from.
• Non-template configuration always has the highest precedence.
• When templates are applied to multiple ancestors, the innermost ancestor takes precedence.
• When multiple templates are applied to a particular node, the order of application (as indicated by the client when applying the templates) determines the precedence within that node.

Whenever the contents of a template is updated in <running> or <system>, the result of template expansion appears in <intended>.

Pattern Matching in Templates The configuration inside a template definition can contain values for list keys that are simple regular expressions, using a limited subset of regular expression syntax. This controls which list entries that particular subtree of the template takes effect for when the template is applied. An example of this would be to have a template that is applied to a top-level "interfaces" container, but the template only takes effect for certain interface names that match the regular expression.

Off-box Template Expansion If the client knows the complete contents of <running> and <system>, which include non- template configuration, template definitions and template applications, the client must be able to calculate the result of template expansion, i.e., the contents of <intended>. In other words, the outcome of template expansion depends solely on the contents of running and system datastores.

Configuration Template Solution

Defining Templates A configuration template must first be defined before it can be applied (see ). The creation, modification, and deletion of configuration templates are achieved by network management operations via NETCONF or RESTCONF protocols. The contents of the configuration template must be an instantiated chunk of data starting from any level node in the hierarchies of any YANG data model. For example, provides an interface configuration template named "base-interface":

Example of An Interface Template ]]>

The YANG data model of configuration templates is defined in .

Template Definition with Pattern Matching To allow a single template to apply to multiple instances with similar naming conventions without explicit replication, a regular expression string may be used within key leafs to restrict which list entries a template takes effect for. It MUST NOT be used on any nodes other than a list key with built-in type "string", or types derived from "string". Any regular expression pattern MUST conform to , which defines a subset of XML Schema Definition (XSD) regular expressions . For example, provides an interface configuration template that sets "type" as ethernetCsmacd and "mtu" as 1500 for all interfaces names match the pattern "eth.*", i.e., starting with the prefix "eth":

Example of An Interface Template with Pattern Matching ]]>

Applying Templates For each configuration node, including container, list, anydata, anyxml, leaf-list, and leaf, one or more templates can be applied. This causes configuration from one or more templates to be merged with explicitly provided configuration data to produce a final set of configuration that is intended to be applied by the server. Any update to the applied templates will be reflected in the merging result.

The "apply-templates" Metadata Template application is indicated using the "apply-templates" metadata annotation . The value of this is a list of space-separated template identifiers. The order of appearance of the template identifiers in the list determines their precedence when producing the merging result. If the template is applied to a node in the data tree, the metadata object is added to that specific node. The encoding of "apply-templates" metadata object follows the way defined in . For example, provides the interface configuration with the container node "interfaces" applying the templates "ethernet-interface" and "base-interface", defined in and respectively:

An Example of Applying Templates loopback0 eth0 eth1 ]]>

And the above interface configuration renders the expanded configuration shown in :

Template Expansion loopback0 true 65536 default provisioned interface eth0 true ethernetCsmacd 1500 default provisioned ethernet interface eth1 true ethernetCsmacd 1500 default provisioned ethernet interface ]]>

Creating, editing and deleting the "apply-templates" metadata The "apply-templates" metadata annotation may be modified by the client by specifying a different value in subsequent operations. Any modification to this annotation MUST provide the complete, updated list of template identifiers on the target node, rather than merging with or appending to it. There are three cases when modifying the "apply-templates" annotation:

• The "apply-templates" annotation is specified and the value is non- empty (i.e. a list of templates to apply to the node). The "apply- templates" metadata is changed to match the exact value in the request.
• The "apply-templates" annotation is specified and the value is either empty or contains only whitespace. The "apply-templates" metadata is removed and thus no templates are applied to the node.
• The "apply-templates" annotation is not specified. The "apply-templates" metadata currently present on the node (if any) is unchanged.

For example, creates two interface entries named "loopback0" and "eth0" and applies template "base-interface" to the interfaces container:

An Initial Template Application Example loopback0 eth0 ]]>

A subsequent request in also applies template "ethernet-interface" to the interfaces container:

Request to Prepend a Second Template ]]>

After this request, <running> is as shown in :

Running Contents After Multiple Template Application loopback0 eth0 ]]>

adds a new interface list entry, and leaves the applied templates unchanged:

Request to Add a New Interface Entry eth1 ]]>

After this request, <running> is as shown in .

Running Contents After Interface Addition loopback0 eth0 eth1 ]]>

Finally, this request deletes all the templates, and leaves the list entries unchanged:

Request to Clear All Applied Templates loopback0 eth0 eth1 ]]>

After this request, <running> is as follows:

Running Contents After Removing Template Applications loopback0 eth0 eth1 ]]>

Overriding Templates The client may want to to override some configuration in a template when it is applied to a particular node in read-write datastores (e.g., <running> or <candidate>). The client can achieve this by providing the desired value at the corresponding level when applying the template. Configuration explicitly provided by the client always takes precedence over the same node defined in template. A template node can be overriden by having its value changed, but it can't be deleted. provides an example of overriding a node in a template, a client may configure physically present interfaces "eth0" and "eth1" inheriting the template defined in , but the "mtu" value of "eth1" needs to be 9122:

Example of Explicit Configuration Overriding a Template eth0 eth1 9122 ]]>

And the above interface configuration renders the expanded configuration shown in .

Expanded Configuration Result with Overridden MTU eth0 true 65536 default provisioned interface eth1 true 9122 default provisioned interface ]]>

Expanding Templates When a configuration template is applied to a node in the data tree, it acts as if the configuration defined in the template is merged with the configuration provided explicitly at the corresponding level in the data tree, with the explicitly provided configuration taking precedence. the process of expanding templates to derive <intended> is deterministic and depends solely on the contents of <running>. The process rules are as follows:

• The value of a node in <intended> after template expansion is determined by using precedence to decide where to take the value from.
• Non-template configuration always has the highest precedence.
• When templates are applied to multiple ancestors, the innermost ancestor takes precedence.
• When multiple templates are applied to a particular node, the order of application (as indicated by the client when applying the templates) determines the precedence within that node.

If a client has knowledge of the complete contents of <running> and <system>, it can calculate the exact result of template expansion, independent of the server's operational state. Whenever the contents of an applied template is updated in <running> or <system>, the result of template expansion appears in <intended>.

Deletion of Templates A configuration template can not be deleted if it is currently actively applied to any data node. When a client attempts to delete a template definition from read-write datastores (e.g., <running> or <candidate>) that is in use, the server MUST reject the deletion request with the error-tag value "data-missing", indicating that the template is still in use. To successfully delete a template, a client MUST first update the target configuration nodes to remove the template identifier from their "apply-templates" metadata attribute (as described in ), and then subsequently delete the template definition itself.

Validity of Templates The contents of the template alone is not always sufficient to enforce the constraints of the data model. Some constraints may depend on configuration outside of the templates to satisfy, e.g., a list may contain a mandatory leaf node which is not defined in the template but explicitly provided by the client. However, servers SHOULD parse the template and enforce the constraints if it is possible during the processing of template creation, e.g., servers may validate type constraints for the leaf, including those defined in the type's "range", "length", and "pattern" properties. Implementations may also consider using mechanism defined in to validate anydata. That said, if a template is applied in the configuration data tree, the results of the template configuration merging with configuration explicitly provided by the client MUST always be valid, as defined in .

Interaction with NMDA datastores Some implementations may have predefined configuration templates for the convenience of clients, which are present in <system> (if implemented, see ). In addition, clients can always define their own templates in <running>. However, configuration template data defined by "ietf-config-template" YANG data model should not be visible in <operational> until being inherited by a node in the data tree. If a node in the data tree applies a configuration template, the configuration template does not expand in <running>. A read of <running> returns what is sent by the client with the "apply-templates" metadata attached to the specific node. A configuration template which is inherited or overridden by the node instance MUST be expanded in <intended>.

Interaction with Non-NMDA datastores TBC

The "ietf-config-template" YANG Module

Data Model Overview The following tree diagram illustrates the "ietf-config-template" module: +--ro last-modified? yang:timestamp ]]>

• Editor's Note: Should we use the RFC7952 metadata annotation for the 'apply-templates' metadata here?

• Editor's Note: the current definition of template configuration uses anydata, but this may not be able to be validated at template definition time because anydata is opaque.

YANG Module Editor: Kent Watsen Editor: Qiufang Ma Editor: Deepak Rajaram "; description "This module defines a template list with a RPC to expand the template. Copyright (c) 2026 IETF Trust and the persons identified as authors of the code. All rights reserved. Redistribution and use in source and binary forms, with or without modification, is permitted pursuant to, and subject to the license terms contained in, the Revised BSD License set forth in Section 4.c of the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info). This version of this YANG module is part of RFC XXXX (https://www.rfc-editor.org/info/rfcXXXX); see the RFC itself for full legal notices. The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', 'SHALL NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED', 'NOT RECOMMENDED', 'MAY', and 'OPTIONAL' in this document are to be interpreted as described in BCP 14 (RFC 2119) (RFC 8174) when, and only when, they appear in all capitals, as shown here."; revision 2026-07-03 { description "Initial revision."; reference "RFC XXXX: YANG Templates"; } container templates { description "Specifies the template parameters."; list template { key id; description "The list of templates managed on this device."; leaf id { type string; description "The identifier of the template that uniquely identifies a template."; } leaf description { type string; description "A textual description of the template."; } anydata content { description "inline template content."; } leaf last-modified { type yang:timestamp; config false; description "Timestamp when the template is modified last time."; } } } } ]]>

Operational Considerations Implementations MAY restrict the applications of configuration templates to some specific nodes in the YANG data tree. Restrictions should be applied consistently across all client operations. Any attempts to apply a template to a restricted node will be rejected. Implementations are recommended to expose the list of configuration nodes that do not support template application, any mechanisms to achieve this are outside the scope of this document. Configuration templates are designed to remain unexpanded in <running>. This ensures storage efficiency and preserves the client's control over <running>, i.e., reads of <running> returns the client-submitted configuration with the "apply-templates" metadata attached to target nodes. Any configuration template that is applied in the data tree MUST be expanded in <intended>, which holds a merged result of template expansion and configuration explicitly provided by clients. Implementations MAY differ in whether the configuration templates themselves appear in <intended>, independent of whether the templates are applied. Implementations MAY also support conditional visibility, where templates appear in <intended> only when they are applied by at least one node via the "apply-templates" annotation. Regardless of the approach chosen, implementations MUST ensure the behavior is consistent and deterministic, and SHOULD be documented to allow clients to rely on predictable operational behaviors.

Security Considerations TODO Security

IANA Considerations

The "IETF XML" Registry This document registers the following URI in the "IETF XML Registry" .

The "YANG Module Names" Registry This document registers the following YANG module in the "YANG Module Names" registry .

References Normative References Datastores are a fundamental concept binding the data models written in the YANG data modeling language to network management protocols such as the Network Configuration Protocol (NETCONF) and RESTCONF. This document defines an architectural framework for datastores based on the experience gained with the initial simpler model, addressing requirements that were not well supported in the initial model. This document updates RFC 7950. The Network Configuration Protocol (NETCONF) defined in this document provides mechanisms to install, manipulate, and delete the configuration of network devices. It uses an Extensible Markup Language (XML)-based data encoding for the configuration data as well as the protocol messages. The NETCONF protocol operations are realized as remote procedure calls (RPCs). This document obsoletes RFC 4741. [STANDARDS-TRACK] This document describes an HTTP-based protocol that provides a programmatic interface for accessing data defined in YANG, using the datastore concepts defined in the Network Configuration Protocol (NETCONF). In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings. YANG is a data modeling language used to model configuration data, state data, Remote Procedure Calls, and notifications for network management protocols. This document describes the syntax and semantics of version 1.1 of the YANG language. YANG version 1.1 is a maintenance release of the YANG language, addressing ambiguities and defects in the original specification. There are a small number of backward incompatibilities from YANG version 1. This document also specifies the YANG mappings to the Network Configuration Protocol (NETCONF). This document specifies I-Regexp, a flavor of regular expression that is limited in scope with the goal of interoperation across many different regular expression libraries. This document describes an IANA maintained registry for IETF standards which use Extensible Markup Language (XML) related items such as Namespaces, Document Type Declarations (DTDs), Schemas, and Resource Description Framework (RDF) Schemas. YANG is a data modeling language used to model configuration and state data manipulated by the Network Configuration Protocol (NETCONF), NETCONF remote procedure calls, and NETCONF notifications. [STANDARDS-TRACK] Informative References This document captures the current syntax used in YANG module tree diagrams. The purpose of this document is to provide a single location for this definition. This syntax may be updated from time to time based on the evolution of the YANG language. Huawei Huawei The Network Management Datastore Architecture (NMDA) in RFC 8342 defines several configuration datastores holding configuration. The contents of these configuration datastores are controlled by clients. This document introduces the concept of system configuration datastore holding configuration controlled by the system on which a server is running. The system configuration can be referenced (e.g., leafref) by configuration explicitly created by clients. This document updates RFC 8342. This document defines a YANG extension that allows for defining metadata annotations in YANG modules. The document also specifies XML and JSON encoding of annotations and other rules for annotating instances of YANG data nodes. Swisscom Swisscom This document describes a method to use YANG RFC 8525 and standard YANG validation rules in RFC 7950 to validate YANG data nodes that are children of an "anydata" data node.

Requirement Implementation Status Note to the RFC Editor: Please remove this section before publication. This appendix aims to track which of identified requirements have been addressed in the current version, and, where applicable, how they are fulfilled by the proposed mechanism. These requirements are sourced from https://github.com/netmod-wg/template-reqs/issues, specifically those that 1) have already been discussed during interims and shown consensus, 2) present split opinions and thus require further discussion, or 3) are new technical requirements added by folks after interim discussion.

Requirement	Fulfilled	Requirement Description
R1: Allowed Multiple templates to be applied at a single node	Y	see
R2: Templates must work with any YANG module	Y	see
R3: Templates must be validated when defined	N	Per discussion at IETF 125, the consensus seems to be to make a best effort to validate the template at definition time, and that the current text is sufficient
R4: Local-config overrides template-config	Y	see
R5: Living template: modified template data gets expanded for all consumers	Y	see
R6: Support basic programmatic elements (loops, conditions) in templates	N	Seems to add some complexity
R7: Allow a server to constrain which nodes can be templates consumer	Y	See
R8: Configuration with both expanded and unexpanded templates is able to be returned	Y	see and
R9: <running> contains the unexpanded template	Y	see , also stated explicitly in
R10: <intended> contains the expanded template	Y	see , also stated explicitly in
R11: Enables off-box template expansion of <running>	Y	see
R12: Support limited regex in templates	Y	see
R13: Have a precedence rule when multiple templates are applied at a single node	Y	See
R14: The innermost template takes precedence when templates are applied at multiple ancestor nodes	Y	See
R15: Enable non-NMDA servers to return the expanded data	N	have a dedicated section () for this, but empty now
Not discussed: R16: exclude templates applied at ancestor nodes	N	Seems to add some complexity, needs further discussion
Not discussed: R17: Annotations to determine which template a node was applied from	N	Needs further discussion

Acknowledgments The author would like to thank Lou Berger, Jason Sterne, Kent Watsen, and Robert Wilton for comments and contributions made during interim meetings. The author would like to acknowledge the following drafts and presenters for kick-starting discussions on Yang Templates:

• draft-ma-netmod-yang-config-template-00
• draft-rajaram-netmod-yang-cfg-template-framework-00
• draft-wills-netmod-yang-templates-00
• Jan Lindblad

Contributors Cisco

United Kingdom rowills@cisco.com

Huawei

101 Software Avenue, Yuhua District Jiangsu 210012 China bill.wu@huawei.com