Containerized software architecture for configuration management on network devices

An apparatus comprising:

• at least one processor;
• network processing hardware that processes data packets to determine how or whether the data packets are to be directed into a network on behalf of the apparatus;
• and
• at least one memory that stores instructions for a primary control plane operable to program a primary data plane that includes the network processing hardware, and a secondary control plane operable to program a secondary data plane, wherein the secondary control plane is a software containerized version of the primary control plane, and the secondary data plane is a software containerized version of the primary data plane, and wherein a first Internet Protocol address assigned to a network interface of the primary data plane differs from a second Internet Protocol address assigned to a virtual interface of the secondary data plane, the first and second Internet Protocol addresses sharing a common subnetwork, wherein the at least one processor is configured to:
• obtain, at the secondary control plane, one or more configuration changes to be made to the apparatus;
• generate test packets by selectively copying the data packets from the primary data plane based on one or more parameters of the data packets matching one or more access lists;
• execute, by the secondary data plane, network processing decisions on the test packets based on the one or more configuration changes;
• intentionally drop the test packets after executing the network processing decisions by the secondary data plane;
• and
• evaluate results of the network processing decisions executed by the secondary data plane on the test packets.

One or more non-transitory computer readable storage media encoded with instructions to be executed by a processor in a network device that includes a primary control plane operable to program a primary data plane that processes data packets obtained at the network device to determine how or whether the data packets are to be directed into a network, and a secondary control plane operable to program a secondary data plane, wherein the secondary control plane is a software containerized version of the primary control plane, and the secondary data plane is a software containerized version of the primary data plane, and wherein a first Internet Protocol address assigned to a network interface of the primary data plane differs from a second Internet Protocol address assigned to a virtual interface of the secondary data plane, the first and second Internet Protocol addresses sharing a common subnetwork, wherein the instructions, when executed by the processor, cause the processor to:

• obtain, at the secondary control plane, one or more configuration changes to be made to the network device;
• generate test packets by selectively copying the data packets from the primary data plane based on one or more parameters of the data packets matching one or more access lists;
• execute, by the secondary data plane, network processing decisions on the test packets based on the one or more configuration changes;
• intentionally drop the test packets after executing the network processing decisions by the secondary data plane;
• and
• evaluate results of the network processing decisions executed by the secondary data plane on the test packets.