[doc]: Define in-box gNOI client access model

[hdwhdw]

Why I did it

sonic-buildimage PR 28341 adds a typed Python gNOI client to sonic-py-common. The package and access to the local gNMI/gNOI Unix socket are separate capabilities, so SONiC needs an explicit policy for granting that socket to in-box containers.

How I did it

Added an HLD that documents:

• reproducible generation and distribution of the sonic_grpc System and File modules;
• secure TCP, insecure local TCP, and Unix-domain-socket transports;
• UDS application-authentication bypass, global authorization-policy limits, and privileged-container risk;
• the certificate-absent plaintext loopback path; and
• deny-by-default admission criteria and tests for future in-box consumers.

By default, the gnmi server owner has read-write access to /var/run/gnmi; swss, syncd, and pmon have no /var/run/gnmi mount.

Verification

• npx --yes markdownlint-cli@0.45.0 doc/mgmt/gnmi/gnoi_client_access_hld.md
• draw.io structural validation of the checked-in .drawio source: 0 errors, 0 warnings
• SVG regenerated from the checked-in .drawio source and visually inspected for overlaps, crossings, and clipped labels

Dependencies

• Documents [sonic-grpc]: Add gNOI client and generated stubs to sonic-py-common sonic-buildimage#28341.
• ADO Task 39058660.

[mssonicbld]

/azp run

[azure-pipelines]

No pipelines are associated with this pull request.

[Copilot]

Pull request overview

Adds a new management-plane HLD to define the SONiC in-box gNOI Python client packaging boundary and a deny-by-default policy for granting containers access to the local gNMI/gNOI Unix-domain socket, along with a supporting access-model diagram.

Changes:

• Documented the sonic_grpc (gNOI client) packaging model, transport options (secure TCP, insecure TCP, UDS), and security implications of UDS access.
• Defined deny-by-default UDS admission criteria and suggested test expectations for future in-box consumers.
• Added a draw.io source diagram for the package and access-policy model.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.

File	Description
doc/mgmt/gnmi/gnoi_client_access_hld.md	New HLD describing the in-box gNOI client package boundary and UDS access policy/security model.
doc/mgmt/gnmi/images/gnoi_client_access.drawio	New diagram source illustrating package generation/distribution and UDS admission/access paths.

[hdwhdw]

/copilot review