CATS Service Contact Instance Functional Implementation

1.1. Scope and Relationship to Other CATS Documents

This document specifies the functional behavior of the SCI as a CATS component. The scope is deliberately limited in two ways. First, the normative requirements concern the observable behavior of the SCI - the metrics it reports, the semantics of those metrics, the health state machine that drives metric adjustment, and the update policies that control reporting frequency. Second, how the SCI is internally structured (e.g., whether it is implemented as a load balancer, a gateway, or an application-level function) is a local matter; Section 3 provides an illustrative component decomposition that is informative in nature.¶

The relationships to other CATS documents are as follows:¶

• [I-D.ietf-cats-framework] defines the CATS components and their interactions, including general implementation considerations on using CATS metrics (Section 5.4 of that document). This document provides the detailed SCI-side behavior that the framework leaves open.¶

• [I-D.ietf-cats-metric-definition-11] defines the CATS metric taxonomy (Level 0/1/2), the CATS metric field template, and the "CATS Metrics" registry. This document uses the service-oriented metrics defined in [I-D.zhangb-cats-service-metrics-op] (registered in that registry) and specifies how an SCI produces and reports them; it does not define new metric categories.¶

• [I-D.zhangb-cats-service-metrics-op] defines the service-oriented metrics (Global Available Slots, Computing Time, Price, Reputation, Security Level) and the C-PS side joint selection workflow. This document specifies the SCI-side execution: how these metrics are derived and maintained at the service site, and how they are reported to the C-SMA.¶

• [I-D.ietf-cats-oam-fw] defines the OAM framework and requirements for CATS. The health monitoring and failure-detection behavior specified in Section 5 of this document is a component-level behavior that complements, and is consistent with, the OAM requirements; the actual OAM mechanisms, measurement frameworks, and management interfaces are out of scope here.¶

• [I-D.yl-cats-data-model] defines a YANG data model for the management of CATS. The report fields specified in Section 7.3 are semantic requirements; their mapping to configuration and management objects should be aligned with that data model where applicable.¶

• [I-D.yxl-cats-protocols-applicability] discusses the applicability of existing protocols for CATS. The choice of transport for metric reporting (Section 7) should follow that document rather than being re-specified here.¶

The framework states that how a service provider structures its services remains out of the scope of CATS. This document does not standardize the internal structure of a service site; it standardizes the behavior of the SCI that is observable by other CATS components, in particular the C-SMA and, indirectly, the C-PS.¶

1.2. Requirements Language

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶

3.1. SCI Position in CATS Framework

The SCI sits at the boundary between the CATS network and the service site. Its relationships with other CATS components are:¶

• The SCI receives traffic from the Egress CATS-Forwarder.¶

• The SCI reports metrics to the C-SMA, which may be co-located with or adjacent to the SCI.¶

• The C-SMA advertises the SCI's metrics (along with the CSCI-ID) to the C-PS.¶

• The C-PS uses these metrics to make traffic steering decisions.¶

• The SCI does not directly interact with the C-PS or C-NMA; all control-plane communication goes through the C-SMA.¶

The SCI is transparent to the client. The client sees only the CSCI-ID (e.g., an IP address and port) and is unaware of the internal service instances managed by the SCI.¶

4.1. Metric Collection Scope

Resource Metrics:

Raw computing resource utilization. Examples include: CPU utilization (%), Memory utilization (%), GPU utilization (%) and GPU memory usage, NPU/TPU utilization (if applicable), Disk I/O and network I/O rates.¶

Performance Metrics:

Service-level performance indicators. Examples include: Request queue depth, Average response time, Requests per second (throughput), Error rate (5xx errors, timeout rate).¶

Status Metrics:

Operational state indicators. Examples include: Instance health (up/down), Load average, Number of active connections/sessions, Custom application-level status.¶

The MC collects these metrics at a configurable sampling interval (e.g., every 5-10 seconds). The specific collection mechanism (e.g., Prometheus scraping, SNMP, gRPC, HTTP health endpoints) is deployment-specific and outside the scope of this document.¶

4.2. Collection Methods

The MC SHOULD support multiple collection methods to accommodate different service instance types:¶

Pull-based:

The MC periodically queries each service instance via a standardized metrics endpoint (e.g., Prometheus /metrics, HTTP REST API, SNMP). This is suitable for instances that expose metrics via well-known interfaces.¶

Push-based:

Service instances push metrics to the MC via a message queue or streaming protocol (e.g., gRPC streaming, MQTT, Kafka). This is suitable for high-frequency updates or event-driven metrics.¶

Agent-based:

A lightweight agent runs alongside each service instance and reports metrics to the MC. This is suitable for environments where instances cannot be modified to expose endpoints.¶

The MC MUST support at least one of these methods. In mixed deployments, the MC MAY use different methods for different service instances.¶

4.3. Aggregation and Derivation

The Metric Aggregator (MA) combines instance-level metrics into the service-oriented metrics defined in [I-D.zhangb-cats-service-metrics-op], which are meaningful for CATS traffic steering. The definitions and semantics of these metrics are normative in [I-D.zhangb-cats-service-metrics-op]; this section specifies the SCI-side execution details for deriving and maintaining them. The key aggregated metrics are:¶

Global Available Slots (GAS):

The MA calculates the total GAS for the SCI by summing the available capacity of all healthy service instances. For each instance, the available capacity is derived from: the instance's maximum concurrent request capacity (the initial GAS value, which can be calculated based on resource allocation and the service reference information defined in [I-D.zhangb-cats-service-metrics-op]), the instance's current active session count (from the Session Manager), and the instance's health status (from the Health Monitor). Unhealthy instances contribute 0 to GAS.¶

GAS = SUM_over_instances(max_capacity_i - active_sessions_i) for all healthy instances i¶

The MA MAY apply a local policy factor (e.g., a safety margin of 80%, as an example configuration) to prevent over-subscription.¶

Computing Time:

The MA estimates the Computing Time for the SCI based on the observed response times of service instances. This can be computed as: the weighted average of instance response times, weighted by instance load; the median or percentile (e.g., p95) of instance response times to account for outliers; or a dynamically adjusted estimate based on current load and historical trends. The MA also reports the min/max computing time and the associated input token counts for reference.¶

Optional Metrics:

The MA MAY also derive optional service attributes such as Price, Reputation, and Security Level as defined in [I-D.zhangb-cats-service-metrics-op].¶

The derivation algorithm is a local matter and is not standardized by this document. However, the MA MUST ensure that the reported metrics are consistent and comparable across updates, and that they conform to the semantics and units defined in [I-D.zhangb-cats-service-metrics-op].¶

5.1. Health Check Types

Liveness Check:

Verifies that the service instance process is running and responsive. This is typically done via a simple TCP connection or HTTP GET to a /health endpoint. Failure indicates the instance is down.¶

Readiness Check:

Verifies that the service instance is ready to accept new requests. This may check: whether the instance has finished initialization, whether critical dependencies are available, and whether the instance is not in a maintenance mode.¶

Performance Check:

Verifies that the service instance is performing within acceptable bounds. This may check: response time against a threshold, error rate against a threshold, and resource utilization (e.g., CPU > 90% for 30 seconds).¶

The HM SHOULD perform these checks at regular intervals (e.g., every 5-10 seconds for liveness, every 30 seconds for readiness and performance). The intervals and thresholds SHOULD be configurable.¶

5.2. Failure Detection and Recovery

The HM classifies each service instance into one of the following health states:¶

• HEALTHY: The instance is fully operational and accepting requests.¶

• DEGRADED: The instance is operational but experiencing performance issues (e.g., high latency, high error rate). New requests MAY be steered away, but existing sessions are maintained.¶

• UNHEALTHY: The instance is not operational or not ready. No new requests are dispatched to this instance. Existing sessions MAY be migrated or terminated based on policy.¶

• UNKNOWN: The HM cannot determine the instance's status (e.g., network partition). The instance is treated as UNHEALTHY until status is confirmed.¶

Figure 2 shows the health state machine and the transitions between states:¶

   +------------+
   |  UNKNOWN   |
   +-----+------+
         | status confirmed (treated as UNHEALTHY meanwhile)
         v
+--------+  fail xN   +----------+  fail xN   +-----------+
| HEALTHY| ---------> | DEGRADED | ---------> | UNHEALTHY |
|        | <--------- |          | <--------- |           |
+--------+  pass xM   +----------+  pass xM   +-----------+
    ^          |            ^          |            ^
    |          |            |          |            |
    +----------+------------+----------+------------+
       recovery (pass xM) at any degraded/unhealthy state

State transitions trigger the following actions:¶

• HEALTHY -> DEGRADED: The HM notifies the MA to reduce the instance's contribution to GAS. The DP reduces or stops sending new requests to the instance.¶

• DEGRADED -> UNHEALTHY: The HM notifies the MA to set the instance's contribution to GAS to 0. The DP stops sending new requests. The SM initiates session migration or graceful termination for affected sessions.¶

• UNHEALTHY -> HEALTHY: The HM notifies the MA to restore the instance's contribution to GAS. The DP resumes sending requests.¶

The HM MUST implement a hysteresis mechanism (e.g., require N consecutive failed checks before marking UNHEALTHY, and M consecutive passed checks before marking HEALTHY; N and M are example configuration parameters) to avoid flapping.¶

5.3. Metric Adjustment on Health Changes

When the HM detects a health state change, the MA MUST adjust the aggregated metrics accordingly:¶

• When an instance becomes DEGRADED, the MA MAY reduce its max_capacity by a configured degradation factor (e.g., 50%) or set it to 0 based on local policy.¶

• When an instance becomes UNHEALTHY, the MA MUST set its contribution to GAS to 0.¶

• When an instance recovers to HEALTHY, the MA MUST restore its contribution to GAS based on current load.¶

• The Computing Time estimate MUST be recalculated to exclude UNHEALTHY instances and weight DEGRADED instances lower.¶

These adjustments are reflected in the next metric report to the C-SMA. The MA SHOULD batch rapid health changes to avoid excessive updates.¶

6.1. Dispatch Decision Logic

1. Affinity Requirements: If the request belongs to an existing session with affinity, the DP MUST dispatch to the same service instance (if healthy).¶

2. Health Status: The DP MUST NOT dispatch to UNHEALTHY instances. It SHOULD avoid DEGRADED instances unless no HEALTHY instances are available.¶

3. Load Balancing Policy: The DP selects among HEALTHY instances using a local load balancing algorithm. Supported algorithms include round-robin, least-connections, weighted response time, resource-aware (lowest CPU/memory/GPU utilization), and slot-based (most available slots, i.e., max_capacity - active_sessions). The choice of algorithm is a local matter.¶

4. Local Policy: The DP MAY apply additional policies such as price optimization, security level requirements, or instance preference.¶

The DP MUST handle the case where no HEALTHY instances are available. In this case, it MAY:¶

• Return an error to the client (e.g., HTTP 503 Service Unavailable).¶

• Queue the request and retry after a timeout.¶

• Dispatch to a DEGRADED instance as a last resort.¶

6.2. Affinity Handling

The Session Manager (SM) maintains affinity bindings between client flows and service instances. Affinity is identified by a flow key (e.g., 5-tuple: source IP, destination IP, source port, destination port, protocol).¶

When a new request arrives:¶

• The SM checks if the flow key has an existing binding.¶

• If yes, and the bound instance is HEALTHY, the DP dispatches to that instance.¶

• If yes, but the bound instance is UNHEALTHY, the SM removes the binding and the DP selects a new instance.¶

• If no binding exists, the DP selects an instance and the SM creates a new binding.¶

Affinity bindings have a configurable timeout. After the timeout expires with no activity, the SM removes the binding.¶

The SM MUST support affinity at the flow level. It MAY also support affinity at the session level (e.g., for HTTP sessions identified by cookies or session IDs).¶

6.3. Session Lifecycle Management

The SM tracks the lifecycle of each session:¶

Allocation:

When a request is dispatched, the SM increments the active session count for the selected instance and records the flow binding.¶

Renewal:

For long-lived sessions, the SM may refresh the binding timeout on each packet or keepalive.¶

Release:

When the session ends (e.g., TCP FIN/RST, timeout, explicit logout), the SM decrements the active session count and removes the binding.¶

The SM notifies the MA of session allocation and release events so that GAS can be updated. However, per-session changes do not necessarily trigger immediate reports to the C-SMA; the MA applies local aggregation and threshold policies.¶

7.1. Reporting Interface

The RI SHOULD use a reliable transport (e.g., TCP, QUIC, or HTTP/2) to ensure metric delivery. The specific protocol is deployment-specific.¶

In centralized deployments (e.g., SDN controller), the RI MAY use a RESTful API (e.g., RESTCONF [RFC8040]) or gRPC to push metrics to the C-SMA.¶

In distributed deployments, the RI MAY use a routing protocol extension (e.g., BGP-LS [RFC8571], GRASP [RFC8990]) or a dedicated CATS metric distribution protocol. The applicability of these mechanisms is discussed in [I-D.yxl-cats-protocols-applicability]; this document does not select among them.¶

7.2. Update Policies and Thresholds

The RI applies the following policies to control update frequency. These policies directly address the question of the appropriate frequency and scope of metric distribution, which the CATS framework leaves open:¶

Periodic Heartbeat:

A full report is sent at a fixed interval (e.g., every 60 seconds, as an example configuration) to maintain soft state and prevent stale metrics.¶

Threshold-based Trigger:

A delta report is sent when any metric crosses a configured threshold. Examples include: GAS changes by more than 10% or an absolute value of 50, Computing Time deviates by more than 20%, or Health status changes for any instance. The numerical values above are examples; the thresholds MUST be configurable.¶

Event-based Trigger:

A delta report is sent immediately upon critical events: all instances become UNHEALTHY (GAS = 0), an instance recovers from UNHEALTHY to HEALTHY, or security-related events (e.g., detected attack).¶

Rate Limiting:

The RI MUST implement rate limiting to prevent excessive updates during rapid fluctuations (e.g., during a thundering herd or DDoS attack).¶

The specific thresholds and intervals SHOULD be configurable via the CATS Management Plane, and their alignment with the CATS data model [I-D.yl-cats-data-model] SHOULD be provided.¶

7.3. Report Message Format

The report message contains the following fields. The semantics of these fields are normative; their encoding and wire format depend on the chosen transport and are out of scope of this document:¶

The encoding details, including field lengths and wire format, are TBD and depend on the chosen transport protocol, following the applicability analysis in [I-D.yxl-cats-protocols-applicability].¶

8.1. Client-Facing Interface

The SCI MUST support the following on the client-facing interface:¶

• Accept incoming connections/requests from the Egress CATS-Forwarder.¶

• Maintain transport-layer state (e.g., TCP connections) for the duration of the session.¶

• Support the service protocol (e.g., HTTP, gRPC, RTP) required by the CS-ID.¶

The SCI MUST NOT expose internal service instance details (e.g., SI-IDs, internal IP addresses) to the client.¶

8.2. Egress CATS-Forwarder Interface

The SCI communicates with the Egress CATS-Forwarder via the underlay network. The Egress CATS-Forwarder is responsible for:¶

• Decapsulating CATS overlay traffic and forwarding it to the SCI's CSCI-ID.¶

• Receiving responses from the SCI and encapsulating them for return to the Ingress CATS-Forwarder.¶

The SCI does not need to be CATS-aware; it operates as a standard service endpoint from the network perspective. However, the SCI MAY support CATS-specific signaling (e.g., for affinity or session state synchronization) if defined by future documents.¶