DENOG18

Existing automation solutions are usually monolithic and require you to migrate all of your existing infrastructure at once to the automation. But I wanted to continue using our existing sources of truth and wanted to introduce automation in our network step by step and not in one big step.

Additionally, there is the security perspective: do you really want to grant an automation solution that you don't fully understand internally unrestricted access to all of your routers?

The solution: modular network automation from scratch: write a module for any aspect you want to automate in your network. Want to automate your peerings with Peering-Manager? Write a module for it. Want to automate your base router interfaces with NetBox? Write a module for it.

The modules itself are isolated from each other in the configuration by using one config group for each module (basically a separate config tree for each module). This by design eliminates the possibility of collisions between modules and makes consecutive deployments easier by fully replacing the config group on each run. It additionally allows you to minimize the permissions of an automation user to the absolute required minimum by only granting them access to the config group. Furthermore, the use of config groups allows you to override the automation on any given time in the main config tree or even exclude some parts of the main config tree from it.

Although this solution was developed for Nokia SR OS, it can in principle be extended to any platform that is transactional and supports something like config groups.