Network Automation with Ansible

• This course focuses on automating networks with Ansible, emphasizing practical application and production-ready solutions.
• The course covers designing, implementing, operating, and troubleshooting automation solutions in complex networks.
• Key principles include Ansible-based network automation, infrastructure as code, design options (CLI and API-based), Python coding for Ansible customization, and bulletproofing playbooks.
• Prior knowledge of Python, basic networking (CCNA level), and an introduction to Layer 3 VPNs are recommended.

Network Automation Differences

• Ansible is typically used in systems administration, but involves some specific differences in network automation.
• Most network devices lack native Python support, unlike Linux-based systems.
• Ansible delegates module execution to managed devices with Python.
• Without Python, the module logic runs on the Ansible control machine.
• Network devices commonly use different connectivity methods beyond SSH.

MPLS Network Overview

• Multiprotocol Label Switching (MPLS) enables multitenancy across geographically dispersed sites using VPNs.
• Globomantics, a network service provider, automates customer provisioning using Ansible.
• MPLS VPNs use Border Gateway Protocol (BGP) to exchange IP routes.
• Route targets (RTs) are numeric tags applied to BGP routes, determining VPN membership.
• Ansible primarily manages R1 and R2 routers.

Ansible Core Components

• The Ansible configuration file defines global runtime settings like inventory file location and logging.
• The Ansible inventory lists managed hosts and groups.
• Variable files store group and host-specific data, significantly used for configuration settings.
• Playbooks are the mainstay of Ansible, containing a list of plays.
• Plays include tasks, which are specific actions to be accomplished on the target hosts.
• The configuration file contains global operations while plays select groups from the inventory based on high level global operations that affect the entire playbook.
• Group and host variables are consumed at the task level.
• ansible_network_os specifies the type of network device.
• ansible_user sets the login username.
• ansible_password sets the login password.

Ansible Preparation Steps

• Install Ansible and create a directory structure with basic component files.
• Python virtual environment with Python version 3.6.7 and Ansible version 2.7.7 is used.
• The default config file is in /etc/ansible/ansible.cfg, and playbook-level config files are recommended for portability.
• Common defaults include disabling fact gathering (gathering: false), identifying the inventory file (inventory = inv.yml), and disabling retry files (retry_files_enabled = False).
• The YAML inventory format is hierarchical, starting with the all group containing subgroups.
• The group_vars folder automatically inherits variables at the group level.

First Ansible Playbook

• A playbook lists plays, defining the play data and scope.
• Tasks include names, modules, and options.
• ios_command module runs exec-level commands on Cisco IOS devices.
• The register task option stores the result.
• The debug module prints output.
• Ansible prints out the play and task names in the console log.

Playbook Logging Challenge

• Output data should be represented as simple text, and configuration snippets backed up to files.
• ansible-doc feature provides documentation of Ansible
• Examine stdout, a list of strings, one per command issued.
• JSON structure uses dot notation (e.g., cli_result.stdout) or Python notation (e.g., cli_result['stdout']).
• The file module creates directories.
• run_once accomplishes folder creation only once instead of N times.
• The copy module writes content from memory to a file on the control machine.
• inventory_hostname variable reflects the hostname of each host.

Infrastructure as Code (IaC)

• Traditional network operators often manually determine the current state of devices and their configuration.
• IaC allows operators to declare a desired state.
• IaC solutions offer varying levels of abstraction for different environments.
• Version control systems track changes made by all users with difference checking capabilities.

IaC Components

• Idempotence means an operation can be executed multiple times without unnecessary changes after the initial setup.
• Variables illustrate route target management using YAML data.
• Ansible workflows can be designed generically with custom templates per device type.
• Version control enables reverting to previous states, checking logs, and enhancing troubleshooting and postmortem processes.
• Continuous Integration/Continuous Deployment (CI/CD) automates testing and deployment.

Business Benefits of IaC

• Quality is improved by reducing variability.
• Time is reallocated from mundane tasks to network design and planning.
• Automation frameworks like Ansible are low or no cost.
• Automation for a US Federal Government customer reduced defect rates, shortened lead times, and saved approximately $2 million annually.

Deploying "ios_config" for CLI-based IAC

• The host_vars folder defines specific variables for individual hosts.
• R1 and R2 have VRFs with route import and export lists.
• Jinja2 templates allow loops for iteration and if/else statements for conditional logic.
• The ios_config module makes changes to the router
• The src option specifies the Jinja2 template file path.
• The save_when: changed option copies the running-config to startup-config if changes are required.
• The notify option calls a handler when changes occur.
• Handlers listen for a specific signal (e.g., config_changed) and execute tasks conditionally
• Handlers are used to print output only if there was a change.
• Use ansible-doc to learn more about file and copy modules

Deploying "cli_config" for CLI-based IAC

• Uses a more platform-agnostic approach with a mixed IOS and IOS XR network.
• The inventory file includes additional hierarchy with ios_routers and iosxr_routers subgroups.
• Subgroups allow defining OS-specific variables in the group_vars folder, such as ansible_network_os.
• Templates are device-based (ios_vpn.j2 and iosxr_vpn.j2).
• Module cli_config handles any network CLI via the ansible_network_os field.
• set_fact module performs variable assignment.
• The cli_config module uses lookup to render the template manually.
• The handler is notified if a change occurs, and results are stored in cli_result.
• A bug exists in cli_config: does not properly save IOS configurations.

Deploying "ios_vrf" for CLI-based IAC

• Manages VPN membership configuration by just updating route targets in the network based on declarative statement without any templates.
• The ios_vrf module passes a list of dictionaries.
• Naming variables consistently with module suboptions helps stay organized.

Comparing CLI-based Infrastructure as Code Solutions

• Generic solutions rely on modules like ios_config or cli_config.
• Specific modules like ios_vrf have a limited set of features.
• Generic solutions use Jinja2 templates, while specific solutions ingest structured data directly.

The Big Problem

• Ansible may have difficulty removing stale configurations when using CLI-based Infrastructure as Code solutions.
• Removing old configuration is challenging as Ansible does not want to make assumptions.
• Basic IaC solutions are great at remediating missing route targets if any exist.

Custom Filters

• Ansible is easily extendable using Python with custom filters, modules, and plugins.
• Filters are Python functions that complement existing Ansible constructs.
• Filters enable running arbitrary Python code in playbooks.
• YAML-based DSL can be inflexible.
• Python functions often reduce complexity
• Ansible plugins need to be included in the config file.
• The FilterModule class in Python is consumed by Ansible.
• The filters function returns a dictionary mapping Ansible filter names to Python function names.

Simplest Possible Custom Filter

• Filter extracts the BGP Autonomous System Number from the route target using Python.
• Specify custom filters file path in the config file.
• The FilterModule class creates a method called filters.
• A statichmethod decorator is used since Ansible doesn’t need to instantiate this class.
• Invoke custom filter using the pipe syntax.

Parser and Regex Basics

• Python filter transforms the VRF definition text blob into a JSON structure.
• Regular expressions (regex) match input strings against generic patterns for extracting data fields.
• Named capture groups identify data.
• Regex101.com support checking regex against sample text inputs.

Custom Parser for VRF Information Demo

• The RE library is used for regular expressions.
• A filter takes in a single string (text), which should be a delimited blob.
• The big blob gets broken into smaller chunks, one per VRF.
• A Python list comprehension combined with string splitting is used .
• Iterate through each VRF stanza individually to search the VRF stanza for the VRF name, and store it in dictionary form.

Bullet-proofing Code with Unit Tests

• Unit tests pass static data to individual code segments (custom filters).
• Test the results by the use of static input.
• Detect future changes to detect breaking changes without impacting production

Using Ansible for Filter Unit Testing

• Use Ansible to test Ansible.
• Playbook loads test cases defined in the task's directory.
• One task file is created for each filter, and each task file contains individual test cases.
• The play runs on localhost only and uses connection local.
• The find module grabs YAML files that begin with test_ in the tasks directory.
• The map filter grabs all path attributes from each dictionary and assembles them into a simple list of strings.
• Walk the list of file names pulling each one into the playbook using the include_tasks directive.
• The assert module asserts provided list of conditions are all true.

Set Theory Basics

• A set is a mathematical term representing a collection of unique elements.
• Sets are unsorted, unsorted collections of unique elements.
• Operations include union, intersection, and difference.
• Set difference answers the set difference: which one is in one set, but is NOT in the other set.

Set Operations in Python

• want represents the desired state (YAML lists).
• have represents the current route target configuration.
• want - have identifies route targets to add (present in desired state, not in current state).
• have - want identifies route targets to remove (currently configured, not in desired state).

Custom Filter for Route-targeting Presence Determination

• Filter takes two arguments: list of VRFs from intended state and dictionary of VRFs from running configuration.
• Function returns a list of VRFs.
• Uses get function that works with a list indexes, returns NOne if matching value found,.
• Adds or deletes based on matching filter conditions
• Set intersection not required because its a non change

Unit Tests For the Custom Filter

• Use static data to mock up YAML-formatted data.
• Mock variables such as run-vrf-dict to compare current stated vs intended state
• Assert individual data fields are correct.

Fitting the Pieces Together

• The desired state is stored in per-host variable files using YAML format.
• The playbook captures the current VRF configuration.
• Tasks: parse the lists of current import and export route targets; Compare to desired configurations and then Apply any route target additions or removals.
• Jinja loops are nested for each set of commands
• Commands loop to add the necessary data

The Whole Solution in Action

• A Jinja2 template applies config changes.
• Four inner loops add and delete route target import/export.
• grep for seeing a high‑level view of a large Ansible playbook.
• Steps: grab the VRF config, parse it, perform set difference, apply changes, and display changes if they occurred.
• A key component is rt_diff filter
• Use desired state route target lists via a script, run the playbook again, and the infrastructure updates appropriately; no more manual changes directly on devices.

Ansible Roles

• An Ansible Role encapsulates Ansible components into a self-contained package for reuse.
• Each Ansible Role will include unit tests for code
• Roles are available via Ansbile Galaxy
• Roles assist in scaling the Ansible architecture
• Helps maximizes code reuse

Ansible Galaxy Refresher

• ansible-galaxy is a shell command available to create or interfact with files from Ansible
• Use ansible-galaxy list command to enumate installed Ansible Roles
• Use ansible-galaxy search command to to search the Ansible-galaxy website
• Use the ansible-galaxy install command to install the modules on to your Ansible distribution
• Ansible's init command builds the directory