Quick placeholder task to not forget about the few resources linked
The tool we use to generate ACLs has been forked and greatly improved under the name Aerleon.
We should use that opportunity to improve the Netbox Capirca script as well.
Change 929330 had a related patch set uploaded (by Ayounsi; author: Ayounsi):
[operations/homer/public@master] Convert ACL policies to YAML for Aerleon
Change 929333 had a related patch set uploaded (by Ayounsi; author: Ayounsi):
[operations/software/homer@master] Replace Capirca with Aerleon
Change 929333 merged by jenkins-bot:
[operations/software/homer@master] Replace Capirca with Aerleon
Change 929330 merged by jenkins-bot:
[operations/homer/public@master] Convert ACL policies to YAML for Aerleon
Change 939325 had a related patch set uploaded (by Ayounsi; author: Ayounsi):
[operations/homer/public@master] Aerleon: workaround regression with includes
Change 939325 merged by jenkins-bot:
[operations/homer/public@master] Aerleon: workaround regression with includes
Found a few "regressions":
WARNING:absl:Term allow_ok_icmp6 will not be rendered, as it has icmpv6 match specified but the ACL is of inet address family. WARNING:absl:Term allow_ok_icmp4 will not be rendered, as it has icmp match specified but the ACL is of inet6 address family. WARNING:absl:Term allow_dhcp_request4 will not be rendered, as it has source address match specified but no source addresses of inet6 address family are present. WARNING:absl:Term allow_dns will not be rendered, as it has source address match specified but no source addresses of inet6 address family are present. WARNING:absl:Term allow_vmhost will not be rendered, as it has source address match specified but no source addresses of inet6 address family are present. WARNING:absl:Term allow_dhcp4 will not be rendered, as it has source address match specified but no source addresses of inet6 address family are present.
Are flooding the logs. Those used to be DEBUG messages so it's mostly aesthetic, I'm discussing with the Aerleon team to know the best path forward, worse case we can bump https://phabricator.wikimedia.org/diffusion/OSHO/browse/master/homer/cli.py$59 to ERROR
Upstream ticket: https://github.com/aerleon/aerleon/issues/324
This one minor too: https://github.com/aerleon/aerleon/issues/323
And the last one: rOHPUf3ae2f3da805: Aerleon: workaround regression with includes also being discussed, but this specific use-case will go away once the knams migration is completed. - https://github.com/aerleon/aerleon/issues/325
Change 945748 had a related patch set uploaded (by Ayounsi; author: Ayounsi):
[operations/software/homer/deploy@master] Update wheels
Change 945748 merged by Ayounsi:
[operations/software/homer/deploy@master] Update wheels
Change 951038 had a related patch set uploaded (by Ayounsi; author: Ayounsi):
[operations/software/homer/deploy@master] Update wheels to pickup Aerleon 1.7.0
Change 951038 merged by Ayounsi:
[operations/software/homer/deploy@master] Update wheels to pickup Aerleon 1.7.0