Page MenuHomePhabricator

Automatically run Capirca Netbox script regularly
Open, MediumPublic

Description

AIUI we have a regular job that sends a diff between the expected Homer config and the live running config to Netops. However as the Capirca Netbox script is only ran manually, so changes to the generated firewall config can go unnoticed for a while. For example on T361537 I also had to deploy unrelated changes that replaced the apt hosts and added a contint one. Could we run the Capirca Netbox script regularly on a timer to have these pending changes noticed more regularly?

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

Thanks for the task. I was thinking of either a timer or using Netbox's hooks to only run it when relevant changes are done.

This however always brings the question of where the pending changes should wait. Running the script automatically will result in changes pending to be pushed to network devices.

Running it on a timer is also not possible until T358339: Netbox: capirca.getHosts script runs into timeout is done.