Automation/DevOps

Source of Truth

• NetBox / Nautobot → intended state and inventory.
• Model sites, devices, interfaces, prefixes, and circuit relationships.
• Define ownership and authoritative sources per field.
• Reconcile discovered state; flag conflicts before updating records.
• Validate completeness before generating device configurations.

Configuration Engineering

• Jinja2 → reusable, platform-specific configuration templates.
• YAML / JSON → structured inputs, independently validated.
• Pydantic / JSON Schema → enforce data contracts.
• Separate site intent from vendor implementation details.
• Render deterministic artifacts; review configuration diffs.

Device Automation

• Ansible → playbooks, resource modules, configuration workflows.
• Nornir → Python inventory and concurrent execution.
• Netmiko / Scrapli → CLI connectivity and command execution.
• NAPALM → normalized getters and supported configuration operations.
• NETCONF / RESTCONF / gNMI → model-driven interfaces.

Infrastructure as Code

• Terraform / OpenTofu → declarative resource provisioning.
• Provider coverage determines supported resources and behavior.
• Review plans before applying infrastructure changes.
• Protect state; coordinate locking and concurrent execution.
• Define resource ownership across controllers and automation tools.

Testing & Validation

• TextFSM / TTP → structured data from CLI output.
• pyATS / Genie → operational checks and state comparisons.
• Batfish → supported configuration and reachability analysis.
• Containerlab / netlab / CML → reproducible network labs.
• pytest → test rendering, business rules, and integrations.

Delivery & Orchestration

• Git → versioned intent, templates, and automation code.
• GitHub Actions / GitLab CI → validation pipelines.
• AAP / Itential / StackStorm → coordinated automation workflows.
• Canary deployments → staged rollout with explicit stop conditions.
• Prechecks → change → postchecks → tested recovery path.

Observability & Reconciliation

• gNMIc / Telegraf → collect supported streaming telemetry.
• Prometheus / Grafana → metrics, dashboards, and alerting.
• SuzieQ → query operational network state.
• Oxidized / Unimus → configuration history and backups.
• Detect drift; classify exceptions before remediation.

AI & Execution Controls

• Codex / Claude Code / Copilot → draft automation code.
• MCP → expose scoped tools and network context.
• Ground recommendations in verified data and documentation.
• Require deterministic validation before executing generated changes.
• Enforce least privilege, secret management, and audit trails.

Repository & Code Design

• Separate intent data, templates, execution, and tests.
• Define data contracts for inventory and policy inputs.
• Package reusable logic; avoid duplicated device workflows.
• Assign code owners to shared automation components.
• Version schemas alongside their migration requirements.

Development Environments

• Containers / devcontainers → reproducible toolchains.
• Pin dependencies; maintain reviewed lockfiles.
• Match local tooling with CI runner environments.
• Externalize environment settings; exclude embedded credentials.
• Containerlab / CML → repeatable integration testbeds.

Collaboration & Review

• Short-lived branches → focused, reviewable changes.
• Pull requests → document intent and blast radius.
• Review rendered configurations alongside source changes.
• Protect branches; require relevant checks and reviewers.
• Record exceptions with owners and expiration dates.

Testing Strategy

• Unit tests → rendering logic and input validation.
• Integration tests → APIs, drivers, and controller interactions.
• Lab tests → routing, policy, and failure behavior.
• Pre/post checks → verify operational invariants.
• Test idempotency and partial-failure handling explicitly.

Delivery Pipelines

• GitHub Actions / GitLab CI → orchestrate checks.
• Lint → validate → render → test → package.
• Promote immutable artifacts tied to a commit.
• Separate deployment permissions across lab and production.
• Reject stale plans when inputs or state change.

Secrets & Execution Security

• Vault / secret managers → runtime credential injection.
• Prefer short-lived credentials where platforms support them.
• Scope runner connectivity and service-account privileges.
• Isolate untrusted code from production secrets.
• Audit executions; redact sensitive command output.

Release & Recovery

• Release manifests → record targets, artifacts, and versions.
• Canary changes → validate before expanding deployment.
• Bound concurrency to limit simultaneous failures.
• Define stop conditions and tested recovery procedures.
• Distinguish configuration rollback from service restoration.

Operational Ownership

• Assign maintainers, escalation paths, and support expectations.
• Monitor job failures, duration, and queue delays.
• Link execution evidence to changes and incidents.
• Maintain runbooks for retries and interrupted workflows.
• Feed incident findings into regression tests.