netloom-tool 1.11.1

Spec-driven network API CLI for operators, with first-class ClearPass support

 _   _      _   _
| \ | | ___| |_| | ___   ___  _ __ ___
|  \| |/ _ \ __| |/ _ \ / _ \| '_ ` _ \
| |\  |  __/ |_| | (_) | (_) | | | | | |
|_| \_|\___|\__|_|\___/ \___/|_| |_| |_|

A CLI for working with network APIs — easy, consistent, safe, and fast.

About

netloom is a plugin-backed network API CLI for operators and automation engineers. It lets you interact with network APIs through a consistent CLI with a shared command model, context-aware help and tab completion. It keeps server profiles and discovery data organized locally, and supports day-to-day tasks such as list, create, update or delete objects as well as compare and copy configuration between servers.

HPE Aruba ClearPass is a bundled plugin with netloom.

Installation

Install from PyPI:

pip install netloom-tool

Install directly from GitHub:

pip install git+https://github.com/mathias-granlund/netloom

Install the bundled man pages:

netloom-install-manpage
man netloom
man netloom-clearpass

Configuration

Example templates are included as defaults.env.example, profiles.env.example, and credentials.env.example.

For ClearPass, the minimal layout is:

~/.config/netloom/config.env
~/.config/netloom/plugins/clearpass/defaults.env
~/.config/netloom/plugins/clearpass/profiles/<profile>.env
~/.config/netloom/plugins/clearpass/credentials/<profile>.env

Required profile connection settings in profiles/<profile>.env:

NETLOOM_SERVER="server.example.com:443"

Required credentials in credentials/<profile>.env:

NETLOOM_CLIENT_ID="your-client-id"
NETLOOM_CLIENT_SECRET_REF="<profile>/client-secret"
# Optional plaintext fallback:
# NETLOOM_CLIENT_SECRET="your-client-secret"

If you use an OS keychain, store the referenced secret with:

python -m keyring set netloom/clearpass <profile>/client-secret

You can also resolve NETLOOM_CLIENT_SECRET_REF from Delinea Secret Server with a reference such as:

NETLOOM_CLIENT_SECRET_REF="secretserver://prod/Shared/ClearPass/API?field=password"

Shared Secret Server provider config lives under:

~/.config/netloom/keystores/secretserver/defaults.env
~/.config/netloom/keystores/secretserver/profiles/<profile>.env
~/.config/netloom/keystores/secretserver/credentials/<profile>.env

Typical Secret Server provider settings:

NETLOOM_SECRETSERVER_URL="https://vault.example.com/SecretServer"
NETLOOM_SECRETSERVER_USERNAME="svc-netloom"
NETLOOM_SECRETSERVER_PASSWORD_REF="prod/secretserver-password"
NETLOOM_SECRETSERVER_NETWORK_DEVICE_PATH_TEMPLATE="/Shared/ClearPass/network-devices/{name}"

When that provider is configured, netloom policyelements network-device add, update, replace, and copy can backfill missing radius_secret and tacacs_secret values from Delinea by device name. The current integration is read-only and only fetches those secret fields.

First Run / Quick Start

netloom load clearpass
netloom server use <profile>
netloom cache update
netloom identities endpoint list --limit=10

That initial cache update is what enables richer help, completion, and live module/service discovery for the active server.

CLI Examples

List a few endpoints from the active profile:

netloom identities endpoint list --limit=10

Filter a list request with shorthand syntax:

netloom identities endpoint list --filter=name:contains:guest

Fetch one object and print it to the terminal:

netloom policyelements network-device get --id=1001 --console

Compare the same service between two profiles:

netloom policyelements network-device diff --from=<source-profile> --to=<target-profile> --all --max-items=25

Preview a cross-profile copy without writing changes:

netloom policyelements network-device copy --from=<source-profile> --to=<target-profile> --all --dry-run

Feature Roadmap

• Multi-service copy workflows
• Extended validation and dry-run features
• Version tracking for config changes
• Low-priority CLI semantics and naming cleanup
• GUI on top of CLI

Deeper Docs

For full command reference and plugin-specific details:

• Shared CLI reference: man netloom or man/netloom.md
• ClearPass plugin reference: man netloom-clearpass or man/netloom-clearpass.md
• Shell completion setup and generic --filter= syntax: man netloom
• ClearPass-oriented filter and workflow examples: man netloom-clearpass
• Live action help from your current cache: netloom <module> <service> ?

Detailed release history is in CHANGELOG.md.

Development

pip install -e .[dev]
pytest -q
ruff check .
ruff format .
python -m build
python -m twine check dist/*
netloom-generate-manpages
netloom-generate-manpages --check

License

Proprietary / Internal Use
See LICENSE.