Salt Extension for Aerleon

Salt Extension for generating network ACLs and firewall filters with Aerleon.

Overview

Aerleon is the maintained successor to Google's Capirca: it renders platform-specific access-control lists from a single set of platform-independent term and policy definitions.

This extension provides the aerleon execution module. It is a direct port of the capirca execution module that used to ship with Salt core (removed in Salt 3008): the function names and arguments are unchanged, only the underlying library moved from capirca to aerleon. Capirca has been effectively unmaintained since early 2023 (its last PyPI release was 2.0.9 in February 2023), and its capirca.* namespace was renamed to aerleon.* with no compatibility shim, so this port swaps the import and platform-generator lookup accordingly.

The module generates configuration text only; it does not talk to devices. To push generated ACLs onto network gear, use the netacl execution and state modules in saltext-napalm, which call this module's aerleon.* functions.

Requirements

• Salt 3008 or newer. The built-in capirca module was part of Salt core on 3006/3007, so on those releases the extension is neither needed nor installable (pip enforces salt>=3008).
• Aerleon 1.17.0 or newer (installed automatically).

Example

Generate a Cisco term:

salt '*' aerleon.get_term_config cisco example-filter example-term \
    source_address=10.0.0.0/8 protocol=tcp action=accept

Provided functions: get_term_config, get_filter_config, get_policy_config, get_filter_pillar and get_term_pillar.

Security

If you discover a security vulnerability, please refer to Salt's security guide.

User Documentation

For setup and usage instructions, please refer to the User Documentation.

Contributing

The saltext-aerleon project welcomes contributions from anyone!

The Salt Extensions guide provides comprehensive instructions on all aspects of Salt extension development, including writing tests, running tests, writing documentation and rendering the docs.

Quickstart

To get started contributing, first clone this repository (or your fork):

# Clone the repo
git clone --origin upstream https://gitlab.com/ggiesen/saltext-aerleon.git

# Change to the repo dir
cd saltext-aerleon

Automatic

If you have installed direnv, copying the included .envrc.example to .envrc and allowing it to run ensures a proper development environment is present and the virtual environment is active.

Without direnv, you can still run the automation explicitly:

make dev  # or python3 tools/initialize.py
source .venv/bin/activate

Manual

Please follow the first steps, skipping the repository initialization and first commit.

Ways to contribute

Contributions come in many forms, and they're all valuable! Here are some ways you can help without writing code:

• Documentation: Especially examples showing how to use this project to solve specific problems.
• Triaging issues: Help manage issues.

Any of these things are super valuable to our community, and we sincerely appreciate every contribution!