Salt Extension for Napalm

Salt Extension for multi-vendor network device management via NAPALM

Security

If you discover a security vulnerability, please refer to Salt's security guide.

User Documentation

For setup and usage instructions, please refer to the User Documentation.

Deployment models

This extension requires Salt 3008 or newer for every deployment model. The built-in NAPALM support was removed from Salt core in 3008; this extension restores it (and adds the Resources model). On Salt 3006/3007 the NAPALM modules are still part of core, so the extension is neither needed nor installable there (pip enforces salt>=3008).

saltext-napalm can manage devices three ways:

All three models expose the NAPALM surface: the net.* execution module, the napalm_* modules, and the netconfig, netntp, netsnmp, netusers and netacl states. Proxy minion and deltaproxy run identical proxy code (deltaproxy just runs many instances in one process). The Resources model reaches the same net.*/napalm_* execution surface through the resource's shared, cached device connection, so salt -C 'T@napalm:<id>' net.cli ..., net.arp, napalm.call and the rest work as they do on a proxy.

Limitations:

• Scope is NAPALM only (multi-vendor via NAPALM drivers: junos, eos, ios, iosxr, nxos, and so on). Vendor-specific standalone modules such as junos or nxos_api are out of scope and not shipped here.
• Deltaproxy needs metaproxy: deltaproxy set on the control proxy. Its per-sub-proxy schedule/beacon isolation also depends on a Salt-core fix (Salt issue #65088); sub-proxies still connect and run without it, but keepalives can collide.
• All three models load NAPALM through Salt's module loader and are therefore subject to the ncclient requirement below.

Salt loader compatibility (ncclient)

NAPALM depends on junos-eznc, which pins ncclient==0.7.0. Under Salt's module loader that build of ncclient triggers a sys.path shadow (Salt issue #69139): NAPALM's import fails, so the napalm.* functions never load and a proxy reports Proxymodule napalm is missing an init().

The root-cause fix is Salt-side (Salt PR #69787). Until it ships in a Salt release, install a newer ncclient after the extension:

pip install saltext-napalm
pip install "ncclient>=0.7.1"          # onedir: salt-pip install "ncclient>=0.7.1"

pip warns that this conflicts with junos-eznc's pin; the warning is expected, and junos-eznc works correctly with ncclient 0.7.1. See the installation guide for details.

Contributing

The saltext-napalm project welcomes contributions from anyone!

The Salt Extensions guide provides comprehensive instructions on all aspects of Salt extension development, including writing tests, running tests, writing documentation and rendering the docs.

Quickstart

To get started contributing, first clone this repository (or your fork):

# Clone the repo
git clone --origin upstream https://gitlab.com/ggiesen/saltext-napalm.git

# Change to the repo dir
cd saltext-napalm

Automatic

If you have installed direnv, copying the included .envrc.example to .envrc and allowing it to run ensures a proper development environment is present and the virtual environment is active.

Without direnv, you can still run the automation explicitly:

make dev  # or python3 tools/initialize.py
source .venv/bin/activate

Manual

Please follow the first steps, skipping the repository initialization and first commit.

Ways to contribute

Contributions come in many forms, and they’re all valuable! Here are some ways you can help without writing code:

• Documentation: Especially examples showing how to use this project to solve specific problems.
• Triaging issues: Help manage issues.

You can also contribute by:

• Writing blog posts
• Sharing your experiences using Salt + Napalm on social media
• Giving talks at conferences
• Publishing videos
• Engaging in IRC, Discord or email groups

Any of these things are super valuable to our community, and we sincerely appreciate every contribution!