Production-grade network
automation, built right

import pynetbox
import os

nb = pynetbox.api(
    "https://netbox.company.internal",
    token=os.environ["NETBOX_TOKEN"]
)

def get_bgp_peers(device_name):
    """Pull all BGP peers for a device from NetBox."""
    device = nb.dcim.devices.get(name=device_name)
    peers = nb.plugins.bgp.bgp_session.filter(
        device_id=device.id
    )
    return [{
        "neighbor_ip": p.remote_address.address.split("/")[0],
        "remote_asn":   p.remote_as.asn,
        "description":  p.description,
        "local_ip":    p.local_address.address.split("/")[0],
        "route_map_in": p.cf_route_map_in or "RM-DEFAULT-IN",
        "route_map_out": p.cf_route_map_out or "RM-DEFAULT-OUT"
    } for p in peers]

def build_device_context(device_name):
    """Build the full data context for template rendering."""
    device = nb.dcim.devices.get(name=device_name)
    return {
        "hostname":   device.name,
        "local_asn":  device.cf_bgp_asn,
        "router_id":  device.primary_ip.address.split("/")[0],
        "bgp_peers":  get_bgp_peers(device_name),
        "vlans":      [v.vid for v in nb.ipam.vlans.filter(site_id=device.site.id)],
        "role":       device.device_role.slug
    }

! Generated by NetworkForAI automation pipeline
! Device: {{ hostname }} | ASN: {{ local_asn }}
! DO NOT EDIT MANUALLY

router bgp {{ local_asn }}
  bgp router-id {{ router_id }}
  bgp log-neighbor-changes
  no bgp default ipv4-unicast
{% for peer in bgp_peers %}

  ! Peer: {{ peer.description }}
  neighbor {{ peer.neighbor_ip }} remote-as {{ peer.remote_asn }}
  neighbor {{ peer.neighbor_ip }} description {{ peer.description }}
  neighbor {{ peer.neighbor_ip }} update-source Loopback0
  neighbor {{ peer.neighbor_ip }} password {{ peer.md5_password | default("changeme") }}
  neighbor {{ peer.neighbor_ip }} timers 10 30

  address-family ipv4 unicast
    neighbor {{ peer.neighbor_ip }} activate
    neighbor {{ peer.neighbor_ip }} soft-reconfiguration inbound
    neighbor {{ peer.neighbor_ip }} route-map {{ peer.route_map_in }} in
    neighbor {{ peer.neighbor_ip }} route-map {{ peer.route_map_out }} out
    neighbor {{ peer.neighbor_ip }} maximum-prefix 10000 80
  exit-address-family
{% endfor %}

from jinja2 import Environment, FileSystemLoader
from netmiko import ConnectHandler
from netbox_client import build_device_context
import logging

log = logging.getLogger("deploy")

def render_config(device_name, template_name):
    env = Environment(loader=FileSystemLoader("templates/"))
    template = env.get_template(template_name)
    context = build_device_context(device_name)
    return template.render(context)

def deploy_to_device(device_name, mgmt_ip, config, dry_run=True):
    """Push config to device. dry_run=True just prints the diff."""
    config_lines = config.strip().splitlines()

    if dry_run:
        log.info(f"DRY RUN for {device_name}: config ready, not pushing")
        return config

    device = {
        "device_type": "cisco_ios",
        "host":        mgmt_ip,
        "username":    os.environ["NET_USER"],
        "password":    os.environ["NET_PASS"],
        "secret":      os.environ["NET_ENABLE"]
    }

    with ConnectHandler(**device) as conn:
        conn.enable()
        output = conn.send_config_set(config_lines)
        log.info(f"Config pushed to {device_name}")
        return output

def verify_bgp(conn, expected_peer_count):
    """Post-deploy check: verify BGP sessions are established."""
    output = conn.send_command("show bgp summary | include Established")
    established = output.count("Established")
    if established < expected_peer_count:
        raise ValueError(
            f"Expected {expected_peer_count} BGP sessions, got {established}"
        )
    log.info(f"BGP verification passed: {established} sessions up")

! EVPN/VXLAN Leaf Config | {{ hostname }}

vlan 10,20,30

interface nve1
  no shutdown
  source-interface loopback0
  host-reachability protocol bgp
{% for vni in vxlan_vnis %}
  member vni {{ vni.id }}
    ingress-replication protocol bgp
{% endfor %}

router bgp {{ local_asn }}
  address-family l2vpn evpn
{% for peer in bgp_peers if peer.type == "spine" %}
    neighbor {{ peer.neighbor_ip }} activate
    neighbor {{ peer.neighbor_ip }} send-community extended
{% endfor %}
{% for vni in vxlan_vnis %}
  vni {{ vni.id }} l2
    rd auto
    route-target import auto
    route-target export auto
{% endfor %}

from pygnmi.client import gNMIclient
import json, time

TARGET_PATHS = [
    "openconfig-bgp:bgp/neighbors",
    "openconfig-interfaces:interfaces/interface/state/counters",
    "openconfig-network-instance:network-instances"
]

def stream_telemetry(host, port=57400):
    with gNMIclient(
        target=(host, port),
        username=os.environ["NET_USER"],
        password=os.environ["NET_PASS"],
        insecure=True
    ) as gc:
        for update in gc.subscribe_sync(
            subscribe={
                "subscription": [{"path": p, "mode": "sample", "sample_interval": 10_000_000_000}
                               for p in TARGET_PATHS],
                "mode": "stream"
            }
        ):
            process_update(update)

def process_update(update):
    """Parse update and write to InfluxDB."""
    for notification in update.get("update", []):
        path = notification["path"]
        val  = notification["val"]
        write_to_influx(path, val)