JNCIA-DevOps cheat sheet

Idempotency: a script or task is idempotent when running it repeatedly produces the same end state; non-idempotent commands (e.g., appending a config line) drift on re-run.

Junos PyEZ is a Python library for Junos automation built on NETCONF; Device(host=..., user=..., password=...) opens a session and dev.rpc.* or Config objects perform work.

PyEZ Config workflow: cfg = Config(dev); cfg.lock(); cfg.load(path=..., format='set'|'text'|'xml'); cfg.commit_check(); cfg.commit(); cfg.unlock().

Junos 'commit check' validates candidate config without applying; 'commit confirmed ' auto-rolls back unless confirmed with 'commit' - used for safe remote changes.

Slip of the pen: Junos requires 'commit' to apply candidate config; configuration typed without commit exists only in the candidate and is lost on rollback.

Python requests + Junos REST API: POST to https:///rpc with JSON body and header Content-Type: application/json; authenticate with basic auth or session token.

Ansible Juniper modules (juniper.device / junos_*) commonly use connection: netconf or network_cli; junos_config pushes configuration and supports confirm_commit.

YAML indentation is significant: two spaces per level, tabs are invalid; a list item uses '- ' and key: value pairs map to dictionaries.

DevOps shortens the feedback loop between development and operations; core metrics (DORA) are deployment frequency, lead time for changes, change failure rate, and time to restore.

CI is the practice of integrating and testing every change automatically; CD extends this to automatically delivering to staging/production (continuous delivery keeps a manual gate, continuous deployment does not).

Blame-free post-incident review (postmortem) focuses on systemic causes and action items, not individual fault; it produces documented follow-ups.

Infrastructure as Code supports version control, peer review via pull requests, and repeatable environments - the same review process as application code.

Shift-left means testing, security scanning, and validation happen earlier in the pipeline, closer to the developer, reducing cost of defects.

Git branching: feature branch off main, open pull request, review, merge; 'git commit' records local changes, 'git push' publishes, 'git pull' fetches and merges.

ChatOps and automation tooling (CI runners, ticketing integrations) reduce manual handoffs; runbooks should be executable and stored with the code.

Configuration drift occurs when live state diverges from the declared desired state; periodic compliance checks and idempotent tooling detect and correct it.

Declarative IaC describes the desired end state (e.g., Terraform HCL, Ansible playbooks); imperative IaC lists steps to execute. Terraform builds a plan then applies it.

Terraform state file maps declared resources to real infrastructure; remote state with locking prevents concurrent applies from corrupting it.

Ansible playbook structure: hosts, become, tasks; each task names a module (e.g., junos_config, junos_command) and module arguments; handlers run on notify.

Ansible variables can be set in inventory, group_vars/host_vars, play vars, or with -e; precedence matters - extra vars (-e) win over play vars.

Junos configuration hierarchy: configuration is a tree (system, interfaces, protocols, policy-options); 'set' commands are converted into that tree at commit.

Configuration groups apply shared config to multiple interfaces or routing instances with 'apply-groups'; they reduce duplication in templates.

Jinja2 templating renders device config from variables: {{ variable }} substitutes values, {% for %} loops, {% if %} conditionals; used with Ansible template module.

Junos PyEZ Tables/Views parse operational output (show commands) into Python objects; Table defines the RPC and fields, View maps XML to attributes.

Golden config / compliance: compare running config against a template baseline; Junos 'show configuration | compare rollback N' diffs against prior commits.

Pipeline stages typically: source checkout, lint/syntax check, unit test, build artifact, deploy to staging, integration test, deploy to production.

A CI job fails fast when any stage returns non-zero exit status; the pipeline stops and reports failure to the developer.

Artifacts (build outputs, config bundles) are stored by the CI server and promoted between environments rather than rebuilt per stage.

Secrets should be injected from a secret store or CI variables, never committed to the repository; rotate and scope credentials per environment.

Blue-green deployment runs two identical environments and switches traffic; canary deployment sends a small percentage of traffic to the new version first.

Rollback strategy for network changes: use 'commit confirmed' with a timer, or keep the previous config as rollback N so 'rollback N; commit' restores it.

Pipeline-as-code (e.g., a YAML file in the repo) versions the build definition with the application, enabling review and reproducibility.

Test pyramid: many fast unit tests, fewer integration tests, few end-to-end tests; network automation commonly adds config linting and device simulation tests.

Junos supports NETCONF over SSH (port 830) and REST API over HTTPS; enable with 'set system services netconf ssh' and 'set system services rest http' (or https).

NETCONF operations: , , , , , ; candidate datastore enables staged changes.

Junos REST API endpoints: /rpc for RPCs, /config for configuration; HTTP methods GET (retrieve), POST (create/execute), PUT (replace), DELETE (remove).

Junos XML API RPC format: returns XML; PyEZ wraps these RPCs as dev.rpc.get_interface_information().

Junos PyEZ operational tables: from jnpr.junos.op.ethport import EthPortTable; tbl = EthPortTable(dev); tbl.get() iterates interface rows.

Junos 'show configuration | display set' emits set-format commands suitable for scripting; 'display xml' shows the XML hierarchy.

Authentication to Junos APIs uses username/password or SSH keys; REST also supports session tokens obtained via /auth/login for subsequent calls.

gNMI/gRPC and Junos Telemetry Interface stream operational data; YANG models describe config and state for model-driven programmability.

Junos commit scripts and event scripts run on-box in Python/XSLT; commit scripts can enforce configuration policy before commit completes.