JCPA cheat sheet

DevOps is defined by CALMS: Culture, Automation, Lean, Measurement, Sharing.

Idempotency means running a task repeatedly yields the same end state; it is the core property that makes automation safe to re-run.

Declarative models describe the desired end state (e.g., YANG config); imperative models list ordered steps to execute.

Infrastructure as Code (IaC) stores device and topology definitions in version-controlled files rather than manual CLI entry.

A source of truth is the authoritative data store (e.g., NetBox, YAML inventory) that automation reads; devices are not the source of truth.

Mutable infrastructure is modified in place; immutable infrastructure is replaced with a newly built instance on each change.

Continuous integration merges and tests code frequently; continuous delivery keeps artifacts deployable; continuous deployment releases automatically.

Configuration drift is divergence between the intended state and the running device state; detection requires periodic comparison or telemetry.

A Python dictionary maps keys to values and maps directly to JSON objects; lists map to JSON arrays.

json.loads() parses a JSON string into Python objects; json.dumps() serializes Python objects to a JSON string.

with open(path) as f: guarantees the file is closed even if an exception is raised inside the block.

The requests library returns a Response object; .status_code gives the HTTP code, .json() parses the body, .text returns raw text.

try/except/finally handles errors; raise re-raises, and finally always executes for cleanup.

Jinja2 renders templates with Template(text).render(vars); {{ var }} substitutes values and {% for %}/{% if %} control flow.

The netmiko library wraps SSH CLI sessions: ConnectHandler(**device) then send_command() or send_config_set().

argparse builds CLI interfaces with add_argument() and parse_args(); nargs='+' accepts one or more values.

HTTP methods: GET reads, POST creates, PUT replaces, PATCH partially modifies, DELETE removes.

Status code classes: 2xx success, 3xx redirect, 4xx client error, 5xx server error; 401 is unauthenticated, 403 is unauthorized.

REST constraints include statelessness, client-server separation, uniform interface, and cacheability.

In JSON, {} is an object, [] is an array, and string values are double-quoted; JSON has no comments.

XML uses elements with open/close tags, attributes, and namespaces declared via xmlns; XPath addresses nodes.

YANG is a data modeling language: container groups nodes, list is a repeatable entry keyed by key, leaf is a scalar value.

YANG leaf types include string, int32, uint16, boolean, enumeration, and leafref; mandatory true makes a node required.

A YANG module declares namespace and prefix; import references other modules, and augment extends existing trees.

NETCONF runs over SSH on TCP port 830 and uses XML-encoded RPC messages.

NETCONF operations include <get>, <get-config>, <edit-config>, <copy-config>, <lock>, <unlock>, and <commit>.

Datastores: running, candidate, startup; <edit-config> targets a datastore with merge, replace, create, or delete operations.

NETCONF uses <rpc> with a message-id attribute and replies with <rpc-reply>; <ok> or <data> carries the result.

NETCONF capabilities are advertised in <hello> messages; base capability is urn:ietf:params:netconf:base:1.0 or 1.1.

RESTCONF maps CRUD to HTTP methods and uses YANG paths like /restconf/data/<module>:<container>; default port is 443.

RESTCONF media types: application/yang-data+json and application/yang-data+xml; Accept requests a format.

NETCONF messages are delimited by ]]>]]> in base 1.0 and by chunked framing in base 1.1.

Junos PyEZ connects with Device(host=..., user=..., password=...); open() establishes the session.

PyEZ device.rpc.get_* methods invoke operational RPCs; device.rpc.get_config() retrieves configuration.

PyEZ Config class loads text/XML/set/Jinja2 configs; commit_check() validates without committing, and diff() shows changes.

PyEZ tables and views (YAML) map XML RPC output to Python objects for structured parsing.

Junos Ansible modules include junos_config, junos_command, junos_facts, and junos_netconf; they run under the juniper.device collection.

Ansible playbooks are YAML lists of plays with hosts, tasks, and modules; ansible.cfg and inventory files define connectivity.

Salt uses a master/minion or proxy-minion model; Junos proxy-minion executes state files rendered by Jinja2 via salt commands.

PyEZ exceptions include ConnectError, RpcError, and ConfigLoadError; catching RpcError captures device-side failures.

Jinja2 {{ }} outputs values; {% %} executes statements; {# #} is a comment.

Filters transform output: {{ x | upper }}, {{ list | join(',') }}, {{ var | default('x') }}.

Template variables come from YAML/JSON data; separating data from template enables reuse across many devices.

A configlet or snippet is a reusable partial template included via {% include 'file.j2' %}.

{% for host in hosts %} iterates data; {% if x is defined %} guards optional fields.

Configuration backup is retrieval of the running config into version control; diffing backups reveals drift.

Golden config comparison validates device state against a known-good baseline before or after deployment.

Rollback strategies include Junos rollback N, commit confirmed <minutes>, and storing prior configs for restoration.

SNMP polling is pull-based with OIDs; SNMP traps are push-based asynchronous notifications.

Streaming telemetry pushes structured data continuously; common transports are gRPC and UDP, with encodings like JSON or GPB.

Junos supports set services analytics streaming-server and native/OpenConfig sensor paths for telemetry.

Syslog severity levels run 0 (emergency) to 7 (debug); facility and severity filter messages.

Event-driven automation reacts to a trigger (syslog, SNMP trap, telemetry threshold) by running a script or workflow.

Junos event scripts and event-options policies match events and execute actions such as commands or scripts.

Push vs pull: telemetry and traps push data; polling and API queries pull data on demand.

NetFlow/IPFIX/sFlow export flow records for traffic analysis; they are distinct from device health telemetry.

Git objects: blobs (file contents), trees (directories), commits (snapshots with parent links), and tags (named refs).

git clone copies a repo; git fetch downloads refs; git pull fetches and merges; git push uploads commits.

Branches are movable pointers to commits; git checkout -b name creates and switches to a new branch.

git merge combines histories; git rebase replays commits onto a new base and rewrites history.

A CI pipeline stage typically runs lint, unit tests, template rendering, and validation before deployment.

Pipeline gates can require approval or passing tests before config is pushed to production devices.

Merge/pull requests enable code review and automated checks before changes reach the main branch.

Secrets in CI/CD should be stored in a vault or CI secret store, never committed to the repository.

Use SSH (NETCONF/RESTCONF over TLS) rather than Telnet; disable plaintext management protocols.

Store credentials in a secrets manager or encrypted vault; never hardcode passwords in scripts or repos.

Prefer key-based authentication and per-automation service accounts with least privilege over shared admin accounts.

Role-based access control and Junos login classes limit what an automation account can change.

Validate input and template data to prevent injection; treat device output as untrusted.

Use commit confirmed or staged rollback so a bad automated change auto-reverts if not confirmed.

Log automation actions and retain change history for audit; correlate commits with device changes.

Rotate credentials and API tokens regularly; scope tokens to the minimum required permissions.

Idempotent automation can be safely re-run without changing the end state beyond the first application.

Declarative automation specifies the desired end state; the tool determines the steps to reach it.

The source of truth holds intended state; devices hold actual state, and drift is the difference between them.

CI runs automated tests on every change; CD keeps or delivers tested artifacts to environments.