Segment Routing GitOps Workflow

Segment Routing GitOps

Segment Routing GitOps SR-MPLS SRv6 Network as Code Ansible Nornir Batfish CI/CD Argo CD Traffic Engineering TI-LFA

Network Config as Code

# === Segment Routing Config Templates ===

# Cisco IOS-XR SR-MPLS Config (Jinja2 Template)
# segment-routing
#   mpls
#     connected-prefix-sid-map
#       address-family ipv4
#         {{ loopback_ip }}/32 index {{ node_sid }} range 1
#     sr-prefer
#   traffic-eng
#     segment-list {{ sl_name }}
#       index 10 mpls label {{ sid_1 }}
#       index 20 mpls label {{ sid_2 }}
#       index 30 mpls label {{ sid_3 }}
#     policy {{ policy_name }}
#       color {{ color }} end-point ipv4 {{ endpoint }}
#       candidate-paths
#         preference 100
#           explicit segment-list {{ sl_name }}

from dataclasses import dataclass

@dataclass
class SRConfig:
    device: str
    node_sid: int
    loopback: str
    adjacency_sids: str
    flex_algo: str
    role: str

configs = [
    SRConfig("PE-Router-1 (Bangkok)",
        16001, "10.0.0.1",
        "24001 (to P1) 24002 (to P2)",
        "Algo 0 (SPF) Algo 128 (Low Latency)",
        "Provider Edge ingress"),
    SRConfig("P-Router-1 (Core)",
        16002, "10.0.0.2",
        "24003 (to P2) 24004 (to PE2)",
        "Algo 0 Algo 128 Algo 129 (Avoid Link)",
        "Core Transit"),
    SRConfig("P-Router-2 (Core)",
        16003, "10.0.0.3",
        "24005 (to PE1) 24006 (to PE2)",
        "Algo 0 Algo 128",
        "Core Transit Redundant"),
    SRConfig("PE-Router-2 (Singapore)",
        16004, "10.0.0.4",
        "24007 (to P1) 24008 (to P2)",
        "Algo 0 Algo 128",
        "Provider Edge egress"),
]

print("=== SR Node Config ===")
for c in configs:
    print(f"  [{c.device}] SID: {c.node_sid} Lo: {c.loopback}")
    print(f"    Adj SIDs: {c.adjacency_sids}")
    print(f"    Flex Algo: {c.flex_algo}")
    print(f"    Role: {c.role}")

GitOps Pipeline

# === Network GitOps CI/CD ===

# GitHub Actions Pipeline
# name: Network Config Deploy
# on:
#   push:
#     branches: [main]
#     paths: ['configs/**']
# jobs:
#   validate:
#     runs-on: ubuntu-latest
#     steps:
#       - uses: actions/checkout@v4
#       - name: Validate with Batfish
#         run: |
#           python validate.py --config configs/ --batfish http://batfish:9996
#       - name: Dry-run with Nornir
#         run: |
#           python deploy.py --dry-run --config configs/
#   deploy:
#     needs: validate
#     runs-on: ubuntu-latest
#     steps:
#       - name: Deploy Config
#         run: |
#           python deploy.py --config configs/ --target production

@dataclass
class PipelineStep:
    step: str
    tool: str
    action: str
    rollback: str

pipeline = [
    PipelineStep("Lint & Syntax Check",
        "YAML Lint + Jinja2 Render",
        "ตรวจ Config Template ถูกต้อง",
        "Block PR ถ้า Syntax Error"),
    PipelineStep("Batfish Validation",
        "Batfish (Network Config Analysis)",
        "ตรวจ Routing Loop Unreachable Prefix ACL Conflict",
        "Block Deploy ถ้า Validation Fail"),
    PipelineStep("Containerlab Test",
        "Containerlab (Virtual Lab)",
        "ทดสอบ Config ใน Virtual Network",
        "Block Deploy ถ้า Test Fail"),
    PipelineStep("Dry-run Deploy",
        "Nornir + Napalm",
        "Generate Config Diff ไม่ Push จริง",
        "Review Diff ก่อน Approve"),
    PipelineStep("Production Deploy",
        "Nornir + Napalm (Commit)",
        "Push Config ไป Router/Switch",
        "Git Revert + Nornir Rollback"),
    PipelineStep("Post-deploy Verify",
        "gNMI Telemetry + Ping Test",
        "ตรวจ SR Policy Active Path OK",
        "Auto-rollback ถ้า Verify Fail"),
]

print("=== GitOps Pipeline ===")
for p in pipeline:
    print(f"  [{p.step}] Tool: {p.tool}")
    print(f"    Action: {p.action}")
    print(f"    Rollback: {p.rollback}")

Monitoring & Telemetry

# === SR Monitoring ===

@dataclass
class SRMetric:
    metric: str
    source: str
    threshold: str
    action: str

sr_metrics = [
    SRMetric("SR Policy State",
        "gNMI /segment-routing/policies/policy/state",
        "State != Active",
        "Alert P1 + ตรวจ Segment List"),
    SRMetric("TI-LFA Coverage",
        "gNMI /segment-routing/ti-lfa/state",
        "Coverage < 100%",
        "ตรวจ Topology หา Unprotected Prefix"),
    SRMetric("Path Latency",
        "TWAMP / Y.1731 Probe",
        "> SLA Target (e.g. > 20ms)",
        "Switch to Backup Path หรือ Reroute"),
    SRMetric("Packet Loss per Segment",
        "Interface Counters gNMI",
        "> 0.01%",
        "ตรวจ Interface Errors CRC"),
    SRMetric("SID Counter (Traffic)",
        "gNMI /segment-routing/mpls/sid-counters",
        "Traffic Drop > 10% จาก Baseline",
        "ตรวจ SR Policy Change Routing Loop"),
    SRMetric("Config Drift",
        "Batfish Periodic Scan",
        "Running Config != Git Config",
        "Alert + Auto-remediate จาก Git"),
]

print("=== SR Monitoring ===")
for m in sr_metrics:
    print(f"  [{m.metric}]")
    print(f"    Source: {m.source}")
    print(f"    Threshold: {m.threshold}")
    print(f"    Action: {m.action}")

เคล็ดลับ

• Batfish: Validate ทุก Config ด้วย Batfish ก่อน Deploy
• TI-LFA: ตรวจ TI-LFA Coverage 100% ป้องกัน Link Failure
• Flex Algo: ใช้ Flex Algo แยก Traffic ตาม SLA
• gNMI: ใช้ gNMI Telemetry Real-time ไม่ใช้ SNMP Polling
• Containerlab: ทดสอบ Config ใน Lab ก่อน Production

Segment Routing คืออะไร

Source Routing SR-MPLS SRv6 Node SID Adjacency SID Flex Algo TI-LFA Traffic Engineering Network Slicing ลด State ไม่ต้อง LDP RSVP

สรุป

Segment Routing GitOps SR-MPLS SRv6 Network as Code Ansible Nornir Batfish CI/CD gNMI TI-LFA Flex Algo Monitoring Production