The NetDevOps CI/CD Pipeline End-to-End

Putting It All Together

A complete NetDevOps pipeline integrates version control, automated verification, and controlled deployment into a single workflow. Here's how a real change flows through the system:

1. Engineer edits config file locally
         ↓
2. git commit + git push → opens Pull Request
         ↓
3. CI pipeline triggers (Jenkins / GitLab CI / GitHub Actions)
         ↓
4. Batfish loads current snapshot (Snapshot A)
   Batfish loads candidate snapshot (Snapshot B)
         ↓
5. Automated tests run:
   ├── Regression tests (did we break existing connectivity?)
   ├── Security policy tests (did we violate any security rules?)
   └── Differential analysis (what behavior changed?)
         ↓
6a. Tests PASS → PR gets green checkmark → human review → merge → deploy
6b. Tests FAIL → PR blocked → engineer notified with specific failure details

The key insight: The pipeline enforces that no configuration reaches a device without passing automated verification. The human engineer is still in the loop for review and approval, but the mechanical checking — the part that humans are bad at — is fully automated.

Tooling ecosystem:
- Batfish / pybatfish: Formal verification and reachability analysis.
- Nornir: Python automation framework for network device interaction (like Ansible, but pure Python).
- Napalm: Network Automation and Programmability Abstraction Layer with Multivendor support — a Python library that provides a vendor-neutral API for interacting with network devices.
- Ansible Network Modules: Declarative configuration management for network devices.
- Netmiko: Python library for SSH connections to network devices, used for configuration retrieval and deployment.