feat: report Kea's HA peers and the firewall's config sync #19

2026-10-16T13:22:39Z

christianmanivong commented

2026-10-16 13:22:39 +00:00

Implements the new napalm-device-types 4.11.0 contract (NAPALM/napalm-device-types#42) for NetOrk/netork#1125.

get_dhcp_ha() reads two endpoints:
- kea/dhcpv4/get (its ha section): whether Kea's HA hook is on, and this firewall's peer name. this_server_name is empty while left at its default (the hostname); the effective name is then in its % twin.
- kea/dhcpv4/searchPeer: each peer's name, role and HA URL.
get_config_sync() reads core/hasync/get: synchronizetoip and the ticked sync items.
- Items are mapped to the service names get_services reports (kea → kea-dhcp, dnsresolver → unbound, ssh → openssh, ...).
- Items that are no service (aliases, rules, NAT, ...) are listed under unmapped.
- Ticked items without a target push nothing, so they count for nothing.
Both raise when the request fails.
ConfigSyncMixin is mixed into the driver class, not into the role.
Requires napalm_device_types>=4.11.0.

They are configuration, not state: Kea's control agent, which knows whether the pair is in hot standby right now, listens on localhost only.

Fixture tests/unit/fixtures/ha_pair.json holds what gw-01 and gw-02 answered on 2026-10-16 (read-only): gw primary, gw-02 standby, and gw-01 syncing Kea and Unbound to gw-02. Tests: tests/unit/test_ha.py. Full suite: 387 passed.

Implements the new napalm-device-types 4.11.0 contract (NAPALM/napalm-device-types#42) for NetOrk/netork#1125. - **`get_dhcp_ha()`** reads two endpoints: - `kea/dhcpv4/get` (its `ha` section): whether Kea's HA hook is on, and this firewall's peer name. `this_server_name` is empty while left at its default (the hostname); the effective name is then in its `%` twin. - `kea/dhcpv4/searchPeer`: each peer's name, role and HA URL. - **`get_config_sync()`** reads `core/hasync/get`: `synchronizetoip` and the ticked sync items. - Items are mapped to the service names `get_services` reports (`kea` → `kea-dhcp`, `dnsresolver` → `unbound`, `ssh` → `openssh`, ...). - Items that are no service (aliases, rules, NAT, ...) are listed under `unmapped`. - Ticked items without a target push nothing, so they count for nothing. - Both raise when the request fails. - `ConfigSyncMixin` is mixed into the driver class, not into the role. - Requires `napalm_device_types>=4.11.0`. They are configuration, not state: Kea's control agent, which knows whether the pair is in hot standby right now, listens on localhost only. Fixture `tests/unit/fixtures/ha_pair.json` holds what gw-01 and gw-02 answered on 2026-10-16 (read-only): gw primary, gw-02 standby, and gw-01 syncing Kea and Unbound to gw-02. Tests: `tests/unit/test_ha.py`. Full suite: 387 passed.

christianmanivong added 1 commit 2026-10-16 13:22:39 +00:00

feat: report Kea's HA peers and the firewall's config sync

CI / test (3.10) (push) Successful in 32s

Details

CI / test (3.11) (push) Successful in 33s

Details

CI / test (3.12) (push) Successful in 34s

Details

CI / test (3.10) (pull_request) Successful in 38s

Details

CI / test (3.11) (pull_request) Successful in 37s

Details

CI / test (3.12) (pull_request) Successful in 38s

Details

e334dc0058

get_dhcp_ha reads kea/dhcpv4/get (the ha section) and
kea/dhcpv4/searchPeer: whether Kea's HA hook is on, this firewall's peer
name -- the % twin when left at its default -- and each peer's name,
role and HA URL. get_config_sync reads core/hasync/get: the address this
firewall pushes its configuration to and the ticked sync items, mapped to
the service names get_services reports; items that are no service stay
under `unmapped`. Both raise when the request fails.

Configuration, not state: Kea's control agent, which knows whether the
pair is in hot standby right now, listens on localhost only.

Needs napalm-device-types 4.11.0 (ConfigSyncMixin). NetOrk/netork#1125.

christianmanivong merged commit 055ec3da71 into master

2026-10-16 13:32:24 +00:00

christianmanivong deleted branch feat/dhcp-ha-config-sync

2026-10-16 13:32:24 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: NAPALM/napalm-opnsense#19