3 ms·

VyOS is unfortunately completely useless for larger applications, since it's difficult to impossible to automate due to it's unique way of applying configuratio

VyOS is unfortunately completely useless for larger applications, since it's difficult to impossible to automate due to it's unique way of applying configurations. Don't get me wrong, for manual administration it's great, there's a lot of missed automation potential given that it's just Linux underneath. As an example, the Ansible modules for VyOS are basicially just variations of an adapted ansible.builtin.shell, instead of offering to manage state in a more first class manner (via attributes and values): https://docs.ansible.com/ansible/latest/collections/vyos/vyos/vyos_config_module.html#ansible-collections-vyos-vyos-vyos-config-module https://docs.ansible.com/ansible/latest/collections/vyos/vyo...

LeBit 3y ago
You can ssh into the router, copy a new config (state) and load that config. It is not very elegant though. Do you know of an open source router that does what you are looking for?
- chomp 3y ago
  That doesn’t sound that far off from what unifi does, it uses a daemon to do those things. (Receive configuration and then do a local apply)
  - synergy20 3y ago
    unifi runs vyos underneath
    - zrail 3y ago
      UniFi doesn't use VyOS anywhere afaik. Some Ubiquiti products run EdgeOS which is a Vyatta fork (EdgeRouter, the original security gateways). More recent UniFi products (UDM, UDM-SE, UNVR, etc) run UniFi OS which is their own Debian-based OS that runs applications inside Podman containers.
jon-wood 3y ago
From what I've seen of VyOS using a configuration file that is then used to generate the actual system configuration I'm not really sure its so hard to automate. Take your target state, generate a configuration file in the right format, then send it over and apply. To be honest this feels more like a limitation in Ansible, which has always felt like a bit of a hacky config management system to me in that the way it functions is generally to run a bunch of commands that gradually mutate the system's state, rather than atomically applying the target state, but then I've been spoiled by NixOS on my personal infrastructure recently.
icehawk 3y ago
There's higher level configuration for a number of major things like the interfaces, bgp, ospf and the firewall: https://docs.ansible.com/ansible/latest/collections/vyos/vyos/vyos_interfaces_module.html https://docs.ansible.com/ansible/latest/collections/vyos/vyo... https://docs.ansible.com/ansible/latest/collections/vyos/vyos/vyos_ospf_interfaces_module.html#ansible-collections-vyos-vyos-vyos-ospf-interfaces-module https://docs.ansible.com/ansible/latest/collections/vyos/vyo... https://docs.ansible.com/ansible/latest/collections/vyos/vyos/vyos_bgp_global_module.html#ansible-collections-vyos-vyos-vyos-bgp-global-module https://docs.ansible.com/ansible/latest/collections/vyos/vyo...
Sylamore 3y ago
AT&T had bought Vyatta before selling it to it's current owner, but I know they used a REST API internally when deploying it for 5G Edge use cases. It looks like VyOS gained an API in 2019.
nunez 3y ago
idk I've found VyOS fairly easy to automate. It doesn't have an HTTP API and everything needs to be configured through vbash afaik.
numpad0 3y ago
But what'd you do with Ansible on a router? Looks like VyOS has REST API and OpenFlow support, btw.
da768 3y ago
1.4 has config sync and a REST API coming in

LeBit 3y ago

You can ssh into the router, copy a new config (state) and load that config. It is not very elegant though. Do you know of an open source router that does what you are looking for?

chomp 3y ago
That doesn’t sound that far off from what unifi does, it uses a daemon to do those things. (Receive configuration and then do a local apply)
- synergy20 3y ago
  unifi runs vyos underneath
  - zrail 3y ago
    UniFi doesn't use VyOS anywhere afaik. Some Ubiquiti products run EdgeOS which is a Vyatta fork (EdgeRouter, the original security gateways). More recent UniFi products (UDM, UDM-SE, UNVR, etc) run UniFi OS which is their own Debian-based OS that runs applications inside Podman containers.

jon-wood 3y ago

From what I've seen of VyOS using a configuration file that is then used to generate the actual system configuration I'm not really sure its so hard to automate. Take your target state, generate a configuration file in the right format, then send it over and apply. To be honest this feels more like a limitation in Ansible, which has always felt like a bit of a hacky config management system to me in that the way it functions is generally to run a bunch of commands that gradually mutate the system's state, rather than atomically applying the target state, but then I've been spoiled by NixOS on my personal infrastructure recently.

icehawk 3y ago

There's higher level configuration for a number of major things like the interfaces, bgp, ospf and the firewall: https://docs.ansible.com/ansible/latest/collections/vyos/vyos/vyos_interfaces_module.html https://docs.ansible.com/ansible/latest/collections/vyos/vyo... https://docs.ansible.com/ansible/latest/collections/vyos/vyos/vyos_ospf_interfaces_module.html#ansible-collections-vyos-vyos-vyos-ospf-interfaces-module https://docs.ansible.com/ansible/latest/collections/vyos/vyo... https://docs.ansible.com/ansible/latest/collections/vyos/vyos/vyos_bgp_global_module.html#ansible-collections-vyos-vyos-vyos-bgp-global-module https://docs.ansible.com/ansible/latest/collections/vyos/vyo...

Sylamore 3y ago

AT&T had bought Vyatta before selling it to it's current owner, but I know they used a REST API internally when deploying it for 5G Edge use cases. It looks like VyOS gained an API in 2019.

nunez 3y ago

idk I've found VyOS fairly easy to automate. It doesn't have an HTTP API and everything needs to be configured through vbash afaik.

numpad0 3y ago

But what'd you do with Ansible on a router? Looks like VyOS has REST API and OpenFlow support, btw.

da768 3y ago

1.4 has config sync and a REST API coming in