Release Notes: Secure Provisioning for NetOps Automation

To upgrade to the latest version of Secure Provisioning, refer to this article.

Known Issues

• When upgrading to version 2.2.0 or later from a version earlier than 2.2.0, all resource files will be redeployed to nodes on first push
• From version 2.2.0, pushing git resources as the root user is no longer supported, the git user should now be used instead
• After unenrolling an Operations Manager from Lighthouse, Secure Provisioning containers must be stopped manually
• If upgrading Lighthouse to version 19.Q2.0 with Secure Provisioning activated and no access to Docker Hub, offline module upgrade must be performed

Fixes and Features by Version

2.3.0 (November, 2019)

The release includes new features and bug fixes for the Secure Provisioning module. The minimum required versions for Lighthouse and nodes are:

• Lighthouse: 19.Q2.0 (bundles Secure Provisioning 1.2.0 by default)
• Operations Manager: om22xx-19.Q2.0
• Console Server: acm700x-4.5.0, acm7004-5-4.5.0, im72xx-4.5.0

Changes:

• Add support for configuring static address on Operations Manager provisioning interface
• Stop ZTP services running before resources are pushed on Operations Manager
• Fix central DNS access for provisioned devices
• Fix hardcoded interface name in NetOps deployment firewall rules

2.2.0 (October, 2019)

The release includes new features and bug fixes for the Secure Provisioning module. The minimum required versions for Lighthouse and nodes are:

• Lighthouse: 19.Q2.0 (bundles Secure Provisioning 1.2.0 by default)
• Operations Manager: om22xx-19.Q2.0
• Console Server: acm700x-4.5.0, acm7004-5-4.5.0, im72xx-4.5.0

Changes:

• Added support for Cisco IOS XE provisioning over HTTP and Guest Shell ZTP scripts
• Added restricted 'git' user
• Added API support for deactivating Secure Provisioning on a node
• Added support for configuring node firewall via Operations Manager API
• Secure Provisioning no longer activates nodes automatically on enrollment
• Reduced verbosity of NetOps container logs
• Integrated offline NetOps installer into NetOps deployment container
• No longer serve DHCP addresses to devices not being provisioned by Secure Provisioning

2.0.0 (June, 2019)

The release includes new features and bug fixes for the Secure Provisioning module. The minimum required versions for Lighthouse and nodes are:

• Lighthouse: 19.Q2.0 (bundles Secure Provisioning 1.2.0 by default)
• Operations Manager: om22xx-18.Q4.0
• Console Server: acm700x-4.4.1, acm7004-5-4.4.1, im72xx-4.4.1

Changes:

• Add support for provisioning Cisco IOS XE and Cisco NX-OS devices
• Add SSH key template variable to allow provisioning scripts to access devices from the Opengear node
• Dynamically determine provisioning interface on Operations Manager based on network configuration
• Add HTTP support for device provisioning on ACM7xxx and IM72xx nodes
• Fix NetOps ports listening externally on Lighthouse
• Fix HTTP timeout when serving large files on Operations Manager
• Fix provisioning configuration being overridden by system changes on ACM7xxx and IM72xx
• Fix creating a Node Inventory without specifying a Smart Group

1.2.0 (May, 2019)

The release includes new features and bug fixes for the Secure Provisioning module. The minimum required versions for Lighthouse and nodes are:

• Lighthouse: 19.Q2.0 (bundles Secure Provisioning 1.2.0 by default)
• Operations Manager: om22xx-18.Q4.0
• Console Server: acm700x-4.4.1, acm7004-5-4.4.1, im72xx-4.4.1

Changes:

• Added support for IM7200 and ACM7000 products as provisioning nodes
• Added support for OM2224-24E as provisioning nodes
• Updated to support Operations Manager new firewall framework (firewalld)
• Only show Secure Provisioning activated nodes on Static Inventory page

1.1.1 (January, 2019)

The release includes bug fixes for the Secure Provisioning module. The minimum required versions for Lighthouse and Operations Manager are:

• Lighthouse: 5.2.2 (bundles Secure Provisioning 1.0.0 by default)
• Operations Manager: om22xx-18.Q3.0

Changes:

• Add UI warning when resource bundle filenames conflict with existing files
• Updated template variables for referencing the netmask
• Fixed bug with templated resource filenames being offered with .j2 extension still intact

1.1.0 (November, 2018)

The release includes new features and bug fixes for the Secure Provisioning module. The minimum required versions for Lighthouse and Operations Manager are:

• Lighthouse: 5.2.2 (bundles Secure Provisioning 1.0.0 by default)
• Operations Manager: om22xx-18.Q3.0

Changes:

• Add support for Operations Manager acting as NTP and syslog server for provisioned devices
• Add device information such as allocated DHCP address to available resource template variables
• Prefer HTTP to TFTP as ZTP file transfer method for vendors that support it
• Consolidate downloads and templates directories into a single downloads directory for CLI workflow
• Only restart Operations Manager provisioning services as strictly necessary
• Add support for creating model-specific resource bundles for Opengear devices, and support ZTP enrollment into Lighthouse
• Improve performance of resource push
• Improve performance of node module upgrade
• Fix long Docker operations timing out during deployment
• Fix known issue with Cisco IOS XR file retrieval
• Remove built-in Push to all nodes / 'all' resource distribution policy
• Ignore any DHCP client requests originating from Operations Manager's provisioning interface

1.0.0 (September, 2018)

This is the first generally available release for the Secure Provisioning module for NetOps Automation. This includes and improves upon all functionality in the beta release. The minimum required versions for Lighthouse and Operations Manager are:

• Lighthouse: 5.2.2
• Operations Manager: om22xx-18.Q3.0

Changes:

• Add per-user resource and inventory separation for Node Admin privileged users, including tiered deployment strategies for resources
• Add remote logging to Lighthouse and Operations Manager systems for ZTP services
• Add support for file serving over HTTP(S) in place of TFTP
• Add output from git deployment process displayed to users
• Rename Day One Provisioning module to Secure Provisioning module, which currently provides the Device Provisioning feature

1.0.0b1 (June, 2018)

This is the first beta release for the NetOps Automation platform and its NetOps Modules. This release is intended for beta testing by select users. The minimum required versions for Lighthouse and Operations Manager are:

• Lighthouse: 5.2.2b1
• Operations Manager: om22xx-18.Q2.0b1

Changes:

• The Day One Provisioning NetOps module provides a platform to distribute resources and configuration (ZTP) to devices managed by the Lighthouse 5 platform and connected to an Operations Manager
• First-class support for provisioning the following vendors: Opengear, Arista, Aruba, Cisco IOS, Cisco IOS-XR, Cumulus, Huawei, Juniper, and Pico8 – see the individual vendor documentation for supported ZTP operations
• Workflows for NetOps configuration and push supported via git and Web UI
• Docker engine integrated with the Lighthouse and Operations Manager platforms
• DNS and DHCP via the Operations Manager for managed devices
• Access to configured networks from managed devices via the secure Lighthouse VPN tunnel