Skip to content

Repository files navigation

GO-ANTA - Golang Network Test Automation Framework

go-anta (Golang ANTA) is a high-performance network testing framework inspired by the Python ANTA project. It provides automated testing capabilities for network devices, particularly Arista EOS devices, with support for concurrent test execution, flexible inventory management, Netbox integration, and comprehensive reporting.

🚀 Features

  • High Performance: Concurrent test execution across multiple devices with configurable parallelism
  • Dynamic Inventory: Native Netbox integration for source-of-truth driven testing
  • Flexible Device Targeting: Advanced filtering with hostname, wildcard, range, and index-based selection
  • Multiple Output Formats: Table, CSV, JSON, and Markdown reporting
  • Smart Caching: Command result caching to reduce device load and improve performance
  • Comprehensive Logging: Structured logging with configurable levels for troubleshooting
  • Dry Run Mode: Preview operations without making changes
  • Secure: TLS support with certificate validation options
  • Modular Architecture: Pluggable test system with easy-to-extend design

Table of Contents

Installation

Prerequisites

  • Go 1.21 or later
  • Access to Arista EOS devices with eAPI enabled
  • Optional: Netbox instance for dynamic inventory

Building from Source

# Clone the repository
git clone https://github.com/fluidstackio/go-anta.git
cd go-anta
# Build the binary
make build
# Verify installation
./bin/go-anta --help

Quick Start

Option 1: Static Inventory File

  1. Create an inventory file (inventory.yaml):
devices:
- name: "leaf1"host: "192.168.1.10"username: "admin"password: "admin123"tags: ["leaf", "datacenter"]insecure: true # Skip TLS verification for lab environments
  1. Create a test catalog (catalog.yaml):
tests:
- name: "VerifyUptime"module: "system"inputs:
minimum_uptime: 3600# 1 hour in seconds
  1. Run the tests:
./bin/go-anta nrfu -i inventory.yaml -C catalog.yaml

Option 2: Netbox Dynamic Inventory

# Set environment variablesexport NETBOX_URL=https://netbox.example.com
export NETBOX_TOKEN=$TOKENexport DEVICE_USERNAME=admin
export DEVICE_PASSWORD=admin123
# Run tests directly from Netbox
./bin/go-anta nrfu \
--netbox-query "site=datacenter1,platform=eos" \
-C catalog.yaml

Inventory Management

View and Verify Inventory

Before running tests, preview your inventory to ensure the correct devices are targeted:

# Show inventory from file
./bin/go-anta inventory -i inventory.yaml
# Show inventory from Netbox
./bin/go-anta inventory \
--netbox-url https://netbox.example.com \
--netbox-token $TOKEN \
--netbox-query "site=dc1"# Show inventory with additional metadata
./bin/go-anta inventory -i inventory.yaml --show-tags --show-extra
# Export inventory in different formats
./bin/go-anta inventory -i inventory.yaml -f json
./bin/go-anta inventory -i inventory.yaml -f yaml
./bin/go-anta inventory -i inventory.yaml -f count # Just show device count

Real-World Example

# Verify Netbox query returns expected devices
./bin/go-anta inventory \
--netbox-url https://netbox.fluidstack.io \
--netbox-token $TOKEN \
--netbox-query "site_id=14&manufacturer_id=35&platform_id=5" \
--show-tags
# Export Netbox devices to static inventory file
./bin/go-anta inventory \
--netbox-url https://netbox.example.com \
--netbox-token $TOKEN \
--netbox-query "site=dc1&status=active" \
-f yaml > netbox-devices.yaml

Device Connectivity

Check Device Connectivity

Verify devices are reachable before running tests:

# Check connectivity to devices in inventory
./bin/go-anta check -i inventory.yaml
# Dry-run mode - show inventory without connecting
./bin/go-anta check -i inventory.yaml --no-connect
# Check devices from Netbox
./bin/go-anta check \
--netbox-url https://netbox.example.com \
--netbox-token $TOKEN \
--netbox-query "site=dc1"# Override credentials
./bin/go-anta check -i inventory.yaml \
--device-username admin \
--device-password newpassword

Example Output:

Checking 3 devices...
Checking leaf1 (192.168.1.10)... ✅ Connected (Model: DCS-7050SX-64)
Checking leaf2 (192.168.1.11)... ✅ Connected (Model: DCS-7050SX-64) Checking spine1 (192.168.1.1)... ❌ Failed: connection timeout
Summary: 2 successful, 1 failed

Running Tests

Network Ready For Use (NRFU) Command

The nrfu command is the primary testing interface:

# Dry-run to see what would be tested
./bin/go-anta nrfu -i inventory.yaml -C catalog.yaml --dry-run
# Run actual tests
./bin/go-anta nrfu -i inventory.yaml -C catalog.yaml
# Run with verbose logging
./bin/go-anta nrfu -i inventory.yaml -C catalog.yaml -v
# Run with specific concurrency
./bin/go-anta nrfu -i inventory.yaml -C catalog.yaml -j 20

NRFU Command Options

OptionShortDescriptionExample
--inventory-iInventory file path-i devices.yaml
--catalog-CTest catalog file path (required)-C tests.yaml
--netbox-urlNetbox URL (or use NETBOX_URL env var)--netbox-url https://netbox.example.com
--netbox-tokenNetbox API token (or use NETBOX_TOKEN env var)--netbox-token abc123
--netbox-queryNetbox query filter--netbox-query "site=dc1,role=leaf"
--device-usernameDevice username override--device-username admin
--device-passwordDevice password override--device-password secret
--tags-tFilter devices by tags-t production,spine
--devices-dFilter specific devices-d leaf1,leaf2
--limitAdvanced device limiting--limit "leaf*"
--tests-TFilter specific tests-T VerifyBGPPeers
--concurrency-jMax concurrent connections-j 20
--format-fOutput format-f json
--output-oOutput file path-o results.json
--hideHide results by status--hide success,skipped
--dry-runShow what would run without executing--dry-run
--ignore-statusAlways return exit code 0--ignore-status
--verbose-vEnable verbose logging-v
--log-levelSet specific log level--log-level debug

Netbox Integration

go-anta provides native integration with Netbox for dynamic inventory management.

Environment Variables

export NETBOX_URL=https://netbox.example.com
export NETBOX_TOKEN=$TOKENexport NETBOX_INSECURE=true # Skip TLS verification if neededexport DEVICE_USERNAME=admin
export DEVICE_PASSWORD=admin123
export DEVICE_ENABLE_PASSWORD=enable123 # Optional

Netbox Query Syntax

go-anta supports two query formats:

1. URL Parameter Format (Precise)

Use exact Netbox API parameters with IDs:

# Query by IDs (most precise)
--netbox-query "site_id=14&manufacturer_id=35&platform_id=5"# Mix IDs and other filters
--netbox-query "site_id=14&platform=eos&status=active"# Complex queries
--netbox-query "site_id=14&manufacturer_id=35&platform_id=5&role_id=12&status=active"

2. Comma-Separated Format (Human-Friendly)

Use slug-based filtering:

# Filter by site and platform
--netbox-query "site=datacenter1,platform=eos"# Filter by multiple criteria
--netbox-query "site=dc1,role=leaf,manufacturer=arista,status=active"# Filter by tags
--netbox-query "site=dc1,tag=production"

Supported Netbox Fields

FieldSlug FormatID FormatDescription
Sitesite=slugsite_id=123Site location
Rolerole=slugrole_id=123Device role
Device Typedevice_type=slugdevice_type_id=123Hardware model
Manufacturermanufacturer=slugmanufacturer_id=123Device manufacturer
Platformplatform=slugplatform_id=123Network OS platform
Statusstatus=activeDevice status
Tenanttenant=slugtenant_id=123Tenant assignment
Regionregion=slugregion_id=123Geographic region
Namename=hostnameExact hostname match
Name Containsname_contains=textHostname substring
Tagstag=productionDevice tags

Real-World Netbox Examples

# Test all leaf switches in a specific datacenter
./bin/go-anta nrfu \
--netbox-url https://netbox.fluidstack.io \
--netbox-token $NETBOX_TOKEN \
--netbox-query "site_id=14&role=leaf&status=active" \
-C catalog.yaml
# Test all Arista devices in production
./bin/go-anta nrfu \
--netbox-url https://netbox.fluidstack.io \
--netbox-token $NETBOX_TOKEN \
--netbox-query "manufacturer=arista,tag=production" \
-C catalog.yaml \
--hide success
# Dry-run with device preview
./bin/go-anta nrfu \
--netbox-url https://netbox.fluidstack.io \
--netbox-token $NETBOX_TOKEN \
--netbox-query "site_id=14&manufacturer_id=35&platform_id=5" \
-C catalog.yaml \
--dry-run
# Test specific tenant's devices
./bin/go-anta nrfu \
--netbox-url https://netbox.fluidstack.io \
--netbox-token $NETBOX_TOKEN \
--netbox-query "tenant=customer1,status=active" \
-C catalog.yaml \
--device-username customer1_admin \
--device-password customer1_pass

Device Filtering

go-anta provides powerful device filtering capabilities to target specific subsets of your inventory.

Basic Filtering

# Filter by device names
./bin/go-anta nrfu -i inventory.yaml -C catalog.yaml -d "leaf1,leaf2,spine1"# Filter by tags
./bin/go-anta nrfu -i inventory.yaml -C catalog.yaml -t "production,spine"# Combine multiple filters
./bin/go-anta nrfu -i inventory.yaml -C catalog.yaml -d "leaf1,leaf2" -t "production"

Advanced Limit Filtering

The --limit flag provides sophisticated device selection:

1. Single Hostname

# Target specific device
./bin/go-anta nrfu \
--netbox-query "site_id=14" \
--limit "wdl-200-50-r101-eth-leaf-01" \
-C catalog.yaml

2. Comma-Separated List

# Target multiple specific devices
./bin/go-anta nrfu \
--netbox-query "site_id=14" \
--limit "leaf01,leaf02,spine01" \
-C catalog.yaml

3. Index-Based Selection

# Target first device (index 0)
./bin/go-anta nrfu \
--netbox-query "site_id=14" \
--limit "0" \
-C catalog.yaml
# Target third device (index 2)
./bin/go-anta nrfu \
--netbox-query "site_id=14" \
--limit "2" \
-C catalog.yaml

4. Range-Based Selection

# Target first 3 devices (indices 0-2)
./bin/go-anta nrfu \
--netbox-query "site_id=14" \
--limit "0-2" \
-C catalog.yaml
# Target devices 5-10
./bin/go-anta nrfu \
--netbox-query "site_id=14" \
--limit "4-9" \
-C catalog.yaml

5. Wildcard Patterns

# Target all leaf switches
./bin/go-anta nrfu \
--netbox-query "site_id=14" \
--limit "leaf*" \
-C catalog.yaml
# Target all devices containing "spine"
./bin/go-anta nrfu \
--netbox-query "site_id=14" \
--limit "*spine*" \
-C catalog.yaml
# Target devices with specific pattern
./bin/go-anta nrfu \
--netbox-query "site_id=14" \
--limit "dc1-*-leaf-*" \
-C catalog.yaml

Filtering Workflow Examples

# Step 1: Preview inventory
./bin/go-anta inventory \
--netbox-query "site_id=14&manufacturer_id=35" \
--show-tags
# Step 2: Target specific devices for testing
./bin/go-anta nrfu \
--netbox-query "site_id=14&manufacturer_id=35" \
--limit "*leaf*" \
-C catalog.yaml \
--dry-run
# Step 3: Run actual tests
./bin/go-anta nrfu \
--netbox-query "site_id=14&manufacturer_id=35" \
--limit "*leaf*" \
-C catalog.yaml

Test Catalog

Test Structure

Each test in the catalog follows this structure:

tests:
- name: "TestName"# Must match test implementationmodule: "module_name"# Test module (connectivity, hardware, routing, system)categories: ["category"] # Optional: for grouping and filteringtags: ["tag"] # Optional: for additional filteringinputs: # Test-specific parametersparameter1: value1parameter2: value2

Example Comprehensive Catalog

tests:
# System Health Tests
- name: "VerifyUptime"module: "system"categories: ["health"]inputs:
minimum_uptime: 86400# 24 hours
- name: "VerifyEOSVersion"module: "system"categories: ["compliance"]inputs:
minimum_version: "4.25.0"
- name: "VerifyNTP"module: "system"categories: ["time"]inputs:
servers:
- server: "0.pool.ntp.org"synchronized: true# Hardware Tests
- name: "VerifyTemperature"module: "hardware"categories: ["environmental"]inputs:
check_temp_sensors: truefailure_margin: 5
- name: "VerifyTransceivers"module: "hardware"categories: ["optics"]inputs:
check_manufacturer: truecheck_temperature: true# Connectivity Tests 
- name: "VerifyReachability"module: "connectivity"categories: ["basic"]inputs:
hosts:
- destination: "8.8.8.8"vrf: "default"reachable: truerepeat: 2
- name: "VerifyLLDPNeighbors"module: "connectivity"categories: ["topology"]inputs:
interfaces:
- interface: "Ethernet1"neighbor_device: "spine1"neighbor_port: "Ethernet1"# Routing Tests
- name: "VerifyBGPPeers"module: "routing"categories: ["bgp"]inputs:
peers:
- peer: "10.0.0.1"state: "Established"asn: 65001

Output Formats

Table Format (Default)

Clean, readable format perfect for console output:

./bin/go-anta nrfu -i inventory.yaml -C catalog.yaml
Device Test Status Message Duration
------------------------------------------------------------------------
leaf1 VerifyUptime ✅ SUCCESS - 0.15s
leaf1 VerifyBGPPeers ❌ FAILURE Peer 10.0.0.1 down 0.23s
leaf2 VerifyUptime ✅ SUCCESS - 0.12s
------------------------------------------------------------------------
Summary: Total: 3 | Success: 2 | Failure: 1 | Error: 0 | Skipped: 0

JSON Format

Structured data perfect for automation and integration:

./bin/go-anta nrfu -i inventory.yaml -C catalog.yaml -f json -o results.json
{
"results": [
{
"test_name": "VerifyUptime",
"device_name": "leaf1",
"status": 1,
"message": "",
"duration": 150000000,
"timestamp": "2024-01-15T10:30:00Z",
"categories": ["system"]
}
],
"statistics": {
"total": 3,
"success": 2,
"failure": 1,
"error": 0,
"skipped": 0
}
}

CSV Format

Great for spreadsheet analysis:

./bin/go-anta nrfu -i inventory.yaml -C catalog.yaml -f csv -o results.csv

Markdown Format

Perfect for documentation and reports:

./bin/go-anta nrfu -i inventory.yaml -C catalog.yaml -f markdown -o report.md

Filtering Output

# Hide successful tests to focus on issues
./bin/go-anta nrfu -i inventory.yaml -C catalog.yaml --hide success
# Hide successful and skipped tests
./bin/go-anta nrfu -i inventory.yaml -C catalog.yaml --hide success,skipped
# Show only failures and errors
./bin/go-anta nrfu -i inventory.yaml -C catalog.yaml --hide success,skipped

Logging and Debugging

Log Levels

By default, go-anta only shows warnings and errors. Enable more detailed logging as needed:

# Quiet mode (warnings and errors only) - default
./bin/go-anta nrfu -i inventory.yaml -C catalog.yaml
# Verbose mode (debug level)
./bin/go-anta nrfu -i inventory.yaml -C catalog.yaml -v
# Specific log levels
./bin/go-anta nrfu -i inventory.yaml -C catalog.yaml --log-level info
./bin/go-anta nrfu -i inventory.yaml -C catalog.yaml --log-level debug
./bin/go-anta nrfu -i inventory.yaml -C catalog.yaml --log-level error

Debugging Connection Issues

# Enable verbose logging to see connection details
./bin/go-anta check -i inventory.yaml -v
# Test connectivity to specific device
./bin/go-anta check -i inventory.yaml --limit "problematic-device" -v
# Debug with maximum logging
./bin/go-anta nrfu -i inventory.yaml -C catalog.yaml --limit "device1" --log-level debug

Log Output Examples

Default (Warning level):

Summary: 2 successful, 0 failed

Verbose mode:

time="14:51:56" level=info msg="Connecting to device leaf1 (192.168.1.10:443)"
time="14:51:56" level=debug msg="Creating HTTP request for leaf1 to https://192.168.1.10:443/command-api"
time="14:51:56" level=info msg="Successfully connected to leaf1 (Model: DCS-7050SX-64)"

Available Tests

System Tests

VerifyEOSVersion

Validates EOS software version meets requirements.

- name: "VerifyEOSVersion"module: "system"inputs:
minimum_version: "4.25.0"# Minimum acceptable version# OR specify exact versions:versions:
- "4.28.0F"
- "4.27.3F"

VerifyUptime

Ensures system uptime meets minimum requirements.

- name: "VerifyUptime"module: "system"inputs:
minimum_uptime: 86400# Seconds (24 hours)

VerifyNTP

Verifies NTP synchronization status and server configuration.

- name: "VerifyNTP"module: "system"inputs:
servers:
- server: "0.pool.ntp.org"synchronized: truestratum: 2# Optional max stratum

Hardware Tests

VerifyTemperature

Monitors system temperature sensors for overheating conditions.

- name: "VerifyTemperature"module: "hardware"inputs:
check_temp_sensors: truefailure_margin: 5# Degrees from overheat threshold

VerifyTransceivers

Validates optical transceiver health and specifications.

- name: "VerifyTransceivers"module: "hardware"inputs:
check_manufacturer: truemanufacturers:
- "Arista Networks"
- "Finisar"check_temperature: truecheck_voltage: true

VerifyInventory

Verifies hardware inventory meets minimum specifications.

- name: "VerifyInventory"module: "hardware"inputs:
minimum_memory: 8192# MBminimum_flash: 4096# MBrequired_modules:
- "DCS-7280SR-48C6"

Connectivity Tests

VerifyReachability

Tests network connectivity to specified destinations.

- name: "VerifyReachability"module: "connectivity"inputs:
hosts:
- destination: "8.8.8.8"vrf: "default"# Optional, defaults to "default"reachable: true # Expected reachability state
- destination: "192.168.255.1"vrf: "management"reachable: truerepeat: 2# Optional: number of pingssize: 100# Optional: packet size in bytes

VerifyLLDPNeighbors

Validates LLDP neighbor relationships and topology.

- name: "VerifyLLDPNeighbors"module: "connectivity"inputs:
interfaces:
- interface: "Ethernet1"neighbor_device: "spine1"neighbor_port: "Ethernet1"
- interface: "Ethernet2"neighbor_device: "spine2"neighbor_port: "Ethernet1"

Routing Tests

VerifyBGPPeers

Validates BGP peer status and configuration.

- name: "VerifyBGPPeers"module: "routing"inputs:
peers:
- peer: "10.0.0.1"state: "Established"asn: 65001vrf: "default"# Optional VRF
- peer: "10.0.0.2"state: "Established"asn: 65002

VerifyOSPFNeighbors

Verifies OSPF neighbor adjacencies and states.

- name: "VerifyOSPFNeighbors"module: "routing"inputs:
neighbors:
- interface: "Ethernet1"state: "Full"router_id: "1.1.1.1"# Optional router ID verificationinstance: "1"# Optional OSPF instance

VerifyStaticRoutes

Validates static route configuration and next-hops.

- name: "VerifyStaticRoutes"module: "routing"inputs:
routes:
- prefix: "0.0.0.0/0"next_hop: "192.168.1.1"vrf: "default"
- prefix: "10.0.0.0/8"next_hop: "192.168.1.2"vrf: "default"

Configuration

Static Inventory Configuration

Create detailed device inventories with flexible credential management:

# inventory.yamldevices:
- name: "spine1"host: "10.0.0.1"port: 443# Default: 443username: "admin"password: "admin123"enable_password: "enable123"# Optionaltags: ["spine", "production"]timeout: "30s"# Default: 30sinsecure: false # Default: false# Network-based discoverynetworks:
- network: "192.168.100.0/24"username: "admin"password: "admin123"tags: ["management"]insecure: true# Range-based discovery ranges:
- start: "10.0.1.1"end: "10.0.1.10"username: "admin"password: "admin123"tags: ["lab"]

Application Configuration

Create .go-anta.yaml for application-wide settings:

# .go-anta.yamllog:
level: "info"# debug, info, warn, errorfile: "go-anta.log"# Optional log fileformat: "text"# text, jsondevice:
timeout: "30s"max_connections: 100retry_attempts: 3retry_delay: "5s"test:
max_concurrency: 10cache_ttl: "60s"cache_size: 128reporter:
default_format: "table"output_file: ""netbox:
url: "https://netbox.example.com"token: "your-token-here"insecure: falsetimeout: "30s"

Environment Variables

go-anta supports extensive environment variable configuration:

# Netbox Configurationexport NETBOX_URL=https://netbox.example.com
export NETBOX_TOKEN=your-api-token
export NETBOX_INSECURE=true
# Device Credentialsexport DEVICE_USERNAME=admin
export DEVICE_PASSWORD=admin123
export DEVICE_ENABLE_PASSWORD=enable123
# Application Settings (prefix with go-anta_)export go-anta_LOG_LEVEL=debug
export go-anta_DEVICE_TIMEOUT=60s
export go-anta_TEST_CONCURRENCY=20

Troubleshooting

Common Connection Issues

  1. Connection Timeouts

    # Increase timeout
    ./bin/go-anta check -i inventory.yaml --log-level debug
  2. TLS Certificate Errors

    # In inventory filedevices:
    - name: "device1"host: "192.168.1.10"insecure: true # Skip certificate verification
  3. Authentication Failures

    # Override credentials
    ./bin/go-anta check -i inventory.yaml \
    --device-username admin \
    --device-password newpassword
  4. Netbox Query Issues

    # Test query separately
    ./bin/go-anta inventory \
    --netbox-url $NETBOX_URL \
    --netbox-token $NETBOX_TOKEN \
    --netbox-query "your-query" \
    -f count

Debug Network Connectivity

Use the included debug tools:

# Build debug tool
go build -o debug cmd/debug/main.go
# Test network connectivity
./debug 192.168.1.10

Performance Tuning

# Increase concurrency for faster execution
./bin/go-anta nrfu -i inventory.yaml -C catalog.yaml -j 50
# Reduce concurrency for stability
./bin/go-anta nrfu -i inventory.yaml -C catalog.yaml -j 5
# Use caching to improve performance# (Enabled by default, disable with --no-cache if needed)

Contributing

Contributions are welcome! This project follows standard Go development practices:

  1. Fork the repository
  2. Create a feature branch
  3. Add tests for new functionality
  4. Ensure all tests pass
  5. Submit a pull request

Development Setup

git clone https://github.com/fluidstackio/go-anta.git
cd go-anta
go mod tidy
make test
make build

License

This project is licensed under the MIT License - see the LICENSE file for details.

Acknowledgments

  • Inspired by the ANTA project from the Arista community
  • Built for the Arista EOS platform and ecosystem
  • Special thanks to the network automation community for their contributions and feedback

Real-World Usage Examples

Production Network Validation

# Full production spine-leaf validation
./bin/go-anta nrfu \
--netbox-url https://netbox.fluidstack.io \
--netbox-token $PROD_TOKEN \
--netbox-query "site=prod-dc1,status=active" \
-C production-catalog.yaml \
-j 25 \
--format json \
--output prod-validation-$(date +%Y%m%d).json \
--hide success

Staging Environment Testing

# Quick staging verification
./bin/go-anta nrfu \
--netbox-query "site=staging,tag=ready-for-prod" \
-C staging-catalog.yaml \
--limit "*leaf*" \
-v

Maintenance Window Validation

# Pre-maintenance check
./bin/go-anta check \
--netbox-query "site=dc1,tenant=customer1" \
--device-username maint_user \
--device-password $MAINT_PASSWORD# Post-maintenance validation 
./bin/go-anta nrfu \
--netbox-query "site=dc1,tenant=customer1" \
-C post-maint-catalog.yaml \
--format markdown \
--output maintenance-report.md

About

GO-ANTA (Golang ANTA) is a network testing framework inspired by the Python ANTA project. It provides automated testing capabilities for network devices, particularly Arista EOS devices, with support for concurrent test execution, flexible inventory management, and comprehensive reporting.

Resources

Stars

3 stars

Watchers

0 watching

Forks

Releases

Packages

Contributors

Languages