Changelog

v1.0.2 - 2026-10-05

  • Pin the Proxmox VMs to host cores, the UPF on its own, behind virtual.proxmox.cpu_pinning.

  • Check each Proxmox node’s CPU topology before deploying on it.

  • Document per server the VM sizing and which host NICs carry each VM interface.

  • Discover the release of the Juniper switches before deploying and use the junos-ex conf/root namespaces from Junos 24.2.

v1.0.1 - 2026-09-22

  • Offer the blueprints of the loaded model as suggested values of the blueprint attribute, so they no longer have to be typed from memory. A blueprint registers itself next to its implementation with an athonet_mpn::blueprint::Blueprint, which also says what it deploys and which deployments offer it: the lab blueprints of this module say lab, and a deployment shows the ones matching blueprints.environment of its configuration, production unless it says otherwise. Registering is a suggestion and nothing more: an unregistered blueprint deploys exactly as before, it is only absent from the list. Where the orchestrator is recent enough to render them (ISO 9.3.0 and up), the description is shown next to the name and the name is what the service gets; older ones are handed the plain names, which is what they understand.

  • Pick the remote location of the IPSec tunnels per uplink peering endpoint, so that one uplink reaches one datacenter per site. Two firewalls behind a single switch share one port and one vlan, which cannot be split into two peerings because the vlan would be a duplicate. The remote_location of the endpoint wins, the one on the peering is deprecated and says the same thing for all of its endpoints, and a null on both is still the first remote location of the configuration, so existing instances keep the datacenter they have without an attribute rewrite.

  • Authenticate the prometheus remote writes of the core virtual machines with basic auth. A remote write, configured or annotated, can carry a secret_reference naming its credentials in the inventory: the name of the secret is the username and its value the password. Both are resolved when the metrics configuration is deployed, off a single lookup, so the credential is never read by the compiler and never written to the desired state, and it is only ever read, never generated, so a remote write is never configured with something the receiving end has not seen.

  • Let services annotate the metrics of a virtual machine, by adding an athonet_mpn::blueprint::MonitoringAnnotation to it. An annotation carries extra prometheus external labels next to the ones the configuration defines, and extra remote write destinations next to the ones every core virtual machine already gets, for a destination that depends on the service and so cannot be written down in the configuration. All annotations on one virtual machine are merged. See docs/monitoring.md.

  • Render the external label templates with the network function and the blueprint virtual machine in scope as well, so a label can differ per virtual machine. Until now only the Core and the blueprint were available, which cover the whole set of core virtual machines at once.

v1.0.0 - 2026-09-11

  • Name the egress interface on the bootstrap default route of a firewall: FortiOS refuses to create a static route without device, so the route could only be updated, never created.

  • Support blueprint vSwitches that already exist on the hypervisor (VSwitch.managed) and vSwitches without an aggregated uplink (VSwitch.lacp). See docs/proxmox.md.

  • Let services set inventory custom fields and tags on the switches, servers and virtual machines, by adding an athonet_mpn::blueprint::InventoryAnnotation to the network element. All annotations on one element are merged, so several services can annotate the same object, and an element nobody annotates is sent to the inventory exactly as it is today. The custom fields and the tags have to exist in the inventory already. See docs/inventory.md.

  • Order the provisioning restore after the network function’s own config write. Both the config restore and the mgmt/config write reinitialize the data layer, but only the former was ordered before the restore, so on a run where the config write happened to land after it the restored subscriber data was silently wiped. Nothing failed: every resource deployed correctly and the service reached up, which is why the nightly upgrade test caught it only through its check on the provisioned data.

  • Configure the default gateway of the ESXi servers, so they stay reachable once they leave the out-of-band network they were staged on. A server was only ever given a gateway on its OAM vmkernel nic, which ESXi treats as an override for the services egressing through that nic and never as the host’s default route, so the host had no default route at all and could only answer hosts in a subnet it is directly attached to. The gateway is the IRB of the site management network and is configured once the service leaves a bootstrap state, which is when the orchestrator starts reaching the server over that network.

  • Give a Proxmox node its default gateway on the bridge that carries its management address, once the service leaves a bootstrap state, so its own egress moves over the in-band OAM network at the same cutover as everything else. A node fetches its own VM images, and the out-of-band link is only a staging network while the setup is being built: afterwards it is an LTE connection at the customer site, which is no place for an upgrade to pull an image over. This needs a node whose own management bridge was installed without a gateway, as docs/proxmox.md already required, because PVE accepts exactly one.

  • Configure the DNS resolvers of the ESXi servers, from the new virtual.esxi.dns config option. The servers were left without a resolver. Their search and domain name come from virtual.esxi.dns_search, which defaults to the domain.local the orchestrator used to hard-code, so a server that is already deployed keeps the domain name it has.

  • Remove the switch configuration of a deleted peering. Its VLAN, IRB unit, routing instance interface, BGP neighbour and static routes go with the peering, a trunk or access port goes once no peering uses it anymore and a LAG, together with the bundling of its member ports, goes once its last peering is removed.

  • Configure lo0.0 on the Junos switches from the new switch.loopback_address config option (127.0.0.10/32 by default), so show ntp associations reports the NTP peers.

  • Fix the FortiGate admin password change on FortiOS 7.6, which failed indefinitely with a 500 on change-password/select. A set password in the boot config no longer takes effect there, so a fresh firewall keeps the factory-empty admin password instead of the one the boot config asked for. Send an empty old password and drop the boot config block that has no effect. This makes the firewall bootstrap 7.6-only.

  • Deploy a BGP neighbour’s export prefix list before the BGP configuration that uses it.

  • Fix an upgrade losing the provisioned subscriber data of the core site being upgraded.

  • Create the IPsec VPN address groups only once their member addresses exist.

  • Make the network function VM memory configurable through a new virtual.vm_memory config section (control_plane, user_plane, firewall and ims, in MB). The defaults keep the previous sizing (16384/8192/4096/16384).

  • Add a Proxmox VE virtualization backend (athonet_mpn::domain::virtual::proxmox) next to the ESXi backend, selected per server through the blueprint Server.hypervisor attribute. Adds a virtual.proxmox config section, a qcow2_url to the version config and Proxmox variants of the lab blueprints. Upgrading the firewall VM is not supported on Proxmox. See docs/proxmox.md.

v0.11.6 - 2026-08-18

  • Tolerate a failed documentation update when the service is concurrently being updated.

  • Fix the Junos chassis aggregated-devices ethernet device-count: derive it from the highest ae index in use plus a headroom of 2, instead of from the number of LAGs.

v0.11.5 - 2026-06-22

  • Fix BFD not being configured on external peerings when enable_bfd is set: the peering BGP group passed enable_bfd but left the BFD timers unset, while the Junos neighbor implementation only emits bfd-liveness-detection when a bfd_minimum_interval is present. The group now applies the switch.juniper.bfd_minimum_interval/bfd_minimum_receive_interval/bfd_multiplier config values when enable_bfd is enabled. The internal firewall/switch peerings are unaffected.

  • Default inventory.netbox.version to 4.4 instead of 4.1: the netbox adapter dropped 4.1 support, and netbox >= 4.2 serializes prefix/VLAN scope with scope_type/scope_id instead of site. The lab runs netbox 4.4.

  • Allow a null firewall.entitlement.end_date: the firewall license end date is then not managed by the orchestrator and the entitlement follows the FortiFlex program end date (managed through program renewals). Requires inmanta-module-fortigate >= 1.0.6 with optional Entitlement.end_date.

  • Configure the Netbox-Secrets RSA key pair location explicitly instead of deriving it from the state dir of the process resolving the secret: the new inventory.netbox.rsa_key_dir config option (default /var/lib/inmanta/rsa_keys) is set on the netbox credentials and carried inside the exported secret references, so executors resolve secrets against the right key pair regardless of the inmanta-core state-dir layout. The RegenerateFirewallToken handler and the password/secret-role plugins use the same option, replacing the iso7/iso8 state-dir guessing. Requires inmanta-module-netbox >= 4.6.1.

v0.11.4 - 2026-06-02

  • Deploy Athonet core licenses on a dedicated agent (the VM name with a _license suffix), so the slow license fetch/activation no longer blocks the deployment of other resources on the VM

  • Migrate netbox secret references to the new netbox::create_secret_reference_v2 plugin

  • Set tenant on netbox racks

  • Skip the catch-all deny 0.0.0.0/0 rule on BGP export prefix-lists when the user already lists 0.0.0.0/0, avoiding a double-set on the same prefix.

v0.11.3 - 2026-03-17

  • Support duplicate lag definitions when they match

v0.11.2 - 2026-03-15

  • Fix netbox documentation when a tenant has more than one MPN deployment. Once deployed, this change will recreate a number of VRF. It is advised to use the compare function of the desired to see which renames will happen and do them manually first.

  • Improve port and lag member validation for peerings

v0.11.1 - 2026-02-26

  • Export AMF/MME service IPs of all sites

v0.11.0 - 2026-02-03

  • Use inmanta references for credentials

  • Disable spanning tree also on EX for the ISL and set a default vlan based on the config file

  • Add vlan name to the description of the irb unit interface

  • Fix the use of a LAG port in external peerings

  • Add descriptions to BGP neighbors on the switch

  • Introduce ran vrf settings under mpn_settings. This allows to export and import prefixes from the RAN into the uplink vrf (root vdom on fortigate). It has a shortcut to advertise MME settings. It fully replaces enable_ipsec_ran_access.

  • Added option to enable imei locking using the EIR service for both MME and AMF.

  • Enable IP SMS function

v0.10.6 - 2025-10-15

  • Fix upgrade validation and firewall renaming during upgrade

v0.10.5 - 2025-08-19

  • Link additional PLMN ID zones to named configuration

v0.10.4 - 2025-08-05

  • Handle correctly oob network with 32 prefixlen

  • Fix validation of IPSeC tunnel remote locations

v0.10.3 - 2025-07-09

  • Update readme to include changelog in documentation

v0.10.2 - 2025-07-08

  • Require manual action to terminate each site upgrade

  • Add support for LAG uplink peering ports

  • Allow additional vlans to be attached to interfaces via the mpn settings

  • Improve handling of out of bound ip address

v0.10.1 - 2025-06-02

  • Fix fortigate deploy ordering when deleting datanetwork

v0.10.0 - 2025-04-03

  • Added service builder extension point

  • Add firewall oob interface documentation

  • Fix update validation checks

  • Add multiple vpn endpoints support for uplink peerings

  • Add used_mgmt_prefix attribute to prevent duplicated management prefix

  • Use better inmanta orchestrator client in plugins

  • Fix fortigate interface removal when removing datanetwork

v0.9.31 - 2025-02-07

  • Allow to specifie oob network in the config

  • Fix failing athonet_core resources in upgrade_preparation

  • Add protected attribute to mpn service to prevent service interrupting updates

  • Fix uplink peering deletion

  • Fix vms not getting an ip from dhcp when booting

  • Add netbox 4.1 support (not backward compatible)

v0.9.30 - 2024-11-26

  • Enable clustering in failed state.

v0.9.29 - 2024-11-18

  • More resilient fortigate integration: don’t block ims, core and fortigate resources when fortinet is unavailable

  • Configure athonet_core api to be version aware

  • Configure athonet_ims api to be version aware

  • Make ntp servers updatable

  • Improve IMS configuration

v0.9.28 - 2024-10-25

  • Configure DNS and NTP on switches

  • Remove blackhole routes

v0.9.27 - 2024-10-21

  • Add support for multiple netbox agents

v0.9.26 - 2024-10-03

  • Export the leaked default gw to the UPF in case no firewall is used

v0.9.25 - 2024-09-24

  • Enforce apn name are lower case without spaces in the API

v0.9.24 - 2024-09-12

  • Enforce apn name are lower case without spaces

  • Make pcf scripts explicit

  • Add mermaid diagram checker for mock tests

  • Enable ims fluentbit and eventlog-manager services before configuring them

  • Allow FW management access from OAM VRF

  • Add enable_nat_traversal attribute to service uplink peerings

  • Add missing FW dependencies between vdom/address and interface/policy

  • Add mpn settings and ntp servers to mpn service attributes

  • Add deployed state after creating

  • Add peering_id index to peering

  • Add tas srv record to IMS ENUM for Athonet

v0.9.23 - 2024-07-17

  • Filter routes announced to RAN VRF when IPSec access is enabled

  • Add option to disable NAT on uplink for chosen destination prefixes

v0.9.22 - 2024-07-16

  • Add a topology with central and edge location

  • Add support for UPF allocation for slices

  • Fix VPNs on uplinks with l2 at the other site

  • Add Boot delay capability to VirtualMachines

v0.9.21 - 2024-06-24

  • Fix ims peering_id allocation

  • Include os_name/device_type in juniper config

  • Add hostname to ESXI host

  • Update documentation to include upgrade functionality

  • Allow service deletion in documentation states

  • Do not disable the backup route over the OOB interface

  • Extend support for IPSEC tunnels

v0.9.20 - 2024-06-12

  • Fix netbox support for 3.7

  • Add support for FNT inventory

v0.9.19 - 2024-06-05

  • Add the A records of functions for both sites to the DNS/ENUM function of the IMS

v0.9.18 - 2024-06-05

  • Fix firewall address resources

  • Use new retry attributes from ims and core api entity

  • Add TAS ip to the DNS/ENUM for Athonet

  • Add application 16777217 to the DRA

  • Add sh application and interface to UDM

v0.9.17 - 2024-06-03

  • Upgrade IMS support to 1.23.3.1

v0.9.16 - 2024-05-30

  • Fix route configuration when IPSec is used

  • Fix IPSec using different secrets

  • Fix wrong assertion for uplink peering (DHCP does not need to be enabled)

  • Fix wrong type for some values with juniper_ex

  • Fix PrefixList deployment loop

  • Add OAM peering and option to access the RAN from the OAM network

v0.9.15 - 2024-05-15

  • Add suggested values for Core and IMS Versions

v0.9.14 - 2024-05-15

  • Fix cycle dependencies in upgrade_preparation_failed

  • Fix issue with single switch topologies and two firewalls

v0.9.13 - 2024-05-14

  • Add peering for EXT_IMS VRF to the IMS settings

  • Fix peering static route bfd config

  • Add default token mechanism for Fortigate

  • Only configure number of lags when there are required

  • Make handling of tenant names more robust

  • Add MPN location and customer uniqueness validation

  • Allow ping on Fortigate interfaces

  • Improve Netbox documentation

v0.9.12 - 2024-05-07

  • Refactor blueprints to fix a bug in support IMS in the single switch blueprint

  • Fix IPSec configuration for Uplink peering

v0.9.11 - 2024-05-03

  • Add creating_failed state

  • DSM and NRF provisioning data are no longer backup up

  • Add constraint to the Netbox slug field

  • Fix removal of DataNetwork

  • Add oob placeholder interface on server

  • Make VRF unique in Netbox

  • Add netbox validation for location and tenant before documentation

v0.9.10 - 2024-04-22

  • Introduce os_name for switch to separate device type from os and adapter

  • Add support for changing log level

v0.9.9 - 2024-04-17

  • Fix default IPv6 GW for IMS/UPF network

v0.9.8 - 2024-04-16

  • Fix IPv6 peering between switches

v0.9.7 - 2024-04-14

  • Add documentation tab

  • Add regeneration of Fortigate token

  • Add support for handling multiple secrets in a single resource

v0.9.6 - 2024-03-29

  • Allow configuration without log processing

v0.9.5 - 2024-03-28

  • Add TAS and XCAP configuration

  • Expose national prefixes in the IMS config API

  • Refactor blueprint to support different topologies and add a lab blueprint that shares a switch between two sites

  • Add upgrade support

  • Change IMS default configuration

v0.9.4 - 2024-03-12

  • Fix use for hostname in scscf and icscf

  • Configure EIR realm for additional PLMNIDs in the MME

  • Create EPC dns zones for additional PLMNIDs

v0.9.3 - 2024-03-11

  • Add network_names as an instance option

  • Updated Password entities and dependencies for Athonet modules

  • Make vendor dependencies optional

  • Add support for Juniper MX switches

  • Fix ip parsing logic on get_oob_ip

  • Move plugins to std and bump std dependency

  • Support uplink peerings with different L2 and L3 sites

  • Validate peerings defined in service attributes

  • Refactor secret integration

  • Add support for Prometheus

  • Add initial RAN orchestration support

  • Switch to policy based routing instead of VRFs for the Athonet IMS

  • Support multiple PLMN IDs

  • Add default 4G slice for IMS DN

  • Make network function naming customizable

v0.9.2 - 2024-01-17

  • Add MME set configuration

v0.9.1 - 2024-01-16

  • Port to latest fortigate adapter

v0.9.0 - 2024-01-15

  • Fix mixed config for external switch port (tagged and untagged)

  • Allow configuration of log shipping

  • Add configuration of network names (full and short form)

  • Add DataNetwork and DNPeering purge support

  • Change order of AMF and MME encryption procotols to *ea2, *ea1, *ea0

  • Add support for Log processing

  • Allow configuration of the license precedence

  • Add support for Active/Backup links

  • Add SMF based pools, PCSCF IPs and PCRF selection to the core and ims

  • Add and Enable BFD support

  • Add DHCP support

  • Add AMF and MME names to the configuration

  • Fetch OOB IPs from inventory

  • Made AMF ID unique per AMF over all deployments

  • FortiGateConfiguration now gets the cpu_size from the VM

  • Support IPv6 addresses to the IMS datanetwork and the pcscf

  • Add option to not manage athonet licenses (core.athonet.manage_license and ims.athonet.manage_license)