8) SDN & Réseaux modernes

# APIC REST — créer Tenant/BD/EPG (extraits)
POST https://apic/api/mo/uni/tn-Demo.json
{ "fvTenant": { "attributes": { "name": "Demo" } } }

POST https://apic/api/mo/uni/tn-Demo/BD-bd10.json
{ "fvBD": { "attributes": { "name": "bd10" }, "children":[
  { "fvSubnet": { "attributes": { "ip": "10.10.10.1/24" } } }
] } }

POST https://apic/api/mo/uni/tn-Demo/ap-App/epg-Web.json
{ "fvAEPg": { "attributes": { "name": "Web" } } }

# Terraform ACI — tenant + VRF + BD + EPG
provider "aci" { url="https://apic" username="admin" password="***" insecure=true }
resource "aci_tenant" "demo" { name = "Demo" }
resource "aci_vrf" "vrf" { tenant_dn = aci_tenant.demo.id name="PROD" }
resource "aci_bridge_domain" "bd" { tenant_dn=aci_tenant.demo.id name="BD10" arp_flood="yes" }
resource "aci_application_profile" "app" { tenant_dn=aci_tenant.demo.id name="App" }
resource "aci_application_epg" "web" { application_profile_dn=aci_application_profile.app.id name="Web" }

# Diag rapides
show endpoint ip 10.10.10.5
contract hit-counts | fabric node health | faults | atomic counters

# Arista EOS (extraits)
router bgp 65001
  neighbor SPINE peer-group
  address-family evpn
    neighbor SPINE activate
vlan 10
  vxlan vlan 10 vni 1010
interface Vxlan1
  vxlan source-interface Loopback0
  vxlan vlan 10 vni 1010
  vxlan vrf PROD vni 5000

! Cisco NX-OS (extraits)
feature nv overlay
feature bgp
router bgp 65001
  address-family l2vpn evpn
vlan 10
 vn-segment 1010
interface nve1
 source-interface loopback0
 member vni 1010
  suppress-arp

# Checks essentiels
- MTU path (host <-> leaf) | ECMP OK | BGP EVPN adj up
- VRF ↔ L3VNI mapping | SVI anycast doublé | ARP/ND counters

! Jinja2 — SVI avec helpers
interface Vlan
 ip address  
 no shut

# Nornir + Netmiko (Python)
from nornir import InitNornir
from nornir_netmiko.tasks import netmiko_send_config
nr = InitNornir(config_file="config.yaml")
r = nr.run(task=netmiko_send_config, config_commands=["hostname LAB-SW"])
print(r)

# hosts.yaml (inventaire)
access:
  hosts:
    sw1: { hostname: 10.0.0.11, platform: ios }
    sw2: { hostname: 10.0.0.12, platform: ios }

# Module segment NSX
module "seg_web" { source="./modules/nsx_segment" name="web" cidr="10.10.10.0/24" }

# GitHub Actions — plan/apply
on: [pull_request, push]
jobs:
  tf:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - uses: hashicorp/setup-terraform@v3
    - run: terraform init && terraform validate && terraform plan -out=plan.out
    - if: github.ref == 'refs/heads/main'
      run: terraform apply -auto-approve plan.out

# OPA/Rego — policy (exemple conceptuel)
package net.policy
deny[msg] { input.vlan.id < 10; msg := "VLAN réservé" }

# intent/sites/paris.yaml
site: paris
vlans:
- { id: 10, name: "USERS", gw: "10.10.10.1/24" }
- { id: 20, name: "VOICE", gw: "10.10.20.1/24" }
contracts:
- { name: "web", src: "EPG-Web", dst: "EPG-App", ports: [80,443] }

# Pipeline
1) Lint YAML/Jinja + sécurité secrets
2) Build configs (Ansible/Jinja) + validations (Batfish)
3) Plan Terraform (NSX/ACI) — approval requis
4) Déploiement fenêtré + post-checks (pyATS)

# .pre-commit-config.yaml (extrait)
- repo: https://github.com/adrienverge/yamllint
  rev: v1.35.1
  hooks: [{ id: yamllint }]
- repo: https://github.com/zricethezav/gitleaks
  rev: v8.18.0
  hooks: [{ id: gitleaks }]

# Calico policy (extrait)
apiVersion: projectcalico.org/v3
kind: NetworkPolicy
spec: { selector: "app == 'web'", ingress: [{ action: Allow, protocol: TCP, destination: { ports: [80,443] }}] }

# Istio — Gateway API (extrait YAML)
kind: HTTPRoute
spec: { hostnames: ["app.example.com"], rules: [{ matches:[{path:{type: PathPrefix, value:"/"}}], backendRefs:[{ name:"app-svc", port:80 }]}]}