NETCONF Lock Datastore

Use netconf_lock to reserve a datastore for your NETCONF session while applying a configuration change.

Use Cases

Prevent competing sessions from editing the same datastore during a multi-step change.

How It Works

The lock belongs to the NETCONF session. Target the same worker and backend for edits and unlocking. The device releases the lock when that session closes, including connection cleanup by the worker. Locks acquired on other devices remain held if one device fails.

Output

Each host's XML reply appears under lock. Successful operations normally return <ok/>. RPC and connection errors mark hosts as failed. add_details=True includes execution metadata; to_dict=False returns serialized records. XML processors can convert or filter replies.

Examples

CLIPython

nf# nornir netconf lock target candidate workers nornir-worker-1 FL router-1

from norfab.core.nfapi import NorFab

with NorFab(inventory="inventory.yaml") as nf:
    client = nf.make_client()
    result = client.run_job(
        "nornir", "netconf_lock", workers="nornir-worker-1",
        kwargs={'target': 'candidate', 'FL': ['router-1']},
    )
    print(result)

Task Command Shell Reference

nf#man tree nornir.netconf.lock

R - required field, M - supports multiline input, D - dynamic key

root
└── nornir:    Nornir service
    └── netconf:    Manage devices using NETCONF
        └── lock:    Lock a NETCONF datastore
            ├── timeout:    Job timeout
            ├── workers:    Filter workers to target, default 'all'
            ├── verbose-result:    Control output details, default 'False'
            ├── nowait:    Do not wait for job to complete, default 'False'
            ├── FO:    Filter hosts using a Nornir-Salt Filter Object
            ├── FB:    Filter hosts by name using glob patterns
            ├── FH:    Filter hosts by hostname
            ├── FC:    Filter hosts by name containment pattern
            ├── FR:    Filter hosts by name using regular expressions
            ├── FG:    Filter hosts by group
            ├── FP:    Filter hosts by hostname using IP prefix
            ├── FL:    Filter hosts by names list
            ├── FM:    Filter hosts by platform
            ├── FX:    Exclude hosts by name
            ├── FN:    Negate the host filter match
            ├── on-failed:    Run task on hosts currently marked as failed by Nornir, default 'False'
            ├── to-dict:    Return task results as a dictionary keyed by host, default 'True'
            ├── add-details:    Add Nornir task execution details to results, default 'False'
            ├── progress:    Emit progress events during task execution, default 'True'
            ├── num-workers:    RetryRunner number of threads for task execution
            ├── num-connectors:    RetryRunner number of threads for device connections
            ├── connect-retry:    RetryRunner number of connection attempts
            ├── task-retry:    RetryRunner number of attempts to run each task
            ├── reconnect-on-fail:    RetryRunner reconnects to a host after task failure
            ├── connect-check:    RetryRunner tests TCP connectivity before opening connection
            ├── connect-timeout:    RetryRunner TCP connection check timeout in seconds
            ├── creds-retry:    RetryRunner connection credentials and parameters to retry
            ├── tf:    File group name to save task results on the worker
            ├── tf-skip-failed:    Skip failed task results when saving to file
            ├── diff:    File group name to diff task results against
            ├── diff-last:    Previous saved file version to diff against
            ├── xmltodict:    Convert XML replies to dictionaries with DataProcessor, default 'False'
            ├── xpath:    XPath expression to run with DataProcessor
            ├── xml-flake:    XML flake pattern for DataProcessor
            ├── plugin:    NETCONF backend, default 'NetconfPlugin.ncclient'
            └── target:    Datastore to lock, default 'NetconfConfigSource.candidate'
nf#

Common host filters, job options, XML processors, and serialization options are also available. ncclient is the default backend; select plugin scrapli to use Scrapli NETCONF.

Python API Reference

Lock a datastore for the current NETCONF session.

Parameters:

Name	Type	Description	Default
job	Job	NorFab job metadata.	required
target	str	Datastore to lock: candidate (default), running, or startup. Requires device support for the selected datastore.	'candidate'
plugin	str	NETCONF backend: ncclient (default) or scrapli.	'ncclient'
**kwargs	Any	Common host filters, processors, retries, XML processors, to_dict and add_details serialization options.	{}

Returns:

Name	Type	Description
Result	Result	XML replies under lock, normally an ok reply. Use the same worker and backend for subsequent edits and netconf_unlock. The device releases the lock when its NETCONF session closes, including worker connection cleanup. Locks are per device; failures do not release locks acquired on other devices. RPC and connection errors mark hosts failed; unmatched hosts return status no_match. to_dict=False returns serialized records. Retrying a successful lock can report that it is already locked.

Source code in norfab\workers\nornir_worker\netconf_task.py

@Task(
    fastapi={"methods": ["POST"]},
    input=NetconfLockInput,
    output=NetconfResult,
    mcp={
        "annotations": {
            "title": "NETCONF Lock Datastore",
            "readOnlyHint": False,
            "destructiveHint": False,
            "idempotentHint": False,
            "openWorldHint": True,
        }
    },
)
def netconf_lock(
    self,
    job: Job,
    target: str = "candidate",
    plugin: str = "ncclient",
    **kwargs: Any,
) -> Result:
    """Lock a datastore for the current NETCONF session.

    Args:
        job: NorFab job metadata.
        target: Datastore to lock: candidate (default), running, or startup.
            Requires device support for the selected datastore.
        plugin: NETCONF backend: ncclient (default) or scrapli.
        **kwargs: Common host filters, processors, retries, XML processors,
            to_dict and add_details serialization options.

    Returns:
        Result: XML replies under lock, normally an ok reply. Use the same
            worker and backend for subsequent edits and netconf_unlock.
            The device releases the lock when its NETCONF session closes,
            including worker connection cleanup. Locks are per device;
            failures do not release locks acquired on other devices.
            RPC and connection errors mark hosts failed; unmatched hosts
            return status no_match. to_dict=False returns serialized records.
            Retrying a successful lock can report that it is already locked.
    """
    return self._run_netconf(
        job, call="lock", plugin=plugin, target=target, **kwargs
    )