NETCONF Unlock Datastore

Use netconf_unlock to release a datastore lock after completing a configuration change.

Use Cases

Release a lock acquired with netconf_lock so other sessions can edit the datastore.

How It Works

Target the same worker and backend that acquired the lock. Another session cannot release it. Unlocking does not commit or discard configuration; complete those operations first.

Output

Each host's XML reply appears under unlock. Successful operations normally return <ok/>. RPC and connection errors mark hosts as failed. add_details=True includes execution metadata; to_dict=False returns serialized records. XML processors can convert or filter replies.

Examples

CLIPython

nf# nornir netconf unlock target candidate workers nornir-worker-1 FL router-1

from norfab.core.nfapi import NorFab

with NorFab(inventory="inventory.yaml") as nf:
    client = nf.make_client()
    result = client.run_job(
        "nornir", "netconf_unlock", workers="nornir-worker-1",
        kwargs={'target': 'candidate', 'FL': ['router-1']},
    )
    print(result)

Task Command Shell Reference

nf#man tree nornir.netconf.unlock

R - required field, M - supports multiline input, D - dynamic key

root
└── nornir:    Nornir service
    └── netconf:    Manage devices using NETCONF
        └── unlock:    Unlock a NETCONF datastore
            ├── timeout:    Job timeout
            ├── workers:    Filter workers to target, default 'all'
            ├── verbose-result:    Control output details, default 'False'
            ├── nowait:    Do not wait for job to complete, default 'False'
            ├── FO:    Filter hosts using a Nornir-Salt Filter Object
            ├── FB:    Filter hosts by name using glob patterns
            ├── FH:    Filter hosts by hostname
            ├── FC:    Filter hosts by name containment pattern
            ├── FR:    Filter hosts by name using regular expressions
            ├── FG:    Filter hosts by group
            ├── FP:    Filter hosts by hostname using IP prefix
            ├── FL:    Filter hosts by names list
            ├── FM:    Filter hosts by platform
            ├── FX:    Exclude hosts by name
            ├── FN:    Negate the host filter match
            ├── on-failed:    Run task on hosts currently marked as failed by Nornir, default 'False'
            ├── to-dict:    Return task results as a dictionary keyed by host, default 'True'
            ├── add-details:    Add Nornir task execution details to results, default 'False'
            ├── progress:    Emit progress events during task execution, default 'True'
            ├── num-workers:    RetryRunner number of threads for task execution
            ├── num-connectors:    RetryRunner number of threads for device connections
            ├── connect-retry:    RetryRunner number of connection attempts
            ├── task-retry:    RetryRunner number of attempts to run each task
            ├── reconnect-on-fail:    RetryRunner reconnects to a host after task failure
            ├── connect-check:    RetryRunner tests TCP connectivity before opening connection
            ├── connect-timeout:    RetryRunner TCP connection check timeout in seconds
            ├── creds-retry:    RetryRunner connection credentials and parameters to retry
            ├── tf:    File group name to save task results on the worker
            ├── tf-skip-failed:    Skip failed task results when saving to file
            ├── diff:    File group name to diff task results against
            ├── diff-last:    Previous saved file version to diff against
            ├── xmltodict:    Convert XML replies to dictionaries with DataProcessor, default 'False'
            ├── xpath:    XPath expression to run with DataProcessor
            ├── xml-flake:    XML flake pattern for DataProcessor
            ├── plugin:    NETCONF backend, default 'NetconfPlugin.ncclient'
            └── target:    Datastore to unlock, default 'NetconfConfigSource.candidate'
nf#

Common host filters, job options, XML processors, and serialization options are also available. ncclient is the default backend; select plugin scrapli to use Scrapli NETCONF.

Python API Reference

Release a datastore lock held by the current NETCONF session.

Parameters:

Name	Type	Description	Default
job	Job	NorFab job metadata.	required
target	str	Datastore to unlock: candidate (default), running, or startup. Requires device support for the selected datastore.	'candidate'
plugin	str	NETCONF backend: ncclient (default) or scrapli.	'ncclient'
**kwargs	Any	Common host filters, processors, retries, XML processors, to_dict and add_details serialization options.	{}

Returns:

Name	Type	Description
Result	Result	XML replies under unlock, normally an ok reply. Target the worker and backend that acquired the lock; another session's lock cannot be released. Does not commit or discard changes. RPC and connection errors mark hosts failed; unmatched hosts return status no_match. to_dict=False returns serialized records. Retries may fail after an earlier unlock succeeded.

Source code in norfab\workers\nornir_worker\netconf_task.py

@Task(
    fastapi={"methods": ["POST"]},
    input=NetconfUnlockInput,
    output=NetconfResult,
    mcp={
        "annotations": {
            "title": "NETCONF Unlock Datastore",
            "readOnlyHint": False,
            "destructiveHint": False,
            "idempotentHint": False,
            "openWorldHint": True,
        }
    },
)
def netconf_unlock(
    self,
    job: Job,
    target: str = "candidate",
    plugin: str = "ncclient",
    **kwargs: Any,
) -> Result:
    """Release a datastore lock held by the current NETCONF session.

    Args:
        job: NorFab job metadata.
        target: Datastore to unlock: candidate (default), running, or startup.
            Requires device support for the selected datastore.
        plugin: NETCONF backend: ncclient (default) or scrapli.
        **kwargs: Common host filters, processors, retries, XML processors,
            to_dict and add_details serialization options.

    Returns:
        Result: XML replies under unlock, normally an ok reply. Target the
            worker and backend that acquired the lock; another session's
            lock cannot be released. Does not commit or discard changes.
            RPC and connection errors mark hosts failed; unmatched hosts
            return status no_match. to_dict=False returns serialized records.
            Retries may fail after an earlier unlock succeeded.
    """
    return self._run_netconf(
        job, call="unlock", plugin=plugin, target=target, **kwargs
    )