TSYS Group » Chief Operations Officer » Known Element Enterprises - Technology & Facility Services

Problem¶

Oxidized and UNPoller need credentials to poll network devices (Dell switches, Cisco router, UniFi controller). Currently no credential infrastructure exists for this. Must be solved holistically to support both current deployment and future IAC rebuilds via AWX.

Scope¶

1. Network device local users (read-only config pull)¶

• Create local user accounts on all Dell PowerConnect switches + Cisco router with read-only privileges (can run show commands / pull running-config)
• Minimum privilege: enough for Oxidized to fetch configs
• Same account on all devices for consistency

2. RADIUS authentication (tsys-ucs-01/02)¶

• Configure RADIUS on Univention Corporate Server (tsys-ucs-01, tsys-ucs-02)
• RADIUS is deployed but unconfigured
• Network devices authenticate against RADIUS instead of local users
• Requires UCS configuration work (LDAP/RADIUS integration)

3. Credential storage strategy¶

Evaluate and implement credential hierarchy:

• HashiCorp Vault (#408/#409) — system-of-record for all secrets at runtime
• Bitwarden machine accounts (#410) — for non-shared secrets
• Ansible Vault — for IAC/AWX deployments. Encrypted credentials passed to AWX playbooks when (re)deploying Oxidized, UNPoller, or any tool needing device credentials
• Goal: any tool (Oxidized, UNPoller, Ansible playbooks) can retrieve credentials at runtime without hardcoded values

4. AWX IAC playbooks (bootstrap-to-IAC migration)¶

• Goal: all work done manually in this session (Smokeping, NetDisco, Oxidized, UNPoller) can be redone via AWX playbooks
• Ansible Vault provides credentials to playbooks at deploy time
• Playbooks live in this repo or KNELIAC
• Not redoing work for fun — this is the rebuild/upgrade path for when systems need to be rebuilt

Dependencies¶

• #408 (Vault infrastructure)
• #409 (Vault credential migration)
• #410 (Bitwarden machine accounts)
• #385 (SSH certificates — related auth infrastructure)
• #337 (Oxidized deployment — needs these credentials)
• #387/#388 (OIDC/RADIUS — UCS auth work)

Priority¶

Medium — blocked by Vault deployment (#408). Current deployment uses placeholder credentials (CHANGE_ME) in ~/.creds files. Tools are deployed and ready; credentials unblock them.