“If a network change isn’t represented by a Git commit, it doesn’t exist. Shifting from manual SSH to GitOps is an organizational culture transformation.”

At NTT Data, I led the transformation from traditional manual network administration to a NetDevOps model.

The NetDevOps Architecture

Instead of making manual edits directly on routers and firewalls, engineers submit Pull Requests (PRs) containing network intent in YAML.

• Git Repository: Houses the single source of truth for device inventories, interface configurations, and firewall policies.
• CI Pipeline: Automatically validates YAML syntax, checks duplicate IP assignments, and runs dry-run execution tests before approval.
• CD Pipeline: Pushes changes to production devices using Ansible Tower.

[!IMPORTANT] Never allow manual CLI configuration changes in production once GitOps pipelines are established. Remove SSH write permissions to enforce pipeline compliance.

# # NetDevOps Pipeline Inventory Definition
all:
  children:
    datacenter_switches:
      hosts:
        leaf-01:
          ansible_host: 10.10.1.11
          vlan_id: 200
          vlan_name: "App-Tier-Subnet"

The Verdict

Key Takeaway

Git Is the Single Source of Truth for Network State.

Treat network infrastructure configuration as software code. Moving to NetDevOps eliminates manual errors and creates an immutable audit trail for every change.