graphiant.naas.graphiant_public_vif module – Manage Graphiant gateway Public VIF (local data exchange) services

Note

This module is part of the graphiant.naas collection (version 26.10.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install graphiant.naas. You need further requirements to be able to use this module, see Requirements for details.

To use it in a playbook, specify: graphiant.naas.graphiant_public_vif.

New in graphiant.naas 26.8.0

Synopsis 

Manages gateway Public VIF services — a producer LAN segment (VRF) exposed over BGP through one or more Graphiant-managed gateways, in a chosen cloud region/provider, to a cloud router and to one or more consumer LAN segments.
Supports creating, updating, and deleting services.

Requirements 

The below requirements are needed on the host that executes this module.

python >= 3.7
graphiant-sdk >= 26.10.0
tabulate

Parameters 

Parameter	Comments
access_token string	Bearer token for API authentication (for example, from `graphiant login`, which opens a browser for sign-in (SSO or non-SSO) and retrieves the token). If not passed as a module argument, the collection reads `GRAPHIANT_ACCESS_TOKEN` (set after `graphiant login` when you `source ~/.graphiant/env.sh`). When a bearer token is present (module argument or environment), it takes precedence over `username` and `password`. If no valid token is available, the module authenticates with `username` and `password` when both are supplied.
config_file string	Path to the YAML configuration file for the operation. Required for `create_services`, `update_services`, and `delete_services` operations. Can be an absolute path or relative path. Relative paths are resolved using the configured config_path. Configuration files support Jinja2 templating syntax for dynamic generation. File must contain public_vif_services list.
detailed_logs boolean	Enable detailed logging output for troubleshooting and monitoring. When enabled, provides comprehensive logs of all Public VIF operations. Logs are captured and included in the `msg` return value for display using ansible.builtin.debug module. Choices: `false` ← (default) `true`
host aliases: base_url string / required	Graphiant portal host URL for API connectivity. Example: “https://api.graphiant.com”
operation string / required	The specific Public VIF operation to perform. `create_services`/`update_services`: Create or update services from a YAML file containing a public_vif_services list. Each service needs a serviceName; the producer lanSegment, region, and storageProvider (cloud provider) for the gateways; one or more gatewayBgpNeighbors (peer IP/ASN, local interface, timers, route filters, MD5 password per gateway); a matching natPrefixStrategy entry per gateway (the public NAT prefix advertised to the cloud); and consumerLanSegments (which LAN segments may use this Public VIF, and what they advertise over it). Optional coveringPrefixes summarizes the LAN routes advertised, and advertisement scopes which sites/site lists may consume the service (all symmetric sites if omitted). `update_services` requires the service to already exist and supports `--check`/`--diff` to preview the payload that would be sent. `delete_services`: Delete Public VIF services from a YAML configuration file. For query operations (services_summary, service_details), use graphiant.naas.graphiant_public_vif_info instead. Choices: `"create_services"` `"update_services"` `"delete_services"`
password string	Graphiant portal password for authentication. Required for password-based login when no valid bearer token is available from `access_token` or `GRAPHIANT_ACCESS_TOKEN`.
state string	The desired state of the Public VIF services. `present`: Maps to `create_services` when `operation` not specified. `absent`: Maps to `delete_services` when `operation` not specified. Choices: `"present"` ← (default) `"absent"`
username string	Graphiant portal username for authentication. Required for password-based login when no valid bearer token is available from `access_token` or `GRAPHIANT_ACCESS_TOKEN`.
vault_public_vif_bgp_md5_passwords dictionary	Dict of service name to device name to BGP MD5 password (create_services/ update_services only). Pass from playbook vars loaded from encrypted vault_secrets.yml; secrets in memory only. Keys must match the service `name` and the device name/ID key used under that service’s gatewayBgpNeighbors in the config. Optional; used only when a neighbor’s md5Password is null/absent in YAML. Default: `{}`

Attributes 

Attribute	Support	Description
check_mode	Support: full	Supported. In check mode, no API writes are performed; payloads that would be sent are logged with a `[check_mode]` prefix.

Notes 

Note

Configuration files support Jinja2 templating syntax for dynamic configuration generation.
Names given for lanSegment, region, advertisement.sites, and advertisement.siteLists are resolved to IDs.
gatewayBgpNeighbors (per-gateway BGP peering) and natPrefixStrategy (per-gateway NAT prefix) share the same key space — the gateway device name or ID — and every key in one should have a matching entry in the other. consumerLanSegments is a separate key space, keyed by consumer LAN segment name. See sample_public_vif_services.yaml.
Before any write, each configured gateway is checked against what’s actually provisioned for the resolved region/storageProvider; each neighbor’s localInterface is checked against that gateway’s real interfaces; and the resolved lanSegment is checked against what’s configured on those gateways. A bad reference fails fast with a clear error instead of a confusing API rejection or a silently wrong VRF.
Each gatewayBgpNeighbors entry’s enabled/bfd fields are not user-configurable — the module always enables the neighbor and disables BFD (not yet supported for Public VIF).
Vault (create_services/update_services only): vault_public_vif_bgp_md5_passwords, keyed by service name -> gateway name, fills a neighbor’s md5Password when left null in YAML (YAML value wins if set). Load from an encrypted vault file with ansible.builtin.include_vars (no_log true); see configs/vault_secrets.yml.example. md5Password, from either source, is always redacted as ******** in logs and --diff.
create_services/delete_services are idempotent, matched by serviceName.
update_services is a full replace, not a merge — the config must contain the complete desired service; anything omitted (a field, or a gatewayBgpNeighbors/ consumerLanSegments/natPrefixStrategy entry) is removed. It does not compare against live state first, so every run reports changed=true — see sample_public_vif_services_update.yaml.
Check mode (--check) validates and resolves everything normally; only the write is skipped, with the payload logged under a [check_mode] prefix.
Use graphiant.naas.graphiant_public_vif_info to query service summaries and details.

Examples 

- name: Create Public VIF services
  graphiant.naas.graphiant_public_vif:
    operation: create_services
    config_file: "sample_public_vif_services.yaml"
    host: "{{ graphiant_host }}"
    username: "{{ graphiant_username }}"
    password: "{{ graphiant_password }}"
    detailed_logs: true
  register: create_result

- name: Display service creation result
  ansible.builtin.debug:
    msg: "{{ create_result.msg }}"

- name: Create Public VIF services with BGP MD5 passwords from Ansible Vault (leave md5Password null in YAML)
  graphiant.naas.graphiant_public_vif:
    operation: create_services
    config_file: "sample_public_vif_services.yaml"
    host: "{{ graphiant_host }}"
    username: "{{ graphiant_username }}"
    password: "{{ graphiant_password }}"
    vault_public_vif_bgp_md5_passwords: "{{ vault_public_vif_bgp_md5_passwords | default({}) }}"
  register: create_result

- name: Preview Public VIF service updates (check + diff)
  graphiant.naas.graphiant_public_vif:
    operation: update_services
    config_file: "sample_public_vif_services_update.yaml"
    host: "{{ graphiant_host }}"
    username: "{{ graphiant_username }}"
    password: "{{ graphiant_password }}"
    detailed_logs: true
  register: update_result
  # Run playbook with: ansible-playbook playbook.yml --check --diff

- name: Update Public VIF services
  graphiant.naas.graphiant_public_vif:
    operation: update_services
    config_file: "sample_public_vif_services_update.yaml"
    host: "{{ graphiant_host }}"
    username: "{{ graphiant_username }}"
    password: "{{ graphiant_password }}"
    detailed_logs: true
  register: update_result

- name: Display service update result
  ansible.builtin.debug:
    msg: "{{ update_result.msg }}"

- name: Delete Public VIF services
  graphiant.naas.graphiant_public_vif:
    operation: delete_services
    config_file: "sample_public_vif_services.yaml"
    host: "{{ graphiant_host }}"
    username: "{{ graphiant_username }}"
    password: "{{ graphiant_password }}"

Return Values 

Common return values are documented here, the following are the fields unique to this module:

Key	Description
changed boolean	Whether the operation made changes to the system. Returned: always Sample: `true`
config_file string	The configuration file used for the operation. Returned: when applicable Sample: `"sample_public_vif_services.yaml"`
diff dictionary	Ansible `--diff` output showing before/after state for each changed item. Returned for `create_services` and `update_services` when the playbook is run with `--diff` and at least one item would change. For new services, `before` is empty and `after` is the full target config. For updates, `before` is empty (no live-state comparison is performed — see the module notes) and `after` is the full payload that was sent. `gatewayBgpNeighbors[].md5Password` (and any other known secret field) is shown as `******` in this output, same as log lines — it is never printed in plaintext. Returned: when playbook uses `--diff` and `create_services` or `update_services` has changes Sample:** `{"after": "=== pvif-service-1 (create) ===\n{\"serviceName\": \"pvif-service-1\", \"lanSegmentId\": 8568, \"regionId\": 12}\n", "before": "=== pvif-service-1 (create) ===\n{}\n"}`
msg string	Result message from the operation, including detailed logs when `detailed_logs` is enabled. Returned: always Sample: `"Successfully created 1 Public VIF services\n\nDetailed logs:\n2026-08-14 23:08:05,315 - Graphiant_playbook - INFO - Creating service 'pvif-service-1'...\n2026-08-14 23:08:05,450 - Graphiant_playbook - INFO - Successfully created service 'pvif-service-1'\n"`
operation string	The operation that was performed. One of `create_services`, `update_services`, or `delete_services`. Returned: always Sample: `"create_services"`
result_data dictionary	Result data from the operation. Returned: when applicable Sample: `{}`

Authors

Graphiant Team (@graphiant)