Skip to content

Establish Scoped Network-Lab Device Access

  • Purpose: Bind private device discovery, operator metadata, client configuration, and host trust to the active environment.
  • Owner: Network operations
  • Impact: Opens a foreground access session and writes environment-scoped target and client material.
  • Rollback strategy: Close the access process with Ctrl-C; deployed lab resources are unchanged.

Pre-checks

The lab must be healthy. Device management interfaces must use the management network declared by the blueprint.

ENV=<environment>
REF=<blueprint-ref>
hyops blueprint preflight --env "$ENV" --ref "$REF"

Execute

Keep the access session open in the first terminal:

hyops blueprint access \
  --env "$ENV" \
  --ref "$REF" \
  --automation

In a second terminal, inspect the resolved target set:

hyops blueprint device list --env "$ENV" --ref "$REF"

Discovery supplies live management addresses. Operator-defined names, users, ports, and web services remain in the environment target file. Open that file through the supported command when a target needs correction:

hyops blueprint device edit --env "$ENV" --ref "$REF"

Keep passwords and private keys outside the target file. Test reachability and authentication separately:

hyops blueprint device ping --env "$ENV" --ref "$REF" <device>
hyops blueprint device ssh --env "$ENV" --ref "$REF" <device>

Open a client-ready shell for tools that consume the generated proxy and inventory environment:

hyops blueprint device shell --env "$ENV" --ref "$REF"

Or run one command inside the session environment:

hyops blueprint device run --env "$ENV" --ref "$REF" -- <command>

For a declared device web service:

hyops blueprint device web --env "$ENV" --ref "$REF" <device>

Use --all --open-all to open all declared services through one session. Use --scheme or --port only when the declared service needs a one-run override. Each selected service is mapped to a temporary loopback URL.

Verify

device list must show the intended management address and source for each target. A successful ping with failed SSH isolates authentication or device-side SSH configuration from the access path. Web listeners must remain bound to loopback.

Records

Generated SSH, inventory, proxy, and target files are written below the environment's artifacts/access/ and config/automation/ directories. Discovered entries can change with live leases; operator-defined entries are retained. Device host trust is scoped to the environment so a reconstructed node can reuse its management address without inheriting stale global trust.

Rollback

Close the first terminal session. Reopen it after reconstruction to resolve current leases, targets, and host keys.

References