Credential setup

Netpilot never takes a password on the command line. It reads named credential slots, trying each set in config.yaml order until one authenticates. A set whose files are missing is skipped silently.

Credentials are DPAPI-encrypted on Windows — decryptable only by the same Windows user account that created them.

How a slot is resolved

A slot name is looked up in this order (src/utils.py:read_credential):

1. Environment variable CRED_{SLOTNAME_UPPERCASE}
2. File {secrets_dir}/{slotname}.txt

Slot names come from config.yaml under credentials.sets. Those are names, never passwords:

credentials:
  sets:                       # tried in order until one authenticates
    - user: "cisco_admin_user"      # needs cisco_admin_user.txt
      password: "cisco_admin_pass"  # needs cisco_admin_pass.txt
    - user: "alcatel_admin_user"
      password: "alcatel_admin_pass"

Run the setup script

cd src
.\setup_credentials.ps1

The script walks every slot one at a time, hiding password input. Fill in the ones you have and press Enter to skip the rest. You can also preset slots as parameters and be prompted only for the remainder:

powershell -ExecutionPolicy Bypass -File setup_credentials.ps1 -CiscoAdminUser "admin" -CiscoAdminPass "..."

Slots it creates

Group	Slot files
Alcatel	alcatel_default_user, alcatel_default_pass, alcatel_admin_user, alcatel_admin_pass, alcatel_ssoeadmin_user, alcatel_ssoeadmin_pass, alcatel_ncsciscolms_user, alcatel_ncsciscolms_pass1, alcatel_ncsciscolms_pass2, alcatel_ncsalcatellms_user, alcatel_ncsalcatellms_pass
Shared	ncsciscolms_new_user, ncsciscolms_new_pass
Cisco	cisco_admin_user, cisco_admin_pass, cisco_ncsadmin_user, cisco_ncsadmin_pass1, cisco_ncsadmin_pass2, cisco_ssoeadmin_user, cisco_ssoeadmin_pass, cisco_ssoe2admin_user, cisco_ssoe2admin_pass

Caution

Always run setup_credentials.ps1 as the same Windows user that runs Netpilot. DPAPI files created by another account fail to decrypt, and the failure looks identical to a wrong password. This is why a setup that works by hand can fail as a scheduled task running under a service account.

Danger

The script writes to a hardcoded path, D:\Prod_Automation\env\prod\secrets_v3, regardless of what config.yaml says. If you change paths.secrets_dir_windows, either move the files or set the SECRETS_DIR environment variable, which overrides both.

Linux / environment variable override

Environment variables win over files on either platform. On Linux the files are plain text and permission-checked, so group and other bits must be clear (chmod 600).

Bash

export CRED_CISCO_ADMIN_USER="username"
export CRED_CISCO_ADMIN_PASS="password"
export CRED_ALCATEL_ADMIN_USER="username2"
export CRED_ALCATEL_ADMIN_PASS="password2"

config.yaml path

paths:
  secrets_dir_linux: "/opt/automation/secrets_v3"

If every device fails authentication

Check these in order.

1. config.yaml is missing. This is the most common cause and it produces no error. Netpilot falls back to built-in defaults whose slots are named network_1 through network_4, so every lookup misses. config.yaml is commonly git-ignored, so this bites on fresh clones and new machines.
2. Wrong Windows account created the DPAPI files. Re-run the setup script as the account that runs Netpilot.
3. Slot names don’t match the files. A typo looks identical to a slot you meant to leave empty, because missing slots are skipped silently.
4. Secrets directory mismatch. See the hardcoded-path warning above.