Skip to content
Network as Code

Overview

Every Network as Code repository runs the same workflow, regardless of the architecture: validate the data model, plan, apply and test. Each step uses a different tool with its own options: terraform or tofu, nac-validate and nac-test. nac is a single CLI for the whole workflow. The repository is described once in a nac.yaml file, and the same commands work on a laptop and in a CI/CD pipeline:

Terminal window
nac setup       # verify prerequisites and report resolved tool versions
nac init        # terraform/tofu init
nac validate    # nac-validate against the configured data paths
nac plan        # terraform/tofu plan -> plan.tfplan
nac apply       # apply the saved plan (or interactively, without one)
nac test        # nac-test against the configured data/templates/output
nac destroy     # destroy the managed infrastructure
$ nac --help


Usage: nac [OPTIONS] COMMAND [ARGS]...


An umbrella CLI wrapping terraform/tofu, nac-validate, and nac-test.


Options:
  --config <path>       Path to the nac.yaml config file.
                        [env var: NAC_CONFIG] [default: nac.yaml]
  -v, --verbosity <DEBUG|INFO|WARNING|ERROR|CRITICAL>
                        Verbosity level. [env var: NAC_VERBOSITY] [default: WARNING]
  --no-color            Disable colored output (also honored via the NO_COLOR env var).
  --version             Show the version and exit.
  --help                Show this message and exit.


Commands:
  setup     Verify prerequisites and report resolved tool versions.
  init      Initialize the Terraform/OpenTofu working directory.
  validate  Render (if configured) then validate the resolved data paths.
  plan      Produce a saved plan file, optionally with plan.txt/plan.json artifacts.
  apply     Apply a saved plan file if present, otherwise apply interactively.
  test      Run nac-test against the configured data/templates/filters/output.
  destroy   Destroy the managed infrastructure (interactive unless --auto-approve).

How It Works

Section titled “How It Works”
  • One configuration file: nac.yaml at the root of the repository defines where the data model, schema, rules and test templates are located, which Terraform engine to use and which environment variables are required. Every field has a default, so a repository following the data/ and tests/ conventions works without a nac.yaml at all. See Configuration.
  • Managed toolchain: nac resolves the other tools itself. nac-validate and nac-test are used from a local installation if one is available, or run via uvx otherwise, so they don’t have to be installed separately. If neither terraform nor tofu is installed, nac setup can install OpenTofu. See Tool Versions.
  • Tested versions: a Network as Code Terraform module can declare the nac-validate and nac-test versions it was tested with. nac then uses a compatible version by default and warns about versions outside of the tested range. See Tested Versions.
  • Pass-through: arguments not known to nac are forwarded to the wrapped tool, and the exit code of the wrapped tool is returned. See Usage.