Tenant-Aware Report filters and ValidatedSW. by pato23arg · Pull Request #574 · nautobot/nautobot-app-device-lifecycle-mgmt

pato23arg · 2026-03-16T17:51:36Z

Closes: #573

What's Changed

This PR introduces Multi-Tenancy awareness to the Device Lifecycle Management application. It enables organizations to define hardware and software validation policies that are scoped to specific Tenants, preventing "validation leakage" in shared or service-provider environments.
Multi-Tenant Software Validation

Scoped Validation: Added a device_tenants Many-to-Many relationship to the ValidatedSoftwareLCM model. Users can now approve specific software versions for individual departments or clients.

Isolation Logic: Implemented a "Tenant-First" filtering strategy. A device belonging to a Tenant will strictly match software assigned to that Tenant, while still being able to fall back to "Global" validations (where no Tenant is assigned).

Conflict Prevention: Logic ensures that if two different Tenants have different validated versions for the same hardware model, a device will only see the version relevant to its assigned Tenant.

Enhanced Reporting & Filtering

Hardware Notice Filters: Added the ability to filter Hardware Lifecycle reports (EoL/EoS) by Tenant, allowing for business-unit-specific refresh planning.

Validated Software Filters: The Validated Software report now supports Tenant-based filtering, enabling auditors to verify compliance for a single customer or department at a time.

To Do

[x] Explanation of Change(s)
[x] Added change log fragment(s)
[ ] Attached Screenshots, Payload Example - 
[x] Unit, Integration Tests
[ ] Documentation Updates (when adding/changing features)
[x] Outline Remaining Work, Constraints from Design

…ce Tenant, and related UI updates. modified: nautobot_device_lifecycle_mgmt/filter_extensions.py modified: nautobot_device_lifecycle_mgmt/filters.py modified: nautobot_device_lifecycle_mgmt/forms.py new file: nautobot_device_lifecycle_mgmt/migrations/0030_validatedsoftwarelcm_device_tenant.py modified: nautobot_device_lifecycle_mgmt/models.py modified: nautobot_device_lifecycle_mgmt/software_filters.py modified: nautobot_device_lifecycle_mgmt/tables.py modified: nautobot_device_lifecycle_mgmt/views.py

modified: nautobot_device_lifecycle_mgmt/software_filters.py

modified: nautobot_device_lifecycle_mgmt/filters.py modified: nautobot_device_lifecycle_mgmt/forms.py modified: nautobot_device_lifecycle_mgmt/migrations/0030_validatedsoftwarelcm_device_tenant.py modified: nautobot_device_lifecycle_mgmt/models.py modified: nautobot_device_lifecycle_mgmt/software_filters.py modified: nautobot_device_lifecycle_mgmt/tables.py

…ement. modified: nautobot_device_lifecycle_mgmt/software_filters.py modified: nautobot_device_lifecycle_mgmt/tests/test_forms.py modified: nautobot_device_lifecycle_mgmt/tests/test_model.py

new file: changes/573.added

modified: nautobot_device_lifecycle_mgmt/filters.py modified: nautobot_device_lifecycle_mgmt/forms.py modified: nautobot_device_lifecycle_mgmt/migrations/0030_validatedsoftwarelcm_device_tenant.py modified: nautobot_device_lifecycle_mgmt/software_filters.py modified: nautobot_device_lifecycle_mgmt/tests/test_forms.py modified: nautobot_device_lifecycle_mgmt/tests/test_model.py modified: nautobot_device_lifecycle_mgmt/views.py

modified: nautobot_device_lifecycle_mgmt/filters.py modified: nautobot_device_lifecycle_mgmt/forms.py

github-actions · 2026-03-17T08:31:54Z

Coverage report

Click to see where and how coverage changed

File	Statements	Missing	Coverage	Coverage (new stmts)	Lines missing
nautobot_device_lifecycle_mgmt
filter_extensions.py
filters.py
forms.py
models.py
software_filters.py
tables.py
views.py
Project Total

_{This report was generated by python-coverage-comment-action}

modified: nautobot_device_lifecycle_mgmt/software_filters.py

progala · 2026-03-20T17:34:48Z

nautobot_device_lifecycle_mgmt/software_filters.py

                When(device_roles=self.item_obj.role.pk, preferred=True, then=Value(40)),
                When(device_roles=self.item_obj.role.pk, preferred=False, then=Value(1040)),
+                When(
+                    device_tenants=self.item_obj.tenant,


What happens when tenant is not defined for the device?

if device has no tenant, it only sees validated software with no tenant assigned.

Apologies, let me rephrase. What happens to this query specifically if the tenant is not defined? Does it work? Does it error out? What will it return?

it will work:

device without tenant defined:
(AND: (OR: RelatedIn(Col(nautobot_device_lifecycle_mgmt_validatedsoftwarelcm_devices, nautobot_device_lifecycle_mgmt.ValidatedSoftwareLCM_devices.device), [UUID('217b8dda-b719-4680-a2d2-5a3e184c1487')]), (AND: RelatedExact(Col(nautobot_device_lifecycle_mgmt_validatedsoftwarelcm_device_3fbc, nautobot_device_lifecycle_mgmt.ValidatedSoftwareLCM_device_roles.role), UUID('d91b7e68-dadb-4fbb-840c-5b4739575d73')), RelatedExact(Col(nautobot_device_lifecycle_mgmt_validatedsoftwarelcm_device_7ebc, nautobot_device_lifecycle_mgmt.ValidatedSoftwareLCM_device_types.devicetype), UUID('21475479-aa38-40c2-bed7-4e33ac7a4640'))), (AND: RelatedIsNull(Col(nautobot_device_lifecycle_mgmt_validatedsoftwarelcm_device_3fbc, nautobot_device_lifecycle_mgmt.ValidatedSoftwareLCM_device_roles.role), True), RelatedExact(Col(nautobot_device_lifecycle_mgmt_validatedsoftwarelcm_device_7ebc, nautobot_device_lifecycle_mgmt.ValidatedSoftwareLCM_device_types.devicetype), UUID('21475479-aa38-40c2-bed7-4e33ac7a4640'))), (AND: RelatedExact(Col(nautobot_device_lifecycle_mgmt_validatedsoftwarelcm_device_3fbc, nautobot_device_lifecycle_mgmt.ValidatedSoftwareLCM_device_roles.role), UUID('d91b7e68-dadb-4fbb-840c-5b4739575d73')), RelatedIsNull(Col(nautobot_device_lifecycle_mgmt_validatedsoftwarelcm_device_7ebc, nautobot_device_lifecycle_mgmt.ValidatedSoftwareLCM_device_types.devicetype), True)), RelatedIn(Col(nautobot_device_lifecycle_mgmt_validatedsoftwarelcm_object_tags, nautobot_device_lifecycle_mgmt.ValidatedSoftwareLCM_object_tags.tag), <django.db.models.sql.query.Query object at 0x7ad37df44500>)), RelatedIn(Col(T10, nautobot_device_lifecycle_mgmt.ValidatedSoftwareLCM_devices.device), [UUID('217b8dda-b719-4680-a2d2-5a3e184c1487')]))

device with tenant defined:
(AND: (OR: RelatedIn(Col(nautobot_device_lifecycle_mgmt_validatedsoftwarelcm_devices, nautobot_device_lifecycle_mgmt.ValidatedSoftwareLCM_devices.device), [UUID('e46734cb-cbea-4d9f-ad9e-728af5f584a9')]), (AND: RelatedExact(Col(nautobot_device_lifecycle_mgmt_validatedsoftwarelcm_device_a4e6, nautobot_device_lifecycle_mgmt.ValidatedSoftwareLCM_device_tenants.tenant), UUID('33b7f29e-ca9c-412f-83d6-c37fc8f96abc')), RelatedExact(Col(nautobot_device_lifecycle_mgmt_validatedsoftwarelcm_device_7ebc, nautobot_device_lifecycle_mgmt.ValidatedSoftwareLCM_device_types.devicetype), UUID('da439205-b475-4cb9-a025-ff01b7223fb0'))), (AND: RelatedExact(Col(nautobot_device_lifecycle_mgmt_validatedsoftwarelcm_device_3fbc, nautobot_device_lifecycle_mgmt.ValidatedSoftwareLCM_device_roles.role), UUID('c018c03a-e764-40c1-b56d-19e327a4b8d0')), RelatedExact(Col(nautobot_device_lifecycle_mgmt_validatedsoftwarelcm_device_a4e6, nautobot_device_lifecycle_mgmt.ValidatedSoftwareLCM_device_tenants.tenant), UUID('33b7f29e-ca9c-412f-83d6-c37fc8f96abc'))), (AND: RelatedExact(Col(nautobot_device_lifecycle_mgmt_validatedsoftwarelcm_device_a4e6, nautobot_device_lifecycle_mgmt.ValidatedSoftwareLCM_device_tenants.tenant), UUID('33b7f29e-ca9c-412f-83d6-c37fc8f96abc')), RelatedIsNull(Col(nautobot_device_lifecycle_mgmt_validatedsoftwarelcm_device_7ebc, nautobot_device_lifecycle_mgmt.ValidatedSoftwareLCM_device_types.devicetype), True)), RelatedIn(Col(nautobot_device_lifecycle_mgmt_validatedsoftwarelcm_object_tags, nautobot_device_lifecycle_mgmt.ValidatedSoftwareLCM_object_tags.tag), <django.db.models.sql.query.Query object at 0x7ad37de06e90>)))

progala · 2026-03-20T17:35:44Z

nautobot_device_lifecycle_mgmt/software_filters.py

+                When(
+                    device_tenants=self.item_obj.tenant,
+                    device_types=self.item_obj.device_type.pk,


Do we need to have (tenant, device_type) and (tenant, role) combinations, or is (tenant, device_type) enough?

I did not receive role as a requirement, that's why it is not implemented ... do you see it as a potential case? roles are shared across tenants so it did not made a lot of sense to me, but maybe there could be some useful case?

progala · 2026-03-20T17:44:31Z

nautobot_device_lifecycle_mgmt/software_filters.py

+        if self.item_obj.validated_software.exists():
+            self.validated_software_qs = self.validated_software_qs.filter(devices__in=[self.item_obj.pk]).distinct()


The queries above already have a distinct() applied to them. This would essentially repeat the computation we've done up to this point.

this essentially overrides the previous queryset, that's why I added distinct(). Computation-wise should be ok as it is all lazy-eval.

progala · 2026-03-20T17:46:03Z

nautobot_device_lifecycle_mgmt/software_filters.py

+        if self.item_obj.validated_software.exists():
+            self.validated_software_qs = self.validated_software_qs.filter(devices__in=[self.item_obj.pk]).distinct()
        self.validated_software_qs = self._add_weights().order_by("weight", "start")
+        self.validated_software_qs = self.validated_software_qs.order_by("weight", "start")


We already ordered it on the previous line.

good catch! missed tshoot remnant, getting rid of it.

progala · 2026-03-20T17:47:55Z

nautobot_device_lifecycle_mgmt/tests/test_model.py

+            software=self.software,
+            start=date(2013, 11, 2),
+        )
+        lcm_global.device_tenants.set([self.tenant_1])


If we are testing for fallback, then shouldn't the lcm_global.device_tenants be an empty set?

need to modify this, I disabled global fallback, so should be def test_get_for_object_device_tenant_no_fallback_to_global(self):

progala · 2026-03-20T17:54:58Z

nautobot_device_lifecycle_mgmt/software_filters.py

+                Q(devices=self.item_obj.pk)
+                | Q(device_tenants=self.item_obj.tenant, device_types=self.item_obj.device_type.pk)
+                | Q(device_tenants=self.item_obj.tenant, device_roles=self.item_obj.role.pk)
+                | Q(device_tenants=self.item_obj.tenant, device_types=None, software__platform=self.item_obj.platform)


Why do we include software__platform=self.item_obj.platform ? This changes the behavior, is only included when the tenant is defined, and is negated by the line that follows Q(device_tenants=self.item_obj.tenant, device_types=None).

this is a good point, wanted to add validation so if a software from a different platform than device is added, it will not be accepted. However, current app behavior allows for these cases. Going to get rid of it for now, so we stay consistent across tenant and non-tenant cases.

nautobot_device_lifecycle_mgmt/filters.py

progala · 2026-03-20T18:01:55Z

nautobot_device_lifecycle_mgmt/filters.py

        queryset=Platform.objects.all(),
        label="Platform",
    )
+    tenant = django_filters.ModelMultipleChoiceFilter(


We need to add a tenant_id equivalent and add tests.

adding test!

progala · 2026-03-20T18:02:28Z

nautobot_device_lifecycle_mgmt/filters.py

        queryset=Platform.objects.all(),
        label="Platform",
    )
+    tenant = django_filters.ModelMultipleChoiceFilter(


We need to add a tenant_id equivalent and add tests.

adding test!

progala · 2026-03-20T18:07:51Z

nautobot_device_lifecycle_mgmt/filters.py

            "start": {"lookup_expr": "icontains", "preprocessor": str.strip},
            "end": {"lookup_expr": "icontains", "preprocessor": str.strip},
            "devices__name": {"lookup_expr": "icontains", "preprocessor": str.strip},
+            "devices__tenant__name": {"lookup_expr": "icontains", "preprocessor": str.strip},


You probably also want this:

device_tenants__name": {"lookup_expr": "icontains", "preprocessor": str.strip},

eagle's eye, fumbled that one!

modified: nautobot_device_lifecycle_mgmt/filters.py modified: nautobot_device_lifecycle_mgmt/software_filters.py modified: nautobot_device_lifecycle_mgmt/tests/test_filters.py modified: nautobot_device_lifecycle_mgmt/tests/test_model.py

…s. Removal platform lookup for tenant-specific filters. modified: nautobot_device_lifecycle_mgmt/software_filters.py

modified: nautobot_device_lifecycle_mgmt/software_filters.py modified: nautobot_device_lifecycle_mgmt/tests/test_filters.py

modified: nautobot_device_lifecycle_mgmt/filters.py

…agement. modified: docs/user/software_lifecycle.md

changes/573.added

Co-authored-by: Josh VanDeraa <jv@networktocode.com>

modified: nautobot_device_lifecycle_mgmt/filters.py modified: nautobot_device_lifecycle_mgmt/forms.py

mzbroch · 2026-03-17T16:51:49Z

nautobot_device_lifecycle_mgmt/models.py

    )
    devices = models.ManyToManyField(to="dcim.Device", related_name="validated_software", blank=True)
    device_types = models.ManyToManyField(to="dcim.DeviceType", related_name="validated_software", blank=True)
+    device_tenants = models.ManyToManyField(to="tenancy.Tenant", related_name="validated_software_tenants", blank=True)


Probably just have related_name="validated_software"

progala · 2026-03-31T13:54:48Z

nautobot_device_lifecycle_mgmt/software_filters.py

-        ).distinct()
-
+        # 1. tenant relationship exists.
+        if self.item_obj.tenant:


Thinking about this more. This is breaking backwards compatibility. We are applying this new logic to any device with a tenant defined. Validation logic will break if an operator has an existing ValidatedSoftware record without a tenant defined (all of them, since this is a new addition) that worked for his devices, whether they have a tenant or not.

I think we'll need a workflow diagram illustrating different use cases. We need to ensure the existing behavior is not broken. This means adding regression tests.

pato23arg added 5 commits March 16, 2026 18:40

FIX: passing tests.

974c4e5

modified: nautobot_device_lifecycle_mgmt/software_filters.py

FEAT: add tests and filters for tenant-based software lifecycle manag…

c7f558c

…ement. modified: nautobot_device_lifecycle_mgmt/software_filters.py modified: nautobot_device_lifecycle_mgmt/tests/test_forms.py modified: nautobot_device_lifecycle_mgmt/tests/test_model.py

CHORE: changelog fragment.

691f589

new file: changes/573.added

pato23arg requested review from jvanderaa and progala as code owners March 16, 2026 17:51

pato23arg added 2 commits March 16, 2026 19:27

CHORE: pylint.disable too-many-lines in filters.py and forms.py

d5f1187

modified: nautobot_device_lifecycle_mgmt/filters.py modified: nautobot_device_lifecycle_mgmt/forms.py

FIX: mySQL compatibility issues.

3157579

modified: nautobot_device_lifecycle_mgmt/software_filters.py

progala requested changes Mar 20, 2026

View reviewed changes

pato23arg added 2 commits March 23, 2026 14:32

REVIEW: implemented comments in PR review.

34f26e9

modified: nautobot_device_lifecycle_mgmt/filters.py modified: nautobot_device_lifecycle_mgmt/software_filters.py modified: nautobot_device_lifecycle_mgmt/tests/test_filters.py modified: nautobot_device_lifecycle_mgmt/tests/test_model.py

FIX: device in global tenant view of tenant-specific software filter…

ff90014

…s. Removal platform lookup for tenant-specific filters. modified: nautobot_device_lifecycle_mgmt/software_filters.py

pato23arg requested a review from progala March 23, 2026 14:06

pato23arg and others added 4 commits March 23, 2026 16:45

Merge branch 'develop' into u/pvillar-tntfilters

04b7452

CHORE: Ruff linting.

9a8d142

modified: nautobot_device_lifecycle_mgmt/software_filters.py modified: nautobot_device_lifecycle_mgmt/tests/test_filters.py

REVIEW: Edit tenant filters.

103a8df

modified: nautobot_device_lifecycle_mgmt/filters.py

CHORE: documentation updates for tenant-based software lifecycle man…

c0f663f

…agement. modified: docs/user/software_lifecycle.md

jvanderaa reviewed Mar 26, 2026

View reviewed changes

changes/573.added Outdated Show resolved Hide resolved

Update changes/573.added

363a2e9

Co-authored-by: Josh VanDeraa <jv@networktocode.com>

pato23arg requested a review from jvanderaa March 26, 2026 15:03

FIX: report filters.

c0cf665

modified: nautobot_device_lifecycle_mgmt/filters.py modified: nautobot_device_lifecycle_mgmt/forms.py

mzbroch reviewed Mar 30, 2026

View reviewed changes

progala requested changes Mar 31, 2026

View reviewed changes

		if self.item_obj.validated_software.exists():
		self.validated_software_qs = self.validated_software_qs.filter(devices__in=[self.item_obj.pk]).distinct()

Conversation

pato23arg commented Mar 16, 2026

Closes: #573

What's Changed

Uh oh!

github-actions bot commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Coverage report

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

progala Mar 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

progala Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

github-actions bot commented Mar 17, 2026 •

edited

Loading

progala Mar 20, 2026 •

edited

Loading

progala Mar 31, 2026 •

edited

Loading