Skip to content

Commit 83c8ae8

Browse files
gserichegseriche
committed
Deploy NetBox with slurpit_netbox plugin using init container
- Add init container to install slurpit_netbox plugin via pip - Enable slurpit_netbox plugin in NetBox configuration - Use shared volume to provide plugins to NetBox container - Update PYTHONPATH to include plugins directory
1 parent ee1907d commit 83c8ae8

File tree

10 files changed

+448
-0
lines changed

10 files changed

+448
-0
lines changed

‎fleet/lib/netbox/README.md‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
# NetBox Kubernetes Deployment
2+
3+
## Overview
4+
5+
NetBox is an Infrastructure Resource Modeling (IRM) application designed to empower network automation. This deployment provides a production-ready NetBox instance on Kubernetes using Helm charts and Fleet configuration management.
6+
7+
## Architecture
8+
9+
- **Chart**: netbox v6.1.5 from <https://charts.netbox.oss.netboxlabs.com/>
10+
- **Namespace**: netbox
11+
- **Components**: Web application, worker processes, PostgreSQL database, Valkey cache
12+
- **Ingress**: NGINX with Let's Encrypt TLS certificates
13+
14+
## Configuration
15+
16+
### Core Settings
17+
18+
- **Timezone**: America/Santiago
19+
- **Superuser**: <[email protected]>
20+
- **Change Log Retention**: 90 days
21+
- **Job Retention**: 90 days
22+
- **GraphQL**: Enabled
23+
- **Login Required**: False
24+
25+
### Security
26+
27+
- Non-root container execution (UID/GID: 1000)
28+
- Read-only root filesystem
29+
- Dropped capabilities
30+
- Runtime security profile enabled
31+
- External secret management via Kubernetes secrets
32+
33+
### Storage
34+
35+
- **Persistence**: Disabled (ephemeral storage)
36+
- **PostgreSQL**: 20Gi persistent storage (rook-ceph-block)
37+
- **Media/Reports/Scripts**: Stored in ephemeral volumes
38+
39+
### Resources
40+
41+
| Component | CPU Request | Memory Request | CPU Limit | Memory Limit |
42+
|-----------|-------------|----------------|-----------|--------------|
43+
| NetBox | 500m | 1Gi | 1000m | 2Gi |
44+
| Worker | 500m | 1Gi | 1000m | 2Gi |
45+
| PostgreSQL| 250m | 512Mi | 500m | 1Gi |
46+
47+
## Access
48+
49+
NetBox is accessible via dynamically generated hostnames based on cluster configuration:
50+
51+
```bash
52+
https://netbox.{cluster-name}.{site}.lsst.org
53+
```
54+
55+
## Maintenance
56+
57+
- **Housekeeping**: Daily automated cleanup (00:00 UTC)
58+
- **Job History**: 5 successful/failed jobs retained
59+
- **Monitoring**: Available via cluster monitoring stack

‎fleet/lib/netbox/base/externalsecret-netbox-keycloak.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
apiVersion: external-secrets.io/v1
2+
kind: ExternalSecret
3+
metadata:
4+
name: netbox-keycloak
5+
namespace: netbox
6+
spec:
7+
secretStoreRef:
8+
kind: ClusterSecretStore
9+
name: onepassword
10+
target:
11+
name: netbox-keycloak
12+
creationPolicy: Owner
13+
data:
14+
- secretKey: SOCIAL_AUTH_KEYCLOAK_KEY
15+
remoteRef:
16+
key: &item netbox-keycloak-sso
17+
property: client-id
18+
- secretKey: SOCIAL_AUTH_KEYCLOAK_SECRET
19+
remoteRef:
20+
key: *item
21+
property: client-secret

‎fleet/lib/netbox/base/externalsecret-netbox-postgresql.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
apiVersion: external-secrets.io/v1
2+
kind: ExternalSecret
3+
metadata:
4+
name: netbox-postgresql
5+
namespace: netbox
6+
spec:
7+
secretStoreRef:
8+
kind: ClusterSecretStore
9+
name: onepassword
10+
target:
11+
name: netbox-postgresql
12+
creationPolicy: Owner
13+
data:
14+
- secretKey: password
15+
remoteRef:
16+
key: &item netbox-postgresql
17+
property: password
18+
- secretKey: postgres-password
19+
remoteRef:
20+
key: *item
21+
property: postgres-password

‎fleet/lib/netbox/base/externalsecret-netbox-secrets.yaml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
apiVersion: external-secrets.io/v1
2+
kind: ExternalSecret
3+
metadata:
4+
name: netbox-secrets
5+
namespace: netbox
6+
spec:
7+
secretStoreRef:
8+
kind: ClusterSecretStore
9+
name: onepassword
10+
target:
11+
name: netbox-secrets
12+
creationPolicy: Owner
13+
data:
14+
- secretKey: username
15+
remoteRef:
16+
key: &item netbox-secrets
17+
property: username
18+
- secretKey: password
19+
remoteRef:
20+
key: *item
21+
property: password
22+
- secretKey: email
23+
remoteRef:
24+
key: *item
25+
property: email
26+
- secretKey: api_token
27+
remoteRef:
28+
key: *item
29+
property: apiToken
30+
- secretKey: secret-key
31+
remoteRef:
32+
key: *item
33+
property: secretKey

‎fleet/lib/netbox/base/externalsecret-netbox-valkey.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: external-secrets.io/v1
2+
kind: ExternalSecret
3+
metadata:
4+
name: netbox-valkey
5+
namespace: netbox
6+
spec:
7+
secretStoreRef:
8+
kind: ClusterSecretStore
9+
name: onepassword
10+
target:
11+
name: netbox-valkey
12+
creationPolicy: Owner
13+
data:
14+
- secretKey: valkey-password
15+
remoteRef:
16+
key: &item netbox-valkey
17+
property: password

‎fleet/lib/netbox/base/kustomization.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
---
2+
resources:
3+
- externalsecret-netbox-secrets.yaml
4+
- externalsecret-netbox-valkey.yaml
5+
- externalsecret-netbox-postgresql.yaml
6+
- externalsecret-netbox-keycloak.yaml
7+
8+
patches:
9+
- path: netbox-plugin-init-patch.yaml
10+
target:
11+
kind: Deployment
12+
name: netbox

‎fleet/lib/netbox/base/netbox-plugin-init-patch.yaml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
---
2+
apiVersion: apps/v1
3+
kind: Deployment
4+
metadata:
5+
name: netbox
6+
spec:
7+
template:
8+
spec:
9+
# Add shared volume for plugins
10+
volumes:
11+
- name: plugins-volume
12+
emptyDir: {}
13+
# Init container to install slurpit_netbox plugin
14+
initContainers:
15+
- name: install-plugins
16+
image: python:3.11-slim
17+
command:
18+
- /bin/bash
19+
- -c
20+
- |
21+
set -e
22+
echo "Installing slurpit_netbox plugin..."
23+
24+
# Install pip if not available
25+
python -m ensurepip --upgrade
26+
27+
# Install the slurpit_netbox plugin to shared volume
28+
pip install --target /opt/plugins slurpit_netbox
29+
30+
echo "Plugin installation completed"
31+
ls -la /opt/plugins/
32+
volumeMounts:
33+
- name: plugins-volume
34+
mountPath: /opt/plugins
35+
resources:
36+
requests:
37+
cpu: 100m
38+
memory: 256Mi
39+
limits:
40+
cpu: 500m
41+
memory: 512Mi
42+
containers:
43+
- name: netbox
44+
# Mount the plugins volume
45+
volumeMounts:
46+
- name: plugins-volume
47+
mountPath: /opt/netbox/plugins
48+
# Update PYTHONPATH to include plugins directory
49+
env:
50+
- name: PYTHONPATH
51+
value: "/opt/netbox/plugins:/opt/netbox"

‎fleet/lib/netbox/fleet.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
---
2+
defaultNamespace: &name netbox
3+
labels:
4+
bundle: *name
5+
namespaceLabels:
6+
lsst.io/discover: "true"
7+
kustomize:
8+
dir: base
9+
helm:
10+
chart: &chart netbox
11+
releaseName: *chart
12+
repo: https://charts.netbox.oss.netboxlabs.com/
13+
version: 6.1.5
14+
timeoutSeconds: 600
15+
waitForJobs: true
16+
valuesFiles:
17+
- values.yaml

0 commit comments

Comments
 (0)