Skip to content

Commit d1ca89d

Browse files
gserichegseriche
committed
Deploy NetBox with slurpit_netbox plugin using init container
- Add init container to install slurpit_netbox plugin via pip - Enable slurpit_netbox plugin in NetBox configuration - Use shared volume to provide plugins to NetBox container - Update PYTHONPATH to include plugins directory
1 parent ee1907d commit d1ca89d

File tree

9 files changed

+371
-0
lines changed

9 files changed

+371
-0
lines changed

‎fleet/lib/netbox/README.md‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
# NetBox Kubernetes Deployment
2+
3+
## Overview
4+
5+
NetBox is an Infrastructure Resource Modeling (IRM) application designed to empower network automation. This deployment provides a production-ready NetBox instance on Kubernetes using Helm charts and Fleet configuration management.
6+
7+
## Architecture
8+
9+
- **Chart**: netbox v6.1.5 from <https://charts.netbox.oss.netboxlabs.com/>
10+
- **Namespace**: netbox
11+
- **Components**: Web application, worker processes, PostgreSQL database, Valkey cache
12+
- **Ingress**: NGINX with Let's Encrypt TLS certificates
13+
14+
## Configuration
15+
16+
### Core Settings
17+
18+
- **Timezone**: America/Santiago
19+
- **Superuser**: <[email protected]>
20+
- **Change Log Retention**: 90 days
21+
- **Job Retention**: 90 days
22+
- **GraphQL**: Enabled
23+
- **Login Required**: False
24+
25+
### Security
26+
27+
- Non-root container execution (UID/GID: 1000)
28+
- Read-only root filesystem
29+
- Dropped capabilities
30+
- Runtime security profile enabled
31+
- External secret management via Kubernetes secrets
32+
33+
### Storage
34+
35+
- **Persistence**: Disabled (ephemeral storage)
36+
- **PostgreSQL**: 20Gi persistent storage (rook-ceph-block)
37+
- **Media/Reports/Scripts**: Stored in ephemeral volumes
38+
39+
### Resources
40+
41+
| Component | CPU Request | Memory Request | CPU Limit | Memory Limit |
42+
|-----------|-------------|----------------|-----------|--------------|
43+
| NetBox | 500m | 1Gi | 1000m | 2Gi |
44+
| Worker | 500m | 1Gi | 1000m | 2Gi |
45+
| PostgreSQL| 250m | 512Mi | 500m | 1Gi |
46+
47+
## Access
48+
49+
NetBox is accessible via dynamically generated hostnames based on cluster configuration:
50+
51+
```bash
52+
https://netbox.{cluster-name}.{site}.lsst.org
53+
```
54+
55+
## Maintenance
56+
57+
- **Housekeeping**: Daily automated cleanup (00:00 UTC)
58+
- **Job History**: 5 successful/failed jobs retained
59+
- **Monitoring**: Available via cluster monitoring stack

‎fleet/lib/netbox/base/externalsecret-netbox-postgresql.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
apiVersion: external-secrets.io/v1
2+
kind: ExternalSecret
3+
metadata:
4+
name: netbox-postgresql
5+
namespace: netbox
6+
spec:
7+
secretStoreRef:
8+
kind: ClusterSecretStore
9+
name: onepassword
10+
target:
11+
name: netbox-postgresql
12+
creationPolicy: Owner
13+
data:
14+
- secretKey: password
15+
remoteRef:
16+
key: &item netbox-postgresql
17+
property: password
18+
- secretKey: postgres-password
19+
remoteRef:
20+
key: *item
21+
property: postgres-password

‎fleet/lib/netbox/base/externalsecret-netbox-secrets.yaml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
apiVersion: external-secrets.io/v1
2+
kind: ExternalSecret
3+
metadata:
4+
name: netbox-secrets
5+
namespace: netbox
6+
spec:
7+
secretStoreRef:
8+
kind: ClusterSecretStore
9+
name: onepassword
10+
target:
11+
name: netbox-secrets
12+
creationPolicy: Owner
13+
data:
14+
- secretKey: username
15+
remoteRef:
16+
key: &item netbox-secrets
17+
property: username
18+
- secretKey: password
19+
remoteRef:
20+
key: *item
21+
property: password
22+
- secretKey: email
23+
remoteRef:
24+
key: *item
25+
property: email
26+
- secretKey: api_token
27+
remoteRef:
28+
key: *item
29+
property: apiToken
30+
- secretKey: secret-key
31+
remoteRef:
32+
key: *item
33+
property: secretKey

‎fleet/lib/netbox/base/externalsecret-netbox-valkey.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: external-secrets.io/v1
2+
kind: ExternalSecret
3+
metadata:
4+
name: netbox-valkey
5+
namespace: netbox
6+
spec:
7+
secretStoreRef:
8+
kind: ClusterSecretStore
9+
name: onepassword
10+
target:
11+
name: netbox-valkey
12+
creationPolicy: Owner
13+
data:
14+
- secretKey: valkey-password
15+
remoteRef:
16+
key: &item netbox-valkey
17+
property: password

‎fleet/lib/netbox/base/kustomization.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
---
2+
resources:
3+
- externalsecret-netbox-secrets.yaml
4+
- externalsecret-netbox-valkey.yaml
5+
- externalsecret-netbox-postgresql.yaml
6+
7+
patches:
8+
- path: netbox-plugin-init-patch.yaml
9+
target:
10+
kind: Deployment
11+
name: netbox

‎fleet/lib/netbox/base/netbox-plugin-init-patch.yaml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
---
2+
apiVersion: apps/v1
3+
kind: Deployment
4+
metadata:
5+
name: netbox
6+
spec:
7+
template:
8+
spec:
9+
# Add shared volume for plugins
10+
volumes:
11+
- name: plugins-volume
12+
emptyDir: {}
13+
# Init container to install slurpit_netbox plugin
14+
initContainers:
15+
- name: install-plugins
16+
image: python:3.11-slim
17+
command:
18+
- /bin/bash
19+
- -c
20+
- |
21+
set -e
22+
echo "Installing slurpit_netbox plugin..."
23+
24+
# Install pip if not available
25+
python -m ensurepip --upgrade
26+
27+
# Install the slurpit_netbox plugin to shared volume
28+
pip install --target /opt/plugins slurpit_netbox
29+
30+
echo "Plugin installation completed"
31+
ls -la /opt/plugins/
32+
volumeMounts:
33+
- name: plugins-volume
34+
mountPath: /opt/plugins
35+
resources:
36+
requests:
37+
cpu: 100m
38+
memory: 256Mi
39+
limits:
40+
cpu: 500m
41+
memory: 512Mi
42+
containers:
43+
- name: netbox
44+
# Mount the plugins volume
45+
volumeMounts:
46+
- name: plugins-volume
47+
mountPath: /opt/netbox/plugins
48+
# Update PYTHONPATH to include plugins directory
49+
env:
50+
- name: PYTHONPATH
51+
value: "/opt/netbox/plugins:/opt/netbox"

‎fleet/lib/netbox/fleet.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
---
2+
defaultNamespace: &name netbox
3+
labels:
4+
bundle: *name
5+
namespaceLabels:
6+
lsst.io/discover: "true"
7+
kustomize:
8+
dir: base
9+
helm:
10+
chart: &chart netbox
11+
releaseName: *chart
12+
repo: https://charts.netbox.oss.netboxlabs.com/
13+
version: 6.1.5
14+
timeoutSeconds: 600
15+
waitForJobs: true
16+
valuesFiles:
17+
- values.yaml

‎fleet/lib/netbox/values.yaml‎

Lines changed: 161 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,161 @@
1+
nameOverride: netbox
2+
clusterDomain: cluster.local
3+
4+
superuser:
5+
name: admin
6+
email: [email protected]
7+
existingSecret: netbox-secrets
8+
9+
10+
allowedHosts:
11+
- netbox.${ get .ClusterLabels "management.cattle.io/cluster-display-name" }.${ .ClusterLabels.site }.lsst.org
12+
13+
allowedHostsIncludesPodIP: false
14+
15+
admins:
16+
- [Admin User, [email protected]]
17+
18+
internalIPs: [127.0.0.1]
19+
20+
timeZone: America/Santiago
21+
22+
# Disable persistent volumes to avoid multi-attach issues with ReadWriteOnce storage
23+
# Media files will be stored in ephemeral storage
24+
persistence:
25+
enabled: false
26+
# storageClass: rook-ceph-block
27+
# accessMode: ReadWriteOnce
28+
# size: 10Gi
29+
# annotations: {}
30+
31+
reportsPersistence:
32+
enabled: false
33+
# storageClass: rook-ceph-block
34+
# accessMode: ReadWriteOnce
35+
# size: 1Gi
36+
# annotations: {}
37+
38+
scriptsPersistence:
39+
enabled: false
40+
# storageClass: rook-ceph-block
41+
# accessMode: ReadWriteOnce
42+
# size: 1Gi
43+
# annotations: {}
44+
45+
resourcesPreset: medium
46+
resources:
47+
requests:
48+
cpu: 500m
49+
memory: 1Gi
50+
limits:
51+
cpu: 1000m
52+
memory: 2Gi
53+
54+
## @section Traffic Exposure Parameters
55+
56+
ingress:
57+
enabled: true
58+
className: nginx
59+
annotations:
60+
cert-manager.io/cluster-issuer: letsencrypt
61+
nginx.ingress.kubernetes.io/backend-protocol: HTTP
62+
nginx.ingress.kubernetes.io/client-body-buffer-size: 10m
63+
nginx.ingress.kubernetes.io/proxy-read-timeout: "60"
64+
nginx.ingress.kubernetes.io/proxy-send-timeout: "60"
65+
hosts:
66+
- host: netbox.${ get .ClusterLabels "management.cattle.io/cluster-display-name" }.${ .ClusterLabels.site }.lsst.org
67+
paths:
68+
- /
69+
tls:
70+
- secretName: netbox-tls
71+
hosts:
72+
- netbox.${ get .ClusterLabels "management.cattle.io/cluster-display-name" }.${ .ClusterLabels.site }.lsst.org
73+
74+
postgresql:
75+
enabled: true
76+
auth:
77+
username: netbox
78+
database: netbox
79+
existingSecret: netbox-postgresql
80+
secretKeys:
81+
adminPasswordKey: postgres-password
82+
userPasswordKey: password
83+
# Use external secret passwords for consistency
84+
usePasswordFiles: false
85+
# Ensure PostgreSQL is ready before Netbox starts
86+
primary:
87+
persistence:
88+
enabled: true
89+
storageClass: rook-ceph-block
90+
size: 20Gi
91+
resources:
92+
requests:
93+
cpu: 250m
94+
memory: 512Mi
95+
limits:
96+
cpu: 500m
97+
memory: 1Gi
98+
# Global PostgreSQL configuration to prevent credential mismatch
99+
global:
100+
postgresql:
101+
auth:
102+
existingSecret: netbox-postgresql
103+
secretKeys:
104+
adminPasswordKey: postgres-password
105+
userPasswordKey: password
106+
107+
valkey:
108+
enabled: true
109+
auth:
110+
existingSecret: netbox-valkey
111+
existingSecretPasswordKey: valkey-password
112+
113+
## @section Worker for Netbox parameters
114+
115+
worker:
116+
enabled: true
117+
replicaCount: 1
118+
resources:
119+
requests:
120+
cpu: 500m
121+
memory: 1Gi
122+
limits:
123+
cpu: 1000m
124+
memory: 2Gi
125+
126+
## @section Cron housekeeping job parameters
127+
128+
housekeeping:
129+
enabled: true
130+
schedule: 0 0 * * *
131+
successfulJobsHistoryLimit: 5
132+
failedJobsHistoryLimit: 5
133+
resourcesPreset: medium
134+
resources:
135+
requests:
136+
cpu: 500m
137+
memory: 1Gi
138+
limits:
139+
cpu: 1000m
140+
memory: 2Gi
141+
142+
# Database configuration using external secrets
143+
extraEnvs:
144+
- name: DB_WAIT_DEBUG
145+
value: "1"
146+
- name: SECRET_KEY
147+
valueFrom:
148+
secretKeyRef:
149+
name: netbox-secrets
150+
key: secret-key
151+
152+
153+
# Plugin configuration
154+
plugins:
155+
- slurpit_netbox
156+
157+
pluginsConfig:
158+
slurpit_netbox:
159+
# Basic configuration for slurpit_netbox plugin
160+
# Add specific configuration options as needed
161+

‎fleet/s/dev/c/kueyen/netbox‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../../../../lib/netbox

0 commit comments

Comments
 (0)