Skip to content

Commit e13fe08

Browse files
gserichegseriche
committed
(fleet/netbox) Deploy netbox on Kueyen
1 parent ee1907d commit e13fe08

File tree

8 files changed

+293
-0
lines changed

8 files changed

+293
-0
lines changed

‎fleet/lib/netbox/README.md‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
# NetBox Kubernetes Deployment
2+
3+
## Overview
4+
5+
NetBox is an Infrastructure Resource Modeling (IRM) application designed to empower network automation. This deployment provides a production-ready NetBox instance on Kubernetes using Helm charts and Fleet configuration management.
6+
7+
## Architecture
8+
9+
- **Chart**: netbox v6.1.5 from <https://charts.netbox.oss.netboxlabs.com/>
10+
- **Namespace**: netbox
11+
- **Components**: Web application, worker processes, PostgreSQL database, Valkey cache
12+
- **Ingress**: NGINX with Let's Encrypt TLS certificates
13+
14+
## Configuration
15+
16+
### Core Settings
17+
18+
- **Timezone**: America/Santiago
19+
- **Superuser**: <[email protected]>
20+
- **Change Log Retention**: 90 days
21+
- **Job Retention**: 90 days
22+
- **GraphQL**: Enabled
23+
- **Login Required**: False
24+
25+
### Security
26+
27+
- Non-root container execution (UID/GID: 1000)
28+
- Read-only root filesystem
29+
- Dropped capabilities
30+
- Runtime security profile enabled
31+
- External secret management via Kubernetes secrets
32+
33+
### Storage
34+
35+
- **Persistence**: Disabled (ephemeral storage)
36+
- **PostgreSQL**: 20Gi persistent storage (rook-ceph-block)
37+
- **Media/Reports/Scripts**: Stored in ephemeral volumes
38+
39+
### Resources
40+
41+
| Component | CPU Request | Memory Request | CPU Limit | Memory Limit |
42+
|-----------|-------------|----------------|-----------|--------------|
43+
| NetBox | 500m | 1Gi | 1000m | 2Gi |
44+
| Worker | 500m | 1Gi | 1000m | 2Gi |
45+
| PostgreSQL| 250m | 512Mi | 500m | 1Gi |
46+
47+
## Access
48+
49+
NetBox is accessible via dynamically generated hostnames based on cluster configuration:
50+
51+
```
52+
https://netbox.{cluster-name}.{site}.lsst.org
53+
```
54+
55+
## Maintenance
56+
57+
- **Housekeeping**: Daily automated cleanup (00:00 UTC)
58+
- **Job History**: 5 successful/failed jobs retained
59+
- **Monitoring**: Available via cluster monitoring stack

‎fleet/lib/netbox/base/externalsecret-netbox-postgresql.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
apiVersion: external-secrets.io/v1
2+
kind: ExternalSecret
3+
metadata:
4+
name: netbox-postgresql
5+
namespace: netbox
6+
spec:
7+
secretStoreRef:
8+
kind: ClusterSecretStore
9+
name: onepassword
10+
target:
11+
name: netbox-postgresql
12+
creationPolicy: Owner
13+
data:
14+
- secretKey: password
15+
remoteRef:
16+
key: &item netbox-postgresql
17+
property: password
18+
- secretKey: postgres-password
19+
remoteRef:
20+
key: *item
21+
property: postgres-password

‎fleet/lib/netbox/base/externalsecret-netbox-secrets.yaml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
apiVersion: external-secrets.io/v1
2+
kind: ExternalSecret
3+
metadata:
4+
name: netbox-secrets
5+
namespace: netbox
6+
spec:
7+
secretStoreRef:
8+
kind: ClusterSecretStore
9+
name: onepassword
10+
target:
11+
name: netbox-secrets
12+
creationPolicy: Owner
13+
data:
14+
- secretKey: username
15+
remoteRef:
16+
key: &item netbox-secrets
17+
property: username
18+
- secretKey: password
19+
remoteRef:
20+
key: *item
21+
property: password
22+
- secretKey: email
23+
remoteRef:
24+
key: *item
25+
property: email
26+
- secretKey: api_token
27+
remoteRef:
28+
key: *item
29+
property: apiToken
30+
- secretKey: secret-key
31+
remoteRef:
32+
key: *item
33+
property: secretKey

‎fleet/lib/netbox/base/externalsecret-netbox-valkey.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: external-secrets.io/v1
2+
kind: ExternalSecret
3+
metadata:
4+
name: netbox-valkey
5+
namespace: netbox
6+
spec:
7+
secretStoreRef:
8+
kind: ClusterSecretStore
9+
name: onepassword
10+
target:
11+
name: netbox-valkey
12+
creationPolicy: Owner
13+
data:
14+
- secretKey: valkey-password
15+
remoteRef:
16+
key: &item netbox-valkey
17+
property: password

‎fleet/lib/netbox/base/kustomization.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
resources:
3+
- externalsecret-netbox-secrets.yaml
4+
- externalsecret-netbox-valkey.yaml
5+
- externalsecret-netbox-postgresql.yaml

‎fleet/lib/netbox/fleet.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
---
2+
defaultNamespace: &name netbox
3+
labels:
4+
bundle: *name
5+
namespaceLabels:
6+
lsst.io/discover: "true"
7+
kustomize:
8+
dir: base
9+
helm:
10+
chart: &chart netbox
11+
releaseName: *chart
12+
repo: https://charts.netbox.oss.netboxlabs.com/
13+
version: 6.1.5
14+
timeoutSeconds: 600
15+
waitForJobs: true
16+
valuesFiles:
17+
- values.yaml

‎fleet/lib/netbox/values.yaml‎

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
nameOverride: netbox
2+
clusterDomain: cluster.local
3+
4+
superuser:
5+
name: admin
6+
email: [email protected]
7+
existingSecret: netbox-secrets
8+
9+
10+
allowedHosts:
11+
- netbox.${ get .ClusterLabels "management.cattle.io/cluster-display-name" }.${ .ClusterLabels.site }.lsst.org
12+
13+
allowedHostsIncludesPodIP: false
14+
15+
admins:
16+
- [Admin User, [email protected]]
17+
18+
internalIPs: [127.0.0.1]
19+
20+
timeZone: America/Santiago
21+
22+
# Disable persistent volumes to avoid multi-attach issues with ReadWriteOnce storage
23+
# Media files will be stored in ephemeral storage
24+
persistence:
25+
enabled: false
26+
# storageClass: rook-ceph-block
27+
# accessMode: ReadWriteOnce
28+
# size: 10Gi
29+
# annotations: {}
30+
31+
reportsPersistence:
32+
enabled: false
33+
# storageClass: rook-ceph-block
34+
# accessMode: ReadWriteOnce
35+
# size: 1Gi
36+
# annotations: {}
37+
38+
scriptsPersistence:
39+
enabled: false
40+
# storageClass: rook-ceph-block
41+
# accessMode: ReadWriteOnce
42+
# size: 1Gi
43+
# annotations: {}
44+
45+
resourcesPreset: medium
46+
resources:
47+
requests:
48+
cpu: 500m
49+
memory: 1Gi
50+
limits:
51+
cpu: 1000m
52+
memory: 2Gi
53+
54+
## @section Traffic Exposure Parameters
55+
56+
ingress:
57+
enabled: true
58+
className: nginx
59+
annotations:
60+
cert-manager.io/cluster-issuer: letsencrypt
61+
nginx.ingress.kubernetes.io/backend-protocol: HTTP
62+
nginx.ingress.kubernetes.io/client-body-buffer-size: 10m
63+
nginx.ingress.kubernetes.io/proxy-read-timeout: "60"
64+
nginx.ingress.kubernetes.io/proxy-send-timeout: "60"
65+
hosts:
66+
- host: netbox.${ get .ClusterLabels "management.cattle.io/cluster-display-name" }.${ .ClusterLabels.site }.lsst.org
67+
paths:
68+
- /
69+
tls:
70+
- secretName: netbox-tls
71+
hosts:
72+
- netbox.${ get .ClusterLabels "management.cattle.io/cluster-display-name" }.${ .ClusterLabels.site }.lsst.org
73+
74+
postgresql:
75+
enabled: true
76+
auth:
77+
username: netbox
78+
database: netbox
79+
existingSecret: netbox-postgresql
80+
secretKeys:
81+
adminPasswordKey: postgres-password
82+
userPasswordKey: password
83+
# Ensure PostgreSQL is ready before Netbox starts
84+
primary:
85+
persistence:
86+
enabled: true
87+
storageClass: rook-ceph-block
88+
size: 20Gi
89+
resources:
90+
requests:
91+
cpu: 250m
92+
memory: 512Mi
93+
limits:
94+
cpu: 500m
95+
memory: 1Gi
96+
97+
valkey:
98+
enabled: true
99+
auth:
100+
existingSecret: netbox-valkey
101+
existingSecretPasswordKey: valkey-password
102+
103+
## @section Worker for Netbox parameters
104+
105+
worker:
106+
enabled: true
107+
resourcesPreset: medium
108+
resources:
109+
requests:
110+
cpu: 500m
111+
memory: 1Gi
112+
limits:
113+
cpu: 1000m
114+
memory: 2Gi
115+
116+
## @section Cron housekeeping job parameters
117+
118+
housekeeping:
119+
enabled: true
120+
schedule: 0 0 * * *
121+
successfulJobsHistoryLimit: 5
122+
failedJobsHistoryLimit: 5
123+
resourcesPreset: medium
124+
resources:
125+
requests:
126+
cpu: 500m
127+
memory: 1Gi
128+
limits:
129+
cpu: 1000m
130+
memory: 2Gi
131+
132+
# Database configuration using external secrets
133+
extraEnvs:
134+
- name: DB_WAIT_DEBUG
135+
value: "1"
136+
- name: SECRET_KEY
137+
valueFrom:
138+
secretKeyRef:
139+
name: netbox-secrets
140+
key: secret-key

‎fleet/s/dev/c/kueyen/netbox‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../../../../lib/netbox

0 commit comments

Comments
 (0)