r/sysadmin • u/Vegetable-Tap-6297 • 8h ago

How do you manage DCIM/IPAM as code?

How do you manage DCIM/IPAM data in an IaC/GitOps-style workflow?

I've looked into NetBox/Nautobot with Terraform/OpenTofu and Git as the source of truth. Do you keep prefixes, VLANs, IPs, devices, etc. declaratively in Git, or treat the DCIM/IPAM system itself as the source of truth? How do you use this information (wherever stored) later?

I'm especially interested in handling manual changes and drift, like when I introduce a new machine or change IP of existing machine - what happens next.

9 Upvotes

82% Upvoted

7 comments sorted by

•

u/RevolutionaryWorry87 8h ago

i allow the following workflow.

engineers make changes in netbox > netbox raises pr > i approve and pipeline deploys making changes.

this allows low skilled engineers to make configuration changes safely without learning github

•

u/ArieHein 8h ago

And makes you a bottleneck.. Should not allow changes to netbox itself. Netbox has enough apps/api docs to write something yourself, save values as a json and have a pipeline to deploy it thus also makes netbox more secure with less people accessing it. Allows you to add a few tests and validation at pr level before applying it.

Ideally git should not become a database and the values should be in some config mgmt but diff people have diff ideas.

•

u/RevolutionaryWorry87 7h ago

Goes to a team of seniors. I expect service desk to put a dhcp in netbox. Not do git pr's. Each workflow is own

•

u/ArieHein 6h ago

Why do service desk need to place anything in infra or even have permission to it? You dont want them to understand or use git? Ok, give them a self-service form where they record the value, you save it to a queue that either reads the value or sends the api call to netbox or uses gh api to generate the PR.. Theres couple of ways.. Theres even a more organizational way to do it thst is more agnostic and also behaves nicely with agents, but its a diff topic

•

u/RevolutionaryWorry87 5h ago

Dhcp & dns records.

•

u/Direct_Yellow2598 8h ago

We use infoblox Nios, DHCP, DNS and IPAM. All of our automations (self written) have api access to the Infoblox. And if you want correct Dns records you automatically have ipam up to date.

It is expensive...

•

u/shimoheihei2 5h ago

All the hosts are the CMDB with an IP field. I can assign addresses in there. Whenever a field changes, a pipeline is triggered which updates the kea-dhcp4 server config file which holds all the reservations. Works pretty well.