NetBox becomes the source of truth for host/interface/IPAM data as part of
retiring Cobbler (the ENC already moved to encapi; a kickstart-generation
service consuming NetBox comes later and is out of scope here).
Adds the netbox app in namespace netbox:
- netbox-community helm chart 8.3.40 (appVersion v4.6.5) via the OCI
helm-through-kustomize pattern; bundled Postgres and Valkey subcharts
disabled in favour of estate-native components.
- CNPG Postgres cluster (2 instances) with the standard per-cluster S3 backup
stanza (barmanObjectStore -> s3://cnpg-netbox, cephrgw ObjectStoreUser +
Bucket, nightly ScheduledBackup at 03:40, 30d retention) and a pgbouncer
Pooler (session mode) that NetBox connects through.
- Standalone Valkey Deployment (valkey/valkey:8-alpine, AOF-persistent PVC)
serving DB 0 = RQ task queue, DB 1 = cache; matches the litellm standalone
cache pattern and keeps image control in-estate.
- Gateway + HTTPRoute at netbox.k8s.syd1.au.unkin.net (traefik-internal,
vault-issuer cert, external-dns), HTTP->HTTPS redirect.
- All credentials via VSO VaultStaticSecret (postgres-credentials,
netbox-secret-key, netbox-superuser, oauth-credentials); no plain Secrets.
- Authentik OIDC SSO (python-social-auth): REMOTE_AUTH wired via chart values,
SOCIAL_AUTH_OIDC_* via extraConfig, client secret injected as a YAML fragment
from Vault; auto-provisions users on first login.
Registers netbox in the platform ApplicationSet and AppProject (destination
namespace + chart sourceRepo).
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
unkinben
a28aabae78