A per-site data-source lookup cannot resolve a global object before the global
unit has applied it, which deadlocks the first plan. Pass device-type, device
role and dhcp IPAM role ids as dependency outputs instead, mocked for plan.
Stop repeating the site slug inside the YAML: terragrunt passes the dc as
site_slug and site.yaml carries only site-wide attributes. Declare device
types, roles, platforms, custom fields and the dhcp IPAM role once in
config/global via their own unit and state; the per-site unit looks them up
by slug or name.
Device records, interfaces, MACs and cabling are written by the
autodiscovery agent, and host names, roles and IP allocation by the UI, so
terraform declaring them fights both owners.
- drop the device, interface, MAC, per-host IP and net:<name> tag resources
- declare sites, device types, roles and platforms in their own config files
- add interface templates per device type and model the Omada SG3429X
- add per-site VLAN groups and VLANs, seeding vid 101 and 201 in syd1
- publish network profiles as site-scoped config contexts
- rename subnets to net-<a>-<b>-<c>-<d>-<len> and restore dns/domain/next_server
The syd1 site does not exist, so the site data source failed the plan.
Sites now follow the same declared-by-reference rule as device roles,
types and manufacturers.
Carried over from terraform-infra, scoped to NetBox: Kea is managed by the
kea-operator CRs. Devices carried no platform and NetBox had no custom
fields, so bootapi could only ever render its default template.
- prefixes, DHCP-pool ip_ranges, gateways, networks, devices and the
PuppetDB backfill script, minus every Kea resource, provider and token
- netbox_custom_field definitions from config/<region>/<dc>/custom-fields.yaml
- netbox_platform per declared platform, set as the device platform_id
- model_hint written to the device provision_template custom field
- state key infra/terraform/netbox, NetBox token from netbox/creds/terraform-netbox
pxe_enabled's value is deliberately unmanaged: it is runtime state that
bootapi's provisioned callback clears.
unkin-agent