NetBox

NetBox is an IP address management (IPAM) and data center infrastructure management (DCIM) tool.

TL;DR

$ helm repo add bootc https://charts.boo.tc
$ helm install netbox \
  --set postgresql.auth.postgresPassword=[password1] \
  --set postgresql.auth.password=[password2] \
  --set redis.auth.password=[password3] \
  bootc/netbox

Prerequisites

• This chart has only been tested on Kubernetes 1.18+, but should work on 1.14+
• This chart works with NetBox 3.0.0+ (3.0.11+ recommended)
• Recent versions of Helm 3 are supported

Installing the Chart

To install the chart with the release name my-release and default configuration:

$ helm repo add bootc https://charts.boo.tc
$ helm install my-release \
  --set postgresql.auth.postgresPassword=[password1] \
  --set postgresql.auth.password=[password2] \
  --set redis.auth.password=[password3] \
  bootc/netbox

The default configuration includes the required PostgreSQL and Redis database services, but either or both may be managed externally if required.

Production Usage

Always use an existing Secret and supply all passwords and secret keys yourself to avoid Helm re-generating any of them for you.

I strongly recommend setting both postgresql.enabled and redis.enabled to false and using a separate external PostgreSQL and Redis instance. This de-couples those services from the chart's bundled versions which may have complex upgrade requirements. I also recommend using a clustered PostgreSQL server (e.g. using Zalando's Postgres Operator) and Redis with Sentinel (e.g. using Aaron Layfield's redis-ha chart).

Set persistence.enabled to false and use the S3 storageBackend for object storage. This works well with Minio or Ceph RGW as well as Amazon S3.

Run multiple replicas of the NetBox web front-end to avoid interruptions during upgrades or at other times when the pods need to be restarted. There's no need to have multiple workers (worker.replicaCount) for better availability. Set up affinity.podAntiAffinity to avoid multiple NetBox pods being colocated on the same node, for example:

affinity:
  podAntiAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
      - labelSelector:
          matchLabels:
            app.kubernetes.io/instance: netbox
            app.kubernetes.io/name: netbox
            app.kubernetes.io/component: netbox
        topologyKey: kubernetes.io/hostname

Uninstalling the Chart

To delete the chart:

$ helm delete my-release

Upgrading

Bundled PostgreSQL

When upgrading or changing settings and using the bundled Bitnami PostgreSQL sub-chart, you must provide the postgresql.auth.password at minimum. Ideally you should also supply the postgresql.auth.postgresPassword and, if using replication, the postgresql.auth.replicationPassword. Please see the upstream documentation for further information.

From 4.x to 5.x

• NetBox has been updated to 3.4.4, but older 3.x versions should still work. This is not tested or supported, however.
• The Bitnami PostgreSQL sub-chart was upgraded from 10.x to 12.x; please read the upstream upgrade notes if you are using the bundled PostgreSQL
• The Bitnami Redis sub-chart was upgraded from 15.x to 17.x; please read the upstream upgrade notes if you are using the bundled Redis
• No particular upgrade steps are required as long as you are not using the bundled Bitnami PostgreSQL or Redis charts.

From 3.x to 4.x

• NetBox 3.0.0 or above is required
• The Bitnami Redis sub-chart was upgraded from 12.x to 15.x; please read the upstream upgrade notes if you are using the bundled Redis
• The cacheTimeout and releaseCheck.timeout settings were removed

From 2.x to 3.x

• NetBox 2.10.4 or above is required
• Kubernetes 1.14 or above is required
• Helm v3 or above is now required
• The netbox Deployment selectors are changed, so the Deployment must be deleted on upgrades
• The Bitnami PostgreSQL sub-chart was upgraded from 8.x to 10.x; please read the upstream upgrade notes if you are using the bundled PostgreSQL
• The Bitnami Redis sub-chart was upgraded from 10.x to 12.x; please read the upstream upgrade notes if you are using the bundled Redis
• The NGINX container is removed, on account of upstream's migration from Gunicorn to NGINX Unit
• The webhooksRedis configuration key in values.yaml has been renamed to tasksRedis to match the upstream name
• The redis_password key in the Secret has been renamed to redis_tasks_password

From 1.x to 2.x

If you use an external Redis you will need to update your configuration values due to the chart reflecting upstream changes in how it uses Redis. There are now separate Redis configuration blocks for webhooks and for caching, though they can both point at the same Redis instance as long as the database numbers are different.

From 0.x to 1.x

The chart dependencies on PostgreSQL and Redis have been upgraded, so you may need to take action depending on how you have configured the chart. The PostgreSQL chart was upgraded from 5.x.x to 7.x.x, and Redis from 8.x.x to 9.x.x.

Configuration

The following table lists the configurable parameters for this chart and their default values.

Specify each parameter using the --set key=value[,key=value] argument to helm install or provide a YAML file containing the values for the above parameters:

$ helm install --name my-release bootc/netbox --values values.yaml

Persistent storage pitfalls

Persistent storage for media is enabled by default, but unless you take special care you will run into issues. The most common issue is that one of the NetBox pods gets stuck in the ContainerCreating state. There are several ways around this problem:

1. For production usage I recommend disabling persistent storage by setting persistence.enabled to false and using the S3 storageBackend. This can be used with any S3-compatible storage provider including Amazon S3, Minio, Ceph RGW, and many others. See further down for an example of this.
2. Use a ReadWriteMany volume that can be mounted by several pods across nodes simultaneously.
3. Configure pod affinity settings to keep all the pods on the same node. This allows a ReadWriteOnce volume to be mounted in several pods at the same time.
4. Disable persistent storage of media altogether and just manage without. The storage functionality is only needed to store uploaded image attachments.

To configure the pod affinity to allow using a ReadWriteOnce volume you can use the following example configuration:

affinity:
  podAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
    - labelSelector:
        matchLabels:
          app.kubernetes.io/name: netbox
      topologyKey: kubernetes.io/hostname


housekeeping:
  affinity:
    podAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
      - labelSelector:
          matchLabels:
            app.kubernetes.io/name: netbox
        topologyKey: kubernetes.io/hostname

worker:
  affinity:
    podAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
      - labelSelector:
          matchLabels:
            app.kubernetes.io/name: netbox
        topologyKey: kubernetes.io/hostname

Using an Existing Secret

Rather than specifying passwords and secrets as part of the Helm release values, you may pass these to NetBox using a pre-existing Secret resource. When using this, the Secret must contain the following keys:

Using extraConfig for S3 storage configuration

If you want to use S3 as your storage backend and not have the config in the values.yaml (credentials!) you can use an existing secret that is then referenced under the extraConfig key.

The secret would look like this:

apiVersion: v1
kind: Secret
metadata:
  labels:
    app.kubernetes.io/instance: netbox
  name: netbox-extra
stringData:
  s3-config.yaml: |
    STORAGE_CONFIG:
      AWS_S3_ENDPOINT_URL: <endpoint-URL>
      AWS_S3_REGION_NAME: <region>
      AWS_STORAGE_BUCKET_NAME: <bucket-name>
      AWS_ACCESS_KEY_ID: <access-key>
      AWS_SECRET_ACCESS_KEY: <secret-key>

And the secret then has to be referenced like this:

extraConfig:
  - secret: # same as pod.spec.volumes.secret
      secretName: netbox-extra

Authentication

• Single Sign On
• LDAP Authentication

License

The following notice applies to all files contained within this Helm Chart and the Git repository which contains it:

Copyright 2019-2020 Chris Boot

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.