Skip to content

vmware source: stop reconciling guest.net IPs on acos/tmos/alteon data interfaces - #11

Merged
dirtycache merged 1 commit into
mainfrom
wip/guestnet-ip-guard
Jul 29, 2026
Merged

vmware source: stop reconciling guest.net IPs on acos/tmos/alteon data interfaces#11
dirtycache merged 1 commit into
mainfrom
wip/guestnet-ip-guard

Conversation

@dirtycache

Copy link
Copy Markdown
Owner

Summary

  • netbox-sync's guest.net-derived IP reconciliation was fighting netbox-device-onboard.py's self-IP writes on acos/tmos/alteon data-plane interfaces every 5-minute cron cycle (confirmed live in netbox_sync.log for both alt01a and ltm01a).
  • Extends the existing identity-only-sync policy (previously attributes-only) to also cover IP-to-interface ownership: a new _skip_ip_reconciliation flag tells add_update_interface() to leave a data interface's IP assignment alone entirely. mgmt interfaces are unaffected - that path has never conflicted.
  • Also re-sources (no data change) any IP left alone this way so the 30-day orphan-prune doesn't reclaim an address a device-side collector is actively managing.

Test plan

  • Dry run (-n -l DEBUG2) against live vCenter/NetBox data before the fix: reproduced both failure modes (address torn off alt01a's vNIC; address reparented off ltm01a's synthetic VLAN interface onto the real vNIC 1.3)
  • Dry run after the fix: zero proposed changes for alt01a/alt01b/ltm01a/ltm01b/bigip-ve-001/thn01a/thn01b
  • Confirmed mgmt IPs still flow through guest.net normally (unaffected by the new guard)
  • Confirmed previously-assigned self-IPs no longer get tagged NetBox-synced: Orphaned

…a interfaces

Confirmed live: netbox-sync's own guest.net-derived IP handling was fighting
netbox-device-onboard.py's self-IP writes on these platforms' data-plane
interfaces every 5-minute cron cycle - either tearing the address off a real
vNIC guest.net never reports it on (alt01a), or reparenting it back onto the
real vNIC from the device-side collector's synthetic VLAN interface (ltm01a).
The existing identity-only-sync policy only covered interface attributes, not
IP-to-interface ownership.

Extends the same per-platform policy: a new _skip_ip_reconciliation flag
(smuggled through interface_data the same way untagged_vlan/tagged_vlans
already are) tells add_update_interface() to leave a data interface's IP
assignment alone entirely, for both additions and removals. mgmt keeps
syncing from guest.net as before - that path has never conflicted.

Also touch (re-source, no data change) any IP left alone this way, so
prune_data()'s 30-day orphan-delete doesn't reclaim an address a device-side
collector is actively managing just because this source stopped claiming it.
@dirtycache
dirtycache merged commit b2c5495 into main Jul 29, 2026
@dirtycache
dirtycache deleted the wip/guestnet-ip-guard branch July 29, 2026 17:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant