Help with NetBox and Change Management/Approval

[adparis99]

Just curious, how do you guys integrate change management/workflow approval into NetBox? We as the network team have been working on building out all the info over the last few months and are ready to give limited access to the systems team to reserve IP addresses for VMs they create. Ideally, though, we'd like the process to go like so: IP is requested for use > we are notified and can approve > NetBox officially reserves the address. Perhaps we can adjust permissions such that when someone on the systems team attempt to request an IP they get denied, thus triggering a notification for us? But we'd need to know what IP they requested so we can make sure we're approving the right one. I know this isn't exactly what NetBox is for, but if anyone else has figured out a way to make use of it in this way, I'd love to hear how.

[mtinberg]

I have not, our Netbox only has read-write access to the network team who can authorize what they want, but I would suggest a mix of using the Status field (or adding custom Status options using FIELD_CHOICES https://demo.netbox.dev/static/docs/configuration/data-validation/) and custom_fields to show the state of the IP reservation in your workflow/approval system. Netbox can't do approval workflow by itself but it can be the data source for a plugin or API client so you can see where each IP is in the process. Create a flow chart for yourself as to how each status option maps to your workflow and what transitions are appropriate then make your automation do that. In your description, I'd make the IP record at the beginning step 1

1) IP is requested for use (ipam.ipaddress created, guarantees uniqueness) (external form using REST API, maybe custom Script if the access control can be handled, maybe add contact info to IP record for communication using Tenant or custom field?) 2) we are notified and can approve (maybe a custom Report that runs on a schedule or just have the form that creates the record in step 1 also notify) 3) NetBox officially reserves the address. (this step isn't needed, should create in step 1 so we can add data and see status) 4) request is accepted or denied 4a) accepted request: change IPaddress record from Reserved to Active (or create additional statuses for workflow management) 4b) denied request: delete IPaddress record and notify requestor

— Mark Tinberg ***@***.***> Division of Information Technology-Network Services University of Wisconsin-Madison

…

________________________________ From: adparis99 ***@***.***> Sent: Monday, November 21, 2022 9:08 PM To: netbox-community/netbox ***@***.***> Cc: Subscribed ***@***.***> Subject: [netbox-community/netbox] Help with NetBox and Change Management/Approval (Discussion #10995) Just curious, how do you guys integrate change management/workflow approval into NetBox? We as the network team have been working on building out all the info over the last few months and are ready to give limited access to the system team to reserve IP addresses for VMs they create. Ideally, though, we'd like the process to go like so: IP is requested for use > we are notified and can approve > NetBox officially reserves the address. Perhaps we can have the someone attempt to request an IP and get denied and then be notified? But we'd need to know what IP they requested so we can make sure we're approving the right one. I know this isn't exactly what NetBox is for, but if anyone else has figured out a way to make use of it in this way, I'd love to hear how. — Reply to this email directly, view it on GitHub<#10995>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AAS7UM7PGISVNATDNNK573DWJQ2JDANCNFSM6AAAAAASHJV4HM>. You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[adparis99]

Hey there, thank you very much for your thoughts. I went ahead and implemented something that I think will work for us based on them:

1. IP is created. I ended up giving the Systems team read access to everything but write access specifically to reserved addresses, which I didn't realize was possible but serves as a perfect solution in this case.
2. When an IP is created with the reserved status, a webhook sends an email to the network team letting us know an IP has been reserved and containing a link directly to it.
3. As you mentioned, once we verify things on our side, we simply change the status to active as a method of approval.