Automation & Tooling

NetBox IPAM

The IP address source of truth and the first stop in provisioning, where an address is reserved before infrastructure exists and released after verified teardown.

What it is and whyHow I use it inArchitectureLessons learned and gotchasImpactFurther reading

What it is & why I use it

NetBox is the IP address management (IPAM) and inventory system for AutomationLab. It is the authoritative record of which addresses are in use, which are free, and what each one is for. When the pipeline provisions a machine, its first action is to ask NetBox for an address - allocation happens in the record before the VM is built.

I use it because "which IPs are free?" should have one trustworthy answer, queryable by automation, not a spreadsheet or a guess. An IPAM that the provisioning flow actually consults is what keeps a growing lab from quietly handing out the same address twice.

How I use it in the lab

Allocate first. The provisioning pipeline requests an address from NetBox as its opening step, so the record reserves it before anything downstream uses it.
Feeds the rest of the flow. The allocated address flows into the infrastructure-as-code and configuration stages, so downstream steps build on the same authoritative value.
Released on decommission. Tearing a machine down returns its address to the pool in NetBox, so freed space is actually reusable and the record keeps matching reality.
Queried, not remembered. Automation reads NetBox through its API rather than relying on anyone's memory of what is assigned where.

Architecture

NetBox owns address allocation before infrastructure creation and releases the address after decommissioning. Prefixes, addresses, and hostnames are omitted.

Lessons learned & gotchas

Gotcha - a source of truth is only true if everything goes through it NetBox is authoritative right up until someone assigns an address out of band - a quick manual static IP, a machine stood up outside the pipeline. The moment that happens, the record and the network disagree, and the next automated allocation can hand out an address that is already quietly in use. An IPAM does not enforce reality; it only reflects what it is told. Provisioning and decommission paths therefore reserve and release addresses through NetBox. Bypassing that path turns the source of truth into a stale record.

Allocate before you build, not after. Reserving the address first removes the ordinary race between concurrent provisions. Recording it after the fact leaves a window where a conflict can slip in.
Release on teardown or the pool silently shrinks. If decommission does not return the address, the free pool leaks over time and you eventually "run out" of space that is actually idle. The reverse path matters as much as the forward one.
Reconcile occasionally. Because out-of-band changes remain possible, it is worth periodically checking the record against what is really answering on the network, and fixing drift before it causes a conflict.

Impact

First

step in provisioning

authoritative IP record

Release

after verified teardown

NetBox makes address management a controlled workflow instead of a recurring source of conflicts. The lesson generalizes: a source of truth stays trustworthy when managed work flows through it. Bypassing it turns the record into a confident-looking liability.