netbox-ceph

netbox-ceph is a sibling NetBox plugin for netbox-proxbox. It mirrors Proxmox-managed Ceph inventory through proxbox-api and reuses netbox-proxbox backend context, branch lifecycle, endpoint relationships and job conventions. Its v1 reflected inventory is intentionally read-only. Reflected inventory (v1) The plugin ships clusters, daemons, OSDs, pools, filesystems, CRUSH rules, flags, health checks, plugin settings, and read-only RGW/S3 and RBD reflected inventory. Syncs are dispatched with POST /api/plugins/ceph/clusters/{id}/sync/, which enqueues a CephSyncJob with a 7200-second timeout. A resources parameter may be passed as a list or comma-separated string, such as ["pools", "osds"]; omitting it runs the default full sync. Queued runs appear in NetBox's core Jobs UI. Desired-state control plane (v2) Ceph v2 adds a separately gated desired-state plane: immutable endpoint-and-configuration-revision-bound plans, validation findings, two-person approval audit records, apply/recovery runs, drift records, metric snapshots, and a typed proxbox-api client. A raw approval token exists only between the approval response and the immediately following apply request; it is never stored, logged, serialized or rendered by NetBox. Desired-state models let operators declare NetBox-first intent for pools, CephFS, RBD and RGW/S3 — size, autoscale, CRUSH rule, application, quotas, compression, CephFS metadata/data pools, MDS placement, RBD image layout/features, RBD snapshot protection, RGW topology, S3 users and buckets. These remain useful as NetBox-owned intent records. The strict proxbox-ceph-v2-2026-07 writer currently lets only pool and CephFS rows generate mutations. Each supported row requires an exact execution_node; pool payloads are limited to the fields accepted by proxbox-api issue #258, and CephFS creation is limited to pg_num and add_storage. RBD and RGW/S3 intent is browsable but deliberately has no Generate operation action until writer support exists. Approval flow and permissions The requester must hold the custom request and apply permissions; a different actor with the approve permission then performs a single Approve & apply action through the orchestrator. Migration 0007_ceph_plan_bound_approvals retires legacy authority, adds endpoint/provider/node/configuration snapshots, creates expiring approval-issuance leases, and enforces one local run per approval. Installation Install with pip install netbox-ceph, add both "netbox_proxbox" and "netbox_ceph" to PLUGINS in configuration.py, then run NetBox migrations as usual. Scope and safety notes Out of scope for v1: direct Ceph Dashboard API integration, Prometheus metric ingestion, external non-Proxmox Ceph clusters, and NetBox-to-Ceph write operations for reflected inventory. No shell or direct Proxmox API fallback exists. Recommended rollout: deploy the matching backend contract first, back up NetBox, migrate, grant request/apply/approve permissions deliberately, populate exact execution nodes on legacy supported intent, and validate the full flow in staging; keep all Proxmox endpoint allow_writes flags disabled until those gates and the authenticated actor-header gateway control are complete. Compatibility and project status The repository includes Apache-2.0 licensing, PyPI metadata, compatibility metadata, GitHub Actions CI, release validation, docs publishing, and screenshot capture and page-coverage workflows for NetBox v4.6.4. Digest-pinned Docker install smoke covers official NetBox v4.7.0 GA, and exact-source integration tests cover the backward-compatible v4.5.8 through v4.6.6 range. NetBox v4.7.0 GA metadata is admitted on a GA basis without a compatibility warning, while 4.7.1 and later fail closed; CI pins GA source revision 5f06007e4c9bacc93ce17c1e645fc1143d60df3d. Full documentation is published at the project's documentation site, model and field references live in docs/models.md, the version table is in COMPATIBILITY.md, certification evidence is tracked in CERTIFICATION.md, and bugs and feature requests are handled through GitHub Issues.