I'm designing a workflow for managing DCIM and IPAM data alongside infrastructure as code. I've been looking at NetBox or Nautobot with Terraform/OpenTofu, using Git as a possible source of truth. For things like prefixes, VLANs, IP addresses, and devices, do you store the desired state declaratively in Git, or treat the DCIM/IPAM platform as the authoritative system? How do you consume that data later for automation, DNS, DHCP, configuration management, or deployments? I'm particularly interested in handling manual changes and drift—for example, adding a new machine or changing the address of an existing one—and what process should happen afterward.
3 Answers
We use an IPAM and DNS/DHCP platform as the authoritative system, with our automation calling its API directly. Keeping IP assignments current there also lets the system maintain accurate DNS records. It works well operationally, although commercial platforms in this space can be quite expensive.
In our setup, the CMDB contains every host and its assigned address. When an address or another relevant field changes, a pipeline is triggered and regenerates the DHCP reservation configuration for the Kea server. That gives us a straightforward event-driven workflow: make the change in one place, review or validate it in the pipeline, and then publish the resulting service configuration.
One workable pattern is to let engineers make approved changes through the IPAM interface, have the system generate a pull request, and then require review before a pipeline applies the resulting configuration. That gives less experienced engineers a safe workflow without requiring them to work directly in Git.
The tradeoff is that the IPAM administrators can become a bottleneck. Another approach is to keep the platform protected as a read-oriented source and provide an internal API or form that writes structured data, stores it in version control, runs validation and policy checks, and then deploys it. That gives you reviewable changes without turning Git into an unstructured database.