netbox-best-practiceslisted

NetBox 4.2-4.6 deployment and upgrade knowledge that the official netboxlabs/skills marketplace does NOT cover - use for deploying or upgrading NetBox on Kubernetes with the netbox-community helm chart (netbox-chart), external PostgreSQL/valkey wiring, API token bootstrap on 4.5+ (nbt_ v2 tokens), plugin installation in the official image, version-migration planning between NetBox 4.2 and 4.6, module type profiles, and front/rear port (patch panel) API changes. Trigger on "netbox helm", "netbox chart", "netbox kubernetes", "netbox upgrade", "netbox plugin install", "netbox api token bootstrap", "netbox 4.x breaking changes", "netbox oidc/sso group mapping" or "netbox sso hardening", or seeding/automation that must survive a NetBox version bump. For general NetBox data modeling, IPAM design, Diode, or validation questions - and for turning on an auth backend in the first place - prefer the official netboxlabs/skills marketplace skills (netbox-administration); this skill only covers the gaps.
air-gapped/skills · ★ 3 · AI & Automation · score 76

Install: claude install-skill air-gapped/skills

# NetBox Best Practices (helm + version deltas) This skill COMPLEMENTS the official `netboxlabs/skills` marketplace (`/plugin marketplace add netboxlabs/skills`). For data modeling, IPAM design, API patterns, Diode ingestion, or validation, consult those skills first — they are maintained upstream and authoritative. This skill covers three areas they do not (as of 2026-06): 1. **netbox-chart (helm) deployment gotchas** → `references/helm-chart-gotchas.md` 2. **NetBox 4.2→4.6 version-delta cheat sheet** → `references/version-deltas.md` 3. **Modeling gaps**: module type profiles (4.3+), port-mapping rework (4.5) → `references/modeling-gaps.md` 4. **SSO/OIDC group→role mapping + hardening** → `references/sso-hardening.md` Evidence labels used throughout: `[source]` = verified against chart/NetBox source code (file:line cited); `[live]` = verified on a production install of chart 8.3.14 / NetBox v4.6.2 — upstream is now chart 8.3.37 / v4.6.5 (2026-07-21), still 4.6.x and still chart 8.x, so no delta invalidated; `[docs]` = official docs/release notes, adversarially verified (3-vote panel). ## The five rules that prevent the worst failures 1. **Never commit rendered helm templates.** With `superuser.password`, `secretKey`, and `apiTokenPeppers` left empty, every OFFLINE render regenerates them (`lookup` returns nothing without a live cluster), so `helm template` output contains fresh random secret material every time. Gitignore `template-*.yaml`. During a real `he