netbox-best-practices — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited netbox-best-practices (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill COMPLEMENTS the official netboxlabs/skills marketplace (/plugin marketplace add netboxlabs/skills). For data modeling, IPAM design, API patterns, Diode ingestion, or validation, consult those skills first — they are maintained upstream and authoritative. This skill covers four areas they do not (as of 2026-06):
references/helm-chart-gotchas.mdreferences/version-deltas.mdreferences/modeling-gaps.mdreferences/sso-hardening.mdEvidence labels used throughout: [source] = verified against chart/NetBox source code (file:line cited); [live] = verified on a production install — undated labels on chart 8.3.14 / NetBox v4.6.2, [live 2026-09-15] on chart 8.3.66 / v4.6.10 with Keycloak 26.7.2, [live 2026-10-27] on chart 8.3.96 / v4.7.3. Undated [live] chart observations were not re-run on 4.7. [docs] = official docs/release notes (4.2–4.6: adversarially verified, 3-vote panel).
From the 4.7.0–4.7.3 release notes, plus one live 4.6.10 → 4.7.3 hop.
| Gate | What it means for a Kubernetes install |
|---|---|
| Target 4.7.2 or later | 4.7.0 breaks the SSO button under a restrictive form-action CSP (#23112) and its pg_dump restores without the hierarchy cascade triggers (#23130). 4.7.0–4.7.1 write the plaintext of tokens created by background bulk API requests into job results, readable by anyone who can view jobs (#23196) — replace any token created that way. Chart pins: 8.3.66 = 4.6.10 (last 4.6), 8.3.67–8.3.77 = 4.7.0, 8.3.78–8.3.90 = 4.7.1, 8.3.91 = 4.7.2, 8.3.92+ = 4.7.3 (latest 8.3.96, 2026-10-27). 8.3.66 → 8.3.96 in one hop works [live]. |
| PostgreSQL 15+ required; 14 dropped | The upgrade script aborts on 14 — 4.6 only warned, so a cluster that upgraded cleanly to 4.6 can hard-fail here. Check the external DB's major version before bumping the image tag. |
| The `ltree` extension must be available | Trusted: the migration creates it as the NetBox DB user, which needs CREATE on the database (owning it is enough) — no superuser [live]. A managed DB that restricts extension creation blocks it. |
| Redis 6.0+ required; 5.x dropped | Applies to the external valkey/Redis wiring. Valkey is 7.x-derived and unaffected; a pinned legacy Redis 5 sidecar is not. |
| Selection custom fields change shape on read | REST and GraphQL now return {"value": "...", "label": "..."} instead of the bare value. Writes still accept the raw value. Any seeding or reconciliation script that reads a selection custom field back breaks silently — it gets a dict where it expected a string. |
| The mptt → ltree migration locks hierarchical tables | ACCESS EXCLUSIVE on each hierarchical table (reads block too) while it backfills; minutes on a large install. Plan a window. |
After the 4.7 roll, run the steps in references/version-deltas.md §4.7 "After the roll": config-context cache rebuild (the image entrypoint skips it), housekeeping CronJob off, POST-based SSO check, hierarchy-path check. Before moving or restoring a 4.7 database, read §4.7 "Moving or restoring".
superuser.password,secretKey, and apiTokenPeppers left empty, every OFFLINE render regenerates them (lookup returns nothing without a live cluster), so helm template output contains fresh random secret material every time. Gitignore template-*.yaml. During a real helm upgrade the chart preserves existing values via lookup. [source: templates/_helpers.tpl]
Zalando names a Service after the cluster CR, so a CR named like the release fullname makes helm install fail with "invalid ownership metadata" [live]. CloudNativePG suffixes its Services (-rw/-ro/-r) but names its ServiceAccount, Role and RoleBinding after the cluster, and the chart creates all three under the release name [live 2026-10-27: object names]. Use <release>-postgres-cluster or <release>-pg.
and mounts it, but NetBox 4.6's entrypoint never seeds it (v2 peppered tokens can't be pre-seeded). Bootstrap real tokens via POST /api/users/tokens/provision/. Details + wire format in references/helm-chart-gotchas.md#api-token-bootstrap. [source+live]
plugins:/pluginsConfig: values areconfig-only (rendered into PLUGINS json); the official image ships zero plugin code. Build FROM ghcr.io/netbox-community/netbox:<tag> + RUN /opt/netbox/venv/bin/pip install <plugin>. [source: configmap.yaml]
API broke meaningfully at 4.3 (services), 4.5 (tokens, port mappings) — code that worked on 4.2 fails on 4.6 in non-obvious ways. See references/version-deltas.md.
Read references/helm-chart-gotchas.md end-to-end first — it is ordered as a pre-flight checklist (external DB, valkey sentinel wiring, secrets layout, first-boot expectations, metrics). First boot runs all Django migrations and takes several minutes before the pod goes Ready; that is normal. [live]
Read references/version-deltas.md — it lists what changed in each minor release 4.2→4.7 with dates and PR numbers, plus two "anti-facts" (plausible claims that are FALSE) to avoid repeating common misinformation.
Read references/sso-hardening.md. The official netbox-administration skill covers enabling each backend; this file covers the gap it leaves: that the REMOTE_AUTH_SUPERUSER_GROUPS/_STAFF/group-sync settings work ONLY with the header/proxy backend — native OIDC/SAML ignores them and needs a custom SOCIAL_AUTH_PIPELINE function to map IdP groups to NetBox roles — plus OIDC backend gotchas (redirect URI shape, RS256-only default, PKCE off by default) and the break-glass / header-spoofing / SSO≠API-token / associate_by_email hardening rules. [source-verified against netbox 4.6 and 4.7.3 authentication code]
Deploying SSO on the helm chart (Keycloak etc.): start from the worked example at the end of `references/sso-hardening.md` — the complete Keycloak wiring that ran live on 2026-09-15 (client, mapper, values, pipeline module, self-check, verification) — and read references/helm-chart-gotchas.md §9 — there are no dedicated OIDC chart values (maintainers declined, #987); everything rides in extraConfig, custom pipeline code must be volume-mounted as a netbox.* module, and the chart's own docs/auth.md examples carry a dated KeycloakOAuth2 config (legacy /auth URLs, pasted realm key) and a risky associate_by_email pipeline step.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.