[Bug] Additional NetBox VM-tags are removed while running

[AskskwBv8T2nrm4Qnj]

Is this urgent?

No

How are you running netbox-ssot?

Podman

Which version of netbox are you using

v4.2.4

Which version of netbox-ssot are you running

v1.11.6

Which module has the issue?

Proxmox

Share your configuration

netbox:
  apiToken: "token"
  hostname: "xxx.nl"
  httpScheme: https
  port: 443
  timeout: 30
  removeOrphans: false
  removeOrphansAfterDays: 2
  sourcePriority:
    - CLUSTER

source:
  - name: CLUSTERNAME
    type: proxmox
    username: user
    password: "password"
    httpScheme: https
    hostname: proxmox.xxx.nl
    validateCert: true
    ignoredSubnets:
    - 127.0.0.0/8
    - 169.254.0.0/16
    - ::1/128
    - fe80::/16
    - 172.16.0.0/12
    # Loopback, APIPA, loopback, link-local, Docker
    interfaceFilter: (veth*|Loopback*)
    hostSiteRelations:
      - .* = LOCATION-A
    clusterSiteRelations:
      - .* = LOCATION-A
    clusterTenantRelations:
     - .* = TENANT
    vmRoleRelations:
      - .* = PROXMOXVM
    hostRoleRelations:
      - .* = PROXMOXSERVER
    vmTenantRelations:
      - CUST-.* = Customer

What is the problem?

Any 'unexpected' NetBox Tags on VMs managed by netbox-ssot, are removed while running netbox-ssot.

I'm not sure if this bug(?) is an expected result or not.

Steps to reproduce

1. Run netbox-ssot to add VMs (In my case, of a Proxmox cluster)
2. Add a tag to a VM that was added by netbox-ssot
3. Re-run netbox-ssot, and the tag added to the NetBox VM will be removed.

What did you expect to happen?

I expected additional NetBox Tags to remain added to NetBox VMs.

What actually happened?

The NetBox tag I added in between runs was removed...

Share DEBUG-level logs (remove sensitive information)

Running version v1.11.6 built on 2025-04-06T15:09:34Z (commit b288ee365066180b464bf53b130a6a0377b17cac)
...
...
2025/05/22 14:45:09 add_items.go:1154   DEBUG   (<CLUSTER>): VM VM{Name: <SERVER>, Cluster: Cluster{Name: <CLUSTERNAME>, Type: ClusterType{Name: Proxmox}}} already exists in Netbox but is out of date. Patching it...
...
2025/05/22 14:45:10 rest.go:152         DEBUG   (<CLUSTER>): Successfully patched objects.VM: VM{Name: <SERVER>, Cluster: Cluster{Name: <CLUSTERNAME>, Type: <nil>}}
...
2025/05/22 14:45:10 add_items.go:1167   DEBUG   (<CLUSTER>): VM VM{Name: <SERVER>, Cluster: Cluster{Name: <CLUSTERNAME>, Type: <nil>}} already exists in Netbox and is up to date...


The changelog in NetBox:
Pre-Change Data:
tags: [
    "Cloud",
    "Source: <CLUSTER>",
    "netbox-ssot",
    "proxmox"
]

Post-Change Data:
{
    "tags": [
        "Source: <CLUSTER>",
        "netbox-ssot",
        "proxmox"
    ]
}

Share your environment details

Operating System: Rocky Linux 8.10 (Green Obsidian)
Kernel: Linux 4.18.0-553.40.1.el8_10.x86_64

If I can share any additional info, please let me know!

[peterbaumert]

In the debug log there should be a line with Successfully collected tags from Netbox: did it show all the proper tags from before?

[AskskwBv8T2nrm4Qnj]

In the debug log there should be a line with Successfully collected tags from Netbox: did it show all the proper tags from before?

Yes, the lines show all the tags we have in NetBox. An abbreviated version of the output below:

 2025/05/25 13:55:34 rest.go:66          DEBUG   (inventory): Getting all objects.Tag from Netbox
 2025/05/25 13:55:34 rest.go:69          DEBUG   (inventory): Getting objects.Tag with limit=250 and offset=0
 2025/05/25 13:55:35 rest.go:104         DEBUG   (inventory): Successfully received all objects.Tag: [Tag{Name: <TAG1>} Tag{Name: <TAG2>} Tag{Name: Cloud}]
 2025/05/25 13:55:35 init_items.go:29    DEBUG   (inventory): Successfully collected tags from Netbox: map[<TAG1>:Tag{Name: <TAG1>} <TAG2>:Tag{Name: <TAG2>} Cloud:Tag{Name: Cloud}]

Additionally, I tested the same situation on a netbox-ssot 'managed' Prefix, MAC address, IP address and interface. The Cloud Tag was removed from all of them during the following run.

[AskskwBv8T2nrm4Qnj]

In testing I also noticed that netbox-ssot not just removes tags from objects that are managed by it, but it also removes all tags from objects that it wants to manage. If a Proxmox VM has subnet 192.168.0.0/24, netbox-ssot looks for 192.168.0.0/24 in NetBox, if said subnet already exists, it takes 'ownership' Subnet by adding its Tag, and it inadvertently also removes all other Tags. If you have multiple 192.168.0.0/24 subnets, it seemingly picks the oldest(?) one. I tried guiding netbox-ssot to a specific Subnet by adding the proper Tag and Proxmox source before running again, but my 'configured' Subnet gets ignored for another. Kind of painful as it messes up current administration. I may create another Bug report but I feel like it relates to this thread.

[github-actions]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days.

[AskskwBv8T2nrm4Qnj]

I'm patiently waiting for any input, would also love to hear if anyone else experiences this behavior.