check_redfish: OS IPs reported by the BMC (HPE iLO/AMS) conflict with the VMware source and unset the primary IP #582

Description

With a vmware source and a check_redfish source syncing the same ESXi hosts (HPE ProLiant with iLO 5 and the AMS agent installed), the host's management IP moves between interfaces on every run, and the device's primary IPv4 is unset each time.

iLO with AMS reports the IP addresses of the operating system on the physical NIC ports. On ESXi, all VMkernel IPs show up on the active uplinks. From a check_redfish inventory file:

{"id": "2.2", "os_name": "vmnic5", "ipv4_addresses": ["10.0.10.163", "192.168.11.214", "192.168.11.215"], ...}
{"id": "3.2", "os_name": "vmnic7", "ipv4_addresses": ["10.0.10.163", "192.168.11.214", "192.168.11.215"], ...}

The two sources then undo each other's work:

1. The VMware source doesn't see the IP on vmnic7, so it removes it. That IP is the device's primary IP, so primary_ip4 is cleared. The source then assigns the IP to vmk0.
2. The check_redfish source assigns the same IP to vmnic5/vmnic7 again. It runs add_update_interface() with keep_undiscovered_ips=True, so it never cleans up behind itself.

Log of one host over a single run:

INFO: IP address is no longer assigned to vmnic7 (esxi01) and therefore removed from this interface
INFO: Setting attribute 'primary_ip4' for 'esxi01' to None
INFO: Ip address '10.0.10.163/22' attribute 'assigned_object_id' changed from 'vmnic7 (esxi01)' to 'vmk0 (esxi01)'
...
INFO: Ip address '10.0.10.163/22' attribute 'assigned_object_id' changed from 'vmk0 (esxi01)' to 'vmnic5 (esxi01)'

In my environment this affects every ESXi host with AMS installed (26 hosts).

Why permitted_subnets doesn't help

The BMC IPs and the host IPs are often in the same subnets (here both are in the same /22), so they can't be separated by network. The only workaround is a !x.x.x.x/32 exclusion per host IP in the check_redfish source, which has to be maintained for every new host.

Proposal

A check_redfish option skip_os_reported_ips (default False). When it's enabled, only the IPs of the BMC ports (ports with manager_ids) are synced. The IPs reported for the server's own NICs are skipped and left to the source that owns the operating system.

Environment

• netbox-sync: v1.9.0 (logic unchanged on main)
• NetBox: 4.7.2
• Sources: vmware (vCenter 8.0.3) + check_redfish (HPE ProLiant Gen10, iLO 5 with AMS)