Octet

Say this first

A source of truth is the one authoritative place that says what the network should look like: devices, interfaces, IP addresses, VLANs, circuits. Automation reads intent from it, renders config and pushes it, so the network follows the data instead of the data trying to describe the network. NetBox is the common open source choice: DCIM plus IPAM with a REST and GraphQL API, a Python client (pynetbox) and an Ansible collection that includes a dynamic inventory.

Go deeper

What NetBox models

DCIM: regions, sites, locations, racks, device types, devices, interfaces, cables, power.
IPAM: VRFs, prefixes, IP addresses, VLANs and VLAN groups, ASNs, route targets.
Circuits and providers, virtualization, tenancy.
Extensibility: custom fields, tags, config contexts (JSON data merged by site, role or platform), config templates (Jinja2), webhooks and event rules, plugins.

Reading it from Python

Python

import os
import pynetbox

nb = pynetbox.api("https://netbox.example.com", token=os.environ["NETBOX_TOKEN"])
for dev in nb.dcim.devices.filter(site="dc1", status="active"):
    print(dev.name, dev.primary_ip4)

As Ansible inventory

YAML

# nb_inventory.yml
plugin: netbox.netbox.nb_inventory
api_endpoint: https://netbox.example.com
validate_certs: true
group_by:
  - sites
  - platforms
query_filters:
  - status: active

The token comes from the NETBOX_TOKEN environment variable.

Intended vs actual

NetBox holds intended state. The devices hold actual state. Automation turns one into the other, and drift checks compare them. NetBox is not a monitoring system and does not discover the network by itself.

They will ask next

What happens if engineers keep making changes by CLI and never update NetBox?
The source of truth stops being true, and the next automated push overwrites their fixes or fails. The rule has to be "change the data, not the device", backed by drift reports that catch CLI changes so they get added to NetBox or reverted.
Can you have more than one source of truth?
One authoritative source per kind of data. NetBox for IPAM and inventory, ISE for identity policy, Git for templates and playbooks. Problems start when two systems both claim the same data.

Traps

Calling a config backup repository a source of truth. Backups record what is, not what should be.

How did you do?