[znerol2]

Summary

promsd asked NetBox for tagged records with ?tag=<slug>, and it built that slug from the tag name by turning the colon into a hyphen. That's the rule netbox-sot follows. NetBox's own rule drops the colon, so a monitoring:scrape tag created in the NetBox UI gets the slug monitoringscrape. NetBox then answered 400, the whole refresh failed, every lane kept its last snapshot, and /readyz went stale.

• Look up by name: NetboxClient.tag_slugs(names) resolves the lane tags with one exact-name lookup (GET /api/extras/tags/?name=…). Record queries then use the slugs NetBox returns. promsd no longer keeps its own slug rule.
• Missing lane tag: a lane tag that the lookup doesn't return gets no record query, and its lane is empty. The other lanes are served. /healthz lists it under missing_tags, while last_error stays null and /readyz stays ready.
• Record query errors: any error on a record query, on any page and including a 400, fails the refresh and keeps the last good snapshot with the error in last_error. That matches existing outage behavior.

The README documents missing_tags and the error behavior.

Tests

• UI-created slug monitoringscrape, and the legacy hyphen slug.
• A missing tag: only its lane is empty, and no query names it.
• A device with two lane tags where one tag is missing.
• A 400 on the first page and on a later page: the last snapshot is kept, and last_error is set.
• A tag removed after a good snapshot: its lane empties on the next refresh.
• scripts/check.sh passes (26 tests).

Closes dmfdeploy/dmfdeploy#795

[lkirc]

Request changes: the new tag lookup adds an undocumented permission dependency.

• src/dmf_promsd/netbox.py:105: /api/extras/tags/ requires the token to have tag-view access in NetBox, but README.md still says the token need only read services, devices, and virtual machines. A token provisioned as documented can receive an empty tag result, publish empty lanes, clear last_error, and remain ready. Update the documented/deployed permission prerequisite (or preserve compatibility with the documented token) before merging.

[lkirc]

Changes requested: partial tag visibility is still treated as a healthy missing-tag state.

• src/dmf_promsd/cache.py:77: if not slugs only fails when zero tags are visible. NetBox object permissions can constrain extras.view_tag to a subset, so a token that can see monitoring:scrape but not probe/snmp makes this refresh succeed, replaces good probe/snmp data with empty lanes, clears last_error, and leaves /readyz ready. Do not treat one returned tag as proof of full tag visibility; fail closed or explicitly require and enforce an unrestricted all-tags view permission, with a partial-visibility regression test.

[znerol2]

Thanks, you're right that a single visible tag proved nothing about the others. 0ebf201 fails closed instead:

• Any lane tag promsd can't see fails the refresh, whether it's missing from NetBox or hidden by permissions. The last snapshot is kept, and last_error names every unseen tag.
• The missing-tags path is gone: the snapshot field, the build_payloads branch and the /healthz field.
• test_a_partly_visible_lane_tag_set_fails_the_refresh_and_keeps_every_lane covers your case: only monitoring:scrape is visible. It fails on 3e6dccc.
• The README now says the token needs view access to all three lane tags. netbox-sot creates all three, so an unseen one is a misconfiguration or a permission gap.

Readiness still follows freshness. /readyz turns 503 once the kept snapshot is older than freshness_window_seconds, as it does for every other refresh failure, and right away when there's no snapshot yet.

The issue's acceptance criterion was updated to match (dmfdeploy/dmfdeploy#795).

[lkirc]

Approved. The current head resolves the earlier tag-visibility concern: every expected lane tag must be visible before a snapshot is replaced, preserving the last good lanes and reporting the error on any missing or hidden tag.