[PATCH pve-docs 10/10] sdn: ipam: document the per-zone VRF and section in NetBox and phpIPAM

[Hannes Laimer <h.laimer@proxmox.com>]

Every zone's subnets now go into a VRF or a sub-section named after
the zone, which is what an admin sees in the IPAM, and a prefix or
subnet from before stays where it is.

Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
---
 pvesdn.adoc | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/pvesdn.adoc b/pvesdn.adoc
index 3fd3533ad07f..3516102ce511 100644
--- a/pvesdn.adoc
+++ b/pvesdn.adoc
@@ -1287,6 +1287,13 @@ Fingerprint:: The SHA-256 fingerprint of the NetBox API. Can be retrieved with
   `openssl x509 -in /etc/ssl/certs/netbox.crt -noout -fingerprint -sha256` when
   using the default certificate.
 
+{pve} creates a VRF named `pve-<zone>` for every zone, together with the first
+subnet of the zone, and keeps the prefixes of the zone's subnets in it. This way
+two zones can use the same subnet. The IP addresses allocated in a prefix carry
+the MAC address of the guest in their description. Prefixes that earlier
+versions created in the global table are still found there and can be moved
+into the VRF of their zone, together with their IP addresses and IP ranges.
+
 
 [[pvesdn_ipam_plugin_phpipam]]
 phpIPAM Plugin
@@ -1304,6 +1311,14 @@ Token:: An API access token
 Section:: An integer ID. Sections are a group of subnets in phpIPAM. Default
   installations use `sectionid=1` for customers.
 
+{pve} creates a sub-section named `pve-<zone>` under the configured section for
+every zone, together with the first subnet of the zone, and keeps the zone's
+subnets in it. This way two zones can use the same subnet. phpIPAM nests
+sections one level deep, so a configured section that is itself a sub-section
+gets no sub-sections and the subnets of all zones stay in it. Subnets that
+earlier versions created in the configured section itself are still found there
+and can be moved into the sub-section of their zone.
+
 
 [[pvesdn_config_dns]]
 DNS
-- 
2.47.3