[PATCH pve-docs v2 11/11] sdn: ipam: document the per-zone VRF and section in NetBox and phpIPAM

[Hannes Laimer <h.laimer@proxmox.com>]

Every zone's subnets now go into a VRF or a sub-section named after
the zone, which is what an admin sees in the IPAM, and a prefix or
subnet from before stays where it is.

Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
---
 pvesdn.adoc | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/pvesdn.adoc b/pvesdn.adoc
index 3fd3533ad07f..75ac781e8c92 100644
--- a/pvesdn.adoc
+++ b/pvesdn.adoc
@@ -1287,6 +1287,18 @@ Fingerprint:: The SHA-256 fingerprint of the NetBox API. Can be retrieved with
   `openssl x509 -in /etc/ssl/certs/netbox.crt -noout -fingerprint -sha256` when
   using the default certificate.
 
+{pve} creates a VRF named `pve-<zone>` for every zone, together with the first
+subnet of the zone, and keeps the prefixes of the zone's subnets in it. This way
+two zones can use the same subnet. The IP addresses allocated in a prefix carry
+the MAC address of the guest in their description. Prefixes that earlier
+versions created in the global table are still found there and can be moved
+into the VRF of their zone, together with their IP addresses and IP ranges. A
+zone from before gets its VRF only with the next subnet added to it, so to move
+prefixes into it earlier, create the VRF `pve-<zone>` by hand. Creating a
+subnet whose range the global table still holds is refused, since a prefix in
+the VRF would hide the addresses recorded in the old one, so move or remove
+that prefix first.
+
 
 [[pvesdn_ipam_plugin_phpipam]]
 phpIPAM Plugin
@@ -1304,6 +1316,19 @@ Token:: An API access token
 Section:: An integer ID. Sections are a group of subnets in phpIPAM. Default
   installations use `sectionid=1` for customers.
 
+{pve} creates a sub-section named `pve-<zone>` under the configured section for
+every zone, together with the first subnet of the zone, and keeps the zone's
+subnets in it. This way two zones can use the same subnet. phpIPAM nests
+sections one level deep, so a configured section that is itself a sub-section
+gets no sub-sections and the subnets of all zones stay in it. Subnets that
+earlier versions created in the configured section itself are still found there
+and can be moved into the sub-section of their zone. A zone from before gets its
+sub-section only with the next subnet added to it, so to move subnets into it
+earlier, create the sub-section `pve-<zone>` under the configured section by
+hand. Creating a subnet whose range the configured section still holds is
+refused, since a copy in the sub-section would hide the addresses recorded in
+the old one, so move or remove that subnet first.
+
 
 [[pvesdn_config_dns]]
 DNS
-- 
2.47.3