Still need to drop the hardcoded allowed set.
Remove separate NetBox lookups. Explicitly allow connections between cluster nodes. Tigthen temporary allowed IPv6 ranges.
Just prepares the servers, all management is then done through cephadm.