The Puppet DB Netbox import script works very well and, once interfaces are set up on a host, properly adds them in Netbox, and attaches IP objects as needed.

This is true for all interfaces on Linux hosts, including vlan / 802.1q sub-interfaces.

If a host has vlan sub-interfaces, however, the switch port it's connected to needs to be configured as a trunk, usually with the primary interface untagged ("native vlan" on the switch side), and the remaining tagged. Switch configuration is controlled by the port settings in Netbox (for example https://netbox.wikimedia.org/dcim/interfaces/23749/). The port's attributes in Netbox are set so that the "802.1q mode" is "tagged", and the "untagged" and "tagged" vlan fields are populated as needed.

Currently setting the switch port mode and allowed vlans is done manually if required. Which is not a big deal as the number of devices with sub-ints is very low. An improvement could be made by which the Netbox PuppetDB import script would evaluate if tagged sub-interfaces are present, and make sure that the corresponding switch port is configured to match. Likely this would be easier if T296832 was also completed, to properly represent the interface relationships in Netbox, as opposed to evaluating based on names.

Not urgent by any means, but creating task to record the gap that could be filled at some stage.