I think that this issue called for a more generic solution that allows us to preserve any given ip somehow. Something like this suggestion from the issue:

Alternatives would be to perhaps preserve comments to show why certain IPs differ or to ignore values with comments when considering the diff, perhaps both for added visibility.

I especially like the idea that it will not remove anything with a comment.

In addition to this I still want to keep your idea of always adding the private subnet (although as André said I'm not sure we should hard code it to 172.16.0.0/12).

I think that this issue called for a more generic solution that allows us to preserve any given ip somehow. ...

Yeah we had a discussion on Slack regarding it, and the new idea is that it will treat subnet CIDRs differently compared to individual IPs. And if it finds a configured CIDR it should keep it and ignore any IPs it finds that matches those CIDRs.

We might still want to add the comment approach to to cover individual IPs as well, though I'm unsure if we have great use of that for those IPs we manage with the script. 🤔

@viktor-f @aarnq @Xartos

The update command seems to well now, though I think we need to work on the dry-run part as well. 😅

I propose that we try to hook into the process earlier by running this as a filter on the list of ips (rather than modify how the ips are written into the file, as then we don't need to do a similar thing for how we diff as well). And with that we should rework the update-ips script in general so we can have some common path for how we update and diff ips.