fix: avoid assigning control-plane VIP as node SSH address

Exclude the configured VIP suffix from subnet scans and prefer non-VIP IPs when multiple SSH endpoints resolve to the same node. This prevents cp-1 being discovered as .250 and later failing SSH commands against the floating VIP.

nixos/kubeadm/scripts/discover-inventory-from-ssh.py

@@ -96,8 +96,19 @@ def main() -> int:
     prefix = derive_prefix(payload)
     start = int(os.environ.get("KUBEADM_SUBNET_START", "2"))
     end = int(os.environ.get("KUBEADM_SUBNET_END", "254"))
+    vip_suffix = int(os.environ.get("KUBEADM_CONTROL_PLANE_VIP_SUFFIX", "250"))
 
-    scan_ips = [str(ipaddress.IPv4Address(f"{prefix}.{i}")) for i in range(start, end + 1)]
+    def is_vip_ip(ip: str) -> bool:
+        try:
+            return int(ip.split(".")[-1]) == vip_suffix
+        except Exception:
+            return False
+
+    scan_ips = [
+        str(ipaddress.IPv4Address(f"{prefix}.{i}"))
+        for i in range(start, end + 1)
+        if i != vip_suffix
+    ]
     found: Dict[str, str] = {}
     vmid_to_name: Dict[str, str] = {}
     for name, vmid in payload.get("control_plane_vm_ids", {}).get("value", {}).items():
@@ -117,12 +128,17 @@ def main() -> int:
                 host, ip, serial = result
                 if host not in seen_hostnames:
                     seen_hostnames[host] = ip
-                if host in target_names and host not in found:
-                    found[host] = ip
-                elif serial in vmid_to_name:
+                target = None
+                if serial in vmid_to_name:
                     inferred = vmid_to_name[serial]
-                    if inferred not in found:
-                        found[inferred] = ip
+                    target = inferred
+                elif host in target_names:
+                    target = host
+
+                if target:
+                    existing = found.get(target)
+                    if existing is None or (is_vip_ip(existing) and not is_vip_ip(ip)):
+                        found[target] = ip
                 if all(name in found for name in target_names):
                     return