nixos/kubeadm/modules/k8s-common.nix

@@ -380,6 +380,7 @@ in
     after = [ "containerd.service" "network-online.target" ];
     serviceConfig = {
       Environment = [
+        "KUBELET_KUBECONFIG_ARGS=--bootstrap-kubeconfig=/etc/kubernetes/bootstrap-kubelet.conf --kubeconfig=/etc/kubernetes/kubelet.conf"
         "KUBELET_CONFIG_ARGS=--config=/var/lib/kubelet/config.yaml"
         "KUBELET_KUBEADM_ARGS="
         "KUBELET_EXTRA_ARGS="
@@ -388,7 +389,7 @@ in
         "-/var/lib/kubelet/kubeadm-flags.env"
         "-/etc/default/kubelet"
       ];
-      ExecStart = "${pinnedK8s}/bin/kubelet \$KUBELET_CONFIG_ARGS \$KUBELET_KUBEADM_ARGS \$KUBELET_EXTRA_ARGS";
+      ExecStart = "${pinnedK8s}/bin/kubelet \$KUBELET_KUBECONFIG_ARGS \$KUBELET_CONFIG_ARGS \$KUBELET_KUBEADM_ARGS \$KUBELET_EXTRA_ARGS";
       Restart = "on-failure";
       RestartSec = "10";
     };

nixos/kubeadm/scripts/discover-inventory-from-ssh.py

@@ -96,8 +96,19 @@ def main() -> int:
     prefix = derive_prefix(payload)
     start = int(os.environ.get("KUBEADM_SUBNET_START", "2"))
     end = int(os.environ.get("KUBEADM_SUBNET_END", "254"))
+    vip_suffix = int(os.environ.get("KUBEADM_CONTROL_PLANE_VIP_SUFFIX", "250"))
 
-    scan_ips = [str(ipaddress.IPv4Address(f"{prefix}.{i}")) for i in range(start, end + 1)]
+    def is_vip_ip(ip: str) -> bool:
+        try:
+            return int(ip.split(".")[-1]) == vip_suffix
+        except Exception:
+            return False
+
+    scan_ips = [
+        str(ipaddress.IPv4Address(f"{prefix}.{i}"))
+        for i in range(start, end + 1)
+        if i != vip_suffix
+    ]
     found: Dict[str, str] = {}
     vmid_to_name: Dict[str, str] = {}
     for name, vmid in payload.get("control_plane_vm_ids", {}).get("value", {}).items():
@@ -117,12 +128,17 @@ def main() -> int:
                 host, ip, serial = result
                 if host not in seen_hostnames:
                     seen_hostnames[host] = ip
-                if host in target_names and host not in found:
+                target = None
-                    found[host] = ip
+                if serial in vmid_to_name:
-                elif serial in vmid_to_name:
                     inferred = vmid_to_name[serial]
-                    if inferred not in found:
+                    target = inferred
-                        found[inferred] = ip
+                elif host in target_names:
+                    target = host
+
+                if target:
+                    existing = found.get(target)
+                    if existing is None or (is_vip_ip(existing) and not is_vip_ip(ip)):
+                        found[target] = ip
                 if all(name in found for name in target_names):
                     return