ci: storage VM moves to DHCP and is addressed by FQDN (1/2)

The repo stops holding opinions about CI VLAN addressing: the VM boots
via DHCP with hostname pvetest-storage (deterministic MAC for an
optional reservation), registers in the operator's CI DNS zone, and
everything addresses it by STORAGE_VM_FQDN. Replaces the static-IP +
explicit-DNS variables.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/integration-tests.yml

@@ -24,9 +24,10 @@ name: Integration Tests
 #                        node with the most free memory and refuses to run when
 #                        no node has enough headroom — the token's user needs
 #                        PVEAuditor on /nodes for the memory stats.
-#   STORAGE_VM_IP      - Static CIDR address for the shared storage/answer-server
-#                        VM on the CI VLAN (default: 172.16.60.60/24)
-#   STORAGE_VM_GATEWAY - Gateway + DNS for that VM (default: 172.16.60.1)
+#   STORAGE_VM_FQDN    - DNS name of the shared storage/answer-server VM; it
+#                        boots via DHCP as hostname pvetest-storage and must
+#                        resolve from the runner and the CI VLAN
+#                        (default: pvetest-storage.test.local)
 #
 # Optional secrets (for skip_provision mode):
 #   PVETEST_HOST       - Hostname or IP of a pre-existing nested PVE
@@ -139,8 +140,7 @@ jobs:
           PVE_API_TOKEN: ${{ secrets.PVE_API_TOKEN }}
           PVE_TARGET_NODE: ${{ vars.PVE_TARGET_NODE }}
           PVE_PASSWORD: ${{ secrets.PVE_TEST_PASSWORD }}
-          STORAGE_VM_IP: ${{ vars.STORAGE_VM_IP }}
-          STORAGE_VM_GATEWAY: ${{ vars.STORAGE_VM_GATEWAY }}
+          STORAGE_VM_FQDN: ${{ vars.STORAGE_VM_FQDN }}
           TF_VAR_disk_storage: ${{ vars.DISK_STORAGE }}
           TF_VAR_iso_storage: ${{ vars.ISO_STORAGE }}
           TF_VAR_network_bridge: ${{ vars.NETWORK_BRIDGE }}
@@ -214,8 +214,7 @@ jobs:
           PVE_API_TOKEN: ${{ secrets.PVE_API_TOKEN }}
           PVE_TARGET_NODE: ${{ vars.PVE_TARGET_NODE }}
           PVE_PASSWORD: ${{ secrets.PVE_TEST_PASSWORD }}
-          STORAGE_VM_IP: ${{ vars.STORAGE_VM_IP }}
-          STORAGE_VM_GATEWAY: ${{ vars.STORAGE_VM_GATEWAY }}
+          STORAGE_VM_FQDN: ${{ vars.STORAGE_VM_FQDN }}
           TF_VAR_disk_storage: ${{ vars.DISK_STORAGE }}
           TF_VAR_iso_storage: ${{ vars.ISO_STORAGE }}
           TF_VAR_network_bridge: ${{ vars.NETWORK_BRIDGE }}

tests/infrastructure/outputs.tf

@@ -7,8 +7,3 @@ output "pve_test_node_name" {
   value       = "pve"
   description = "Default node name inside a fresh PVE install"
 }
-
-output "storage_vm_ip" {
-  description = "Static address of the shared NFS/iSCSI storage VM"
-  value       = var.storage_vm_ip
-}

tests/infrastructure/scripts/setup-storage-server.sh

@@ -3,12 +3,12 @@
 # iSCSI target, and the HTTP answer server the PVE auto-installers fetch
 # from. Idempotent — safe to re-run against an already-configured VM.
 #
-# Usage: setup-storage-server.sh <storage-vm-ip> <ssh-private-key-path> <iscsi-iqn> <answer-dir>
+# Usage: setup-storage-server.sh <storage-vm-host> <ssh-private-key-path> <iscsi-iqn> <answer-dir>
 #   <answer-dir> is the local directory holding default.toml and answers/.
 
 set -euo pipefail
 
-STORAGE_IP="${1:?Usage: setup-storage-server.sh <ip> <ssh-key> <iqn> <answer-dir>}"
+STORAGE_IP="${1:?Usage: setup-storage-server.sh <host> <ssh-key> <iqn> <answer-dir>}"
 SSH_KEY="${2:?missing SSH private key path}"
 ISCSI_IQN="${3:?missing iSCSI IQN}"
 ANSWER_DIR="${4:?missing answer directory}"

tests/infrastructure/storage-vm.tf

@@ -41,17 +41,14 @@ resource "proxmox_virtual_environment_vm" "storage" {
   initialization {
     datastore_id = var.disk_storage
 
+    # DHCP: pfSense owns addressing/DNS for the CI VLAN; the VM registers its
+    # hostname (= VM name) in the CI DNS zone and is addressed by FQDN.
     ip_config {
       ipv4 {
-        address = var.storage_vm_ip
-        gateway = var.storage_vm_gateway
+        address = "dhcp"
       }
     }
 
-    dns {
-      servers = [var.storage_vm_dns]
-    }
-
     user_account {
       username = "ubuntu"
       # Password is console-only: Ubuntu cloud images refuse SSH password auth
@@ -64,6 +61,8 @@ resource "proxmox_virtual_environment_vm" "storage" {
   network_device {
     bridge = var.network_bridge
     model  = "virtio"
+    # Deterministic MAC so the operator can pin a DHCP reservation to it
+    mac_address = "aa:bb:cc:00:60:01"
   }
 
   operating_system {

tests/infrastructure/variables.tf

@@ -84,35 +84,12 @@ variable "storage_vmid" {
   default     = 5080
 }
 
-variable "storage_vm_ip" {
-  description = "Static IPv4 address in CIDR form for the storage VM, outside the VLAN's DHCP range"
-  type        = string
-  default     = "172.16.60.60/24"
-
-  validation {
-    condition     = can(cidrnetmask(var.storage_vm_ip))
-    error_message = "storage_vm_ip must be CIDR notation, e.g. 172.16.60.60/24."
-  }
-}
-
 variable "storage_vm_ssh_public_key" {
   description = "SSH public key granted to the storage VM's ubuntu user (cloud images refuse password SSH; required for provision, unused on destroy)"
   type        = string
   default     = ""
 }
 
-variable "storage_vm_gateway" {
-  description = "Gateway for the storage VM"
-  type        = string
-  default     = "172.16.60.1"
-}
-
-variable "storage_vm_dns" {
-  description = "DNS server for the storage VM. The CI VLAN gateway runs no resolver; public DNS works under the ci-to-internet rule and keeps the sandbox independent of fleet DNS"
-  type        = string
-  default     = "1.1.1.1"
-}
-
 variable "cloud_image_path" {
   description = "Local path to the Ubuntu cloud image imported as the storage VM's disk (required for provision; unused on destroy)"
   type        = string