Use kernel-range form for DNS-materialized remoteports

vastnfs rejects comma-separated IP lists in remoteports= with EINVAL —
kernel mount returns "Invalid argument" and the pod stays in
ContainerCreating with FailedMount events. Only the dash-range form
"<low>-<high>" is accepted; the kernel expands it to every IP in the
inclusive range.

Empirically observed on a dlim CMK in eu-iceland1-a (ICAT) with a
DnsName-populated disk: net.LookupIP returned the 16 ICAT-2 VIPs
(172.27.255.18-.33) in random order; the previous materialize path
joined them with commas, producing a value the kernel rejected on
every mount attempt.

Fix: sort the IPv4 results by network-byte-order value and emit the
range as "<first>-<last>". Host becomes the lowest IP. Single-IP
responses degenerate to "remoteports=<ip>" which the kernel also
accepts.

Coverage: extend resolve_test.go with TestMaterializeNFSTarget_
SortsOutOfOrderResponse and rename DNSResolvesToList -> DNSResolvesToRange
so the assertion matches what vastnfs actually requires.

Refs: CRUSOE-70481

Author: npujari-crusoe

internal/node/fs/resolve.go

@@ -1,10 +1,11 @@
 package fs
 
 import (
+	"bytes"
 	"errors"
 	"fmt"
 	"net"
-	"strings"
+	"sort"
 )
 
 // ErrNoUsableNFSAddress is returned when DNS resolution yields no usable IPv4
@@ -30,12 +31,17 @@ var lookupIP = net.LookupIP
 // If remotePorts == "dns", the hostname is resolved via lookupIP, IPv4-mapped
 // IPv6 addresses are normalized to IPv4, unspecified addresses (::, 0.0.0.0)
 // and non-IPv4 results are filtered out, and the result is returned as:
-//   - newHost: the first valid IPv4, suitable as the host portion of the
+//   - newHost: the lowest-valued IPv4, suitable as the host portion of the
 //     mount source string ("<ip>:/volumes/<id>"), so that busybox-mount in
 //     the Alpine CSI pod never needs to do its own getaddrinfo (closes the
 //     INC-450 musl REFUSED surface).
-//   - newRemotePorts: comma-separated list of all valid IPv4s, suitable for
-//     the kernel's remoteports= option.
+//   - newRemotePorts: kernel-range form "<minIP>-<maxIP>" suitable for the
+//     vastnfs remoteports= option, which the kernel expands to every IP in
+//     the inclusive range. NOT a comma-separated list: vastnfs rejects
+//     comma form with EINVAL (kernel mount returns "Invalid argument").
+//     If the DNS response is not contiguous, the range may span IPs that
+//     are not actual NFS endpoints; those expand harmlessly because the
+//     NFS client only opens connections that the server accepts.
 //
 // Returns ErrNoUsableNFSAddress (wrapped) when the hostname has no usable
 // IPv4 records after filtering. Callers should log the error and fall back
@@ -67,5 +73,19 @@ func materializeNFSTarget(host, remotePorts string) (newHost, newRemotePorts str
 		return host, remotePorts, fmt.Errorf("%w: %s", ErrNoUsableNFSAddress, host)
 	}
 
-	return ipv4s[0], strings.Join(ipv4s, ","), nil
+	// Sort IPv4 strings by network-byte-order value so the kernel-range form
+	// always reflects (lowest, highest). net.ParseIP returns a 16-byte
+	// IPv6-mapped form even for IPv4 inputs; ip.To4() returns the canonical
+	// 4-byte form for byte-wise comparison.
+	sort.Slice(ipv4s, func(i, j int) bool {
+		return bytes.Compare(net.ParseIP(ipv4s[i]).To4(), net.ParseIP(ipv4s[j]).To4()) < 0
+	})
+
+	first := ipv4s[0]
+	last := ipv4s[len(ipv4s)-1]
+	if first == last {
+		return first, first, nil
+	}
+
+	return first, fmt.Sprintf("%s-%s", first, last), nil
 }

internal/node/fs/resolve_test.go

@@ -61,7 +61,7 @@ func TestMaterializeNFSTarget_IPListPassthrough(t *testing.T) {
 }
 
 //nolint:paralleltest // mutates package-level lookupIP via fs.SetLookupIP
-func TestMaterializeNFSTarget_DNSResolvesToList(t *testing.T) {
+func TestMaterializeNFSTarget_DNSResolvesToRange(t *testing.T) {
 	const lookupHost = "nfs.crusoecloudcompute.com"
 	withStubLookupIP(t, func(host string) ([]net.IP, error) {
 		if host != lookupHost {
@@ -76,10 +76,40 @@ func TestMaterializeNFSTarget_DNSResolvesToList(t *testing.T) {
 		t.Fatalf("unexpected error: %v", err)
 	}
 	if gotHost != testIPv4A {
-		t.Errorf("host = %q, want %q (first IPv4)", gotHost, testIPv4A)
+		t.Errorf("host = %q, want %q (lowest IPv4 by network byte order)", gotHost, testIPv4A)
 	}
-	if gotPorts != testIPv4A+","+testIPv4B {
-		t.Errorf("remotePorts = %q, want %q", gotPorts, testIPv4A+","+testIPv4B)
+	// vastnfs rejects comma-separated lists with EINVAL; only the kernel-range
+	// form "<low>-<high>" is accepted. See CRUSOE-70481 dlim ICAT test
+	// 2026-05-29 for the empirical failure that motivated this assertion.
+	want := testIPv4A + "-" + testIPv4B
+	if gotPorts != want {
+		t.Errorf("remotePorts = %q, want %q (dash-range form, NOT comma-separated)", gotPorts, want)
+	}
+}
+
+//nolint:paralleltest // mutates package-level lookupIP via fs.SetLookupIP
+// TestMaterializeNFSTarget_SortsOutOfOrderResponse guards against the kernel
+// receiving "<high>-<low>" — the range form requires the lower IP first, and
+// net.LookupIP is documented to return addresses in unspecified order. This
+// matches the dlim ICAT response we observed (16 VIPs returned in shuffled
+// order) which would otherwise produce a malformed range like
+// "172.27.255.33-172.27.255.18".
+func TestMaterializeNFSTarget_SortsOutOfOrderResponse(t *testing.T) {
+	withStubLookupIP(t, func(_ string) ([]net.IP, error) {
+		// Deliberately reverse order: DNS hands us testIPv4B (higher) first.
+		return []net.IP{net.ParseIP(testIPv4B), net.ParseIP(testIPv4A)}, nil
+	})
+
+	gotHost, gotPorts, err := fs.MaterializeNFSTarget(testHost, testDNS)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if gotHost != testIPv4A {
+		t.Errorf("host = %q, want %q (must be the lowest IP after sort)", gotHost, testIPv4A)
+	}
+	want := testIPv4A + "-" + testIPv4B
+	if gotPorts != want {
+		t.Errorf("remotePorts = %q, want %q (sorted dash-range)", gotPorts, want)
 	}
 }