fix(resmgr): blueprint schema fidelity; add vnc_floating_ip

Bring pcd_cluster_blueprint in line with what the blueprint API actually
stores and what the product actually exposes, verified against PCD
2026.4 and the PCD UI source.

Remove vm_high_availability and auto_resource_rebalancing. They are
cluster-scoped: the blueprint API does not store them (a POST carrying
both returns an object with neither key) and the UI never sends them in
blueprintConfigBody. A user setting them here believed HA/DRR were on
when nothing had happened. They remain on pcd_cluster, where they take
effect. Optional+Computed, so omitting configs are unaffected.

Make networking_type and enable_distributed_routing Computed-only. No
product surface exposes them — the UI hardcodes ovn / true and pcdctl
has no blueprint capability at all — but the API requires both on
create with no server default (omitted or "" networkingType is
rejected; omitted enableDistributedRouting is a 500). The provider now
takes the UI's role and supplies the product values, and rejects any
attempt to configure them, so Terraform cannot produce a region the
UI never would.

Add vnc_floating_ip on the resource and data source. resmgr silently
discards vncFloatingIp on POST and persists it only on PUT (identical
body: POST stores null, PUT stores the value); the UI never trips this
because it sets the IP on a later save. On create the provider follows
the POST with a PUT when the value is set. The API's null is modelled
as "" so a user can clear it with vnc_floating_ip = "" and get a stable
plan. Full lifecycle verified live — create, update, clear, omit,
never-set — each followed by "No changes".

Reword instance_shared_storage to match the UI toggle it maps to and
reference vm_storage, so the flag is discoverable next to the path it
qualifies. Fix the example, which set the now read-only networking_type.

Author: PF9-pushkar

CHANGELOG.md

@@ -6,6 +6,32 @@ All notable changes to this project are documented here. The format is based on
 
 ## [Unreleased]
 
+## [0.1.6] - 2026-08-15
+
+### Fixed
+- **`pcd_cluster_blueprint` silently accepted `vm_high_availability` and
+  `auto_resource_rebalancing`.** These are cluster-scoped settings: the blueprint API does
+  not store them (a POST carrying them returns an object without either key), and the PCD
+  UI never sends them. A user who set them on the blueprint believed HA/DRR were enabled
+  when nothing had happened. Both attributes are removed; they live on `pcd_cluster`, where
+  they take effect. Not a breaking change for configurations that omitted them.
+- **`networking_type` and `enable_distributed_routing` are now read-only.** No product
+  surface exposes them (the PCD UI hardcodes `ovn`/`true`; `pcdctl` has no blueprint
+  capability), yet the API requires both on create with no server default. The provider now
+  supplies the product values itself and rejects attempts to configure them, so a Terraform
+  user cannot put a region into a state the UI would never produce.
+
+### Added
+- **`pcd_cluster_blueprint.vnc_floating_ip`** (and on the data source): the floating IP
+  through which VM VNC consoles are reached. Set `""` to clear. Works around a resmgr
+  quirk where `POST /v2/blueprint` silently discards `vncFloatingIp` and only `PUT`
+  persists it — on create the provider follows the POST with a PUT when the value is set.
+
+### Changed
+- `instance_shared_storage` documentation now matches the UI toggle it maps to ("Enable
+  if this path is mounted as shared storage (e.g. NFS) across all hosts") and references
+  `vm_storage`, so the flag is discoverable next to the path it qualifies.
+
 ## [0.1.5] - 2026-08-15
 
 ### Fixed

docs/data-sources/cluster_blueprint.md

@@ -28,14 +28,15 @@ data "pcd_cluster_blueprint" "example" {
 ### Read-Only
 
 - `dns_domain_name` (String) The internal DNS domain name for VMs.
-- `enable_distributed_routing` (Boolean) Whether distributed routing is enabled.
+- `enable_distributed_routing` (Boolean) Whether distributed routing is enabled for the region. PCD-set; not user-configurable.
 - `image_library_shared_storage` (Boolean) Whether the image library uses shared storage.
 - `image_library_storage` (String) The image library storage location.
-- `instance_shared_storage` (Boolean) Whether instance storage is shared.
-- `networking_type` (String) The networking type (`ovn` or `ovs`).
+- `instance_shared_storage` (Boolean) Whether `vm_storage` is mounted as shared storage (e.g. NFS) across all hosts.
+- `networking_type` (String) The networking type PCD selected for the region (`ovn`). PCD-set; not user-configurable.
 - `storage_backends_json` (String, Sensitive) The Cinder storage backends as a JSON string (contains credentials).
 - `virtual_networking` (Attributes) Virtual (tenant) networking settings. (see [below for nested schema](#nestedatt--virtual_networking))
-- `vm_storage` (String) The VM ephemeral storage path.
+- `vm_storage` (String) The path on each hypervisor where instance (ephemeral) storage lives.
+- `vnc_floating_ip` (String) The floating IP through which VM VNC consoles are reached, if any.
 
 <a id="nestedatt--virtual_networking"></a>
 ### Nested Schema for `virtual_networking`

docs/resources/cluster_blueprint.md

@@ -17,7 +17,6 @@ Manages a PCD cluster blueprint — the shared, declarative configuration that v
 # the existing blueprint (see import.sh) and then manage it here.
 resource "pcd_cluster_blueprint" "example" {
   name            = "cluster-1"
-  networking_type = "ovn"
   dns_domain_name = "example.local."
 
   virtual_networking = {
@@ -26,9 +25,21 @@ resource "pcd_cluster_blueprint" "example" {
     vnid_range    = "1000:2000"
   }
 
+  # Where instance (ephemeral) disks live on each hypervisor. Set
+  # instance_shared_storage = true only if this path is mounted as shared
+  # storage (e.g. NFS) across all hosts.
+  vm_storage              = "/opt/data/instances"
+  instance_shared_storage = false
+
+  # Optional: a floating IP through which VM VNC consoles are reached.
+  # vnc_floating_ip = "203.0.113.10"
+
   # storage_backends_json is omitted here so the imported Cinder backends are
   # preserved. It is required only when creating a brand-new blueprint, and it
   # carries driver credentials (sensitive).
+
+  # networking_type and enable_distributed_routing are set by PCD (ovn / true)
+  # and are read-only here; they appear in state but are not configurable.
 }
 ```
 
@@ -41,27 +52,19 @@ resource "pcd_cluster_blueprint" "example" {
 
 ### Optional
 
-- `auto_resource_rebalancing` (Attributes) Automatic workload-rebalancing settings. (see [below for nested schema](#nestedatt--auto_resource_rebalancing))
 - `dns_domain_name` (String) The internal DNS domain name suffix for VMs (not Designate).
-- `enable_distributed_routing` (Boolean) Whether cluster-wide distributed routing is enabled.
 - `image_library_shared_storage` (Boolean) Whether the image library uses shared storage.
 - `image_library_storage` (String) The image library storage location.
-- `instance_shared_storage` (Boolean) Whether instance ephemeral storage is shared.
-- `networking_type` (String) The networking type: `ovn` (default) or `ovs`.
+- `instance_shared_storage` (Boolean) Set `true` when `vm_storage` is mounted as shared storage (e.g. NFS) across all hosts, so PCD can treat instance disks as shared. Matches the UI's "Enable if this path is mounted as shared storage across all hosts" toggle. Defaults to `false` (local disk).
 - `storage_backends_json` (String, Sensitive) The Cinder storage backends as a JSON string (contains credentials). Read back from the server; set it only to change backends.
 - `virtual_networking` (Attributes) Virtual (tenant) networking settings. (see [below for nested schema](#nestedatt--virtual_networking))
-- `vm_high_availability` (Attributes) VM high-availability settings. (see [below for nested schema](#nestedatt--vm_high_availability))
-- `vm_storage` (String) The VM ephemeral storage path.
-
-<a id="nestedatt--auto_resource_rebalancing"></a>
-### Nested Schema for `auto_resource_rebalancing`
-
-Optional:
+- `vm_storage` (String) The path on each hypervisor where instance (ephemeral) storage lives, e.g. `/opt/data/instances`.
+- `vnc_floating_ip` (String) A floating IP through which VM VNC consoles are reached. Leave unset for none.
 
-- `enabled` (Boolean) Whether auto-rebalancing is enabled.
-- `rebalancing_frequency_mins` (Number) Rebalancing frequency in minutes (1-60).
-- `rebalancing_strategy` (String) `vm_workload_consolidation` or `node_resource_consolidation`.
+### Read-Only
 
+- `enable_distributed_routing` (Boolean) Whether distributed routing is enabled. Always `true` — set by the provider to match the product; not user-configurable.
+- `networking_type` (String) The region's networking type. Always `ovn` — set by the provider to match the product; not user-configurable.
 
 <a id="nestedatt--virtual_networking"></a>
 ### Nested Schema for `virtual_networking`
@@ -72,14 +75,6 @@ Optional:
 - `underlay_type` (String) The underlay type: `vlan` or `other`.
 - `vnid_range` (String) The VLAN/VNI segmentation ID range (e.g. `1000:2000`).
 
-
-<a id="nestedatt--vm_high_availability"></a>
-### Nested Schema for `vm_high_availability`
-
-Optional:
-
-- `enabled` (Boolean) Auto-detect host failure and recover VMs.
-
 ## Import
 
 Import is supported using the following syntax:

examples/resources/pcd_cluster_blueprint/resource.tf

@@ -2,7 +2,6 @@
 # the existing blueprint (see import.sh) and then manage it here.
 resource "pcd_cluster_blueprint" "example" {
   name            = "cluster-1"
-  networking_type = "ovn"
   dns_domain_name = "example.local."
 
   virtual_networking = {
@@ -11,7 +10,19 @@ resource "pcd_cluster_blueprint" "example" {
     vnid_range    = "1000:2000"
   }
 
+  # Where instance (ephemeral) disks live on each hypervisor. Set
+  # instance_shared_storage = true only if this path is mounted as shared
+  # storage (e.g. NFS) across all hosts.
+  vm_storage              = "/opt/data/instances"
+  instance_shared_storage = false
+
+  # Optional: a floating IP through which VM VNC consoles are reached.
+  # vnc_floating_ip = "203.0.113.10"
+
   # storage_backends_json is omitted here so the imported Cinder backends are
   # preserved. It is required only when creating a brand-new blueprint, and it
   # carries driver credentials (sensitive).
+
+  # networking_type and enable_distributed_routing are set by PCD (ovn / true)
+  # and are read-only here; they appear in state but are not configurable.
 }

internal/services/resmgr/blueprint_data_source.go

@@ -39,6 +39,7 @@ type blueprintDataSourceModel struct {
 	ImageLibrarySharedStorage types.Bool   `tfsdk:"image_library_shared_storage"`
 	InstanceSharedStorage     types.Bool   `tfsdk:"instance_shared_storage"`
 	VMStorage                 types.String `tfsdk:"vm_storage"`
+	VNCFloatingIP             types.String `tfsdk:"vnc_floating_ip"`
 	StorageBackendsJSON       types.String `tfsdk:"storage_backends_json"`
 }
 
@@ -53,9 +54,9 @@ type blueprintAPI struct {
 	ImageLibrarySharedStorage bool                  `json:"imageLibrarySharedStorage"`
 	InstanceSharedStorage     bool                  `json:"instanceSharedStorage"`
 	VMStorage                 string                `json:"vmStorage"`
-	VMHighAvailability        *haAPI                `json:"vmHighAvailability"`
-	AutoResourceRebalancing   *rebalanceAPI         `json:"autoResourceRebalancing"`
-	StorageBackends           json.RawMessage       `json:"storageBackends"`
+	// Pointer: the API returns null for "no floating IP".
+	VNCFloatingIP   *string         `json:"vncFloatingIp"`
+	StorageBackends json.RawMessage `json:"storageBackends"`
 }
 
 type haAPI struct {
@@ -89,8 +90,8 @@ func (d *blueprintDataSource) Schema(_ context.Context, _ datasource.SchemaReque
 		MarkdownDescription: "Reads a PCD cluster blueprint by name.",
 		Attributes: map[string]schema.Attribute{
 			"name":                       schema.StringAttribute{Required: true, MarkdownDescription: "The blueprint (cluster) name."},
-			"networking_type":            schema.StringAttribute{Computed: true, MarkdownDescription: "The networking type (`ovn` or `ovs`)."},
-			"enable_distributed_routing": schema.BoolAttribute{Computed: true, MarkdownDescription: "Whether distributed routing is enabled."},
+			"networking_type":            schema.StringAttribute{Computed: true, MarkdownDescription: "The networking type PCD selected for the region (`ovn`). PCD-set; not user-configurable."},
+			"enable_distributed_routing": schema.BoolAttribute{Computed: true, MarkdownDescription: "Whether distributed routing is enabled for the region. PCD-set; not user-configurable."},
 			"dns_domain_name":            schema.StringAttribute{Computed: true, MarkdownDescription: "The internal DNS domain name for VMs."},
 			"virtual_networking": schema.SingleNestedAttribute{
 				Computed:            true,
@@ -103,8 +104,9 @@ func (d *blueprintDataSource) Schema(_ context.Context, _ datasource.SchemaReque
 			},
 			"image_library_storage":        schema.StringAttribute{Computed: true, MarkdownDescription: "The image library storage location."},
 			"image_library_shared_storage": schema.BoolAttribute{Computed: true, MarkdownDescription: "Whether the image library uses shared storage."},
-			"instance_shared_storage":      schema.BoolAttribute{Computed: true, MarkdownDescription: "Whether instance storage is shared."},
-			"vm_storage":                   schema.StringAttribute{Computed: true, MarkdownDescription: "The VM ephemeral storage path."},
+			"vm_storage":                   schema.StringAttribute{Computed: true, MarkdownDescription: "The path on each hypervisor where instance (ephemeral) storage lives."},
+			"instance_shared_storage":      schema.BoolAttribute{Computed: true, MarkdownDescription: "Whether `vm_storage` is mounted as shared storage (e.g. NFS) across all hosts."},
+			"vnc_floating_ip":              schema.StringAttribute{Computed: true, MarkdownDescription: "The floating IP through which VM VNC consoles are reached, if any."},
 			"storage_backends_json":        schema.StringAttribute{Computed: true, Sensitive: true, MarkdownDescription: "The Cinder storage backends as a JSON string (contains credentials)."},
 		},
 	}
@@ -141,6 +143,11 @@ func (d *blueprintDataSource) Read(ctx context.Context, req datasource.ReadReque
 	data.ImageLibrarySharedStorage = types.BoolValue(bp.ImageLibrarySharedStorage)
 	data.InstanceSharedStorage = types.BoolValue(bp.InstanceSharedStorage)
 	data.VMStorage = types.StringValue(bp.VMStorage)
+	if bp.VNCFloatingIP != nil {
+		data.VNCFloatingIP = types.StringValue(*bp.VNCFloatingIP)
+	} else {
+		data.VNCFloatingIP = types.StringValue("")
+	}
 
 	if bp.VirtualNetworking != nil {
 		obj, diags := types.ObjectValue(virtualNetworkingAttrTypes, map[string]attr.Value{