Until a minute ago I'd been assuming that we would put bare-metal nodes in the labs-vm subnet. Having thought a bit about the complications there, though, I'm now thinking that perhaps we should create a new subnet just for this.

The subnet would have all the same routing/filtering rules as the vm subnet (allowing it to talk to labs vms and not to internal production ips) BUT it would use the normal production dhcp setup rather than trying to get IPs from nova or nova-network or neutron or what-have-you.

I don't know how hard it would be to set this up, but it will allow us to dodge a lot of painful hacks.