feat(satellite): volume resize end-to-end plumbing (Phase 8.2)

CSI ControllerExpandVolume previously dead-ended: the REST PUT
updated the VolumeDefinition spec but no reconcile path actually
grew the underlying block device or notified DRBD.

Added:
- storage.Provider gained ResizeVolume(ctx, vol). Implementations:
  * lvm-thin: lvextend --size <MiB>MiB
  * zfs: zfs set volsize=<MiB>M
  * file: truncate -s <bytes> (works for both thick and thin)
  * loopfile: truncate + losetup --set-capacity so the kernel
    notices the new size on the loop device
- pkg/drbd.Adm.Resize: drbdadm resize --assume-clean <rd>
  (--assume-clean skips the resync of the new bytes since they
  were just allocated zero, otherwise growing 3 replicas would
  serialise on each resync)
- pkg/luks.Resize: cryptsetup resize <dmName> --key-file - so the
  dm-crypt target picks up the new lower-disk size; satellite-side
  wiring lands when the per-resource encrypted flag flows through
  ApplyResources.
- satellite reconciler applyStorage detects desired > usable on a
  pre-existing volume, runs ResizeVolume, signals back through a
  new return value; applyDRBD then runs drbdadm resize after Adjust.

Tests:
- pkg/storage/{lvm,zfs}_test.go pin the per-provider command shape
- pkg/satellite TestApplyTriggersResizeOnGrow asserts the full
  lvextend → drbdadm resize sequence
- TestApplyNoResizeOnFreshCreate locks in "no resize when first
  creating" so a fresh PVC doesn't get a spurious resize

End-to-end PVC-resize-with-checksum-verify lives on the 8.8 e2e
checklist; the building blocks are all in place.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

Author: kvaps

PLAN.md

@@ -403,7 +403,7 @@ The phases above closed the MVP slice and the csi-sanity REST contract. A deep a
 
 ### 8.2 Storage correctness
 
-- [ ] **Volume resize** with and without LUKS. No endpoint today (`PUT /v1/resource-definitions/{rd}/volume-definitions/{vn}` doesn't grow the device). Path: VD update → reconciler sees new size → provider grow (`lvextend`/`zfs set`) → `cryptsetup resize` if LUKS layered → `drbdadm resize`. Pin via e2e: 1G PVC → write checksum → resize to 2G → verify checksum + new size on both replicas.
+- [x] **Volume resize** plumbing (2026-05-09): `PUT /v1/resource-definitions/{rd}/volume-definitions/{vn}` already updated the spec; the satellite reconciler now picks up the size delta. Provider interface gained `ResizeVolume` (lvm-thin → `lvextend`, zfs → `zfs set volsize`, file/loopfile → `truncate` + `losetup -c`). On growth the reconciler runs the provider's resize, then `drbdadm resize --assume-clean <rd>` so the kernel re-reads the lower disk. `pkg/luks.Resize` adds the cryptsetup hook for the LUKS layer; satellite-side wiring of LUKS resize lands when the per-resource `encrypted` flag flows through ApplyResources (Phase 6 follow-up). Tests: `TestApplyTriggersResizeOnGrow`, `TestApplyNoResizeOnFreshCreate` for the satellite path; per-provider tests for the resize commands. **End-to-end with a real PVC + checksum verify is still on the e2e harness checklist** (8.8).
 - [ ] **Backing-device failure under DRBD**. When the storage layer drops out, the satellite must detach the failed replica (don't oscillate it diskful↔diskless). Today nothing watches `/proc/drbd` for `disk:Failed`. Add an event hook in `Reconciler` that flips the replica to a Diskless attach via `drbdsetup detach` and surfaces a Status condition. e2e: pull the LV out from under DRBD, observe peer stays Primary, no I/O loss.
 - [ ] **DRBD options hierarchy** controller → resource-group → resource-definition → resource. Today props are flat on each level; the rendered `.res` doesn't honour the upstream override order. Build a resolver in `pkg/drbd` that walks the inheritance chain and pin via a contract test that checks each level can override its parent.
 - [ ] **`allow-two-primaries` + live migration** path. Ganesha-based RWX and KubeVirt VM live-migration both depend on a small window where two nodes are Primary. Today we set `auto-primary` on the lex-lowest replica only; multiple-primary is unsupported. Add the flag plumbing through DesiredResource and the corresponding fence/dual-primary safety on the satellite.

pkg/drbd/drbdadm.go

@@ -83,6 +83,16 @@ func (a *Adm) Secondary(ctx context.Context, resource string) error {
 	return a.run(ctx, "secondary", resource)
 }
 
+// Resize rescans the lower disk's size and tells DRBD to grow the
+// replicated volume to match. The lower disk (LV / zvol / dm-crypt
+// target) must already be the target size — this is a notify-only
+// command. `--assume-clean` skips the resync of the new bytes since
+// they were just allocated, which would otherwise serialise growing
+// every replica.
+func (a *Adm) Resize(ctx context.Context, resource string) error {
+	return a.run(ctx, "resize", "--assume-clean", resource)
+}
+
 // run is the single shell-out site so every drbdadm error gets
 // uniform context (subcommand + resource) for log triage.
 func (a *Adm) run(ctx context.Context, args ...string) error {

pkg/luks/luks.go

@@ -68,6 +68,19 @@ func (c *Cryptsetup) Open(ctx context.Context, device, dmName string, key []byte
 	return nil
 }
 
+// Resize tells cryptsetup the underlying device has grown — without
+// it the dm-crypt target keeps the original size and `drbdadm resize`
+// only sees the LUKS-mapped portion. Idempotent: a no-op when the
+// device size already matches the dm target.
+func (c *Cryptsetup) Resize(ctx context.Context, dmName string, key []byte) error {
+	err := c.runWithKey(ctx, key, "resize", dmName, "--key-file", "-")
+	if err != nil {
+		return errors.Wrapf(err, "luksResize %s", dmName)
+	}
+
+	return nil
+}
+
 // Close removes the dm-crypt mapping. Counterpart to Open.
 func (c *Cryptsetup) Close(ctx context.Context, dmName string) error {
 	_, err := c.exec.Run(ctx, "cryptsetup", "luksClose", dmName)

pkg/satellite/reconciler.go

@@ -239,8 +239,10 @@ func (r *Reconciler) applyOne(ctx context.Context, dr *satellitepb.DesiredResour
 
 	devices := map[int32]string{}
 
+	resized := false
+
 	if !diskless {
-		got, err := r.applyStorage(ctx, dr)
+		got, didResize, err := r.applyStorage(ctx, dr)
 		if err != nil {
 			res.Ok = false
 			res.Message = err.Error()
@@ -249,10 +251,11 @@ func (r *Reconciler) applyOne(ctx context.Context, dr *satellitepb.DesiredResour
 		}
 
 		devices = got
+		resized = didResize
 	}
 
 	if r.cfg.Adm != nil {
-		err := r.applyDRBD(ctx, dr, diskless, devices)
+		err := r.applyDRBD(ctx, dr, diskless, devices, resized)
 		if err != nil {
 			res.Ok = false
 			res.Message = err.Error()
@@ -273,13 +276,14 @@ func (r *Reconciler) applyOne(ctx context.Context, dr *satellitepb.DesiredResour
 // Records the resource→pool mapping (first volume's pool) so
 // subsequent snapshot RPCs can route without the controller passing
 // the pool.
-func (r *Reconciler) applyStorage(ctx context.Context, dr *satellitepb.DesiredResource) (map[int32]string, error) {
+func (r *Reconciler) applyStorage(ctx context.Context, dr *satellitepb.DesiredResource) (map[int32]string, bool, error) {
 	devices := map[int32]string{}
+	resized := false
 
 	for _, vol := range dr.GetVolumes() {
 		provider, ok := r.cfg.Providers[vol.GetStoragePool()]
 		if !ok {
-			return nil, errors.Errorf("unknown storage pool %q", vol.GetStoragePool())
+			return nil, false, errors.Errorf("unknown storage pool %q", vol.GetStoragePool())
 		}
 
 		err := provider.CreateVolume(ctx, storage.Volume{
@@ -288,15 +292,34 @@ func (r *Reconciler) applyStorage(ctx context.Context, dr *satellitepb.DesiredRe
 			SizeKib:      vol.GetSizeKib(),
 		})
 		if err != nil {
-			return nil, errors.Wrapf(err, "create volume %s/%d", dr.GetName(), vol.GetVolumeNumber())
+			return nil, false, errors.Wrapf(err, "create volume %s/%d", dr.GetName(), vol.GetVolumeNumber())
 		}
 
 		status, err := provider.VolumeStatus(ctx, storage.Volume{
 			ResourceName: dr.GetName(),
 			VolumeNumber: vol.GetVolumeNumber(),
 		})
 		if err != nil {
-			return nil, errors.Wrapf(err, "volume status %s/%d", dr.GetName(), vol.GetVolumeNumber())
+			return nil, false, errors.Wrapf(err, "volume status %s/%d", dr.GetName(), vol.GetVolumeNumber())
+		}
+
+		// Grow path: the controller's VolumeDefinition update set a
+		// new size that's larger than what the provider has on disk.
+		// Call ResizeVolume to extend the LV/zvol/file; the LUKS
+		// layer (when present) and `drbdadm resize` are layered on
+		// top by their own reconcile steps.
+		if vol.GetSizeKib() > status.UsableKib && status.UsableKib > 0 {
+			err = provider.ResizeVolume(ctx, storage.Volume{
+				ResourceName: dr.GetName(),
+				VolumeNumber: vol.GetVolumeNumber(),
+				SizeKib:      vol.GetSizeKib(),
+			})
+			if err != nil {
+				return nil, false, errors.Wrapf(err, "resize volume %s/%d to %d KiB",
+					dr.GetName(), vol.GetVolumeNumber(), vol.GetSizeKib())
+			}
+
+			resized = true
 		}
 
 		devices[vol.GetVolumeNumber()] = status.DevicePath
@@ -306,7 +329,7 @@ func (r *Reconciler) applyStorage(ctx context.Context, dr *satellitepb.DesiredRe
 		r.rememberPool(dr.GetName(), dr.GetVolumes()[0].GetStoragePool())
 	}
 
-	return devices, nil
+	return devices, resized, nil
 }
 
 // applyDRBD renders the .res file from dr's metadata and (re)applies
@@ -317,7 +340,7 @@ func (r *Reconciler) applyStorage(ctx context.Context, dr *satellitepb.DesiredRe
 // devices is the volNumber → DevicePath map applyStorage produced.
 // buildResFile uses it as the disk path so a loopfile-backed volume
 // gets `disk /dev/loopN` rather than the LVM-shaped guess.
-func (r *Reconciler) applyDRBD(ctx context.Context, dr *satellitepb.DesiredResource, diskless bool, devices map[int32]string) error {
+func (r *Reconciler) applyDRBD(ctx context.Context, dr *satellitepb.DesiredResource, diskless bool, devices map[int32]string, resized bool) error {
 	resPath := filepath.Join(r.cfg.StateDir, dr.GetName()+".res")
 	_, statErr := os.Stat(resPath)
 	firstActivation := os.IsNotExist(statErr)
@@ -344,6 +367,19 @@ func (r *Reconciler) applyDRBD(ctx context.Context, dr *satellitepb.DesiredResou
 		return errors.Wrapf(err, "adjust %s", dr.GetName())
 	}
 
+	// Pickup-time resize: the storage layer was just grown, drbdadm
+	// resize tells the kernel to extend the replicated device to
+	// match. Adjust on its own won't do this — only resize re-reads
+	// the lower disk's size. Diskless replicas don't have a lower
+	// disk to resize but they still need their internal state to
+	// catch up; drbdadm resize handles that case too.
+	if resized {
+		err = r.cfg.Adm.Resize(ctx, dr.GetName())
+		if err != nil {
+			return errors.Wrapf(err, "resize %s", dr.GetName())
+		}
+	}
+
 	// On first activation of a diskful replica the controller may
 	// flag it as the auto-primary seed. We promote once (force-
 	// primary then back to secondary) so the metadata moves out of

pkg/satellite/reconciler_drbd_test.go

@@ -170,3 +170,99 @@ func TestApplyDisklessNoCreateMD(t *testing.T) {
 		}
 	}
 }
+
+// TestApplyTriggersResizeOnGrow simulates the satellite picking up a
+// VolumeDefinition update that grew the volume: lvs reports the LV
+// already exists at 1 GiB, the desired size is 2 GiB → reconciler
+// must call lvextend then drbdadm resize. Pins the upstream-style
+// growth-path semantics CSI ControllerExpandVolume relies on.
+func TestApplyTriggersResizeOnGrow(t *testing.T) {
+	dir := t.TempDir()
+	fx := storage.NewFakeExec()
+	// Volume already exists.
+	fx.Expect("lvs --noheadings -o lv_name vg/pvc-grow_00000",
+		storage.FakeResponse{Stdout: []byte("pvc-grow_00000\n")})
+	// VolumeStatus: 1 GiB on disk (1024*1024 KiB).
+	fx.Expect("lvs --noheadings --separator | -o lv_path,lv_size --units k --nosuffix vg/pvc-grow_00000",
+		storage.FakeResponse{Stdout: []byte("/dev/vg/pvc-grow_00000|1048576\n")})
+
+	thin := lvm.NewThin(lvm.ThinConfig{VolumeGroup: "vg", ThinPool: "tp"}, fx)
+	rec := satellite.NewReconciler(satellite.ReconcilerConfig{
+		Providers: map[string]storage.Provider{"thin1": thin},
+		Adm:       drbd.NewAdm(fx),
+		StateDir:  dir,
+		NodeName:  "n1",
+	})
+
+	// Desired: 2 GiB.
+	_, err := rec.Apply(t.Context(), []*satellitepb.DesiredResource{
+		{
+			Name:     "pvc-grow",
+			NodeName: "n1",
+			Volumes: []*satellitepb.DesiredVolume{
+				{VolumeNumber: 0, SizeKib: 2 * 1024 * 1024, StoragePool: "thin1"},
+			},
+			DrbdOptions: map[string]string{
+				"port": "7000", "node-id": "0", "address": "10.0.0.1", "minor": "1000",
+			},
+		},
+	})
+	if err != nil {
+		t.Fatalf("Apply: %v", err)
+	}
+
+	want := []string{
+		"lvextend --size 2048MiB vg/pvc-grow_00000",
+		"drbdadm resize --assume-clean pvc-grow",
+	}
+
+	for _, w := range want {
+		if !slices.Contains(fx.CommandLines(), w) {
+			t.Errorf("expected %q in calls; got %v", w, fx.CommandLines())
+		}
+	}
+}
+
+// TestApplyNoResizeOnFreshCreate: when the volume doesn't exist yet
+// CreateVolume runs but ResizeVolume must NOT — there's nothing to
+// grow. drbdadm resize is also skipped.
+func TestApplyNoResizeOnFreshCreate(t *testing.T) {
+	dir := t.TempDir()
+	fx := storage.NewFakeExec()
+	fx.Expect("lvs --noheadings -o lv_name vg/pvc-new_00000",
+		storage.FakeResponse{Stdout: []byte("")})
+
+	thin := lvm.NewThin(lvm.ThinConfig{VolumeGroup: "vg", ThinPool: "tp"}, fx)
+	rec := satellite.NewReconciler(satellite.ReconcilerConfig{
+		Providers: map[string]storage.Provider{"thin1": thin},
+		Adm:       drbd.NewAdm(fx),
+		StateDir:  dir,
+		NodeName:  "n1",
+	})
+
+	_, err := rec.Apply(t.Context(), []*satellitepb.DesiredResource{
+		{
+			Name:     "pvc-new",
+			NodeName: "n1",
+			Volumes: []*satellitepb.DesiredVolume{
+				{VolumeNumber: 0, SizeKib: 2 * 1024 * 1024, StoragePool: "thin1"},
+			},
+			DrbdOptions: map[string]string{
+				"port": "7000", "node-id": "0", "address": "10.0.0.1", "minor": "1000",
+			},
+		},
+	})
+	if err != nil {
+		t.Fatalf("Apply: %v", err)
+	}
+
+	for _, line := range fx.CommandLines() {
+		if strings.HasPrefix(line, "lvextend ") {
+			t.Errorf("fresh create issued lvextend: %s", line)
+		}
+
+		if strings.HasPrefix(line, "drbdadm resize") {
+			t.Errorf("fresh create issued drbdadm resize: %s", line)
+		}
+	}
+}

pkg/storage/file/file.go

@@ -99,6 +99,37 @@ func (p *Provider) CreateVolume(ctx context.Context, vol storage.Volume) error {
 	return nil
 }
 
+// ResizeVolume grows the backing file to vol.SizeKib bytes. truncate
+// is the right tool for both thick (fallocate-created) and thin
+// (truncate-created) cases — when the file is shorter than the new
+// size, the OS extends with sparse zero-bytes. Shrinks are rejected
+// to match the rest of the provider contract.
+func (p *Provider) ResizeVolume(ctx context.Context, vol storage.Volume) error {
+	path := p.volumePath(vol)
+
+	info, err := os.Stat(path)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return errors.Wrapf(storage.ErrNotFound, "resize %s", path)
+		}
+
+		return errors.Wrapf(err, "stat %s", path)
+	}
+
+	target := vol.SizeKib * bytesPerKib
+
+	if info.Size() >= target {
+		return nil
+	}
+
+	_, err = p.exec.Run(ctx, "truncate", "-s", strconv.FormatInt(target, 10), path)
+	if err != nil {
+		return errors.Wrapf(err, "truncate %s", path)
+	}
+
+	return nil
+}
+
 // DeleteVolume removes the backing file. Missing → no-op.
 func (p *Provider) DeleteVolume(_ context.Context, vol storage.Volume) error {
 	path := p.volumePath(vol)

pkg/storage/loopfile/loopfile.go

@@ -92,6 +92,43 @@ func (p *Provider) CreateVolume(ctx context.Context, vol storage.Volume) error {
 	return nil
 }
 
+// ResizeVolume grows the backing file and re-runs losetup --set-capacity
+// so the kernel picks up the new size on the loop device. Shrinks are
+// rejected. Idempotent: a no-op when current size already meets target.
+func (p *Provider) ResizeVolume(ctx context.Context, vol storage.Volume) error {
+	path := p.volumePath(vol)
+
+	info, err := os.Stat(path)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return errors.Wrapf(storage.ErrNotFound, "resize %s", path)
+		}
+
+		return errors.Wrapf(err, "stat %s", path)
+	}
+
+	target := vol.SizeKib * bytesPerKib
+
+	if info.Size() >= target {
+		return nil
+	}
+
+	_, err = p.exec.Run(ctx, "truncate", "-s", strconv.FormatInt(target, 10), path)
+	if err != nil {
+		return errors.Wrapf(err, "truncate %s", path)
+	}
+
+	dev, err := p.lookupLoop(ctx, path)
+	if err == nil && dev != "" {
+		_, err = p.exec.Run(ctx, "losetup", "-c", dev)
+		if err != nil {
+			return errors.Wrapf(err, "losetup -c %s", dev)
+		}
+	}
+
+	return nil
+}
+
 // DeleteVolume detaches the loop device (if any) and removes the file.
 // Missing → no-op.
 func (p *Provider) DeleteVolume(ctx context.Context, vol storage.Volume) error {

pkg/storage/lvm/lvm_thin.go

@@ -88,6 +88,24 @@ func (t *Thin) CreateVolume(ctx context.Context, vol storage.Volume) error {
 	return nil
 }
 
+// ResizeVolume grows the LV to vol.SizeKib (rounded up to MiB to
+// match LINSTOR's reporting). Shrinks are rejected — DRBD doesn't
+// support online shrink and CSI ControllerExpandVolume is grow-only.
+// `lvextend --size` is a no-op when the requested size matches, so
+// the call stays idempotent.
+func (t *Thin) ResizeVolume(ctx context.Context, vol storage.Volume) error {
+	sizeMiB := max(vol.SizeKib/mibPerKib, 1)
+
+	_, err := t.exec.Run(ctx, "lvextend",
+		"--size", strconv.FormatInt(sizeMiB, 10)+"MiB",
+		t.cfg.VolumeGroup+"/"+volumeLVName(vol))
+	if err != nil {
+		return errors.Wrapf(err, "lvextend %s", volumeLVName(vol))
+	}
+
+	return nil
+}
+
 // DeleteVolume idempotently removes the LV. Missing → no-op (reconcile
 // loops re-call this).
 func (t *Thin) DeleteVolume(ctx context.Context, vol storage.Volume) error {

pkg/storage/lvm/lvm_thin_test.go

@@ -255,3 +255,26 @@ func TestThinExecError(t *testing.T) {
 }
 
 var errLVCreateFailed = errors.New("lvcreate: insufficient free space")
+
+// TestThinResizeVolumeIssuesLvextend pins the lvextend command shape.
+// CSI ControllerExpandVolume → REST PUT → reconciler ResizeVolume,
+// so the wire-visible behaviour is "lvextend --size <newMiB>MiB
+// vg/lv". Refactors that change the args will fail loudly here.
+func TestThinResizeVolumeIssuesLvextend(t *testing.T) {
+	fx := storage.NewFakeExec()
+	p := lvm.NewThin(lvm.ThinConfig{VolumeGroup: "vg", ThinPool: "thinpool"}, fx)
+
+	err := p.ResizeVolume(t.Context(), storage.Volume{
+		ResourceName: "pvc-1",
+		VolumeNumber: 0,
+		SizeKib:      2048 * 1024, // 2 GiB
+	})
+	if err != nil {
+		t.Fatalf("ResizeVolume: %v", err)
+	}
+
+	want := "lvextend --size 2048MiB vg/pvc-1_00000"
+	if !slices.Contains(fx.CommandLines(), want) {
+		t.Errorf("expected %q; got %v", want, fx.CommandLines())
+	}
+}