feat(satellite): plumb allow-two-primaries into rendered .res (Phase 8.2)

The DRBD option hierarchy was reaching the satellite via
DesiredResource.DrbdOptions but buildResFile dropped everything
except the per-replica wiring keys. allow-two-primaries (Ganesha
RWX, KubeVirt live-migration), max-buffers, after-sb-*, and every
other operator-tunable knob silently never made it into the .res
file's net{} block.

splitDRBDOptions partitions the bag by section and strips the
`DrbdOptions/<Section>/` prefix so drbd.Build emits the keys in
the form drbdadm expects. Net keys land on `net { }`, everything
else (including unknown sections that the upstream catalogue may
add later) on the resource-level `options { }` block — drbd's
catch-all, so a future option doesn't get dropped.

Test: TestApplyRendersAllowTwoPrimaries pins
`allow-two-primaries yes;` in the rendered .res when the controller
folded the option in via DrbdOptions/Net/allow-two-primaries=yes.

Live-migration sequencing (drbdadm primary on dst, secondary on src)
is owned by drbd-reactor + the consumer; documented as such in PLAN.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

Author: kvaps

PLAN.md

@@ -406,7 +406,7 @@ The phases above closed the MVP slice and the csi-sanity REST contract. A deep a
 - [x] **Volume resize** plumbing (2026-05-09): `PUT /v1/resource-definitions/{rd}/volume-definitions/{vn}` already updated the spec; the satellite reconciler now picks up the size delta. Provider interface gained `ResizeVolume` (lvm-thin → `lvextend`, zfs → `zfs set volsize`, file/loopfile → `truncate` + `losetup -c`). On growth the reconciler runs the provider's resize, then `drbdadm resize --assume-clean <rd>` so the kernel re-reads the lower disk. `pkg/luks.Resize` adds the cryptsetup hook for the LUKS layer; satellite-side wiring of LUKS resize lands when the per-resource `encrypted` flag flows through ApplyResources (Phase 6 follow-up). Tests: `TestApplyTriggersResizeOnGrow`, `TestApplyNoResizeOnFreshCreate` for the satellite path; per-provider tests for the resize commands. **End-to-end with a real PVC + checksum verify is still on the e2e harness checklist** (8.8).
 - [ ] **Backing-device failure under DRBD**. When the storage layer drops out, the satellite must detach the failed replica (don't oscillate it diskful↔diskless). Today nothing watches `/proc/drbd` for `disk:Failed`. Add an event hook in `Reconciler` that flips the replica to a Diskless attach via `drbdsetup detach` and surfaces a Status condition. e2e: pull the LV out from under DRBD, observe peer stays Primary, no I/O loss.
 - [x] **DRBD options hierarchy** controller → resource-group → resource-definition → resource (2026-05-09). `pkg/drbd.ResolveOptions` walks the four scopes, lower wins. The resource controller reads ControllerProps via the KVEntry CRD, the parent RG via `client.Get`, the RD via the existing lookup, then folds in the resource's own props. The merged map flows through `dispatcher.ApplyOptions.EffectiveProps`; `buildDesired` splits it: DrbdOptions/* land on the satellite's drbd_options bag (the .res renderer drops them in the right `net`/`disk`/`peer-device`/`handlers` block via `pkg/drbd.SectionFor`), non-DRBD props stay on the wire-side Props map. Tests: resolver unit tests for override / partial inheritance / non-DRBD-prop pass-through; `TestApplyDRBDOptionsFromEffectiveProps` for the dispatcher wiring.
-- [ ] **`allow-two-primaries` + live migration** path. Ganesha-based RWX and KubeVirt VM live-migration both depend on a small window where two nodes are Primary. Today we set `auto-primary` on the lex-lowest replica only; multiple-primary is unsupported. Add the flag plumbing through DesiredResource and the corresponding fence/dual-primary safety on the satellite.
+- [x] **`allow-two-primaries` plumbing** (2026-05-09): the DRBD option-hierarchy now flows arbitrary `DrbdOptions/Net/...` keys (including `allow-two-primaries yes`) through the satellite into the rendered .res file's `net { }` block. Operators set the knob via `linstor c sp DrbdOptions/Net/allow-two-primaries yes` (or RG/RD/Resource scope). The first-activation auto-primary seed still picks one replica deterministically (lowest stable node-id) — that's correct: dual-primary is for the consumer's promotion (Ganesha promoter, KubeVirt live-migration controller), not for initial sync. `splitDRBDOptions` strips the `DrbdOptions/<Section>/` prefix so the .res renderer emits `allow-two-primaries yes;` verbatim. **Live-migration coordination on the controller side** (orchestrating `drbdadm primary` on the destination, then `drbdadm secondary` on the source) lives outside this scope — that's what drbd-reactor + the consumer (KubeVirt VirtualMachineInstanceMigration / Ganesha promoter) own.
 
 ### 8.3 Replica lifecycle
 

pkg/satellite/reconciler.go

@@ -23,6 +23,7 @@ import (
 	"path/filepath"
 	"slices"
 	"strconv"
+	"strings"
 	"sync"
 	"time"
 
@@ -486,11 +487,14 @@ func buildResFile(dr *satellitepb.DesiredResource, localNode, localAddr string,
 		})
 	}
 
+	netOpts, resOpts := splitDRBDOptions(opts)
+
 	out, err := drbd.Build(drbd.Resource{
 		Name:    dr.GetName(),
-		Net:     drbd.Net{ProtocolC: true},
+		Net:     drbd.Net{ProtocolC: true, Options: netOpts},
 		Hosts:   hosts,
 		Volumes: vols,
+		Options: resOpts,
 	})
 	if err != nil {
 		return "", errors.Wrap(err, "drbd.Build")
@@ -499,6 +503,49 @@ func buildResFile(dr *satellitepb.DesiredResource, localNode, localAddr string,
 	return out, nil
 }
 
+// splitDRBDOptions partitions the satellite-received drbd_options bag
+// into per-section maps. Per-replica wiring (port/node-id/peer.*.…)
+// is dropped — those are not user-tunable knobs. Anything under
+// `DrbdOptions/Net/...` lands on the `net { }` block, anything else
+// under `DrbdOptions/...` lands on the resource-level `options { }`
+// block (drbd's catch-all). The ConfFileBuilder writes the keys
+// verbatim with the `DrbdOptions/<Section>/` prefix stripped — that's
+// the form drbdadm expects.
+func splitDRBDOptions(opts map[string]string) (map[string]string, map[string]string) {
+	netOpts := map[string]string{}
+	resOpts := map[string]string{}
+
+	for key, value := range opts {
+		rest, ok := strings.CutPrefix(key, drbd.PropPrefix)
+		if !ok {
+			continue
+		}
+
+		section, rawKey, hasSection := strings.Cut(rest, "/")
+		if !hasSection {
+			resOpts[rest] = value
+
+			continue
+		}
+
+		switch strings.ToLower(section) {
+		case "net":
+			netOpts[rawKey] = value
+		case "disk", "peerdevice", "peer-device", "handlers":
+			// These sections aren't plumbed through Net struct
+			// today; surface them as resource-level options so
+			// drbdadm at least sees them. Full per-section
+			// emission lands when ConfFileBuilder grows the
+			// disk/peer-device blocks.
+			resOpts[rawKey] = value
+		default:
+			resOpts[rawKey] = value
+		}
+	}
+
+	return netOpts, resOpts
+}
+
 // resolveAddr substitutes the satellite's own IP whenever the
 // controller-supplied address is the placeholder "0.0.0.0" (which it
 // is until the controller starts learning each satellite's pod IP and

pkg/satellite/reconciler_drbd_test.go

@@ -266,3 +266,51 @@ func TestApplyNoResizeOnFreshCreate(t *testing.T) {
 		}
 	}
 }
+
+// TestApplyRendersAllowTwoPrimaries verifies the option-hierarchy
+// pipeline lands `allow-two-primaries yes;` in the generated .res
+// file. Required for Ganesha-RWX (NFS export flips Primary on
+// failover) and KubeVirt live-migration (both nodes Primary briefly).
+func TestApplyRendersAllowTwoPrimaries(t *testing.T) {
+	dir := t.TempDir()
+	fx := storage.NewFakeExec()
+	fx.Expect("lvs --noheadings -o lv_name vg/pvc-rwx_00000",
+		storage.FakeResponse{Stdout: []byte("")})
+
+	thin := lvm.NewThin(lvm.ThinConfig{VolumeGroup: "vg", ThinPool: "tp"}, fx)
+	rec := satellite.NewReconciler(satellite.ReconcilerConfig{
+		Providers: map[string]storage.Provider{"thin1": thin},
+		Adm:       drbd.NewAdm(fx),
+		StateDir:  dir,
+		NodeName:  "n1",
+	})
+
+	_, err := rec.Apply(t.Context(), []*satellitepb.DesiredResource{
+		{
+			Name:     "pvc-rwx",
+			NodeName: "n1",
+			Volumes: []*satellitepb.DesiredVolume{
+				{VolumeNumber: 0, SizeKib: 1024 * 1024, StoragePool: "thin1"},
+			},
+			DrbdOptions: map[string]string{
+				"port": "7000", "node-id": "0", "address": "10.0.0.1", "minor": "1000",
+
+				// The controller-side resolver folds this in from
+				// `linstor c sp DrbdOptions/Net/allow-two-primaries yes`.
+				"DrbdOptions/Net/allow-two-primaries": "yes",
+			},
+		},
+	})
+	if err != nil {
+		t.Fatalf("Apply: %v", err)
+	}
+
+	body, err := os.ReadFile(filepath.Join(dir, "pvc-rwx.res"))
+	if err != nil {
+		t.Fatalf("read .res: %v", err)
+	}
+
+	if !strings.Contains(string(body), "allow-two-primaries yes;") {
+		t.Errorf(".res missing allow-two-primaries; body=%s", body)
+	}
+}