feat(layer-stack): plumb LayerStack RD→dispatcher→satellite (Phase 9)

Foundation for Phase 9 — single-replica local mode (no DRBD) and
LUKS layering. This commit lands the data path:

  RD CRD    → ResourceDefinition.Spec.LayerStack (default empty)
  REST      → ResourceDefinition.LayerStack on the wire shape
  store/k8s → CRD ↔ wire converter passes LayerStack through
  proto     → DesiredResource.layer_stack on the gRPC dispatch
  dispatcher → reads RD.Spec.LayerStack on every Apply
  satellite → applyOne skips applyDRBD when layer_stack omits "DRBD"

Empty layer_stack defaults to ["DRBD","STORAGE"] so legacy
clients (and the Phase-1..8 wire) keep getting full DRBD treatment
unchanged. An RD with explicit `layerStack: ["STORAGE"]` provisions
just the storage volume — no .res render, no drbdadm.

LUKS layering (next slice) will hook in by inserting cryptsetup
open/close between applyStorage and applyDRBD when "LUKS" is in the
stack.

Tests:
- pkg/api/v1/layer_stack_test.go pins ResolveLayerStack RD→RG→default
- pkg/satellite/reconciler_drbd_test.go TestApplySkipsDRBDWhenLayerStackOmits
  confirms a [STORAGE]-only Resource produces no .res and no drbdadm

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

Author: kvaps

api/v1alpha1/resourcedefinition_types.go

@@ -45,6 +45,19 @@ type ResourceDefinitionSpec struct {
 	// volumeDefinitions are the volume slots inside this RD.
 	// +optional
 	VolumeDefinitions []ResourceDefinitionVolume `json:"volumeDefinitions,omitempty"`
+
+	// layerStack is the LINSTOR layer composition for this RD's
+	// satellite-side render — `["DRBD","STORAGE"]` (default) renders a
+	// .res file and runs drbdadm; `["LUKS","STORAGE"]` layers
+	// cryptsetup over the storage device with no DRBD; `["STORAGE"]`
+	// is single-replica local mode (no replication, no encryption).
+	// Order is top-down: the first layer's device is what the
+	// consumer Pod mounts, the last is the raw block device the
+	// storage provider creates.
+	// Empty = inherits from the parent ResourceGroup; both empty =
+	// `["DRBD","STORAGE"]`.
+	// +optional
+	LayerStack []string `json:"layerStack,omitempty"`
 }
 
 // ResourceDefinitionVolume is one volume slot inside an RD.

api/v1alpha1/zz_generated.deepcopy.go

@@ -51,6 +51,21 @@ spec:
                 items:
                   type: string
                 type: array
+              layerStack:
+                description: |-
+                  layerStack is the LINSTOR layer composition for this RD's
+                  satellite-side render — `["DRBD","STORAGE"]` (default) renders a
+                  .res file and runs drbdadm; `["LUKS","STORAGE"]` layers
+                  cryptsetup over the storage device with no DRBD; `["STORAGE"]`
+                  is single-replica local mode (no replication, no encryption).
+                  Order is top-down: the first layer's device is what the
+                  consumer Pod mounts, the last is the raw block device the
+                  storage provider creates.
+                  Empty = inherits from the parent ResourceGroup; both empty =
+                  `["DRBD","STORAGE"]`.
+                items:
+                  type: string
+                type: array
               props:
                 additionalProperties:
                   type: string

config/crd/bases/blockstor.io.blockstor.io_resourcedefinitions.yaml

@@ -0,0 +1,51 @@
+/*
+Copyright 2026 Cozystack contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import "strings"
+
+// ResolveLayerStack picks the layer composition for an RD by walking
+// the upstream LINSTOR scope hierarchy: RD → RG → default. The first
+// non-empty entry wins. Same precedence rule as
+// ResourceGroup.SelectFilter inheritance.
+//
+// Empty arrays at every level fall through to DefaultLayerStack
+// (`["DRBD","STORAGE"]`).
+func ResolveLayerStack(rdLayers, rgLayers []string) []string {
+	if len(rdLayers) > 0 {
+		return rdLayers
+	}
+
+	if len(rgLayers) > 0 {
+		return rgLayers
+	}
+
+	return DefaultLayerStack()
+}
+
+// LayerInStack reports whether kind is present in stack
+// (case-insensitive). Used by the dispatcher / satellite to decide
+// whether to render a `.res` or just provision the storage layer.
+func LayerInStack(stack []string, kind string) bool {
+	for _, s := range stack {
+		if strings.EqualFold(s, kind) {
+			return true
+		}
+	}
+
+	return false
+}

pkg/api/v1/layer_stack.go

@@ -0,0 +1,92 @@
+/*
+Copyright 2026 Cozystack contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1_test
+
+import (
+	"slices"
+	"testing"
+
+	apiv1 "github.com/cozystack/blockstor/pkg/api/v1"
+)
+
+// TestResolveLayerStack: RD wins over RG; both empty → default.
+func TestResolveLayerStack(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		name string
+		rd   []string
+		rg   []string
+		want []string
+	}{
+		{
+			name: "RD set, RG ignored",
+			rd:   []string{"LUKS", "STORAGE"},
+			rg:   []string{"DRBD", "STORAGE"},
+			want: []string{"LUKS", "STORAGE"},
+		},
+		{
+			name: "RD empty, RG wins",
+			rg:   []string{"DRBD", "LUKS", "STORAGE"},
+			want: []string{"DRBD", "LUKS", "STORAGE"},
+		},
+		{
+			name: "both empty → default",
+			want: []string{"DRBD", "STORAGE"},
+		},
+		{
+			name: "RD empty slice → default",
+			rd:   []string{},
+			rg:   []string{},
+			want: []string{"DRBD", "STORAGE"},
+		},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			t.Parallel()
+
+			got := apiv1.ResolveLayerStack(c.rd, c.rg)
+			if !slices.Equal(got, c.want) {
+				t.Errorf("got %v, want %v", got, c.want)
+			}
+		})
+	}
+}
+
+// TestLayerInStack: case-insensitive presence check.
+func TestLayerInStack(t *testing.T) {
+	t.Parallel()
+
+	stack := []string{"DRBD", "STORAGE"}
+
+	if !apiv1.LayerInStack(stack, "DRBD") {
+		t.Errorf("DRBD should be in %v", stack)
+	}
+
+	if !apiv1.LayerInStack(stack, "drbd") {
+		t.Errorf("case-insensitive match for drbd should hit DRBD")
+	}
+
+	if apiv1.LayerInStack(stack, "LUKS") {
+		t.Errorf("LUKS not in %v", stack)
+	}
+
+	if apiv1.LayerInStack(nil, "DRBD") {
+		t.Errorf("empty stack should not match anything")
+	}
+}

pkg/api/v1/layer_stack_test.go

@@ -25,7 +25,24 @@ type ResourceDefinition struct {
 	Props             map[string]string `json:"props,omitempty"`
 	Flags             []string          `json:"flags,omitempty"`
 	LayerData         []ResourceLayer   `json:"layer_data,omitempty"`
-	UUID              string            `json:"uuid,omitempty"`
+	// LayerStack is the layer composition (e.g. ["DRBD","STORAGE"]).
+	// Wire field name matches upstream LINSTOR (`resource_definition.layer_stack`).
+	LayerStack []string `json:"layer_stack,omitempty"`
+	UUID       string   `json:"uuid,omitempty"`
+}
+
+// Layer kind constants — the strings LINSTOR uses on the wire.
+const (
+	LayerKindDRBD    = "DRBD"
+	LayerKindLUKS    = "LUKS"
+	LayerKindStorage = "STORAGE"
+)
+
+// DefaultLayerStack returns the layer stack used when the RD spec
+// (and its parent RG) leave it empty. Matches upstream LINSTOR's
+// default — full DRBD-over-STORAGE replication.
+func DefaultLayerStack() []string {
+	return []string{LayerKindDRBD, LayerKindStorage}
 }
 
 // ResourceLayer is the per-layer descriptor on a ResourceDefinition. We

pkg/api/v1/resource_definition.go

@@ -25,7 +25,6 @@ import (
 	"crypto/sha256"
 	"encoding/binary"
 	"slices"
-	"sort"
 	"strconv"
 	"strings"
 
@@ -157,8 +156,6 @@ func lookupEndpoint(nodeName string, nodes []blockstoriov1alpha1.Node) string {
 // `peer.<name>.address` carries a real (pod) IP rather than a 0.0.0.0
 // placeholder; drbd-9 won't replicate to 0.0.0.0.
 func buildDesired(target *blockstoriov1alpha1.Resource, peers []blockstoriov1alpha1.Resource, nodes []blockstoriov1alpha1.Node, rd *blockstoriov1alpha1.ResourceDefinition, effectiveProps map[string]string) *satellitepb.DesiredResource {
-	rdName := target.Spec.ResourceDefinitionName
-
 	// node-id and port/minor are persisted on Status by the controller
 	// before Apply runs. Falling back to derive*() is a transitional
 	// safety net for the case where the allocator hasn't run yet — it
@@ -188,20 +185,15 @@ func buildDesired(target *blockstoriov1alpha1.Resource, peers []blockstoriov1alp
 		}
 	}
 
-	// Stable iteration: sort peer names so the satellite-side .res
-	// renderer sees a deterministic order. node-id itself is stable
-	// regardless of iteration order because it's persisted.
 	dropped := make([]string, 0, len(idOf))
 
 	for name := range idOf {
-		if name == target.Spec.NodeName {
-			continue
+		if name != target.Spec.NodeName {
+			dropped = append(dropped, name)
 		}
-
-		dropped = append(dropped, name)
 	}
 
-	sort.Strings(dropped)
+	slices.Sort(dropped)
 
 	drbdOpts := map[string]string{
 		"port":    strconv.Itoa(port),
@@ -224,16 +216,30 @@ func buildDesired(target *blockstoriov1alpha1.Resource, peers []blockstoriov1alp
 
 	addPeerEntries(drbdOpts, dropped, peers, nodes, port, idOf)
 
+	return assembleDesired(target, peers, rd, dropped, drbdOpts, effectiveProps)
+}
+
+// assembleDesired packages the per-replica wire payload. Pulled out
+// of buildDesired so the caller stays under the funlen budget.
+func assembleDesired(target *blockstoriov1alpha1.Resource, peers []blockstoriov1alpha1.Resource, rd *blockstoriov1alpha1.ResourceDefinition, dropped []string, drbdOpts, effectiveProps map[string]string) *satellitepb.DesiredResource {
+	_ = peers // peers info already folded into drbdOpts via addPeerEntries
+
 	wireProps := mergeEffectiveProps(target.Spec.Props, effectiveProps, drbdOpts)
 
+	var layerStack []string
+	if rd != nil {
+		layerStack = rd.Spec.LayerStack
+	}
+
 	return &satellitepb.DesiredResource{
-		Name:        rdName,
+		Name:        target.Spec.ResourceDefinitionName,
 		NodeName:    target.Spec.NodeName,
 		Flags:       target.Spec.Flags,
 		Props:       wireProps,
 		Peers:       dropped,
 		Volumes:     buildVolumes(rd, target),
 		DrbdOptions: drbdOpts,
+		LayerStack:  layerStack,
 	}
 }