fix(satellite): drop section-less DrbdOptions/* from .res render

piraeus-operator stuffs LINSTOR-controller-only knobs (e.g.
DrbdOptions/AutoEvictAllowEviction) under the DrbdOptions/ namespace
via /v1/controller/properties. The satellite was treating any
DrbdOptions/<key> with no section subpath as a resource-level DRBD
option and writing it into the rendered options{} block — which
drbdadm rejects with "Parse error: ... but got 'AutoEvictAllowEvicti...'".
That parse error makes drbdadm fail on EVERY .res in /etc/drbd.d/,
so a single leaky resource takes the whole node down for new RDs.

Convention upstream: real DRBD options live at
DrbdOptions/<Section>/<Key>; section-less DrbdOptions/<Key> is a
LINSTOR-only knob and should not flow to the satellite's .res output.

Test: TestApplyDropsLinstorOnlyOptions pins the regression.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

Author: kvaps

pkg/satellite/reconciler.go

@@ -524,10 +524,18 @@ func buildResFile(dr *satellitepb.DesiredResource, localNode, localAddr string,
 // into per-section maps. Per-replica wiring (port/node-id/peer.*.…)
 // is dropped — those are not user-tunable knobs. Anything under
 // `DrbdOptions/Net/...` lands on the `net { }` block, anything else
-// under `DrbdOptions/...` lands on the resource-level `options { }`
-// block (drbd's catch-all). The ConfFileBuilder writes the keys
-// verbatim with the `DrbdOptions/<Section>/` prefix stripped — that's
-// the form drbdadm expects.
+// under `DrbdOptions/<Section>/...` lands on the resource-level
+// `options { }` block (drbd's catch-all). The ConfFileBuilder writes
+// the keys verbatim with the `DrbdOptions/<Section>/` prefix stripped
+// — that's the form drbdadm expects.
+//
+// Section-less keys (`DrbdOptions/<Key>` with nothing after the
+// prefix beyond a single segment) are LINSTOR-controller-only props
+// — e.g. `DrbdOptions/AutoEvictAllowEviction` is consumed by the
+// LINSTOR controller's auto-eviction logic, NOT by DRBD. Writing
+// those into the .res file makes drbdadm fail with "expected:
+// cpu-mask | on-no-data-accessible | ... but got: <name>". Drop
+// them on the satellite side; the convention upstream is the same.
 func splitDRBDOptions(opts map[string]string) (map[string]string, map[string]string) {
 	netOpts := map[string]string{}
 	resOpts := map[string]string{}
@@ -540,8 +548,8 @@ func splitDRBDOptions(opts map[string]string) (map[string]string, map[string]str
 
 		section, rawKey, hasSection := strings.Cut(rest, "/")
 		if !hasSection {
-			resOpts[rest] = value
-
+			// LINSTOR-only key (no DRBD section subpath); these
+			// don't belong in the rendered .res. See doc comment.
 			continue
 		}
 

pkg/satellite/reconciler_drbd_test.go

@@ -314,3 +314,71 @@ func TestApplyRendersAllowTwoPrimaries(t *testing.T) {
 		t.Errorf(".res missing allow-two-primaries; body=%s", body)
 	}
 }
+
+// TestApplyDropsLinstorOnlyOptions: section-less DrbdOptions/* keys
+// (e.g. DrbdOptions/AutoEvictAllowEviction set by piraeus-operator
+// via /v1/controller/properties) must NOT land in the rendered .res
+// — they're LINSTOR-controller-only knobs and drbdadm rejects the
+// whole file with "Parse error: ... but got 'AutoEvictAllowEviction'"
+// on the next `drbdadm primary`. Regression for stand-side smoke
+// failure observed 2026-05-09.
+func TestApplyDropsLinstorOnlyOptions(t *testing.T) {
+	dir := t.TempDir()
+	fx := storage.NewFakeExec()
+	fx.Expect("lvs --noheadings -o lv_name vg/pvc-noeviction_00000",
+		storage.FakeResponse{Stdout: []byte("")})
+
+	thin := lvm.NewThin(lvm.ThinConfig{VolumeGroup: "vg", ThinPool: "tp"}, fx)
+	rec := satellite.NewReconciler(satellite.ReconcilerConfig{
+		Providers: map[string]storage.Provider{"thin1": thin},
+		Adm:       drbd.NewAdm(fx),
+		StateDir:  dir,
+		NodeName:  "n1",
+	})
+
+	_, err := rec.Apply(t.Context(), []*satellitepb.DesiredResource{
+		{
+			Name:     "pvc-noeviction",
+			NodeName: "n1",
+			Volumes: []*satellitepb.DesiredVolume{
+				{VolumeNumber: 0, SizeKib: 1024 * 1024, StoragePool: "thin1"},
+			},
+			DrbdOptions: map[string]string{
+				"port": "7000", "node-id": "0", "address": "10.0.0.1", "minor": "1000",
+
+				// Section-less: must be dropped
+				"DrbdOptions/AutoEvictAllowEviction": "false",
+				// Section-less: must be dropped
+				"DrbdOptions/AutoplaceTarget": "3",
+				// Real DRBD option: must land in net{} block
+				"DrbdOptions/Net/rr-conflict": "retry-connect",
+				// Real DRBD option: must land in options{} block
+				"DrbdOptions/Resource/on-no-quorum": "suspend-io",
+			},
+		},
+	})
+	if err != nil {
+		t.Fatalf("Apply: %v", err)
+	}
+
+	body, err := os.ReadFile(filepath.Join(dir, "pvc-noeviction.res"))
+	if err != nil {
+		t.Fatalf("read .res: %v", err)
+	}
+
+	if strings.Contains(string(body), "AutoEvictAllowEviction") {
+		t.Errorf("LINSTOR-only key leaked into .res; body=%s", body)
+	}
+
+	if strings.Contains(string(body), "AutoplaceTarget") {
+		t.Errorf("LINSTOR-only key (AutoplaceTarget) leaked into .res; body=%s", body)
+	}
+
+	if !strings.Contains(string(body), "rr-conflict retry-connect;") {
+		t.Errorf("real DRBD net option missing; body=%s", body)
+	}
+
+	if !strings.Contains(string(body), "on-no-quorum suspend-io;") {
+		t.Errorf("real DRBD resource option missing; body=%s", body)
+	}
+}