refactor(kv): replace ConfigMap-per-instance with KVEntry CRD per (instance, key)

The old implementation stored every key under one corev1.ConfigMap per
LINSTOR instance. ConfigMap.data is etcd-validated to <=1 MiB, which is a
silent scaling cliff: 5–10k entries (entirely realistic on prod cozystack
clusters where linstor-csi pushes per-PVC bookkeeping into the
"csi-volumes" instance) starts rejecting writes with "request is too
large".

This slice replaces that with a per-(instance, key) `KVEntry` CRD:

- api/v1alpha1/kventry_types.go: cluster-scoped CRD with spec.instance,
  spec.key, spec.value (all free-form). status reserved.
- pkg/store/k8s/kv_store.go: rewritten against the CRD.
  - metadata.name = "kv-" + sha256(instance + "\0" + key)[:16] (opaque,
    deterministic, k8s-safe).
  - Label blockstor.io/kv-instance-hash = sha256(instance)[:8] indexes
    server-side; the in-memory loop after re-checks Spec.Instance to
    defend against the once-in-2^64 hash collision.
  - SetKeys upserts per key (Get → Update or Create), so two writers on
    the same key get a clean conflict the caller can retry. No more
    monolithic ConfigMap rewrites.
  - DeleteNamespace iterates the instance's entries and drops anything
    matching ns or ns/* — same semantics as before, no '/' encoding now
    that keys live in spec, not in ConfigMap.data.
  - The old keyEncodeMarker hack ("__slash__") is gone; LINSTOR keys
    round-trip verbatim.
- pkg/store/k8s/k8s_test.go: wipeAllKV switches to DeleteAllOf KVEntry.
- The store.KeyValueStore interface and the REST contract
  (/v1/key-value-store/{instance}) are unchanged — golinstor and
  linstor-csi see the same wire shape.

Shared storetest/RunKeyValueStore (6 cases incl. delete-namespace path)
runs unchanged against both InMemory and the new CRD-backed store; both
green. The DeleteNamespace test that originally forced the encoding hack
now passes because it never crosses ConfigMap key validation in the first
place.

Per-key writes are also a fix to a less obvious bug: a future writer
adding one key no longer races a concurrent writer adding another key
(they used to collide on ConfigMap ResourceVersion); now they hit
distinct CRDs.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

Author: kvaps

PROJECT

@@ -57,4 +57,11 @@ resources:
   kind: Snapshot
   path: github.com/cozystack/blockstor/api/v1alpha1
   version: v1alpha1
+- api:
+    crdVersion: v1
+  domain: blockstor.io
+  group: blockstor.io
+  kind: KVEntry
+  path: github.com/cozystack/blockstor/api/v1alpha1
+  version: v1alpha1
 version: "3"

api/v1alpha1/kventry_types.go

@@ -0,0 +1,88 @@
+/*
+Copyright 2026 Cozystack contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// KVEntrySpec is one entry in the LINSTOR-style key/value store.
+//
+// Upstream LINSTOR groups entries by an "instance" (e.g. "csi-volumes")
+// and addresses them by a free-form key (e.g. "Aux/csi-volume-annotations").
+// We store one CRD per (instance, key) pair so neither half of the key
+// runs into k8s naming restrictions, and so the per-write blast radius is
+// a single object instead of an entire ConfigMap.
+type KVEntrySpec struct {
+	// instance is the LINSTOR KV instance name. Free-form string.
+	// +required
+	Instance string `json:"instance"`
+
+	// key is the free-form key inside the instance. May contain '/', '.',
+	// uppercase, etc. — anything golinstor sends.
+	// +required
+	Key string `json:"key"`
+
+	// value is the opaque payload.
+	// +optional
+	Value string `json:"value,omitempty"`
+}
+
+// KVEntryStatus is currently empty: KVEntries are pure config and have no
+// observed state.
+type KVEntryStatus struct {
+	// conditions represent the current state of the KVEntry. Reserved for
+	// future use; populated by reconcilers if any are introduced.
+	// +listType=map
+	// +listMapKey=type
+	// +optional
+	Conditions []metav1.Condition `json:"conditions,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+// +kubebuilder:subresource:status
+// +kubebuilder:resource:scope=Cluster
+
+// KVEntry is the Schema for the kventries API
+type KVEntry struct {
+	metav1.TypeMeta `json:",inline"`
+
+	// metadata is a standard object metadata
+	// +optional
+	metav1.ObjectMeta `json:"metadata,omitzero"`
+
+	// spec defines the desired state of KVEntry
+	// +required
+	Spec KVEntrySpec `json:"spec"`
+
+	// status defines the observed state of KVEntry
+	// +optional
+	Status KVEntryStatus `json:"status,omitzero"`
+}
+
+// +kubebuilder:object:root=true
+
+// KVEntryList contains a list of KVEntry
+type KVEntryList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitzero"`
+	Items           []KVEntry `json:"items"`
+}
+
+func init() {
+	SchemeBuilder.Register(&KVEntry{}, &KVEntryList{})
+}

api/v1alpha1/zz_generated.deepcopy.go

@@ -0,0 +1,129 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.20.1
+  name: kventries.blockstor.io.blockstor.io
+spec:
+  group: blockstor.io.blockstor.io
+  names:
+    kind: KVEntry
+    listKind: KVEntryList
+    plural: kventries
+    singular: kventry
+  scope: Cluster
+  versions:
+  - name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: KVEntry is the Schema for the kventries API
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: spec defines the desired state of KVEntry
+            properties:
+              instance:
+                description: instance is the LINSTOR KV instance name. Free-form string.
+                type: string
+              key:
+                description: |-
+                  key is the free-form key inside the instance. May contain '/', '.',
+                  uppercase, etc. — anything golinstor sends.
+                type: string
+              value:
+                description: value is the opaque payload.
+                type: string
+            required:
+            - instance
+            - key
+            type: object
+          status:
+            description: status defines the observed state of KVEntry
+            properties:
+              conditions:
+                description: |-
+                  conditions represent the current state of the KVEntry. Reserved for
+                  future use; populated by reconcilers if any are introduced.
+                items:
+                  description: Condition contains details for one aspect of the current
+                    state of this API Resource.
+                  properties:
+                    lastTransitionTime:
+                      description: |-
+                        lastTransitionTime is the last time the condition transitioned from one status to another.
+                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                      format: date-time
+                      type: string
+                    message:
+                      description: |-
+                        message is a human readable message indicating details about the transition.
+                        This may be an empty string.
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      description: |-
+                        observedGeneration represents the .metadata.generation that the condition was set based upon.
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                        with respect to the current state of the instance.
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      description: |-
+                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                        Producers of specific condition types may define expected values and meanings for this field,
+                        and whether the values are considered a guaranteed API.
+                        The value should be a CamelCase string.
+                        This field may not be empty.
+                      maxLength: 1024
+                      minLength: 1
+                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                      type: string
+                    status:
+                      description: status of the condition, one of True, False, Unknown.
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                      maxLength: 316
+                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - message
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}

config/crd/bases/blockstor.io.blockstor.io_kventries.yaml

@@ -8,6 +8,7 @@ resources:
 - bases/blockstor.io.blockstor.io_resourcedefinitions.yaml
 - bases/blockstor.io.blockstor.io_resources.yaml
 - bases/blockstor.io.blockstor.io_snapshots.yaml
+- bases/blockstor.io.blockstor.io_kventries.yaml
 # +kubebuilder:scaffold:crdkustomizeresource
 
 patches:

config/crd/kustomization.yaml

@@ -22,6 +22,9 @@ resources:
 # default, aiding admins in cluster management. Those roles are
 # not used by the blockstor itself. You can comment the following lines
 # if you do not want those helpers be installed with your Project.
+- kventry_admin_role.yaml
+- kventry_editor_role.yaml
+- kventry_viewer_role.yaml
 - snapshot_admin_role.yaml
 - snapshot_editor_role.yaml
 - snapshot_viewer_role.yaml

config/rbac/kustomization.yaml

@@ -0,0 +1,27 @@
+# This rule is not used by the project blockstor itself.
+# It is provided to allow the cluster admin to help manage permissions for users.
+#
+# Grants full permissions ('*') over blockstor.io.blockstor.io.
+# This role is intended for users authorized to modify roles and bindings within the cluster,
+# enabling them to delegate specific permissions to other users or groups as needed.
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/name: blockstor
+    app.kubernetes.io/managed-by: kustomize
+  name: kventry-admin-role
+rules:
+- apiGroups:
+  - blockstor.io.blockstor.io
+  resources:
+  - kventries
+  verbs:
+  - '*'
+- apiGroups:
+  - blockstor.io.blockstor.io
+  resources:
+  - kventries/status
+  verbs:
+  - get