feat(controller): gate auto-tiebreaker on DrbdOptions/AutoAddQuorumTiebreaker

Mirrors upstream LINSTOR's CtrlRscAutoTieBreakerHelper: the
auto-witness logic only runs when DrbdOptions/AutoAddQuorumTiebreaker
is non-false. Default is "true" (matches cozystack / piraeus-operator
behaviour where ControllerProps seeds it on cluster bootstrap), so
this is a transparent change for the common case.

Operators who place a manual DISKLESS replica disable the auto path
with `DrbdOptions/AutoAddQuorumTiebreaker: "false"` on the RD spec —
otherwise the RD reconciler races to drop a TIE_BREAKER witness on
the same target node and the explicit kubectl apply conflicts with
the auto-created witness.

`tests/e2e/auto-diskful.sh` flips the prop off to avoid this race.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

Author: kvaps

internal/controller/resourcedefinition_controller.go

@@ -124,7 +124,14 @@ func (r *ResourceDefinitionReconciler) ensureTiebreaker(ctx context.Context, rd
 	nonWitnessDiskless := len(diskless) - len(witness)
 
 	// Tiebreaker decision (mirrors shouldTieBreakerExist).
-	wantWitness := len(diskful) >= 2 && len(diskful)%2 == 0 && nonWitnessDiskless == 0
+	// Gate on DrbdOptions/AutoAddQuorumTiebreaker — upstream LINSTOR
+	// only runs the auto-witness logic when the prop is "true". On
+	// cozystack / piraeus-operator clusters this prop is set
+	// cluster-wide via ControllerProps; vanilla blockstor leaves it
+	// off so explicit DISKLESS replicas don't race with the auto
+	// reconciler.
+	wantWitness := isAutoTieBreakerEnabled(rd) &&
+		len(diskful) >= 2 && len(diskful)%2 == 0 && nonWitnessDiskless == 0
 
 	disklessAfter, err := r.applyWitnessDecision(ctx, rd, replicas, diskless, witness, wantWitness)
 	if err != nil {
@@ -134,6 +141,34 @@ func (r *ResourceDefinitionReconciler) ensureTiebreaker(ctx context.Context, rd
 	return r.setQuorum(ctx, rd, quorumPolicy(len(diskful), len(disklessAfter)))
 }
 
+// isAutoTieBreakerEnabled gates witness auto-creation on the RD's
+// `DrbdOptions/AutoAddQuorumTiebreaker` prop. Default is enabled
+// (matches the effective cozystack / piraeus-operator behaviour
+// where ControllerProps seeds it true) — operators who explicitly
+// place a manual DISKLESS replica disable the auto path with
+// `DrbdOptions/AutoAddQuorumTiebreaker: "false"` on the RD spec.
+//
+// We only check the RD prop bag here; the resolver (controller →
+// RG → RD → Resource hierarchy) doesn't run on the RD reconciler
+// path because that path doesn't dispatch to the satellite. A
+// cluster-wide ControllerProps default still propagates because
+// the REST POST /v1/resource-definitions handler folds parent-RG
+// + ControllerProps into the RD on create.
+func isAutoTieBreakerEnabled(rd *blockstoriov1alpha1.ResourceDefinition) bool {
+	const propKey = "DrbdOptions/AutoAddQuorumTiebreaker"
+
+	if rd.Spec.Props == nil {
+		return true
+	}
+
+	value, ok := rd.Spec.Props[propKey]
+	if !ok {
+		return true
+	}
+
+	return !strings.EqualFold(value, "false")
+}
+
 // applyWitnessDecision creates or removes the witness and returns
 // the diskless slice as it should look after the decision (so the
 // caller's quorum computation reflects the post-write state).

tests/e2e/auto-diskful.sh

@@ -31,11 +31,17 @@ N3=test-worker-3
 trap 'delete_rd "$RD"' EXIT
 
 echo ">> apply 2 diskful + 1 DISKLESS"
+# Disable the auto-tiebreaker — this test explicitly creates its
+# own DISKLESS replica on N3, and we don't want the RD reconciler
+# racing to create a TIE_BREAKER witness on N3 first (which would
+# then conflict with our explicit apply, ALSO landing on N3).
 cat <<EOF | kubectl apply -f -
 apiVersion: blockstor.io.blockstor.io/v1alpha1
 kind: ResourceDefinition
 metadata: {name: ${RD}}
 spec:
+  props:
+    DrbdOptions/AutoAddQuorumTiebreaker: "false"
   volumeDefinitions:
     - {volumeNumber: 0, sizeKib: 65536}
 EOF