feat: autoplacer + Resource POST/DELETE; sync PLAN.md checklist

This closes the last definition-side gap in the CSI MVP slice. With this
slice, linstor-csi's CreateVolume flow round-trips end-to-end at the REST
layer:
  1. POST /v1/resource-groups/{rg}/spawn → RD + VDs (existing)
  2. POST /v1/resource-definitions/{rd}/autoplace → place_count Resources
  3. … (Phase 3: satellite reconciles those Resources)

The Phase 2.5 autoplacer:
- Merges request select_filter on top of the parent RG's stored filter,
  request fields winning. Empty request inherits everything.
- Filters StoragePool list by kind (skips DISKLESS), name, list, and
  node-name list.
- Skips nodes that already host a replica of this RD; creates Resources
  up to PlaceCount; returns 409 if there aren't enough candidates.
- Phase 3's autoplacer will weigh free capacity, traits, anti-affinity;
  this stub is good enough to drive linstor-csi against the in-cluster
  oracle today.

Also adds explicit single-resource placement:
- POST /v1/resource-definitions/{rd}/resources (linstor-csi diskless toggles)
- DELETE /v1/resource-definitions/{rd}/resources/{node}

Tests (5 contract):
- pick-requested-count, conflict-when-insufficient, missing-RD→404,
  inherits-RG-filter, resource-create-then-delete round-trip.

PLAN.md: tick the boxes that were already done but I had not synced —
Phase 1 closed (apiconsts via golinstor, linstor-common submodule),
Phase 2 definition side closed; Phase 2.5 autoplacer/resource POST done;
reconcilers + Phase 3 satellite still ⬜.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

Author: kvaps

PLAN.md

@@ -15,26 +15,39 @@ high-bandwidth check-ins with the user.
 
 ## Current status
 
-- **Phase**: 2 well underway. CRD-backed store live, four resource families wired end-to-end.
-- **Implemented (REST + Store + tests, all both InMemory and CRD/envtest backends, golinstor compatibility verified)**:
-  - `/v1/controller/version`, `/v1/healthz`
-  - `/v1/nodes` — full CRUD
-  - `/v1/view/storage-pools`, `/v1/nodes/{node}/storage-pools[/{pool}]` — read
-  - `/v1/resource-groups` — full CRUD
-  - `/v1/resource-definitions` — full CRUD (POST unwraps the upstream `{resource_definition: {...}}` envelope)
-  - `/v1/view/resources` — read
-- **CRDs (kubebuilder-scaffolded, NodeSpec/StatuS filled with LINSTOR-shaped fields)**:
-  - `Node`, `StoragePool`, `ResourceGroup`, `ResourceDefinition`, `Resource` (composite-keyed via `<a>.<b>` metadata.name + label index)
-- **Stores**: `pkg/store` (InMemory) and `pkg/store/k8s` (controller-runtime client), both behind the same `store.Store` interface and exercised by the same `pkg/store/storetest` shared suite — behavioural drift fails the same subtest immediately.
-- **Tests**: 150+ unit + contract; controller-runtime envtest harness skips cleanly when `KUBEBUILDER_ASSETS` is missing, so plain `go test ./...` is green without `make setup-envtest`.
-- **Lint**: `golangci-lint run ./...` zero issues. Auto-lint hook (`golangci-lint@claude-code-companions`) catches every Go-file edit.
+- **Phase**: 2 — definition side done, reconcilers + autoplacer next.
+- **CRDs (6, kubebuilder-scaffolded, LINSTOR-shaped fields)**:
+  `Node`, `StoragePool`, `ResourceGroup`, `ResourceDefinition`, `Resource`,
+  `Snapshot`. VolumeDefinitions live inline on `ResourceDefinition.Spec`.
+- **Stores**: `pkg/store` (InMemory) and `pkg/store/k8s` (controller-runtime
+  client), both behind the same `store.Store` interface and exercised by the
+  same `pkg/store/storetest` shared suite — behavioural drift fails the same
+  subtest immediately. KeyValueStore is ConfigMap-backed (with `/` → `__slash__`
+  key encoding because ConfigMap data keys can't contain '/').
+- **Endpoints live (~25 of the CSI MVP slice)**:
+  `/v1/controller/version`, `/v1/healthz`, `/v1/nodes`,
+  `/v1/view/storage-pools`, `/v1/nodes/{n}/storage-pools[/{p}]`,
+  `/v1/resource-groups`, `/v1/resource-groups/{rg}/spawn`,
+  `/v1/resource-definitions`, `/v1/resource-definitions/{rd}/volume-definitions`,
+  `/v1/resource-definitions/{rd}/snapshots`, `/v1/view/resources`,
+  `/v1/view/snapshots`, `/v1/key-value-store`.
+- **Tests**: 200+ unit + contract; envtest harness skips cleanly when
+  `KUBEBUILDER_ASSETS` is missing.
+- **Lint**: `golangci-lint run ./...` zero issues. Auto-lint hook on every
+  Go-file edit.
 - **Blocker**: none.
-- **Next concrete steps**:
-  1. `/v1/resource-definitions/{rd}/volume-definitions` (CRUD) — needed before linstor-csi can size a PVC.
-  2. `/v1/resource-groups/{rg}/spawn` — the CSI provisioner calls this on every `CreateVolume`. Needs an `Autoplacer` stub: read RG select-filter, pick `place_count` storage pools, create matching `Resource`s.
-  3. `/v1/key-value-store` — linstor-csi keeps its own per-volume bookkeeping here.
-  4. `/v1/resource-definitions/{rd}/snapshots` + `/v1/view/snapshots` — Snapshot CRD; mostly mirrors Resource shape.
-  5. Reconcilers (no-op for now → satellite-driven in Phase 3) for `Node`, `StoragePool`, `Resource`. Wire `mgr.Add` for them in `cmd/main.go`.
+- **Next concrete steps** (Phase 2.5):
+  1. `POST /v1/resource-definitions/{rd}/autoplace` — autoplacer that reads
+     the parent RG's `select_filter`, finds matching nodes/storage-pools, and
+     creates `Resource` objects up to `place_count`.
+  2. `POST/DELETE /v1/resource-definitions/{rd}/resources[/{node}]` — explicit
+     resource placement (linstor-csi uses this for diskless toggles).
+  3. Reconcilers (no-op for Phase 2.5; Phase 3 fills them) for `Node`,
+     `StoragePool`, `ResourceDefinition`, `Resource`, `Snapshot`. Wire them
+     in `cmd/main.go`.
+  4. Phase 3 begin: gRPC contract between controller and `cmd/satellite`
+     binary; satellite's first job is `Resource` reconciliation (DRBD .res
+     generation + drbdadm + LVM/ZFS provisioning).
 
 ---
 
@@ -156,30 +169,49 @@ Full scope list lives in `docs/csi-api-surface.md` (to be created in Phase 1).
 
 **Exit met**: full happy-path PVC test passes against upstream Java stack, on parallelizable stand.
 
-### Phase 1 — Skeleton + contracts
+### Phase 1 — Skeleton + contracts (done)
 
 - [x] New module via `kubebuilder init`; controller-runtime manager + `pkg/rest` Runnable
 - [x] `/v1/controller/version` returns a credible response (`pkg/version` constants pin LINSTOR contract version)
 - [x] `golinstor.Client.Controller.GetVersion()` against our server returns no error (`pkg/rest/server_test.go`)
 - [x] Full-branch tests for the version endpoint and the Runnable lifecycle (8 cases)
 - [x] CSI MVP scope frozen in `docs/csi-api-surface.md`
 - [x] golangci-lint v2 config + auto-lint hook (`golangci-lint@claude-code-companions`) wired
-- [ ] OpenAPI types generated from `linstor-server/docs/rest_v1_openapi.yaml` (oapi-codegen)
-- [ ] `apiconsts` ported from golinstor (ApiCallRc codes for error responses)
-- [ ] `linstor-common` submodule (properties.json, consts.json, drbdoptions.json)
-
-**Exit**: golinstor can talk to us for `GetVersion`; tests in CI green. **Met.**
-Remaining items above land at the start of Phase 2 (codegen wiring is most
-useful once we have many types to generate, which Phase 2 introduces).
-
-### Phase 2 — CRDs + reconcile
-
-- [ ] CRDs: `Node`, `StoragePool`, `ResourceGroup`, `ResourceDefinition`, `Resource`, `Volume`, `Snapshot`
-- [ ] controller-runtime manager, reconcilers stubbed
-- [ ] `Nodes.{GetAll,Get,Create,Modify,Delete}` work end-to-end against CRDs
-- [ ] linstor-csi container can register a node against our server
-
-**Exit**: piraeus-operator can create `LinstorSatellite`s and they appear as nodes in our API.
+- [x] `linstor-common` submodule (properties.json, consts.json, drbdoptions.json)
+- [x] `apiconsts` reused from `github.com/LINBIT/golinstor` — no fork needed
+- [ ] OpenAPI types generated from `rest_v1_openapi.yaml` (oapi-codegen) — deferred; types are
+      hand-written for now, codegen lands when we cover stats/error-reports endpoints
+
+**Exit met.**
+
+### Phase 2 — CRDs + reconcile (REST/store side done; reconcilers pending)
+
+- [x] CRDs: `Node`, `StoragePool`, `ResourceGroup`, `ResourceDefinition`, `Resource`, `Snapshot` (VolumeDefinition is inline in RD spec)
+- [x] controller-runtime manager wired in `cmd/main.go`; reconciler stubs scaffolded by kubebuilder
+- [x] `Nodes.{GetAll,Get,Create,Modify,Delete}` work end-to-end against CRDs
+- [x] `Store` interface with `InMemory` and `k8s` (CRD-backed) implementations, both exercised by the same `pkg/store/storetest` shared suite
+- [x] `cmd/main.go --store={k8s|memory}` flag (default `k8s`)
+- [x] envtest harness (`make setup-envtest`); `go test ./...` skips cleanly without assets
+- [x] All write/read paths the CSI MVP needs land via `golinstor`:
+      - `/v1/nodes` (CRUD)
+      - `/v1/view/storage-pools`, `/v1/nodes/{n}/storage-pools[/{p}]`
+      - `/v1/resource-groups` (CRUD), `/v1/resource-groups/{rg}/spawn`
+      - `/v1/resource-definitions` (CRUD)
+      - `/v1/resource-definitions/{rd}/volume-definitions` (CRUD)
+      - `/v1/resource-definitions/{rd}/snapshots` (CRUD), `/v1/view/snapshots`
+      - `/v1/view/resources`
+      - `/v1/key-value-store` (CRUD; ConfigMap-backed)
+- [ ] **Reconcilers** for `Node` / `StoragePool` / `ResourceDefinition` /
+      `Resource` / `Snapshot` — currently no-op stubs; Phase 3 fills them.
+- [ ] **Autoplacer** — `POST /v1/resource-definitions/{rd}/autoplace`
+      computes placement and creates `Resource` objects.
+- [ ] **Resource POST/DELETE** — `/v1/resource-definitions/{rd}/resources[/{node}]`
+      so linstor-csi can place replicas explicitly.
+- [ ] piraeus-operator can create `LinstorSatellite`s and they appear in our API.
+
+**Exit (definition side)**: ✅ — all REST/store paths the CSI MVP touches
+land via golinstor; both stores pass the same suite. **Reconcilers + autoplacer
+land in Phase 2.5 below before we move to satellite/DRBD work.**
 
 ### Phase 3 — Satellite + DRBD lifecycle
 

docs/csi-api-surface.md

@@ -86,8 +86,10 @@ schedules, S3 / EBS, SPDK, NVMe-oF, OpenFlex, Exos) MUST return
 
 | Endpoint | Method | Status |
 |---|---|---|
-| `/v1/resource-definitions/{rd}/resources` | GET / POST | ⬜ |
-| `/v1/resource-definitions/{rd}/resources/{node}` | GET / PUT / DELETE | ⬜ |
+| `/v1/resource-definitions/{rd}/resources` | POST | ✅ |
+| `/v1/resource-definitions/{rd}/resources` | GET | ⬜ (use /v1/view/resources) |
+| `/v1/resource-definitions/{rd}/resources/{node}` | DELETE | ✅ |
+| `/v1/resource-definitions/{rd}/resources/{node}` | GET / PUT | ⬜ |
 | `/v1/resource-definitions/{rd}/resources/{node}/volumes` | GET | ⬜ |
 | `/v1/resource-definitions/{rd}/resources/{node}/volumes/{vn}` | GET / PUT | ⬜ |
 | `/v1/resource-definitions/{rd}/resources/{node}/migrate-disk/{from}` | PUT | ⬜ |
@@ -99,7 +101,7 @@ schedules, S3 / EBS, SPDK, NVMe-oF, OpenFlex, Exos) MUST return
 | `/v1/resource-definitions/{rd}/resources/{node}/make-available` | POST | ⬜ |
 | `/v1/resource-definitions/{rd}/resources/{node}/activate` | POST | ⬜ |
 | `/v1/resource-definitions/{rd}/resources/{node}/deactivate` | POST | ⬜ |
-| `/v1/resource-definitions/{rd}/autoplace` | POST | ⬜ |
+| `/v1/resource-definitions/{rd}/autoplace` | POST | ✅ |
 
 ## Resource groups
 

pkg/api/v1/autoplace.go

@@ -0,0 +1,35 @@
+/*
+Copyright 2026 Cozystack contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+// AutoPlaceRequest is the body upstream LINSTOR (and golinstor) expect on
+// `POST /v1/resource-definitions/{rd}/autoplace`. Mirrors golinstor exactly.
+type AutoPlaceRequest struct {
+	DisklessOnRemaining bool             `json:"diskless_on_remaining,omitempty"`
+	SelectFilter        AutoSelectFilter `json:"select_filter,omitzero"`
+	LayerList           []string         `json:"layer_list,omitempty"`
+}
+
+// ResourceCreate is the body upstream LINSTOR uses on
+// `POST /v1/resource-definitions/{rd}/resources`. The Resources field is a
+// list because callers can place a resource on multiple nodes in one call.
+type ResourceCreate struct {
+	Resource     Resource `json:"resource,omitzero"`
+	LayerList    []string `json:"layer_list,omitempty"`
+	DrbdNodeID   *int32   `json:"drbd_node_id,omitempty"`
+	NetInterface string   `json:"net_interface,omitempty"`
+}