[Hrishikesh Kashyap (Hrishikeshkashyap)]

Several durability placement gaps could let a Pod bypass storage restrictions, combine durability volumes that do not share a node, or recreate missing durability storage on another node. This PR makes durability placement mandatory from admission through staging while preserving availability-mode recovery.

• ANDs storage placement with every existing non-empty required selector term instead of adding a bypassable OR term.
• Gives durability constraints precedence regardless of mixed-volume order.
• Intersects durability node sets and denies volumes with no common storage node.
• Rejects missing ordinary PVCs while preserving generic-ephemeral and unbound WaitForFirstConsumer workflows.
• Retains durability PV topology and owner metadata as a binding and scheduling backstop.
• Rejects wrong-owner durability staging and prevents missing durability LVs from being recreated empty.
• Preserves the existing availability-mode ownership transfer and empty-volume recovery behavior.

Type of Change

• Bug fix
• New feature
• Code quality improvement
• Other

Description

Admission and scheduling

• Resolve each claim independently so one missing claim cannot discard another volume's placement.
• Use <pod-name>-<volume-name> for generated generic-ephemeral claim names.
• Keep empty required selectors and empty selector terms unsatisfiable.
• Require all durability volumes to share a storage node.
• Fall back to retained hard PV topology when owner annotations are unavailable.

CSI defense in depth

• Persist the effective failover mode and initial durability owner during CreateVolume.
• Keep AccessibleTopology for durability volumes while availability volumes continue using webhook-managed placement.
• Validate the recorded owner before NodeStageVolume changes metadata or touches LVM.
• Use an existing-only LVM ensure path for durability volumes and return NotFound when the LV is missing.

Behavior Change

A Pod that references a missing ordinary PVC is now denied. The caller must create the PVC and retry Pod creation so admission can resolve and enforce all storage placement constraints. Missing generated generic-ephemeral claims and initially unbound WaitForFirstConsumer claims remain supported.

How Has This Been Tested?

• Focused controller, LVM, node, and webhook test binaries passed on Linux.
• Added regression coverage for missing claims in both orders, generic-ephemeral naming, unbound claims, selector edge cases, mixed modes, same-node and conflicting durability volumes, topology retention, owner validation, and existing-only staging.
• Verified with temporary driver and manager images on an AKS test cluster:
  • Missing ordinary PVCs were denied in both volume orders and no Pod was stored.
  • Missing generic-ephemeral claims preserved resolved durability placement.
  • Dynamically provisioned durability PVs retained hard node topology and initial-owner metadata.
  • Missing durability LVs returned CSI NotFound and were not recreated.
  • Mixed-mode, conflicting durability, same-node durability, and caller-affinity regressions passed.
• Restored the test cluster to its original images and removed all temporary resources and image tags.

CSI Conformance

• Reviewed CreateVolume and NodeStageVolume behavior against CSI specification v1.12.0.
• Wrong-node and missing-owner staging use FailedPrecondition; missing durability metadata or LV uses NotFound.
• No advertised capabilities or sanity-test skips changed.
• The CSI sanity suite was not run; focused unit and live-cluster verification were used.

Checklist

• The purpose and behavior change are documented.
• Tests are included and updated for the code changes.
• Architecture, webhook, recovery, and user documentation are updated.
• Availability-mode recovery behavior is preserved.
• No CSI capabilities or sanity-test skips were changed.

[Hrishikesh Kashyap (Hrishikeshkashyap)]

Hrishikesh Kashyap (Hrishikesh Kashyap (@Hrishikeshkashyap)) please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.

@microsoft-github-policy-service agree [company="{your company}"]

Options:

• (default - no company specified) I have sole ownership of intellectual property rights to my Submissions and I am not making Submissions in the course of work for my employer.

@microsoft-github-policy-service agree

• (when company given) I am making Submissions in the course of work for my employer (or my employer has intellectual property rights in my Submissions by contract or applicable law). I have permission from my employer to make Submissions and enter into this Agreement on behalf of my employer. By signing below, the defined term “You” includes me and my employer.

@microsoft-github-policy-service agree company="Microsoft"

Contributor License Agreement

@microsoft-github-policy-service agree company="Microsoft"

[Copilot]

🟡 Changes recommended

CSI topology-key handling and CreateVolume idempotency remain incorrect.

3 open findings

• Same-name volume requests can rewrite the persisted failover mode · New
• Staging fallback ignores the driver's CSI topology key · New
• Retained-topology fallback ignores the driver's CSI topology key · New

What changed in this PR

Hardens durability placement across admission, provisioning, and staging.

Changes:

• Enforces intersected durability affinity and rejects unresolved PVC placement.
• Preserves durability topology and prevents wrong-node or empty-volume recovery.
• Expands regression tests and documentation.

File	Description
internal/​webhook/​hyperconverged/​handler.go	Enforces durability placement.
internal/​webhook/​hyperconverged/​handler_unit_test.go	Adds affinity regressions.
internal/​webhook/​hyperconverged/​handler_test.go	Extends webhook integration coverage.
internal/​csi/​node/​node.go	Validates ownership during staging.
internal/​csi/​node/​node_test.go	Tests durability staging.
internal/​csi/​core/​lvm/​node.go	Adds existing-only ensure operation.
internal/​csi/​core/​lvm/​lvm.go	Prevents replacement LV allocation.
internal/​csi/​core/​lvm/​lvm_test.go	Tests existing-only behavior.
internal/​csi/​core/​interfaces.go	Extends the node interface.
internal/​csi/​core/​fake.go	Supports staging-path tests.
internal/​csi/​controller/​controller.go	Persists failover metadata and topology.
internal/​csi/​controller/​controller_test.go	Tests durability provisioning.
docs/​user-guide.md	Documents durability behavior.
docs/​design/​webhooks.md	Updates placement design.
docs/​design/​pv-recovery.md	Describes mode-specific recovery.
docs/​architecture.md	Updates architectural guarantees.

🧠 Review effort: Balanced

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[jmclong (jmclong)]

Could you split this into separate PRs for affinity composition, multi-volume placement, claim resolution/admission policy, and CSI durability enforcement, each with its relevant tests and docs?

They share a durability-placement theme, but each fix or behavior change may need a different amount of discussion. For example, rejecting Pods with missing PVCs deserves separate consideration from fixing affinity composition. Splitting them would let us review and merge straightforward fixes without blocking them on changes that need more discussion.

[Hrishikesh Kashyap (Hrishikeshkashyap)]

Superseded by four focused pull requests as requested:

• Fix required storage affinity composition #643 - affinity composition
• Fix multi-volume durability placement #644 - multi-volume placement
• Define unresolved PVC admission behavior #645 - claim resolution and admission policy
• Enforce durability placement during CSI staging #646 - CSI durability enforcement
  Each replacement keeps its relevant tests and documentation with the corresponding behavior change.