[Hrishikesh Kashyap (Hrishikeshkashyap)]

Several durability placement gaps could let a Pod bypass storage restrictions, combine durability volumes that do not share a node, or recreate missing durability storage on another node. This PR makes durability placement mandatory from admission through staging while preserving availability-mode recovery.

• ANDs storage placement with every existing non-empty required selector term instead of adding a bypassable OR term.
• Gives durability constraints precedence regardless of mixed-volume order.
• Intersects durability node sets and denies volumes with no common storage node.
• Rejects missing ordinary PVCs while preserving generic-ephemeral and unbound WaitForFirstConsumer workflows.
• Retains durability PV topology and owner metadata as a binding and scheduling backstop.
• Rejects wrong-owner durability staging and prevents missing durability LVs from being recreated empty.
• Preserves the existing availability-mode ownership transfer and empty-volume recovery behavior.

Type of Change

• Bug fix
• New feature
• Code quality improvement
• Other

Description

Admission and scheduling

• Resolve each claim independently so one missing claim cannot discard another volume's placement.
• Use <pod-name>-<volume-name> for generated generic-ephemeral claim names.
• Keep empty required selectors and empty selector terms unsatisfiable.
• Require all durability volumes to share a storage node.
• Fall back to retained hard PV topology when owner annotations are unavailable.

CSI defense in depth

• Persist the effective failover mode and initial durability owner during CreateVolume.
• Keep AccessibleTopology for durability volumes while availability volumes continue using webhook-managed placement.
• Validate the recorded owner before NodeStageVolume changes metadata or touches LVM.
• Use an existing-only LVM ensure path for durability volumes and return NotFound when the LV is missing.

Behavior Change

A Pod that references a missing ordinary PVC is now denied. The caller must create the PVC and retry Pod creation so admission can resolve and enforce all storage placement constraints. Missing generated generic-ephemeral claims and initially unbound WaitForFirstConsumer claims remain supported.

How Has This Been Tested?

• Focused controller, LVM, node, and webhook test binaries passed on Linux.
• Added regression coverage for missing claims in both orders, generic-ephemeral naming, unbound claims, selector edge cases, mixed modes, same-node and conflicting durability volumes, topology retention, owner validation, and existing-only staging.
• Verified with temporary driver and manager images on an AKS test cluster:
  • Missing ordinary PVCs were denied in both volume orders and no Pod was stored.
  • Missing generic-ephemeral claims preserved resolved durability placement.
  • Dynamically provisioned durability PVs retained hard node topology and initial-owner metadata.
  • Missing durability LVs returned CSI NotFound and were not recreated.
  • Mixed-mode, conflicting durability, same-node durability, and caller-affinity regressions passed.
• Restored the test cluster to its original images and removed all temporary resources and image tags.

CSI Conformance

• Reviewed CreateVolume and NodeStageVolume behavior against CSI specification v1.12.0.
• Wrong-node and missing-owner staging use FailedPrecondition; missing durability metadata or LV uses NotFound.
• No advertised capabilities or sanity-test skips changed.
• The CSI sanity suite was not run; focused unit and live-cluster verification were used.

Checklist

• The purpose and behavior change are documented.
• Tests are included and updated for the code changes.
• Architecture, webhook, recovery, and user documentation are updated.
• Availability-mode recovery behavior is preserved.
• No CSI capabilities or sanity-test skips were changed.

[Hrishikesh Kashyap (Hrishikeshkashyap)]

Superseded by #641, which now contains the same public-facing changes and updated terminology.