feat(config): enable device-mapper so hcloud CSI volumes can detach #45

Merged

pipeline-bot merged 2 commits from feat/defconfig-device-mapper into trunk

2026-09-03 12:12:03 +00:00

sean commented

2026-09-03 11:12:03 +00:00

Owner

The Hetzner CSI driver cannot detach a volume on this kernel, so no hcloud volume can ever move between nodes. This blocks moving any workload off Mayastor.

LinuxMountService.Unpublish calls cryptsetup status on every NodeUnpublishVolume to test for LUKS. With no device-mapper, cryptsetup cannot open /dev/mapper/control, exits 1 instead of 4, and unpublish fails forever. The kubelet keeps the volume in node.status.volumesInUse, the VolumeAttachment is never removed, and a pod scheduled elsewhere sits in Multi-Attach forever. Reproduced on 2026-09-03: a 10Gi volume attached, formatted ext4 and wrote at 233 MB/s on one node, then could not move to a second.

BLK_DEV_DM is inside if MD, so MD must be set too, and both are tristate so they must be =y under CONFIG_MODULES=n. DM_CRYPT is not needed for the detach fix; it rides along so encrypted Hetzner volumes remain possible without a second fleet reboot.

arm64 already listed BLK_DEV_DM, DM_MIRROR and DM_ZERO with no MD, so kconfig dropped all of them. That is repaired here for consistency; no arm64 node exists.

https://claude.ai/code/session_01MdSbMhzabSbpG8TtP9Ur3H

The Hetzner CSI driver cannot detach a volume on this kernel, so no hcloud volume can ever move between nodes. This blocks moving any workload off Mayastor. `LinuxMountService.Unpublish` calls `cryptsetup status` on every NodeUnpublishVolume to test for LUKS. With no device-mapper, cryptsetup cannot open `/dev/mapper/control`, exits 1 instead of 4, and unpublish fails forever. The kubelet keeps the volume in `node.status.volumesInUse`, the VolumeAttachment is never removed, and a pod scheduled elsewhere sits in Multi-Attach forever. Reproduced on 2026-09-03: a 10Gi volume attached, formatted ext4 and wrote at 233 MB/s on one node, then could not move to a second. `BLK_DEV_DM` is inside `if MD`, so `MD` must be set too, and both are tristate so they must be `=y` under `CONFIG_MODULES=n`. `DM_CRYPT` is not needed for the detach fix; it rides along so encrypted Hetzner volumes remain possible without a second fleet reboot. arm64 already listed `BLK_DEV_DM`, `DM_MIRROR` and `DM_ZERO` with no `MD`, so kconfig dropped all of them. That is repaired here for consistency; no arm64 node exists. https://claude.ai/code/session_01MdSbMhzabSbpG8TtP9Ur3H

sean added 2 commits

2026-09-03 11:12:03 +00:00

feat(config): CONFIG_BLK_DEV_DM=y — hcloud CSI cannot detach volumes without device-mapper

pipeline/ci CI failed @ d435f3172338

Details

d435f31723

The Hetzner CSI node plugin calls cryptsetup on every NodeUnpublishVolume to see
if the volume is LUKS. Without device-mapper cryptsetup cannot open
/dev/mapper/control, exits 1 instead of 4, and unpublish fails forever. The
kubelet then keeps the volume in node.status.volumesInUse, the VolumeAttachment
is never removed, and the volume can never move to another node.

BLK_DEV_DM lives inside `if MD`, so MD must come with it, and both are tristate
so they must be =y under CONFIG_MODULES=n. DM_CRYPT is not needed for the detach
fix; it rides along so encrypted Hetzner volumes stay possible without a second
fleet reboot.

Claude-Session: https://claude.ai/code/session_01MdSbMhzabSbpG8TtP9Ur3H

fix(config): CONFIG_MD=y on arm64 — its device-mapper lines were inert

pipeline/ci CI green @ b65d53ea1b33

Details

b65d53ea1b

arch/arm64 already listed BLK_DEV_DM, DM_MIRROR and DM_ZERO, but BLK_DEV_DM is
inside `if MD` and MD was never set, so kconfig dropped all of them and arm64
silently had no device-mapper. No arm64 node exists today, so this only stops
the two defconfigs from disagreeing.

Claude-Session: https://claude.ai/code/session_01MdSbMhzabSbpG8TtP9Ur3H

sean referenced this pull request from sean/builder-images

2026-09-03 11:13:50 +00:00

fix(kernel): hard-gate the device-mapper symbols #196