perf(store,cli): stop reading the whole cluster to answer two narrow questions

api/v1alpha1/resource_types.go

@@ -523,6 +523,12 @@ type ResourceVolumeStatus struct {
 // +kubebuilder:subresource:status
 // +kubebuilder:resource:scope=Cluster
 // +kubebuilder:validation:XValidation:rule="oldSelf.hasValue() || self.metadata.name.lowerAscii() == (self.spec.resourceDefinitionName + '.' + self.spec.nodeName).lowerAscii()",message="metadata.name must equal <spec.resourceDefinitionName>.<spec.nodeName> (case-insensitive)",optionalOldSelf=true
+// Server-side field selectors. Without these the API server refuses a
+// selector on these paths outright, which is the failure mode we want: a
+// selector that silently returned a subset is the Bug 038 shape, where a
+// partial-but-correct answer hid the replicas an operator applied by hand.
+// +kubebuilder:selectablefield:JSONPath=`.spec.nodeName`
+// +kubebuilder:selectablefield:JSONPath=`.spec.resourceDefinitionName`
 // +kubebuilder:printcolumn:name="Definition",type=string,JSONPath=`.spec.resourceDefinitionName`
 // +kubebuilder:printcolumn:name="Node",type=string,JSONPath=`.spec.nodeName`
 // +kubebuilder:printcolumn:name="Pool",type=string,JSONPath=`.spec.storagePool`

api/v1alpha1/snapshot_types.go

@@ -274,6 +274,12 @@ type SnapshotPerNodeStatus struct {
 // +kubebuilder:subresource:status
 // +kubebuilder:resource:scope=Cluster
 // +kubebuilder:validation:XValidation:rule="oldSelf.hasValue() || self.metadata.name.lowerAscii() == (self.spec.resourceDefinitionName + '.' + self.spec.snapshotName).lowerAscii()",message="metadata.name must equal <spec.resourceDefinitionName>.<spec.snapshotName> (case-insensitive)",optionalOldSelf=true
+// spec.resourceDefinitionName is selectable so a definition-scoped snapshot
+// read is a definition-scoped query. A field, not the label the objects
+// usually carry: a Snapshot adopted from a LINSTOR dump has no labels, and a
+// label selector would answer partial-but-correct on the read that refuses
+// `rd d` and sweeps the leftovers after it.
+// +kubebuilder:selectablefield:JSONPath=`.spec.resourceDefinitionName`
 // +kubebuilder:printcolumn:name="Definition",type=string,JSONPath=`.spec.resourceDefinitionName`
 // +kubebuilder:printcolumn:name="Snapshot",type=string,JSONPath=`.spec.snapshotName`
 // +kubebuilder:printcolumn:name="Nodes",type=string,JSONPath=`.spec.nodes`

api/v1alpha1/storagepool_types.go

@@ -112,6 +112,14 @@ type StoragePoolStatus struct {
 // +kubebuilder:subresource:status
 // +kubebuilder:resource:scope=Cluster
 // +kubebuilder:validation:XValidation:rule="oldSelf.hasValue() || self.metadata.name.lowerAscii() == (self.spec.poolName + '.' + self.spec.nodeName).lowerAscii()",message="metadata.name must equal <spec.poolName>.<spec.nodeName> (case-insensitive)",optionalOldSelf=true
+// spec.nodeName is selectable so a node-scoped read is a node-scoped query.
+// The pools on a node are what a `node delete` is refused on and what the
+// cascade removes, and answering that by listing every pool in the cluster is
+// the read this replaces. A field, not the label the objects usually carry: a
+// pool created by an operator (piraeus writes them with `kubectl apply`) has
+// no label, and a label selector would answer partial-but-correct — which on
+// the refusal path means deleting a node the cluster still has pools on.
+// +kubebuilder:selectablefield:JSONPath=`.spec.nodeName`
 // +kubebuilder:printcolumn:name="Node",type=string,JSONPath=`.spec.nodeName`
 // +kubebuilder:printcolumn:name="Pool",type=string,JSONPath=`.spec.poolName`
 // +kubebuilder:printcolumn:name="Provider",type=string,JSONPath=`.spec.providerKind`

cmd/apiserver/main.go

@@ -138,8 +138,8 @@ func newScheme() *runtime.Scheme {
 // election off — every apiserver replica serves reads
 // independently. Caches still warm up so the REST server's
 // cached-client reads are cheap.
-func buildManager(flags *apiserverFlags) (manager.Manager, error) {
-	mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
+func buildManager(flags *apiserverFlags) (manager.Manager, *storek8s.Store, error) {
+	mgr, st, err := storek8s.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
 		Scheme: newScheme(),
 		Metrics: metricsserver.Options{
 			BindAddress:   flags.metricsAddr,
@@ -150,10 +150,10 @@ func buildManager(flags *apiserverFlags) (manager.Manager, error) {
 		LeaderElection:         false,
 	})
 	if err != nil {
-		return nil, errors.Wrap(err, "new manager")
+		return nil, nil, errors.Wrap(err, "new manager")
 	}
 
-	return mgr, nil
+	return mgr, st, nil
 }
 
 // resolveNamespace mirrors the controller's namespace-resolution
@@ -248,24 +248,12 @@ func main() {
 	flags := parseFlags()
 	namespace := resolveNamespace(flags.controllerNamespace)
 
-	mgr, err := buildManager(flags)
+	mgr, st, err := buildManager(flags)
 	if err != nil {
 		setupLog.Error(err, "Failed to start manager")
 		os.Exit(1)
 	}
 
-	// CRD-backed store is the only supported persistence layer
-	// post-Phase-11 — the apiserver/controller split made
-	// in-process state pointless across replicas.
-	//
-	// BUG-048: pass the manager's direct (uncached) API reader so the
-	// atomic VolumeNumber allocation re-reads live RD state on each
-	// conflict-retry. With only the informer-cached client, two
-	// concurrent `vd c` against one RD both retry against a stale cache,
-	// re-derive the same number, exhaust the retry budget, and silently
-	// drop the second volume.
-	st := storek8s.NewWithAPIReader(mgr.GetClient(), mgr.GetAPIReader())
-
 	ready := newReadyState()
 
 	// Bug 219: `ctrl.SetupSignalHandler` is one-shot — a second call

cmd/blockstor/main.go

@@ -41,8 +41,10 @@ import (
 	"os"
 	"strings"
 
+	ctrl "sigs.k8s.io/controller-runtime"
 	ctrlclient "sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/client/config"
+	"sigs.k8s.io/controller-runtime/pkg/log/zap"
 
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -55,6 +57,25 @@ import (
 )
 
 func main() {
+	// The store logs when a scoped read falls back to reading everything. Only
+	// a cluster whose CRD predates the selectable fields takes that branch,
+	// and both uncached readers reach it there: this client, and the servers'
+	// node-scoped reads, which go to the manager's API reader and are refused
+	// on the wire by the same API server. What the servers do not reach is the
+	// cache half of it, since they register the indexes.
+	//
+	// Without a root logger controller-runtime buffers the line, then after
+	// thirty seconds promotes to a null sink and prints its own "SetLogger
+	// was never called" stack trace into operator-facing stderr instead. So
+	// set one: quiet at the default level, and BLOCKSTOR_DEBUG turns the
+	// V(1) lines on for the operator who is asking why a large cluster
+	// crawls.
+	logOpts := zap.Options{
+		Development: os.Getenv("BLOCKSTOR_DEBUG") != "",
+		DestWriter:  os.Stderr,
+	}
+	ctrl.SetLogger(zap.New(zap.UseFlagOptions(&logOpts)))
+
 	app := &cli.App{
 		Out:      os.Stdout,
 		Err:      os.Stderr,

cmd/controller/main.go

@@ -166,7 +166,7 @@ func main() {
 		metricsServerOptions.KeyName = metricsCertKey
 	}
 
-	mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
+	mgr, st, err := storek8s.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
 		Scheme:                 scheme,
 		Metrics:                metricsServerOptions,
 		WebhookServer:          webhookServer,
@@ -190,12 +190,11 @@ func main() {
 		os.Exit(1)
 	}
 
-	// Construct the store before reconciler wiring so the
-	// NodeReconciler can drive eviction-triggered migration via the
-	// shared placer. CRD-backed is the only supported persistence
-	// layer since Phase 11.x — the apiserver/controller split makes
-	// in-process state pointless across replicas.
-	st := storek8s.New(mgr.GetClient())
+	// The store came back with the manager, before reconciler wiring, so the
+	// NodeReconciler can drive eviction-triggered migration via the shared
+	// placer. CRD-backed is the only supported persistence layer since Phase
+	// 11.x — the apiserver/controller split makes in-process state pointless
+	// across replicas.
 
 	if err := (&controller.NodeReconciler{
 		Client: mgr.GetClient(),

config/crd/bases/blockstor.cozystack.io_resources.yaml

@@ -781,6 +781,9 @@ spec:
           optionalOldSelf: true
           rule: oldSelf.hasValue() || self.metadata.name.lowerAscii() == (self.spec.resourceDefinitionName
             + '.' + self.spec.nodeName).lowerAscii()
+    selectableFields:
+    - jsonPath: .spec.nodeName
+    - jsonPath: .spec.resourceDefinitionName
     served: true
     storage: true
     subresources:

config/crd/bases/blockstor.cozystack.io_snapshots.yaml

@@ -322,6 +322,8 @@ spec:
           optionalOldSelf: true
           rule: oldSelf.hasValue() || self.metadata.name.lowerAscii() == (self.spec.resourceDefinitionName
             + '.' + self.spec.snapshotName).lowerAscii()
+    selectableFields:
+    - jsonPath: .spec.resourceDefinitionName
     served: true
     storage: true
     subresources:

config/crd/bases/blockstor.cozystack.io_storagepools.yaml

@@ -223,6 +223,8 @@ spec:
           optionalOldSelf: true
           rule: oldSelf.hasValue() || self.metadata.name.lowerAscii() == (self.spec.poolName
             + '.' + self.spec.nodeName).lowerAscii()
+    selectableFields:
+    - jsonPath: .spec.nodeName
     served: true
     storage: true
     subresources: