feat(storage): reserve the worker layout for Longhorn V2

k8s/clusters/prod/bootstrap/config-map.yaml

@@ -98,7 +98,7 @@ data:
   snapshot_controller_replicas: "2"
   # --- Longhorn distributed storage ---
   # All 3 static workers carry Longhorn disks (labeled with
-  # node.longhorn.io/create-default-disk=true). Replica count matches the
+  # node.longhorn.io/create-default-disk=config). Replica count matches the
   # worker count (3), so every volume is fully replicated across all storage
   # nodes.
   longhorn_replica_count: "3"

k8s/providers/hetzner/infrastructure/cluster-policies/restrict-storage-to-baseline-workers.yaml

@@ -6,7 +6,7 @@
 #
 # WHY THIS EXISTS: autoscaler nodes boot from the SAME Talos worker config as
 # the static workers (talos/workers/label-nodes.yaml), so they inherit the
-# node.longhorn.io/create-default-disk=true kubelet label. With
+# node.longhorn.io/create-default-disk kubelet label. With
 # createDefaultDiskOnLabeledNodesOnly Longhorn then treats every autoscale
 # node as a storage node: it creates a default disk, and replicaAutoBalance:
 # best-effort actively migrates volume replicas onto it. Observed 2026-06-30:

talos/workers/label-nodes.yaml

@@ -9,6 +9,18 @@
 # via machine.nodeLabels are applied later by NodeApplyController and
 # would race with registration-time scheduling.
 machine:
+  # Reconcile existing Node objects too; kubelet registration arguments alone
+  # do not prove that an already registered node has adopted the new label.
+  nodeLabels:
+    node.longhorn.io/create-default-disk: config
   kubelet:
     extraArgs:
-      node-labels: "node.longhorn.io/create-default-disk=true"
+      node-labels: "node.longhorn.io/create-default-disk=config"
+  nodeAnnotations:
+    # Talos unlocks this encrypted raw partition under a stable mapper name.
+    # Existing V1 disks are unchanged: Longhorn reads these defaults only for a
+    # node with this label and no disks. KSail removes the label from autoscaler
+    # nodes, so they stay without a default disk. A permanent worker rebuilt from
+    # this config gets the V2 disk, not a V1 one (#5582).
+    node.longhorn.io/default-disks-config: >-
+      [{"name":"longhorn-v2","path":"/dev/mapper/luks2-r-longhorn","diskType":"block","diskDriver":"aio","allowScheduling":true,"storageReserved":4294967296}]

talos/workers/mount-longhorn-data.yaml

@@ -7,7 +7,7 @@
 # /dev/sdc, etc.  Partitioning /dev/sdb with Talos would destroy those
 # volumes and break any PVC backed by hcloud-csi.
 #
-# NOTE: node-labels for Longhorn (node.longhorn.io/create-default-disk=true)
+# NOTE: node-labels for Longhorn (node.longhorn.io/create-default-disk=config)
 # are set in label-nodes.yaml. Talos strategic merge overwrites map keys,
 # so all kubelet.extraArgs.node-labels values must live in a single patch
 # file — see label-nodes.yaml.

talos/workers/reserve-ephemeral-space.yaml

@@ -0,0 +1,11 @@
+# Existing partitions are not shrunk by configuration. The reviewed migration
+# first evacuates replicas and drains the worker, then resets only EPHEMERAL.
+apiVersion: v1alpha1
+kind: VolumeConfig
+name: EPHEMERAL
+provisioning:
+  diskSelector:
+    match: system_disk
+  minSize: 40GiB
+  maxSize: -104GiB
+  grow: false

talos/workers/reserve-longhorn-data.yaml

@@ -0,0 +1,21 @@
+# Reserve local block storage without claiming any CSI-attached disk (#5582).
+# Existing EPHEMERAL partitions are not shrunk by configuration. The protected
+# node-preparation workflow first evacuates all replicas and drains the worker,
+# then wipes only EPHEMERAL, retaining STATE and its encryption salt.
+# Larger compute workers keep the additional disk capacity in EPHEMERAL;
+# their raw partition is never eligible for Longhorn replicas.
+apiVersion: v1alpha1
+kind: RawVolumeConfig
+name: longhorn
+provisioning:
+  diskSelector:
+    match: system_disk
+  minSize: 96GiB
+  maxSize: 96GiB
+  grow: false
+encryption:
+  provider: luks2
+  keys:
+    - nodeID: {}
+      slot: 0
+      lockToState: true