fix(cozystack): load drbd_transport_tcp explicitly

[Aleksei Sviridkin (lexfrei)]

The cozystack preset now loads drbd_transport_tcp next to drbd. Without it DRBD can't connect to any peer on Talos v1.14.

Since v1.14.0 Talos builds the kernel with an empty modprobe path (siderolabs/pkgs#1565), so the kernel no longer loads modules on request_module(). DRBD loads its transport that way when a resource first connects to a peer. After upgrading a node from v1.13.6 to v1.14.2, drbdsetup new-peer failed with "Failed to create transport (drbd_transport_xxx module missing?)" and every resource on the node stayed in Connecting. Adding the module to machine.kernel.modules fixed it without a reboot.

The module ships in the drbd extension on v1.13 too, so nodes can take this config before the upgrade. Nodes that already list it through extraKernelModules are fine, since Talos tolerates duplicate module names.

Cozystack is moving its Talos image to v1.14.2 in cozystack/cozystack#4598, so this should land before that release.

[coderabbitai]

Warning

Review limit reached

Next included review available in 46 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 2 included reviews currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: a69837d0-b52a-49a2-8560-c0b4944e83da

📥 Commits

Reviewing files that changed from the base of the PR and between dac1d2c and c4f62f4.

📒 Files selected for processing (8)

• charts/cozystack/templates/_helpers.tpl
• charts/cozystack/values.yaml
• docs/manual-test-plan.md
• pkg/engine/contract_machine_test.go
• pkg/engine/testdata/golden/cozystack-controlplane-legacy.golden.yaml
• pkg/engine/testdata/golden/cozystack-controlplane-multidoc.golden.yaml
• pkg/engine/testdata/golden/cozystack-worker-legacy.golden.yaml
• pkg/engine/testdata/golden/cozystack-worker-multidoc.golden.yaml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[IvanHunters]

Verdict

LGTM

Correct, minimal, well-targeted fix: the cozystack preset now pins drbd_transport_tcp beside drbd, verified safe on fresh v1.14 install and on the N-1 upgrade, with the changed contract tests proven non-vacuous.

Caveats

• Upgrade path verified, not assumed. A node that already lists drbd_transport_tcp via extraKernelModules now renders it twice (built-in + append). Talos v1.14.0 tolerates this: KernelModuleConfigController builds each entry as NewKernelModuleSpec(ns, module.Name()) via WriterModify keyed by name, so duplicate names collapse to one resource, and v1alpha1_validation.go performs no module-uniqueness check; the list is a YAML sequence, so decode does not reject duplicate items either. Confirmed against pinned upstream source, not test-pinned (runtime behaviour, correctly out of unit scope).
• Module name confirmed from DRBD9 source, not folklore: drbd/drbd_transport_tcp.c compiles to drbd_transport_tcp.ko, and drbd_transport.c:87 calls request_module("drbd_transport_%s", name) with name tcp, so the exact missing-on-v1.14 module is drbd_transport_tcp as written.
• Changed-test non-vacuity: removing the template line turns TestContract_Machine_KernelModules_Cozystack (all 4 cells), _ExtraKernelModules_Cozystack_AppendValues, and _EmptyOmitsAppend RED, the last with expected 7 modules ... got 6, so the kernel:/certSANs: block-boundary count is real and not fooled by the added line.
• Scope confirmed correct: rendered on CP and worker, legacy and multidoc, ordered after drbd core and before zfs; the generic chart (operator-supplied modules, no built-in pins) is untouched, so it correctly does not receive the entry, and drbd core is already pinned on the same node set so emitting the transport everywhere mirrors existing placement rather than over-broadening.
• Hermetic: no cluster touched. talm renders Talos machine config applied client-side, so there is no helm-controller SSA / admission surface; the render plus the upstream-source checks above are complete for this repo. One unrelated suite failure (TestCommittedTextFilesIgnoresUntrackedArtefacts) is a host-git 2.23 artifact, not a PR defect; review-helper mutate --from-diff had nothing to grade (the diff adds a list entry, no guard or numeric bound); talm ships no AGENTS/CONTRIBUTING, so the cozystack release-note and make generate conventions do not apply, and the values.yaml edit is a plain comment, not a cozyvalues @param.