feat(storage): prepare encrypted migration disks with released pool tooling

.github/actions/deploy-prod/action.yml

@@ -84,7 +84,7 @@ runs:
       shell: bash
       env:
         # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?<version>.+)$
-        KSAIL_VERSION: "7.210.0"
+        KSAIL_VERSION: "7.213.4"
         GITHUB_TOKEN: ${{ github.token }}
       run: |
         .github/scripts/setup-ksail.sh

.github/workflows/cd.yaml

@@ -192,7 +192,7 @@ jobs:
         shell: bash
         env:
           # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?<version>.+)$
-          KSAIL_VERSION: "7.210.0"
+          KSAIL_VERSION: "7.213.4"
           GITHUB_TOKEN: ${{ github.token }}
         run: .github/scripts/setup-ksail.sh
 

.github/workflows/ci.yaml

@@ -1958,7 +1958,7 @@ jobs:
         shell: bash
         env:
           # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?<version>.+)$
-          KSAIL_VERSION: "7.210.0"
+          KSAIL_VERSION: "7.213.4"
           GITHUB_TOKEN: ${{ github.token }}
         run: .github/scripts/setup-ksail.sh
 
@@ -3265,7 +3265,7 @@ jobs:
         shell: bash
         env:
           # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?<version>.+)$
-          KSAIL_VERSION: "7.210.0"
+          KSAIL_VERSION: "7.213.4"
           GITHUB_TOKEN: ${{ github.token }}
         run: |
           .github/scripts/setup-ksail.sh
@@ -3699,7 +3699,7 @@ jobs:
         shell: bash
         env:
           # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?<version>.+)$
-          KSAIL_VERSION: "7.210.0"
+          KSAIL_VERSION: "7.213.4"
           GITHUB_TOKEN: ${{ github.token }}
         run: |
           .github/scripts/setup-ksail.sh
@@ -4745,7 +4745,7 @@ jobs:
         shell: bash
         env:
           # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?<version>.+)$
-          KSAIL_VERSION: "7.210.0"
+          KSAIL_VERSION: "7.213.4"
           GITHUB_TOKEN: ${{ github.token }}
         run: .github/scripts/setup-ksail.sh
 

.github/workflows/dr-rebuild.yaml

@@ -180,7 +180,7 @@ jobs:
         # deploy-prod action; renovate keeps the pin current in all places.
         env:
           # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?<version>.+)$
-          KSAIL_VERSION: "7.210.0"
+          KSAIL_VERSION: "7.213.4"
           GITHUB_TOKEN: ${{ github.token }}
         run: |
           .github/scripts/setup-ksail.sh

.github/workflows/prove-scoped-package-access.yaml

@@ -43,7 +43,7 @@ jobs:
       - name: Setup KSail for the existing encrypted pull credential
         env:
           # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?<version>.+)$
-          KSAIL_VERSION: "7.210.0"
+          KSAIL_VERSION: "7.213.4"
           GITHUB_TOKEN: ${{ github.token }}
         run: .github/scripts/setup-ksail.sh
 

.github/workflows/validate-image-verifier-liveness.yaml

@@ -168,7 +168,7 @@ jobs:
         shell: bash
         env:
           # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?<version>.+)$
-          KSAIL_VERSION: "7.210.0"
+          KSAIL_VERSION: "7.213.4"
           GITHUB_TOKEN: ${{ github.token }}
         run: .github/scripts/setup-ksail.sh
 

.github/workflows/validate-main.yaml

@@ -134,7 +134,7 @@ jobs:
         shell: bash
         env:
           # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?<version>.+)$
-          KSAIL_VERSION: "7.210.0"
+          KSAIL_VERSION: "7.213.4"
           GITHUB_TOKEN: ${{ github.token }}
         run: .github/scripts/setup-ksail.sh
 
@@ -327,7 +327,7 @@ jobs:
         shell: bash
         env:
           # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?<version>.+)$
-          KSAIL_VERSION: "7.210.0"
+          KSAIL_VERSION: "7.213.4"
           GITHUB_TOKEN: ${{ github.token }}
         run: |
           .github/scripts/setup-ksail.sh

k8s/bases/infrastructure/controllers/ksail-operator/oci-repository.yaml

@@ -11,7 +11,7 @@ spec:
   # the source exposes real readiness.
   url: oci://ghcr.io/devantler-tech/charts/ksail-operator
   ref:
-    tag: 7.210.0
+    tag: 7.213.4
   layerSelector:
     mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
     operation: copy

ksail.prod.yaml

@@ -134,6 +134,28 @@ spec:
             max: 2
             labels:
               storage.platform.devantler.tech/migration-pool: v1
+            talosPatches:
+              - |
+                ---
+                apiVersion: v1alpha1
+                kind: VolumeConfig
+                name: EPHEMERAL
+                provisioning:
+                  diskSelector:
+                    match: system_disk
+                  minSize: 40GiB
+                  maxSize: -152GiB
+                  grow: false
+                ---
+                apiVersion: v1alpha1
+                kind: RawVolumeConfig
+                name: longhorn
+                provisioning:
+                  diskSelector:
+                    match: system_disk
+                  minSize: 144GiB
+                  maxSize: 144GiB
+                  grow: false
           # Fresh raw-disk capacity; created after the worker layout changed.
           # Together with rebuilt permanent workers 1 and 2, this provides three
           # V2 targets while V1 retains worker 3 and its two migration workers.
@@ -144,6 +166,33 @@ spec:
             max: 1
             labels:
               storage.platform.devantler.tech/migration-pool: v2
+            talosPatches:
+              - |
+                apiVersion: v1alpha1
+                kind: VolumeConfig
+                name: EPHEMERAL
+                provisioning:
+                  diskSelector:
+                    match: system_disk
+                  grow: false
+                  minSize: 40GiB
+                  maxSize: 44GiB
+                ---
+                apiVersion: v1alpha1
+                kind: RawVolumeConfig
+                name: longhorn-stage
+                provisioning:
+                  diskSelector:
+                    match: system_disk
+                  grow: false
+                  minSize: 144GiB
+                  maxSize: 144GiB
+                encryption:
+                  provider: luks2
+                  keys:
+                    - slot: 0
+                      nodeID: {}
+                      lockToState: true
           - name: autoscale-cx43
             serverType: cx43
             location: fsn1

scripts/reconcile-talos-kernel-args/README.md

@@ -624,3 +624,23 @@ silently skipped. Its [final-head provider trial](https://github.com/devantler-t
 verified a same-version image update, readiness, a second no-change plan and
 cleanup on a temporary single-node cluster. That trial does not cover autoscaled
 nodes or an interrupted rollout; the release's regression tests cover those paths.
+
+**7.213.4**, commit `695328215555c4d957498569f4cf788c7343dc4c`, retains
+byte-identical configuration-manager and Talos-generator trees relative to
+7.207.1. The fold's trigger, normalized arguments, both-role output and explicit
+schematic-ID boundary are unchanged. The API adds ordered per-pool Talos patches
+and observed host status; status preservation in its marshaler does not change
+desired configuration. The chart adds those fields and a node-list permission
+for nested Kind provisioning. Talos machinery and both YAML encoders are
+unchanged; COSI runtime moves from 1.16.3 to 1.16.4, Kubernetes clients from
+0.36.5 to 0.36.6, and the build toolchain from Go 1.27.3 to 1.27.4.
+
+The source audit covers the published releases and complete commit range from
+7.207.0 through 7.213.4, including changes between retained unpublished tags.
+Per-pool patches are applied after shared worker configuration; they do not
+replace this shared post-installer fold. The consumer fixtures exercise all
+five pool profiles during bootstrap and reconciliation with the patched
+toolchain, and their generated configurations validate with the platform's
+pinned Talos client.
+The offline render regression still checks both shared roles, schematic-ID
+precedence and invalid-patch refusal. This audit changes no runtime exception.

scripts/reconcile-talos-kernel-args/audited_inputs.go

@@ -369,6 +369,14 @@ var auditedFoldInputs = []struct {
 		"go.mod":                     "832fc16ab44bcfbba8759238575fc1ea0fba5c7b",
 		"go.sum":                     "1a9d7d5860e52a2aa5ab5ac7e1a06f35996423a0",
 	}},
+	{"7.213.4", map[string]string{
+		"pkg/fsutil/configmanager":   "51dbdaf40c1bc6bc3eb1018ccdf29588cca13fd5",
+		"pkg/fsutil/generator/talos": "25c9c416e06b77937e68e71a213c1b2e9ed61205",
+		"pkg/apis":                   "2cc7c7d8a796e1160456db2823e0e87a918c931b",
+		"charts":                     "d404672b26c6fd7bc741ca1fd29fa1ea10e045bc",
+		"go.mod":                     "25edcda6b27a76716c758753ebec1ff66008cb50",
+		"go.sum":                     "484daeaf917de0194dbcdd324c03a0a9ae760fbd",
+	}},
 }
 
 // verifyFoldInputs passes only when every fold input of the pinned release was

tests/chart-rendered-rbac-policy/excluded-role-grants.json

@@ -893,6 +893,17 @@
           "watch"
         ]
       },
+      {
+        "apiGroups": [
+          ""
+        ],
+        "resources": [
+          "nodes"
+        ],
+        "verbs": [
+          "list"
+        ]
+      },
       {
         "apiGroups": [
           "apiextensions.k8s.io"