Backport of #4292 to release-1.6.

Cozystack's Talos configuration removes the systemd DRBD shutdown guard
without a replacement. talos.gracefulShutdown.enabled, disabled by default,
releases unused Secondary DRBD resources before the satellite stops so their
backing devices, including ZFS zvols, can be released during normal shutdown.
The hook skips Primary resources and open devices, rechecks each candidate,
and stops on ambiguous status, command failure or timeout. It uses no force,
demotion, Kubernetes API calls or extra permissions.

Three differences from main, all from the same cause: release-1.6 has no
drbd.enabled flag, since the DRBD-less-substrate switch landed after 1.6 was
cut. The hook is therefore gated on talos.gracefulShutdown.enabled alone, the
values block adds only that key, and the case asserting the hook is omitted on
a substrate without DRBD is left out along with the flag it sets. The README
line naming both flags names talos.enabled instead. Nothing else differs.

The automated backport in #4320 stopped at the same values.yaml hunk and
pushed the conflict markers as its only commit, which is why this exists.

Verified on this branch: 11 Helm tests and the 20 behavioural Python tests
pass.

Assisted-by: LLM
Signed-off-by: Yan Bondarenko <[email protected]>

Backport of #4292 to release-1.6.

Cozystack's Talos configuration removes the systemd DRBD shutdown guard
without a replacement. talos.gracefulShutdown.enabled, disabled by default,
releases unused Secondary DRBD resources before the satellite stops so their
backing devices, including ZFS zvols, can be released during normal shutdown.
The hook skips Primary resources and open devices, rechecks each candidate,
and stops on ambiguous status, command failure or timeout. It uses no force,
demotion, Kubernetes API calls or extra permissions.

Three differences from main, all from the same cause: release-1.6 has no
drbd.enabled flag, since the DRBD-less-substrate switch landed after 1.6 was
cut. The hook is therefore gated on talos.gracefulShutdown.enabled alone, the
values block adds only that key, and the case asserting the hook is omitted on
a substrate without DRBD is left out along with the flag it sets. The README
line naming both flags names talos.enabled instead. Nothing else differs.

The automated backport in #4320 stopped at the same values.yaml hunk and
pushed the conflict markers as its only commit, which is why this exists.

Verified on this branch: 11 Helm tests and the 20 behavioural Python tests
pass.

Assisted-by: LLM
Signed-off-by: Yan Bondarenko <[email protected]>
Signed-off-by: Myasnikov Daniil <[email protected]>

Backport of #4292 to release-1.6.

Cozystack's Talos configuration removes the systemd DRBD shutdown guard
without a replacement. talos.gracefulShutdown.enabled, disabled by default,
releases unused Secondary DRBD resources before the satellite stops so their
backing devices, including ZFS zvols, can be released during normal shutdown.
The hook skips Primary resources and open devices, rechecks each candidate,
and stops on ambiguous status, command failure or timeout. It uses no force,
demotion, Kubernetes API calls or extra permissions.

Three differences from main, all from the same cause: release-1.6 has no
drbd.enabled flag, since the DRBD-less-substrate switch landed after 1.6 was
cut. The hook is therefore gated on talos.gracefulShutdown.enabled alone, the
values block adds only that key, and the case asserting the hook is omitted on
a substrate without DRBD is left out along with the flag it sets. The README
line naming both flags names talos.enabled instead. Nothing else differs.

The automated backport in #4320 stopped at the same values.yaml hunk and
pushed the conflict markers as its only commit, which is why this exists.

Verified on this branch: 11 Helm tests and the 20 behavioural Python tests
pass.

Assisted-by: LLM
Signed-off-by: Yan Bondarenko <[email protected]>
Signed-off-by: Myasnikov Daniil <[email protected]>

…utdown on Talos (#4401)

This reopens a fork backport from a branch in this repository so its CI
can run. The commit is the one from #4338 by @yankawai, unchanged. On
release-1.6 the pull-request CI pushes the images it builds, and a run
from a fork has no registry credentials, so #4338 stopped at the build
jobs and never reached e2e. The description below is the author's.

## What this PR does

Manual backport of #4292 to `release-1.6`.

The automated backport, #4320, stopped on a conflict in
`packages/system/linstor/values.yaml` and pushed the markers as its only
commit, so it is red on DCO and would ship conflict markers in a values
file if merged.

The conflict is `drbd.enabled`, which does not exist on this line: the
DRBD-less-substrate switch landed on main after 1.6 was cut, and the
cherry-pick pulled its values block in with the hunk it needed.
Everything else in the change applies unchanged, so three differences
follow from that one cause:

- the preStop hook is gated on `talos.gracefulShutdown.enabled` alone
rather than on it and `drbd.enabled`;
- the values block adds `talos.gracefulShutdown` only;
- the case asserting the hook is omitted on a Talos substrate without
DRBD goes with the flag it sets, and the README line that named both
flags names `talos.enabled`.

Verified on this branch: 11 Helm tests and the 20 behavioural Python
tests pass. The file set and line counts match #4292 apart from those
three points.

Feature summary, unchanged from #4292: Cozystack's Talos configuration
removes the systemd DRBD shutdown guard without a replacement.
`talos.gracefulShutdown.enabled`, disabled by default, releases unused
Secondary DRBD resources before the satellite stops so their backing
devices, including ZFS zvols, can be released during normal shutdown.
The hook skips Primary resources and open devices, rechecks each
candidate, and stops on ambiguous status, command failure or timeout. It
never forces, demotes, calls the Kubernetes API or asks for extra
permissions. It is opt-in because preStop also runs on ordinary
satellite restarts, and Piraeus has one DaemonSet per node with no
cluster-wide rollout barrier.

### Screenshots

Not a UI change.

### Downstream repositories

Walked the trigger map against the diff: this touches one system chart,
its hook script and its tests. No downstream repository restates the
linstor chart values.

- [x] No downstream repository is affected by this change

### Release note

```release-note
fix(linstor): add `talos.gracefulShutdown.enabled`, off by default, so a satellite releases unused Secondary DRBD resources before it stops and their backing devices, ZFS zvols included, can be released during a normal Talos shutdown. Enable it only where satellite and node restarts are serialized: the hook also runs on ordinary pod restarts, and Piraeus has one DaemonSet per node.
```