linode: tag every LKE volume at birth via StorageClass volumeTags

[travagliad]

Problem

Root-cause fix for the residual volume leak behind #1287/#1296. Auditing the live account after #1296 shipped still turned up dozens of orphaned pvc-* Block Storage volumes the sweep could not reap — all untagged.

Cause, confirmed on a live LKE cluster:

• Every PMM HA PVC uses LKE's default StorageClass linode-block-storage-retain, whose reclaim policy is Retain — so its backing Block Storage volume is kept when the PVC/cluster is deleted.
• That StorageClass has no volumeTags, and a StorageClass's parameters are immutable, so volumes are born untagged.
• prune-lke-orphans.sh deletes by positive attribution (a pmm-qa-run: tag whose run has no live cluster). It can never reap an untagged volume — by design, to avoid deleting live/other-owner data. So any volume that was unattached at teardown, or created after the provision-time tagging pass, or belonged to a cluster not torn down via our scripts, leaked permanently.

The imperative tagging added in #1287/#1296 (tag-lke-resources.sh at provision and before delete) only tags volumes attached at those moments, so it structurally cannot cover the unattached/late cases.

Change

create-lke-pmm-ha.sh now, before installing any chart, recreates the cluster's default StorageClass (same name linode-block-storage-retain, so it covers PVCs that reference it explicitly or inherit it as default) with:

parameters:
  linodebs.csi.linode.com/volumeTags: "pmm-qa-ephemeral,pmm-qa-run:<RUN_ID>"

The Linode CSI driver then stamps the run tag on every volume at creation — attached or not, at provision or later — so 100% of the cluster's volumes are attributable and the sweep reaps them reliably. Reclaim policy is left Retain (no behavior change beyond attribution); the EXIT-trap and pre-delete tag-lke-resources.sh remain as a backstop for the brief window before the StorageClass applies (and if LKE re-reconciles the SC).

SKILL.md updated to describe tag-at-birth as the primary volume-attribution mechanism.

Validation

• shellcheck -S warning and bash -n clean on create-lke-pmm-ha.sh.
• Proven on a live LKE cluster: created a PVC against a StorageClass carrying linodebs.csi.linode.com/volumeTags; the resulting Linode volume came back from the API already tagged ["pmm-qa-ephemeral","pmm-qa-run:sctest"], and with Delete reclaim the volume was removed when the PVC was deleted.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DBhvZuEUQU8ym347Xat4Yy

---

Generated by Claude Code

[coderabbitai]

Warning

Review limit reached

Next included review available in 16 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 8b3e1220-dd34-42b0-84e5-afafe3c8a29b

📥 Commits

Reviewing files that changed from the base of the PR and between 59e178b and 5be71e7.

📒 Files selected for processing (2)

• .claude/skills/linode-ha-provisioning/SKILL.md
• .claude/skills/linode-ha-provisioning/scripts/create-lke-pmm-ha.sh

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[claude]

No review reference covers .claude/**, so this diff got the generic checks only — Lint (shellcheck) is the sole gate on it, and nothing in CI exercises the LKE provisioning path, so the manual live-cluster run in the body is the only evidence the StorageClass swap works against the real charts. CodeRabbit hit its review limit on this PR, so no bot pass ran on the diff either.