Export zpools on zfs shutdown - #1028

Since v1.13.0 (commit 5aeaf4e, PR siderolabs#1028) the zfs-service runs
`zpool export -a` at shutdown via a blocking cmd.Run() that log.Fatalf's
on error, to release the backing device so `cryptsetup close` can finish
on upgrade (the LUKS-on-ZFS case). Talos gives extension services a fixed
10s SIGTERM->SIGKILL grace with no machine-config knob to raise it, so on
busy pools the export overruns that grace: the zpool child is SIGKILLed
mid-export, the parent is SIGKILLed too, and the containerd shim then
hangs ~20 minutes cleaning up the /dev rshared-rbind mount that still
references zvol device nodes.

Make the shutdown export configurable via the ZFS_EXPORT_TIMEOUT env var,
without changing the default:

  - unset (default): run the export unbounded, exactly as before;
  - 0: skip the export entirely (pre-v1.13 behavior);
  - >0 (a Go duration): bound the export with context.WithTimeout,
    exec.CommandContext and WaitDelay; on timeout or error, log and exit 0
    instead of log.Fatalf so the containerd shim can unmount /dev cleanly.
    Un-exported pools are recovered next boot by `zpool import -fal`.

This is a community extension, so the default is left unchanged to avoid
regressing the original LUKS-on-ZFS case, while topologies where the
export only blocks (e.g. DRBD/LUKS over zvols) get an opt-in escape hatch.
Mirrors the in-repo context + CommandContext + WaitDelay pattern from
nvidia-fabricmanager-wrapper. Documents the env var in storage/zfs/README.md.

Refs siderolabs#1085

Signed-off-by: Bernard Gütermann <[email protected]>

Since v1.13.0 (siderolabs#1028) the zfs-service runs `zpool export -a` at shutdown
via a blocking cmd.Run() that log.Fatalf's on error. Talos gives extension
services a fixed 10s SIGTERM->SIGKILL grace with no knob to raise it, so on
busy pools the export overruns it: zpool is SIGKILLed mid-export and the
containerd shim then hangs ~20 minutes cleaning up the /dev rbind.

Make the export configurable via ZFS_EXPORT_TIMEOUT, default unchanged:
unset runs it unbounded as before; 0 skips it (pre-v1.13); a positive Go
duration bounds it and, on timeout or error, logs and exits 0 instead of
log.Fatalf so the shim can unmount /dev cleanly (pools are re-imported next
boot by `zpool import -fal`). Leaving the default unchanged avoids
regressing the original LUKS-on-ZFS case.

Refs siderolabs#1085

Signed-off-by: Bernard Gütermann <[email protected]>

Since v1.13.0 (siderolabs#1028) the zfs-service runs `zpool export -a` at shutdown
via a blocking cmd.Run() that log.Fatalf's on error. Talos gives extension
services a fixed 10s SIGTERM->SIGKILL grace with no knob to raise it, so on
busy pools the export overruns it: the service is SIGKILLed mid-export and
the containerd shim then hangs ~20 minutes cleaning up the /dev rbind.

Bound the export with context.WithTimeout, exec.CommandContext and WaitDelay
so this PID 1 exits cleanly within the grace; on timeout or error, log and
exit 0 instead of log.Fatalf so the shim can unmount /dev in order (pools are
re-imported next boot by `zpool import -fal`). The bound is configurable via
ZFS_EXPORT_TIMEOUT (a Go duration, default 8s, under the 10s grace); 0 skips
the export entirely (pre-v1.13 behavior).

Refs siderolabs#1085

Signed-off-by: Bernard Gütermann <[email protected]>

Since v1.13.0 (siderolabs#1028) the zfs-service runs `zpool export -a` at shutdown
via a blocking cmd.Run() that log.Fatalf's on error. Talos gives extension
services a fixed 10s SIGTERM->SIGKILL grace with no knob to raise it, so on
busy pools the export overruns it: the service is SIGKILLed mid-export and
the containerd shim then hangs ~20 minutes cleaning up the /dev rbind.

Bound the export with context.WithTimeout, exec.CommandContext and WaitDelay
so this PID 1 exits cleanly within the grace; on timeout or error, log and
exit 0 instead of log.Fatalf so the shim can unmount /dev in order (pools are
re-imported next boot by `zpool import -fal`). The bound is configurable via
ZFS_EXPORT_TIMEOUT (a Go duration, default 8s, under the 10s grace); 0 skips
the export entirely (pre-v1.13 behavior).

Refs siderolabs#1085

Signed-off-by: Bernard Gütermann <[email protected]>

Since v1.13.0 (siderolabs#1028) the zfs-service runs `zpool export -a` at shutdown
via a blocking cmd.Run() that log.Fatalf's on error. Talos gives extension
services a fixed 10s SIGTERM->SIGKILL grace with no knob to raise it, so on
busy pools the export overruns it: the service is SIGKILLed mid-export and
the containerd shim then hangs ~20 minutes cleaning up the /dev rbind.

Bound the export with context.WithTimeout, exec.CommandContext and WaitDelay
so this PID 1 exits cleanly within the grace; on timeout or error, log and
exit 0 instead of log.Fatalf so the shim can unmount /dev in order (pools are
re-imported next boot by `zpool import -fal`). The bound is configurable via
ZFS_EXPORT_TIMEOUT (a Go duration, default 8s, under the 10s grace); 0 skips
the export entirely (pre-v1.13 behavior).

Refs siderolabs#1085

Signed-off-by: Bernard Gütermann <[email protected]>

Since v1.13.0 (siderolabs#1028) the zfs-service runs `zpool export -a` at shutdown
via a blocking cmd.Run() that log.Fatalf's on error. Talos gives extension
services a fixed 10s SIGTERM->SIGKILL grace with no knob to raise it, so on
busy pools the export overruns it: the service is SIGKILLed mid-export and
the containerd shim then hangs ~20 minutes cleaning up the /dev rbind.

Bound the export with context.WithTimeout, exec.CommandContext and WaitDelay
so this PID 1 exits cleanly within the grace; on timeout or error, log and
exit 0 instead of log.Fatalf so the shim can unmount /dev in order (pools are
re-imported next boot by `zpool import -fal`). The bound is configurable via
ZFS_EXPORT_TIMEOUT (a Go duration, default 8s, under the 10s grace); 0 skips
the export entirely (pre-v1.13 behavior).

Refs siderolabs#1085

Signed-off-by: Bernard Gütermann <[email protected]>
Signed-off-by: Andrey Smirnov <[email protected]>

Since v1.13.0 (#1028) the zfs-service runs `zpool export -a` at shutdown
via a blocking cmd.Run() that log.Fatalf's on error. Talos gives extension
services a fixed 10s SIGTERM->SIGKILL grace with no knob to raise it, so on
busy pools the export overruns it: the service is SIGKILLed mid-export and
the containerd shim then hangs ~20 minutes cleaning up the /dev rbind.

Bound the export with context.WithTimeout, exec.CommandContext and WaitDelay
so this PID 1 exits cleanly within the grace; on timeout or error, log and
exit 0 instead of log.Fatalf so the shim can unmount /dev in order (pools are
re-imported next boot by `zpool import -fal`). The bound is configurable via
ZFS_EXPORT_TIMEOUT (a Go duration, default 8s, under the 10s grace); 0 skips
the export entirely (pre-v1.13 behavior).

Refs #1085

Signed-off-by: Bernard Gütermann <[email protected]>
Signed-off-by: Andrey Smirnov <[email protected]>
(cherry picked from commit 1b7063c)

Since v1.13.0 (siderolabs#1028) the zfs-service runs `zpool export -a` at shutdown
via a blocking cmd.Run() that log.Fatalf's on error. Talos gives extension
services a fixed 10s SIGTERM->SIGKILL grace with no knob to raise it, so on
busy pools the export overruns it: the service is SIGKILLed mid-export and
the containerd shim then hangs ~20 minutes cleaning up the /dev rbind.

Bound the export with context.WithTimeout, exec.CommandContext and WaitDelay
so this PID 1 exits cleanly within the grace; on timeout or error, log and
exit 0 instead of log.Fatalf so the shim can unmount /dev in order (pools are
re-imported next boot by `zpool import -fal`). The bound is configurable via
ZFS_EXPORT_TIMEOUT (a Go duration, default 8s, under the 10s grace); 0 skips
the export entirely (pre-v1.13 behavior).

Refs siderolabs#1085

Signed-off-by: Bernard Gütermann <[email protected]>
Signed-off-by: Andrey Smirnov <[email protected]>