[Epic] External Volume features and bug fixes for v1.1 #3757

Tracks external volume features, reliability improvements, and bug fixes targeted for the v1.1 milestone.

Features

• Shared storage across actors (ReadWriteMany / ReadOnlyMany volumes) #1637
  • ateapi: add the ExternalVolume resource #3744
  • ateapi: add ExternalVolumeSource.ref #3745
  • ateapi: record each actor-provisioned volume as an ExternalVolume #3746
  • Shared volumes: actors mount an atespace-scoped ExternalVolume and hand it off in turn #2567
  • Shared volumes: concurrent holders with READ_WRITE_MANY, safe detach and safe unstage #3332
• [FEATURE] Move CSI volume configuration from Kubernetes objects into the Substrate API #3754
  • ateapi: add ExternalVolumeClass proto message and PostgreSQL store #3742
  • ateapi: add ExternalVolumeClass CRUD RPCs, validation, and OpenFGA authz #3743
  • ateapi: control handlers for ExternalVolumeClass CRUD #3751
  • ateapi: add ExternalVolumeTemplate.external_volume_class and provision volumes from ExternalVolumeClass #3752
• Add snapshotting support for external volumes #1951
  • Add volume snapshot support to volume plugins #1849
  • Capture external volumes when a tag is created #3748
• Let benchmark tests set a StorageClass and apply extra manifests #2368
• external-volume: Use the CSI driver's NodeID for ControllerPublish and ControllerUnpublish #3103
• external-volume: Pass StorageClass mountOptions through to CSI MountFlags #3102

Bugs & Hardening

CSI Client & Node Mount Reliability

• [Bug]: atelet should not create the csi volume mount directory #3755
• csi: wait for the node plugin to come back after a restart #3212
• csi: use round_robin for the CSI driver client #3247

Actor Lifecycle & Volume State Machine

• Async suspend (pause) should not detach the actor's volumes #2734
• ateapi, atelet: retried actor delete gets EBUSY when volumes were deleted after a failed Terminate #2971
  • ateapi: skip deleting external volumes when Terminate or volume detach fails #3112
• [Bug]: UpdateActor skips the volume check if the old template was deleted; ResumeActor and DeleteActor then fail and the worker isn't released #3401
  • controlapi: handle actor template volume mismatches #3430
• ActorTemplate validation accepts a declared volume that no container mounts, contrary to the API guide #3069
  • Reject ActorTemplates with unmounted volumes #3096

Security, Validation & Docs

• Validate storage_volume_id path containment when constructing CSI staging directories #2935
  • CSI staging directories are named by a hash of the volume ID #3180
• Check relative path containment in ocispec.guestVolumeSource #2920
  • ocispec: reject path traversal and empty host dirs in guestVolumeSource #2999
• csi: harden CSIDriverConfig endpoint validation #2008
• docs: retain NFS controller privileges in the CSI example #3521