fix(talos): indent cilium inlineManifests block scalars and let longhorn_disks declare an array with optional mountpoint/kind — the scalars rendered their first line at column 0, silently invalidating all 3 control-plane configs so lb-ippool/l2-announcement never reached any node

terraform/templates/controlplane.tftpl

@@ -49,12 +49,15 @@ machine:
     image: factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:${talos_version}
     wipe: true
     grubUseUKICmdline: true
+%{ if length(longhorn_disks) > 0 ~}
   disks:
-%{ for disk in longhorn_disks ~}
+%{ for idx, disk in longhorn_disks ~}
+    # ${disk.kind} — ${disk.device}
     - device: ${disk.device}
       partitions:
-        - mountpoint: ${disk.mountpoint}
+        - mountpoint: ${coalesce(disk.mountpoint, format("/var/lib/longhorn-disk%d", idx + 1))}
 %{ endfor ~}
+%{ endif ~}
   features:
     diskQuotaSupport: true
     kubePrism:

terraform/variables.tf

@@ -107,10 +107,24 @@ variable "controlplane_configs" {
     lan_subnet   = string
     lan_gateway  = string
     install_disk = string
-    longhorn_disks = list(object({
+    # Longhorn data disks, in mountpoint order. `device` should be a stable
+    # /dev/disk/by-id/wwn-* path: this hardware enumerates /dev/sdX by discovery
+    # order, and `install.wipe: true` means a renumber can aim the installer at a
+    # data disk.
+    #
+    # `mountpoint` defaults to /var/lib/longhorn-disk<N> by position. Never
+    # renumber or reorder existing entries — Longhorn keys its disks off the
+    # mountpoint, so a rename orphans the replicas already on that disk. Append
+    # new disks to the end.
+    #
+    # `kind` ("ssd"/"hdd") is a declared label only. PERC RAID controllers report
+    # every disk as rotational, so it can't be autodetected, and it deliberately
+    # does not affect ordering or mountpoints.
+    longhorn_disks = optional(list(object({
       device     = string
-      mountpoint = string
-    }))
+      mountpoint = optional(string)
+      kind       = optional(string, "hdd")
+    })), [])
     zone             = string
     allow_scheduling = bool
     # Extra cert SANs for this node — e.g. Cloudflare Tunnel public hostnames so