Fix Talos iSCSI configuration for Portworx CSI

Root cause: Previous config violated boot-time security model
- Removed /etc/iscsi mount (iscsi-tools extension manages it)
- Moved multipath.conf to post-boot DaemonSet
- Added explicit kubelet nodeIP for dual-NIC workers

Deliverables:
- Fixed talconfig.yaml with working worker patch
- iscsi-multipath-init.yaml DaemonSet for multipath config
- Automated deployment and verification scripts
- Complete documentation suite

Ready for production deployment to fastpass worker nodes.

Co-authored-by: Talos Specialist <subagent@hermes>

talos/talhelper/iscsi-multipath-init.yaml

@@ -0,0 +1,121 @@
+---
+# iSCSI Multipath Initialization DaemonSet
+# 
+# Configures multipath.conf for Pure Storage FlashArray on Talos worker nodes.
+# Runs as a DaemonSet with an initContainer that writes configuration, then 
+# sleeps indefinitely to mark the node as configured.
+#
+# This approach avoids Talos boot-time file writing issues while ensuring
+# multipath is properly configured before Portworx CSI driver starts using
+# iSCSI volumes.
+
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: iscsi-multipath-init
+  namespace: kube-system
+  labels:
+    app: iscsi-multipath-init
+    component: storage
+spec:
+  selector:
+    matchLabels:
+      app: iscsi-multipath-init
+  template:
+    metadata:
+      labels:
+        app: iscsi-multipath-init
+        component: storage
+    spec:
+      hostNetwork: true
+      hostPID: true
+      
+      # Only run on worker nodes with iSCSI storage network
+      nodeSelector:
+        node-role.kubernetes.io/worker: ""
+      
+      tolerations:
+      - effect: NoSchedule
+        key: node-role.kubernetes.io/control-plane
+      
+      initContainers:
+      - name: configure-multipath
+        image: alpine:3.19
+        securityContext:
+          privileged: true
+        command:
+        - sh
+        - -c
+        - |
+          set -e
+          
+          echo "Configuring multipath for Pure Storage FlashArray..."
+          
+          # Write multipath.conf
+          cat > /host/etc/multipath.conf <<'MPCONF'
+          # Multipath configuration for Pure Storage FlashArray
+          # Managed by iscsi-multipath-init DaemonSet
+          
+          defaults {
+              polling_interval 10
+              find_multipaths yes
+              user_friendly_names no
+          }
+          
+          devices {
+              device {
+                  vendor "PURE"
+                  product "FlashArray"
+                  path_selector "service-time 0"
+                  path_grouping_policy group_by_prio
+                  prio alua
+                  path_checker tur
+                  fast_io_fail_tmo 10
+                  user_friendly_names no
+                  no_path_retry 0
+                  hardware_handler "1 alua"
+                  dev_loss_tmo 600
+                  failback immediate
+              }
+          }
+          
+          # Blacklist Portworx virtual block devices
+          blacklist {
+              devnode "^pxd[0-9]*"
+              devnode "^pxd.*"
+          }
+          MPCONF
+          
+          echo "✓ Multipath configuration written to /etc/multipath.conf"
+          
+          # Reload multipathd if running (Talos manages the service)
+          if nsenter -t 1 -m -u -i -n -- multipathd show status >/dev/null 2>&1; then
+            echo "Reloading multipathd..."
+            nsenter -t 1 -m -u -i -n -- multipathd reconfigure || true
+          fi
+          
+          echo "✓ Multipath configuration complete"
+          echo "Current multipath devices:"
+          nsenter -t 1 -m -u -i -n -- multipath -ll || echo "  (no multipath devices yet)"
+          
+        volumeMounts:
+        - name: host-etc
+          mountPath: /host/etc
+      
+      containers:
+      # Pause container keeps the pod running to indicate configuration is applied
+      - name: pause
+        image: registry.k8s.io/pause:3.9
+        resources:
+          requests:
+            cpu: 1m
+            memory: 8Mi
+          limits:
+            cpu: 10m
+            memory: 16Mi
+      
+      volumes:
+      - name: host-etc
+        hostPath:
+          path: /etc
+          type: Directory