Fix Talos iSCSI configuration for Portworx CSI

Root cause: Previous config violated boot-time security model
- Removed /etc/iscsi mount (iscsi-tools extension manages it)
- Moved multipath.conf to post-boot DaemonSet
- Added explicit kubelet nodeIP for dual-NIC workers

Deliverables:
- Fixed talconfig.yaml with working worker patch
- iscsi-multipath-init.yaml DaemonSet for multipath config
- Automated deployment and verification scripts
- Complete documentation suite

Ready for production deployment to fastpass worker nodes.

Co-authored-by: Talos Specialist <subagent@hermes>

talos/talhelper/talconfig.yaml

@@ -124,55 +124,36 @@ worker:
   patches:
     - |-
       machine:
+        # Load required kernel modules for iSCSI and multipath
         kernel:
           modules:
             - name: iscsi_tcp
             - name: dm_multipath
             - name: dm_round_robin
 
+        # CRITICAL: Explicitly set nodeIP to primary network to avoid dual-NIC issues
+        # Workers have ens18 (10.1.71.x) for K8s traffic and ens19 (10.1.75.x) for iSCSI
         kubelet:
+          nodeIP:
+            validSubnets:
+              - 10.1.71.0/24
+          
           extraMounts:
-            # iSCSI initiator data directory
-            - destination: /etc/iscsi
-              type: bind
-              source: /etc/iscsi
-              options:
-                - bind
-                - rshared
+            # Only mount /var/lib/iscsi (NOT /etc/iscsi)
+            # The iscsi-tools extension manages /etc/iscsi automatically
+            # /var/lib/iscsi contains iSCSI session and node data that must persist
             - destination: /var/lib/iscsi
               type: bind
               source: /var/lib/iscsi
               options:
                 - bind
                 - rshared
+                - rw
 
+        # ARP tuning for dual-NIC setup
         sysctls:
           net.ipv4.conf.all.arp_announce: "2"
           net.ipv4.conf.all.arp_ignore: "1"
-        
-        files:
-          - content: |
-              defaults {
-                  polling_interval 10
-              }
-              devices {
-                  device {
-                      vendor "PURE"
-                      product "FlashArray"
-                      path_selector "queue-length 0"
-                      path_grouping_policy group_by_prio
-                      prio alua
-                      path_checker tur
-                      fast_io_fail_tmo 10
-                      user_friendly_names no
-                      no_path_retry 0
-                      hardware_handler "1 alua"
-                      dev_loss_tmo 600
-                      failback immediate
-                  }
-              }
-            path: /etc/multipath.conf
-            op: create
 
 # ─── Nodes ───────────────────────────────────────────────────────────────────
 nodes: