From 6a10ddad606e838a634016b23e37fb48838fb292 Mon Sep 17 00:00:00 2001
From: Olli Hauer <ohauer@gmx.de>
Date: Fri, 3 Jul 2026 08:06:10 +0200
Subject: [PATCH] feat: add trident-nfs-tools extension for NFS support on
 Talos

Trident's chwrap mechanism shells out to mkdir to create NFS mountpoint
directories. Talos Linux does not ship mkdir, causing NFS mounts to fail
with exit status 32.

This extension provides /usr/local/sbin/mkdir (busybox) on the host,
enabling Trident NFS volumes to work on Talos.

Upstream fix: https://github.com/NetApp/trident/pull/1152
Related: https://github.com/NetApp/trident/issues/806

Signed-off-by: Oliver Hauer <ohauer@users.noreply.github.com>
---
 Makefile                                     |  1 +
 storage/trident-nfs-tools/README.md          | 42 ++++++++++++++++++++
 storage/trident-nfs-tools/manifest.yaml.tmpl | 17 ++++++++
 storage/trident-nfs-tools/pkg.yaml           | 27 +++++++++++++
 storage/trident-nfs-tools/vars.yaml          |  3 ++
 5 files changed, 90 insertions(+)
 create mode 100644 storage/trident-nfs-tools/README.md
 create mode 100644 storage/trident-nfs-tools/manifest.yaml.tmpl
 create mode 100644 storage/trident-nfs-tools/pkg.yaml
 create mode 100644 storage/trident-nfs-tools/vars.yaml

diff --git a/Makefile b/Makefile
index 56fad7e8..385f4785 100644
--- a/Makefile
+++ b/Makefile
@@ -131,6 +131,7 @@ TARGETS += tailscale
 TARGETS += tenstorrent
 TARGETS += thunderbolt
 TARGETS += trident-iscsi-tools
+TARGETS += trident-nfs-tools
 TARGETS += uhid
 TARGETS += uinput
 TARGETS += usb-modem-drivers
diff --git a/storage/trident-nfs-tools/README.md b/storage/trident-nfs-tools/README.md
new file mode 100644
index 00000000..ab7dad92
--- /dev/null
+++ b/storage/trident-nfs-tools/README.md
@@ -0,0 +1,42 @@
+# trident-nfs-tools
+
+This extension provides `mkdir` on the host for **NetApp Trident CSI** NFS volume support on Talos Linux.
+
+## Problem
+
+Trident's `chwrap` mechanism shells out to `mkdir` to create NFS mountpoint directories.
+Talos Linux does not ship `mkdir` or any coreutils, causing NFS mounts to fail with:
+
+```
+Mkdir failed: exit status 2
+error mounting NFS volume ... exit status 32
+```
+
+Note: The iSCSI code path in Trident uses Go's native `os.MkdirAll()` and does not
+have this problem. Only the NFS code path shells out to the `mkdir` binary.
+
+## What's Included
+
+* **mkdir** — busybox multi-call binary (only depends on musl libc)
+
+## Use Case
+
+To run [trident-operator](https://github.com/NetApp/trident) with NFS, you need this extension
+in addition to `nfs-utils` (for NFSv3 locking support):
+
+```yaml
+systemExtensions:
+  - siderolabs/nfs-utils
+  - siderolabs/trident-nfs-tools
+```
+
+## Upstream Fix
+
+PR [#1152](https://github.com/NetApp/trident/pull/1152) replaces the `mkdir` shell-out
+with Go's native `os.MkdirAll()`. Once merged and released, this extension will no longer
+be needed.
+
+## References
+
+- [Trident issue #806](https://github.com/NetApp/trident/issues/806)
+- [Trident PR #1152](https://github.com/NetApp/trident/pull/1152)
diff --git a/storage/trident-nfs-tools/manifest.yaml.tmpl b/storage/trident-nfs-tools/manifest.yaml.tmpl
new file mode 100644
index 00000000..a03f8bbd
--- /dev/null
+++ b/storage/trident-nfs-tools/manifest.yaml.tmpl
@@ -0,0 +1,17 @@
+version: v1alpha1
+metadata:
+  name: trident-nfs-tools
+  version: "{{ .VERSION }}"
+  author: Oliver Hauer
+  description: |
+    [{{ .TIER }}] This system extension provides mkdir on the host for NetApp Trident CSI
+    NFS volume support on Talos Linux.
+
+    Trident's chwrap mechanism requires mkdir to be present on the host filesystem.
+    Without it, NFS mounts fail with "exit status 32".
+
+    See: https://github.com/NetApp/trident/issues/806
+    See: https://github.com/NetApp/trident/pull/1152
+  compatibility:
+    talos:
+      version: ">= v1.13.0"
diff --git a/storage/trident-nfs-tools/pkg.yaml b/storage/trident-nfs-tools/pkg.yaml
new file mode 100644
index 00000000..a4f9e9b2
--- /dev/null
+++ b/storage/trident-nfs-tools/pkg.yaml
@@ -0,0 +1,27 @@
+name: trident-nfs-tools
+variant: scratch
+shell: /bin/bash
+dependencies:
+  - stage: base
+steps:
+  - install:
+      - |
+        mkdir -p /rootfs/usr/local/sbin
+
+        # Use busybox mkdir from the build tools image.
+        # busybox is a multi-call binary; when invoked as "mkdir" (argv[0])
+        # it acts as mkdir. Only depends on musl libc which is on Talos.
+        cp /usr/bin/busybox /rootfs/usr/local/sbin/mkdir
+      - |
+        sed -i "s#\$VERSION#{{ .VERSION }}#" /pkg/manifest.yaml
+  - test:
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
+finalize:
+  - from: /rootfs
+    to: /rootfs
+  - from: /pkg/manifest.yaml
+    to: /
diff --git a/storage/trident-nfs-tools/vars.yaml b/storage/trident-nfs-tools/vars.yaml
new file mode 100644
index 00000000..8daac951
--- /dev/null
+++ b/storage/trident-nfs-tools/vars.yaml
@@ -0,0 +1,3 @@
+VERSION: v0.1.0
+
+TIER: "contrib"