fix(applycheck): accept stable disk symlinks for RefKindDiskLiteral

machine.install.disk is most safely written as a /dev/disk/by-id/
or /dev/disk/by-path/ form — the kernel-assigned /dev/sdX names
reorder across reboots, but the udev-managed symlinks pin to the
underlying device. Talos's block.DiskSpec exposes those alternate
forms in spec.symlinks; the gate must accept any of them as
equivalent to spec.dev_path.

Without this fix, the recommended-for-production literal
'disk: /dev/disk/by-id/wwn-0x...' surfaced a Phase 1 blocker with
a hint listing only /dev/sda — pushing operators toward the
unstable kernel name. cosiLinksDisksReader now carries Symlinks
into the snapshot; ValidateRefs builds the path set from
DevPath + Symlinks. Verified on the dev17 OCI cluster: a by-id
literal that previously blocked now passes Phase 1.

Refs: #172
Signed-off-by: Aleksei Sviridkin <f@lex.la>

Author: lexfrei

pkg/applycheck/validate.go

@@ -29,6 +29,13 @@ type HostSnapshot struct {
 // predicate over Transport + Rotational, mirrored in matchSelector.
 // CDROM and Readonly devices are excluded by Talos's install-disk
 // resolution; matchSelector mirrors that exclusion.
+//
+// Symlinks captures the alternate path forms Talos exposes for the
+// same device (/dev/disk/by-id/wwn-…, /dev/disk/by-path/pci-…,
+// /dev/disk/by-diskseq/…); RefKindDiskLiteral validation accepts any
+// of these as equivalent to DevPath, because by-id paths are the
+// recommended stable form for `machine.install.disk` and an operator
+// using them is doing the right thing.
 type DiskInfo struct {
 	DevPath    string // /dev/sda
 	Model      string
@@ -42,6 +49,7 @@ type DiskInfo struct {
 	Rotational bool
 	Readonly   bool
 	CDROM      bool
+	Symlinks   []string
 }
 
 // Severity classifies a finding's blocker status.
@@ -90,9 +98,18 @@ func ValidateRefs(refs []Ref, snapshot HostSnapshot) []Finding {
 		linkSet[name] = struct{}{}
 	}
 
-	diskPaths := make(map[string]struct{}, len(snapshot.Disks))
+	// Disk-literal validation accepts DevPath (`/dev/sda`) and every
+	// stable Symlink alternative (/dev/disk/by-id/wwn-…, by-path/…,
+	// by-diskseq/…). The recommended Talos pattern is by-id, so the
+	// gate must not reject by-id literals.
+	diskPaths := make(map[string]struct{}, len(snapshot.Disks)*4) //nolint:mnd // upper-bound estimate for sym-count.
 	for i := range snapshot.Disks {
-		diskPaths[snapshot.Disks[i].DevPath] = struct{}{}
+		d := &snapshot.Disks[i]
+		diskPaths[d.DevPath] = struct{}{}
+
+		for _, sym := range d.Symlinks {
+			diskPaths[sym] = struct{}{}
+		}
 	}
 
 	var findings []Finding

pkg/applycheck/validate_test.go

@@ -85,6 +85,40 @@ func TestValidateRefs_DiskLiteralMissing_EmitsBlocker(t *testing.T) {
 	}
 }
 
+// TestValidateRefs_DiskLiteralByID_AcceptedViaSymlink pins the
+// contract: machine.install.disk accepts the by-id /
+// by-path / by-diskseq stable forms Talos exposes via Disk.Symlinks.
+// These are the recommended forms for stable boot ordering, so the
+// gate must not block them — verified on the dev17 OCI cluster where
+// /dev/sda surfaces /dev/disk/by-id/wwn-0x602742… as a symlink.
+func TestValidateRefs_DiskLiteralByID_AcceptedViaSymlink(t *testing.T) {
+	t.Parallel()
+
+	refs := []applycheck.Ref{{
+		Kind: applycheck.RefKindDiskLiteral,
+		Name: "/dev/disk/by-id/wwn-0x602742ce4e9046729ae81c05166f4d8e",
+	}}
+	snapshot := applycheck.HostSnapshot{
+		Disks: []applycheck.DiskInfo{
+			{
+				DevPath: "/dev/sda",
+				WWID:    "naa.602742ce4e9046729ae81c05166f4d8e",
+				Symlinks: []string{
+					"/dev/disk/by-diskseq/23",
+					"/dev/disk/by-id/scsi-3602742ce4e9046729ae81c05166f4d8e",
+					"/dev/disk/by-id/wwn-0x602742ce4e9046729ae81c05166f4d8e",
+					"/dev/disk/by-path/pci-0000:00:04.0-scsi-0:0:0:1",
+				},
+			},
+		},
+	}
+
+	findings := applycheck.ValidateRefs(refs, snapshot)
+	if len(findings) != 0 {
+		t.Errorf("by-id symlink should resolve to /dev/sda; gate must not block, got findings=%+v", findings)
+	}
+}
+
 func TestValidateRefs_SelectorZeroMatches_Blocker(t *testing.T) {
 	t.Parallel()
 

pkg/commands/preflight_apply_safety.go

@@ -301,6 +301,7 @@ func cosiLinksDisksReader(c *client.Client) linksDisksReader {
 				Rotational: spec.Rotational,
 				Readonly:   spec.Readonly,
 				CDROM:      spec.CDROM,
+				Symlinks:   append([]string(nil), spec.Symlinks...),
 			})
 		}