fix(ha/cluster-init): fix LIO teardown, mount idempotency, VIP portal

- Remove VIP-specific portal binding — the VIP doesn't exist until Pacemaker
  assigns it; the default all-IPs portal (::0:3260) is correct for Pacemaker
  to manage
- Clear existing LIO targets before re-running targetcli (idempotent on
  partial failures)
- Tear down LIO kernel objects after saveconfig so umount succeeds (LIO holds
  the backing file open otherwise)
- Guard mount with mountpoint check so re-runs don't fail when already mounted
- Use --replace for cibadmin constraints (idempotent vs --create)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HaH1cSGvhogRP5ExoF6nD8

scripts/ha/cluster-init.sh

@@ -165,7 +165,7 @@ fi
 
 log "Mounting ${DRBD_DEVICE} at ${XFS_MOUNT}..."
 mkdir -p "${XFS_MOUNT}"
-mount "${DRBD_DEVICE}" "${XFS_MOUNT}"
+mountpoint -q "${XFS_MOUNT}" || mount "${DRBD_DEVICE}" "${XFS_MOUNT}"
 
 # ── 4. NFS dataset directories ────────────────────────────────────────────
 log "Creating NFS dataset directories..."
@@ -181,21 +181,33 @@ fi
 
 # ── 6. LIO iSCSI target ───────────────────────────────────────────────────
 log "Configuring LIO iSCSI target via targetcli..."
+# Note: do NOT bind portal to ${VIP} here — the VIP isn't assigned yet (Pacemaker
+# creates it).  The default portal (all IPs, port 3260) is correct; Pacemaker's
+# VIP resource will make the target reachable at the VIP address.
+#
+# Clear any existing LIO state first (idempotent: re-run after a partial failure).
+if ls /sys/kernel/config/target/iscsi/ 2>/dev/null | grep -q iqn; then
+  log "Clearing existing LIO targets before reconfiguration..."
+  echo "clearconfig confirm=yes" | targetcli 2>/dev/null || true
+fi
 targetcli <<EOF
 /backstores/fileio create name=ha-lun0 file_or_dev=${ISCSI_LUN_FILE} size=0 write_back=false
 /iscsi create ${ISCSI_IQN}
 /iscsi/${ISCSI_IQN}/tpg1/luns create /backstores/fileio/ha-lun0
-/iscsi/${ISCSI_IQN}/tpg1/portals create ${VIP}
 /iscsi/${ISCSI_IQN}/tpg1 set attribute authentication=0
 /iscsi/${ISCSI_IQN}/tpg1 set attribute demo_mode_write_protect=0
 saveconfig /etc/target/saveconfig.json
 EOF
 
+log "Tearing down LIO kernel objects — Pacemaker will restore via targetctl on the Active node..."
+# LIO holds the backing file open; clear kernel state now so the XFS unmount succeeds.
+echo "clearconfig confirm=yes" | targetcli 2>/dev/null || warn "LIO clearconfig had errors — umount may fail"
+
 log "Distributing iSCSI saveconfig to $NODE2..."
 n2_scp /etc/target/saveconfig.json /etc/target/saveconfig.json
 
 log "Unmounting ${XFS_MOUNT} — Pacemaker manages it..."
-umount "${XFS_MOUNT}"
+umount "${XFS_MOUNT}" || { sync; umount -l "${XFS_MOUNT}"; }
 
 log "Demoting DRBD to Secondary — Pacemaker manages primary role..."
 drbdadm secondary ha-data
@@ -277,7 +289,7 @@ cibadmin --replace --scope resources --xml-text "
 "
 
 log "Adding ordering and colocation constraints..."
-cibadmin --create --scope constraints --xml-text "
+cibadmin --replace --scope constraints --xml-text "
 <constraints>
   <rsc_order id=\"order-drbd-group\" first=\"ms-drbd0\" first-action=\"promote\" then=\"ha-group\" then-action=\"start\"/>
   <rsc_colocation id=\"coloc-group-with-drbd\" rsc=\"ha-group\" with-rsc=\"ms-drbd0\" with-rsc-role=\"Master\" score=\"INFINITY\"/>