feat: add filesystem scrubbing controller

api/resource/definitions/block/block.proto

@@ -6,6 +6,8 @@ option go_package = "github.com/siderolabs/talos/pkg/machinery/api/resource/defi
 option java_package = "dev.talos.api.resource.definitions.block";
 
 import "google/api/expr/v1alpha1/checked.proto";
+import "google/protobuf/duration.proto";
+import "google/protobuf/timestamp.proto";
 import "resource/definitions/enums/enums.proto";
 
 // DeviceSpec is the spec for devices status.
@@ -100,6 +102,29 @@ message EncryptionSpec {
   repeated string perf_options = 6;
 }
 
+// FSScrubConfigSpec describes configuration of watchdog timer.
+message FSScrubConfigSpec {
+  string name = 1;
+  string mountpoint = 2;
+  google.protobuf.Duration period = 3;
+}
+
+// FSScrubScheduleSpec describes scheduled filesystem scrubbing jobs.
+message FSScrubScheduleSpec {
+  string mountpoint = 1;
+  google.protobuf.Duration period = 2;
+  google.protobuf.Timestamp start_time = 3;
+}
+
+// FSScrubStatusSpec describes status of filesystem scrub jobs.
+message FSScrubStatusSpec {
+  string mountpoint = 1;
+  google.protobuf.Duration period = 2;
+  google.protobuf.Timestamp time = 3;
+  google.protobuf.Duration duration = 4;
+  string status = 5;
+}
+
 // FilesystemSpec is the spec for volume filesystem.
 message FilesystemSpec {
   talos.resource.definitions.enums.BlockFilesystemType type = 1;

api/resource/definitions/enums/enums.proto

@@ -462,3 +462,11 @@ enum RuntimeSELinuxState {
   SE_LINUX_STATE_ENFORCING = 2;
 }
 
+// RuntimeTaskState describes the task state.
+enum RuntimeTaskState {
+  TASK_STATE_CREATED = 0;
+  TASK_STATE_RUNNING = 1;
+  TASK_STATE_STOPPING = 2;
+  TASK_STATE_COMPLETED = 3;
+}
+

api/resource/definitions/runtime/runtime.proto

@@ -7,6 +7,7 @@ option java_package = "dev.talos.api.resource.definitions.runtime";
 
 import "common/common.proto";
 import "google/protobuf/duration.proto";
+import "google/protobuf/timestamp.proto";
 import "resource/definitions/enums/enums.proto";
 
 // DevicesStatusSpec is the spec for devices status.
@@ -126,6 +127,22 @@ message SecurityStateSpec {
   talos.resource.definitions.enums.RuntimeSELinuxState se_linux_state = 4;
 }
 
+// TaskSpec describes a background task to be run by a schedule.
+message TaskSpec {
+  string id = 1;
+  string task_name = 2;
+  repeated string args = 3;
+}
+
+// TaskStatusSpec describes configuration of watchdog timer.
+message TaskStatusSpec {
+  string id = 1;
+  talos.resource.definitions.enums.RuntimeTaskState task_status = 2;
+  int64 exit_code = 3;
+  google.protobuf.Timestamp start = 4;
+  google.protobuf.Duration duration = 5;
+}
+
 // UniqueMachineTokenSpec is the spec for the machine unique token. Token can be empty if machine wasn't assigned any.
 message UniqueMachineTokenSpec {
   string token = 1;

fsscrub.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1alpha1
+kind: FilesystemScrubConfig
+name: var # Name of the config document.
+mountpoint: /var # Mountpoint of the filesystem to be scrubbed.
+period: 168s # Period for running the scrub task for this filesystem.