Two manual sections describe per-net flavor rules, <target>.srpc.flavor.<network>[.<direction>]=<flavor>. The sections are "Managing Security in a Lustre File System" and "Lustre Shared Secret Key". Add a note about Multi-Rail and LNet Dynamic Peer Discovery to both sections.

The note must say these items:

• A per-net rule matches the net of the primary NID of the other side. The rule does not match the net that an RPC uses.
• The client uses the primary NID of the server. The server uses the primary NID of the client.
• With discovery on, a primary NID can be on any net of the node, and it can change.
• Give the same flavor to each net that a client and a server share. Otherwise the two sides can select different flavors. The server then refuses the RPCs with "unauthorized rpc flavor".
• The 'network' mount option restricts the nets that a client sends on. With discovery on, the primary NID of the client can still be on another net. To select a flavor for the net of a tenant, keep discovery off.

Related tickets: LU-20403 (removes the lock of the primary NID), LU-20384 (per-net rules match again), and LU-20921 (future work).