Five findings from the #3294 review rounds, each with a guard that fails
without the fix.
[MAJOR] The Talos<->Kubernetes support matrix keyed only on talos.version, so
a pool could keep a supported talos.version and still boot a Talos release
outside the kubelet's support window through image.builtin.version or
image.factory.version, with no render failure. The matrix moves into a named
template in _helpers.tpl and both paths consult it -- the pool default at the
top of nodegroup.yaml, the resolved version where the image is resolved. A
Talos minor the table does not list still passes, unchanged, because failing
closed on a hand-maintained table would block an operator moving to a newer
Talos before the table is updated.
[MINOR] schematicID, version and imageFactoryURL reach an unquoted YAML scalar
in the KubevirtMachineTemplate, and a value carrying a newline or a YAML
metacharacter injects keys into the pool's own template. The schema cannot
narrow them -- the pinned cozyvalues-gen derives `pattern` from the value type
and has no annotation for a custom one -- so they are pattern-checked at
render, which is where this chart already validates the kubelet reservation
fields against the same hazard. The clone-path DataVolume name is quoted too;
the HTTP url deliberately is not, because quoting it changes the KMT content
hash and rolls every live worker.
[MINOR] A golden was referenced only from inside a VM dataVolumeTemplates
source, so nothing told an operator which pools still pinned it -- and a pool
on `builtin: {}` does not name it in its own CR either. Every cloned worker
disk now annotates its source golden, and the catalog documents the one read
that answers "is this golden still in use".
[MINOR] An images[] entry is effectively immutable once its golden exists: the
DataVolume is named from (schematicID, version) while storage, storageClass
and the URL are rendered into a spec that cannot be patched in place. The
catalog said the opposite, inviting a `storage` bump. It now says to add a new
entry instead.
[MAJOR, residual] Nothing tied the parent kubernetes chart's talos defaults to
kubernetes-nodes'. Both declare "keep in sync", the pool chart's `make update`
copies neither, and the catalog drift guard reads only one of the two files. A
one-sided bump now trips three checks instead of none.
Assisted-By: LLM
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Myasnikov Daniil
f489e78265