🐛Remove the CEL validation on VSphereMachineTemplate.spec.network

[DanielXiao]

When the Cluster API topology controller does a dry-run patch on the VSphereMachineTemplate to figure out if there are changes to apply, it fails with below error:

server side apply dry-run failed for modified object: VSphereMachineTemplate.vmware.infrastructure.cluster.x-k8s.io "guestcluster1-rhhvs" is invalid: spec.template.spec: Invalid value: "object": field ''network'' cannot be added or removed after creation

Move diff validation on VSphereMachineTemplate spec to Webhook and Skip validation if it 's triggerd by server side dry-run.

Test modifying VSphereMachineTemplate:

❯ kubectl edit vspheremachinetemplate -n tkgs-test coffee-workers-2dz2l
error: vspheremachinetemplates.vmware.infrastructure.cluster.x-k8s.io "coffee-workers-2dz2l" could not be patched: admission webhook "validation.vspheremachinetemplate.vmware.infrastructure.cluster.x-k8s.io" denied the request: spec.template.spec: Invalid value: v1beta1.VSphereMachineTemplate{TypeMeta:v1.TypeMeta{Kind:"VSphereMachineTemplate", APIVersion:"vmware.infrastructure.cluster.x-k8s.io/v1beta1"}, ObjectMeta:v1.ObjectMeta{Name:"coffee-workers-2dz2l", GenerateName:"", Namespace:"tkgs-test", SelfLink:"", UID:"f82a2003-429b-44d8-92d5-7ee66d6cdb35", ResourceVersion:"4757840", Generation:2, CreationTimestamp:time.Date(2025, time.September, 1, 10, 50, 11, 0, time.Local), DeletionTimestamp:<nil>, DeletionGracePeriodSeconds:(*int64)(nil), Labels:map[string]string{"cluster.x-k8s.io/cluster-name":"coffee", "kapp.k14s.io/app":"1756282494296777655", "kapp.k14s.io/association":"v1.887bec453a550dde4e67046b32701b45", "kubernetes.vmware.com/managed-by":"vks", "topology.cluster.x-k8s.io/deployment-name":"workers", "topology.cluster.x-k8s.io/owned":""}, Annotations:map[string]string{"cluster.x-k8s.io/cloned-from-groupkind":"VSphereMachineTemplate.vmware.infrastructure.cluster.x-k8s.io", "cluster.x-k8s.io/cloned-from-name":"tkc-md-v3.5.0", "kapp.k14s.io/identity":"v1;vmware-system-vks-public/vmware.infrastructure.cluster.x-k8s.io/VSphereMachineTemplate/tkc-md-v3.5.0;vmware.infrastructure.cluster.x-k8s.io/v1beta1", "kapp.k14s.io/original":"{\"apiVersion\":\"vmware.infrastructure.cluster.x-k8s.io/v1beta1\",\"kind\":\"VSphereMachineTemplate\",\"metadata\":{\"labels\":{\"kapp.k14s.io/app\":\"1756282494296777655\",\"kapp.k14s.io/association\":\"v1.887bec453a550dde4e67046b32701b45\",\"kubernetes.vmware.com/managed-by\":\"vks\"},\"name\":\"tkc-md-v3.5.0\",\"namespace\":\"vmware-system-vks-public\"},\"spec\":{\"template\":{\"spec\":{\"className\":\"\",\"imageName\":\"\",\"storageClass\":\"\"}}}}", "kapp.k14s.io/original-diff-md5":"5351bf566e31f83ae633bb0d962aed16"}, OwnerReferences:[]v1.OwnerReference{v1.OwnerReference{APIVersion:"cluster.x-k8s.io/v1beta2", Kind:"Cluster", Name:"coffee", UID:"cc24afe5-ef4d-46ad-99a7-2a02d90ffe48", Controller:(*bool)(nil), BlockOwnerDeletion:(*bool)(nil)}}, Finalizers:[]string(nil), ManagedFields:[]v1.ManagedFieldsEntry{v1.ManagedFieldsEntry{Manager:"capi-topology", Operation:"Apply", APIVersion:"vmware.infrastructure.cluster.x-k8s.io/v1beta1", Time:time.Date(2025, time.September, 1, 10, 50, 11, 0, time.Local), FieldsType:"FieldsV1", FieldsV1:(*v1.FieldsV1)(0xc001e739b0), Subresource:""}, v1.ManagedFieldsEntry{Manager:"manager", Operation:"Update", APIVersion:"vmware.infrastructure.cluster.x-k8s.io/v1beta1", Time:time.Date(2025, time.September, 1, 10, 50, 11, 0, time.Local), FieldsType:"FieldsV1", FieldsV1:(*v1.FieldsV1)(0xc001e739e0), Subresource:"status"}, v1.ManagedFieldsEntry{Manager:"kubectl-edit", Operation:"Update", APIVersion:"vmware.infrastructure.cluster.x-k8s.io/v1beta1", Time:time.Date(2025, time.September, 1, 10, 52, 12, 0, time.Local), FieldsType:"FieldsV1", FieldsV1:(*v1.FieldsV1)(0xc001e73a10), Subresource:""}}}, Spec:v1beta1.VSphereMachineTemplateSpec{Template:v1beta1.VSphereMachineTemplateResource{Spec:v1beta1.VSphereMachineSpec{ProviderID:(*string)(nil), FailureDomain:(*string)(nil), ImageName:"vmi-ae52cc8f387747da4", ClassName:"best-effort-medium", StorageClass:"wcpglobal-storage-profile", Volumes:[]v1beta1.VSphereMachineVolume(nil), Network:v1beta1.VSphereMachineNetworkSpec{Interfaces:v1beta1.InterfacesSpec{Primary:v1beta1.InterfaceSpec{Network:v1beta1.InterfaceNetworkReference{Kind:"", Name:"", APIVersion:""}, MTU:0, Routes:[]v1beta1.RouteSpec(nil)}, Secondary:[]v1beta1.SecondaryInterfaceSpec{v1beta1.SecondaryInterfaceSpec{Name:"eth1", InterfaceSpec:v1beta1.InterfaceSpec{Network:v1beta1.InterfaceNetworkReference{Kind:"Network", Name:"antrea-secondary", APIVersion:"netoperator.vmware.com/v1alpha1"}, MTU:0, Routes:[]v1beta1.RouteSpec(nil)}}}}}, PowerOffMode:"hard", MinHardwareVersion:"", NamingStrategy:(*v1beta1.VirtualMachineNamingStrategy)(nil)}}}, Status:v1beta1.VSphereMachineTemplateStatus{Capacity:v1.ResourceList{"cpu":resource.Quantity{i:resource.int64Amount{value:2, scale:0}, d:resource.infDecAmount{Dec:(*inf.Dec)(nil)}, s:"2", Format:"DecimalSI"}, "memory":resource.Quantity{i:resource.int64Amount{value:4294967296, scale:0}, d:resource.infDecAmount{Dec:(*inf.Dec)(nil)}, s:"4Gi", Format:"BinarySI"}}}}: VSphereMachineTemplate spec.template.spec field is immutable. Please create a new resource instead. Diff: v1beta1.VSphereMachineSpec{
    ProviderID:    nil,
    FailureDomain: nil,
    ImageName:     "vmi-ae52cc8f387747da4",
-   ClassName:     "best-effort-small",
+   ClassName:     "best-effort-medium",
    StorageClass:  "wcpglobal-storage-profile",
    Volumes:       nil,
    ... // 4 identical fields
  }
You can run `kubectl replace -f /var/folders/hd/qpb0lksn7p1_ft4y7z0djfjm0000gq/T/kubectl-edit-136286660.yaml` to try this update again.

What this PR does / why we need it:

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #

[sbueringer]

/cherry-pick release-1.14

[k8s-infra-cherrypick-robot]

@sbueringer: once the present PR merges, I will cherry-pick it on top of release-1.14 in a new PR and assign it to you.

In response to this:

/cherry-pick release-1.14

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[sbueringer]

Thx!

/lgtm
/approve

[k8s-ci-robot]

LGTM label has been added.

Git tree hash: c37e06da2f7f8292d5a249fd7441f5526f8ec3e2

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: sbueringer

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [sbueringer]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[k8s-infra-cherrypick-robot]

@sbueringer: new pull request created: #3624

In response to this:

/cherry-pick release-1.14

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.