vtalosconfigtemplate webhook blocks ClusterClass-driven worker upgrades (no TopologyDryRunAnnotation bypass)

[danylomikula]

vtalosconfigtemplate admission webhook unconditionally rejects any Spec change, including the dry-run SSA the CAPI topology controller performs to detect template changes. As a result, ClusterClass variable changes that mutate a worker TalosConfigTemplate (e.g. talosVersion / talosImage bumps) cannot propagate, and worker MachineDeployments stay on the old Talos version indefinitely.

Discovered while testing siderolabs/cluster-api-control-plane-provider-talos#251. Control plane upgrade works fine; only workers are blocked.

Steps to reproduce

1. ClusterClass referencing a TalosConfigTemplate as default-worker.
2. Cluster with spec.topology.variables including talosVersion and talosImage, used in patches that mutate the worker bootstrap template.
3. After cluster is healthy, bump talosVersion (e.g. v1.12 → v1.13) and talosImage and re-apply.
4. Observe Cluster.status.conditions[type=TopologyReconciled].

Observed

TopologyReconciled: error reconciling the Cluster topology: failed to reconcile
MachineDeployment atlas/atlas-worker: failed to create patch helper for
TalosConfigTemplate atlas/atlas-worker-6jrnk: server side apply dry-run failed
for modified object: admission webhook "vtalosconfigtemplate.cluster.x-k8s.io"
denied the request: TalosConfigTemplate.Spec is immutable

Worker MachineDeployment stays on the old Talos version. Control plane rolls out normally (managed by CACPPT, doesn't go through this webhook).

Root cause

api/v1beta1/talosconfigtemplate_webhook.go rejects any Spec change with no bypass for req.DryRun + topology.cluster.x-k8s.io/dry-run. This violates the CAPI TopologyDryRunAnnotation contract, so the topology controller's dry-run SSA fails before it can compute HasSpecChanges and trigger template rotation.

Suggested fix

Skip the immutability check when the admission request is a topology dry-run, using topology.ShouldSkipImmutabilityChecks from sigs.k8s.io/cluster-api/util/topology. This preserves immutability for direct user edits while letting CAPI topology compute spec changes and trigger template rotation. Same change applies to api/v1beta1/talosconfig_webhook.go.

Environment

• CABPT: v0.7.0-alpha.2
• CAPI: v1.13.0
• CACPPT: built from siderolabs/cluster-api-control-plane-provider-talos#251 (under review)