feat: custom image settings for k8s upgrade

[mstrohl]

Pull Request

Fixes: #8275

What? (description)

• Adding management of private registries for k8s upgrades
• set image before condition
• format

Due to the usage of authentication for image pullin adding this in the pre-pull feature was to big that is why we enable the feature only on --pre-pull=false.
It could be another feature.

Why? (reasoning)

The cli patch MachineConfig using public registries. This break automatic upgrade because of public registries overwriting.

Acceptance

Please use the following checklist:

• you linked an issue (if applicable)
• you included tests (if applicable)
• you ran conformance (make conformance)
• you formatted your code (make fmt)
• you linted your code (make lint)
• you generated documentation (make docs)
• you ran unit-tests (make unit-tests)

See make help for a description of the available targets.

Co-author : @g3offrey

[smira]

this PR sounds good, but it has a subtle issue - previously talosctl would always set the proper image ref, but right now it will try to update the previous one.

upstream k8s images, as well as Talos-provided kubelet images were migrated a couple of times, and this change will break that migration

k8s.gcr.io -> registry.k8s.io
ghcr.io/talos-systems -> ghcr.io/siderolabs

[smira]

the reason I brought this up is that probably a more proper way is to use flags which give you base image references for each component, and you can override them if you want, but the tool still always doesn't patch the tag, but sets a complete reference.

also there's another ticket about pinning the images using digests (SHAs), which this PR would not support (but currently upgrade-k8s doesn't support them either)

[mstrohl]

Another commit will be pushed to add a flag for upgrade options

[mstrohl]

@smira I'm trying to manage proxy image too but I'm not sure where is managed .ProxyImage in DaemonSet template and if the manifest is managed differently between init and upgrade be cause as far as I know the version of the proxy image is base on talosctl default kubernetes version

[smira]

@smira I'm trying to manage proxy image too but I'm not sure where is managed .ProxyImage in DaemonSet template and if the manifest is managed differently between init and upgrade be cause as far as I know the version of the proxy image is base on talosctl default kubernetes version

not sure what you mean, but talosctl upgrade-k8s does similar action in the end - it patches machine config with new version (and then fetches back manifests from Talos and syncs against Kubernetes, but that is less important).

[mstrohl]

Hello, I just have tested new flag and proxy kubelet images management that works well. Any change to see the PR moving forward ? (FYI gpg has been generated in a wsl, and i'm can't understand what is appening on number of commits.

Regards

[smira]

it's not quite the way I saw this change, but I can take a look if I can twist the way I'd like to. We'll get it reviewed.

[mstrohl]

Ok thank you, I wanted to wait this on to be merged before make a proposal on the digest capability base on that code.

[smira]

/ok-to-test

[smira]

@mstrohl please take a look, I reworked it to be a bit different, and more flexible

[mstrohl]

@smira look good to me

[smira]

/promote integration-provision

[frezbo]

Maybe a release notes too?

[smira]

Maybe a release notes too?

probably, and also some words in the docs

[smira]

/m

[smira]

/m