feat(kubernetes): configure per-pool Talos sysctls - #5254

What this PR does

Adds an optional KubernetesNodes.spec.talos.sysctls string map, rendered into machine.sysctls on that pool's guest workers. This lets operators configure the user namespaces needed by the Talos gVisor extension without adding a dedicated API field for each future sysctl.

Replaces the proposal in #4650, following the suggestion to expose a general sysctl map. This is a new branch from main, not a stack on the original PR. The suggestion is not treated as maintainer consensus on the broader API.

spec:
  talos:
    sysctls:
      user.max_user_namespaces: "11255"

• Empty or omitted maps preserve the existing rendered machine configuration and bootstrap hash. A literal "0" is an explicit override; remove the entry to restore the Talos default.
• The existing content-hashed TalosConfigTemplate mechanism updates the MachineDeployment bootstrap reference when overrides change. No new rollout mechanism is introduced.
• Both keys and values are YAML-quoted, then shell-escaped for backslashes, dollars and backticks before entering the unquoted reconcile Job heredoc. Quoting scalars individually also keeps newlines and Unicode line separators from breaking the surrounding YAML or heredoc delimiter.
• Both the generated schema and a render-time guard enforce string values. The template guard is tested with schema validation disabled too.
• Regenerates the schema, parameter reference, Go API type/deepcopy and ApplicationDefinition. The README table alignment change is generator output.

This changes only the selected pool's guest configuration, not the management hosts, control plane or other pools. Supported sysctls and their semantics remain Talos/kernel-dependent; inappropriate settings can weaken guest isolation or prevent boot. Installing the gVisor extension, configuring its RuntimeClass and enforcing workload/network restrictions remain separate steps.

Validation

• helm unittest packages/apps/kubernetes-nodes: 40 suites, 245 tests and 12 existing snapshots passed, without updating snapshots.
• bats hack/check-talosconfigtemplate-name-agreement.bats hack/talos-reconcile-heredoc_test.bats: all 16 tests passed (5 name-agreement and 11 heredoc tests). Covers Job/Role/MachineDeployment name agreement, changed and restored hashes, explicit zero, schema and template type rejection, invalid UTF-8 file inputs, and a literal round-trip through the actual manifest-producing heredoc under Bash and Dash. Hostile keys/values include command substitutions, backticks, variable references, backslashes, quotes, newlines and Unicode separators; no marker command executes, and runtime placeholders still expand. The UTF-8 regression was observed failing before the fix with schema validation disabled; valid Unicode including U+FFFD remains accepted.
• bats hack/bats-no-exit-trap.bats hack/bats-no-negated-assert.bats: all 32 tests passed.
• Package make generate with cozyvalues-gen v1.7.0 and root make generate: repeat runs are idempotent. Root make manifests passed.
• go test ./kubernetesnodes and go vet ./kubernetesnodes in api/apps/v1alpha1 passed; the generated API package has no test files.

No live cluster rollout or gVisor execution was tested for this PR. make show could not run because cozyhr is unavailable locally; offline chart rendering is exercised by the Helm and BATS tests above. Worker replacement and rollback still need staging validation. This main-branch change is not drop-in support for the release-1.6 nodeGroups API.

Screenshots

Not applicable; no UI changes.

Downstream repositories

• No downstream repository is affected by this change
• cozystack/website - the existing K8S_NODES reference imports this package's generated README at release; no manual docs contract changes.
• cozystack/terraform-provider-cozystack - follow-up: Support KubernetesNodes talos.sysctls after upstream API acceptance terraform-provider-cozystack#72; adapt the existing follow-up to the general talos.sysctls map after the upstream API is accepted, rather than implementing the superseded dedicated field.
• cozystack/ansible-cozystack - follow-up:
• cozystack/ccp - follow-up:
• cozystack/talm - follow-up:
• cozystack/cozyhr - follow-up:
• cozystack/cozy-proxy - follow-up:
• cozystack/cozystack-telemetry-server - follow-up:
• cozystack/external-apps-example - follow-up:
• cozystack/examples - follow-up:
• cozystack/community - follow-up:

The other trigger-map entries are unaffected: no management-node prerequisite, package name, controller contract, tooling, image or release convention changes. No downstream implementation or live deployment is included.

Release note

feat(kubernetes): add an optional per-pool KubernetesNodes talos.sysctls string map for Talos worker machine.sysctls overrides, preserving defaults and using the existing bootstrap rollout mechanism.

Summary by CodeRabbit

• New Features
  • Added optional string-valued sysctl overrides for worker nodes in a pool. The default is empty and preserves existing behavior. Adding, changing, or removing overrides updates the worker configuration and rolls the pool.
• Bug Fixes
  • Invalid sysctl configuration types and invalid UTF-8 values are rejected during validation.
• Documentation
  • Documented the setting’s scope, rollout behavior, and compatibility considerations, including that it does not configure gVisor. Clarified HTTPS certificate configuration and when it applies.
• Improvements
  • Adjusted installation waiting behavior and timeout for Kubernetes node pools. Updated the ordering of displayed configuration options.