No way to remove or override nameservers, they can only come from discovery

[myasnikovdaniil]

What is wrong?

Both presets take nameservers only from discovery, charts/talm/templates/_helpers.tpl:273:

{{- define "talm.discovered.default_resolvers" }}
{{- with (lookup "resolvers" "" "resolvers") }}
{{- toJson .spec.dnsServers }}

It goes into ResolverConfig on 1.12+ and into machine.network.nameservers on legacy schema. There is no nameservers key in charts/generic/values.yaml or charts/cozystack/values.yaml, so operator cant change it from values at all.

lookup "resolvers" returns effective dns of the node, and effective dns is exactly what previous talm apply wrote there, so every render puts the same nameservers back. Removing them from templates changes nothing.

Override in node body doesn't work too. Talos merges slices by concatenation unless the field has merge:"replace" tag (config/merge/merge.go:24), and nameservers doesn't have it, neither in ResolverConfig nor in v1alpha1. So entries can only be added, never removed. Same mechanics as #77.

In result whatever dns the node had on first apply is pinned in config forever. On dhcp node it bakes dhcp provided servers, or 1.1.1.1 and 8.8.8.8 that talos falls back to when nothing else is set.

Only workaround I found is $patch: delete in node body:

apiVersion: v1alpha1
kind: ResolverConfig
nameservers:
  - address: 8.8.8.8
    $patch: delete

and it has to stay in node file forever, because discovery will pick up whatever is effective on the next render.

Seen on talos 1.12.6.

How it should work?

nameservers value in both presets, same shape as advertisedSubnets already has: when set it replaces discovery, when empty discovery is used.