feat: Talos 1.11/1.12+ multi-document configuration migration

[mlinares1998]

Summary

Hi @M4t7e! 👋

This PR lays the groundwork required to fully upgrade to Talos v1.12+, introducing a modular architecture for the new multi-document YAML configuration.

The goal is to address pending v1.11/v1.12 migrations from the legacy v1alpha1 machine configuration to the new document-based approach.

References:

• What's New in Talos 1.11
• What's New in Talos 1.12

---

Architecture Changes

Replaced the monolithic talos_config.tf approach with dedicated files for each document type:

talos_manifest_machineconfig.tf       → v1alpha1 machine config (core settings)
talos_manifest_hostnameconfig.tf      → Hostname configuration
talos_manifest_resolverconfig.tf      → DNS nameserver configuration
talos_manifest_statichostconfig.tf    → Static /etc/hosts entries
talos_manifest_timesyncconfig.tf      → NTP time synchronization
talos_manifest_network.tf             → Network interface configuration
talos_manifest_volumeconfig.tf        → Disk encryption configuration
talos_manifest_oomconfig.tf           → Out of Memory handler configuration
talos_manifest_uservolumeconfig.tf    → User volumes on EPHEMERAL partition
talos_manifest_registries.tf          → Container registry configuration
talos_manifest_trustedroots.tf        → Custom CA certificates

Each file generates standalone configuration documents that are combined in talos_config.tf via the config_patches mechanism.

---

Current Progress

Feature	Status
Disk encryption → VolumeConfig	✅ Done
Hostname configuration → HostnameConfig	✅ Done
DNS nameservers → ResolverConfig	✅ Done
Static /etc/hosts entries → StaticHostConfig	✅ Done
NTP time sync → TimeSyncConfig	✅ Done
Network interfaces → LinkConfig, DHCPv4Config, HCloudVIPConfig	✅ Done
Registry configuration → RegistryMirrorConfig, RegistryTLSConfig, RegistryAuthConfig	✅ Done
UserVolumeConfig with volumeType: directory	✅ Done
OOMConfig document support	✅ Done
TrustedRootsConfig for custom CA certificates	✅ Done

---

New Features

Directory Volumes (UserVolumeConfig)

Talos 1.12 introduces a new UserVolumeConfig document with directory support. This allows creating bind mounts directly on the ephemeral partition without provisioning new partitions.

Configuration variables:

• control_plane_directory_volumes - List of volume names for control plane nodes
• worker_directory_volumes - List of volume names for worker nodes
• cluster_autoscaler_directory_volumes - List of volume names for autoscaler nodes

Userspace OOM Handler (OOMConfig)

Talos 1.12 introduces a new OOMConfig document to configure the new userspace OOM handler behavior. The OOM handler is always enabled by default with sensible built-in settings.

Configuration variables:

• talos_custom_oom_enabled - Enable custom OOM configuration (default: false)
• talos_custom_oom_trigger_expression - Custom trigger CEL expression
• talos_custom_oom_cgroup_ranking_expression - Custom ranking CEL expression
• talos_custom_oom_sample_interval - Custom evaluation interval (e.g., "100ms", "500ms")

Custom CA Certificates (TrustedRootsConfig)

New support for adding custom CA certificates to the system trust store beyond Talos defaults.

Configuration variables:

• talos_trusted_roots_certificates - List of PEM-encoded CA certificates

---

I hope this approach suits well for the incoming v4 release.

Regards! 🚀

[mlinares1998]

Hi @M4t7e, PR's ready for your review! 😄
Let me know if anything needs changes.