fix: sort mirrors and tls configs when generating the machine config

Unix4ever · smira · commit 3b974b99e583 · 2026-01-21T16:24:09.000+04:00
As registry mirrors are using map to save all defined options without sort it is not deterministic. Signed-off-by: Artem Chernyshev <artem.chernyshev@talos-systems.com> (cherry picked from commit 71adaf0)
diff --git a/pkg/machinery/config/generate/generate_test.go b/pkg/machinery/config/generate/generate_test.go
@@ -9,10 +9,13 @@ import (
 	"fmt"
 	"testing"
 
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	"github.com/stretchr/testify/suite"
 
 	"github.com/siderolabs/talos/pkg/machinery/client"
 	"github.com/siderolabs/talos/pkg/machinery/config"
+	mc "github.com/siderolabs/talos/pkg/machinery/config/config"
 	"github.com/siderolabs/talos/pkg/machinery/config/generate"
 	"github.com/siderolabs/talos/pkg/machinery/config/machine"
 	"github.com/siderolabs/talos/pkg/machinery/constants"
@@ -134,6 +137,29 @@ func (suite *GenerateSuite) TestGenerateTalosconfigSuccess() {
 	suite.Equal([]string{string(role.Admin)}, cert.Subject.Organization)
 }
 
+func TestGenerateRegistryMirrorsOrder(t *testing.T) {
+	t.Parallel()
+
+	input, err := generate.NewInput("test", "https://10.0.1.5", constants.DefaultKubernetesVersion,
+		generate.WithRegistryMirror("b.com", "http://127.0.0.1:5004"),
+		generate.WithRegistryMirror("a.com", "http://127.0.0.1:5005"),
+	)
+
+	require.NoError(t, err)
+
+	cfg, err := input.Config(machine.TypeControlPlane)
+
+	require.NoError(t, err)
+
+	named, ok := cfg.Documents()[1].(mc.NamedDocument)
+	require.True(t, ok)
+	assert.Equal(t, "a.com", named.Name())
+
+	named, ok = cfg.Documents()[2].(mc.NamedDocument)
+	require.True(t, ok)
+	assert.Equal(t, "b.com", named.Name())
+}
+
 type runtimeMode struct {
 	requiresInstall bool
 }
diff --git a/pkg/machinery/config/generate/registry.go b/pkg/machinery/config/generate/registry.go
@@ -7,6 +7,8 @@ package generate
 import (
 	"fmt"
 	"net/url"
+	"slices"
+	"strings"
 
 	"github.com/siderolabs/go-pointer"
 
@@ -16,7 +18,7 @@ import (
 	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
 )
 
-//nolint:gocyclo
+//nolint:gocyclo,cyclop
 func (in *Input) generateRegistryConfigs(machine *v1alpha1.MachineConfig) ([]config.Document, error) {
 	if !in.Options.VersionContract.MultidocNetworkConfigSupported() {
 		// old-style registry config
@@ -112,5 +114,21 @@ func (in *Input) generateRegistryConfigs(machine *v1alpha1.MachineConfig) ([]con
 		documents = append(documents, tlsConfig)
 	}
 
+	// sort the TLS config and registry mirrors docs alphabetically by the name
+	slices.SortStableFunc(documents, func(a, b config.Document) int {
+		na, aok := a.(config.NamedDocument)
+		nb, bok := b.(config.NamedDocument)
+
+		if c := strings.Compare(a.Kind(), b.Kind()); c != 0 {
+			return c
+		}
+
+		if aok && bok {
+			return strings.Compare(na.Name(), nb.Name())
+		}
+
+		return 0
+	})
+
 	return documents, nil
 }
