fix: always override APIServer audit policy

Fixes #7537

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>

pkg/machinery/config/configpatcher/apply_test.go

@@ -130,3 +130,43 @@ func TestApplyMultiDoc(t *testing.T) {
 		})
 	}
 }
+
+//go:embed testdata/auditpolicy/config.yaml
+var configAudit []byte
+
+//go:embed testdata/auditpolicy/expected.yaml
+var expectedAudit []byte
+
+func TestApplyAuditPolicy(t *testing.T) {
+	patches, err := configpatcher.LoadPatches([]string{
+		"@testdata/auditpolicy/patch1.yaml",
+	})
+	require.NoError(t, err)
+
+	cfg, err := configloader.NewFromBytes(configAudit)
+	require.NoError(t, err)
+
+	for _, tt := range []struct {
+		name  string
+		input configpatcher.Input
+	}{
+		{
+			name:  "WithConfig",
+			input: configpatcher.WithConfig(cfg),
+		},
+		{
+			name:  "WithBytes",
+			input: configpatcher.WithBytes(configAudit),
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			out, err := configpatcher.Apply(tt.input, patches)
+			require.NoError(t, err)
+
+			bytes, err := out.Bytes()
+			require.NoError(t, err)
+
+			assert.Equal(t, string(expectedAudit), string(bytes))
+		})
+	}
+}

pkg/machinery/config/configpatcher/testdata/auditpolicy/config.yaml

@@ -0,0 +1,13 @@
+version: v1alpha1
+machine:
+  network:
+    hostname: hostname-foo
+cluster:
+  apiServer:
+    auditPolicy:
+      apiVersion: audit.k8s.io/v1
+      kind: Policy
+      rules:
+        - level: Metadata
+  controlPlane:
+    endpoint: https://localhost:6443

pkg/machinery/config/configpatcher/testdata/auditpolicy/expected.yaml

@@ -0,0 +1,16 @@
+version: v1alpha1
+machine:
+    type: ""
+    token: ""
+    certSANs: []
+    network:
+        hostname: hostname-foo
+cluster:
+    controlPlane:
+        endpoint: https://localhost:6443
+    apiServer:
+        auditPolicy:
+            apiVersion: audit.k8s.io/v1
+            kind: Policy
+            rules:
+                - level: None

pkg/machinery/config/configpatcher/testdata/auditpolicy/patch1.yaml

@@ -0,0 +1,7 @@
+cluster:
+  apiServer:
+    auditPolicy:
+      apiVersion: audit.k8s.io/v1
+      kind: Policy
+      rules:
+        - level: None

pkg/machinery/config/types/v1alpha1/v1alpha1_types.go

@@ -1693,7 +1693,7 @@ type APIServerConfig struct {
 	//     - value: APIServerDefaultAuditPolicy
 	//   schema:
 	//     type: object
-	AuditPolicyConfig Unstructured `yaml:"auditPolicy,omitempty"`
+	AuditPolicyConfig Unstructured `yaml:"auditPolicy,omitempty" merge:"replace"`
 	//   description: |
 	//     Configure the API server resources.
 	//   schema:

website/content/v1.5/talos-guides/configuration/patching.md

@@ -49,6 +49,7 @@ There are some special rules:
   - values of the fields `cluster.network.podSubnets` and `cluster.network.serviceSubnets` are overwritten on merge
   - `network.interfaces` section is merged with the value in the machine config if there is a match on `interface:` or `deviceSelector:` keys
   - `network.interfaces.vlans` section is merged with the value in the machine config if there is a match on the `vlanId:` key
+  - `cluster.apiServer.auditPolicy` value is replaced on merge
 
 When patching a multi-document machine configuration, following rules apply: