machineconfig patch drops base-side CEL expressions and byte sizes when a later patch merges into the same document #14584

Bug Report

What happened? What did you expect?

When a patch merges into an existing config document, CEL expressions and minSize values in the base document are dropped, even when the patch does not mention them. Plain fields (wipe, grow) and maxSize are kept.

I hit it with a layered set of patches for UnattendedInstallConfig: talosctl validate failed with provisioning.diskSelector.match is required, because an earlier patch's match was gone from the rendered config.

Expected: a field that the patch does not set keeps its base value.

Steps to reproduce

Client-side only, no node needed. 100% reproducible on talosctl v1.14.2.

base.yaml

apiVersion: v1alpha1
kind: UnattendedInstallConfig
provisioning:
  diskSelector:
    match: 'disk.dev_path == "/dev/nvme0n1"'
  wipe: false

patch.yaml

apiVersion: v1alpha1
kind: UnattendedInstallConfig
installer:
  image: example.test/installer:v1.14.2

talosctl machineconfig patch base.yaml --patch @patch.yaml

Output (no diskSelector):

apiVersion: v1alpha1
kind: UnattendedInstallConfig
installer:
    image: example.test/installer:v1.14.2
provisioning:
    wipe: false

Same loss with minSize: a base UserVolumeConfig with provisioning: {diskSelector: {match: 'disk.size > 1u'}, minSize: 1GiB, grow: true}, patched with a document that only has apiVersion, kind and name: data, comes back with provisioning: {grow: true} only.

What I checked:

• Also affected: VolumeConfig (provisioning.diskSelector.match, provisioning.minSize), OOMConfig (triggerExpression), LinkAliasConfig (selector.match).
• Not affected: provisioning.maxSize, grow, wipe, ResolverConfig addresses, WatchdogTimerConfig timeout.
• Also happens with talosctl gen config t https://1.2.3.4:6443 --config-patch @base.yaml --config-patch @patch.yaml (the generated controlplane.yaml has no match), but not with --config-patch @base.yaml alone.
• A single document that is not merged into keeps its match. So does a document appended as the last patch.
• Not tested: talosctl patch mc (needs a node).

Workaround: repeat the field in the last patch that touches the document.

Logs and diagnostics

No node involved, so no support bundle. Output is above.

Environment

• Talos version: talosctl client v1.14.2 (no server involved)
• Kubernetes version: not relevant
• Platform: devcontainer on Linux, talosctl only
• System extensions and relevant configuration: none
• Recent changes and last known working version: found while moving machine.install to UnattendedInstallConfig on v1.14.2; not tested on older versions