refactor: rewrite code to include preliminary support for multi-doc

`config.Container` implements a multi-doc container which implements
both `Container` interface (encoding, validation, etc.), and `Conifg`
interface (accessing parts of the config).

Refactor `generate` and `bundle` packages to support multi-doc, and
provide backwards compatibility.

Implement a first (mostly example) machine config document for
SideroLink API URL.

Many places don't properly support multi-doc yet (e.g. config patches).

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>

cmd/talosctl/cmd/mgmt/cluster/create.go

@@ -32,12 +32,12 @@ import (
 	"github.com/siderolabs/talos/pkg/images"
 	clientconfig "github.com/siderolabs/talos/pkg/machinery/client/config"
 	"github.com/siderolabs/talos/pkg/machinery/config"
+	"github.com/siderolabs/talos/pkg/machinery/config/bundle"
 	"github.com/siderolabs/talos/pkg/machinery/config/configpatcher"
 	"github.com/siderolabs/talos/pkg/machinery/config/encoder"
+	"github.com/siderolabs/talos/pkg/machinery/config/generate"
+	"github.com/siderolabs/talos/pkg/machinery/config/machine"
 	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/bundle"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/generate"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/machine"
 	"github.com/siderolabs/talos/pkg/machinery/constants"
 	"github.com/siderolabs/talos/pkg/machinery/nethelpers"
 	"github.com/siderolabs/talos/pkg/provision"
@@ -333,7 +333,7 @@ func create(ctx context.Context, flags *pflag.FlagSet) (err error) {
 
 		configBundleOpts = append(configBundleOpts, bundle.WithExistingConfigs(inputDir))
 	} else {
-		genOptions := []generate.GenOption{
+		genOptions := []generate.Option{
 			generate.WithInstallImage(nodeInstallImage),
 			generate.WithDebug(configDebug),
 			generate.WithDNSDomain(dnsDomain),
@@ -530,7 +530,7 @@ func create(ctx context.Context, flags *pflag.FlagSet) (err error) {
 		return err
 	}
 
-	configBundle, err := bundle.NewConfigBundle(configBundleOpts...)
+	configBundle, err := bundle.NewBundle(configBundleOpts...)
 	if err != nil {
 		return err
 	}

cmd/talosctl/cmd/mgmt/debug/air-gapped.go

@@ -96,7 +96,7 @@ func generateConfigPatch(caPEM []byte) error {
 		},
 	}
 
-	patchBytes, err := patch.EncodeBytes(encoder.WithComments(encoder.CommentsDisabled))
+	patchBytes, err := encoder.NewEncoder(patch, encoder.WithComments(encoder.CommentsDisabled)).Encode()
 	if err != nil {
 		return err
 	}

cmd/talosctl/cmd/mgmt/gen/config.go

@@ -20,12 +20,13 @@ import (
 	"github.com/siderolabs/talos/cmd/talosctl/pkg/mgmt/helpers"
 	"github.com/siderolabs/talos/pkg/images"
 	"github.com/siderolabs/talos/pkg/machinery/config"
+	"github.com/siderolabs/talos/pkg/machinery/config/bundle"
 	"github.com/siderolabs/talos/pkg/machinery/config/configpatcher"
 	"github.com/siderolabs/talos/pkg/machinery/config/encoder"
+	"github.com/siderolabs/talos/pkg/machinery/config/generate"
+	"github.com/siderolabs/talos/pkg/machinery/config/generate/secrets"
+	"github.com/siderolabs/talos/pkg/machinery/config/machine"
 	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/bundle"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/generate"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/machine"
 	"github.com/siderolabs/talos/pkg/machinery/constants"
 )
 
@@ -91,7 +92,7 @@ setup, usually involving a load balancer, use the IP and port of the load balanc
 
 			switch genConfigCmdFlags.configVersion {
 			case "v1alpha1":
-				return writeV1Alpha1Config(args)
+				return writeConfig(args)
 			default:
 				return fmt.Errorf("unknown config version: %q", genConfigCmdFlags.configVersion)
 			}
@@ -115,17 +116,17 @@ func fixControlPlaneEndpoint(u *url.URL) *url.URL {
 	return u
 }
 
-// V1Alpha1Config generates the Talos config bundle
+// GenerateConfigBundle generates the Talos config bundle
 //
-// V1Alpha1Config is useful for integration with external tooling options.
-func V1Alpha1Config(genOptions []generate.GenOption,
+// GenerateConfigBundle is useful for integration with external tooling options.
+func GenerateConfigBundle(genOptions []generate.Option,
 	clusterName string,
 	endpoint string,
 	kubernetesVersion string,
 	configPatch []string,
 	configPatchControlPlane []string,
 	configPatchWorker []string,
-) (*bundle.ConfigBundle, error) {
+) (*bundle.Bundle, error) {
 	configBundleOpts := []bundle.Option{
 		bundle.WithInputOptions(
 			&bundle.InputOptions{
@@ -160,7 +161,7 @@ func V1Alpha1Config(genOptions []generate.GenOption,
 		return nil, err
 	}
 
-	configBundle, err := bundle.NewConfigBundle(configBundleOpts...)
+	configBundle, err := bundle.NewBundle(configBundleOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("failed to generate config bundle: %w", err)
 	}
@@ -172,7 +173,7 @@ func V1Alpha1Config(genOptions []generate.GenOption,
 }
 
 //nolint:gocyclo
-func writeV1Alpha1Config(args []string) error {
+func writeConfig(args []string) error {
 	if err := validateFlags(); err != nil {
 		return err
 	}
@@ -182,7 +183,7 @@ func writeV1Alpha1Config(args []string) error {
 		return err
 	}
 
-	var genOptions []generate.GenOption //nolint:prealloc
+	var genOptions []generate.Option //nolint:prealloc
 
 	for _, registryMirror := range genConfigCmdFlags.registryMirrors {
 		components := strings.SplitN(registryMirror, "=", 2)
@@ -213,7 +214,14 @@ func writeV1Alpha1Config(args []string) error {
 	}
 
 	if genConfigCmdFlags.withSecrets != "" {
-		genOptions = append(genOptions, generate.WithSecrets(genConfigCmdFlags.withSecrets))
+		var secretsBundle *secrets.Bundle
+
+		secretsBundle, err = secrets.LoadBundle(genConfigCmdFlags.withSecrets)
+		if err != nil {
+			return fmt.Errorf("failed to load secrets bundle: %w", err)
+		}
+
+		genOptions = append(genOptions, generate.WithSecretsBundle(secretsBundle))
 	}
 
 	genOptions = append(genOptions,
@@ -234,7 +242,7 @@ func writeV1Alpha1Config(args []string) error {
 		commentsFlags |= encoder.CommentsExamples
 	}
 
-	configBundle, err := V1Alpha1Config(
+	configBundle, err := GenerateConfigBundle(
 		genOptions,
 		args[0],
 		args[1],
@@ -280,7 +288,7 @@ func validateFlags() error {
 }
 
 // nolint:gocyclo
-func writeConfigBundle(configBundle *bundle.ConfigBundle, outputPaths configOutputPaths, commentsFlags encoder.CommentsFlags) error {
+func writeConfigBundle(configBundle *bundle.Bundle, outputPaths configOutputPaths, commentsFlags encoder.CommentsFlags) error {
 	outputTypesSet := slices.ToSet(genConfigCmdFlags.outputTypes)
 
 	if _, ok := outputTypesSet[controlPlaneOutputType]; ok {

cmd/talosctl/cmd/mgmt/gen/secrets.go

@@ -7,12 +7,13 @@ package gen
 import (
 	"fmt"
 	"os"
+	"time"
 
 	"github.com/spf13/cobra"
 	"gopkg.in/yaml.v3"
 
 	"github.com/siderolabs/talos/pkg/machinery/config"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/generate"
+	"github.com/siderolabs/talos/pkg/machinery/config/generate/secrets"
 )
 
 var genSecretsCmdFlags struct {
@@ -30,7 +31,7 @@ var genSecretsCmd = &cobra.Command{
 	Args:  cobra.NoArgs,
 	RunE: func(cmd *cobra.Command, args []string) error {
 		var (
-			secretsBundle   *generate.SecretsBundle
+			secretsBundle   *secrets.Bundle
 			versionContract *config.VersionContract
 			err             error
 		)
@@ -43,7 +44,7 @@ var genSecretsCmd = &cobra.Command{
 		}
 
 		if genSecretsCmdFlags.fromKubernetesPki != "" {
-			secretsBundle, err = generate.NewSecretsBundleFromKubernetesPKI(genSecretsCmdFlags.fromKubernetesPki,
+			secretsBundle, err = secrets.NewBundleFromKubernetesPKI(genSecretsCmdFlags.fromKubernetesPki,
 				genSecretsCmdFlags.kubernetesBootstrapToken, versionContract)
 			if err != nil {
 				return fmt.Errorf("failed to create secrets bundle: %w", err)
@@ -52,8 +53,8 @@ var genSecretsCmd = &cobra.Command{
 			return writeSecretsBundleToFile(secretsBundle)
 		}
 
-		secretsBundle, err = generate.NewSecretsBundle(generate.NewClock(),
-			generate.WithVersionContract(versionContract),
+		secretsBundle, err = secrets.NewBundle(secrets.NewFixedClock(time.Now()),
+			versionContract,
 		)
 		if err != nil {
 			return fmt.Errorf("failed to create secrets bundle: %w", err)
@@ -63,7 +64,7 @@ var genSecretsCmd = &cobra.Command{
 	},
 }
 
-func writeSecretsBundleToFile(bundle *generate.SecretsBundle) error {
+func writeSecretsBundleToFile(bundle *secrets.Bundle) error {
 	bundleBytes, err := yaml.Marshal(bundle)
 	if err != nil {
 		return err

cmd/talosctl/cmd/mgmt/root.go

@@ -20,7 +20,7 @@ var Commands []*cobra.Command
 // GenV1Alpha1Config generates the Talos config bundle
 //
 // Kept with this name in this package for backwards-compatibility.
-var GenV1Alpha1Config = gen.V1Alpha1Config
+var GenV1Alpha1Config = gen.GenerateConfigBundle
 
 func addCommand(cmd *cobra.Command) {
 	Commands = append(Commands, cmd)

cmd/talosctl/cmd/talos/health.go

@@ -21,7 +21,7 @@ import (
 	"github.com/siderolabs/talos/pkg/cluster/sonobuoy"
 	clusterapi "github.com/siderolabs/talos/pkg/machinery/api/cluster"
 	"github.com/siderolabs/talos/pkg/machinery/client"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/machine"
+	"github.com/siderolabs/talos/pkg/machinery/config/machine"
 	clusterres "github.com/siderolabs/talos/pkg/machinery/resources/cluster"
 )
 

cmd/talosctl/cmd/talos/images.go

@@ -10,6 +10,7 @@ import (
 	"github.com/spf13/cobra"
 
 	"github.com/siderolabs/talos/pkg/images"
+	"github.com/siderolabs/talos/pkg/machinery/config/container"
 	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
 )
 
@@ -19,7 +20,7 @@ var imagesCmd = &cobra.Command{
 	Short: "List the default images used by Talos",
 	Long:  ``,
 	RunE: func(cmd *cobra.Command, args []string) error {
-		images := images.List(&v1alpha1.Config{
+		images := images.List(container.NewV1Alpha1(&v1alpha1.Config{
 			MachineConfig: &v1alpha1.MachineConfig{
 				MachineKubelet: &v1alpha1.KubeletConfig{},
 			},
@@ -31,7 +32,7 @@ var imagesCmd = &cobra.Command{
 				CoreDNSConfig:           &v1alpha1.CoreDNS{},
 				ProxyConfig:             &v1alpha1.ProxyConfig{},
 			},
-		})
+		}))
 
 		fmt.Printf("%s\n", images.Flannel)
 		fmt.Printf("%s\n", images.FlannelCNI)

cmd/talosctl/pkg/mgmt/helpers/wireguard.go

@@ -14,6 +14,7 @@ import (
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
 	"github.com/siderolabs/talos/pkg/machinery/config"
+	"github.com/siderolabs/talos/pkg/machinery/config/container"
 	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
 )
 
@@ -112,5 +113,5 @@ func (w *WireguardConfigBundle) PatchConfig(ip fmt.Stringer, cfg config.Provider
 
 	config.MachineConfig.MachineNetwork.NetworkInterfaces = append(config.MachineConfig.MachineNetwork.NetworkInterfaces, device)
 
-	return config, nil
+	return container.New(config)
 }

internal/app/machined/internal/server/v1alpha1/v1alpha1_cluster.go

@@ -24,7 +24,7 @@ import (
 	"github.com/siderolabs/talos/pkg/conditions"
 	"github.com/siderolabs/talos/pkg/grpc/middleware/authz"
 	clusterapi "github.com/siderolabs/talos/pkg/machinery/api/cluster"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/machine"
+	"github.com/siderolabs/talos/pkg/machinery/config/machine"
 	"github.com/siderolabs/talos/pkg/machinery/constants"
 	clusterres "github.com/siderolabs/talos/pkg/machinery/resources/cluster"
 )

internal/app/machined/internal/server/v1alpha1/v1alpha1_server.go

@@ -79,9 +79,9 @@ import (
 	"github.com/siderolabs/talos/pkg/machinery/api/storage"
 	timeapi "github.com/siderolabs/talos/pkg/machinery/api/time"
 	clientconfig "github.com/siderolabs/talos/pkg/machinery/client/config"
+	"github.com/siderolabs/talos/pkg/machinery/config/generate/secrets"
+	machinetype "github.com/siderolabs/talos/pkg/machinery/config/machine"
 	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/generate"
-	machinetype "github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/machine"
 	"github.com/siderolabs/talos/pkg/machinery/constants"
 	"github.com/siderolabs/talos/pkg/machinery/nethelpers"
 	etcdresource "github.com/siderolabs/talos/pkg/machinery/resources/etcd"
@@ -2140,11 +2140,11 @@ func (s *Server) GenerateClientConfiguration(ctx context.Context, in *machine.Ge
 		return nil, status.Error(codes.InvalidArgument, "crt_ttl should be positive")
 	}
 
-	ca := s.Controller.Runtime().Config().Machine().Security().CA()
-
 	roles, _ := role.Parse(in.Roles)
 
-	cert, err := generate.NewAdminCertificateAndKey(time.Now(), ca, roles, crtTTL)
+	secretsBundle := secrets.NewBundleFromConfig(secrets.NewFixedClock(time.Now()), s.Controller.Runtime().Config())
+
+	cert, err := secretsBundle.GenerateTalosAPIClientCertificate(roles)
 	if err != nil {
 		return nil, err
 	}
@@ -2155,7 +2155,7 @@ func (s *Server) GenerateClientConfiguration(ctx context.Context, in *machine.Ge
 		contextName = strings.TrimPrefix(r[0], role.Prefix) + "@" + contextName
 	}
 
-	talosconfig := clientconfig.NewConfig(contextName, nil, ca.Crt, cert)
+	talosconfig := clientconfig.NewConfig(contextName, nil, secretsBundle.Certs.OS.Crt, cert)
 
 	b, err := talosconfig.Bytes()
 	if err != nil {
@@ -2165,7 +2165,7 @@ func (s *Server) GenerateClientConfiguration(ctx context.Context, in *machine.Ge
 	reply := &machine.GenerateClientConfigurationResponse{
 		Messages: []*machine.GenerateClientConfiguration{
 			{
-				Ca:          ca.Crt,
+				Ca:          secretsBundle.Certs.OS.Crt,
 				Crt:         cert.Crt,
 				Key:         cert.Key,
 				Talosconfig: b,

internal/app/machined/internal/server/v1alpha1/v1alpha1_time_test.go

@@ -21,6 +21,7 @@ import (
 	"github.com/siderolabs/talos/pkg/grpc/factory"
 	timeapi "github.com/siderolabs/talos/pkg/machinery/api/time"
 	"github.com/siderolabs/talos/pkg/machinery/config"
+	"github.com/siderolabs/talos/pkg/machinery/config/container"
 	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
 )
 
@@ -39,13 +40,13 @@ type mockConfigProvider struct {
 }
 
 func (provider *mockConfigProvider) Config() config.Config {
-	return &v1alpha1.Config{
+	return container.NewV1Alpha1(&v1alpha1.Config{
 		MachineConfig: &v1alpha1.MachineConfig{
 			MachineTime: &v1alpha1.TimeConfig{
 				TimeServers: []string{provider.timeServer},
 			},
 		},
-	}
+	})
 }
 
 func (suite *TimedSuite) TestTime() {

internal/app/machined/pkg/controllers/cluster/affiliate_merge_test.go

@@ -14,7 +14,7 @@ import (
 	"github.com/stretchr/testify/suite"
 
 	clusterctrl "github.com/siderolabs/talos/internal/app/machined/pkg/controllers/cluster"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/machine"
+	"github.com/siderolabs/talos/pkg/machinery/config/machine"
 	"github.com/siderolabs/talos/pkg/machinery/resources/cluster"
 )
 

internal/app/machined/pkg/controllers/cluster/cluster_test.go

@@ -19,8 +19,6 @@ import (
 	"github.com/stretchr/testify/suite"
 
 	"github.com/siderolabs/talos/pkg/logging"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
-	"github.com/siderolabs/talos/pkg/machinery/resources/config"
 )
 
 type ClusterSuite struct {
@@ -94,21 +92,6 @@ func (suite *ClusterSuite) TearDownTest() {
 	suite.ctxCancel()
 
 	suite.wg.Wait()
-
-	// trigger updates in resources to stop watch loops
-	err := suite.state.Create(
-		context.Background(), config.NewMachineConfig(
-			&v1alpha1.Config{
-				ConfigVersion: "v1alpha1",
-				MachineConfig: &v1alpha1.MachineConfig{},
-			},
-		),
-	)
-	if state.IsConflictError(err) {
-		err = suite.state.Destroy(context.Background(), config.NewMachineConfig(nil).Metadata())
-	}
-
-	suite.Assert().NoError(err)
 }
 
 func (suite *ClusterSuite) State() state.State { return suite.state }

internal/app/machined/pkg/controllers/cluster/config_test.go

@@ -15,6 +15,7 @@ import (
 	"github.com/stretchr/testify/suite"
 
 	clusterctrl "github.com/siderolabs/talos/internal/app/machined/pkg/controllers/cluster"
+	"github.com/siderolabs/talos/pkg/machinery/config/container"
 	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
 	"github.com/siderolabs/talos/pkg/machinery/resources/cluster"
 	"github.com/siderolabs/talos/pkg/machinery/resources/config"
@@ -29,7 +30,7 @@ func (suite *ConfigSuite) TestReconcileConfig() {
 
 	suite.startRuntime()
 
-	cfg := config.NewMachineConfig(&v1alpha1.Config{
+	cfg := config.NewMachineConfig(container.NewV1Alpha1(&v1alpha1.Config{
 		ConfigVersion: "v1alpha1",
 		ClusterConfig: &v1alpha1.ClusterConfig{
 			ClusterID:     "cluster1",
@@ -38,7 +39,7 @@ func (suite *ConfigSuite) TestReconcileConfig() {
 				DiscoveryEnabled: pointer.To(true),
 			},
 		},
-	})
+	}))
 
 	suite.Require().NoError(suite.state.Create(suite.ctx, cfg))
 
@@ -71,7 +72,7 @@ func (suite *ConfigSuite) TestReconcileConfigCustom() {
 
 	suite.startRuntime()
 
-	cfg := config.NewMachineConfig(&v1alpha1.Config{
+	cfg := config.NewMachineConfig(container.NewV1Alpha1(&v1alpha1.Config{
 		ConfigVersion: "v1alpha1",
 		ClusterConfig: &v1alpha1.ClusterConfig{
 			ClusterID:     "cluster1",
@@ -88,7 +89,7 @@ func (suite *ConfigSuite) TestReconcileConfigCustom() {
 				},
 			},
 		},
-	})
+	}))
 
 	suite.Require().NoError(suite.state.Create(suite.ctx, cfg))
 
@@ -117,7 +118,7 @@ func (suite *ConfigSuite) TestReconcileConfigCustomInsecure() {
 
 	suite.startRuntime()
 
-	cfg := config.NewMachineConfig(&v1alpha1.Config{
+	cfg := config.NewMachineConfig(container.NewV1Alpha1(&v1alpha1.Config{
 		ConfigVersion: "v1alpha1",
 		ClusterConfig: &v1alpha1.ClusterConfig{
 			ClusterID:     "cluster1",
@@ -134,7 +135,7 @@ func (suite *ConfigSuite) TestReconcileConfigCustomInsecure() {
 				},
 			},
 		},
-	})
+	}))
 
 	suite.Require().NoError(suite.state.Create(suite.ctx, cfg))
 
@@ -163,11 +164,11 @@ func (suite *ConfigSuite) TestReconcileDisabled() {
 
 	suite.startRuntime()
 
-	cfg := config.NewMachineConfig(&v1alpha1.Config{
+	cfg := config.NewMachineConfig(container.NewV1Alpha1(&v1alpha1.Config{
 		ConfigVersion: "v1alpha1",
 		MachineConfig: &v1alpha1.MachineConfig{},
 		ClusterConfig: &v1alpha1.ClusterConfig{},
-	})
+	}))
 
 	suite.Require().NoError(suite.state.Create(suite.ctx, cfg))
 

internal/app/machined/pkg/controllers/cluster/discovery_service.go

@@ -23,7 +23,7 @@ import (
 	"github.com/siderolabs/go-pointer"
 	"go.uber.org/zap"
 
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/machine"
+	"github.com/siderolabs/talos/pkg/machinery/config/machine"
 	"github.com/siderolabs/talos/pkg/machinery/proto"
 	"github.com/siderolabs/talos/pkg/machinery/resources/cluster"
 	"github.com/siderolabs/talos/pkg/machinery/resources/config"

internal/app/machined/pkg/controllers/cluster/discovery_service_test.go

@@ -26,7 +26,7 @@ import (
 	clusterctrl "github.com/siderolabs/talos/internal/app/machined/pkg/controllers/cluster"
 	"github.com/siderolabs/talos/internal/app/machined/pkg/controllers/ctest"
 	"github.com/siderolabs/talos/pkg/logging"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/machine"
+	"github.com/siderolabs/talos/pkg/machinery/config/machine"
 	"github.com/siderolabs/talos/pkg/machinery/constants"
 	"github.com/siderolabs/talos/pkg/machinery/proto"
 	"github.com/siderolabs/talos/pkg/machinery/resources/cluster"

internal/app/machined/pkg/controllers/cluster/endpoint.go

@@ -15,7 +15,7 @@ import (
 	"github.com/cosi-project/runtime/pkg/resource"
 	"go.uber.org/zap"
 
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/machine"
+	"github.com/siderolabs/talos/pkg/machinery/config/machine"
 	"github.com/siderolabs/talos/pkg/machinery/resources/cluster"
 	"github.com/siderolabs/talos/pkg/machinery/resources/k8s"
 )

internal/app/machined/pkg/controllers/cluster/endpoint_test.go

@@ -15,7 +15,7 @@ import (
 	"github.com/stretchr/testify/suite"
 
 	clusterctrl "github.com/siderolabs/talos/internal/app/machined/pkg/controllers/cluster"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/machine"
+	"github.com/siderolabs/talos/pkg/machinery/config/machine"
 	"github.com/siderolabs/talos/pkg/machinery/resources/cluster"
 	"github.com/siderolabs/talos/pkg/machinery/resources/k8s"
 )

internal/app/machined/pkg/controllers/cluster/local_affiliate_test.go

@@ -17,7 +17,7 @@ import (
 	clusteradapter "github.com/siderolabs/talos/internal/app/machined/pkg/adapters/cluster"
 	kubespanadapter "github.com/siderolabs/talos/internal/app/machined/pkg/adapters/kubespan"
 	clusterctrl "github.com/siderolabs/talos/internal/app/machined/pkg/controllers/cluster"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/machine"
+	"github.com/siderolabs/talos/pkg/machinery/config/machine"
 	"github.com/siderolabs/talos/pkg/machinery/resources/cluster"
 	"github.com/siderolabs/talos/pkg/machinery/resources/config"
 	"github.com/siderolabs/talos/pkg/machinery/resources/k8s"

internal/app/machined/pkg/controllers/cluster/member_test.go

@@ -14,7 +14,7 @@ import (
 	"github.com/stretchr/testify/suite"
 
 	clusterctrl "github.com/siderolabs/talos/internal/app/machined/pkg/controllers/cluster"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/machine"
+	"github.com/siderolabs/talos/pkg/machinery/config/machine"
 	"github.com/siderolabs/talos/pkg/machinery/resources/cluster"
 )
 

internal/app/machined/pkg/controllers/config/machine_type.go

@@ -14,7 +14,7 @@ import (
 	"github.com/siderolabs/go-pointer"
 	"go.uber.org/zap"
 
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/machine"
+	"github.com/siderolabs/talos/pkg/machinery/config/machine"
 	"github.com/siderolabs/talos/pkg/machinery/resources/config"
 )
 

internal/app/machined/pkg/controllers/cri/seccomp_profile_test.go

@@ -14,13 +14,14 @@ import (
 
 	"github.com/siderolabs/talos/internal/app/machined/pkg/controllers/cri"
 	"github.com/siderolabs/talos/internal/app/machined/pkg/controllers/ctest"
+	"github.com/siderolabs/talos/pkg/machinery/config/container"
 	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
 	"github.com/siderolabs/talos/pkg/machinery/resources/config"
 	criseccompresource "github.com/siderolabs/talos/pkg/machinery/resources/cri"
 )
 
 func (suite *CRISeccompProfileSuite) TestReconcileSeccompProfile() {
-	cfg := config.NewMachineConfig(&v1alpha1.Config{
+	cfg := config.NewMachineConfig(container.NewV1Alpha1(&v1alpha1.Config{
 		MachineConfig: &v1alpha1.MachineConfig{
 			MachineSeccompProfiles: []*v1alpha1.MachineSeccompProfile{
 				{
@@ -41,7 +42,7 @@ func (suite *CRISeccompProfileSuite) TestReconcileSeccompProfile() {
 				},
 			},
 		},
-	})
+	}))
 
 	suite.Require().NoError(suite.State().Create(suite.Ctx(), cfg))
 
@@ -108,7 +109,7 @@ func (suite *CRISeccompProfileSuite) TestReconcileSeccompProfile() {
 	})
 
 	// test deletion
-	cfg = config.NewMachineConfig(&v1alpha1.Config{
+	cfg = config.NewMachineConfig(container.NewV1Alpha1(&v1alpha1.Config{
 		MachineConfig: &v1alpha1.MachineConfig{
 			MachineSeccompProfiles: []*v1alpha1.MachineSeccompProfile{
 				{
@@ -121,7 +122,7 @@ func (suite *CRISeccompProfileSuite) TestReconcileSeccompProfile() {
 				},
 			},
 		},
-	})
+	}))
 
 	ctest.UpdateWithConflicts(suite, cfg, func(mc *config.MachineConfig) error { return nil })
 

internal/app/machined/pkg/controllers/etcd/config_test.go

@@ -15,8 +15,9 @@ import (
 
 	"github.com/siderolabs/talos/internal/app/machined/pkg/controllers/ctest"
 	etcdctrl "github.com/siderolabs/talos/internal/app/machined/pkg/controllers/etcd"
+	"github.com/siderolabs/talos/pkg/machinery/config/container"
+	"github.com/siderolabs/talos/pkg/machinery/config/machine"
 	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/machine"
 	"github.com/siderolabs/talos/pkg/machinery/resources/config"
 	"github.com/siderolabs/talos/pkg/machinery/resources/etcd"
 )
@@ -148,7 +149,7 @@ func (suite *ConfigSuite) TestReconcile() {
 		},
 	} {
 		suite.Run(tt.name, func() {
-			cfg := &v1alpha1.Config{
+			cfg := container.NewV1Alpha1(&v1alpha1.Config{
 				ClusterConfig: &v1alpha1.ClusterConfig{
 					EtcdConfig: tt.etcdConfig,
 				},
@@ -157,7 +158,7 @@ func (suite *ConfigSuite) TestReconcile() {
 						NetworkInterfaces: tt.networkConfig,
 					},
 				},
-			}
+			})
 
 			machineConfig := config.NewMachineConfig(cfg)
 			suite.Require().NoError(suite.State().Create(suite.Ctx(), machineConfig))

internal/app/machined/pkg/controllers/files/etcfile_test.go

@@ -153,11 +153,12 @@ func (suite *EtcFileSuite) TearDownTest() {
 	suite.ctxCancel()
 
 	suite.wg.Wait()
-
-	// trigger updates in resources to stop watch loops
-	suite.Assert().NoError(suite.state.Create(context.Background(), files.NewEtcFileSpec(files.NamespaceName, "bar")))
 }
 
 func TestEtcFileSuite(t *testing.T) {
+	if os.Geteuid() != 0 {
+		t.Skip("requires root")
+	}
+
 	suite.Run(t, new(EtcFileSuite))
 }

internal/app/machined/pkg/controllers/hardware/hardware_test.go

@@ -19,8 +19,6 @@ import (
 	"github.com/stretchr/testify/suite"
 
 	"github.com/siderolabs/talos/pkg/logging"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
-	"github.com/siderolabs/talos/pkg/machinery/resources/config"
 )
 
 type HardwareSuite struct {
@@ -84,19 +82,4 @@ func (suite *HardwareSuite) TearDownTest() {
 	suite.ctxCancel()
 
 	suite.wg.Wait()
-
-	// trigger updates in resources to stop watch loops
-	err := suite.state.Create(
-		context.Background(), config.NewMachineConfig(
-			&v1alpha1.Config{
-				ConfigVersion: "v1alpha1",
-				MachineConfig: &v1alpha1.MachineConfig{},
-			},
-		),
-	)
-	if state.IsConflictError(err) {
-		err = suite.state.Destroy(context.Background(), config.NewMachineConfig(nil).Metadata())
-	}
-
-	suite.Assert().NoError(err)
 }

internal/app/machined/pkg/controllers/k8s/address_filter_test.go

@@ -24,6 +24,7 @@ import (
 
 	k8sctrl "github.com/siderolabs/talos/internal/app/machined/pkg/controllers/k8s"
 	"github.com/siderolabs/talos/pkg/logging"
+	"github.com/siderolabs/talos/pkg/machinery/config/container"
 	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
 	"github.com/siderolabs/talos/pkg/machinery/resources/config"
 	"github.com/siderolabs/talos/pkg/machinery/resources/k8s"
@@ -91,27 +92,29 @@ func (suite *K8sAddressFilterSuite) TestReconcile() {
 	suite.Require().NoError(err)
 
 	cfg := config.NewMachineConfig(
-		&v1alpha1.Config{
-			ConfigVersion: "v1alpha1",
-			MachineConfig: &v1alpha1.MachineConfig{},
-			ClusterConfig: &v1alpha1.ClusterConfig{
-				ControlPlane: &v1alpha1.ControlPlaneConfig{
-					Endpoint: &v1alpha1.Endpoint{
-						URL: u,
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				ConfigVersion: "v1alpha1",
+				MachineConfig: &v1alpha1.MachineConfig{},
+				ClusterConfig: &v1alpha1.ClusterConfig{
+					ControlPlane: &v1alpha1.ControlPlaneConfig{
+						Endpoint: &v1alpha1.Endpoint{
+							URL: u,
+						},
 					},
-				},
-				ClusterNetwork: &v1alpha1.ClusterNetworkConfig{
-					ServiceSubnet: []string{
-						"10.200.0.0/22",
-						"fd40:10:200::/112",
-					},
-					PodSubnet: []string{
-						"10.32.0.0/12",
-						"fd00:10:32::/102",
+					ClusterNetwork: &v1alpha1.ClusterNetworkConfig{
+						ServiceSubnet: []string{
+							"10.200.0.0/22",
+							"fd40:10:200::/112",
+						},
+						PodSubnet: []string{
+							"10.32.0.0/12",
+							"fd00:10:32::/102",
+						},
 					},
 				},
 			},
-		},
+		),
 	)
 	suite.Require().NoError(suite.state.Create(suite.ctx, cfg))
 

internal/app/machined/pkg/controllers/k8s/control_plane_static_pod_test.go

@@ -631,14 +631,6 @@ func (suite *ControlPlaneStaticPodSuite) TearDownTest() {
 	suite.ctxCancel()
 
 	suite.wg.Wait()
-
-	// trigger updates in resources to stop watch loops
-	suite.Assert().NoError(
-		suite.state.Create(
-			context.Background(),
-			k8s.NewSecretsStatus(k8s.ControlPlaneNamespaceName, "-"),
-		),
-	)
 }
 
 func TestControlPlaneStaticPodSuite(t *testing.T) {

internal/app/machined/pkg/controllers/k8s/control_plane_test.go

@@ -20,8 +20,9 @@ import (
 
 	"github.com/siderolabs/talos/internal/app/machined/pkg/controllers/ctest"
 	k8sctrl "github.com/siderolabs/talos/internal/app/machined/pkg/controllers/k8s"
+	"github.com/siderolabs/talos/pkg/machinery/config/container"
+	"github.com/siderolabs/talos/pkg/machinery/config/machine"
 	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/machine"
 	"github.com/siderolabs/talos/pkg/machinery/constants"
 	"github.com/siderolabs/talos/pkg/machinery/resources/config"
 	"github.com/siderolabs/talos/pkg/machinery/resources/k8s"
@@ -54,17 +55,19 @@ func (suite *K8sControlPlaneSuite) TestReconcileDefaults() {
 	suite.Require().NoError(err)
 
 	cfg := config.NewMachineConfig(
-		&v1alpha1.Config{
-			ConfigVersion: "v1alpha1",
-			MachineConfig: &v1alpha1.MachineConfig{},
-			ClusterConfig: &v1alpha1.ClusterConfig{
-				ControlPlane: &v1alpha1.ControlPlaneConfig{
-					Endpoint: &v1alpha1.Endpoint{
-						URL: u,
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				ConfigVersion: "v1alpha1",
+				MachineConfig: &v1alpha1.MachineConfig{},
+				ClusterConfig: &v1alpha1.ClusterConfig{
+					ControlPlane: &v1alpha1.ControlPlaneConfig{
+						Endpoint: &v1alpha1.Endpoint{
+							URL: u,
+						},
 					},
 				},
 			},
-		},
+		),
 	)
 
 	suite.setupMachine(cfg)
@@ -96,17 +99,19 @@ func (suite *K8sControlPlaneSuite) TestReconcileTransitionWorker() {
 	suite.Require().NoError(err)
 
 	cfg := config.NewMachineConfig(
-		&v1alpha1.Config{
-			ConfigVersion: "v1alpha1",
-			MachineConfig: &v1alpha1.MachineConfig{},
-			ClusterConfig: &v1alpha1.ClusterConfig{
-				ControlPlane: &v1alpha1.ControlPlaneConfig{
-					Endpoint: &v1alpha1.Endpoint{
-						URL: u,
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				ConfigVersion: "v1alpha1",
+				MachineConfig: &v1alpha1.MachineConfig{},
+				ClusterConfig: &v1alpha1.ClusterConfig{
+					ControlPlane: &v1alpha1.ControlPlaneConfig{
+						Endpoint: &v1alpha1.Endpoint{
+							URL: u,
+						},
 					},
 				},
 			},
-		},
+		),
 	)
 
 	suite.setupMachine(cfg)
@@ -131,21 +136,23 @@ func (suite *K8sControlPlaneSuite) TestReconcileIPv6() {
 	suite.Require().NoError(err)
 
 	cfg := config.NewMachineConfig(
-		&v1alpha1.Config{
-			ConfigVersion: "v1alpha1",
-			MachineConfig: &v1alpha1.MachineConfig{},
-			ClusterConfig: &v1alpha1.ClusterConfig{
-				ControlPlane: &v1alpha1.ControlPlaneConfig{
-					Endpoint: &v1alpha1.Endpoint{
-						URL: u,
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				ConfigVersion: "v1alpha1",
+				MachineConfig: &v1alpha1.MachineConfig{},
+				ClusterConfig: &v1alpha1.ClusterConfig{
+					ControlPlane: &v1alpha1.ControlPlaneConfig{
+						Endpoint: &v1alpha1.Endpoint{
+							URL: u,
+						},
+					},
+					ClusterNetwork: &v1alpha1.ClusterNetworkConfig{
+						PodSubnet:     []string{constants.DefaultIPv6PodNet},
+						ServiceSubnet: []string{constants.DefaultIPv6ServiceNet},
 					},
 				},
-				ClusterNetwork: &v1alpha1.ClusterNetworkConfig{
-					PodSubnet:     []string{constants.DefaultIPv6PodNet},
-					ServiceSubnet: []string{constants.DefaultIPv6ServiceNet},
-				},
 			},
-		},
+		),
 	)
 
 	suite.setupMachine(cfg)
@@ -163,21 +170,23 @@ func (suite *K8sControlPlaneSuite) TestReconcileDualStack() {
 	suite.Require().NoError(err)
 
 	cfg := config.NewMachineConfig(
-		&v1alpha1.Config{
-			ConfigVersion: "v1alpha1",
-			MachineConfig: &v1alpha1.MachineConfig{},
-			ClusterConfig: &v1alpha1.ClusterConfig{
-				ControlPlane: &v1alpha1.ControlPlaneConfig{
-					Endpoint: &v1alpha1.Endpoint{
-						URL: u,
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				ConfigVersion: "v1alpha1",
+				MachineConfig: &v1alpha1.MachineConfig{},
+				ClusterConfig: &v1alpha1.ClusterConfig{
+					ControlPlane: &v1alpha1.ControlPlaneConfig{
+						Endpoint: &v1alpha1.Endpoint{
+							URL: u,
+						},
+					},
+					ClusterNetwork: &v1alpha1.ClusterNetworkConfig{
+						PodSubnet:     []string{constants.DefaultIPv4PodNet, constants.DefaultIPv6PodNet},
+						ServiceSubnet: []string{constants.DefaultIPv4ServiceNet, constants.DefaultIPv6ServiceNet},
 					},
 				},
-				ClusterNetwork: &v1alpha1.ClusterNetworkConfig{
-					PodSubnet:     []string{constants.DefaultIPv4PodNet, constants.DefaultIPv6PodNet},
-					ServiceSubnet: []string{constants.DefaultIPv4ServiceNet, constants.DefaultIPv6ServiceNet},
-				},
 			},
-		},
+		),
 	)
 
 	suite.setupMachine(cfg)
@@ -195,29 +204,31 @@ func (suite *K8sControlPlaneSuite) TestReconcileExtraVolumes() {
 	suite.Require().NoError(err)
 
 	cfg := config.NewMachineConfig(
-		&v1alpha1.Config{
-			ConfigVersion: "v1alpha1",
-			MachineConfig: &v1alpha1.MachineConfig{},
-			ClusterConfig: &v1alpha1.ClusterConfig{
-				ControlPlane: &v1alpha1.ControlPlaneConfig{
-					Endpoint: &v1alpha1.Endpoint{
-						URL: u,
-					},
-				},
-				APIServerConfig: &v1alpha1.APIServerConfig{
-					ExtraVolumesConfig: []v1alpha1.VolumeMountConfig{
-						{
-							VolumeHostPath:  "/var/lib",
-							VolumeMountPath: "/var/foo/",
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				ConfigVersion: "v1alpha1",
+				MachineConfig: &v1alpha1.MachineConfig{},
+				ClusterConfig: &v1alpha1.ClusterConfig{
+					ControlPlane: &v1alpha1.ControlPlaneConfig{
+						Endpoint: &v1alpha1.Endpoint{
+							URL: u,
 						},
-						{
-							VolumeHostPath:  "/var/lib/a.foo",
-							VolumeMountPath: "/var/foo/b.foo",
+					},
+					APIServerConfig: &v1alpha1.APIServerConfig{
+						ExtraVolumesConfig: []v1alpha1.VolumeMountConfig{
+							{
+								VolumeHostPath:  "/var/lib",
+								VolumeMountPath: "/var/foo/",
+							},
+							{
+								VolumeHostPath:  "/var/lib/a.foo",
+								VolumeMountPath: "/var/foo/b.foo",
+							},
 						},
 					},
 				},
 			},
-		},
+		),
 	)
 
 	suite.setupMachine(cfg)
@@ -251,22 +262,24 @@ func (suite *K8sControlPlaneSuite) TestReconcileEnvironment() {
 	suite.Require().NoError(err)
 
 	cfg := config.NewMachineConfig(
-		&v1alpha1.Config{
-			ConfigVersion: "v1alpha1",
-			MachineConfig: &v1alpha1.MachineConfig{},
-			ClusterConfig: &v1alpha1.ClusterConfig{
-				ControlPlane: &v1alpha1.ControlPlaneConfig{
-					Endpoint: &v1alpha1.Endpoint{
-						URL: u,
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				ConfigVersion: "v1alpha1",
+				MachineConfig: &v1alpha1.MachineConfig{},
+				ClusterConfig: &v1alpha1.ClusterConfig{
+					ControlPlane: &v1alpha1.ControlPlaneConfig{
+						Endpoint: &v1alpha1.Endpoint{
+							URL: u,
+						},
 					},
-				},
-				APIServerConfig: &v1alpha1.APIServerConfig{
-					EnvConfig: v1alpha1.Env{
-						"HTTP_PROXY": "foo",
+					APIServerConfig: &v1alpha1.APIServerConfig{
+						EnvConfig: v1alpha1.Env{
+							"HTTP_PROXY": "foo",
+						},
 					},
 				},
 			},
-		},
+		),
 	)
 
 	suite.setupMachine(cfg)
@@ -289,24 +302,26 @@ func (suite *K8sControlPlaneSuite) TestReconcileExternalCloudProvider() {
 	suite.Require().NoError(err)
 
 	cfg := config.NewMachineConfig(
-		&v1alpha1.Config{
-			ConfigVersion: "v1alpha1",
-			MachineConfig: &v1alpha1.MachineConfig{},
-			ClusterConfig: &v1alpha1.ClusterConfig{
-				ControlPlane: &v1alpha1.ControlPlaneConfig{
-					Endpoint: &v1alpha1.Endpoint{
-						URL: u,
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				ConfigVersion: "v1alpha1",
+				MachineConfig: &v1alpha1.MachineConfig{},
+				ClusterConfig: &v1alpha1.ClusterConfig{
+					ControlPlane: &v1alpha1.ControlPlaneConfig{
+						Endpoint: &v1alpha1.Endpoint{
+							URL: u,
+						},
 					},
-				},
-				ExternalCloudProviderConfig: &v1alpha1.ExternalCloudProviderConfig{
-					ExternalEnabled: pointer.To(true),
-					ExternalManifests: []string{
-						"https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml",
-						"https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml",
+					ExternalCloudProviderConfig: &v1alpha1.ExternalCloudProviderConfig{
+						ExternalEnabled: pointer.To(true),
+						ExternalManifests: []string{
+							"https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml",
+							"https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml",
+						},
 					},
 				},
 			},
-		},
+		),
 	)
 
 	suite.setupMachine(cfg)
@@ -351,30 +366,32 @@ func (suite *K8sControlPlaneSuite) TestReconcileInlineManifests() {
 	suite.Require().NoError(err)
 
 	cfg := config.NewMachineConfig(
-		&v1alpha1.Config{
-			ConfigVersion: "v1alpha1",
-			MachineConfig: &v1alpha1.MachineConfig{},
-			ClusterConfig: &v1alpha1.ClusterConfig{
-				ControlPlane: &v1alpha1.ControlPlaneConfig{
-					Endpoint: &v1alpha1.Endpoint{
-						URL: u,
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				ConfigVersion: "v1alpha1",
+				MachineConfig: &v1alpha1.MachineConfig{},
+				ClusterConfig: &v1alpha1.ClusterConfig{
+					ControlPlane: &v1alpha1.ControlPlaneConfig{
+						Endpoint: &v1alpha1.Endpoint{
+							URL: u,
+						},
 					},
-				},
-				ClusterInlineManifests: v1alpha1.ClusterInlineManifests{
-					{
-						InlineManifestName: "namespace-ci",
-						InlineManifestContents: strings.TrimSpace(
-							`
+					ClusterInlineManifests: v1alpha1.ClusterInlineManifests{
+						{
+							InlineManifestName: "namespace-ci",
+							InlineManifestContents: strings.TrimSpace(
+								`
 apiVersion: v1
 kind: Namespace
 metadata:
 	name: ci
 `,
-						),
+							),
+						},
 					},
 				},
 			},
-		},
+		),
 	)
 
 	suite.setupMachine(cfg)

internal/app/machined/pkg/controllers/k8s/endpoint.go

@@ -28,7 +28,7 @@ import (
 
 	"github.com/siderolabs/talos/pkg/conditions"
 	"github.com/siderolabs/talos/pkg/kubernetes"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/machine"
+	"github.com/siderolabs/talos/pkg/machinery/config/machine"
 	"github.com/siderolabs/talos/pkg/machinery/constants"
 	"github.com/siderolabs/talos/pkg/machinery/resources/config"
 	"github.com/siderolabs/talos/pkg/machinery/resources/k8s"

internal/app/machined/pkg/controllers/k8s/extra_manifest_test.go

@@ -29,7 +29,6 @@ import (
 	"github.com/siderolabs/talos/pkg/logging"
 	"github.com/siderolabs/talos/pkg/machinery/resources/k8s"
 	"github.com/siderolabs/talos/pkg/machinery/resources/network"
-	"github.com/siderolabs/talos/pkg/machinery/resources/v1alpha1"
 )
 
 type ExtraManifestSuite struct {
@@ -155,9 +154,6 @@ func (suite *ExtraManifestSuite) TearDownTest() {
 	suite.ctxCancel()
 
 	suite.wg.Wait()
-
-	// trigger updates in resources to stop watch loops
-	suite.Assert().NoError(suite.state.Create(context.Background(), v1alpha1.NewService("foo")))
 }
 
 func TestExtraManifestSuite(t *testing.T) {

internal/app/machined/pkg/controllers/k8s/kubelet_config_test.go

@@ -25,6 +25,7 @@ import (
 
 	k8sctrl "github.com/siderolabs/talos/internal/app/machined/pkg/controllers/k8s"
 	"github.com/siderolabs/talos/pkg/logging"
+	"github.com/siderolabs/talos/pkg/machinery/config/container"
 	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
 	"github.com/siderolabs/talos/pkg/machinery/constants"
 	"github.com/siderolabs/talos/pkg/machinery/resources/config"
@@ -83,46 +84,48 @@ func (suite *KubeletConfigSuite) TestReconcile() {
 	suite.createStaticPodServerStatus()
 
 	cfg := config.NewMachineConfig(
-		&v1alpha1.Config{
-			ConfigVersion: "v1alpha1",
-			MachineConfig: &v1alpha1.MachineConfig{
-				MachineKubelet: &v1alpha1.KubeletConfig{
-					KubeletImage:      "kubelet",
-					KubeletClusterDNS: []string{"10.0.0.1"},
-					KubeletExtraArgs: map[string]string{
-						"enable-feature": "foo",
-					},
-					KubeletExtraMounts: []v1alpha1.ExtraMount{
-						{
-							Mount: specs.Mount{
-								Destination: "/tmp",
-								Source:      "/var",
-								Type:        "tmpfs",
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				ConfigVersion: "v1alpha1",
+				MachineConfig: &v1alpha1.MachineConfig{
+					MachineKubelet: &v1alpha1.KubeletConfig{
+						KubeletImage:      "kubelet",
+						KubeletClusterDNS: []string{"10.0.0.1"},
+						KubeletExtraArgs: map[string]string{
+							"enable-feature": "foo",
+						},
+						KubeletExtraMounts: []v1alpha1.ExtraMount{
+							{
+								Mount: specs.Mount{
+									Destination: "/tmp",
+									Source:      "/var",
+									Type:        "tmpfs",
+								},
 							},
 						},
+						KubeletExtraConfig: v1alpha1.Unstructured{
+							Object: map[string]interface{}{
+								"serverTLSBootstrap": true,
+							},
+						},
+						KubeletDefaultRuntimeSeccompProfileEnabled: pointer.To(true),
 					},
-					KubeletExtraConfig: v1alpha1.Unstructured{
-						Object: map[string]interface{}{
-							"serverTLSBootstrap": true,
+				},
+				ClusterConfig: &v1alpha1.ClusterConfig{
+					ControlPlane: &v1alpha1.ControlPlaneConfig{
+						Endpoint: &v1alpha1.Endpoint{
+							URL: u,
 						},
 					},
-					KubeletDefaultRuntimeSeccompProfileEnabled: pointer.To(true),
-				},
-			},
-			ClusterConfig: &v1alpha1.ClusterConfig{
-				ControlPlane: &v1alpha1.ControlPlaneConfig{
-					Endpoint: &v1alpha1.Endpoint{
-						URL: u,
+					ExternalCloudProviderConfig: &v1alpha1.ExternalCloudProviderConfig{
+						ExternalEnabled: pointer.To(true),
+					},
+					ClusterNetwork: &v1alpha1.ClusterNetworkConfig{
+						DNSDomain: "service.svc",
 					},
 				},
-				ExternalCloudProviderConfig: &v1alpha1.ExternalCloudProviderConfig{
-					ExternalEnabled: pointer.To(true),
-				},
-				ClusterNetwork: &v1alpha1.ClusterNetworkConfig{
-					DNSDomain: "service.svc",
-				},
 			},
-		},
+		),
 	)
 
 	suite.Require().NoError(suite.state.Create(suite.ctx, cfg))
@@ -190,24 +193,26 @@ func (suite *KubeletConfigSuite) TestReconcileDefaults() {
 	suite.createStaticPodServerStatus()
 
 	cfg := config.NewMachineConfig(
-		&v1alpha1.Config{
-			ConfigVersion: "v1alpha1",
-			MachineConfig: &v1alpha1.MachineConfig{
-				MachineKubelet: &v1alpha1.KubeletConfig{
-					KubeletImage: "kubelet",
-				},
-			},
-			ClusterConfig: &v1alpha1.ClusterConfig{
-				ControlPlane: &v1alpha1.ControlPlaneConfig{
-					Endpoint: &v1alpha1.Endpoint{
-						URL: u,
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				ConfigVersion: "v1alpha1",
+				MachineConfig: &v1alpha1.MachineConfig{
+					MachineKubelet: &v1alpha1.KubeletConfig{
+						KubeletImage: "kubelet",
 					},
 				},
-				ClusterNetwork: &v1alpha1.ClusterNetworkConfig{
-					ServiceSubnet: []string{constants.DefaultIPv4ServiceNet},
+				ClusterConfig: &v1alpha1.ClusterConfig{
+					ControlPlane: &v1alpha1.ControlPlaneConfig{
+						Endpoint: &v1alpha1.Endpoint{
+							URL: u,
+						},
+					},
+					ClusterNetwork: &v1alpha1.ClusterNetworkConfig{
+						ServiceSubnet: []string{constants.DefaultIPv4ServiceNet},
+					},
 				},
 			},
-		},
+		),
 	)
 
 	suite.Require().NoError(suite.state.Create(suite.ctx, cfg))

internal/app/machined/pkg/controllers/k8s/manifest_test.go

@@ -353,9 +353,6 @@ func (suite *ManifestSuite) TearDownTest() {
 	suite.ctxCancel()
 
 	suite.wg.Wait()
-
-	// trigger updates in resources to stop watch loops
-	suite.Assert().NoError(suite.state.Create(context.Background(), secrets.NewKubernetesRoot("-")))
 }
 
 func TestManifestSuite(t *testing.T) {

internal/app/machined/pkg/controllers/k8s/node_label_spec_test.go

@@ -23,8 +23,9 @@ import (
 
 	k8sctrl "github.com/siderolabs/talos/internal/app/machined/pkg/controllers/k8s"
 	"github.com/siderolabs/talos/pkg/logging"
+	"github.com/siderolabs/talos/pkg/machinery/config/container"
+	"github.com/siderolabs/talos/pkg/machinery/config/machine"
 	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/machine"
 	"github.com/siderolabs/talos/pkg/machinery/resources/config"
 	"github.com/siderolabs/talos/pkg/machinery/resources/k8s"
 )
@@ -102,11 +103,12 @@ func (suite *NodeLabelsSuite) setupMachineType() {
 
 func mcWithNodeLabels(labels map[string]string) *config.MachineConfig {
 	return config.NewMachineConfig(
-		&v1alpha1.Config{
-			MachineConfig: &v1alpha1.MachineConfig{
-				MachineNodeLabels: labels,
-			},
-		})
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				MachineConfig: &v1alpha1.MachineConfig{
+					MachineNodeLabels: labels,
+				},
+			}))
 }
 
 func (suite *NodeLabelsSuite) createNodeLabelsConfig(labels map[string]string) {

internal/app/machined/pkg/controllers/k8s/nodeip_config_test.go

@@ -23,6 +23,7 @@ import (
 
 	k8sctrl "github.com/siderolabs/talos/internal/app/machined/pkg/controllers/k8s"
 	"github.com/siderolabs/talos/pkg/logging"
+	"github.com/siderolabs/talos/pkg/machinery/config/container"
 	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
 	"github.com/siderolabs/talos/pkg/machinery/constants"
 	"github.com/siderolabs/talos/pkg/machinery/resources/config"
@@ -71,44 +72,46 @@ func (suite *NodeIPConfigSuite) TestReconcileWithSubnets() {
 	suite.Require().NoError(err)
 
 	cfg := config.NewMachineConfig(
-		&v1alpha1.Config{
-			ConfigVersion: "v1alpha1",
-			MachineConfig: &v1alpha1.MachineConfig{
-				MachineKubelet: &v1alpha1.KubeletConfig{
-					KubeletNodeIP: &v1alpha1.KubeletNodeIPConfig{
-						KubeletNodeIPValidSubnets: []string{"10.0.0.0/24"},
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				ConfigVersion: "v1alpha1",
+				MachineConfig: &v1alpha1.MachineConfig{
+					MachineKubelet: &v1alpha1.KubeletConfig{
+						KubeletNodeIP: &v1alpha1.KubeletNodeIPConfig{
+							KubeletNodeIPValidSubnets: []string{"10.0.0.0/24"},
+						},
 					},
-				},
-				MachineNetwork: &v1alpha1.NetworkConfig{
-					NetworkInterfaces: []*v1alpha1.Device{
-						{
-							DeviceVIPConfig: &v1alpha1.DeviceVIPConfig{
-								SharedIP: "1.2.3.4",
-							},
-							DeviceVlans: []*v1alpha1.Vlan{
-								{
-									VlanID: 100,
-									VlanVIP: &v1alpha1.DeviceVIPConfig{
-										SharedIP: "5.6.7.8",
+					MachineNetwork: &v1alpha1.NetworkConfig{
+						NetworkInterfaces: []*v1alpha1.Device{
+							{
+								DeviceVIPConfig: &v1alpha1.DeviceVIPConfig{
+									SharedIP: "1.2.3.4",
+								},
+								DeviceVlans: []*v1alpha1.Vlan{
+									{
+										VlanID: 100,
+										VlanVIP: &v1alpha1.DeviceVIPConfig{
+											SharedIP: "5.6.7.8",
+										},
 									},
 								},
 							},
 						},
 					},
 				},
-			},
-			ClusterConfig: &v1alpha1.ClusterConfig{
-				ControlPlane: &v1alpha1.ControlPlaneConfig{
-					Endpoint: &v1alpha1.Endpoint{
-						URL: u,
+				ClusterConfig: &v1alpha1.ClusterConfig{
+					ControlPlane: &v1alpha1.ControlPlaneConfig{
+						Endpoint: &v1alpha1.Endpoint{
+							URL: u,
+						},
+					},
+					ClusterNetwork: &v1alpha1.ClusterNetworkConfig{
+						ServiceSubnet: []string{constants.DefaultIPv4ServiceNet},
+						PodSubnet:     []string{constants.DefaultIPv4PodNet},
 					},
 				},
-				ClusterNetwork: &v1alpha1.ClusterNetworkConfig{
-					ServiceSubnet: []string{constants.DefaultIPv4ServiceNet},
-					PodSubnet:     []string{constants.DefaultIPv4PodNet},
-				},
 			},
-		},
+		),
 	)
 
 	suite.Require().NoError(suite.state.Create(suite.ctx, cfg))
@@ -152,21 +155,23 @@ func (suite *NodeIPConfigSuite) TestReconcileDefaults() {
 	suite.Require().NoError(err)
 
 	cfg := config.NewMachineConfig(
-		&v1alpha1.Config{
-			ConfigVersion: "v1alpha1",
-			MachineConfig: &v1alpha1.MachineConfig{},
-			ClusterConfig: &v1alpha1.ClusterConfig{
-				ControlPlane: &v1alpha1.ControlPlaneConfig{
-					Endpoint: &v1alpha1.Endpoint{
-						URL: u,
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				ConfigVersion: "v1alpha1",
+				MachineConfig: &v1alpha1.MachineConfig{},
+				ClusterConfig: &v1alpha1.ClusterConfig{
+					ControlPlane: &v1alpha1.ControlPlaneConfig{
+						Endpoint: &v1alpha1.Endpoint{
+							URL: u,
+						},
+					},
+					ClusterNetwork: &v1alpha1.ClusterNetworkConfig{
+						ServiceSubnet: []string{constants.DefaultIPv4ServiceNet, constants.DefaultIPv6ServiceNet},
+						PodSubnet:     []string{constants.DefaultIPv4PodNet, constants.DefaultIPv6PodNet},
 					},
 				},
-				ClusterNetwork: &v1alpha1.ClusterNetworkConfig{
-					ServiceSubnet: []string{constants.DefaultIPv4ServiceNet, constants.DefaultIPv6ServiceNet},
-					PodSubnet:     []string{constants.DefaultIPv4PodNet, constants.DefaultIPv6PodNet},
-				},
 			},
-		},
+		),
 	)
 
 	suite.Require().NoError(suite.state.Create(suite.ctx, cfg))

internal/app/machined/pkg/controllers/k8s/nodename_test.go

@@ -25,6 +25,7 @@ import (
 
 	k8sctrl "github.com/siderolabs/talos/internal/app/machined/pkg/controllers/k8s"
 	"github.com/siderolabs/talos/pkg/logging"
+	"github.com/siderolabs/talos/pkg/machinery/config/container"
 	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
 	"github.com/siderolabs/talos/pkg/machinery/resources/config"
 	"github.com/siderolabs/talos/pkg/machinery/resources/k8s"
@@ -102,17 +103,19 @@ func (suite *NodenameSuite) TestDefault() {
 	suite.Require().NoError(err)
 
 	cfg := config.NewMachineConfig(
-		&v1alpha1.Config{
-			ConfigVersion: "v1alpha1",
-			MachineConfig: &v1alpha1.MachineConfig{},
-			ClusterConfig: &v1alpha1.ClusterConfig{
-				ControlPlane: &v1alpha1.ControlPlaneConfig{
-					Endpoint: &v1alpha1.Endpoint{
-						URL: u,
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				ConfigVersion: "v1alpha1",
+				MachineConfig: &v1alpha1.MachineConfig{},
+				ClusterConfig: &v1alpha1.ClusterConfig{
+					ControlPlane: &v1alpha1.ControlPlaneConfig{
+						Endpoint: &v1alpha1.Endpoint{
+							URL: u,
+						},
 					},
 				},
 			},
-		},
+		),
 	)
 
 	suite.Require().NoError(suite.state.Create(suite.ctx, cfg))
@@ -137,21 +140,23 @@ func (suite *NodenameSuite) TestFQDN() {
 	suite.Require().NoError(err)
 
 	cfg := config.NewMachineConfig(
-		&v1alpha1.Config{
-			ConfigVersion: "v1alpha1",
-			MachineConfig: &v1alpha1.MachineConfig{
-				MachineKubelet: &v1alpha1.KubeletConfig{
-					KubeletRegisterWithFQDN: pointer.To(true),
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				ConfigVersion: "v1alpha1",
+				MachineConfig: &v1alpha1.MachineConfig{
+					MachineKubelet: &v1alpha1.KubeletConfig{
+						KubeletRegisterWithFQDN: pointer.To(true),
+					},
 				},
-			},
-			ClusterConfig: &v1alpha1.ClusterConfig{
-				ControlPlane: &v1alpha1.ControlPlaneConfig{
-					Endpoint: &v1alpha1.Endpoint{
-						URL: u,
+				ClusterConfig: &v1alpha1.ClusterConfig{
+					ControlPlane: &v1alpha1.ControlPlaneConfig{
+						Endpoint: &v1alpha1.Endpoint{
+							URL: u,
+						},
 					},
 				},
 			},
-		},
+		),
 	)
 
 	suite.Require().NoError(suite.state.Create(suite.ctx, cfg))
@@ -177,28 +182,6 @@ func (suite *NodenameSuite) TearDownTest() {
 	suite.ctxCancel()
 
 	suite.wg.Wait()
-
-	// trigger updates in resources to stop watch loops
-	err := suite.state.Create(
-		context.Background(), config.NewMachineConfig(
-			&v1alpha1.Config{
-				ConfigVersion: "v1alpha1",
-				MachineConfig: &v1alpha1.MachineConfig{},
-			},
-		),
-	)
-	if state.IsConflictError(err) {
-		err = suite.state.Destroy(context.Background(), config.NewMachineConfig(nil).Metadata())
-	}
-
-	suite.Require().NoError(err)
-
-	suite.Assert().NoError(
-		suite.state.Create(
-			context.Background(),
-			network.NewHostnameStatus(network.NamespaceName, "bar"),
-		),
-	)
 }
 
 func TestNodenameSuite(t *testing.T) {

internal/app/machined/pkg/controllers/k8s/static_endpoint_test.go

@@ -16,6 +16,7 @@ import (
 
 	"github.com/siderolabs/talos/internal/app/machined/pkg/controllers/ctest"
 	k8sctrl "github.com/siderolabs/talos/internal/app/machined/pkg/controllers/k8s"
+	"github.com/siderolabs/talos/pkg/machinery/config/container"
 	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
 	"github.com/siderolabs/talos/pkg/machinery/resources/config"
 	"github.com/siderolabs/talos/pkg/machinery/resources/k8s"
@@ -30,17 +31,19 @@ func (suite *StaticEndpointControllerSuite) TestReconcile() {
 	suite.Require().NoError(err)
 
 	cfg := config.NewMachineConfig(
-		&v1alpha1.Config{
-			ConfigVersion: "v1alpha1",
-			MachineConfig: &v1alpha1.MachineConfig{},
-			ClusterConfig: &v1alpha1.ClusterConfig{
-				ControlPlane: &v1alpha1.ControlPlaneConfig{
-					Endpoint: &v1alpha1.Endpoint{
-						URL: u,
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				ConfigVersion: "v1alpha1",
+				MachineConfig: &v1alpha1.MachineConfig{},
+				ClusterConfig: &v1alpha1.ClusterConfig{
+					ControlPlane: &v1alpha1.ControlPlaneConfig{
+						Endpoint: &v1alpha1.Endpoint{
+							URL: u,
+						},
 					},
 				},
 			},
-		},
+		),
 	)
 
 	suite.Require().NoError(suite.State().Create(suite.Ctx(), cfg))

internal/app/machined/pkg/controllers/k8s/static_pod_config_test.go

@@ -23,6 +23,7 @@ import (
 
 	k8sctrl "github.com/siderolabs/talos/internal/app/machined/pkg/controllers/k8s"
 	"github.com/siderolabs/talos/pkg/logging"
+	"github.com/siderolabs/talos/pkg/machinery/config/container"
 	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
 	"github.com/siderolabs/talos/pkg/machinery/resources/config"
 	"github.com/siderolabs/talos/pkg/machinery/resources/k8s"
@@ -100,32 +101,33 @@ func (suite *StaticPodConfigSuite) assertNoResource(md resource.Metadata) func()
 
 func (suite *StaticPodConfigSuite) TestReconcile() {
 	cfg := config.NewMachineConfig(
-		&v1alpha1.Config{
-			ConfigVersion: "v1alpha1",
-			MachineConfig: &v1alpha1.MachineConfig{
-				MachinePods: []v1alpha1.Unstructured{
-					{
-						Object: map[string]interface{}{
-							"apiVersion": "v1",
-							"kind":       "pod",
-							"metadata": map[string]interface{}{
-								"name": "nginx",
-							},
-							"spec": map[string]interface{}{
-								"containers": []interface{}{
-									map[string]interface{}{
-										"name":  "nginx",
-										"image": "nginx",
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				ConfigVersion: "v1alpha1",
+				MachineConfig: &v1alpha1.MachineConfig{
+					MachinePods: []v1alpha1.Unstructured{
+						{
+							Object: map[string]interface{}{
+								"apiVersion": "v1",
+								"kind":       "pod",
+								"metadata": map[string]interface{}{
+									"name": "nginx",
+								},
+								"spec": map[string]interface{}{
+									"containers": []interface{}{
+										map[string]interface{}{
+											"name":  "nginx",
+											"image": "nginx",
+										},
 									},
 								},
 							},
 						},
 					},
 				},
+				ClusterConfig: &v1alpha1.ClusterConfig{},
 			},
-			ClusterConfig: &v1alpha1.ClusterConfig{},
-		},
-	)
+		))
 
 	suite.Require().NoError(suite.state.Create(suite.ctx, cfg))
 

internal/app/machined/pkg/controllers/kubeaccess/config_test.go

@@ -14,8 +14,9 @@ import (
 	"github.com/stretchr/testify/suite"
 
 	kubeaccessctrl "github.com/siderolabs/talos/internal/app/machined/pkg/controllers/kubeaccess"
+	"github.com/siderolabs/talos/pkg/machinery/config/container"
+	"github.com/siderolabs/talos/pkg/machinery/config/machine"
 	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/machine"
 	"github.com/siderolabs/talos/pkg/machinery/resources/config"
 	"github.com/siderolabs/talos/pkg/machinery/resources/kubeaccess"
 )
@@ -34,7 +35,7 @@ func (suite *ConfigSuite) TestReconcileConfig() {
 
 	suite.Require().NoError(suite.state.Create(suite.ctx, machineType))
 
-	cfg := config.NewMachineConfig(&v1alpha1.Config{
+	cfg := config.NewMachineConfig(container.NewV1Alpha1(&v1alpha1.Config{
 		ConfigVersion: "v1alpha1",
 		MachineConfig: &v1alpha1.MachineConfig{
 			MachineFeatures: &v1alpha1.FeaturesConfig{
@@ -45,7 +46,7 @@ func (suite *ConfigSuite) TestReconcileConfig() {
 				},
 			},
 		},
-	})
+	}))
 
 	suite.Require().NoError(suite.state.Create(suite.ctx, cfg))
 
@@ -77,10 +78,10 @@ func (suite *ConfigSuite) TestReconcileDisabled() {
 
 	suite.Require().NoError(suite.state.Create(suite.ctx, machineType))
 
-	cfg := config.NewMachineConfig(&v1alpha1.Config{
+	cfg := config.NewMachineConfig(container.NewV1Alpha1(&v1alpha1.Config{
 		ConfigVersion: "v1alpha1",
 		MachineConfig: &v1alpha1.MachineConfig{},
-	})
+	}))
 
 	suite.Require().NoError(suite.state.Create(suite.ctx, cfg))
 
@@ -112,7 +113,7 @@ func (suite *ConfigSuite) TestReconcileWorker() {
 
 	suite.Require().NoError(suite.state.Create(suite.ctx, machineType))
 
-	cfg := config.NewMachineConfig(&v1alpha1.Config{
+	cfg := config.NewMachineConfig(container.NewV1Alpha1(&v1alpha1.Config{
 		ConfigVersion: "v1alpha1",
 		MachineConfig: &v1alpha1.MachineConfig{
 			MachineFeatures: &v1alpha1.FeaturesConfig{
@@ -123,7 +124,7 @@ func (suite *ConfigSuite) TestReconcileWorker() {
 				},
 			},
 		},
-	})
+	}))
 
 	suite.Require().NoError(suite.state.Create(suite.ctx, cfg))
 

internal/app/machined/pkg/controllers/kubeaccess/kubeaccess_test.go

@@ -19,8 +19,6 @@ import (
 	"github.com/stretchr/testify/suite"
 
 	"github.com/siderolabs/talos/pkg/logging"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
-	"github.com/siderolabs/talos/pkg/machinery/resources/config"
 )
 
 type KubeaccessSuite struct {
@@ -94,19 +92,4 @@ func (suite *KubeaccessSuite) TearDownTest() {
 	suite.ctxCancel()
 
 	suite.wg.Wait()
-
-	// trigger updates in resources to stop watch loops
-	err := suite.state.Create(
-		context.Background(), config.NewMachineConfig(
-			&v1alpha1.Config{
-				ConfigVersion: "v1alpha1",
-				MachineConfig: &v1alpha1.MachineConfig{},
-			},
-		),
-	)
-	if state.IsConflictError(err) {
-		err = suite.state.Destroy(context.Background(), config.NewMachineConfig(nil).Metadata())
-	}
-
-	suite.Assert().NoError(err)
 }

internal/app/machined/pkg/controllers/kubeaccess/serviceaccount/crd_controller.go

@@ -43,7 +43,7 @@ import (
 	"k8s.io/client-go/util/workqueue"
 
 	clientconfig "github.com/siderolabs/talos/pkg/machinery/client/config"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/generate"
+	"github.com/siderolabs/talos/pkg/machinery/config/generate/secrets"
 	"github.com/siderolabs/talos/pkg/machinery/constants"
 	"github.com/siderolabs/talos/pkg/machinery/role"
 )
@@ -639,7 +639,7 @@ func (t *CRDController) newSecret(talosSA *unstructured.Unstructured, roles role
 func (t *CRDController) generateTalosconfig(roles role.Set) ([]byte, error) {
 	var newCert *x509.PEMEncodedCertificateAndKey
 
-	newCert, err := generate.NewAdminCertificateAndKey(time.Now(), t.talosCA, roles, certTTL)
+	newCert, err := secrets.NewAdminCertificateAndKey(time.Now(), t.talosCA, roles, certTTL)
 	if err != nil {
 		return nil, err
 	}

internal/app/machined/pkg/controllers/kubespan/config_test.go

@@ -13,6 +13,7 @@ import (
 	"github.com/stretchr/testify/suite"
 
 	kubespanctrl "github.com/siderolabs/talos/internal/app/machined/pkg/controllers/kubespan"
+	"github.com/siderolabs/talos/pkg/machinery/config/container"
 	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
 	"github.com/siderolabs/talos/pkg/machinery/resources/config"
 	"github.com/siderolabs/talos/pkg/machinery/resources/kubespan"
@@ -27,20 +28,22 @@ func (suite *ConfigSuite) TestReconcileConfig() {
 
 	suite.startRuntime()
 
-	cfg := config.NewMachineConfig(&v1alpha1.Config{
-		ConfigVersion: "v1alpha1",
-		MachineConfig: &v1alpha1.MachineConfig{
-			MachineNetwork: &v1alpha1.NetworkConfig{
-				NetworkKubeSpan: &v1alpha1.NetworkKubeSpan{
-					KubeSpanEnabled: pointer.To(true),
+	cfg := config.NewMachineConfig(
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				ConfigVersion: "v1alpha1",
+				MachineConfig: &v1alpha1.MachineConfig{
+					MachineNetwork: &v1alpha1.NetworkConfig{
+						NetworkKubeSpan: &v1alpha1.NetworkKubeSpan{
+							KubeSpanEnabled: pointer.To(true),
+						},
+					},
 				},
-			},
-		},
-		ClusterConfig: &v1alpha1.ClusterConfig{
-			ClusterID:     "8XuV9TZHW08DOk3bVxQjH9ih_TBKjnh-j44tsCLSBzo=",
-			ClusterSecret: "I+1In7fLnpcRIjUmEoeugZnSyFoTF6MztLxICL5Yu0s=",
-		},
-	})
+				ClusterConfig: &v1alpha1.ClusterConfig{
+					ClusterID:     "8XuV9TZHW08DOk3bVxQjH9ih_TBKjnh-j44tsCLSBzo=",
+					ClusterSecret: "I+1In7fLnpcRIjUmEoeugZnSyFoTF6MztLxICL5Yu0s=",
+				},
+			}))
 
 	suite.Require().NoError(suite.state.Create(suite.ctx, cfg))
 
@@ -69,11 +72,13 @@ func (suite *ConfigSuite) TestReconcileDisabled() {
 
 	suite.startRuntime()
 
-	cfg := config.NewMachineConfig(&v1alpha1.Config{
-		ConfigVersion: "v1alpha1",
-		MachineConfig: &v1alpha1.MachineConfig{},
-		ClusterConfig: &v1alpha1.ClusterConfig{},
-	})
+	cfg := config.NewMachineConfig(
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				ConfigVersion: "v1alpha1",
+				MachineConfig: &v1alpha1.MachineConfig{},
+				ClusterConfig: &v1alpha1.ClusterConfig{},
+			}))
 
 	suite.Require().NoError(suite.state.Create(suite.ctx, cfg))
 

internal/app/machined/pkg/controllers/kubespan/endpoint_test.go

@@ -13,7 +13,7 @@ import (
 	"github.com/stretchr/testify/suite"
 
 	kubespanctrl "github.com/siderolabs/talos/internal/app/machined/pkg/controllers/kubespan"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/machine"
+	"github.com/siderolabs/talos/pkg/machinery/config/machine"
 	"github.com/siderolabs/talos/pkg/machinery/resources/cluster"
 	"github.com/siderolabs/talos/pkg/machinery/resources/kubespan"
 )

internal/app/machined/pkg/controllers/kubespan/kubespan_test.go

@@ -22,8 +22,6 @@ import (
 	"github.com/stretchr/testify/suite"
 
 	"github.com/siderolabs/talos/pkg/logging"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
-	"github.com/siderolabs/talos/pkg/machinery/resources/config"
 )
 
 type KubeSpanSuite struct {
@@ -131,19 +129,4 @@ func (suite *KubeSpanSuite) TearDownTest() {
 	suite.ctxCancel()
 
 	suite.wg.Wait()
-
-	// trigger updates in resources to stop watch loops
-	err := suite.state.Create(
-		context.Background(), config.NewMachineConfig(
-			&v1alpha1.Config{
-				ConfigVersion: "v1alpha1",
-				MachineConfig: &v1alpha1.MachineConfig{},
-			},
-		),
-	)
-	if state.IsConflictError(err) {
-		err = suite.state.Destroy(context.Background(), config.NewMachineConfig(nil).Metadata())
-	}
-
-	suite.Assert().NoError(err)
 }

internal/app/machined/pkg/controllers/kubespan/manager_test.go

@@ -480,5 +480,9 @@ func asUDP(addr netip.AddrPort) *net.UDPAddr {
 }
 
 func TestManagerSuite(t *testing.T) {
+	if os.Geteuid() != 0 {
+		t.Skip("requires root")
+	}
+
 	suite.Run(t, new(ManagerSuite))
 }

internal/app/machined/pkg/controllers/kubespan/nftables_test.go

@@ -5,6 +5,7 @@ package kubespan_test
 
 import (
 	"net/netip"
+	"os"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -16,6 +17,10 @@ import (
 )
 
 func TestNfTables(t *testing.T) {
+	if os.Geteuid() != 0 {
+		t.Skip("requires root")
+	}
+
 	// use a different mark to avoid conflicts with running kubespan
 	mgr := kubespan.NewNfTablesManager(
 		constants.KubeSpanDefaultFirewallMark<<1,

internal/app/machined/pkg/controllers/kubespan/peer_spec_test.go

@@ -15,7 +15,7 @@ import (
 
 	clusteradapter "github.com/siderolabs/talos/internal/app/machined/pkg/adapters/cluster"
 	kubespanctrl "github.com/siderolabs/talos/internal/app/machined/pkg/controllers/kubespan"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/machine"
+	"github.com/siderolabs/talos/pkg/machinery/config/machine"
 	"github.com/siderolabs/talos/pkg/machinery/constants"
 	"github.com/siderolabs/talos/pkg/machinery/resources/cluster"
 	"github.com/siderolabs/talos/pkg/machinery/resources/config"

internal/app/machined/pkg/controllers/kubespan/routing_rules_test.go

@@ -4,6 +4,7 @@
 package kubespan_test
 
 import (
+	"os"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -13,6 +14,10 @@ import (
 )
 
 func TestRoutingRules(t *testing.T) {
+	if os.Geteuid() != 0 {
+		t.Skip("requires root")
+	}
+
 	// use a different table/mark to avoid conflicts with running kubespan
 	mgr := kubespan.NewRulesManager(constants.KubeSpanDefaultRoutingTable+10, constants.KubeSpanDefaultForceFirewallMark<<1, constants.KubeSpanDefaultFirewallMask<<1)
 

internal/app/machined/pkg/controllers/network/address_config_test.go

@@ -28,6 +28,7 @@ import (
 
 	netctrl "github.com/siderolabs/talos/internal/app/machined/pkg/controllers/network"
 	"github.com/siderolabs/talos/pkg/logging"
+	"github.com/siderolabs/talos/pkg/machinery/config/container"
 	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
 	"github.com/siderolabs/talos/pkg/machinery/nethelpers"
 	"github.com/siderolabs/talos/pkg/machinery/resources/config"
@@ -162,61 +163,63 @@ func (suite *AddressConfigSuite) TestMachineConfiguration() {
 	suite.Require().NoError(err)
 
 	cfg := config.NewMachineConfig(
-		&v1alpha1.Config{
-			ConfigVersion: "v1alpha1",
-			MachineConfig: &v1alpha1.MachineConfig{
-				MachineNetwork: &v1alpha1.NetworkConfig{
-					NetworkInterfaces: []*v1alpha1.Device{
-						{
-							DeviceInterface: "eth3",
-							DeviceCIDR:      "192.168.0.24/28",
-						},
-						{
-							DeviceIgnore:    pointer.To(true),
-							DeviceInterface: "eth4",
-							DeviceCIDR:      "192.168.0.24/28",
-						},
-						{
-							DeviceInterface: "eth2",
-							DeviceCIDR:      "2001:470:6d:30e:8ed2:b60c:9d2f:803a/64",
-						},
-						{
-							DeviceInterface: "eth5",
-							DeviceCIDR:      "10.5.0.7",
-						},
-						{
-							DeviceInterface: "eth6",
-							DeviceAddresses: []string{
-								"10.5.0.8",
-								"2001:470:6d:30e:8ed2:b60c:9d2f:803b/64",
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				ConfigVersion: "v1alpha1",
+				MachineConfig: &v1alpha1.MachineConfig{
+					MachineNetwork: &v1alpha1.NetworkConfig{
+						NetworkInterfaces: []*v1alpha1.Device{
+							{
+								DeviceInterface: "eth3",
+								DeviceCIDR:      "192.168.0.24/28",
 							},
-						},
-						{
-							DeviceInterface: "eth0",
-							DeviceVlans: []*v1alpha1.Vlan{
-								{
-									VlanID:   24,
-									VlanCIDR: "10.0.0.1/8",
+							{
+								DeviceIgnore:    pointer.To(true),
+								DeviceInterface: "eth4",
+								DeviceCIDR:      "192.168.0.24/28",
+							},
+							{
+								DeviceInterface: "eth2",
+								DeviceCIDR:      "2001:470:6d:30e:8ed2:b60c:9d2f:803a/64",
+							},
+							{
+								DeviceInterface: "eth5",
+								DeviceCIDR:      "10.5.0.7",
+							},
+							{
+								DeviceInterface: "eth6",
+								DeviceAddresses: []string{
+									"10.5.0.8",
+									"2001:470:6d:30e:8ed2:b60c:9d2f:803b/64",
 								},
-								{
-									VlanID: 25,
-									VlanAddresses: []string{
-										"11.0.0.1/8",
+							},
+							{
+								DeviceInterface: "eth0",
+								DeviceVlans: []*v1alpha1.Vlan{
+									{
+										VlanID:   24,
+										VlanCIDR: "10.0.0.1/8",
+									},
+									{
+										VlanID: 25,
+										VlanAddresses: []string{
+											"11.0.0.1/8",
+										},
 									},
 								},
 							},
 						},
 					},
 				},
-			},
-			ClusterConfig: &v1alpha1.ClusterConfig{
-				ControlPlane: &v1alpha1.ControlPlaneConfig{
-					Endpoint: &v1alpha1.Endpoint{
-						URL: u,
+				ClusterConfig: &v1alpha1.ClusterConfig{
+					ControlPlane: &v1alpha1.ControlPlaneConfig{
+						Endpoint: &v1alpha1.Endpoint{
+							URL: u,
+						},
 					},
 				},
 			},
-		},
+		),
 	)
 
 	suite.Require().NoError(suite.state.Create(suite.ctx, cfg))
@@ -240,21 +243,6 @@ func (suite *AddressConfigSuite) TearDownTest() {
 	suite.ctxCancel()
 
 	suite.wg.Wait()
-
-	// trigger updates in resources to stop watch loops
-	err := suite.state.Create(
-		context.Background(), config.NewMachineConfig(
-			&v1alpha1.Config{
-				ConfigVersion: "v1alpha1",
-				MachineConfig: &v1alpha1.MachineConfig{},
-			},
-		),
-	)
-	if state.IsConflictError(err) {
-		err = suite.state.Destroy(context.Background(), config.NewMachineConfig(nil).Metadata())
-	}
-
-	suite.Require().NoError(err)
 }
 
 func TestAddressConfigSuite(t *testing.T) {

internal/app/machined/pkg/controllers/network/address_merge_test.go

@@ -273,14 +273,6 @@ func (suite *AddressMergeSuite) TearDownTest() {
 	suite.ctxCancel()
 
 	suite.wg.Wait()
-
-	// trigger updates in resources to stop watch loops
-	suite.Assert().NoError(
-		suite.state.Create(
-			context.Background(),
-			network.NewAddressSpec(network.ConfigNamespaceName, "bar"),
-		),
-	)
 }
 
 func TestAddressMergeSuite(t *testing.T) {

internal/app/machined/pkg/controllers/network/address_spec_test.go

@@ -12,6 +12,7 @@ import (
 	"math/rand"
 	"net"
 	"net/netip"
+	"os"
 	"sync"
 	"testing"
 	"time"
@@ -244,16 +245,12 @@ func (suite *AddressSpecSuite) TearDownTest() {
 	suite.ctxCancel()
 
 	suite.wg.Wait()
-
-	// trigger updates in resources to stop watch loops
-	suite.Assert().NoError(
-		suite.state.Create(
-			context.Background(),
-			network.NewAddressSpec(network.NamespaceName, "bar"),
-		),
-	)
 }
 
 func TestAddressSpecSuite(t *testing.T) {
+	if os.Geteuid() != 0 {
+		t.Skip("requires root")
+	}
+
 	suite.Run(t, new(AddressSpecSuite))
 }

internal/app/machined/pkg/controllers/network/device_config_test.go

@@ -18,6 +18,8 @@ import (
 
 	"github.com/siderolabs/talos/internal/app/machined/pkg/controllers/ctest"
 	netctrl "github.com/siderolabs/talos/internal/app/machined/pkg/controllers/network"
+	configs "github.com/siderolabs/talos/pkg/machinery/config/config"
+	"github.com/siderolabs/talos/pkg/machinery/config/container"
 	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
 	"github.com/siderolabs/talos/pkg/machinery/nethelpers"
 	"github.com/siderolabs/talos/pkg/machinery/resources/config"
@@ -29,7 +31,7 @@ type DeviceConfigSpecSuite struct {
 }
 
 func (suite *DeviceConfigSpecSuite) TestDeviceConfigs() {
-	cfgProvider := &v1alpha1.Config{
+	cfgProvider := container.NewV1Alpha1(&v1alpha1.Config{
 		ConfigVersion: "v1alpha1",
 		MachineConfig: &v1alpha1.MachineConfig{
 			MachineNetwork: &v1alpha1.NetworkConfig{
@@ -54,13 +56,13 @@ func (suite *DeviceConfigSpecSuite) TestDeviceConfigs() {
 				},
 			},
 		},
-	}
+	})
 
 	cfg := config.NewMachineConfig(cfgProvider)
 
-	devices := map[string]*v1alpha1.Device{}
-	for index, item := range cfgProvider.MachineConfig.MachineNetwork.NetworkInterfaces {
-		devices[fmt.Sprintf("%s/%03d", item.DeviceInterface, index)] = item
+	devices := map[string]configs.Device{}
+	for index, item := range cfgProvider.Machine().Network().Devices() {
+		devices[fmt.Sprintf("%s/%03d", item.Interface(), index)] = item
 	}
 
 	suite.Require().NoError(suite.State().Create(suite.Ctx(), cfg))
@@ -75,7 +77,7 @@ func (suite *DeviceConfigSpecSuite) TestDeviceConfigs() {
 func (suite *DeviceConfigSpecSuite) TestSelectors() {
 	kernelDriver := "thedriver"
 
-	cfgProvider := &v1alpha1.Config{
+	cfgProvider := container.NewV1Alpha1(&v1alpha1.Config{
 		ConfigVersion: "v1alpha1",
 		MachineConfig: &v1alpha1.MachineConfig{
 			MachineNetwork: &v1alpha1.NetworkConfig{
@@ -90,7 +92,7 @@ func (suite *DeviceConfigSpecSuite) TestSelectors() {
 				},
 			},
 		},
-	}
+	})
 
 	cfg := config.NewMachineConfig(cfgProvider)
 	suite.Require().NoError(suite.State().Create(suite.Ctx(), cfg))
@@ -111,7 +113,7 @@ func (suite *DeviceConfigSpecSuite) TestSelectors() {
 }
 
 func (suite *DeviceConfigSpecSuite) TestBondSelectors() {
-	cfgProvider := &v1alpha1.Config{
+	cfgProvider := container.NewV1Alpha1(&v1alpha1.Config{
 		ConfigVersion: "v1alpha1",
 		MachineConfig: &v1alpha1.MachineConfig{
 			MachineNetwork: &v1alpha1.NetworkConfig{
@@ -135,7 +137,7 @@ func (suite *DeviceConfigSpecSuite) TestBondSelectors() {
 				},
 			},
 		},
-	}
+	})
 
 	cfg := config.NewMachineConfig(cfgProvider)
 	suite.Require().NoError(suite.State().Create(suite.Ctx(), cfg))

internal/app/machined/pkg/controllers/network/etcfile_test.go

@@ -25,6 +25,7 @@ import (
 
 	netctrl "github.com/siderolabs/talos/internal/app/machined/pkg/controllers/network"
 	"github.com/siderolabs/talos/pkg/logging"
+	"github.com/siderolabs/talos/pkg/machinery/config/container"
 	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
 	"github.com/siderolabs/talos/pkg/machinery/resources/config"
 	"github.com/siderolabs/talos/pkg/machinery/resources/files"
@@ -66,30 +67,32 @@ func (suite *EtcFileConfigSuite) SetupTest() {
 	suite.Require().NoError(err)
 
 	suite.cfg = config.NewMachineConfig(
-		&v1alpha1.Config{
-			ConfigVersion: "v1alpha1",
-			MachineConfig: &v1alpha1.MachineConfig{
-				MachineNetwork: &v1alpha1.NetworkConfig{
-					ExtraHostEntries: []*v1alpha1.ExtraHost{
-						{
-							HostIP:      "10.0.0.1",
-							HostAliases: []string{"a", "b"},
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				ConfigVersion: "v1alpha1",
+				MachineConfig: &v1alpha1.MachineConfig{
+					MachineNetwork: &v1alpha1.NetworkConfig{
+						ExtraHostEntries: []*v1alpha1.ExtraHost{
+							{
+								HostIP:      "10.0.0.1",
+								HostAliases: []string{"a", "b"},
+							},
+							{
+								HostIP:      "10.0.0.2",
+								HostAliases: []string{"c", "d"},
+							},
 						},
-						{
-							HostIP:      "10.0.0.2",
-							HostAliases: []string{"c", "d"},
+					},
+				},
+				ClusterConfig: &v1alpha1.ClusterConfig{
+					ControlPlane: &v1alpha1.ControlPlaneConfig{
+						Endpoint: &v1alpha1.Endpoint{
+							URL: u,
 						},
 					},
 				},
 			},
-			ClusterConfig: &v1alpha1.ClusterConfig{
-				ControlPlane: &v1alpha1.ControlPlaneConfig{
-					Endpoint: &v1alpha1.Endpoint{
-						URL: u,
-					},
-				},
-			},
-		},
+		),
 	)
 
 	suite.defaultAddress = network.NewNodeAddress(network.NamespaceName, network.NodeAddressDefaultID)
@@ -182,14 +185,16 @@ func (suite *EtcFileConfigSuite) TestNoExtraHosts() {
 
 func (suite *EtcFileConfigSuite) TestNoSearchDomain() {
 	cfg := config.NewMachineConfig(
-		&v1alpha1.Config{
-			ConfigVersion: "v1alpha1",
-			MachineConfig: &v1alpha1.MachineConfig{
-				MachineNetwork: &v1alpha1.NetworkConfig{
-					NetworkDisableSearchDomain: pointer.To(true),
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				ConfigVersion: "v1alpha1",
+				MachineConfig: &v1alpha1.MachineConfig{
+					MachineNetwork: &v1alpha1.NetworkConfig{
+						NetworkDisableSearchDomain: pointer.To(true),
+					},
 				},
 			},
-		},
+		),
 	)
 	suite.testFiles(
 		[]resource.Resource{cfg, suite.defaultAddress, suite.hostnameStatus, suite.resolverStatus},
@@ -230,40 +235,6 @@ func (suite *EtcFileConfigSuite) TearDownTest() {
 	suite.ctxCancel()
 
 	suite.wg.Wait()
-
-	// trigger updates in resources to stop watch loops
-	err := suite.state.Create(
-		context.Background(), config.NewMachineConfig(
-			&v1alpha1.Config{
-				ConfigVersion: "v1alpha1",
-				MachineConfig: &v1alpha1.MachineConfig{},
-			},
-		),
-	)
-	if state.IsConflictError(err) {
-		err = suite.state.Destroy(context.Background(), config.NewMachineConfig(nil).Metadata())
-	}
-
-	suite.Require().NoError(err)
-
-	suite.Assert().NoError(
-		suite.state.Create(
-			context.Background(),
-			network.NewHostnameStatus(network.NamespaceName, "bar"),
-		),
-	)
-	suite.Assert().NoError(
-		suite.state.Create(
-			context.Background(),
-			network.NewResolverStatus(network.NamespaceName, "bar"),
-		),
-	)
-	suite.Assert().NoError(
-		suite.state.Create(
-			context.Background(),
-			network.NewNodeAddress(network.NamespaceName, "bar"),
-		),
-	)
 }
 
 func TestEtcFileConfigSuite(t *testing.T) {

internal/app/machined/pkg/controllers/network/hardware_addr_test.go

@@ -146,14 +146,6 @@ func (suite *HardwareAddrSuite) TearDownTest() {
 	suite.ctxCancel()
 
 	suite.wg.Wait()
-
-	// trigger updates in resources to stop watch loops
-	suite.Assert().NoError(
-		suite.state.Create(
-			context.Background(),
-			network.NewLinkStatus(network.NamespaceName, "bar"),
-		),
-	)
 }
 
 func TestHardwareAddrSuite(t *testing.T) {

internal/app/machined/pkg/controllers/network/hostname_config_test.go

@@ -31,6 +31,7 @@ import (
 	"github.com/siderolabs/talos/internal/app/machined/pkg/controllers/ctest"
 	netctrl "github.com/siderolabs/talos/internal/app/machined/pkg/controllers/network"
 	"github.com/siderolabs/talos/pkg/logging"
+	"github.com/siderolabs/talos/pkg/machinery/config/container"
 	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
 	"github.com/siderolabs/talos/pkg/machinery/resources/cluster"
 	"github.com/siderolabs/talos/pkg/machinery/resources/config"
@@ -116,7 +117,7 @@ func (suite *HostnameConfigSuite) TestDefaultIPBasedHostname() {
 
 	suite.startRuntime()
 
-	cfg := config.NewMachineConfig(&v1alpha1.Config{ConfigVersion: "v1alpha1"})
+	cfg := config.NewMachineConfig(container.NewV1Alpha1(&v1alpha1.Config{ConfigVersion: "v1alpha1"}))
 	suite.Require().NoError(suite.state.Create(suite.ctx, cfg))
 
 	defaultAddress := network.NewNodeAddress(network.NamespaceName, network.NodeAddressDefaultID)
@@ -141,14 +142,16 @@ func (suite *HostnameConfigSuite) TestDefaultStableHostname() {
 	suite.startRuntime()
 
 	cfg := config.NewMachineConfig(
-		&v1alpha1.Config{
-			ConfigVersion: "v1alpha1",
-			MachineConfig: &v1alpha1.MachineConfig{
-				MachineFeatures: &v1alpha1.FeaturesConfig{
-					StableHostname: pointer.To(true),
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				ConfigVersion: "v1alpha1",
+				MachineConfig: &v1alpha1.MachineConfig{
+					MachineFeatures: &v1alpha1.FeaturesConfig{
+						StableHostname: pointer.To(true),
+					},
 				},
 			},
-		},
+		),
 	)
 
 	suite.Require().NoError(suite.state.Create(suite.ctx, cfg))
@@ -198,21 +201,23 @@ func (suite *HostnameConfigSuite) TestMachineConfiguration() {
 	suite.Require().NoError(err)
 
 	cfg := config.NewMachineConfig(
-		&v1alpha1.Config{
-			ConfigVersion: "v1alpha1",
-			MachineConfig: &v1alpha1.MachineConfig{
-				MachineNetwork: &v1alpha1.NetworkConfig{
-					NetworkHostname: "foo",
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				ConfigVersion: "v1alpha1",
+				MachineConfig: &v1alpha1.MachineConfig{
+					MachineNetwork: &v1alpha1.NetworkConfig{
+						NetworkHostname: "foo",
+					},
 				},
-			},
-			ClusterConfig: &v1alpha1.ClusterConfig{
-				ControlPlane: &v1alpha1.ControlPlaneConfig{
-					Endpoint: &v1alpha1.Endpoint{
-						URL: u,
+				ClusterConfig: &v1alpha1.ClusterConfig{
+					ControlPlane: &v1alpha1.ControlPlaneConfig{
+						Endpoint: &v1alpha1.Endpoint{
+							URL: u,
+						},
 					},
 				},
 			},
-		},
+		),
 	)
 
 	suite.Require().NoError(suite.state.Create(suite.ctx, cfg))
@@ -228,7 +233,7 @@ func (suite *HostnameConfigSuite) TestMachineConfiguration() {
 	)
 
 	ctest.UpdateWithConflicts(suite, cfg, func(r *config.MachineConfig) error {
-		r.Config().(*v1alpha1.Config).MachineConfig.MachineNetwork.NetworkHostname = strings.Repeat("a", 128)
+		r.Container().RawV1Alpha1().MachineConfig.MachineNetwork.NetworkHostname = strings.Repeat("a", 128)
 
 		return nil
 	})
@@ -249,28 +254,6 @@ func (suite *HostnameConfigSuite) TearDownTest() {
 	suite.ctxCancel()
 
 	suite.wg.Wait()
-
-	// trigger updates in resources to stop watch loops
-	err := suite.state.Create(
-		context.Background(), config.NewMachineConfig(
-			&v1alpha1.Config{
-				ConfigVersion: "v1alpha1",
-				MachineConfig: &v1alpha1.MachineConfig{},
-			},
-		),
-	)
-	if state.IsConflictError(err) {
-		err = suite.state.Destroy(context.Background(), config.NewMachineConfig(nil).Metadata())
-	}
-
-	suite.Require().NoError(err)
-
-	suite.Assert().NoError(
-		suite.state.Create(
-			context.Background(),
-			network.NewNodeAddress(network.NamespaceName, "bar"),
-		),
-	)
 }
 
 func TestHostnameConfigSuite(t *testing.T) {

internal/app/machined/pkg/controllers/network/hostname_merge_test.go

@@ -124,14 +124,6 @@ func (suite *HostnameMergeSuite) TearDownTest() {
 	suite.ctxCancel()
 
 	suite.wg.Wait()
-
-	// trigger updates in resources to stop watch loops
-	suite.Assert().NoError(
-		suite.state.Create(
-			context.Background(),
-			network.NewHostnameSpec(network.ConfigNamespaceName, "bar"),
-		),
-	)
 }
 
 func TestHostnameMergeSuite(t *testing.T) {

internal/app/machined/pkg/controllers/network/hostname_spec_test.go

@@ -117,14 +117,6 @@ func (suite *HostnameSpecSuite) TearDownTest() {
 	suite.ctxCancel()
 
 	suite.wg.Wait()
-
-	// trigger updates in resources to stop watch loops
-	suite.Assert().NoError(
-		suite.state.Create(
-			context.Background(),
-			network.NewHostnameSpec(network.NamespaceName, "bar"),
-		),
-	)
 }
 
 func TestHostnameSpecSuite(t *testing.T) {

internal/app/machined/pkg/controllers/network/link_config_test.go

@@ -28,6 +28,7 @@ import (
 
 	netctrl "github.com/siderolabs/talos/internal/app/machined/pkg/controllers/network"
 	"github.com/siderolabs/talos/pkg/logging"
+	"github.com/siderolabs/talos/pkg/machinery/config/container"
 	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
 	"github.com/siderolabs/talos/pkg/machinery/nethelpers"
 	"github.com/siderolabs/talos/pkg/machinery/resources/config"
@@ -150,101 +151,103 @@ func (suite *LinkConfigSuite) TestMachineConfiguration() {
 	suite.Require().NoError(err)
 
 	cfg := config.NewMachineConfig(
-		&v1alpha1.Config{
-			ConfigVersion: "v1alpha1",
-			MachineConfig: &v1alpha1.MachineConfig{
-				MachineNetwork: &v1alpha1.NetworkConfig{
-					NetworkInterfaces: []*v1alpha1.Device{
-						{
-							DeviceInterface: "eth0",
-							DeviceVlans: []*v1alpha1.Vlan{
-								{
-									VlanID:  24,
-									VlanMTU: 1000,
-									VlanAddresses: []string{
-										"10.0.0.1/8",
-									},
-								},
-								{
-									VlanID: 48,
-									VlanAddresses: []string{
-										"10.0.0.2/8",
-									},
-								},
-							},
-						},
-						{
-							DeviceInterface: "eth1",
-							DeviceAddresses: []string{"192.168.0.24/28"},
-						},
-						{
-							DeviceInterface: "eth1",
-							DeviceMTU:       9001,
-						},
-						{
-							DeviceIgnore:    pointer.To(true),
-							DeviceInterface: "eth2",
-							DeviceAddresses: []string{"192.168.0.24/28"},
-						},
-						{
-							DeviceInterface: "eth2",
-						},
-						{
-							DeviceInterface: "bond0",
-							DeviceBond: &v1alpha1.Bond{
-								BondInterfaces: []string{"eth2", "eth3"},
-								BondMode:       "balance-xor",
-							},
-						},
-						{
-							DeviceInterface: "bond1",
-							DeviceBond: &v1alpha1.Bond{
-								BondDeviceSelectors: []v1alpha1.NetworkDeviceSelector{{
-									NetworkDeviceKernelDriver: kernelDriver,
-								}},
-								BondMode: "balance-xor",
-							},
-						},
-						{
-							DeviceInterface: "eth4",
-							DeviceAddresses: []string{"192.168.0.42/24"},
-						},
-						{
-							DeviceInterface: "eth5",
-							DeviceAddresses: []string{"192.168.0.43/24"},
-						},
-						{
-							DeviceInterface: "br0",
-							DeviceBridge: &v1alpha1.Bridge{
-								BridgedInterfaces: []string{"eth4", "eth5"},
-								BridgeSTP: &v1alpha1.STP{
-									STPEnabled: pointer.To(false),
-								},
-							},
-						},
-						{
-							DeviceInterface: "br0",
-							DeviceBridge: &v1alpha1.Bridge{
-								BridgeSTP: &v1alpha1.STP{
-									STPEnabled: pointer.To(true),
-								},
-							},
-						},
-						{
-							DeviceInterface: "dummy0",
-							DeviceDummy:     pointer.To(true),
-						},
-						{
-							DeviceInterface: "wireguard0",
-							DeviceWireguardConfig: &v1alpha1.DeviceWireguardConfig{
-								WireguardPrivateKey: "ABC",
-								WireguardPeers: []*v1alpha1.DeviceWireguardPeer{
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				ConfigVersion: "v1alpha1",
+				MachineConfig: &v1alpha1.MachineConfig{
+					MachineNetwork: &v1alpha1.NetworkConfig{
+						NetworkInterfaces: []*v1alpha1.Device{
+							{
+								DeviceInterface: "eth0",
+								DeviceVlans: []*v1alpha1.Vlan{
 									{
-										WireguardPublicKey: "DEF",
-										WireguardEndpoint:  "10.0.0.1:3000",
-										WireguardAllowedIPs: []string{
-											"10.2.3.0/24",
-											"10.2.4.0/24",
+										VlanID:  24,
+										VlanMTU: 1000,
+										VlanAddresses: []string{
+											"10.0.0.1/8",
+										},
+									},
+									{
+										VlanID: 48,
+										VlanAddresses: []string{
+											"10.0.0.2/8",
+										},
+									},
+								},
+							},
+							{
+								DeviceInterface: "eth1",
+								DeviceAddresses: []string{"192.168.0.24/28"},
+							},
+							{
+								DeviceInterface: "eth1",
+								DeviceMTU:       9001,
+							},
+							{
+								DeviceIgnore:    pointer.To(true),
+								DeviceInterface: "eth2",
+								DeviceAddresses: []string{"192.168.0.24/28"},
+							},
+							{
+								DeviceInterface: "eth2",
+							},
+							{
+								DeviceInterface: "bond0",
+								DeviceBond: &v1alpha1.Bond{
+									BondInterfaces: []string{"eth2", "eth3"},
+									BondMode:       "balance-xor",
+								},
+							},
+							{
+								DeviceInterface: "bond1",
+								DeviceBond: &v1alpha1.Bond{
+									BondDeviceSelectors: []v1alpha1.NetworkDeviceSelector{{
+										NetworkDeviceKernelDriver: kernelDriver,
+									}},
+									BondMode: "balance-xor",
+								},
+							},
+							{
+								DeviceInterface: "eth4",
+								DeviceAddresses: []string{"192.168.0.42/24"},
+							},
+							{
+								DeviceInterface: "eth5",
+								DeviceAddresses: []string{"192.168.0.43/24"},
+							},
+							{
+								DeviceInterface: "br0",
+								DeviceBridge: &v1alpha1.Bridge{
+									BridgedInterfaces: []string{"eth4", "eth5"},
+									BridgeSTP: &v1alpha1.STP{
+										STPEnabled: pointer.To(false),
+									},
+								},
+							},
+							{
+								DeviceInterface: "br0",
+								DeviceBridge: &v1alpha1.Bridge{
+									BridgeSTP: &v1alpha1.STP{
+										STPEnabled: pointer.To(true),
+									},
+								},
+							},
+							{
+								DeviceInterface: "dummy0",
+								DeviceDummy:     pointer.To(true),
+							},
+							{
+								DeviceInterface: "wireguard0",
+								DeviceWireguardConfig: &v1alpha1.DeviceWireguardConfig{
+									WireguardPrivateKey: "ABC",
+									WireguardPeers: []*v1alpha1.DeviceWireguardPeer{
+										{
+											WireguardPublicKey: "DEF",
+											WireguardEndpoint:  "10.0.0.1:3000",
+											WireguardAllowedIPs: []string{
+												"10.2.3.0/24",
+												"10.2.4.0/24",
+											},
 										},
 									},
 								},
@@ -252,15 +255,15 @@ func (suite *LinkConfigSuite) TestMachineConfiguration() {
 						},
 					},
 				},
-			},
-			ClusterConfig: &v1alpha1.ClusterConfig{
-				ControlPlane: &v1alpha1.ControlPlaneConfig{
-					Endpoint: &v1alpha1.Endpoint{
-						URL: u,
+				ClusterConfig: &v1alpha1.ClusterConfig{
+					ControlPlane: &v1alpha1.ControlPlaneConfig{
+						Endpoint: &v1alpha1.Endpoint{
+							URL: u,
+						},
 					},
 				},
 			},
-		},
+		),
 	)
 
 	suite.Require().NoError(suite.state.Create(suite.ctx, cfg))
@@ -393,48 +396,50 @@ func (suite *LinkConfigSuite) TestDefaultUp() {
 	suite.Require().NoError(err)
 
 	cfg := config.NewMachineConfig(
-		&v1alpha1.Config{
-			ConfigVersion: "v1alpha1",
-			MachineConfig: &v1alpha1.MachineConfig{
-				MachineNetwork: &v1alpha1.NetworkConfig{
-					NetworkInterfaces: []*v1alpha1.Device{
-						{
-							DeviceInterface: "eth0",
-							DeviceVlans: []*v1alpha1.Vlan{
-								{
-									VlanID: 24,
-									VlanAddresses: []string{
-										"10.0.0.1/8",
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				ConfigVersion: "v1alpha1",
+				MachineConfig: &v1alpha1.MachineConfig{
+					MachineNetwork: &v1alpha1.NetworkConfig{
+						NetworkInterfaces: []*v1alpha1.Device{
+							{
+								DeviceInterface: "eth0",
+								DeviceVlans: []*v1alpha1.Vlan{
+									{
+										VlanID: 24,
+										VlanAddresses: []string{
+											"10.0.0.1/8",
+										},
 									},
-								},
-								{
-									VlanID: 48,
-									VlanAddresses: []string{
-										"10.0.0.2/8",
+									{
+										VlanID: 48,
+										VlanAddresses: []string{
+											"10.0.0.2/8",
+										},
 									},
 								},
 							},
-						},
-						{
-							DeviceInterface: "bond0",
-							DeviceBond: &v1alpha1.Bond{
-								BondInterfaces: []string{
-									"eth3",
-									"eth4",
+							{
+								DeviceInterface: "bond0",
+								DeviceBond: &v1alpha1.Bond{
+									BondInterfaces: []string{
+										"eth3",
+										"eth4",
+									},
 								},
 							},
 						},
 					},
 				},
-			},
-			ClusterConfig: &v1alpha1.ClusterConfig{
-				ControlPlane: &v1alpha1.ControlPlaneConfig{
-					Endpoint: &v1alpha1.Endpoint{
-						URL: u,
+				ClusterConfig: &v1alpha1.ClusterConfig{
+					ControlPlane: &v1alpha1.ControlPlaneConfig{
+						Endpoint: &v1alpha1.Endpoint{
+							URL: u,
+						},
 					},
 				},
 			},
-		},
+		),
 	)
 
 	suite.Require().NoError(suite.state.Create(suite.ctx, cfg))
@@ -472,28 +477,6 @@ func (suite *LinkConfigSuite) TearDownTest() {
 	suite.ctxCancel()
 
 	suite.wg.Wait()
-
-	// trigger updates in resources to stop watch loops
-	err := suite.state.Create(
-		context.Background(), config.NewMachineConfig(
-			&v1alpha1.Config{
-				ConfigVersion: "v1alpha1",
-				MachineConfig: &v1alpha1.MachineConfig{},
-			},
-		),
-	)
-	if state.IsConflictError(err) {
-		err = suite.state.Destroy(context.Background(), config.NewMachineConfig(nil).Metadata())
-	}
-
-	suite.Require().NoError(err)
-
-	suite.Assert().NoError(
-		suite.state.Create(
-			context.Background(),
-			network.NewLinkStatus(network.NamespaceName, "bar"),
-		),
-	)
 }
 
 func TestLinkConfigSuite(t *testing.T) {

internal/app/machined/pkg/controllers/network/link_merge_test.go

@@ -373,14 +373,6 @@ func (suite *LinkMergeSuite) TearDownTest() {
 	suite.ctxCancel()
 
 	suite.wg.Wait()
-
-	// trigger updates in resources to stop watch loops
-	suite.Assert().NoError(
-		suite.state.Create(
-			context.Background(),
-			network.NewLinkSpec(network.ConfigNamespaceName, "bar"),
-		),
-	)
 }
 
 func TestLinkMergeSuite(t *testing.T) {

internal/app/machined/pkg/controllers/network/link_spec_test.go

@@ -11,6 +11,7 @@ import (
 	"log"
 	"math/rand"
 	"net/netip"
+	"os"
 	"sync"
 	"testing"
 	"time"
@@ -891,12 +892,13 @@ func (suite *LinkSpecSuite) TearDownTest() {
 	suite.ctxCancel()
 
 	suite.wg.Wait()
-
-	// trigger updates in resources to stop watch loops
-	suite.Assert().NoError(suite.state.Create(context.Background(), network.NewLinkSpec(network.NamespaceName, "bar")))
 }
 
 func TestLinkSpecSuite(t *testing.T) {
+	if os.Geteuid() != 0 {
+		t.Skip("requires root")
+	}
+
 	suite.Run(t, new(LinkSpecSuite))
 }
 

internal/app/machined/pkg/controllers/network/link_status_test.go

@@ -12,6 +12,7 @@ import (
 	"log"
 	"math/rand"
 	"net"
+	"os"
 	"strings"
 	"sync"
 	"testing"
@@ -200,6 +201,10 @@ func (suite *LinkStatusSuite) TestLoopbackInterface() {
 }
 
 func (suite *LinkStatusSuite) TestDummyInterface() {
+	if os.Geteuid() != 0 {
+		suite.T().Skip("requires root")
+	}
+
 	dummyInterface := suite.uniqueDummyInterface()
 
 	conn, err := rtnetlink.Dial(nil)
@@ -287,6 +292,10 @@ func (suite *LinkStatusSuite) TestDummyInterface() {
 }
 
 func (suite *LinkStatusSuite) TestBridgeInterface() {
+	if os.Geteuid() != 0 {
+		suite.T().Skip("requires root")
+	}
+
 	bridgeInterface := suite.uniqueDummyInterface()
 
 	conn, err := rtnetlink.Dial(nil)
@@ -352,14 +361,6 @@ func (suite *LinkStatusSuite) TearDownTest() {
 	suite.ctxCancel()
 
 	suite.wg.Wait()
-
-	// trigger updates in resources to stop watch loops
-	suite.Assert().NoError(
-		suite.state.Create(
-			context.Background(),
-			network.NewLinkRefresh(network.NamespaceName, "bar"),
-		),
-	)
 }
 
 func TestLinkStatusSuite(t *testing.T) {

internal/app/machined/pkg/controllers/network/node_address_test.go

@@ -471,20 +471,6 @@ func (suite *NodeAddressSuite) TearDownTest() {
 	suite.ctxCancel()
 
 	suite.wg.Wait()
-
-	// trigger updates in resources to stop watch loops
-	suite.Assert().NoError(
-		suite.state.Create(
-			context.Background(),
-			network.NewAddressStatus(network.NamespaceName, "bar"),
-		),
-	)
-	suite.Assert().NoError(
-		suite.state.Create(
-			context.Background(),
-			network.NewLinkStatus(network.NamespaceName, "bar"),
-		),
-	)
 }
 
 func TestNodeAddressSuite(t *testing.T) {

internal/app/machined/pkg/controllers/network/operator_config_test.go

@@ -27,6 +27,7 @@ import (
 
 	netctrl "github.com/siderolabs/talos/internal/app/machined/pkg/controllers/network"
 	"github.com/siderolabs/talos/pkg/logging"
+	"github.com/siderolabs/talos/pkg/machinery/config/container"
 	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
 	"github.com/siderolabs/talos/pkg/machinery/nethelpers"
 	"github.com/siderolabs/talos/pkg/machinery/resources/config"
@@ -227,64 +228,66 @@ func (suite *OperatorConfigSuite) TestMachineConfigurationDHCP4() {
 	suite.Require().NoError(err)
 
 	cfg := config.NewMachineConfig(
-		&v1alpha1.Config{
-			ConfigVersion: "v1alpha1",
-			MachineConfig: &v1alpha1.MachineConfig{
-				MachineNetwork: &v1alpha1.NetworkConfig{
-					NetworkInterfaces: []*v1alpha1.Device{
-						{
-							DeviceInterface: "eth0",
-						},
-						{
-							DeviceInterface: "eth1",
-							DeviceDHCP:      pointer.To(true),
-						},
-						{
-							DeviceIgnore:    pointer.To(true),
-							DeviceInterface: "eth2",
-							DeviceDHCP:      pointer.To(true),
-						},
-						{
-							DeviceInterface: "eth3",
-							DeviceDHCP:      pointer.To(true),
-							DeviceDHCPOptions: &v1alpha1.DHCPOptions{
-								DHCPIPv4:        pointer.To(true),
-								DHCPRouteMetric: 256,
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				ConfigVersion: "v1alpha1",
+				MachineConfig: &v1alpha1.MachineConfig{
+					MachineNetwork: &v1alpha1.NetworkConfig{
+						NetworkInterfaces: []*v1alpha1.Device{
+							{
+								DeviceInterface: "eth0",
 							},
-						},
-						{
-							DeviceInterface: "eth4",
-							DeviceVlans: []*v1alpha1.Vlan{
-								{
-									VlanID:   25,
-									VlanDHCP: pointer.To(true),
+							{
+								DeviceInterface: "eth1",
+								DeviceDHCP:      pointer.To(true),
+							},
+							{
+								DeviceIgnore:    pointer.To(true),
+								DeviceInterface: "eth2",
+								DeviceDHCP:      pointer.To(true),
+							},
+							{
+								DeviceInterface: "eth3",
+								DeviceDHCP:      pointer.To(true),
+								DeviceDHCPOptions: &v1alpha1.DHCPOptions{
+									DHCPIPv4:        pointer.To(true),
+									DHCPRouteMetric: 256,
 								},
-								{
-									VlanID: 26,
-								},
-								{
-									VlanID: 27,
-									VlanDHCPOptions: &v1alpha1.DHCPOptions{
-										DHCPRouteMetric: 256,
+							},
+							{
+								DeviceInterface: "eth4",
+								DeviceVlans: []*v1alpha1.Vlan{
+									{
+										VlanID:   25,
+										VlanDHCP: pointer.To(true),
+									},
+									{
+										VlanID: 26,
+									},
+									{
+										VlanID: 27,
+										VlanDHCPOptions: &v1alpha1.DHCPOptions{
+											DHCPRouteMetric: 256,
+										},
 									},
 								},
 							},
+							{
+								DeviceInterface: "eth5",
+								DeviceDHCP:      pointer.To(true),
+							},
 						},
-						{
-							DeviceInterface: "eth5",
-							DeviceDHCP:      pointer.To(true),
+					},
+				},
+				ClusterConfig: &v1alpha1.ClusterConfig{
+					ControlPlane: &v1alpha1.ControlPlaneConfig{
+						Endpoint: &v1alpha1.Endpoint{
+							URL: u,
 						},
 					},
 				},
 			},
-			ClusterConfig: &v1alpha1.ClusterConfig{
-				ControlPlane: &v1alpha1.ControlPlaneConfig{
-					Endpoint: &v1alpha1.Endpoint{
-						URL: u,
-					},
-				},
-			},
-		},
+		),
 	)
 
 	suite.Require().NoError(suite.state.Create(suite.ctx, cfg))
@@ -344,44 +347,46 @@ func (suite *OperatorConfigSuite) TestMachineConfigurationDHCP6() {
 	suite.Require().NoError(err)
 
 	cfg := config.NewMachineConfig(
-		&v1alpha1.Config{
-			ConfigVersion: "v1alpha1",
-			MachineConfig: &v1alpha1.MachineConfig{
-				MachineNetwork: &v1alpha1.NetworkConfig{
-					NetworkInterfaces: []*v1alpha1.Device{
-						{
-							DeviceInterface: "eth1",
-							DeviceDHCP:      pointer.To(true),
-							DeviceDHCPOptions: &v1alpha1.DHCPOptions{
-								DHCPIPv4: pointer.To(true),
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				ConfigVersion: "v1alpha1",
+				MachineConfig: &v1alpha1.MachineConfig{
+					MachineNetwork: &v1alpha1.NetworkConfig{
+						NetworkInterfaces: []*v1alpha1.Device{
+							{
+								DeviceInterface: "eth1",
+								DeviceDHCP:      pointer.To(true),
+								DeviceDHCPOptions: &v1alpha1.DHCPOptions{
+									DHCPIPv4: pointer.To(true),
+								},
 							},
-						},
-						{
-							DeviceInterface: "eth2",
-							DeviceDHCP:      pointer.To(true),
-							DeviceDHCPOptions: &v1alpha1.DHCPOptions{
-								DHCPIPv6: pointer.To(true),
+							{
+								DeviceInterface: "eth2",
+								DeviceDHCP:      pointer.To(true),
+								DeviceDHCPOptions: &v1alpha1.DHCPOptions{
+									DHCPIPv6: pointer.To(true),
+								},
 							},
-						},
-						{
-							DeviceInterface: "eth3",
-							DeviceDHCP:      pointer.To(true),
-							DeviceDHCPOptions: &v1alpha1.DHCPOptions{
-								DHCPIPv6:        pointer.To(true),
-								DHCPRouteMetric: 512,
+							{
+								DeviceInterface: "eth3",
+								DeviceDHCP:      pointer.To(true),
+								DeviceDHCPOptions: &v1alpha1.DHCPOptions{
+									DHCPIPv6:        pointer.To(true),
+									DHCPRouteMetric: 512,
+								},
 							},
 						},
 					},
 				},
-			},
-			ClusterConfig: &v1alpha1.ClusterConfig{
-				ControlPlane: &v1alpha1.ControlPlaneConfig{
-					Endpoint: &v1alpha1.Endpoint{
-						URL: u,
+				ClusterConfig: &v1alpha1.ClusterConfig{
+					ControlPlane: &v1alpha1.ControlPlaneConfig{
+						Endpoint: &v1alpha1.Endpoint{
+							URL: u,
+						},
 					},
 				},
 			},
-		},
+		),
 	)
 
 	suite.Require().NoError(suite.state.Create(suite.ctx, cfg))
@@ -424,28 +429,6 @@ func (suite *OperatorConfigSuite) TearDownTest() {
 	suite.ctxCancel()
 
 	suite.wg.Wait()
-
-	// trigger updates in resources to stop watch loops
-	err := suite.state.Create(
-		context.Background(), config.NewMachineConfig(
-			&v1alpha1.Config{
-				ConfigVersion: "v1alpha1",
-				MachineConfig: &v1alpha1.MachineConfig{},
-			},
-		),
-	)
-	if state.IsConflictError(err) {
-		err = suite.state.Destroy(context.Background(), config.NewMachineConfig(nil).Metadata())
-	}
-
-	suite.Require().NoError(err)
-
-	suite.Assert().NoError(
-		suite.state.Create(
-			context.Background(),
-			network.NewLinkStatus(network.ConfigNamespaceName, "bar"),
-		),
-	)
 }
 
 func TestOperatorConfigSuite(t *testing.T) {

internal/app/machined/pkg/controllers/network/operator_merge_test.go

@@ -309,14 +309,6 @@ func (suite *OperatorMergeSuite) TearDownTest() {
 	suite.ctxCancel()
 
 	suite.wg.Wait()
-
-	// trigger updates in resources to stop watch loops
-	suite.Assert().NoError(
-		suite.state.Create(
-			context.Background(),
-			network.NewOperatorSpec(network.ConfigNamespaceName, "bar"),
-		),
-	)
 }
 
 func TestOperatorMergeSuite(t *testing.T) {

internal/app/machined/pkg/controllers/network/operator_spec_test.go

@@ -546,14 +546,6 @@ func (suite *OperatorSpecSuite) TearDownTest() {
 	suite.ctxCancel()
 
 	suite.wg.Wait()
-
-	// trigger updates in resources to stop watch loops
-	suite.Assert().NoError(
-		suite.state.Create(
-			context.Background(),
-			network.NewOperatorSpec(network.NamespaceName, "bar"),
-		),
-	)
 }
 
 func TestOperatorSpecSuite(t *testing.T) {

internal/app/machined/pkg/controllers/network/operator_vip_config_test.go

@@ -25,6 +25,7 @@ import (
 
 	netctrl "github.com/siderolabs/talos/internal/app/machined/pkg/controllers/network"
 	"github.com/siderolabs/talos/pkg/logging"
+	"github.com/siderolabs/talos/pkg/machinery/config/container"
 	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
 	"github.com/siderolabs/talos/pkg/machinery/resources/config"
 	"github.com/siderolabs/talos/pkg/machinery/resources/network"
@@ -81,48 +82,50 @@ func (suite *OperatorVIPConfigSuite) TestMachineConfigurationVIP() {
 	suite.Require().NoError(err)
 
 	cfg := config.NewMachineConfig(
-		&v1alpha1.Config{
-			ConfigVersion: "v1alpha1",
-			MachineConfig: &v1alpha1.MachineConfig{
-				MachineNetwork: &v1alpha1.NetworkConfig{
-					NetworkInterfaces: []*v1alpha1.Device{
-						{
-							DeviceInterface: "eth1",
-							DeviceDHCP:      pointer.To(true),
-							DeviceVIPConfig: &v1alpha1.DeviceVIPConfig{
-								SharedIP: "2.3.4.5",
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				ConfigVersion: "v1alpha1",
+				MachineConfig: &v1alpha1.MachineConfig{
+					MachineNetwork: &v1alpha1.NetworkConfig{
+						NetworkInterfaces: []*v1alpha1.Device{
+							{
+								DeviceInterface: "eth1",
+								DeviceDHCP:      pointer.To(true),
+								DeviceVIPConfig: &v1alpha1.DeviceVIPConfig{
+									SharedIP: "2.3.4.5",
+								},
 							},
-						},
-						{
-							DeviceInterface: "eth2",
-							DeviceDHCP:      pointer.To(true),
-							DeviceVIPConfig: &v1alpha1.DeviceVIPConfig{
-								SharedIP: "fd7a:115c:a1e0:ab12:4843:cd96:6277:2302",
+							{
+								DeviceInterface: "eth2",
+								DeviceDHCP:      pointer.To(true),
+								DeviceVIPConfig: &v1alpha1.DeviceVIPConfig{
+									SharedIP: "fd7a:115c:a1e0:ab12:4843:cd96:6277:2302",
+								},
 							},
-						},
-						{
-							DeviceInterface: "eth3",
-							DeviceDHCP:      pointer.To(true),
-							DeviceVlans: []*v1alpha1.Vlan{
-								{
-									VlanID: 26,
-									VlanVIP: &v1alpha1.DeviceVIPConfig{
-										SharedIP: "5.5.4.4",
+							{
+								DeviceInterface: "eth3",
+								DeviceDHCP:      pointer.To(true),
+								DeviceVlans: []*v1alpha1.Vlan{
+									{
+										VlanID: 26,
+										VlanVIP: &v1alpha1.DeviceVIPConfig{
+											SharedIP: "5.5.4.4",
+										},
 									},
 								},
 							},
 						},
 					},
 				},
-			},
-			ClusterConfig: &v1alpha1.ClusterConfig{
-				ControlPlane: &v1alpha1.ControlPlaneConfig{
-					Endpoint: &v1alpha1.Endpoint{
-						URL: u,
+				ClusterConfig: &v1alpha1.ClusterConfig{
+					ControlPlane: &v1alpha1.ControlPlaneConfig{
+						Endpoint: &v1alpha1.Endpoint{
+							URL: u,
+						},
 					},
 				},
 			},
-		},
+		),
 	)
 
 	suite.Require().NoError(suite.state.Create(suite.ctx, cfg))
@@ -160,28 +163,6 @@ func (suite *OperatorVIPConfigSuite) TearDownTest() {
 	suite.ctxCancel()
 
 	suite.wg.Wait()
-
-	// trigger updates in resources to stop watch loops
-	err := suite.state.Create(
-		context.Background(), config.NewMachineConfig(
-			&v1alpha1.Config{
-				ConfigVersion: "v1alpha1",
-				MachineConfig: &v1alpha1.MachineConfig{},
-			},
-		),
-	)
-	if state.IsConflictError(err) {
-		err = suite.state.Destroy(context.Background(), config.NewMachineConfig(nil).Metadata())
-	}
-
-	suite.Require().NoError(err)
-
-	suite.Assert().NoError(
-		suite.state.Create(
-			context.Background(),
-			network.NewLinkStatus(network.ConfigNamespaceName, "bar"),
-		),
-	)
 }
 
 func TestOperatorVIPConfigSuite(t *testing.T) {

internal/app/machined/pkg/controllers/network/resolver_config_test.go

@@ -29,6 +29,7 @@ import (
 	"github.com/siderolabs/talos/internal/app/machined/pkg/controllers/ctest"
 	netctrl "github.com/siderolabs/talos/internal/app/machined/pkg/controllers/network"
 	"github.com/siderolabs/talos/pkg/logging"
+	"github.com/siderolabs/talos/pkg/machinery/config/container"
 	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
 	"github.com/siderolabs/talos/pkg/machinery/constants"
 	"github.com/siderolabs/talos/pkg/machinery/resources/config"
@@ -148,21 +149,23 @@ func (suite *ResolverConfigSuite) TestMachineConfiguration() {
 	suite.Require().NoError(err)
 
 	cfg := config.NewMachineConfig(
-		&v1alpha1.Config{
-			ConfigVersion: "v1alpha1",
-			MachineConfig: &v1alpha1.MachineConfig{
-				MachineNetwork: &v1alpha1.NetworkConfig{
-					NameServers: []string{"2.2.2.2", "3.3.3.3"},
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				ConfigVersion: "v1alpha1",
+				MachineConfig: &v1alpha1.MachineConfig{
+					MachineNetwork: &v1alpha1.NetworkConfig{
+						NameServers: []string{"2.2.2.2", "3.3.3.3"},
+					},
 				},
-			},
-			ClusterConfig: &v1alpha1.ClusterConfig{
-				ControlPlane: &v1alpha1.ControlPlaneConfig{
-					Endpoint: &v1alpha1.Endpoint{
-						URL: u,
+				ClusterConfig: &v1alpha1.ClusterConfig{
+					ControlPlane: &v1alpha1.ControlPlaneConfig{
+						Endpoint: &v1alpha1.Endpoint{
+							URL: u,
+						},
 					},
 				},
 			},
-		},
+		),
 	)
 
 	suite.Require().NoError(suite.state.Create(suite.ctx, cfg))
@@ -181,7 +184,7 @@ func (suite *ResolverConfigSuite) TestMachineConfiguration() {
 	)
 
 	ctest.UpdateWithConflicts(suite, cfg, func(r *config.MachineConfig) error {
-		r.Config().(*v1alpha1.Config).MachineConfig.MachineNetwork.NameServers = nil
+		r.Container().RawV1Alpha1().MachineConfig.MachineNetwork.NameServers = nil
 
 		return nil
 	})
@@ -201,21 +204,6 @@ func (suite *ResolverConfigSuite) TearDownTest() {
 	suite.ctxCancel()
 
 	suite.wg.Wait()
-
-	// trigger updates in resources to stop watch loops
-	err := suite.state.Create(
-		context.Background(), config.NewMachineConfig(
-			&v1alpha1.Config{
-				ConfigVersion: "v1alpha1",
-				MachineConfig: &v1alpha1.MachineConfig{},
-			},
-		),
-	)
-	if state.IsConflictError(err) {
-		err = suite.state.Destroy(context.Background(), config.NewMachineConfig(nil).Metadata())
-	}
-
-	suite.Require().NoError(err)
 }
 
 func TestResolverConfigSuite(t *testing.T) {

internal/app/machined/pkg/controllers/network/resolver_merge_test.go

@@ -125,14 +125,6 @@ func (suite *ResolverMergeSuite) TearDownTest() {
 	suite.ctxCancel()
 
 	suite.wg.Wait()
-
-	// trigger updates in resources to stop watch loops
-	suite.Assert().NoError(
-		suite.state.Create(
-			context.Background(),
-			network.NewResolverSpec(network.ConfigNamespaceName, "bar"),
-		),
-	)
 }
 
 func TestResolverMergeSuite(t *testing.T) {

internal/app/machined/pkg/controllers/network/resolver_spec_test.go

@@ -113,14 +113,6 @@ func (suite *ResolverSpecSuite) TearDownTest() {
 	suite.ctxCancel()
 
 	suite.wg.Wait()
-
-	// trigger updates in resources to stop watch loops
-	suite.Assert().NoError(
-		suite.state.Create(
-			context.Background(),
-			network.NewResolverSpec(network.NamespaceName, "bar"),
-		),
-	)
 }
 
 func TestResolverSpecSuite(t *testing.T) {

internal/app/machined/pkg/controllers/network/route_config_test.go

@@ -26,6 +26,7 @@ import (
 
 	netctrl "github.com/siderolabs/talos/internal/app/machined/pkg/controllers/network"
 	"github.com/siderolabs/talos/pkg/logging"
+	"github.com/siderolabs/talos/pkg/machinery/config/container"
 	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
 	"github.com/siderolabs/talos/pkg/machinery/nethelpers"
 	"github.com/siderolabs/talos/pkg/machinery/resources/config"
@@ -144,84 +145,86 @@ func (suite *RouteConfigSuite) TestMachineConfiguration() {
 	suite.Require().NoError(err)
 
 	cfg := config.NewMachineConfig(
-		&v1alpha1.Config{
-			ConfigVersion: "v1alpha1",
-			MachineConfig: &v1alpha1.MachineConfig{
-				MachineNetwork: &v1alpha1.NetworkConfig{
-					NetworkInterfaces: []*v1alpha1.Device{
-						{
-							DeviceInterface: "eth3",
-							DeviceAddresses: []string{"192.168.0.24/28"},
-							DeviceRoutes: []*v1alpha1.Route{
-								{
-									RouteNetwork: "192.168.0.0/18",
-									RouteGateway: "192.168.0.25",
-									RouteMetric:  25,
-								},
-								{
-									RouteNetwork: "169.254.254.254/32",
-								},
-							},
-						},
-						{
-							DeviceIgnore:    pointer.To(true),
-							DeviceInterface: "eth4",
-							DeviceAddresses: []string{"192.168.0.24/28"},
-							DeviceRoutes: []*v1alpha1.Route{
-								{
-									RouteNetwork: "192.168.0.0/18",
-									RouteGateway: "192.168.0.26",
-									RouteMetric:  25,
-								},
-							},
-						},
-						{
-							DeviceInterface: "eth2",
-							DeviceAddresses: []string{"2001:470:6d:30e:8ed2:b60c:9d2f:803a/64"},
-							DeviceRoutes: []*v1alpha1.Route{
-								{
-									RouteGateway: "2001:470:6d:30e:8ed2:b60c:9d2f:803b",
-								},
-							},
-						},
-						{
-							DeviceInterface: "eth0",
-							DeviceVlans: []*v1alpha1.Vlan{
-								{
-									VlanID: 24,
-									VlanAddresses: []string{
-										"10.0.0.1/8",
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				ConfigVersion: "v1alpha1",
+				MachineConfig: &v1alpha1.MachineConfig{
+					MachineNetwork: &v1alpha1.NetworkConfig{
+						NetworkInterfaces: []*v1alpha1.Device{
+							{
+								DeviceInterface: "eth3",
+								DeviceAddresses: []string{"192.168.0.24/28"},
+								DeviceRoutes: []*v1alpha1.Route{
+									{
+										RouteNetwork: "192.168.0.0/18",
+										RouteGateway: "192.168.0.25",
+										RouteMetric:  25,
 									},
-									VlanRoutes: []*v1alpha1.Route{
-										{
-											RouteNetwork: "10.0.3.0/24",
-											RouteGateway: "10.0.3.1",
+									{
+										RouteNetwork: "169.254.254.254/32",
+									},
+								},
+							},
+							{
+								DeviceIgnore:    pointer.To(true),
+								DeviceInterface: "eth4",
+								DeviceAddresses: []string{"192.168.0.24/28"},
+								DeviceRoutes: []*v1alpha1.Route{
+									{
+										RouteNetwork: "192.168.0.0/18",
+										RouteGateway: "192.168.0.26",
+										RouteMetric:  25,
+									},
+								},
+							},
+							{
+								DeviceInterface: "eth2",
+								DeviceAddresses: []string{"2001:470:6d:30e:8ed2:b60c:9d2f:803a/64"},
+								DeviceRoutes: []*v1alpha1.Route{
+									{
+										RouteGateway: "2001:470:6d:30e:8ed2:b60c:9d2f:803b",
+									},
+								},
+							},
+							{
+								DeviceInterface: "eth0",
+								DeviceVlans: []*v1alpha1.Vlan{
+									{
+										VlanID: 24,
+										VlanAddresses: []string{
+											"10.0.0.1/8",
+										},
+										VlanRoutes: []*v1alpha1.Route{
+											{
+												RouteNetwork: "10.0.3.0/24",
+												RouteGateway: "10.0.3.1",
+											},
 										},
 									},
 								},
 							},
-						},
-						{
-							DeviceInterface: "eth1",
-							DeviceRoutes: []*v1alpha1.Route{
-								{
-									RouteNetwork: "192.244.0.0/24",
-									RouteGateway: "192.244.0.1",
-									RouteSource:  "192.244.0.10",
+							{
+								DeviceInterface: "eth1",
+								DeviceRoutes: []*v1alpha1.Route{
+									{
+										RouteNetwork: "192.244.0.0/24",
+										RouteGateway: "192.244.0.1",
+										RouteSource:  "192.244.0.10",
+									},
 								},
 							},
 						},
 					},
 				},
-			},
-			ClusterConfig: &v1alpha1.ClusterConfig{
-				ControlPlane: &v1alpha1.ControlPlaneConfig{
-					Endpoint: &v1alpha1.Endpoint{
-						URL: u,
+				ClusterConfig: &v1alpha1.ClusterConfig{
+					ControlPlane: &v1alpha1.ControlPlaneConfig{
+						Endpoint: &v1alpha1.Endpoint{
+							URL: u,
+						},
 					},
 				},
 			},
-		},
+		),
 	)
 
 	suite.Require().NoError(suite.state.Create(suite.ctx, cfg))
@@ -271,21 +274,6 @@ func (suite *RouteConfigSuite) TearDownTest() {
 	suite.ctxCancel()
 
 	suite.wg.Wait()
-
-	// trigger updates in resources to stop watch loops
-	err := suite.state.Create(
-		context.Background(), config.NewMachineConfig(
-			&v1alpha1.Config{
-				ConfigVersion: "v1alpha1",
-				MachineConfig: &v1alpha1.MachineConfig{},
-			},
-		),
-	)
-	if state.IsConflictError(err) {
-		err = suite.state.Destroy(context.Background(), config.NewMachineConfig(nil).Metadata())
-	}
-
-	suite.Require().NoError(err)
 }
 
 func TestRouteConfigSuite(t *testing.T) {

internal/app/machined/pkg/controllers/network/route_merge_test.go

@@ -352,14 +352,6 @@ func (suite *RouteMergeSuite) TearDownTest() {
 	suite.ctxCancel()
 
 	suite.wg.Wait()
-
-	// trigger updates in resources to stop watch loops
-	suite.Assert().NoError(
-		suite.state.Create(
-			context.Background(),
-			network.NewRouteSpec(network.ConfigNamespaceName, "bar"),
-		),
-	)
 }
 
 func TestRouteMergeSuite(t *testing.T) {

internal/app/machined/pkg/controllers/network/route_spec_test.go

@@ -12,6 +12,7 @@ import (
 	"math/rand"
 	"net"
 	"net/netip"
+	"os"
 	"sync"
 	"testing"
 	"time"
@@ -558,11 +559,12 @@ func (suite *RouteSpecSuite) TearDownTest() {
 	suite.ctxCancel()
 
 	suite.wg.Wait()
-
-	// trigger updates in resources to stop watch loops
-	suite.Assert().NoError(suite.state.Create(context.Background(), network.NewRouteSpec(network.NamespaceName, "bar")))
 }
 
 func TestRouteSpecSuite(t *testing.T) {
+	if os.Geteuid() != 0 {
+		t.Skip("requires root")
+	}
+
 	suite.Run(t, new(RouteSpecSuite))
 }

internal/app/machined/pkg/controllers/network/timeserver_config_test.go

@@ -28,6 +28,7 @@ import (
 	"github.com/siderolabs/talos/internal/app/machined/pkg/controllers/ctest"
 	netctrl "github.com/siderolabs/talos/internal/app/machined/pkg/controllers/network"
 	"github.com/siderolabs/talos/pkg/logging"
+	"github.com/siderolabs/talos/pkg/machinery/config/container"
 	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
 	"github.com/siderolabs/talos/pkg/machinery/constants"
 	"github.com/siderolabs/talos/pkg/machinery/resources/config"
@@ -140,21 +141,23 @@ func (suite *TimeServerConfigSuite) TestMachineConfiguration() {
 	suite.Require().NoError(err)
 
 	cfg := config.NewMachineConfig(
-		&v1alpha1.Config{
-			ConfigVersion: "v1alpha1",
-			MachineConfig: &v1alpha1.MachineConfig{
-				MachineTime: &v1alpha1.TimeConfig{
-					TimeServers: []string{"za.pool.ntp.org", "pool.ntp.org"},
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				ConfigVersion: "v1alpha1",
+				MachineConfig: &v1alpha1.MachineConfig{
+					MachineTime: &v1alpha1.TimeConfig{
+						TimeServers: []string{"za.pool.ntp.org", "pool.ntp.org"},
+					},
 				},
-			},
-			ClusterConfig: &v1alpha1.ClusterConfig{
-				ControlPlane: &v1alpha1.ControlPlaneConfig{
-					Endpoint: &v1alpha1.Endpoint{
-						URL: u,
+				ClusterConfig: &v1alpha1.ClusterConfig{
+					ControlPlane: &v1alpha1.ControlPlaneConfig{
+						Endpoint: &v1alpha1.Endpoint{
+							URL: u,
+						},
 					},
 				},
 			},
-		},
+		),
 	)
 
 	suite.Require().NoError(suite.state.Create(suite.ctx, cfg))
@@ -168,7 +171,7 @@ func (suite *TimeServerConfigSuite) TestMachineConfiguration() {
 	)
 
 	ctest.UpdateWithConflicts(suite, cfg, func(r *config.MachineConfig) error {
-		r.Config().(*v1alpha1.Config).MachineConfig.MachineTime = nil
+		r.Container().RawV1Alpha1().MachineConfig.MachineTime = nil
 
 		return nil
 	})
@@ -188,21 +191,6 @@ func (suite *TimeServerConfigSuite) TearDownTest() {
 	suite.ctxCancel()
 
 	suite.wg.Wait()
-
-	// trigger updates in resources to stop watch loops
-	err := suite.state.Create(
-		context.Background(), config.NewMachineConfig(
-			&v1alpha1.Config{
-				ConfigVersion: "v1alpha1",
-				MachineConfig: &v1alpha1.MachineConfig{},
-			},
-		),
-	)
-	if state.IsConflictError(err) {
-		err = suite.state.Destroy(context.Background(), config.NewMachineConfig(nil).Metadata())
-	}
-
-	suite.Require().NoError(err)
 }
 
 func TestTimeServerConfigSuite(t *testing.T) {

internal/app/machined/pkg/controllers/network/timeserver_merge_test.go

@@ -124,14 +124,6 @@ func (suite *TimeServerMergeSuite) TearDownTest() {
 	suite.ctxCancel()
 
 	suite.wg.Wait()
-
-	// trigger updates in resources to stop watch loops
-	suite.Assert().NoError(
-		suite.state.Create(
-			context.Background(),
-			network.NewTimeServerSpec(network.ConfigNamespaceName, "bar"),
-		),
-	)
 }
 
 func TestTimeServerMergeSuite(t *testing.T) {

internal/app/machined/pkg/controllers/network/timeserver_spec_test.go

@@ -112,14 +112,6 @@ func (suite *TimeServerSpecSuite) TearDownTest() {
 	suite.ctxCancel()
 
 	suite.wg.Wait()
-
-	// trigger updates in resources to stop watch loops
-	suite.Assert().NoError(
-		suite.state.Create(
-			context.Background(),
-			network.NewTimeServerSpec(network.NamespaceName, "bar"),
-		),
-	)
 }
 
 func TestTimeServerSpecSuite(t *testing.T) {

internal/app/machined/pkg/controllers/runtime/common_test.go

@@ -20,8 +20,6 @@ import (
 	"github.com/stretchr/testify/suite"
 
 	"github.com/siderolabs/talos/pkg/logging"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
-	"github.com/siderolabs/talos/pkg/machinery/resources/config"
 )
 
 const (
@@ -90,19 +88,4 @@ func (suite *RuntimeSuite) TearDownTest() {
 	suite.ctxCancel()
 
 	suite.wg.Wait()
-
-	// trigger updates in resources to stop watch loops
-	err := suite.state.Create(
-		context.Background(), config.NewMachineConfig(
-			&v1alpha1.Config{
-				ConfigVersion: "v1alpha1",
-				MachineConfig: &v1alpha1.MachineConfig{},
-			},
-		),
-	)
-	if state.IsConflictError(err) {
-		err = suite.state.Destroy(context.Background(), config.NewMachineConfig(nil).Metadata())
-	}
-
-	suite.Assert().NoError(err)
 }

internal/app/machined/pkg/controllers/runtime/kernel_module_config_test.go

@@ -14,6 +14,7 @@ import (
 	"github.com/stretchr/testify/suite"
 
 	runtimecontrollers "github.com/siderolabs/talos/internal/app/machined/pkg/controllers/runtime"
+	"github.com/siderolabs/talos/pkg/machinery/config/container"
 	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
 	"github.com/siderolabs/talos/pkg/machinery/resources/config"
 	runtimeresource "github.com/siderolabs/talos/pkg/machinery/resources/runtime"
@@ -28,22 +29,26 @@ func (suite *KernelModuleConfigSuite) TestReconcileConfig() {
 
 	suite.startRuntime()
 
-	cfg := config.NewMachineConfig(&v1alpha1.Config{
-		ConfigVersion: "v1alpha1",
-		MachineConfig: &v1alpha1.MachineConfig{
-			MachineKernel: &v1alpha1.KernelConfig{
-				KernelModules: []*v1alpha1.KernelModuleConfig{
-					{
-						ModuleName: "brtfs",
-					},
-					{
-						ModuleName: "e1000",
+	cfg := config.NewMachineConfig(
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				ConfigVersion: "v1alpha1",
+				MachineConfig: &v1alpha1.MachineConfig{
+					MachineKernel: &v1alpha1.KernelConfig{
+						KernelModules: []*v1alpha1.KernelModuleConfig{
+							{
+								ModuleName: "brtfs",
+							},
+							{
+								ModuleName: "e1000",
+							},
+						},
 					},
 				},
+				ClusterConfig: &v1alpha1.ClusterConfig{},
 			},
-		},
-		ClusterConfig: &v1alpha1.ClusterConfig{},
-	})
+		),
+	)
 
 	suite.Require().NoError(suite.state.Create(suite.ctx, cfg))
 
@@ -59,13 +64,17 @@ func (suite *KernelModuleConfigSuite) TestReconcileConfig() {
 	))
 
 	old := cfg.Metadata().Version()
-	cfg = config.NewMachineConfig(&v1alpha1.Config{
-		ConfigVersion: "v1alpha1",
-		MachineConfig: &v1alpha1.MachineConfig{
-			MachineKernel: nil,
-		},
-		ClusterConfig: &v1alpha1.ClusterConfig{},
-	})
+	cfg = config.NewMachineConfig(
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				ConfigVersion: "v1alpha1",
+				MachineConfig: &v1alpha1.MachineConfig{
+					MachineKernel: nil,
+				},
+				ClusterConfig: &v1alpha1.ClusterConfig{},
+			},
+		),
+	)
 
 	cfg.Metadata().SetVersion(old)
 	suite.Require().NoError(suite.state.Update(suite.ctx, cfg))

internal/app/machined/pkg/controllers/runtime/kernel_param_config_test.go

@@ -14,6 +14,7 @@ import (
 	"github.com/stretchr/testify/suite"
 
 	runtimecontrollers "github.com/siderolabs/talos/internal/app/machined/pkg/controllers/runtime"
+	"github.com/siderolabs/talos/pkg/machinery/config/container"
 	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
 	"github.com/siderolabs/talos/pkg/machinery/resources/config"
 	runtimeresource "github.com/siderolabs/talos/pkg/machinery/resources/runtime"
@@ -31,18 +32,22 @@ func (suite *KernelParamConfigSuite) TestReconcileConfig() {
 	value := "500000"
 	valueSysfs := "600000"
 
-	cfg := config.NewMachineConfig(&v1alpha1.Config{
-		ConfigVersion: "v1alpha1",
-		MachineConfig: &v1alpha1.MachineConfig{
-			MachineSysctls: map[string]string{
-				fsFileMax: value,
+	cfg := config.NewMachineConfig(
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				ConfigVersion: "v1alpha1",
+				MachineConfig: &v1alpha1.MachineConfig{
+					MachineSysctls: map[string]string{
+						fsFileMax: value,
+					},
+					MachineSysfs: map[string]string{
+						fsFileMax: valueSysfs,
+					},
+				},
+				ClusterConfig: &v1alpha1.ClusterConfig{},
 			},
-			MachineSysfs: map[string]string{
-				fsFileMax: valueSysfs,
-			},
-		},
-		ClusterConfig: &v1alpha1.ClusterConfig{},
-	})
+		),
+	)
 
 	suite.Require().NoError(suite.state.Create(suite.ctx, cfg))
 
@@ -73,16 +78,20 @@ func (suite *KernelParamConfigSuite) TestReconcileConfig() {
 	))
 
 	old := cfg.Metadata().Version()
-	cfg = config.NewMachineConfig(&v1alpha1.Config{
-		ConfigVersion: "v1alpha1",
-		MachineConfig: &v1alpha1.MachineConfig{
-			MachineSysctls: map[string]string{},
-			MachineSysfs: map[string]string{
-				fsFileMax: valueSysfs,
+	cfg = config.NewMachineConfig(
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				ConfigVersion: "v1alpha1",
+				MachineConfig: &v1alpha1.MachineConfig{
+					MachineSysctls: map[string]string{},
+					MachineSysfs: map[string]string{
+						fsFileMax: valueSysfs,
+					},
+				},
+				ClusterConfig: &v1alpha1.ClusterConfig{},
 			},
-		},
-		ClusterConfig: &v1alpha1.ClusterConfig{},
-	})
+		),
+	)
 
 	cfg.Metadata().SetVersion(old)
 	suite.Require().NoError(suite.state.Update(suite.ctx, cfg))

internal/app/machined/pkg/controllers/runtime/kernel_param_spec_test.go

@@ -6,6 +6,7 @@ package runtime_test
 
 import (
 	"fmt"
+	"os"
 	"strings"
 	"testing"
 	"time"
@@ -108,5 +109,9 @@ func (suite *KernelParamSpecSuite) TestParamsUnsupported() {
 }
 
 func TestKernelParamSpecSuite(t *testing.T) {
+	if os.Geteuid() != 0 {
+		t.Skip("skipping test because it requires root privileges")
+	}
+
 	suite.Run(t, new(KernelParamSpecSuite))
 }

internal/app/machined/pkg/controllers/runtime/kmsg_log_test.go

@@ -10,6 +10,7 @@ import (
 	"log"
 	"net"
 	"net/netip"
+	"os"
 	"sync"
 	"testing"
 	"time"
@@ -172,5 +173,9 @@ func (suite *KmsgLogDeliverySuite) TearDownTest() {
 }
 
 func TestKmsgLogDeliverySuite(t *testing.T) {
+	if os.Geteuid() != 0 {
+		t.Skip("requires root")
+	}
+
 	suite.Run(t, new(KmsgLogDeliverySuite))
 }

internal/app/machined/pkg/controllers/runtime/machine_status.go

@@ -21,7 +21,7 @@ import (
 	v1alpha1runtime "github.com/siderolabs/talos/internal/app/machined/pkg/runtime"
 	"github.com/siderolabs/talos/pkg/machinery/api/common"
 	machineapi "github.com/siderolabs/talos/pkg/machinery/api/machine"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/machine"
+	"github.com/siderolabs/talos/pkg/machinery/config/machine"
 	"github.com/siderolabs/talos/pkg/machinery/resources/config"
 	"github.com/siderolabs/talos/pkg/machinery/resources/k8s"
 	"github.com/siderolabs/talos/pkg/machinery/resources/network"

internal/app/machined/pkg/controllers/runtime/machine_status_test.go

@@ -18,7 +18,7 @@ import (
 	runtimectrl "github.com/siderolabs/talos/internal/app/machined/pkg/controllers/runtime"
 	v1alpha1runtime "github.com/siderolabs/talos/internal/app/machined/pkg/runtime"
 	machineapi "github.com/siderolabs/talos/pkg/machinery/api/machine"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/machine"
+	"github.com/siderolabs/talos/pkg/machinery/config/machine"
 	"github.com/siderolabs/talos/pkg/machinery/resources/config"
 	"github.com/siderolabs/talos/pkg/machinery/resources/network"
 	"github.com/siderolabs/talos/pkg/machinery/resources/runtime"

internal/app/machined/pkg/controllers/secrets/api.go

@@ -18,7 +18,7 @@ import (
 	"go.uber.org/zap"
 
 	"github.com/siderolabs/talos/pkg/grpc/gen"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/machine"
+	"github.com/siderolabs/talos/pkg/machinery/config/machine"
 	"github.com/siderolabs/talos/pkg/machinery/resources/config"
 	"github.com/siderolabs/talos/pkg/machinery/resources/k8s"
 	"github.com/siderolabs/talos/pkg/machinery/resources/network"

internal/app/machined/pkg/controllers/secrets/api_test.go

@@ -20,7 +20,7 @@ import (
 
 	"github.com/siderolabs/talos/internal/app/machined/pkg/controllers/ctest"
 	secretsctrl "github.com/siderolabs/talos/internal/app/machined/pkg/controllers/secrets"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/machine"
+	"github.com/siderolabs/talos/pkg/machinery/config/machine"
 	"github.com/siderolabs/talos/pkg/machinery/resources/config"
 	"github.com/siderolabs/talos/pkg/machinery/resources/network"
 	"github.com/siderolabs/talos/pkg/machinery/resources/secrets"

internal/app/machined/pkg/controllers/secrets/kubelet_test.go

@@ -18,6 +18,7 @@ import (
 
 	"github.com/siderolabs/talos/internal/app/machined/pkg/controllers/ctest"
 	secretsctrl "github.com/siderolabs/talos/internal/app/machined/pkg/controllers/secrets"
+	"github.com/siderolabs/talos/pkg/machinery/config/container"
 	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
 	"github.com/siderolabs/talos/pkg/machinery/resources/config"
 	"github.com/siderolabs/talos/pkg/machinery/resources/secrets"
@@ -47,19 +48,21 @@ func (suite *KubeletSuite) TestReconcile() {
 	k8sCA := x509.NewCertificateAndKeyFromCertificateAuthority(ca)
 
 	cfg := config.NewMachineConfig(
-		&v1alpha1.Config{
-			ConfigVersion: "v1alpha1",
-			MachineConfig: &v1alpha1.MachineConfig{},
-			ClusterConfig: &v1alpha1.ClusterConfig{
-				ControlPlane: &v1alpha1.ControlPlaneConfig{
-					Endpoint: &v1alpha1.Endpoint{
-						URL: u,
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				ConfigVersion: "v1alpha1",
+				MachineConfig: &v1alpha1.MachineConfig{},
+				ClusterConfig: &v1alpha1.ClusterConfig{
+					ControlPlane: &v1alpha1.ControlPlaneConfig{
+						Endpoint: &v1alpha1.Endpoint{
+							URL: u,
+						},
 					},
+					ClusterCA:      k8sCA,
+					BootstrapToken: "abc.def",
 				},
-				ClusterCA:      k8sCA,
-				BootstrapToken: "abc.def",
 			},
-		},
+		),
 	)
 
 	suite.Require().NoError(suite.State().Create(suite.Ctx(), cfg))

internal/app/machined/pkg/controllers/secrets/kubernetes_dynamic_certs_test.go

@@ -21,7 +21,7 @@ import (
 
 	"github.com/siderolabs/talos/internal/app/machined/pkg/controllers/ctest"
 	secretsctrl "github.com/siderolabs/talos/internal/app/machined/pkg/controllers/secrets"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/machine"
+	"github.com/siderolabs/talos/pkg/machinery/config/machine"
 	"github.com/siderolabs/talos/pkg/machinery/constants"
 	"github.com/siderolabs/talos/pkg/machinery/resources/config"
 	"github.com/siderolabs/talos/pkg/machinery/resources/network"

internal/app/machined/pkg/controllers/secrets/kubernetes_test.go

@@ -20,7 +20,7 @@ import (
 
 	"github.com/siderolabs/talos/internal/app/machined/pkg/controllers/ctest"
 	secretsctrl "github.com/siderolabs/talos/internal/app/machined/pkg/controllers/secrets"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/machine"
+	"github.com/siderolabs/talos/pkg/machinery/config/machine"
 	"github.com/siderolabs/talos/pkg/machinery/resources/config"
 	"github.com/siderolabs/talos/pkg/machinery/resources/secrets"
 	timeresource "github.com/siderolabs/talos/pkg/machinery/resources/time"

internal/app/machined/pkg/controllers/secrets/root.go

@@ -17,7 +17,7 @@ import (
 	"go.uber.org/zap"
 
 	talosconfig "github.com/siderolabs/talos/pkg/machinery/config"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/machine"
+	"github.com/siderolabs/talos/pkg/machinery/config/machine"
 	"github.com/siderolabs/talos/pkg/machinery/constants"
 	"github.com/siderolabs/talos/pkg/machinery/resources/config"
 	"github.com/siderolabs/talos/pkg/machinery/resources/secrets"

internal/app/machined/pkg/controllers/secrets/trustd_test.go

@@ -20,7 +20,7 @@ import (
 
 	"github.com/siderolabs/talos/internal/app/machined/pkg/controllers/ctest"
 	secretsctrl "github.com/siderolabs/talos/internal/app/machined/pkg/controllers/secrets"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/machine"
+	"github.com/siderolabs/talos/pkg/machinery/config/machine"
 	"github.com/siderolabs/talos/pkg/machinery/resources/config"
 	"github.com/siderolabs/talos/pkg/machinery/resources/network"
 	"github.com/siderolabs/talos/pkg/machinery/resources/secrets"

internal/app/machined/pkg/controllers/siderolink/config.go

@@ -11,6 +11,7 @@ import (
 	"github.com/cosi-project/runtime/pkg/controller"
 	"github.com/cosi-project/runtime/pkg/safe"
 	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/siderolabs/go-pointer"
 	"github.com/siderolabs/go-procfs/procfs"
 	"go.uber.org/zap"
 
@@ -31,7 +32,14 @@ func (ctrl *ConfigController) Name() string {
 
 // Inputs implements controller.Controller interface.
 func (ctrl *ConfigController) Inputs() []controller.Input {
-	return nil
+	return []controller.Input{
+		{
+			Namespace: config.NamespaceName,
+			Type:      config.MachineConfigType,
+			ID:        pointer.To(config.V1Alpha1ID),
+			Kind:      controller.InputWeak,
+		},
+	}
 }
 
 // Outputs implements controller.Controller interface.
@@ -53,16 +61,21 @@ func (ctrl *ConfigController) Run(ctx context.Context, r controller.Runtime, _ *
 		case <-r.EventCh():
 		}
 
-		if err := ctrl.updateConfig(ctx, r); err != nil {
+		cfg, err := safe.ReaderGetByID[*config.MachineConfig](ctx, r, config.V1Alpha1ID)
+		if err != nil && !state.IsNotFoundError(err) {
+			return err
+		}
+
+		if err := ctrl.updateConfig(ctx, r, cfg); err != nil {
 			return fmt.Errorf("failed to update config: %w", err)
 		}
 	}
 }
 
-func (ctrl *ConfigController) updateConfig(ctx context.Context, r controller.Runtime) error {
+func (ctrl *ConfigController) updateConfig(ctx context.Context, r controller.Runtime, machineConfig *config.MachineConfig) error {
 	cfg := siderolink.NewConfig(config.NamespaceName, siderolink.ConfigID)
 
-	endpoint := ctrl.apiEndpoint()
+	endpoint := ctrl.apiEndpoint(machineConfig)
 	if endpoint == "" {
 		err := r.Destroy(ctx, cfg.Metadata())
 		if err != nil && !state.IsNotFoundError(err) {
@@ -79,7 +92,11 @@ func (ctrl *ConfigController) updateConfig(ctx context.Context, r controller.Run
 	})
 }
 
-func (ctrl *ConfigController) apiEndpoint() string {
+func (ctrl *ConfigController) apiEndpoint(machineConfig *config.MachineConfig) string {
+	if machineConfig != nil && machineConfig.Config().SideroLink() != nil && machineConfig.Config().SideroLink().APIUrl() != nil {
+		return machineConfig.Config().SideroLink().APIUrl().String()
+	}
+
 	if ctrl.Cmdline == nil || ctrl.Cmdline.Get(constants.KernelParamSideroLink).First() == nil {
 		return ""
 	}

internal/app/machined/pkg/controllers/siderolink/config_test.go

@@ -0,0 +1,65 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package siderolink_test
+
+import (
+	"net/url"
+	"testing"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/rtestutils"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+
+	"github.com/siderolabs/talos/internal/app/machined/pkg/controllers/ctest"
+	siderolinkctrl "github.com/siderolabs/talos/internal/app/machined/pkg/controllers/siderolink"
+	"github.com/siderolabs/talos/pkg/machinery/config/container"
+	"github.com/siderolabs/talos/pkg/machinery/config/types/meta"
+	siderolinkcfg "github.com/siderolabs/talos/pkg/machinery/config/types/siderolink"
+	"github.com/siderolabs/talos/pkg/machinery/resources/config"
+	"github.com/siderolabs/talos/pkg/machinery/resources/siderolink"
+)
+
+type ConfigSuite struct {
+	ctest.DefaultSuite
+}
+
+func TestConfigSuite(t *testing.T) {
+	suite.Run(t, &ConfigSuite{
+		DefaultSuite: ctest.DefaultSuite{
+			AfterSetup: func(suite *ctest.DefaultSuite) {
+				suite.Require().NoError(suite.Runtime().RegisterController(&siderolinkctrl.ConfigController{}))
+			},
+		},
+	})
+}
+
+func (suite *ConfigSuite) TestConfig() {
+	rtestutils.AssertNoResource[*siderolink.Config](suite.Ctx(), suite.T(), suite.State(), siderolink.ConfigID)
+
+	siderolinkConfig := &siderolinkcfg.ConfigV1Alpha1{
+		APIUrlConfig: meta.URL{
+			URL: must(url.Parse("https://api.sidero.dev")),
+		},
+	}
+
+	cfg, err := container.New(siderolinkConfig)
+	suite.Require().NoError(err)
+
+	suite.Require().NoError(suite.State().Create(suite.Ctx(), config.NewMachineConfig(cfg)))
+
+	rtestutils.AssertResources(suite.Ctx(), suite.T(), suite.State(), []resource.ID{siderolink.ConfigID},
+		func(c *siderolink.Config, assert *assert.Assertions) {
+			assert.Equal("https://api.sidero.dev", c.TypedSpec().APIEndpoint)
+		})
+}
+
+func must[T any](t T, err error) T {
+	if err != nil {
+		panic(err)
+	}
+
+	return t
+}

internal/app/machined/pkg/controllers/time/sync_test.go

@@ -28,6 +28,7 @@ import (
 	timectrl "github.com/siderolabs/talos/internal/app/machined/pkg/controllers/time"
 	v1alpha1runtime "github.com/siderolabs/talos/internal/app/machined/pkg/runtime"
 	"github.com/siderolabs/talos/pkg/logging"
+	"github.com/siderolabs/talos/pkg/machinery/config/container"
 	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
 	"github.com/siderolabs/talos/pkg/machinery/constants"
 	"github.com/siderolabs/talos/pkg/machinery/resources/config"
@@ -167,15 +168,17 @@ func (suite *SyncSuite) TestReconcileSyncDisabled() {
 	)
 
 	cfg := config.NewMachineConfig(
-		&v1alpha1.Config{
-			ConfigVersion: "v1alpha1",
-			MachineConfig: &v1alpha1.MachineConfig{
-				MachineTime: &v1alpha1.TimeConfig{
-					TimeDisabled: pointer.To(true),
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				ConfigVersion: "v1alpha1",
+				MachineConfig: &v1alpha1.MachineConfig{
+					MachineTime: &v1alpha1.TimeConfig{
+						TimeDisabled: pointer.To(true),
+					},
 				},
+				ClusterConfig: &v1alpha1.ClusterConfig{},
 			},
-			ClusterConfig: &v1alpha1.ClusterConfig{},
-		},
+		),
 	)
 
 	suite.Require().NoError(suite.state.Create(suite.ctx, cfg))
@@ -212,11 +215,13 @@ func (suite *SyncSuite) TestReconcileSyncDefaultConfig() {
 	suite.Require().NoError(suite.state.Create(suite.ctx, timeServers))
 
 	cfg := config.NewMachineConfig(
-		&v1alpha1.Config{
-			ConfigVersion: "v1alpha1",
-			MachineConfig: &v1alpha1.MachineConfig{},
-			ClusterConfig: &v1alpha1.ClusterConfig{},
-		},
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				ConfigVersion: "v1alpha1",
+				MachineConfig: &v1alpha1.MachineConfig{},
+				ClusterConfig: &v1alpha1.ClusterConfig{},
+			},
+		),
 	)
 
 	suite.Require().NoError(suite.state.Create(suite.ctx, cfg))
@@ -267,11 +272,13 @@ func (suite *SyncSuite) TestReconcileSyncChangeConfig() {
 	)
 
 	cfg := config.NewMachineConfig(
-		&v1alpha1.Config{
-			ConfigVersion: "v1alpha1",
-			MachineConfig: &v1alpha1.MachineConfig{},
-			ClusterConfig: &v1alpha1.ClusterConfig{},
-		},
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				ConfigVersion: "v1alpha1",
+				MachineConfig: &v1alpha1.MachineConfig{},
+				ClusterConfig: &v1alpha1.ClusterConfig{},
+			},
+		),
 	)
 
 	suite.Require().NoError(suite.state.Create(suite.ctx, cfg))
@@ -359,7 +366,7 @@ func (suite *SyncSuite) TestReconcileSyncChangeConfig() {
 	)
 
 	ctest.UpdateWithConflicts(suite, cfg, func(r *config.MachineConfig) error {
-		r.Config().(*v1alpha1.Config).MachineConfig.MachineTime = &v1alpha1.TimeConfig{
+		r.Container().RawV1Alpha1().MachineConfig.MachineTime = &v1alpha1.TimeConfig{
 			TimeDisabled: pointer.To(true),
 		}
 
@@ -412,15 +419,17 @@ func (suite *SyncSuite) TestReconcileSyncBootTimeout() {
 	)
 
 	cfg := config.NewMachineConfig(
-		&v1alpha1.Config{
-			ConfigVersion: "v1alpha1",
-			MachineConfig: &v1alpha1.MachineConfig{
-				MachineTime: &v1alpha1.TimeConfig{
-					TimeBootTimeout: 5 * time.Second,
+		container.NewV1Alpha1(
+			&v1alpha1.Config{
+				ConfigVersion: "v1alpha1",
+				MachineConfig: &v1alpha1.MachineConfig{
+					MachineTime: &v1alpha1.TimeConfig{
+						TimeBootTimeout: 5 * time.Second,
+					},
 				},
+				ClusterConfig: &v1alpha1.ClusterConfig{},
 			},
-			ClusterConfig: &v1alpha1.ClusterConfig{},
-		},
+		),
 	)
 
 	suite.Require().NoError(suite.state.Create(suite.ctx, cfg))
@@ -446,21 +455,6 @@ func (suite *SyncSuite) TearDownTest() {
 	suite.ctxCancel()
 
 	suite.wg.Wait()
-
-	// trigger updates in resources to stop watch loops
-	err := suite.state.Create(
-		context.Background(), config.NewMachineConfig(
-			&v1alpha1.Config{
-				ConfigVersion: "v1alpha1",
-				MachineConfig: &v1alpha1.MachineConfig{},
-			},
-		),
-	)
-	if state.IsConflictError(err) {
-		err = suite.state.Destroy(context.Background(), config.NewMachineConfig(nil).Metadata())
-	}
-
-	suite.Assert().NoError(err)
 }
 
 func (suite *SyncSuite) newMockSyncer(logger *zap.Logger, servers []string) timectrl.NTPSyncer {

internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_sequencer.go

@@ -12,7 +12,7 @@ import (
 
 	"github.com/siderolabs/talos/internal/app/machined/pkg/runtime"
 	machineapi "github.com/siderolabs/talos/pkg/machinery/api/machine"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/machine"
+	"github.com/siderolabs/talos/pkg/machinery/config/machine"
 	"github.com/siderolabs/talos/pkg/machinery/constants"
 )
 

internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_sequencer_tasks.go

@@ -70,8 +70,8 @@ import (
 	machineapi "github.com/siderolabs/talos/pkg/machinery/api/machine"
 	"github.com/siderolabs/talos/pkg/machinery/config/config"
 	"github.com/siderolabs/talos/pkg/machinery/config/configloader"
+	"github.com/siderolabs/talos/pkg/machinery/config/machine"
 	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/machine"
 	"github.com/siderolabs/talos/pkg/machinery/constants"
 	"github.com/siderolabs/talos/pkg/machinery/kernel"
 	resourcefiles "github.com/siderolabs/talos/pkg/machinery/resources/files"

internal/app/machined/pkg/system/runner/goroutine/goroutine_test.go

@@ -23,6 +23,7 @@ import (
 	"github.com/siderolabs/talos/internal/app/machined/pkg/system/events"
 	"github.com/siderolabs/talos/internal/app/machined/pkg/system/runner"
 	"github.com/siderolabs/talos/internal/app/machined/pkg/system/runner/goroutine"
+	"github.com/siderolabs/talos/pkg/machinery/config/container"
 	v1alpha1cfg "github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
 )
 
@@ -47,9 +48,10 @@ func (suite *GoroutineSuite) SetupSuite() {
 	suite.loggingManager = logging.NewFileLoggingManager(suite.tmpDir)
 
 	s, err := v1alpha1.NewState()
-	suite.Assert().NoError(err)
+	suite.Require().NoError(err)
 
-	cfg := &v1alpha1cfg.Config{}
+	cfg, err := container.New(&v1alpha1cfg.Config{})
+	suite.Require().NoError(err)
 
 	e := v1alpha1.NewEvents(100, 10)
 
@@ -165,5 +167,7 @@ func (suite *GoroutineSuite) TestRunLogs() {
 }
 
 func TestGoroutineSuite(t *testing.T) {
+	t.Setenv("PLATFORM", "metal")
+
 	suite.Run(t, new(GoroutineSuite))
 }

internal/app/machined/pkg/system/runner/process/process_test.go

@@ -220,6 +220,10 @@ func (suite *ProcessSuite) TestStopSigKill() {
 }
 
 func TestProcessSuite(t *testing.T) {
+	if _, err := os.Stat("/sbin/wrapperd"); err != nil {
+		t.Skip("wrapperd not found")
+	}
+
 	for _, runReaper := range []bool{true, false} {
 		func(runReaper bool) {
 			t.Run(fmt.Sprintf("runReaper=%v", runReaper), func(t *testing.T) { suite.Run(t, &ProcessSuite{runReaper: runReaper}) })

internal/app/machined/pkg/system/services/etcd.go

@@ -46,7 +46,7 @@ import (
 	"github.com/siderolabs/talos/pkg/filetree"
 	"github.com/siderolabs/talos/pkg/logging"
 	machineapi "github.com/siderolabs/talos/pkg/machinery/api/machine"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/machine"
+	"github.com/siderolabs/talos/pkg/machinery/config/machine"
 	"github.com/siderolabs/talos/pkg/machinery/constants"
 	"github.com/siderolabs/talos/pkg/machinery/nethelpers"
 	etcdresource "github.com/siderolabs/talos/pkg/machinery/resources/etcd"

internal/app/machined/pkg/system/services/kubelet.go

@@ -29,7 +29,7 @@ import (
 	"github.com/siderolabs/talos/internal/pkg/containers/image"
 	"github.com/siderolabs/talos/internal/pkg/environment"
 	"github.com/siderolabs/talos/pkg/conditions"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/machine"
+	"github.com/siderolabs/talos/pkg/machinery/config/machine"
 	"github.com/siderolabs/talos/pkg/machinery/constants"
 	"github.com/siderolabs/talos/pkg/machinery/resources/k8s"
 	"github.com/siderolabs/talos/pkg/machinery/resources/network"

internal/app/maintenance/server/server.go

@@ -28,7 +28,7 @@ import (
 	"github.com/siderolabs/talos/pkg/machinery/api/machine"
 	"github.com/siderolabs/talos/pkg/machinery/api/storage"
 	"github.com/siderolabs/talos/pkg/machinery/config/configloader"
-	v1alpha1machine "github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/machine"
+	v1alpha1machine "github.com/siderolabs/talos/pkg/machinery/config/machine"
 	"github.com/siderolabs/talos/pkg/machinery/constants"
 	"github.com/siderolabs/talos/pkg/version"
 )

internal/app/trustd/internal/reg/reg_test.go

@@ -22,7 +22,7 @@ import (
 
 	"github.com/siderolabs/talos/internal/app/trustd/internal/reg"
 	"github.com/siderolabs/talos/pkg/machinery/api/security"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/generate"
+	gensecrets "github.com/siderolabs/talos/pkg/machinery/config/generate/secrets"
 	"github.com/siderolabs/talos/pkg/machinery/resources/secrets"
 	"github.com/siderolabs/talos/pkg/machinery/role"
 )
@@ -33,7 +33,7 @@ func TestCertificate(t *testing.T) {
 
 	resources := state.WrapCore(namespaced.NewState(inmem.Build))
 
-	ca, err := generate.NewTalosCA(time.Now())
+	ca, err := gensecrets.NewTalosCA(time.Now())
 	require.NoError(t, err)
 
 	osRoot := secrets.NewOSRoot(secrets.OSRootID)

internal/integration/api/apid.go

@@ -14,7 +14,7 @@ import (
 
 	"github.com/siderolabs/talos/internal/integration/base"
 	"github.com/siderolabs/talos/pkg/machinery/client"
-	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1/machine"
+	"github.com/siderolabs/talos/pkg/machinery/config/machine"
 )
 
 // ApidSuite verifies Discovery API.