Talos 1.14: Example KubeAdmissionControlConfig results in kube-apiserver errors

Path: /talos/v1.14/reference/configuration/kubernetes/kubeadmissioncontrolconfig

Hey team, I got tripped up by the KubeAdmissionControlConfig example while migrating to the new Talos 1.14 configuration schema.

The example KubeAdmissionControlConfig includes kube-system in the PodSecurity namespace exemptions, so I kept it in my patch and added cilium-system alongside it.

apiVersion: v1alpha1
kind: KubeAdmissionControlConfig
name: PodSecurity
configuration:
    apiVersion: pod-security.admission.config.k8s.io/v1alpha1
...
    exemptions:
        namespaces:
            - kube-system # I assumed this had to stay as it was documented
            - cilium-system
...
    kind: PodSecurityConfiguration

It turns out talosctl gen config already includes kube-system, and the patch appends the supplied namespaces. Running talosctl gen config test https://10.xx.xx.xx:6443 --config-patch=@admission.yaml resulted in the KubeAdmissionControlConfig having a duplicate:

...
    exemptions:
        namespaces:
            - kube-system
            - kube-system # oh no!
            - cilium-system
...

This caused the kube-apiserver to fail to start with:

talosctl -n 10.xx.xx.xx logs --namespace cri 'kube-system/kube-apiserver-<node>:kube-apiserver:0aa3972d7b1d'
...
10.xx.xx.xx: 2026-09-10T15:38:48.011416929Z stderr F E0910 15:38:48.011279 1 run.go:72] "command failed" err="failed to apply admission: failed to initialize admission plugin \"PodSecurity\": PodSecurity invalid: exemptions.namespaces[1]: Duplicate value: \"kube-system\""

The append behavior seems intentional, but I didn’t realize the example showed a complete configuration rather than something I could use directly as a patch.

Could we add a short note explaining that kube-system is already included by default, and that a patch should only list the additional namespaces? Or use a different namespace as an example:

apiVersion: v1alpha1
kind: KubeAdmissionControlConfig
name: PodSecurity
configuration:
  exemptions:
    namespaces:
      - cilium-system

After fixing this, the update went smooth as usual. Big thanks for making the Configuration document map, it was very helpful!

talosctl version
Client:
	Tag:         v1.14.0
	SHA:         undefined
	Built:       2026-09-03T06:04:55Z
	Go version:  go1.27.1
	OS/Arch:     linux/amd64

Open /talos/v1.14/reference/configuration/kubernetes/kubeadmissioncontrolconfig and review the KubeAdmissionControlConfig example, especially the PodSecurity namespace exemptions. Update the example or add a note to explain that kube-system is already included and patches should list only additional namespaces, then verify the rendered documentation is clear.