fix(talos): drop siderolabs/thunderbolt from factory schematic

[Aviator-Coding]

Intent

Captain decision 2026-08-29, in the captain's own words: "We are not actively using it we have 1 node where we had issues to create a connection thats why we removed it." So the intent was genuine removal, the inline comment is correct, and the code is wrong.

talos/schematic.yaml.j2 listed - siderolabs/thunderbolt #intentionally removed to avoid Thunderbolt NIC getting unwanted DHCP address at early boot. The item is NOT commented out, so the extension still ships in every built schematic while the comment claims it was removed. The contradiction dates to commit 49a742c (PR #877).

Remove siderolabs/thunderbolt from the schematic so the built image matches the stated intent. Prefer deleting the line outright over leaving a commented-out corpse; if you keep any note, make it a clear standalone comment recording that Thunderbolt is deliberately excluded because it caused connection trouble on one node and is not in use, so nobody re-adds it.

Check whether any other template or doc references the thunderbolt extension and would now be stale - talos/machineconfig.yaml.j2, talos/nodes/*.yaml.j2, talos/AGENTS.md, and docs/. Correct anything that says the extension is present. Do not go further than that.

HARD SAFETY LIMIT: this is a FILE CHANGE ONLY. Do not run talosctl against live nodes, do not apply any machine config, do not upgrade or reboot a node, and do not trigger an image build against live hardware. Rolling this out to nodes is a separate captain decision that has NOT been given. If a node rollout is needed for correctness, say so in the PR body and stop - do not do it.

Acceptance criteria: the built schematic no longer includes siderolabs/thunderbolt; no file still claims the extension is present; repo template validation still passes (render the schematic and show the extension list in the PR body as proof); nothing was applied to any live node.

Implementation notes for the reviewer: the live list item was replaced with a standalone exclusion comment, not a commented-out list item. The already-commented kernel arg module_blacklist=thunderbolt was left as-is because it does not claim the extension is present. No other files claimed the extension was installed. Offline scripts/ci/talos-validate.sh passed. Rendered officialExtensions: siderolabs/xe, siderolabs/i915, siderolabs/intel-ucode, siderolabs/mei, siderolabs/nfsrahead. PR body must include that rendered extension list and must state that taking this off running images still needs a separate captain decision (new factory schematic ID plus just talos upgrade-node per node).

What Changed

• Removed the live siderolabs/thunderbolt entry from talos/schematic.yaml.j2 systemExtensions.officialExtensions and replaced it with a standalone exclusion comment (connection trouble on one node / unwanted early-boot DHCP; not in use; do not re-add).
• Built schematic officialExtensions are now: siderolabs/xe, siderolabs/i915, siderolabs/intel-ucode, siderolabs/mei, siderolabs/nfsrahead.
• No other templates or docs claimed the extension was present; the existing commented module_blacklist=thunderbolt kernel arg was left as-is. Applying this to running nodes still needs a separate captain decision (new factory schematic ID plus just talos upgrade-node per node)—nothing was applied to live hardware.

Risk Assessment

✅ Low: Bounded template-only fix that removes the contradictory live extension entry and matches captain intent without touching live nodes or other configs.

Testing

Offline schematic render and yq-parsed officialExtensions prove thunderbolt is gone (five expected extensions only), baseline still reproduced the bug, scripts/ci/talos-validate.sh passed for all three nodes, and no other file still claims the extension is installed—file-change-only, no live node touch.

Evidence: Rendered officialExtensions after fix (clean yq values)

siderolabs/xe siderolabs/i915 siderolabs/intel-ucode siderolabs/mei siderolabs/nfsrahead

siderolabs/xe
siderolabs/i915
siderolabs/intel-ucode
siderolabs/mei
siderolabs/nfsrahead

Evidence: Before/after officialExtensions (base still had thunderbolt)

=== BEFORE (base 30fdc87a) officialExtensions ===
- siderolabs/xe # Intel iGPU + Arc discrete GPU
# Firmware only, in practice: xe drives the a7a0 iGPU but still loads its
# blobs from i915/ (adlp_dmc.bin, adlp_guc_70.bin), which siderolabs/xe does
# not ship - it carries only xe/ (bmg_*, lnl_*). Dropping this in 73c9e3da
# left talos-1/2 probing -ENOENT. i915.ko rides along but is kept off the
# iGPU by i915.force_probe=!a7a0 above, so xe still owns it.
- siderolabs/i915 # Intel iGPU firmware (i915/adlp_*) for the xe driver
- siderolabs/intel-ucode # Intel iGPU
- siderolabs/mei # Intel iGPU
- siderolabs/nfsrahead # NFS Performance
- siderolabs/thunderbolt #intentionally removed to avoid Thunderbolt NIC getting unwanted DHCP address at early boot

=== AFTER (HEAD a812a3b2) officialExtensions ===
- siderolabs/xe # Intel iGPU + Arc discrete GPU
# Firmware only, in practice: xe drives the a7a0 iGPU but still loads its
# blobs from i915/ (adlp_dmc.bin, adlp_guc_70.bin), which siderolabs/xe does
# not ship - it carries only xe/ (bmg_*, lnl_*). Dropping this in 73c9e3da
# left talos-1/2 probing -ENOENT. i915.ko rides along but is kept off the
# iGPU by i915.force_probe=!a7a0 above, so xe still owns it.
- siderolabs/i915 # Intel iGPU firmware (i915/adlp_*) for the xe driver
- siderolabs/intel-ucode # Intel iGPU
- siderolabs/mei # Intel iGPU
- siderolabs/nfsrahead # NFS Performance
# siderolabs/thunderbolt is deliberately excluded: it caused connection
# trouble on one node (unwanted DHCP on the Thunderbolt NIC at early boot)
# and is not in use. Do not re-add it.

=== delta ===
removed: siderolabs/thunderbolt (was present in base render, absent in HEAD render)

Evidence: Semantic extension assert (PASS)

before: ['siderolabs/xe', 'siderolabs/i915', 'siderolabs/intel-ucode', 'siderolabs/mei', 'siderolabs/nfsrahead', 'siderolabs/thunderbolt'] after: ['siderolabs/xe', 'siderolabs/i915', 'siderolabs/intel-ucode', 'siderolabs/mei', 'siderolabs/nfsrahead'] PASS: baseline had thunderbolt; fixed render drops it; list matches expected five extensions

before: ['siderolabs/xe', 'siderolabs/i915', 'siderolabs/intel-ucode', 'siderolabs/mei', 'siderolabs/nfsrahead', 'siderolabs/thunderbolt']
after: ['siderolabs/xe', 'siderolabs/i915', 'siderolabs/intel-ucode', 'siderolabs/mei', 'siderolabs/nfsrahead']
PASS: baseline had thunderbolt; fixed render drops it; list matches expected five extensions

Evidence: scripts/ci/talos-validate.sh

OK: 3 node config(s) render and validate; schematic renders

/var/folders/yr/h20mxtv56yj1c1pt9tr1_kbc0000gn/T/tmp.iJZoowhG3G/talos-1.yaml is valid for metal mode
/var/folders/yr/h20mxtv56yj1c1pt9tr1_kbc0000gn/T/tmp.iJZoowhG3G/talos-2.yaml is valid for metal mode
/var/folders/yr/h20mxtv56yj1c1pt9tr1_kbc0000gn/T/tmp.iJZoowhG3G/talos-3.yaml is valid for metal mode
OK: 3 node config(s) render and validate; schematic renders

Evidence: Full rendered schematic.yaml

---
customization:
  extraKernelArgs:
    - -init_on_alloc # Less security, faster puter
    - -init_on_free # Less security, faster puter
    - -selinux # Less security, faster puter
    - apparmor=0 # Less security, faster puter
    - init_on_alloc=0 # Less security, faster puter
    - init_on_free=0 # Less security, faster puter
    - intel_iommu=on # PCI Passthrough
    - iommu=pt # PCI Passthrough
    - mitigations=off # Less security, faster puter
    - module_blacklist=igc # Disable onboard NIC
    # - module_blacklist=thunderbolt # Prevent Thunderbolt NIC driver from loading during early boot
    - security=none # Less security, faster puter
    - sysctl.kernel.kexec_load_disabled=1 # Meteor Lake CPU & Intel iGPU
    - nvme_core.default_ps_max_latency_us=0 # Disable NVMe APST deep sleep to prevent I/O stalls
    - pcie_aspm=off # Disable PCIe Active State Power Management to prevent link state transitions
    - pci=realloc # Reallocate PCIe resource windows for the Arc B70 Pro OCuLink switch
    - pci=assign-busses # BIOS leaves the B70's e2ff switch at [bus 00-00] with no spare bus numbers behind 00:01.0; kernel must renumber all buses (NIC renames are safe: bonds select members via LinkAliasConfig)
    - xe.force_probe=a7a0 # Bind xe to the Raptor Lake i9-13900H iGPU (8086:a7a0), which xe skips by default
    - i915.force_probe=!a7a0 # Keep i915 off the iGPU so xe owns it (load-bearing: siderolabs/i915 ships i915.ko)
    - talos.auditd.disabled=1 # Less security, faster puter
    # Bond interface kernel parameters for early network initialization
    # - bond=bond0:enp2s0f0np0,enp2s0f1np1:mode=802.3ad:miimon=100:lacp_rate=1:xmit_hash_policy=layer3+4:updelay=200:downdelay=200
    # - ip=bond0:dhcp # Enable DHCP on bond0 during early boot
  systemExtensions:
    officialExtensions:
      - siderolabs/xe # Intel iGPU + Arc discrete GPU
      # Firmware only, in practice: xe drives the a7a0 iGPU but still loads its
      # blobs from i915/ (adlp_dmc.bin, adlp_guc_70.bin), which siderolabs/xe does
      # not ship - it carries only xe/ (bmg_*, lnl_*). Dropping this in 73c9e3da
      # left talos-1/2 probing -ENOENT. i915.ko rides along but is kept off the
      # iGPU by i915.force_probe=!a7a0 above, so xe still owns it.
      - siderolabs/i915 # Intel iGPU firmware (i915/adlp_*) for the xe driver
      - siderolabs/intel-ucode # Intel iGPU
      - siderolabs/mei # Intel iGPU
      - siderolabs/nfsrahead # NFS Performance
      # siderolabs/thunderbolt is deliberately excluded: it caused connection
      # trouble on one node (unwanted DHCP on the Thunderbolt NIC at early boot)
      # and is not in use. Do not re-add it.

Evidence: Stale reference check (only exclusion comments remain)

=== all thunderbolt mentions in repo (excl .git) ===
./talos/schematic.yaml.j2:14:    # - module_blacklist=thunderbolt # Prevent Thunderbolt NIC driver from loading during early boot
./talos/schematic.yaml.j2:39:      # siderolabs/thunderbolt is deliberately excluded: it caused connection
./talos/schematic.yaml.j2:40:      # trouble on one node (unwanted DHCP on the Thunderbolt NIC at early boot)

=== live YAML list items '- siderolabs/thunderbolt' ===
PASS: none

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

✅ **Review** - passed

✅ No issues found.

✅ **Test** - passed

✅ No issues found.

• bash scripts/ci/talos-validate.sh (3 node metal validates + schematic render)
• minijinja-cli talos/schematic.yaml.j2 | yq '.customization.systemExtensions.officialExtensions[]' on HEAD vs base 30fdc87a
• Semantic before/after assertion: baseline list still contained siderolabs/thunderbolt; HEAD list is exactly xe, i915, intel-ucode, mei, nfsrahead
• Repo-wide check for live - siderolabs/thunderbolt list items and other docs/template presence claims
• Confirmed no talosctl apply/upgrade/reboot or factory schematic POST against live hardware

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.