talosctl wrapper drops inherited persistent flags from parent commands

[lexfrei]

The talosctl wrapper at pkg/commands/talosctl_wrapper.go:54-79 copies flags from each upstream command via:

cmd.Flags().VisitAll(func(flag *pflag.Flag) {
    ...
    wrappedCmd.Flags().AddFlag(flag)
})

Command.Flags() in cobra returns the local flag set. Persistent flags declared on a parent command live in Command.PersistentFlags() and are merged into the effective flag set only at command-execution time via mergePersistentFlags(). The wrapper iterates each command in isolation before the wrapped command tree is assembled, so persistent flags from parents never make it onto the wrapped child.

The result: every wrapped subcommand whose parent declares a persistent flag loses access to that flag through talm.

Concrete examples observed by inspecting cmd/talosctl/cmd/talos/ in siderolabs/talos against talm <cmd> --help:

• talm image list --namespace — upstream registers --namespace on imageCmd.PersistentFlags() (defaults to cri, values system / cri / inmem). talm drops it.
• talm image pull --namespace — same parent, same drop.
• talm meta write --insecure / talm meta delete --insecure — upstream metaCmd.PersistentFlags().BoolVarP(&metaCmdFlags.insecure, "insecure", "i", ...) selects the maintenance service. talm drops it.
• talm image talos-bundle — loses --overlays, --extensions.
• talm image kubernetes-bundle — loses --k8s-version, --etcd-version, --flannel-version, --coredns-version, --kube-network-policies-version.
• talm image cache create / image cache serve / image cache certs gen — collectively lose ~15 flags (image-cache-path, platform, images, force, mirror, tls-cert-file, tls-key-file, advertised-address, advertised-name, etc.).
• talm image integration — loses --installer-tag, --talos-tag, --registry-and-user.

Reproducer:

$ talm image list --help
List CRI images

Usage:
  talm image list [flags]

Aliases:
  list, l, ls

Flags:
  -f, --file strings   specify config files or patches in a YAML file (can specify multiple)
  -h, --help           help for list

Note the absence of --namespace. Upstream talosctl image list --help shows it as a global flag inherited from the image parent.

Scope:

• Walk cmd.PersistentFlags().VisitAll(...) separately from cmd.Flags().VisitAll(...) in wrapTalosCommand and apply persistent flags to the wrapped command's own PersistentFlags(). Preserves inheritance semantics: the wrapped parent's persistent flags will propagate to its wrapped children at execution time via cobra's mergePersistentFlags().
• Alternative: do a second pass after the recursive wrap that re-establishes parent→child persistent-flag inheritance on the wrapped tree. More invasive, no obvious benefit over the first approach.

Tests: per-affected-command help-text snapshot asserting the inherited persistent flag is visible. A meta-test could iterate taloscommands.Commands, recursively find subcommands whose upstream parent has persistent flags, and assert the wrapped subcommand surfaces them — that would catch the next regression in this area without listing every affected command by hand.

Severity: the bug affects every wrapped subcommand whose parent declares a persistent flag — ~25+ flags lost across the talosctl surface. Operators hitting this likely don't recognise it as a talm bug and either work around it via raw talosctl or assume the flag doesn't exist.