feat: add autoscaler worker machine config for 0-worker clusters

When no worker nodes are defined, generates a worker machine config
template using the same cluster secrets and Hetzner-specific patches.
This enables cluster-autoscaler to create workers that correctly join
the cluster without requiring a seed worker in terraform.

The autoscaler_worker data source only activates when worker_count == 0.
When workers exist, use the existing worker machine config output.

Author: toni-bentini

outputs.tf

@@ -48,3 +48,9 @@ output "talos_worker_ids" {
   description = "Server IDs of the hetzner talos workers machines"
   value       = { for id, server in hcloud_server.workers : id => server.id }
 }
+
+output "autoscaler_worker_machine_config" {
+  description = "Worker machine configuration for autoscaler use (generated when no workers are defined)"
+  value       = length(data.talos_machine_configuration.autoscaler_worker) > 0 ? data.talos_machine_configuration.autoscaler_worker[0].machine_configuration : ""
+  sensitive   = true
+}

talos.tf

@@ -162,3 +162,19 @@ locals {
     client_key             = base64decode(talos_cluster_kubeconfig.this[0].kubernetes_client_configuration.client_key)
   }
 }
+
+# Generate a worker machine config template for autoscaler use.
+# This produces a valid worker config even when no worker nodes are defined,
+# using the same machine secrets and cluster configuration as real workers.
+data "talos_machine_configuration" "autoscaler_worker" {
+  count              = local.worker_count == 0 ? 1 : 0
+  talos_version      = var.talos_version
+  cluster_name       = var.cluster_name
+  cluster_endpoint   = local.cluster_endpoint_url_internal
+  kubernetes_version = var.kubernetes_version
+  machine_type       = "worker"
+  machine_secrets    = talos_machine_secrets.this.machine_secrets
+  config_patches     = concat([yamlencode(local.autoscaler_worker_yaml)], var.talos_worker_extra_config_patches)
+  docs               = false
+  examples           = false
+}

talos_patch_worker.tf

@@ -88,3 +88,77 @@ locals {
     }
   }
 }
+
+  # Worker YAML template for autoscaler (used when no real workers exist).
+  # Same config patches as real workers but without node-specific values.
+  autoscaler_worker_yaml = {
+    machine = {
+      install = {
+        image = "ghcr.io/siderolabs/installer:${var.talos_version}"
+      }
+      certSANs = local.cert_SANs
+      kubelet = {
+        extraArgs = merge(
+          {
+            "cloud-provider"             = "external"
+            "rotate-server-certificates" = true
+          },
+          var.kubelet_extra_args
+        )
+        nodeIP = {
+          validSubnets = [
+            local.node_ipv4_cidr
+          ]
+        }
+      }
+      network = {
+        extraHostEntries = local.extra_host_entries
+        kubespan = {
+          enabled = var.enable_kube_span
+          advertiseKubernetesNetworks : false
+          mtu : 1370
+        }
+      }
+      kernel = {
+        modules = var.kernel_modules_to_load
+      }
+      sysctls = merge(
+        {
+          "net.core.somaxconn"          = "65535"
+          "net.core.netdev_max_backlog" = "4096"
+        },
+        var.sysctls_extra_args
+      )
+      features = {
+        hostDNS = {
+          enabled              = true
+          forwardKubeDNSToHost = true
+          resolveMemberNames   = true
+        }
+      }
+      time = {
+        servers = [
+          "ntp1.hetzner.de",
+          "ntp2.hetzner.com",
+          "ntp3.hetzner.net",
+          "time.cloudflare.com"
+        ]
+      }
+      nodeLabels = {}
+      registries = var.registries
+    }
+    cluster = {
+      network = {
+        dnsDomain = var.cluster_domain
+        podSubnets = [
+          local.pod_ipv4_cidr
+        ]
+        serviceSubnets = [
+          local.service_ipv4_cidr
+        ]
+        cni = {
+          name = "none"
+        }
+      }
+    }
+  }