fix(vms): normalize comma spacing in unifi manifests — unblock the lint gate
The hand-authored UniFi VM manifests used column-aligned inline flow mappings
(`{ name: inform, port: 8080, protocol: TCP }`), which yamllint's `commas`
rule rejects as "too many spaces after comma". That made `make -C ci lint` FAIL,
so the merge gate has been BLOCKED on `main` since the UniFi commits landed —
every other static stage was green.
Collapse each run of spaces after a comma to one, and re-align the trailing
comments so the port tables stay readable. Whitespace only:
`kubectl kustomize apps/vms` renders byte-for-byte identically before and after.
The lint config is left untouched — relaxing the rule to make failing files pass
is moving the goalposts, not fixing the code.
Also refresh these files' stale `STAGING / DRAFT` headers: the tree is live,
reconciled by the non-gating `apps-vms` Flux Kustomization.
Gate after this change: spec-immutability / lint / l0 / l1 all green,
MERGE GATE: PASS.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
This commit is contained in:
jakman85andClaude Opus 5 committed
1 parent
3472f1d161
commit
4cf9572c58
5 files changed
+26
-26
No files matched your search
@@ -1,5 +1,5 @@
|
||||
---
|
||||
# STAGING / DRAFT — see namespace.yaml header.
|
||||
# LIVE — reconciled by the non-gating `apps-vms` Flux Kustomization (see namespace.yaml header).
|
||||
#
|
||||
# Default-deny baseline (R-NET-01): deny all ingress + egress, allow ONLY DNS to the
|
||||
# in-cluster resolver. Identical shape to the rendered pihole/app baseline. The VM's
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
# STAGING / DRAFT — see namespace.yaml header.
|
||||
# LIVE — reconciled by the non-gating `apps-vms` Flux Kustomization (see namespace.yaml header).
|
||||
#
|
||||
# CDI DataVolume — the UniFi VM boot disk. This is the FIRST real CDI *http* import on
|
||||
# this cluster (the vm-demo/conformance path imports a containerdisk from a *registry*;
|
||||
@@ -9,7 +9,7 @@
|
||||
# STANDALONE DataVolume (NOT a dataVolumeTemplate) so the disk OUTLIVES `kubectl delete vm`
|
||||
# and survives destroy/rebuild (R-STATE-01) — same durability contract as vm-demo.
|
||||
#
|
||||
# STORAGE = longhorn-vm (the RWX/migratable StorageClass the storage workstream is adding):
|
||||
# STORAGE = longhorn-vm (the RWX/Block/migratable StorageClass; live in platform/longhorn):
|
||||
# - accessModes: ReadWriteMany + volumeMode: Block => REQUIRED for KubeVirt LIVE MIGRATION
|
||||
# (evictionStrategy: LiveMigrate in the VM). A ReadWriteOnce disk cannot live-migrate.
|
||||
# - 40Gi: the Ubuntu cloud image virtual size is ~3.5Gi; cloud-init growpart/growroot
|
||||
|
||||
@@ -65,14 +65,14 @@ spec:
|
||||
# these and (b) surfaces them as containerPorts on the virt-launcher pod so the
|
||||
# LoadBalancer Services + CiliumNetworkPolicy ingress can target/match them.
|
||||
ports:
|
||||
- { name: inform, port: 8080, protocol: TCP } # device inform / adoption
|
||||
- { name: ui-legacy, port: 8443, protocol: TCP } # legacy Network UI (still served)
|
||||
- { name: ui, port: 11443, protocol: TCP } # UOS web UI (modern default)
|
||||
- { name: portal-http, port: 8880, protocol: TCP } # guest portal HTTP
|
||||
- { name: portal-https, port: 8843, protocol: TCP } # guest portal HTTPS
|
||||
- { name: throughput, port: 6789, protocol: TCP } # mobile speedtest / throughput
|
||||
- { name: stun, port: 3478, protocol: UDP } # STUN (device<->controller)
|
||||
- { name: discovery, port: 10001, protocol: UDP } # L2 device discovery
|
||||
- { name: inform, port: 8080, protocol: TCP } # device inform / adoption
|
||||
- { name: ui-legacy, port: 8443, protocol: TCP } # legacy Network UI (still served)
|
||||
- { name: ui, port: 11443, protocol: TCP } # UOS web UI (modern default)
|
||||
- { name: portal-http, port: 8880, protocol: TCP } # guest portal HTTP
|
||||
- { name: portal-https, port: 8843, protocol: TCP } # guest portal HTTPS
|
||||
- { name: throughput, port: 6789, protocol: TCP } # mobile speedtest / throughput
|
||||
- { name: stun, port: 3478, protocol: UDP } # STUN (device<->controller)
|
||||
- { name: discovery, port: 10001, protocol: UDP } # L2 device discovery
|
||||
resources:
|
||||
requests:
|
||||
memory: 4Gi
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
# STAGING / DRAFT — see namespace.yaml header.
|
||||
# LIVE — reconciled by the non-gating `apps-vms` Flux Kustomization (see namespace.yaml header).
|
||||
#
|
||||
# Additive ALLOWs on top of the 10-default-deny baseline. Cilium enforces the UNION of the k8s
|
||||
# NetworkPolicy (default-deny) and these CiliumNetworkPolicies (same pattern as pihole). The VM's
|
||||
@@ -31,13 +31,13 @@ spec:
|
||||
- host
|
||||
toPorts:
|
||||
- ports:
|
||||
- { port: "8080", protocol: TCP } # inform / adoption
|
||||
- { port: "8080", protocol: TCP } # inform / adoption
|
||||
- { port: "11443", protocol: TCP } # UOS UI
|
||||
- { port: "8443", protocol: TCP } # legacy UI
|
||||
- { port: "8880", protocol: TCP } # guest portal http
|
||||
- { port: "8843", protocol: TCP } # guest portal https
|
||||
- { port: "6789", protocol: TCP } # throughput
|
||||
- { port: "3478", protocol: UDP } # STUN
|
||||
- { port: "8443", protocol: TCP } # legacy UI
|
||||
- { port: "8880", protocol: TCP } # guest portal http
|
||||
- { port: "8843", protocol: TCP } # guest portal https
|
||||
- { port: "6789", protocol: TCP } # throughput
|
||||
- { port: "3478", protocol: UDP } # STUN
|
||||
- { port: "10001", protocol: UDP } # discovery
|
||||
---
|
||||
# 2) EGRESS from the controller: internet (apt, the UOS installer download, UniFi updates + remote
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
# STAGING / DRAFT — see namespace.yaml header.
|
||||
# LIVE — reconciled by the non-gating `apps-vms` Flux Kustomization (see namespace.yaml header).
|
||||
#
|
||||
# ============================================================================================
|
||||
# L4 EXPOSURE (the hard part) — why the shared HTTPS Gateway is NOT enough for UniFi.
|
||||
@@ -49,12 +49,12 @@ spec:
|
||||
selector:
|
||||
kubevirt.io/vm: unifi
|
||||
ports:
|
||||
- { name: inform, port: 8080, targetPort: 8080, protocol: TCP }
|
||||
- { name: ui, port: 11443, targetPort: 11443, protocol: TCP }
|
||||
- { name: ui-legacy, port: 8443, targetPort: 8443, protocol: TCP }
|
||||
- { name: portal-http, port: 8880, targetPort: 8880, protocol: TCP }
|
||||
- { name: portal-https, port: 8843, targetPort: 8843, protocol: TCP }
|
||||
- { name: throughput, port: 6789, targetPort: 6789, protocol: TCP }
|
||||
- { name: inform, port: 8080, targetPort: 8080, protocol: TCP }
|
||||
- { name: ui, port: 11443, targetPort: 11443, protocol: TCP }
|
||||
- { name: ui-legacy, port: 8443, targetPort: 8443, protocol: TCP }
|
||||
- { name: portal-http, port: 8880, targetPort: 8880, protocol: TCP }
|
||||
- { name: portal-https, port: 8843, targetPort: 8843, protocol: TCP }
|
||||
- { name: throughput, port: 6789, targetPort: 6789, protocol: TCP }
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
@@ -72,5 +72,5 @@ spec:
|
||||
selector:
|
||||
kubevirt.io/vm: unifi
|
||||
ports:
|
||||
- { name: stun, port: 3478, targetPort: 3478, protocol: UDP }
|
||||
- { name: stun, port: 3478, targetPort: 3478, protocol: UDP }
|
||||
- { name: discovery, port: 10001, targetPort: 10001, protocol: UDP }
|
||||
Reference in new issue
Block a user