fix(vms): actually apply inline userData + drop secretGenerator (amend 760084e)

760084e only committed the unifi-cloudinit.yaml deletion — the `git add` errored
on that already-staged pathspec and skipped the other two files, leaving the
kustomization still referencing the deleted file (broken build). Commit the
intended changes: 30-virtualmachine.yaml inline userData + kustomization.yaml
without the secretGenerator.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

apps/vms/unifi/30-virtualmachine.yaml

@@ -85,10 +85,30 @@ spec:
             name: unifi-rootdisk
         - name: cloudinit
           cloudInitNoCloud:
-            # cloud-init is sourced from the `unifi-cloudinit` Secret (userDataSecretRef) rather than
-            # inline, because the full userData (SSH key + install script) exceeds KubeVirt's 2048-byte
-            # inline cloudInitNoCloud.userData limit. The Secret is generated from
-            # apps/vms/unifi/unifi-cloudinit.yaml by the kustomization's secretGenerator (stable name,
-            # no hash suffix). Content is non-sensitive (public key + public installer script).
-            userDataSecretRef:
-              name: unifi-cloudinit
+            # INLINE (kept < KubeVirt's 2048-byte userData limit — so NO SSH key here; add one back via
+            # userDataSecretRef only if needed). qemu-guest-agent gives the KubeVirt AgentConnected
+            # signal (proves cloud-init ran); install-uos resolves the latest UOS linux-x64 build from
+            # Ubiquiti's PUBLIC firmware API (no auth) and installs it non-interactively (UI on :11443).
+            # NOTE: apps-vms has NO postBuild.substituteFrom, so shell ${...} below is NOT envsubst'd.
+            userData: |-
+              #cloud-config
+              hostname: unifi
+              fqdn: unifi.home.keithjackson.dev
+              package_update: true
+              package_upgrade: false
+              packages: [qemu-guest-agent, podman, uidmap, slirp4netns, ca-certificates, curl, jq, cloud-guest-utils]
+              write_files:
+                - path: /usr/local/sbin/install-uos
+                  permissions: '0755'
+                  content: |
+                    #!/usr/bin/env bash
+                    set -euo pipefail
+                    if [ -z "${UOS_URL:-}" ]; then
+                      UOS_URL="$(curl -fsSL https://fw-update.ui.com/api/firmware-latest | jq -r '._embedded.firmware|map(select(.product=="unifi-os-server" and .platform=="linux-x64"))|sort_by(.version_major,.version_minor,.version_patch)|last._links.data.href')"
+                    fi
+                    [ -n "${UOS_URL}" ] && [ "${UOS_URL}" != "null" ] || { echo "no UOS URL"; exit 1; }
+                    t="$(mktemp)"; echo "downloading ${UOS_URL}"; curl -fL --retry 5 --retry-delay 10 -o "$t" "$UOS_URL"; chmod +x "$t"; echo "installing"; yes | "$t"; echo "done"
+              runcmd:
+                - [ systemctl, enable, --now, qemu-guest-agent ]
+                - [ systemctl, enable, --now, podman.socket ]
+                - [ bash, -lc, "/usr/local/sbin/install-uos 2>&1 | tee /var/log/uos-install.log > /dev/console" ]

apps/vms/unifi/kustomization.yaml

@@ -11,15 +11,3 @@ resources:
   - 30-virtualmachine.yaml
   - 40-networkpolicy.yaml
   - 50-service-l4.yaml
-# The VM's cloud-init (SSH key + UOS install script) exceeds KubeVirt's 2048-byte inline userData
-# limit, so it is delivered via a Secret (30-virtualmachine.yaml userDataSecretRef: unifi-cloudinit).
-# secretGenerator wraps the readable unifi-cloudinit.yaml file as key `userdata`. disableNameSuffixHash
-# keeps the name stable (the VM references it by fixed name — Kustomize can't rewrite a KubeVirt
-# userDataSecretRef). Content is non-sensitive (public key + public installer), so NOT SOPS-encrypted.
-secretGenerator:
-  - name: unifi-cloudinit
-    namespace: unifi
-    files:
-      - userdata=unifi-cloudinit.yaml
-generatorOptions:
-  disableNameSuffixHash: true