From da1f833de732918a5226ccfd22d2cf275975961c Mon Sep 17 00:00:00 2001
From: Keith Jackson <keithallenjackson@gmail.com>
Date: Wed, 26 Aug 2026 16:26:27 -0500
Subject: [PATCH] =?UTF-8?q?fix(vms):=20drop=20postBuild=20substituteFrom?=
 =?UTF-8?q?=20on=20apps-vms=20=E2=80=94=20it=20corrupted=20VM=20cloud-init?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Flux's postBuild.substituteFrom runs envsubst over the WHOLE manifest, including
the VM cloud-init userData. It was substituting every shell `${...}` in the UOS
install script (${UOS_URL}, the API-resolver ${...}) to empty — which is why the
first UOS install silently did nothing — and ${PIPESTATUS[0]} then broke the
build entirely ("missing closing brace"), blocking apps-vms reconcile.

VM manifests use no cluster-vars, so substitution is unneeded. Removed it; the
cloud-init shell now reaches the guest intact. (A future VM needing a cluster-var
must escape its shell `${...}` as `$${...}`.)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 clusters/base/apps-vms.yaml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/clusters/base/apps-vms.yaml b/clusters/base/apps-vms.yaml
index 9a8fd6c..41ea2b5 100644
--- a/clusters/base/apps-vms.yaml
+++ b/clusters/base/apps-vms.yaml
@@ -23,7 +23,7 @@ spec:
     kind: GitRepository
     name: flux-system
   path: ./apps/vms
-  postBuild:
-    substituteFrom:
-      - kind: ConfigMap
-        name: cluster-vars
+  # NO postBuild.substituteFrom: Flux's envsubst would run over the ENTIRE manifest, including the
+  # VM cloud-init shell scripts, and mangle every `${...}` (e.g. ${UOS_URL}, ${PIPESTATUS[0]}) —
+  # corrupting the in-guest install. VM manifests reference no cluster-vars, so substitution is
+  # unneeded here. A future VM that needs a cluster-var must escape its shell `${...}` as `$${...}`.