---
# UniFi OS Server VM (KubeVirt). Part of the non-gating `apps-vms` Flux Kustomization.
# 90-httproute-optional.yaml is intentionally omitted (optional L7 UI; needs BackendTLSPolicy —
# UOS serves HTTPS on :11443; browser access is via the L4 LoadBalancer VIP for now).
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - namespace.yaml
  - 10-default-deny.yaml
  - 20-datavolume.yaml
  - 30-virtualmachine.yaml
  - 40-networkpolicy.yaml
  - 50-service-l4.yaml
# The VM's cloud-init (SSH key + UOS install script) exceeds KubeVirt's 2048-byte inline userData
# limit, so it is delivered via a Secret (30-virtualmachine.yaml userDataSecretRef: unifi-cloudinit).
# secretGenerator wraps the readable unifi-cloudinit.yaml file as key `userdata`. disableNameSuffixHash
# keeps the name stable (the VM references it by fixed name — Kustomize can't rewrite a KubeVirt
# userDataSecretRef). Content is non-sensitive (public key + public installer), so NOT SOPS-encrypted.
secretGenerator:
  - name: unifi-cloudinit
    namespace: unifi
    files:
      - userdata=unifi-cloudinit.yaml
generatorOptions:
  disableNameSuffixHash: true