jakman85andClaude Opus 4.8
317b3f02f1
First KubeVirt VM app + first real CDI http import. UniFi OS Server (UOS) is Ubiquiti's current self-host product (the .deb is deprecated); it bundles UniFi OS + Network app + its own datastore, so no MongoDB companion. - apps/vms/unifi: CDI DataVolume (Ubuntu 24.04 cloud image -> longhorn-vm RWX/Block, live-migratable) + VirtualMachine (evictionStrategy: LiveMigrate) with cloud-init that installs podman/slirp4netns/jq and runs the UOS installer NON-INTERACTIVELY. The installer URL is resolved at boot from Ubiquiti's public firmware API (fw-update.ui.com/api/firmware-latest) — always-latest, no pinned URL to maintain (currently UOS v5.1.37). - L4 exposure: two LoadBalancer Services (TCP+UDP) sharing a pinned, L2-announced Cilium VIP 192.168.1.54 (device inform/adoption + STUN can't ride the L7 Gateway); external-dns publishes unifi.home.keithjackson.dev. UI on :11443. - default-deny + additive CNPs (controller ingress, egress, and CDI-importer egress for the image pull). - clusters/base/apps-vms.yaml: NON-GATING Flux Kustomization (wait:false, dependsOn platform-config) — VMs are a separate lifecycle from the app waves, so a slow VM import/install can't stall the app tier. Co-Authored-By: Claude Opus 4.8 <[email protected]>
20 lines
878 B
YAML
20 lines
878 B
YAML
---
|
|
# UniFi (KubeVirt VM) namespace. Reconciled by the NON-GATING `apps-vms` Flux Kustomization
|
|
# (clusters/base/apps-vms.yaml, wait:false) — VMs are a separate lifecycle from the rendered
|
|
# container-app waves, and UniFi has no in-cluster dependents, so a slow VM import/install can't
|
|
# stall the app tier.
|
|
#
|
|
# Namespace (trust zone). Carries the app-namespace label (Kyverno require-auth-mode-label
|
|
# + default-deny apply here) and gateway-access=shared so an OPTIONAL HTTPRoute could
|
|
# attach to the shared Gateway (see 90-httproute-optional.yaml). backup-policy matches the
|
|
# vm-demo/pihole convention so the VM's Longhorn disk is captured off-cluster.
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: unifi
|
|
labels:
|
|
homelab.keithjackson.dev/app-namespace: 'true'
|
|
gateway-access: shared
|
|
annotations:
|
|
homelab.keithjackson.dev/backup-policy: daily-offcluster
|