jakman85andClaude Opus 5
4cf9572c58
The hand-authored UniFi VM manifests used column-aligned inline flow mappings
(`{ name: inform, port: 8080, protocol: TCP }`), which yamllint's `commas`
rule rejects as "too many spaces after comma". That made `make -C ci lint` FAIL,
so the merge gate has been BLOCKED on `main` since the UniFi commits landed —
every other static stage was green.
Collapse each run of spaces after a comma to one, and re-align the trailing
comments so the port tables stay readable. Whitespace only:
`kubectl kustomize apps/vms` renders byte-for-byte identically before and after.
The lint config is left untouched — relaxing the rule to make failing files pass
is moving the goalposts, not fixing the code.
Also refresh these files' stale `STAGING / DRAFT` headers: the tree is live,
reconciled by the non-gating `apps-vms` Flux Kustomization.
Gate after this change: spec-immutability / lint / l0 / l1 all green,
MERGE GATE: PASS.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
50 lines
2.6 KiB
YAML
50 lines
2.6 KiB
YAML
---
|
|
# LIVE — reconciled by the non-gating `apps-vms` Flux Kustomization (see namespace.yaml header).
|
|
#
|
|
# CDI DataVolume — the UniFi VM boot disk. This is the FIRST real CDI *http* import on
|
|
# this cluster (the vm-demo/conformance path imports a containerdisk from a *registry*;
|
|
# this pulls the official Ubuntu 24.04 LTS server cloud image (qcow2) over https and CDI
|
|
# converts it onto the PVC).
|
|
#
|
|
# STANDALONE DataVolume (NOT a dataVolumeTemplate) so the disk OUTLIVES `kubectl delete vm`
|
|
# and survives destroy/rebuild (R-STATE-01) — same durability contract as vm-demo.
|
|
#
|
|
# STORAGE = longhorn-vm (the RWX/Block/migratable StorageClass; live in platform/longhorn):
|
|
# - accessModes: ReadWriteMany + volumeMode: Block => REQUIRED for KubeVirt LIVE MIGRATION
|
|
# (evictionStrategy: LiveMigrate in the VM). A ReadWriteOnce disk cannot live-migrate.
|
|
# - 40Gi: the Ubuntu cloud image virtual size is ~3.5Gi; cloud-init growpart/growroot
|
|
# expands the root fs to fill the disk on first boot. 40Gi (UOS min is 25Gi) leaves room for the
|
|
# UniFi datastore + OS + podman images + updates.
|
|
#
|
|
# GOTCHA / FLAG: a Block RWX DataVolume import needs CDI scratch space and the importer pod
|
|
# needs egress to cloud-images.ubuntu.com (see the CDI-import allow in 40-networkpolicy.yaml —
|
|
# the importer runs in THIS default-deny namespace, unlike the conformance test whose ephemeral
|
|
# ns has no baseline). No checksum is verified on an http source; pin a dated build for full
|
|
# reproducibility if drift matters (see README "Open questions").
|
|
#
|
|
# NODE PREREQ (Block-mode CDI): the non-root importer opens the raw block device, which k8s
|
|
# never chowns for it. The k3s nodes set `nonroot-devices: true`
|
|
# (infra/ansible/roles/k3s_server) so containerd hands the device to the pod's UID/GID —
|
|
# without it the import dies with `blockdev: cannot open /dev/cdi-block-volume: Permission denied`.
|
|
apiVersion: cdi.kubevirt.io/v1beta1
|
|
kind: DataVolume
|
|
metadata:
|
|
name: unifi-rootdisk
|
|
namespace: unifi
|
|
labels:
|
|
app.kubernetes.io/name: unifi
|
|
spec:
|
|
source:
|
|
http:
|
|
# Ubuntu 24.04 LTS (noble) server cloud image, amd64, qcow2. "releases/.../release/"
|
|
# tracks the latest 24.04 point release. Pin to a dated build dir for reproducibility.
|
|
url: "https://cloud-images.ubuntu.com/releases/noble/release/ubuntu-24.04-server-cloudimg-amd64.img"
|
|
storage:
|
|
accessModes:
|
|
- ReadWriteMany # RWX => migratable (paired with evictionStrategy: LiveMigrate)
|
|
volumeMode: Block # block mode is the migratable/perf default for VM disks
|
|
storageClassName: longhorn-vm
|
|
resources:
|
|
requests:
|
|
storage: 40Gi
|