jakman85andClaude Opus 4.8
e99e3d1666
Adding the SSH key pushed the inline cloudInitNoCloud.userData over KubeVirt's
2048-byte limit ("userdata exceeds 2048 byte limit. Should use UserDataSecretRef").
Move the cloud-init into apps/vms/unifi/unifi-cloudinit.yaml and wrap it as the
`unifi-cloudinit` Secret via a Kustomize secretGenerator (disableNameSuffixHash
so the VM can reference it by fixed name); VM now uses userDataSecretRef. Content
is non-sensitive (public key + public installer script), so not SOPS-encrypted.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
26 lines
1.1 KiB
YAML
26 lines
1.1 KiB
YAML
---
|
|
# UniFi OS Server VM (KubeVirt). Part of the non-gating `apps-vms` Flux Kustomization.
|
|
# 90-httproute-optional.yaml is intentionally omitted (optional L7 UI; needs BackendTLSPolicy —
|
|
# UOS serves HTTPS on :11443; browser access is via the L4 LoadBalancer VIP for now).
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
resources:
|
|
- namespace.yaml
|
|
- 10-default-deny.yaml
|
|
- 20-datavolume.yaml
|
|
- 30-virtualmachine.yaml
|
|
- 40-networkpolicy.yaml
|
|
- 50-service-l4.yaml
|
|
# The VM's cloud-init (SSH key + UOS install script) exceeds KubeVirt's 2048-byte inline userData
|
|
# limit, so it is delivered via a Secret (30-virtualmachine.yaml userDataSecretRef: unifi-cloudinit).
|
|
# secretGenerator wraps the readable unifi-cloudinit.yaml file as key `userdata`. disableNameSuffixHash
|
|
# keeps the name stable (the VM references it by fixed name — Kustomize can't rewrite a KubeVirt
|
|
# userDataSecretRef). Content is non-sensitive (public key + public installer), so NOT SOPS-encrypted.
|
|
secretGenerator:
|
|
- name: unifi-cloudinit
|
|
namespace: unifi
|
|
files:
|
|
- userdata=unifi-cloudinit.yaml
|
|
generatorOptions:
|
|
disableNameSuffixHash: true
|