Repository navigation
virtual devices: S1 spike VM delivered by GitOps (flag off) - #8
Merged
Merged
Conversation
…t render GitOps delivery of the S1 spike VM (default off, teknoir-cloud only): - charts/virtual-device-spike: <teamspace>-vdev namespace (identical to the kit manifest), a separate PSA-restricted namespace for a one-shot render Job with least-privilege RBAC (get one Device, get/create Secrets in the vdev namespace), and the VirtualMachine (sync wave 2). - app-of-apps: Application virtual-device-spike behind virtualDevices.spike.enabled (false) with the resources-finalizer, so turning the flag off removes the VM and both namespaces. - renderer: -in-cluster mode (standard library, SA token, create-if-absent keeps the k3s token stable), -userdata mode, cloud-init moved from a render.sh heredoc into renderer/userdata.tmpl (one source), Dockerfile and the vdev-spike-render workflow (builds ghcr.io/teknoir/vdev-spike-render). - tests: fake API server for -in-cluster, chart assertions and kubeconform; check.sh N8-N10 for the render ServiceAccount. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Oct 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Delivers the S1 spike VM through GitOps instead of a hand-run
render.sh+kubectl create, so the device keys never go into git or onto a workstation. Nothing deploys from this PR:virtualDevices.spike.enabledisfalse, and the chart refuses to render untilrenderer.digestis pinned.charts/virtual-device-spike(new):<teamspace>-vdevnamespace (identical tohack/virtual-device-spike/manifests/teknoir-demo-vdev.yaml, enforced bytest/run.sh), a separate PSA-restricted namespaceteknoir-vdev-spikefor a one-shot render Job (so the -vdev egress policy needs no API-server hole), least-privilege RBAC, and the VirtualMachine (wave 2).getthe one Device;get(that one name) andcreateSecrets inteknoir-demo-vdev. No list/watch/update/patch/delete, no ClusterRole.charts/app-of-apps/templates/virtual-device-spike.yaml: Application behindvirtualDevices.spike.enabled+ the teknoir-cloud allowlist, withresources-finalizer, so flag off removes the VM (VMI, DataVolume/PVC), both namespaces and the Role/RoleBinding. The KubeVirt/CDI runtime stays.hack/virtual-device-spike/renderer:-in-clustermode (standard library only, SA token + CA; create-if-absent keeps the k3s token stable across syncs; refuses k3s >= 1.34.12 without keyCertSign). The cloud-init moved from arender.shheredoc intorenderer/userdata.tmpl, whichrender.shnow also uses (one source). NewDockerfile(cli checked out at the pinnedVDS_CLI_REF) and.github/workflows/vdev-spike-render.yaml(buildsghcr.io/teknoir/vdev-spike-render; PRs build without pushing).check.shN8-N10: the render ServiceAccount can get its Device and nothing else.Verification (offline)
hack/virtual-device-spike/test/run.sh: 164 ok, 0 fail (shellcheck, gofmt, existing render assertions unchanged, new: renderer-in-clusteragainst a fake HTTPS API server for fresh / secret-exists / Device-missing / k3s guard / bad key / bad name; charthelm template+kubeconform -strict; chart namespace and VM equal to therender.shoutput; Job, RBAC and render-namespace assertions).docker buildof the renderer image succeeds;actionlintandgitleaksclean.helm template charts/app-of-apps: default render byte-identical to before; with the flag on it rendersvirtual-device-spikeonce forteknoir-cloudand 0 times forteknoir-online/teknoir-local.Order after merge (see hack/virtual-device-spike/README.md, "S1 delivered by GitOps")
teknoir-cloudand prints the digest. Make the ghcr packagevdev-spike-renderpublic (r415 only hasghcr-tokeninteknoir-system).renderer.digest.vd-spike-1in Backstage (teknoir-demo, Generic PC, user mode create, nodevice-group: test, not Virtual).spike.enabled: true.spike.enabled: false, then delete the Device in Backstage.Staging only; no change to
teknoir-online.🤖 Generated with Claude Code