- namespace: PodSecurity privileged, needed for /dev/kvm + privileged QEMU - storageclass: 1 replica, strict-local, WaitForFirstConsumer - deployment: nodeSelector workload=imessage + matching NoSchedule toleration, Recreate strategy (two QEMU procs on one qcow2 corrupts it), no readiness probe (guest install is interactive and takes many minutes) - services: ClusterIP only; VNC is an unauthenticated console, reach it with port-forward, never an Ingress - networkpolicy: default-deny, opt-in via sms-client=true on port 1234
11 lines
216 B
YAML
11 lines
216 B
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
namespace: sms
|
|
resources:
|
|
- namespace.yaml
|
|
- storageclass.yaml
|
|
- pvc-macos.yaml
|
|
- deployment-macos.yaml
|
|
- service.yaml
|
|
- networkpolicy.yaml
|