Story Crater Bot
71fb7e9826
- namespace: PodSecurity privileged, needed for /dev/kvm + privileged QEMU - storageclass: 1 replica, strict-local, WaitForFirstConsumer - deployment: nodeSelector workload=imessage + matching NoSchedule toleration, Recreate strategy (two QEMU procs on one qcow2 corrupts it), no readiness probe (guest install is interactive and takes many minutes) - services: ClusterIP only; VNC is an unauthenticated console, reach it with port-forward, never an Ingress - networkpolicy: default-deny, opt-in via sms-client=true on port 1234
20 lines
810 B
YAML
20 lines
810 B
YAML
# iMessage delivery for the cluster.
|
|
#
|
|
# BlueBubbles' server is a macOS Electron app paired with an Objective-C helper
|
|
# that hooks Messages.app private APIs — it cannot be containerised on Linux,
|
|
# because containers share the host kernel and macOS needs XNU + Cocoa. The only
|
|
# way to run it on Talos is a full macOS VM under QEMU/KVM (Docker-OSX), which
|
|
# needs a privileged pod with /dev/kvm.
|
|
#
|
|
# Hence privileged PodSecurity: the cluster default from the Talos controlplane
|
|
# is `enforce: baseline`, which forbids privileged containers and host devices.
|
|
# Scope is limited to this namespace.
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: sms
|
|
labels:
|
|
pod-security.kubernetes.io/enforce: privileged
|
|
pod-security.kubernetes.io/audit: privileged
|
|
pod-security.kubernetes.io/warn: privileged
|