EDM-4726: Explain updated behaviour for VM apps

[celdrake]

See before vs now

Before:

Now:

Summary

• Updated the shared VM application form in libs/ui-components/.
• Added an isExisting flag to distinguish new VM forms from existing VM applications.
• Added a restart warning for existing VMs.
• Clarified that VM updates restart existing VMs and reapply cloud-init data and credentials.
• Updated helper text to explain how credentials are written to cloud-init data.

This shared UI change affects VM configuration flows used by both standalone and OCP plugin applications. No changes affect libs/types/, libs/i18n/, libs/cypress/, the Go auth proxy, container builds, or CI configuration.

Security and correctness

• The form now clearly communicates that credentials apply through cloud-init on VM boot.
• The form warns users that credential changes do not update already-running VMs until restart.
• The isExisting state ensures the restart warning appears only for existing VM applications.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: 5617eadc-187c-4f03-8245-2a90a6777696

📥 Commits

Reviewing files that changed from the base of the PR and between 0e19b12 and b0a947f.

⛔ Files ignored due to path filters (1)

• libs/i18n/locales/en/translation.json is excluded by !libs/i18n/locales/en/translation.json

📒 Files selected for processing (3)

• libs/ui-components/src/components/Device/EditDeviceWizard/deviceSpecUtils.ts
• libs/ui-components/src/components/Device/EditDeviceWizard/steps/ApplicationVmForm.tsx
• libs/ui-components/src/types/deviceSpec.ts

---

Walkthrough

The VM application form now records whether it represents an existing VM. The UI uses this state to show restart and cloud-init guidance for existing VMs and clarifies credential handling.

Changes

Existing VM configuration

Layer / File(s)	Summary
VM form existing-state contract libs/ui-components/src/types/deviceSpec.ts, libs/ui-components/src/components/Device/EditDeviceWizard/deviceSpecUtils.ts	VmAppForm includes isExisting. New forms set it to false; forms loaded from existing VM applications set it to true.
Existing VM configuration guidance libs/ui-components/src/components/Device/EditDeviceWizard/steps/ApplicationVmForm.tsx	Existing VMs display restart and cloud-init warnings. Cloud-init guidance explains that credential entries are managed in the credentials section and written into cloud-init data.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• flightctl/flightctl-ui#727: Both changes update VM application form handling and UI behavior.
• flightctl/flightctl-ui#733: Both changes update cloud-init and credential helper text.
• flightctl/flightctl-ui#757: This change extends the VM form model and conversion logic introduced there.

Suggested labels: ui-components, i18n

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Unchecked-Errors	⚠️ Warning	Go sources discard errors without justification: auth.go:619/639, handler.go:149/150, app_terminal.go:103, and terminal.go:268; several w.Write and Close calls also ignore errors.	Handle, return, or log each error. If an error is intentionally ignored, add a nearby comment that explains why it is safe to ignore.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: explaining updated behavior for VM applications.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets	✅ Passed	The PR diff adds only UI text and isExisting fields; scans found no hardcoded secret assignments, credential-bearing URLs, long base64 strings, or private-key material.
No-Weak-Crypto	✅ Passed	The pull request adds only VM form state and explanatory text; scans found no MD5, SHA1, DES, RC4, Blowfish, ECB, crypto API, custom crypto, or new secret comparison.
No-Injection-Vectors	✅ Passed	The PR adds only VM form state and translated warning text. No new eval/exec, HTML injection, shell execution, or unsafe YAML load was added; existing js-yaml load uses the safe default schema.
Container-Privileges	✅ Passed	The commit changes VM form state and UI text only; added lines contain no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, or allowPrivilegeEscalation settings.
No-Sensitive-Data-In-Logs	✅ Passed	The PR adds UI text and VM form state only; searches found no console/logger calls or sensitive-value interpolation in changed files.
Resource-Leaks	✅ Passed	The patch changes only UI TypeScript and i18n files; it changes zero Go files under proxy, so it introduces no resource leak covered by this check.
Ai-Attribution	✅ Passed	The target commit uses the permitted Made-with: Cursor trailer and has no AI Co-Authored-By trailer.
Generated-Files-Not-Hand-Edited	✅ Passed	The OpenAPI model directories are unchanged. The locale diff contains only keys matching the updated source literals, with obsolete keys removed.
I18n-Compliance	✅ Passed	All PR-added UI text uses t() with hardcoded literal keys; the 50 translation calls have no missing English keys or variable key arguments.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}