diff --git a/packages/apps/virtual-machine/templates/secret.yaml b/packages/apps/virtual-machine/templates/secret.yaml
index 6142d102..73cd92bf 100644
--- a/packages/apps/virtual-machine/templates/secret.yaml
+++ b/packages/apps/virtual-machine/templates/secret.yaml
@@ -20,6 +20,10 @@ stringData:
     {{- if .Values.cloudInit }}
     {{-   .Values.cloudInit | nindent 4 }}
     {{- else if and (.Values.sshKeys) (not .Values.cloudInit) }}
+    {{- /*
+      We usually provide ssh keys in cloud-init metadata, because userdata it not typed and can be used for any purpose.
+      However, if user provides ssh keys but not cloud-init, we still need to provide a minimal cloud-init config to avoid errors.
+    */}}
     #cloud-config
     ssh_authorized_keys:
       {{- range .Values.sshKeys }}
diff --git a/packages/apps/vm-instance/templates/secret.yaml b/packages/apps/vm-instance/templates/secret.yaml
index 6142d102..73cd92bf 100644
--- a/packages/apps/vm-instance/templates/secret.yaml
+++ b/packages/apps/vm-instance/templates/secret.yaml
@@ -20,6 +20,10 @@ stringData:
     {{- if .Values.cloudInit }}
     {{-   .Values.cloudInit | nindent 4 }}
     {{- else if and (.Values.sshKeys) (not .Values.cloudInit) }}
+    {{- /*
+      We usually provide ssh keys in cloud-init metadata, because userdata it not typed and can be used for any purpose.
+      However, if user provides ssh keys but not cloud-init, we still need to provide a minimal cloud-init config to avoid errors.
+    */}}
     #cloud-config
     ssh_authorized_keys:
       {{- range .Values.sshKeys }}