Phase 5: KubeVirt + CDI IaaS proof (R-PLAT-03/04, R-STATE-01, R-NET-01)
- platform/kubevirt: pinned KubeVirt v1.9.0 + CDI v1.66.0 operators (remote bases); KubeVirt/CDI CRs tuned for Longhorn; useEmulation=true (prefer real KVM, emulate fallback). - Controllers/configs split (F-MON1): CRs + ServiceMonitors + alerts via platform-config. - Observability: ServiceMonitors, KubeVirt platform-health alerts (R-OBS-04), VM dashboard. - catalog/vm-demo.yaml (kind: vm) + rendered VirtualMachine/DataVolume fixture. - Conformance: vm-lifecycle (R-PLAT-03/04), vm-data-survival (R-STATE-01, L3), vm-default-deny (R-NET-01) — self-skipping until KubeVirt+longhorn exist. - ci/SPEC_PIN: adopt accepted spec b633b7f (ADR-0015 egress work already merged). - conformance/run.sh: document R-ENV-02/R-GITOPS-01 coverage gaps (WS-GITOPS/INFRA-owned). Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
jakman85andClaude Opus 4.8 committed
1 parent
254d50a20c
commit
dbffb8fab8
16 files changed
+905
-61
No files matched your search
@@ -1,14 +1,26 @@
|
||||
# =============================================================================
|
||||
# L2 BEHAVIORAL SCAFFOLD — VM lifecycle (R-PLAT-03)
|
||||
# L2 BEHAVIORAL — VM lifecycle (R-PLAT-03, R-PLAT-04) [RUNNABLE / self-skips]
|
||||
# Catalog: docs/14 "VM lifecycle (R-PLAT-03, L2/L3)"
|
||||
# Spec: docs/06-vm-workloads-kubevirt.md, ADR-0005.
|
||||
#
|
||||
# GIVEN a `kind: vm` ServiceDefinition,
|
||||
# WHEN it is created/started/stopped/destroyed via kubectl/virtctl,
|
||||
# THEN it behaves through the same K8s surface; default-deny + egress class
|
||||
# apply to it. (Disk-survives-rebuild is the L3 partner test, see
|
||||
# tests/l3-fault-injection/data-survival — VMs share R-STATE-01.)
|
||||
# GIVEN a `kind: vm` workload (KubeVirt VirtualMachine),
|
||||
# WHEN it is created / started / stopped / restarted / destroyed via the SAME
|
||||
# Kubernetes API + kubectl surface as a container,
|
||||
# THEN each transition is honoured — the VMI reaches phase=Running on start,
|
||||
# disappears on stop, comes back on restart, and is gone after delete.
|
||||
# (R-PLAT-03 "VMs through the K8s API"; R-PLAT-04 "create/destroy/rebuild
|
||||
# on demand".) The Longhorn-disk-survives-rebuild partner proof is the L3
|
||||
# vm-data-survival test; the default-deny-applies-to-the-VM proof is the L2
|
||||
# vm-default-deny test — both share this VM model.
|
||||
#
|
||||
# STATUS: scaffold — needs T-5.1/T-5.2 (KubeVirt + `kind: vm` path).
|
||||
# RUNNABLE / SELF-SKIPPING: KubeVirt (Phase 5) may not be installed when the
|
||||
# broader suite runs. This test SKIPS CLEANLY (green) until the
|
||||
# virtualmachineinstances.kubevirt.io CRD exists, then runs the full lifecycle the
|
||||
# moment it does — mirroring the data-survival self-skip on `longhorn`. Everything
|
||||
# lives in the chainsaw per-test namespace and is torn down with it (hermetic). A
|
||||
# containerDisk root (kubelet-pulled, no CDI import) keeps the lifecycle proof fast
|
||||
# and free of image-import timing; the CDI-onto-Longhorn path is exercised by the
|
||||
# representative fixtures/vm.yaml via the deploy runbook and by vm-data-survival.
|
||||
# =============================================================================
|
||||
apiVersion: chainsaw.kyverno.io/v1alpha1
|
||||
kind: Test
|
||||
@@ -16,31 +28,123 @@ metadata:
|
||||
name: vm-lifecycle
|
||||
labels:
|
||||
conformance.home.k3s/R-PLAT-03: "true"
|
||||
conformance.home.k3s/R-PLAT-04: "true"
|
||||
annotations:
|
||||
conformance.home.k3s/requirements: "R-PLAT-03"
|
||||
conformance.home.k3s/requirements: "R-PLAT-03, R-PLAT-04"
|
||||
conformance.home.k3s/layer: "L2"
|
||||
conformance.home.k3s/safety-critical: "false"
|
||||
conformance.home.k3s/executable: "true"
|
||||
conformance.home.k3s/intent: >-
|
||||
A VM is created/started/stopped/destroyed via the K8s API; policy applies.
|
||||
A VM is created/started/stopped/restarted/destroyed via the K8s API; the VMI
|
||||
honours each transition (Running on start, gone on delete). Skips cleanly
|
||||
until the KubeVirt CRDs exist.
|
||||
spec:
|
||||
# VM start pulls a containerDisk + boots a guest — well beyond the default 180s exec window.
|
||||
timeouts:
|
||||
exec: 20m
|
||||
steps:
|
||||
- name: given-vm-servicedefinition
|
||||
try:
|
||||
- apply:
|
||||
file: fixtures/vm-servicedefinition.yaml # TODO(T-5.2): author
|
||||
- name: when-start-and-assert-running
|
||||
- name: vm-lifecycle-through-k8s-api
|
||||
try:
|
||||
- script:
|
||||
content: |
|
||||
set -euo pipefail
|
||||
# virtctl start via the same kubectl surface; assert VMI Running.
|
||||
kubectl -n "$NAMESPACE" patch vm demo --type merge -p '{"spec":{"running":true}}'
|
||||
echo "TODO(T-5.3): wait VMI phase=Running (bounded), then STARTED_OK"
|
||||
- name: then-default-deny-and-egress-apply-to-vm
|
||||
try:
|
||||
NS="$NAMESPACE"
|
||||
|
||||
# -- Gate: skip cleanly (green) until KubeVirt is installed. --
|
||||
if ! kubectl get crd virtualmachineinstances.kubevirt.io >/dev/null 2>&1; then
|
||||
echo "SKIP: KubeVirt CRDs absent — vm-lifecycle not applicable on this cluster yet"
|
||||
echo VM_LIFECYCLE_SKIPPED_OK
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# -- GIVEN: a stopped VirtualMachine, defined declaratively (containerDisk root). --
|
||||
kubectl -n "$NS" apply -f - <<'EOF'
|
||||
apiVersion: kubevirt.io/v1
|
||||
kind: VirtualMachine
|
||||
metadata:
|
||||
name: lc
|
||||
spec:
|
||||
running: false
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
kubevirt.io/vm: lc
|
||||
homelab.keithjackson.dev/egress-class: internet
|
||||
spec:
|
||||
domain:
|
||||
cpu: { cores: 1 }
|
||||
memory: { guest: 1024Mi }
|
||||
devices:
|
||||
disks:
|
||||
- name: rootdisk
|
||||
disk: { bus: virtio }
|
||||
interfaces:
|
||||
- name: default
|
||||
masquerade: {}
|
||||
resources:
|
||||
requests:
|
||||
memory: 1024Mi
|
||||
networks:
|
||||
- name: default
|
||||
pod: {}
|
||||
volumes:
|
||||
- name: rootdisk
|
||||
containerDisk:
|
||||
image: quay.io/containerdisks/fedora:41
|
||||
EOF
|
||||
# No VMI should exist while running=false.
|
||||
if kubectl -n "$NS" get vmi lc >/dev/null 2>&1; then
|
||||
echo "FAIL: VMI exists though the VM is defined stopped" >&2; exit 1
|
||||
fi
|
||||
echo "created VM 'lc' (stopped)"
|
||||
|
||||
wait_phase() { # $1=expected phase, bounded poll
|
||||
local want="$1" i phase
|
||||
for i in $(seq 1 80); do
|
||||
phase="$(kubectl -n "$NS" get vmi lc -o jsonpath='{.status.phase}' 2>/dev/null || true)"
|
||||
[ "$phase" = "$want" ] && return 0
|
||||
sleep 10
|
||||
done
|
||||
echo "FAIL: VMI did not reach phase=$want (last='$phase')" >&2; return 1
|
||||
}
|
||||
wait_gone() {
|
||||
local i
|
||||
for i in $(seq 1 30); do
|
||||
kubectl -n "$NS" get vmi lc >/dev/null 2>&1 || return 0
|
||||
sleep 5
|
||||
done
|
||||
echo "FAIL: VMI still present when it should be gone" >&2; return 1
|
||||
}
|
||||
|
||||
# -- WHEN start (running=true) THEN VMI reaches Running. --
|
||||
kubectl -n "$NS" patch vm lc --type merge -p '{"spec":{"running":true}}'
|
||||
wait_phase Running
|
||||
echo "STARTED: VMI phase=Running"
|
||||
|
||||
# -- WHEN stop (running=false) THEN the VMI is torn down. --
|
||||
kubectl -n "$NS" patch vm lc --type merge -p '{"spec":{"running":false}}'
|
||||
wait_gone
|
||||
echo "STOPPED: VMI removed"
|
||||
|
||||
# -- WHEN restart (running=true again) THEN it comes back Running (rebuild-on-demand). --
|
||||
kubectl -n "$NS" patch vm lc --type merge -p '{"spec":{"running":true}}'
|
||||
wait_phase Running
|
||||
echo "RESTARTED: VMI phase=Running"
|
||||
|
||||
# -- WHEN destroy (delete the VM) THEN both VM and VMI are gone. --
|
||||
kubectl -n "$NS" delete vm lc --wait=true --timeout=300s
|
||||
wait_gone
|
||||
if kubectl -n "$NS" get vm lc >/dev/null 2>&1; then
|
||||
echo "FAIL: VM object still present after delete" >&2; exit 1
|
||||
fi
|
||||
echo "DESTROYED: VM + VMI gone"
|
||||
|
||||
echo VM_LIFECYCLE_OK
|
||||
check:
|
||||
# green on a clean skip (no KubeVirt) OR a proven full lifecycle.
|
||||
(contains($stdout, 'VM_LIFECYCLE_OK') || contains($stdout, 'VM_LIFECYCLE_SKIPPED_OK')): true
|
||||
finally:
|
||||
- script:
|
||||
content: 'echo "TODO: run default-deny + egress-class probes from inside the VM"'
|
||||
- name: when-stop-and-destroy
|
||||
try:
|
||||
- script:
|
||||
content: 'echo "TODO(T-5.3): stop then delete VM via kubectl; assert gone"'
|
||||
content: |
|
||||
kubectl -n "$NAMESPACE" delete vm lc --ignore-not-found --wait=false || true
|
||||
echo "cleanup best-effort; chainsaw namespace teardown finalizes"
|
||||
Reference in new issue
Block a user