Phase 5: KubeVirt + CDI IaaS proof (R-PLAT-03/04, R-STATE-01, R-NET-01)
- platform/kubevirt: pinned KubeVirt v1.9.0 + CDI v1.66.0 operators (remote bases); KubeVirt/CDI CRs tuned for Longhorn; useEmulation=true (prefer real KVM, emulate fallback). - Controllers/configs split (F-MON1): CRs + ServiceMonitors + alerts via platform-config. - Observability: ServiceMonitors, KubeVirt platform-health alerts (R-OBS-04), VM dashboard. - catalog/vm-demo.yaml (kind: vm) + rendered VirtualMachine/DataVolume fixture. - Conformance: vm-lifecycle (R-PLAT-03/04), vm-data-survival (R-STATE-01, L3), vm-default-deny (R-NET-01) — self-skipping until KubeVirt+longhorn exist. - ci/SPEC_PIN: adopt accepted spec b633b7f (ADR-0015 egress work already merged). - conformance/run.sh: document R-ENV-02/R-GITOPS-01 coverage gaps (WS-GITOPS/INFRA-owned). Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
jakman85andClaude Opus 4.8 committed
1 parent
254d50a20c
commit
dbffb8fab8
16 files changed
+905
-61
No files matched your search
@@ -0,0 +1,172 @@
|
||||
# =============================================================================
|
||||
# L3 FAULT-INJECTION — VM disk survives rebuild (R-STATE-01) [RUNNABLE / self-skips]
|
||||
# *SAFETY-CRITICAL*
|
||||
# Catalog: docs/14 "Data survival (R-STATE-01, L3)" — the IaaS partner of the
|
||||
# container `data-survival` test. Spec: docs/04, docs/06, ADR-0005.
|
||||
#
|
||||
# GIVEN a VM that writes data to a Longhorn-backed disk,
|
||||
# WHEN the VM is DESTROYED entirely (kept: the Longhorn PVC/DataVolume),
|
||||
# THEN the data is intact and readable by a fresh workload bound to that PVC —
|
||||
# exactly the container proof (data-survival), now for a KubeVirt VM
|
||||
# (R-STATE-01 covers PaaS + IaaS).
|
||||
#
|
||||
# METHOD (virtctl-free, filesystem-agnostic, deterministic): a containerDisk-root
|
||||
# VM (ephemeral) with a Longhorn BLOCK data disk. cloud-init writes a unique canary
|
||||
# to the raw block device and powers the guest off; runStrategy RerunOnFailure means
|
||||
# a clean shutdown STAYS down (VMI -> Succeeded), so the write is known-complete and
|
||||
# the disk is released. We then DELETE the VM (keeping the PVC) and bind a throwaway
|
||||
# busybox reader pod to the SAME Longhorn PVC as a raw block device — if the bytes
|
||||
# match, the data survived the VM's destruction. No SSH/console scraping, no guest
|
||||
# filesystem parsing.
|
||||
#
|
||||
# RUNNABLE / SELF-SKIPPING: skips cleanly (green) until BOTH KubeVirt and a
|
||||
# `longhorn` StorageClass exist; runs the full destroy/rebuild survival check once
|
||||
# they do. Hermetic: everything lives in the chainsaw per-test namespace.
|
||||
# =============================================================================
|
||||
apiVersion: chainsaw.kyverno.io/v1alpha1
|
||||
kind: Test
|
||||
metadata:
|
||||
name: vm-data-survival
|
||||
labels:
|
||||
conformance.home.k3s/R-STATE-01: "true"
|
||||
annotations:
|
||||
conformance.home.k3s/requirements: "R-STATE-01"
|
||||
conformance.home.k3s/layer: "L3"
|
||||
conformance.home.k3s/safety-critical: "true"
|
||||
conformance.home.k3s/executable: "true"
|
||||
conformance.home.k3s/intent: >-
|
||||
Destroy a VM entirely, keep its Longhorn PVC, and a fresh workload re-bound to
|
||||
that PVC still reads the VM-written data. Skips cleanly until KubeVirt + longhorn exist.
|
||||
spec:
|
||||
# Boot a guest + run cloud-init + power off, then reattach a Longhorn RWO volume — far beyond 180s.
|
||||
timeouts:
|
||||
exec: 20m
|
||||
steps:
|
||||
- name: vm-data-survives-destroy-and-rebuild
|
||||
try:
|
||||
- script:
|
||||
content: |
|
||||
set -euo pipefail
|
||||
NS="$NAMESPACE"
|
||||
|
||||
# -- Gate: skip cleanly (green) until BOTH KubeVirt and longhorn are present. --
|
||||
if ! kubectl get crd virtualmachineinstances.kubevirt.io >/dev/null 2>&1; then
|
||||
echo "SKIP: KubeVirt CRDs absent — vm-data-survival not applicable yet"
|
||||
echo VM_DATA_SURVIVAL_SKIPPED_OK; exit 0
|
||||
fi
|
||||
if ! kubectl get storageclass longhorn >/dev/null 2>&1; then
|
||||
echo "SKIP: 'longhorn' StorageClass absent — vm-data-survival not applicable yet"
|
||||
echo VM_DATA_SURVIVAL_SKIPPED_OK; exit 0
|
||||
fi
|
||||
|
||||
CANARY="vm-canary-$(date +%s%N)" # fixed-length, unique per run
|
||||
LEN=${#CANARY}
|
||||
|
||||
# -- GIVEN: a Longhorn BLOCK PVC for the VM's data disk. --
|
||||
kubectl -n "$NS" apply -f - <<EOF
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: vm-survivor
|
||||
spec:
|
||||
accessModes: [ReadWriteOnce]
|
||||
volumeMode: Block
|
||||
storageClassName: longhorn
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
EOF
|
||||
|
||||
# -- The VM: containerDisk root (ephemeral) + the Longhorn block disk (/dev/vdb) + a
|
||||
# cloud-init disk. cloud-init writes the canary to the raw device and powers off.
|
||||
# RerunOnFailure => a clean poweroff STAYS Succeeded (not restarted), so the write is
|
||||
# known-complete and the disk released. Only $CANARY expands (no other '$' in the body).
|
||||
kubectl -n "$NS" apply -f - <<EOF
|
||||
apiVersion: kubevirt.io/v1
|
||||
kind: VirtualMachine
|
||||
metadata:
|
||||
name: survivor
|
||||
spec:
|
||||
runStrategy: RerunOnFailure
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
kubevirt.io/vm: survivor
|
||||
homelab.keithjackson.dev/egress-class: internet
|
||||
spec:
|
||||
domain:
|
||||
cpu: { cores: 1 }
|
||||
memory: { guest: 1024Mi }
|
||||
devices:
|
||||
disks:
|
||||
- name: rootdisk
|
||||
disk: { bus: virtio }
|
||||
- name: datadisk
|
||||
disk: { bus: virtio }
|
||||
- name: cloudinit
|
||||
disk: { bus: virtio }
|
||||
resources:
|
||||
requests:
|
||||
memory: 1024Mi
|
||||
volumes:
|
||||
- name: rootdisk
|
||||
containerDisk:
|
||||
image: quay.io/containerdisks/fedora:41
|
||||
- name: datadisk
|
||||
persistentVolumeClaim:
|
||||
claimName: vm-survivor
|
||||
- name: cloudinit
|
||||
cloudInitNoCloud:
|
||||
userData: |-
|
||||
#cloud-config
|
||||
runcmd:
|
||||
- [ sh, -c, "printf '%s' '$CANARY' | dd of=/dev/vdb bs=1 seek=0 conv=notrunc; sync; sleep 3; poweroff" ]
|
||||
EOF
|
||||
|
||||
# -- WHEN: wait until the guest has written the canary and powered off (VMI Succeeded/gone). --
|
||||
ok=""
|
||||
for i in $(seq 1 90); do
|
||||
phase="$(kubectl -n "$NS" get vmi survivor -o jsonpath='{.status.phase}' 2>/dev/null || true)"
|
||||
if [ "$phase" = "Succeeded" ] || { [ -z "$phase" ] && [ "$i" -gt 3 ]; }; then ok=1; break; fi
|
||||
sleep 10
|
||||
done
|
||||
[ -n "$ok" ] || { echo "FAIL: guest never completed the write+poweroff (last phase='$phase')" >&2; exit 1; }
|
||||
echo "guest wrote canary and powered off"
|
||||
|
||||
# -- FAULT INJECTION: destroy the VM ENTIRELY; KEEP the Longhorn PVC. --
|
||||
kubectl -n "$NS" delete vm survivor --wait=true --timeout=180s
|
||||
kubectl -n "$NS" get pvc vm-survivor # must still exist
|
||||
|
||||
# -- THEN: a fresh workload re-bound to the SAME Longhorn PVC still sees the bytes. --
|
||||
kubectl -n "$NS" apply -f - <<EOF
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: reader
|
||||
spec:
|
||||
restartPolicy: Never
|
||||
containers:
|
||||
- name: app
|
||||
image: busybox:1.36.1
|
||||
command: ["sh","-c","sleep 3600"]
|
||||
volumeDevices:
|
||||
- name: data
|
||||
devicePath: /dev/datadisk
|
||||
volumes:
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: vm-survivor
|
||||
EOF
|
||||
kubectl -n "$NS" wait --for=condition=Ready pod/reader --timeout=240s
|
||||
GOT="$(kubectl -n "$NS" exec reader -- sh -c "dd if=/dev/datadisk bs=1 count=$LEN 2>/dev/null")"
|
||||
echo "recovered='$GOT' expected='$CANARY'"
|
||||
[ "$GOT" = "$CANARY" ] && echo VM_DATA_SURVIVED_OK
|
||||
check:
|
||||
(contains($stdout, 'VM_DATA_SURVIVED_OK') || contains($stdout, 'VM_DATA_SURVIVAL_SKIPPED_OK')): true
|
||||
finally:
|
||||
- script:
|
||||
content: |
|
||||
kubectl -n "$NAMESPACE" delete vm survivor --ignore-not-found --wait=false || true
|
||||
kubectl -n "$NAMESPACE" delete pod reader --ignore-not-found --wait=false || true
|
||||
kubectl -n "$NAMESPACE" delete pvc vm-survivor --ignore-not-found --wait=false || true
|
||||
echo "cleanup best-effort; chainsaw namespace teardown finalizes"
|
||||
Reference in new issue
Block a user