Phase 5: KubeVirt + CDI IaaS proof (R-PLAT-03/04, R-STATE-01, R-NET-01)

- platform/kubevirt: pinned KubeVirt v1.9.0 + CDI v1.66.0 operators (remote bases);
  KubeVirt/CDI CRs tuned for Longhorn; useEmulation=true (prefer real KVM, emulate fallback).
- Controllers/configs split (F-MON1): CRs + ServiceMonitors + alerts via platform-config.
- Observability: ServiceMonitors, KubeVirt platform-health alerts (R-OBS-04), VM dashboard.
- catalog/vm-demo.yaml (kind: vm) + rendered VirtualMachine/DataVolume fixture.
- Conformance: vm-lifecycle (R-PLAT-03/04), vm-data-survival (R-STATE-01, L3),
  vm-default-deny (R-NET-01) — self-skipping until KubeVirt+longhorn exist.
- ci/SPEC_PIN: adopt accepted spec b633b7f (ADR-0015 egress work already merged).
- conformance/run.sh: document R-ENV-02/R-GITOPS-01 coverage gaps (WS-GITOPS/INFRA-owned).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/kubevirt/kustomization.yaml

@@ -1,13 +1,28 @@
 ---
-# KubeVirt + CDI. Installed via their OPERATORS (plain release manifests), then the KubeVirt/CDI
-# custom resources tune the deployment. Phase 0 STUB.
+# KubeVirt + CDI — CONTROLLERS half only (the operators). Phase 5 (WS-VM).
+#
+# CONTROLLERS/CONFIGS SPLIT (F-MON1 / DECISIONS-LOG): the two operator release manifests below install
+# the KubeVirt + CDI CONTROLLERS, which REGISTER the `kubevirt.io` (KubeVirt) and `cdi.kubevirt.io`
+# (CDI) CRDs. The tuning custom resources that CONSUME those CRDs — kubevirt-cr.yaml / cdi-cr.yaml —
+# live in this directory for locality but are applied by the `platform-config` Flux Kustomization
+# (dependsOn: platform, wait) so the CRDs exist BEFORE the CRs apply. Applying both in one atomic pass
+# deadlocks ("no matches for kind KubeVirt"), exactly the failure F-MON1 documents.
+#
+# Namespaces: the operator manifests each create their own namespace (`kubevirt`, `cdi`) with the
+# pod-security profile they need (kubevirt is privileged) — so we do NOT redeclare them here (that
+# would be a duplicate-resource kustomize error). These are PLATFORM namespaces: they intentionally
+# carry NO `homelab.keithjackson.dev/app-namespace` label, so the Kyverno default-deny baseline is NOT
+# generated into them (that would sever the virt control plane). Application VMs live in app namespaces.
+#
+# PINNED (Renovate-maintained): bump the two version tags together to a compatible KubeVirt/CDI pair.
+#   KubeVirt v1.9.0  (kubevirt.io/v1)         — operator + CRDs
+#   CDI      v1.66.0 (cdi.kubevirt.io/v1beta1) — operator + CRDs
+# Kustomize loads these raw release manifests as remote file resources (verified: `kubectl kustomize`
+# builds them); Flux's kustomize-controller fetches them the same way at reconcile.
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - namespaces.yaml
-  # TODO(WS-VM, Phase 5): add the pinned operator release manifests, e.g.
-  #   - https://github.com/kubevirt/kubevirt/releases/download/vX.Y.Z/kubevirt-operator.yaml
-  #   - https://github.com/kubevirt/containerized-data-importer/releases/download/vX.Y.Z/cdi-operator.yaml
-  #   (Flux can pull remote bases; pin versions and let Renovate maintain them.)
-  - kubevirt-cr.yaml
-  - cdi-cr.yaml
+  # renovate: datasource=github-releases depName=kubevirt/kubevirt
+  - https://github.com/kubevirt/kubevirt/releases/download/v1.9.0/kubevirt-operator.yaml
+  # renovate: datasource=github-releases depName=kubevirt/containerized-data-importer
+  - https://github.com/kubevirt/containerized-data-importer/releases/download/v1.66.0/cdi-operator.yaml