Home-Network/home-network-k3s-impl
2
0 Fork 0
Code Issues 2 Pull Requests 5 Actions Packages Projects Releases Wiki Activity
346 Commits 139 Branches 0 Tags
df947b33d00707e894e896f7d6580a3661473607
Commit Graph
2 Commits
Author SHA1 Message Date
jakman85andClaude Opus 4.8 3a59ef1918 fix(kubevirt): boot VMs via CDI DataVolume + EFI + real KVM (Phase 5) 
VMs did not boot on the dev cluster. Three distinct live-verified causes,
all fixed GitOps-side:

1. containerDisk root failed at OCI init:
   exec "/container-disk-binary/usr/bin/container-disk": no such file.
   KubeVirt v1.9 supplies that binary to the volumerootdisk init container
   via a k8s-native `image` volume (VolumeSource.Image), gated by the ALPHA
   `ImageVolume` feature gate. k3s v1.31 has it DISABLED, so the apiserver
   silently prunes the image volume + its mount -> binary missing -> crash.
   (Proved: a server-side dry-run of a pod with an `image` volume drops it.)
   Fix: convert the VM roots in all three tests to CDI DataVolumes imported
   onto Longhorn PVCs (mounted disks bypass the container-disk/image-volume
   path). This is also the spec-required disk model (docs/06, R-STATE-01).
   vm-lifecycle now PASSES green live (VMI Running on start + restart).

2. Guest dropped to emergency mode: the containerdisks/fedora:41 image is
   UEFI-native (ESP + /boot mounted via systemd GPT auto-discovery); under
   KubeVirt's SeaBIOS default the ESP+/boot by-uuid mounts time out ->
   local-fs.target fails -> cloud-init runcmd/poweroff never runs.
   Fix: boot the VMs with EFI (OVMF, secureBoot:false) in all three tests
   and fixtures/vm.yaml. Confirmed live: emergency mode gone with EFI.

3. VMs ran under TCG software emulation (guests ~10x slow, saturating nodes
   until one went NotReady and VMs were evicted). Cause: useEmulation:true
   in the KubeVirt CR makes virt-controller NOT request devices.kubevirt.io/
   kvm, so /dev/kvm is never mounted and qemu falls back to TCG even though
   all nodes advertise kvm=1k / hypervisor=true. (Proved: `ls /dev/kvm` in a
   virt-launcher compute container = "No such file"; qemu accel = tcg.)
   Fix: useEmulation:false so the kvm device is requested and VMs run on real
   (nested) KVM. Requires Flux reconcile to take effect live (PM action).

The virt-handler clientcertificates tls.crt error is UNRELATED: node-labeller
(294 labels, hypervisor=true), device plugins, and VMI scheduling all work.

Also raised test exec timeouts to 30m (CDI import + boot) and, in
vm-default-deny, import the root BEFORE applying the default-deny NetworkPolicy
so the CDI importer's egress to quay.io is not severed by the policy.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
 2026-08-24 23:07:10 -05:00
jakman85andClaude Opus 4.8 dbffb8fab8 Phase 5: KubeVirt + CDI IaaS proof (R-PLAT-03/04, R-STATE-01, R-NET-01) 
- platform/kubevirt: pinned KubeVirt v1.9.0 + CDI v1.66.0 operators (remote bases);
  KubeVirt/CDI CRs tuned for Longhorn; useEmulation=true (prefer real KVM, emulate fallback).
- Controllers/configs split (F-MON1): CRs + ServiceMonitors + alerts via platform-config.
- Observability: ServiceMonitors, KubeVirt platform-health alerts (R-OBS-04), VM dashboard.
- catalog/vm-demo.yaml (kind: vm) + rendered VirtualMachine/DataVolume fixture.
- Conformance: vm-lifecycle (R-PLAT-03/04), vm-data-survival (R-STATE-01, L3),
  vm-default-deny (R-NET-01) — self-skipping until KubeVirt+longhorn exist.
- ci/SPEC_PIN: adopt accepted spec b633b7f (ADR-0015 egress work already merged).
- conformance/run.sh: document R-ENV-02/R-GITOPS-01 coverage gaps (WS-GITOPS/INFRA-owned).

Co-Authored-By: Claude Opus 4.8 <[email protected]>
 2026-08-24 19:51:30 -05:00