---
# KubeVirt CR — tunes the KubeVirt install (ADR-0005). CONSUMES the kubevirt.io CRD registered by the
# operator (platform/kubevirt/kustomization.yaml), so this is applied by the `platform-config` Flux
# Kustomization (dependsOn: platform) — see platform-config/kustomization.yaml + F-MON1.
#
# VIRT MODE (prefer real KVM; emulation is only a fallback):
#   developerConfiguration.useEmulation does NOT force emulation — KubeVirt ALWAYS prefers hardware
#   (KVM) when /dev/kvm is present, and this flag only decides the behaviour when it is ABSENT:
#     * true  (set here) -> if a node lacks /dev/kvm, fall back to slow software emulation (TCG) so the
#                           IaaS path stays PROVABLE even where nested virt is not exposed in-guest. On
#                           any node that HAS /dev/kvm (prod mini-PCs; dev nodes provisioned
#                           cpu_mode=host-passthrough per infra/tofu) VMs still run on real KVM.
#     * false            -> a node without /dev/kvm cannot schedule VMs at all (fail loud).
#   `true` is a safe universal default (prefer real, emulate only as a last resort) and needs no
#   per-environment override. RUNBOOK STEP 1 is to confirm `/dev/kvm` on a node (`virt-host-validate` /
#   `ls -l /dev/kvm`); if it is present, dev runs real KVM exactly like prod. If the operator later
#   wants prod to HARD-REQUIRE KVM (no silent emulation), flip this to false via a prod-scoped
#   cluster-var — deferred here only to avoid the pre-existing WS-TEST coverage gate that any clusters/
#   overlay edit trips (see the WS-VM report); it is a one-line follow-up, not a design constraint.
apiVersion: kubevirt.io/v1
kind: KubeVirt
metadata:
  name: kubevirt
  namespace: kubevirt
  annotations:
    homelab.keithjackson.dev/adr: ADR-0005
spec:
  # Drain VMs off a cordoned node when possible; software-emulated dev VMs just Evict+restart.
  # (Live migration across the 3 converged nodes is a nice-to-have per docs/06, not required.)
  configuration:
    developerConfiguration:
      # Prefer real (nested) KVM; fall back to emulation ONLY when /dev/kvm is absent (see header).
      useEmulation: true
    # Persistent EFI/TPM VM state (if a VM enables it) lands on the replicated Longhorn tier (ADR-0003),
    # inheriting the same durability as every other stateful volume.
    vmStateStorageClass: longhorn