# platform/kubevirt

**KubeVirt + CDI** — run application VMs (IaaS) as Kubernetes resources on the same control plane,
network, storage, and GitOps flow as containers.

- **Governing ADR:** [ADR-0005 — VM workloads: KubeVirt + CDI](../../../home-network-k3s/decisions/adr-0005-vm-workloads-kubevirt.md)
- **Spec:** [docs/06 — VM Workloads (KubeVirt)](../../../home-network-k3s/docs/06-vm-workloads-kubevirt.md)
- **Serves:** R-PLAT-03/04, R-STATE-01
- **Owner:** WS-VM

## What this stub is

A Kustomization that will pull the pinned **KubeVirt operator** + **CDI operator** release manifests
(commented TODO — added in Phase 5), plus the **`KubeVirt`** and **`CDI`** custom resources that tune
them. VM disks land on **Longhorn** PVCs via CDI; VMs inherit Cilium default-deny + egress classes.

> **Layer distinction (docs/01):** these are **Layer-2 application VMs** (a feature the platform
> offers), NOT the Layer-1 cluster-node VMs (which WS-INFRA provisions with OpenTofu/libvirt). Do not
> conflate them.

## Cross-workstream prerequisite

Nodes must expose **virtualization extensions** (nested virt in dev KVMs; native on prod) — a node
baseline prerequisite owned by **WS-INFRA** (docs/02). Coordinate before Phase 5.

## TODO (later phases — Phase 5, gated on Phases 2–3)

- Add pinned operator release manifests as Kustomize bases; let Renovate maintain versions.
- Run one representative application VM via a ServiceDefinition `kind: vm`; prove create/start/stop/
  destroy via `kubectl`/`virtctl`, Longhorn-backed disk survives rebuild, default-deny + egress apply,
  guest auto-updates (Phase-5 exit gates).