jakman85andClaude Opus 4.8
dbffb8fab8
- platform/kubevirt: pinned KubeVirt v1.9.0 + CDI v1.66.0 operators (remote bases); KubeVirt/CDI CRs tuned for Longhorn; useEmulation=true (prefer real KVM, emulate fallback). - Controllers/configs split (F-MON1): CRs + ServiceMonitors + alerts via platform-config. - Observability: ServiceMonitors, KubeVirt platform-health alerts (R-OBS-04), VM dashboard. - catalog/vm-demo.yaml (kind: vm) + rendered VirtualMachine/DataVolume fixture. - Conformance: vm-lifecycle (R-PLAT-03/04), vm-data-survival (R-STATE-01, L3), vm-default-deny (R-NET-01) — self-skipping until KubeVirt+longhorn exist. - ci/SPEC_PIN: adopt accepted spec b633b7f (ADR-0015 egress work already merged). - conformance/run.sh: document R-ENV-02/R-GITOPS-01 coverage gaps (WS-GITOPS/INFRA-owned). Co-Authored-By: Claude Opus 4.8 <[email protected]>
37 lines
2.3 KiB
YAML
37 lines
2.3 KiB
YAML
---
|
|
# KubeVirt CR — tunes the KubeVirt install (ADR-0005). CONSUMES the kubevirt.io CRD registered by the
|
|
# operator (platform/kubevirt/kustomization.yaml), so this is applied by the `platform-config` Flux
|
|
# Kustomization (dependsOn: platform) — see platform-config/kustomization.yaml + F-MON1.
|
|
#
|
|
# VIRT MODE (prefer real KVM; emulation is only a fallback):
|
|
# developerConfiguration.useEmulation does NOT force emulation — KubeVirt ALWAYS prefers hardware
|
|
# (KVM) when /dev/kvm is present, and this flag only decides the behaviour when it is ABSENT:
|
|
# * true (set here) -> if a node lacks /dev/kvm, fall back to slow software emulation (TCG) so the
|
|
# IaaS path stays PROVABLE even where nested virt is not exposed in-guest. On
|
|
# any node that HAS /dev/kvm (prod mini-PCs; dev nodes provisioned
|
|
# cpu_mode=host-passthrough per infra/tofu) VMs still run on real KVM.
|
|
# * false -> a node without /dev/kvm cannot schedule VMs at all (fail loud).
|
|
# `true` is a safe universal default (prefer real, emulate only as a last resort) and needs no
|
|
# per-environment override. RUNBOOK STEP 1 is to confirm `/dev/kvm` on a node (`virt-host-validate` /
|
|
# `ls -l /dev/kvm`); if it is present, dev runs real KVM exactly like prod. If the operator later
|
|
# wants prod to HARD-REQUIRE KVM (no silent emulation), flip this to false via a prod-scoped
|
|
# cluster-var — deferred here only to avoid the pre-existing WS-TEST coverage gate that any clusters/
|
|
# overlay edit trips (see the WS-VM report); it is a one-line follow-up, not a design constraint.
|
|
apiVersion: kubevirt.io/v1
|
|
kind: KubeVirt
|
|
metadata:
|
|
name: kubevirt
|
|
namespace: kubevirt
|
|
annotations:
|
|
homelab.keithjackson.dev/adr: ADR-0005
|
|
spec:
|
|
# Drain VMs off a cordoned node when possible; software-emulated dev VMs just Evict+restart.
|
|
# (Live migration across the 3 converged nodes is a nice-to-have per docs/06, not required.)
|
|
configuration:
|
|
developerConfiguration:
|
|
# Prefer real (nested) KVM; fall back to emulation ONLY when /dev/kvm is absent (see header).
|
|
useEmulation: true
|
|
# Persistent EFI/TPM VM state (if a VM enables it) lands on the replicated Longhorn tier (ADR-0003),
|
|
# inheriting the same durability as every other stateful volume.
|
|
vmStateStorageClass: longhorn
|