jakman85andClaude Opus 4.8
6a7e9d15e7
The cdi-operator manages its own `service-monitor-cdi` (scheme https + cdi-metrics-reader-token) which backs CDI's shipped recording rules (kubevirt_cdi_operator_up / cluster:kubevirt_cdi_operator_up:sum) and the CDIOperatorDown alert. Our extra `cdi` ServiceMonitor scraped the same cdi-prometheus-metrics service (HTTPS :8443) over http, so every scrape failed with 400 Bad Request, adding down (up=0) targets for the CDI pods. That poisoned the up-aggregation the recording rule sums, driving it to 0 and firing a false CDIOperatorDown even though the operator was Running, Ready, and Available=True. Remove the duplicate; keep the kubevirt SM (virt-operator ships none of its own). Co-Authored-By: Claude Opus 4.8 <[email protected]>
platform/kubevirt
KubeVirt + CDI — run application VMs (IaaS) as Kubernetes resources on the same control plane, network, storage, and GitOps flow as containers.
- Governing ADR: ADR-0005 — VM workloads: KubeVirt + CDI
- Spec: docs/06 — VM Workloads (KubeVirt)
- Serves: R-PLAT-03/04, R-STATE-01
- Owner: WS-VM
What this stub is
A Kustomization that will pull the pinned KubeVirt operator + CDI operator release manifests
(commented TODO — added in Phase 5), plus the KubeVirt and CDI custom resources that tune
them. VM disks land on Longhorn PVCs via CDI; VMs inherit Cilium default-deny + egress classes.
Layer distinction (docs/01): these are Layer-2 application VMs (a feature the platform offers), NOT the Layer-1 cluster-node VMs (which WS-INFRA provisions with OpenTofu/libvirt). Do not conflate them.
Cross-workstream prerequisite
Nodes must expose virtualization extensions (nested virt in dev KVMs; native on prod) — a node baseline prerequisite owned by WS-INFRA (docs/02). Coordinate before Phase 5.
TODO (later phases — Phase 5, gated on Phases 2–3)
- Add pinned operator release manifests as Kustomize bases; let Renovate maintain versions.
- Run one representative application VM via a ServiceDefinition
kind: vm; prove create/start/stop/ destroy viakubectl/virtctl, Longhorn-backed disk survives rebuild, default-deny + egress apply, guest auto-updates (Phase-5 exit gates).