Skip to content

Commit 3e370e7

Browse files
lexfreilexfrei
committed
chore(kubevirt): update KubeVirt to v1.9.0
Refetches the vendored operator manifest from the v1.9.0 release. The release turns every Beta feature gate on by default and adds disabledFeatureGates for opting out; the KubeVirt CR side of that lands separately. The virt-launcher QEMU build moves with the bump — el9 qemu-kvm 10.1.0-10 to 10.1.0-20 — and that is the thing to check before moving the release pin, rather than a QEMU major: kubevirt/kubevirt#16386 lost live migration for every running VM on 1.6.2 to 1.7.0, one build apart within the same QEMU version, on virtio feature bits the target launcher would not accept. VMs running on the 1.8.4 launcher were migrated onto the 1.9.0 one on a three-node test cluster before this bump. The update target now carries the check as a note above the pin. make update used to wipe templates/ before fetching, which also removed the local PrometheusRule template; it now only overwrites the file it fetches. Assisted-by: LLM Signed-off-by: Aleksei Sviridkin <[email protected]>
1 parent dc2e427 commit 3e370e7

2 files changed

Lines changed: 160 additions & 20 deletions

File tree

‎packages/system/kubevirt-operator/Makefile‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,11 @@ export NAMESPACE=cozy-kubevirt
44
include ../../../hack/package.mk
55

66
update:
7-
rm -rf templates
8-
mkdir templates
9-
# Skipping v1.7.x: live-migration regression, https://github.com/kubevirt/kubevirt/issues/16386
10-
export RELEASE=v1.8.4 && \
7+
mkdir -p templates
8+
@# A live migration onto the new virt-launcher can fail on virtio feature bits
9+
@# whenever its QEMU build moves at all, major or not (kubevirt/kubevirt#16386
10+
@# broke on qemu-kvm 9.1.0-19 to 9.1.0-20): test one before moving RELEASE.
11+
export RELEASE=v1.9.0 && \
1112
wget https://github.com/kubevirt/kubevirt/releases/download/$${RELEASE}/kubevirt-operator.yaml -O templates/kubevirt-operator.yaml && \
1213
sed -i 's/namespace: kubevirt/namespace: $(NAMESPACE)/g' templates/kubevirt-operator.yaml
1314
awk -i inplace -v RS="---" '!/kind: Namespace/{printf "%s", $$0 RS}' templates/kubevirt-operator.yaml

‎packages/system/kubevirt-operator/templates/kubevirt-operator.yaml‎

Lines changed: 155 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -359,6 +359,33 @@ spec:
359359
nullable: true
360360
type: boolean
361361
type: object
362+
confidentialCompute:
363+
description: QGS configuration for attestation on the Intel TDX
364+
Platform
365+
nullable: true
366+
properties:
367+
tdx:
368+
description: TDX configuration for attestation on the Intel
369+
TDX Platform
370+
nullable: true
371+
properties:
372+
attestation:
373+
description: QGSConfiguration holds QGS configuration
374+
properties:
375+
enforced:
376+
default: false
377+
description: Indicates whether TDX VM should enforce
378+
the existence of QGS (required for attestation)
379+
to be scheduled
380+
type: boolean
381+
qgsSocketPath:
382+
default: /var/run/tdx-qgs/qgs.socket
383+
description: Socket path pointing to the Quote Generation
384+
Service
385+
type: string
386+
type: object
387+
type: object
388+
type: object
362389
controllerConfiguration:
363390
description: |-
364391
ReloadableComponentConfiguration holds all generic k8s configuration options which can
@@ -573,8 +600,10 @@ spec:
573600
type: array
574601
x-kubernetes-list-type: atomic
575602
imagePullPolicy:
576-
description: PullPolicy describes a policy for if/when to pull
577-
a container image
603+
description: |-
604+
The ImagePullPolicy to use for user workload pods and their containers
605+
(launcher pods, exporter pods, etc.).
606+
For KubeVirt infrastructure images, use spec.imagePullPolicy instead.
578607
type: string
579608
instancetype:
580609
description: Instancetype configuration
@@ -787,6 +816,14 @@ spec:
787816
That will ensure the target virt-launcher doesn't share categories with another pod on the node.
788817
However, migrations will fail when using RWX volumes that don't automatically deal with SELinux levels.
789818
type: boolean
819+
maxDowntimeMs:
820+
description: |-
821+
MaxDowntimeMs specifies the maximum tolerable downtime (in milliseconds) during switchover.
822+
Defaults to 900
823+
format: int64
824+
maximum: 2000000
825+
minimum: 1
826+
type: integer
790827
network:
791828
description: |-
792829
Network is the name of the CNI network to use for live migrations. By default, migrations go
@@ -1003,14 +1040,27 @@ spec:
10031040
type: array
10041041
x-kubernetes-list-type: atomic
10051042
type: object
1043+
persistentReservationConfiguration:
1044+
description: PersistentReservationConfiguration controls the deployment
1045+
of additional resources required for using SCSI persistent reservation
1046+
in VMs
1047+
nullable: true
1048+
properties:
1049+
enabled:
1050+
description: |-
1051+
Enabled controls the deployment of additional resources like the pr-helper container
1052+
for enabling the use of the SCSI persistent reservation VMs, defaults to False.
1053+
nullable: true
1054+
type: boolean
1055+
type: object
10061056
roleAggregationStrategy:
10071057
description: |-
10081058
RoleAggregationStrategy controls whether RBAC cluster roles should be aggregated
10091059
to the default Kubernetes roles (admin, edit, view).
10101060
When set to "AggregateToDefault" (default) or not specified, the aggregate-to-* labels are added to the cluster roles.
10111061
When set to "Manual", the labels are not added, and roles will not be aggregated to the default roles.
1012-
Setting this field to "Manual" requires the OptOutRoleAggregation feature gate to be enabled.
1013-
This is an Alpha feature and subject to change.
1062+
Setting RoleAggregationStrategy to "Manual" requires the OptOutRoleAggregation feature gate
1063+
to be enabled (Beta, enabled by default since v1.9.0).
10141064
enum:
10151065
- AggregateToDefault
10161066
- Manual
@@ -1248,7 +1298,11 @@ spec:
12481298
x-kubernetes-list-type: atomic
12491299
type: object
12501300
imagePullPolicy:
1251-
description: The ImagePullPolicy to use.
1301+
description: |-
1302+
The ImagePullPolicy to use for KubeVirt operator-managed infrastructure
1303+
images (virt-api, virt-controller, virt-handler, virt-exportproxy, etc.).
1304+
For pull policy of user workload pods, see
1305+
spec.configuration.imagePullPolicy.
12521306
type: string
12531307
imagePullSecrets:
12541308
description: |-
@@ -3805,6 +3859,33 @@ spec:
38053859
nullable: true
38063860
type: boolean
38073861
type: object
3862+
confidentialCompute:
3863+
description: QGS configuration for attestation on the Intel TDX
3864+
Platform
3865+
nullable: true
3866+
properties:
3867+
tdx:
3868+
description: TDX configuration for attestation on the Intel
3869+
TDX Platform
3870+
nullable: true
3871+
properties:
3872+
attestation:
3873+
description: QGSConfiguration holds QGS configuration
3874+
properties:
3875+
enforced:
3876+
default: false
3877+
description: Indicates whether TDX VM should enforce
3878+
the existence of QGS (required for attestation)
3879+
to be scheduled
3880+
type: boolean
3881+
qgsSocketPath:
3882+
default: /var/run/tdx-qgs/qgs.socket
3883+
description: Socket path pointing to the Quote Generation
3884+
Service
3885+
type: string
3886+
type: object
3887+
type: object
3888+
type: object
38083889
controllerConfiguration:
38093890
description: |-
38103891
ReloadableComponentConfiguration holds all generic k8s configuration options which can
@@ -4019,8 +4100,10 @@ spec:
40194100
type: array
40204101
x-kubernetes-list-type: atomic
40214102
imagePullPolicy:
4022-
description: PullPolicy describes a policy for if/when to pull
4023-
a container image
4103+
description: |-
4104+
The ImagePullPolicy to use for user workload pods and their containers
4105+
(launcher pods, exporter pods, etc.).
4106+
For KubeVirt infrastructure images, use spec.imagePullPolicy instead.
40244107
type: string
40254108
instancetype:
40264109
description: Instancetype configuration
@@ -4233,6 +4316,14 @@ spec:
42334316
That will ensure the target virt-launcher doesn't share categories with another pod on the node.
42344317
However, migrations will fail when using RWX volumes that don't automatically deal with SELinux levels.
42354318
type: boolean
4319+
maxDowntimeMs:
4320+
description: |-
4321+
MaxDowntimeMs specifies the maximum tolerable downtime (in milliseconds) during switchover.
4322+
Defaults to 900
4323+
format: int64
4324+
maximum: 2000000
4325+
minimum: 1
4326+
type: integer
42364327
network:
42374328
description: |-
42384329
Network is the name of the CNI network to use for live migrations. By default, migrations go
@@ -4449,14 +4540,27 @@ spec:
44494540
type: array
44504541
x-kubernetes-list-type: atomic
44514542
type: object
4543+
persistentReservationConfiguration:
4544+
description: PersistentReservationConfiguration controls the deployment
4545+
of additional resources required for using SCSI persistent reservation
4546+
in VMs
4547+
nullable: true
4548+
properties:
4549+
enabled:
4550+
description: |-
4551+
Enabled controls the deployment of additional resources like the pr-helper container
4552+
for enabling the use of the SCSI persistent reservation VMs, defaults to False.
4553+
nullable: true
4554+
type: boolean
4555+
type: object
44524556
roleAggregationStrategy:
44534557
description: |-
44544558
RoleAggregationStrategy controls whether RBAC cluster roles should be aggregated
44554559
to the default Kubernetes roles (admin, edit, view).
44564560
When set to "AggregateToDefault" (default) or not specified, the aggregate-to-* labels are added to the cluster roles.
44574561
When set to "Manual", the labels are not added, and roles will not be aggregated to the default roles.
4458-
Setting this field to "Manual" requires the OptOutRoleAggregation feature gate to be enabled.
4459-
This is an Alpha feature and subject to change.
4562+
Setting RoleAggregationStrategy to "Manual" requires the OptOutRoleAggregation feature gate
4563+
to be enabled (Beta, enabled by default since v1.9.0).
44604564
enum:
44614565
- AggregateToDefault
44624566
- Manual
@@ -4694,7 +4798,11 @@ spec:
46944798
x-kubernetes-list-type: atomic
46954799
type: object
46964800
imagePullPolicy:
4697-
description: The ImagePullPolicy to use.
4801+
description: |-
4802+
The ImagePullPolicy to use for KubeVirt operator-managed infrastructure
4803+
images (virt-api, virt-controller, virt-handler, virt-exportproxy, etc.).
4804+
For pull policy of user workload pods, see
4805+
spec.configuration.imagePullPolicy.
46984806
type: string
46994807
imagePullSecrets:
47004808
description: |-
@@ -6965,6 +7073,7 @@ rules:
69657073
- kubevirt-virt-handler-server-certs
69667074
- kubevirt-virt-handler-migration-client-certs
69677075
- kubevirt-virt-handler-vsock-client-certs
7076+
- kubevirt-virt-handler-monitoring-client-certs
69687077
- kubevirt-operator-certs
69697078
- kubevirt-virt-api-certs
69707079
- kubevirt-controller-certs
@@ -7665,6 +7774,14 @@ rules:
76657774
- update
76667775
- delete
76677776
- patch
7777+
- apiGroups:
7778+
- template.kubevirt.io
7779+
resources:
7780+
- virtualmachinetemplates
7781+
verbs:
7782+
- get
7783+
- list
7784+
- watch
76687785
- apiGroups:
76697786
- pool.kubevirt.io
76707787
resources:
@@ -7830,7 +7947,6 @@ rules:
78307947
- virtualmachineinstances
78317948
verbs:
78327949
- update
7833-
- patch
78347950
- list
78357951
- watch
78367952
- apiGroups:
@@ -7891,11 +8007,13 @@ rules:
78918007
- watch
78928008
- patch
78938009
- apiGroups:
7894-
- apps
8010+
- plugin.kubevirt.io
78958011
resources:
7896-
- controllerrevisions
8012+
- plugins
78978013
verbs:
78988014
- get
8015+
- list
8016+
- watch
78998017
- apiGroups:
79008018
- export.kubevirt.io
79018019
resources:
@@ -8081,6 +8199,19 @@ rules:
80818199
- list
80828200
- watch
80838201
- deletecollection
8202+
- apiGroups:
8203+
- plugin.kubevirt.io
8204+
resources:
8205+
- plugins
8206+
verbs:
8207+
- get
8208+
- delete
8209+
- create
8210+
- update
8211+
- patch
8212+
- list
8213+
- watch
8214+
- deletecollection
80848215
- apiGroups:
80858216
- export.kubevirt.io
80868217
resources:
@@ -8417,6 +8548,14 @@ rules:
84178548
- get
84188549
- list
84198550
- watch
8551+
- apiGroups:
8552+
- plugin.kubevirt.io
8553+
resources:
8554+
- plugins
8555+
verbs:
8556+
- get
8557+
- list
8558+
- watch
84208559
- apiGroups:
84218560
- instancetype.kubevirt.io
84228561
resources:
@@ -8536,14 +8675,14 @@ spec:
85368675
- virt-operator
85378676
env:
85388677
- name: VIRT_OPERATOR_IMAGE
8539-
value: quay.io/kubevirt/virt-operator:v1.8.4
8678+
value: quay.io/kubevirt/virt-operator:v1.9.0
85408679
- name: WATCH_NAMESPACE
85418680
valueFrom:
85428681
fieldRef:
85438682
fieldPath: metadata.annotations['olm.targetNamespaces']
85448683
- name: KUBEVIRT_VERSION
8545-
value: v1.8.4
8546-
image: quay.io/kubevirt/virt-operator:v1.8.4
8684+
value: v1.9.0
8685+
image: quay.io/kubevirt/virt-operator:v1.9.0
85478686
imagePullPolicy: IfNotPresent
85488687
livenessProbe:
85498688
httpGet:

0 commit comments

Comments
 (0)