Commit 631580e

The `vm-disk` chart annotates `source` immutable in addition to `storageClass`, for a mechanism distinct from the PVC-template reasoning above. A `vm-disk` renders a single `DataVolume`, and `DataVolume.spec` is immutable in CDI: once the DataVolume exists, editing `spec.source` (or `spec.storage.storageClassName`) has no effect. The chart therefore looks the existing DataVolume up and reuses its stored `spec`, so an edit to `.Values.source` would otherwise render as a silent no-op while the HelmRelease still reported success — the CR and the cluster diverge with no diagnostic (cozystack/cozystack#2985).

Because the aggregated apiserver does not yet evaluate the CEL rule (see the table above, cozystack/cozystack#2657), `vm-disk` adds a second, chart-level guard that is the substantive enforcement today: `templates/dv.yaml` fails the render when the requested `storageClass` or `source` differs from the existing disk. The `source` comparison keys off the operator's input recorded in a `vm-disk.cozystack.io/source` annotation at creation, not the rendered `spec.source` — the image-clone PVC target name carries a chart-version prefix (`vm-image-` was renamed to `vm-default-images-`) that drifts across upgrades without any operator edit, and comparing the rendered form would falsely reject long-lived image disks. A disk created before that annotation existed is instead compared against its stored `spec.source` directly for every source type except image clones: `http`, `upload`, `disk` and `blank` all reproduce the stored spec exactly, so an edit to one of them is still caught, while the image case is skipped rather than fired on drift. `storageClass` is compared against the bound PVC's class (falling back to the DataVolume spec) and is not subject to that exemption. To actually change `storageClass` or `source`, delete and recreate the disk; size growth is the one mutable dimension and is handled separately by `templates/pvc-resize-hook.yaml`.

{{- if gt (len .Values.source) 1 }}

{{- fail "Exactly one type of source is expected!" }}

{{- end }}

{{- if hasKey .Values.source "image" }}

{{- $desiredSource = dict "pvc" (dict "name" (printf "vm-default-images-%s" (required "A valid .Values.source.image.name entry required!" .Values.source.image.name)) "namespace" "cozy-public") }}

{{- else if hasKey .Values.source "http" }}

{{- $desiredSource = dict "http" (dict "url" (required "A valid .Values.source.http.url entry required!" .Values.source.http.url)) }}

{{- else if hasKey .Values.source "upload" }}

{{- $desiredSource = dict "upload" dict }}

{{- else if hasKey .Values.source "disk" }}

{{- $desiredSource = dict "pvc" (dict "name" (printf "vm-disk-%s" (required "A valid .Values.source.disk.name entry required!" .Values.source.disk.name)) "namespace" .Release.Namespace) }}

{{- else }}

{{- fail (printf "Unknown source type: %s. Expected one of: image, http, upload, disk." (keys .Values.source | join ", ")) }}

{{- end }}

{{- $desiredSource = dict "blank" dict }}

DataVolume.spec is immutable in CDI, so editing storageClass or source on an

existing disk cannot take effect. Reusing the stored spec silently would let

the CR diverge from the cluster while the release reports success (#2985);

fail loudly instead.

storageClass: the effective class is read from the bound PVC (authoritative,

and present even for a DataVolume created via spec.pvc or without an explicit

storageClassName), falling back to the DataVolume spec. When neither records a

class the check is skipped rather than misreading it as "<nil>".

source: the operator's input is recorded in an annotation at creation and

compared back on later renders. Comparing the rendered spec.source instead

would be wrong for image clones — the PVC name carries a chart-version prefix

(vm-image- -> vm-default-images-, commit bec35e3a) that drifts across upgrades

with no operator edit. A disk that predates the annotation is matched against

its stored spec.source directly for every source type except image (all of

which reproduce the stored spec exactly); the image case is the one

documented exemption. The annotation is written only at creation and preserved

verbatim afterwards, never overwritten with an unapplied edit.

Size growth is intentionally excluded and handled by pvc-resize-hook.yaml.

{{- $existingSC := "" }}

{{- if $existingPVC }}

{{- $existingSC = ($existingPVC.spec.storageClassName | default "" | toString) }}

{{- end }}

{{- if not $existingSC }}

{{- $existingSC = ((($existingDV.spec.storage | default dict).storageClassName) | default "" | toString) }}

{{- end }}

{{- if and .Values.storageClass $existingSC (ne $existingSC (.Values.storageClass | toString)) }}

{{- fail (printf "VMDisk storageClass is immutable after creation (current: %q, requested: %q). Delete and recreate the disk to change it." $existingSC .Values.storageClass) }}

{{- end }}

{{- $recordedSource := (index ($existingDV.metadata.annotations | default dict) $sourceAnnotation) | default "" }}

{{- if $recordedSource }}

{{- if ne $recordedSource $requestedSource }}

{{- fail (printf "VMDisk source is immutable after creation (current: %s, requested: %s). Delete and recreate the disk to change it." $recordedSource $requestedSource) }}

{{- end }}

{{- else if not (hasKey .Values.source "image") }}

{{- if ne (toYaml $existingDV.spec.source) (toYaml $desiredSource) }}

{{- fail (printf "VMDisk source is immutable after creation (current: %s, requested: %s). Delete and recreate the disk to change it." (toJson $existingDV.spec.source) $requestedSource) }}

{{- end }}

{{- end }}

{{- if $existingDV }}

{{- with (index ($existingDV.metadata.annotations | default dict) $sourceAnnotation) }}

{{ $sourceAnnotation }}: {{ . | quote }}

{{- end }}

{{- else }}

{{ $sourceAnnotation }}: {{ $requestedSource | quote }}

{{- end }}

contentType: kubevirt

{{- toYaml $desiredSource | nindent 4 }}