Skip to content

Commit 68cf491

Browse files
kvapsclaude
kvaps
and
claude
committed
feat(vm-instance): add firmware config (UEFI/BIOS, Secure Boot, persistent EFI)
Expose a per-VM `firmware` block on the VMInstance API so users can control the boot mode directly instead of relying solely on the instanceProfile: - bootloader: "uefi" (OVMF) or "bios" (SeaBIOS); empty inherits the instanceProfile default (backward compatible) - secureBoot: enable UEFI Secure Boot (also emits domain.features.smm, which KubeVirt requires when Secure Boot is on) - efiPersistent: persist EFI NVRAM so enrolled Secure Boot keys (e.g. an updated Microsoft UEFI CA) survive reboots efiPersistent uses a KubeVirt backend-storage PVC. On the default ReadWriteOnce storage that PVC pins the VM to its node, so a persistent-EFI VM cannot be live-migrated; this is documented on the field and is sufficient for one-time in-guest tasks such as a Microsoft UEFI CA update. Live-migration would require an RWX-Filesystem vmStateStorageClass and is out of scope for this chart. Regenerated values.schema.json, README, the generated API types and deepcopy, and the vm-instance-rd ApplicationDefinition. Co-Authored-By: Claude <[email protected]> Signed-off-by: Andrei Kvapil <[email protected]>
1 parent 77d42ab commit 68cf491

7 files changed

Lines changed: 107 additions & 28 deletions

File tree

‎api/apps/v1alpha1/vminstance/types.go‎

Lines changed: 12 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎api/apps/v1alpha1/vminstance/zz_generated.deepcopy.go‎

Lines changed: 16 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/apps/vm-instance/README.md‎

Lines changed: 30 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -36,32 +36,36 @@ virtctl ssh <user>@<vm>
3636

3737
### Common parameters
3838

39-
| Name | Description | Type | Value |
40-
| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- | ----------- |
41-
| `external` | Enable external access from outside the cluster. | `bool` | `false` |
42-
| `externalMethod` | Method to pass through traffic to the VM. | `string` | `PortList` |
43-
| `externalPorts` | Ports to forward from outside the cluster. | `[]int` | `[22]` |
44-
| `externalAllowICMP` | Whether to accept ICMP traffic to the VM in PortList mode (preserves ping and PMTU discovery). No effect in WholeIP mode. Default true so ping behaves as users expect even when port filtering is in effect. | `bool` | `true` |
45-
| `runStrategy` | Requested running state of the VirtualMachineInstance | `string` | `Always` |
46-
| `instanceType` | Virtual Machine instance type. | `string` | `u1.medium` |
47-
| `instanceProfile` | Virtual Machine preferences profile. | `string` | `ubuntu` |
48-
| `disks` | List of disks to attach. | `[]object` | `[]` |
49-
| `disks[i].name` | Disk name. | `string` | `""` |
50-
| `disks[i].bus` | Disk bus type (e.g. "sata"). | `string` | `""` |
51-
| `networks` | Networks to attach the VM to. | `[]object` | `[]` |
52-
| `networks[i].name` | Network attachment name. | `string` | `""` |
53-
| `subnets` | Deprecated: use networks instead. | `[]object` | `[]` |
54-
| `subnets[i].name` | Network attachment name. | `string` | `""` |
55-
| `gpus` | List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM). | `[]object` | `[]` |
56-
| `gpus[i].name` | The name of the GPU resource to attach. | `string` | `""` |
57-
| `cpuModel` | Model specifies the CPU model inside the VMI. List of available models https://github.com/libvirt/libvirt/tree/master/src/cpu_map | `string` | `""` |
58-
| `resources` | Resource configuration for the virtual machine. | `object` | `{}` |
59-
| `resources.cpu` | Number of CPU cores allocated. | `quantity` | `""` |
60-
| `resources.memory` | Amount of memory allocated. | `quantity` | `""` |
61-
| `resources.sockets` | Number of CPU sockets (vCPU topology). | `quantity` | `""` |
62-
| `sshKeys` | List of SSH public keys for authentication. | `[]string` | `[]` |
63-
| `cloudInit` | Cloud-init user data. | `string` | `""` |
64-
| `cloudInitSeed` | Seed string to generate SMBIOS UUID for the VM. | `string` | `""` |
39+
| Name | Description | Type | Value |
40+
| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------- | ----------- |
41+
| `external` | Enable external access from outside the cluster. | `bool` | `false` |
42+
| `externalMethod` | Method to pass through traffic to the VM. | `string` | `PortList` |
43+
| `externalPorts` | Ports to forward from outside the cluster. | `[]int` | `[22]` |
44+
| `externalAllowICMP` | Whether to accept ICMP traffic to the VM in PortList mode (preserves ping and PMTU discovery). No effect in WholeIP mode. Default true so ping behaves as users expect even when port filtering is in effect. | `bool` | `true` |
45+
| `runStrategy` | Requested running state of the VirtualMachineInstance | `string` | `Always` |
46+
| `instanceType` | Virtual Machine instance type. | `string` | `u1.medium` |
47+
| `instanceProfile` | Virtual Machine preferences profile. | `string` | `ubuntu` |
48+
| `disks` | List of disks to attach. | `[]object` | `[]` |
49+
| `disks[i].name` | Disk name. | `string` | `""` |
50+
| `disks[i].bus` | Disk bus type (e.g. "sata"). | `string` | `""` |
51+
| `networks` | Networks to attach the VM to. | `[]object` | `[]` |
52+
| `networks[i].name` | Network attachment name. | `string` | `""` |
53+
| `subnets` | Deprecated: use networks instead. | `[]object` | `[]` |
54+
| `subnets[i].name` | Network attachment name. | `string` | `""` |
55+
| `gpus` | List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM). | `[]object` | `[]` |
56+
| `gpus[i].name` | The name of the GPU resource to attach. | `string` | `""` |
57+
| `cpuModel` | Model specifies the CPU model inside the VMI. List of available models https://github.com/libvirt/libvirt/tree/master/src/cpu_map | `string` | `""` |
58+
| `firmware` | Firmware and boot configuration (UEFI/BIOS selection, Secure Boot, persistent EFI NVRAM). | `object` | `{}` |
59+
| `firmware.bootloader` | Bootloader to boot the VM with: "uefi" (OVMF) or "bios" (SeaBIOS). Empty inherits the instanceProfile default. | `string` | `""` |
60+
| `firmware.secureBoot` | Enable UEFI Secure Boot. Only applies when bootloader is "uefi". | `bool` | `false` |
61+
| `firmware.efiPersistent` | Persist EFI NVRAM (e.g. enrolled Secure Boot keys, such as an updated Microsoft UEFI CA) across reboots. Only applies when bootloader is "uefi". On default RWO storage the VM is node-pinned (no live-migration). | `bool` | `false` |
62+
| `resources` | Resource configuration for the virtual machine. | `object` | `{}` |
63+
| `resources.cpu` | Number of CPU cores allocated. | `quantity` | `""` |
64+
| `resources.memory` | Amount of memory allocated. | `quantity` | `""` |
65+
| `resources.sockets` | Number of CPU sockets (vCPU topology). | `quantity` | `""` |
66+
| `sshKeys` | List of SSH public keys for authentication. | `[]string` | `[]` |
67+
| `cloudInit` | Cloud-init user data. | `string` | `""` |
68+
| `cloudInitSeed` | Seed string to generate SMBIOS UUID for the VM. | `string` | `""` |
6569

6670

6771
## U Series

‎packages/apps/vm-instance/templates/vm.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@ spec:
4646
spec:
4747
domain:
4848
{{- $domainRes := include "virtual-machine.domainResources" . | fromJson -}}
49+
{{- $fw := .Values.firmware | default dict }}
4950
{{- with $domainRes.cpu }}
5051
cpu: {{- . | toYaml | nindent 10 }}
5152
{{- end }}
@@ -54,6 +55,20 @@ spec:
5455
{{- end }}
5556
firmware:
5657
uuid: {{ include "virtual-machine.stableUuid" . }}
58+
{{- if eq (toString $fw.bootloader) "uefi" }}
59+
bootloader:
60+
efi:
61+
secureBoot: {{ $fw.secureBoot | default false }}
62+
persistent: {{ $fw.efiPersistent | default false }}
63+
{{- else if eq (toString $fw.bootloader) "bios" }}
64+
bootloader:
65+
bios: {}
66+
{{- end }}
67+
{{- if and (eq (toString $fw.bootloader) "uefi") ($fw.secureBoot | default false) }}
68+
features:
69+
smm:
70+
enabled: true
71+
{{- end }}
5772
devices:
5873
{{- if .Values.gpus }}
5974
gpus:

‎packages/apps/vm-instance/values.schema.json‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,25 @@
142142
"type": "string",
143143
"default": ""
144144
},
145+
"firmware": {
146+
"description": "Firmware and boot configuration (UEFI/BIOS selection, Secure Boot, persistent EFI NVRAM).",
147+
"type": "object",
148+
"default": {},
149+
"properties": {
150+
"bootloader": {
151+
"description": "Bootloader to boot the VM with: \"uefi\" (OVMF) or \"bios\" (SeaBIOS). Empty inherits the instanceProfile default.",
152+
"type": "string"
153+
},
154+
"efiPersistent": {
155+
"description": "Persist EFI NVRAM (e.g. enrolled Secure Boot keys, such as an updated Microsoft UEFI CA) across reboots. Only applies when bootloader is \"uefi\". On default RWO storage the VM is node-pinned (no live-migration).",
156+
"type": "boolean"
157+
},
158+
"secureBoot": {
159+
"description": "Enable UEFI Secure Boot. Only applies when bootloader is \"uefi\".",
160+
"type": "boolean"
161+
}
162+
}
163+
},
145164
"resources": {
146165
"description": "Resource configuration for the virtual machine.",
147166
"type": "object",

0 commit comments

Comments
 (0)