Persistent EFI/TPM on default storage blocks live-migration of Windows 11/2022/2025 VMs (regression in v1.5.0) #3005

What happened

Commit 4cc60e3 (released in v1.5.0) removed the sed -i '/persistent: true/d' strip from packages/system/kubevirt-instancetypes and restored upstream's persistent firmware state for the windows.11, windows.2k22, windows.2k25 preferences (and their .virtio variants):

devices:
  preferredTPM:
    persistent: true
firmware:
  preferredEfi:
    persistent: true
    secureBoot: true

That was a correct fix (the strip left preferredTPM: null, which the v1.8 CRD rejects). But it has a side effect on live-migration.

With persistent EFI/TPM, KubeVirt creates a backend-storage PVC (persistent-state-for-<vm>). Its access mode is decided by backend-storage.getAccessMode: with vmStateStorageClass unset (the default), it consults the CDI StorageProfile of the cluster-default StorageClass. On the default replicated (linstor.csi.linbit.com) class the StorageProfile advertises only Filesystem: [ReadWriteOnce] (RWX is Block-only), so the backend PVC is created ReadWriteOnce.

An RWO backend PVC pins the VM to its node, so the VM cannot be live-migrated or drained.

Impact

On a default v1.5.0 install, windows.11 / windows.2k22 / windows.2k25 VMs are no longer live-migratable. Because the KubeVirt CR uses evictionStrategy: LiveMigrate and workloadUpdateMethods: [LiveMigrate, Evict], node drains and cluster upgrades involving these VMs can get stuck on the failed live-migration.

This is a behavioral regression vs. ≤ v1.4.x, where persistence was stripped (no backend PVC, migration worked — at the cost of non-persistent firmware state).

How to reproduce

1. Install cozystack v1.5.0.
2. Create a windows.2k22 VMInstance on the default replicated storage.
3. kubectl get pvc → persistent-state-for-<vm> is ReadWriteOnce.
4. Trigger a live-migration / node drain of that VM → blocked.

Possible directions

• Provide an RWX backend for the persistent state:
  • point spec.configuration.vmStateStorageClass at an RWX-Filesystem class (the LINSTOR NFS-export RWX server linstor-csi-nfs-server is already deployed in current installs), or
  • upstream KubeVirt support for a Block-mode (RWX-Block) backend volume so it uses Block: [ReadWriteMany] on replicated directly, no NFS — draft backend-storage: persistent EFI NVRAM on a Block-mode (RWX) volume kubevirt/kubevirt#18215.
• Or make persistent firmware state opt-in (e.g. via an explicit firmware.efiPersistent field — see feat(vm-instance): add firmware config (UEFI/BIOS, Secure Boot, persistent EFI) #3002) rather than default-on through the Windows profiles, and document the live-migration trade-off.

Environment

• cozystack v1.5.0 (regression introduced by 4cc60e3; not present in ≤ v1.4.4)
• KubeVirt v1.8.2, default replicated StorageClass (linstor.csi.linbit.com)