diff --git a/packages/system/kubevirt-operator/Makefile b/packages/system/kubevirt-operator/Makefile index 1734aa2a..9aeb6de1 100644 --- a/packages/system/kubevirt-operator/Makefile +++ b/packages/system/kubevirt-operator/Makefile @@ -7,7 +7,7 @@ update: rm -rf templates mkdir templates # v1.7.0 blocked by https://github.com/kubevirt/kubevirt/issues/16386 - export RELEASE=v1.6.3 && \ + export RELEASE=v1.8.2 && \ wget https://github.com/kubevirt/kubevirt/releases/download/$${RELEASE}/kubevirt-operator.yaml -O templates/kubevirt-operator.yaml && \ sed -i 's/namespace: kubevirt/namespace: $(NAMESPACE)/g' templates/kubevirt-operator.yaml awk -i inplace -v RS="---" '!/kind: Namespace/{printf "%s", $$0 RS}' templates/kubevirt-operator.yaml diff --git a/packages/system/kubevirt-operator/templates/ServiceMonitor.yaml b/packages/system/kubevirt-operator/templates/ServiceMonitor.yaml deleted file mode 100644 index 7e4eca4d..00000000 --- a/packages/system/kubevirt-operator/templates/ServiceMonitor.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: monitoring.coreos.com/v1 -kind: ServiceMonitor -metadata: - name: kubevirt -spec: - selector: - matchLabels: - prometheus.kubevirt.io: "true" - endpoints: - - port: metrics - scheme: https - tlsConfig: - insecureSkipVerify: true diff --git a/packages/system/kubevirt-operator/templates/alerts.yaml b/packages/system/kubevirt-operator/templates/alerts.yaml deleted file mode 100644 index 70d47014..00000000 --- a/packages/system/kubevirt-operator/templates/alerts.yaml +++ /dev/null @@ -1,7 +0,0 @@ -{{- $files := .Files.Glob "alerts/*.yaml" -}} -{{- range $path, $file := $files }} ---- -# from: {{ $path }} -{{ toString $file }} - -{{- end -}} diff --git a/packages/system/kubevirt-operator/templates/kubevirt-operator.yaml b/packages/system/kubevirt-operator/templates/kubevirt-operator.yaml index 8350d457..8d73f982 100644 --- a/packages/system/kubevirt-operator/templates/kubevirt-operator.yaml +++ b/packages/system/kubevirt-operator/templates/kubevirt-operator.yaml @@ -170,6 +170,20 @@ spec: defaultArchitecture: type: string ppc64le: + description: 'Deprecated: ppc64le architecture is no longer + supported.' + properties: + emulatedMachines: + items: + type: string + type: array + x-kubernetes-list-type: atomic + machineType: + type: string + ovmfPath: + type: string + type: object + s390x: properties: emulatedMachines: items: @@ -232,6 +246,108 @@ spec: type: object type: object x-kubernetes-map-type: atomic + changedBlockTrackingLabelSelectors: + description: |- + ChangedBlockTrackingLabelSelectors defines label selectors. VMs matching these selectors will have changed block tracking enabled. + Enabling changedBlockTracking is mandatory for performing storage-agnostic backups and incremental backups. + nullable: true + properties: + namespaceLabelSelector: + description: NamespaceSelector will enable changedBlockTracking + on all VMs running inside namespaces that match the label + selector. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + virtualMachineLabelSelector: + description: VirtualMachineSelector will enable changedBlockTracking + on all VMs that match the label selector. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object commonInstancetypesDeployment: description: CommonInstancetypesDeployment controls the deployment of common-instancetypes resources @@ -302,6 +418,14 @@ spec: https://kubevirt.io/user-guide/operations/node_overcommit/#node-cpu-allocation-ratio Defaults to 10 type: integer + disabledFeatureGates: + description: |- + DisabledFeatureGates specifies a list of experimental feature gates to disable. + A feature gate must not appear in both FeatureGates and DisabledFeatureGates. + items: + type: string + type: array + x-kubernetes-list-type: atomic diskVerification: description: DiskVerification holds container disks verification limits @@ -316,11 +440,13 @@ spec: - memoryLimit type: object featureGates: - description: FeatureGates is the list of experimental features - to enable. Defaults to none + description: |- + FeatureGates specifies a list of experimental feature gates to enable. Defaults to none. + A feature gate must not appear in both FeatureGates and DisabledFeatureGates. items: type: string type: array + x-kubernetes-list-type: atomic logVerbosity: description: LogVerbosity sets log verbosity level of various components @@ -351,6 +477,7 @@ spec: "see" 2% more memory than its parent pod. Values under 100 are effectively "undercommits". Overcommits can lead to memory exhaustion, which in turn can lead to crashes. Use carefully. Defaults to 100 + minimum: 10 type: integer minimumClusterTSCFrequency: description: |- @@ -426,6 +553,25 @@ spec: type: object type: object type: object + hypervisors: + description: Hypervisors holds information regarding the hypervisor + configurations supported on this cluster. + items: + description: HypervisorConfiguration holds information regarding + the hypervisor present on cluster nodes. + properties: + name: + description: |- + Name is the name of the hypervisor. + Supported values are: "kvm", "hyperv-direct". + enum: + - kvm + - hyperv-direct + type: string + type: object + maxItems: 1 + type: array + x-kubernetes-list-type: atomic imagePullPolicy: description: PullPolicy describes a policy for if/when to pull a container image @@ -537,6 +683,12 @@ spec: description: MediatedDevicesConfiguration holds information about MDEV types to be defined, if available properties: + enabled: + description: |- + Enable the creation and removal of mediated devices by virt-handler + Replaces the deprecated DisableMDEVConfiguration feature gate + Defaults to true + type: boolean mediatedDeviceTypes: items: type: string @@ -669,8 +821,16 @@ spec: UnsafeMigrationOverride allows live migrations to occur even if the compatibility check indicates the migration will be unsafe to the guest. Defaults to false type: boolean + utilityVolumesTimeout: + description: |- + UtilityVolumesTimeout is the maximum number of seconds a migration can wait in Pending state + for utility volumes to be detached. If utility volumes are still present after this timeout, + the migration will be marked as Failed. Defaults to 150 + format: int64 + type: integer type: object minCPUModel: + description: deprecated type: string network: description: NetworkConfiguration holds network options @@ -843,6 +1003,18 @@ spec: type: array x-kubernetes-list-type: atomic type: object + roleAggregationStrategy: + description: |- + RoleAggregationStrategy controls whether RBAC cluster roles should be aggregated + to the default Kubernetes roles (admin, edit, view). + When set to "AggregateToDefault" (default) or not specified, the aggregate-to-* labels are added to the cluster roles. + When set to "Manual", the labels are not added, and roles will not be aggregated to the default roles. + Setting this field to "Manual" requires the OptOutRoleAggregation feature gate to be enabled. + This is an Alpha feature and subject to change. + enum: + - AggregateToDefault + - Manual + type: string seccompConfiguration: description: SeccompConfiguration holds Seccomp configuration for Kubevirt components @@ -957,6 +1129,17 @@ spec: - VersionTLS13 type: string type: object + virtTemplateDeployment: + description: VirtTemplateDeployment controls the deployment of + virt-template components + nullable: true + properties: + enabled: + description: Enabled controls the deployment of virt-template + resources, defaults to True when feature gate is enabled. + nullable: true + type: boolean + type: object virtualMachineInstancesPerNode: type: integer virtualMachineOptions: @@ -1400,7 +1583,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -1415,7 +1597,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -1583,7 +1764,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -1598,7 +1778,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -1692,8 +1871,8 @@ spec: most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + compute a sum by iterating through the elements of this field and subtracting + "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. items: description: The weights of all of the matched WeightedPodAffinityTerm @@ -1764,7 +1943,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -1779,7 +1957,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -1947,7 +2124,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -1962,7 +2138,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -2481,7 +2656,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -2496,7 +2670,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -2664,7 +2837,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -2679,7 +2851,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -2773,8 +2944,8 @@ spec: most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + compute a sum by iterating through the elements of this field and subtracting + "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. items: description: The weights of all of the matched WeightedPodAffinityTerm @@ -2845,7 +3016,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -2860,7 +3030,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -3028,7 +3197,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -3043,7 +3211,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -3449,6 +3616,20 @@ spec: defaultArchitecture: type: string ppc64le: + description: 'Deprecated: ppc64le architecture is no longer + supported.' + properties: + emulatedMachines: + items: + type: string + type: array + x-kubernetes-list-type: atomic + machineType: + type: string + ovmfPath: + type: string + type: object + s390x: properties: emulatedMachines: items: @@ -3511,6 +3692,108 @@ spec: type: object type: object x-kubernetes-map-type: atomic + changedBlockTrackingLabelSelectors: + description: |- + ChangedBlockTrackingLabelSelectors defines label selectors. VMs matching these selectors will have changed block tracking enabled. + Enabling changedBlockTracking is mandatory for performing storage-agnostic backups and incremental backups. + nullable: true + properties: + namespaceLabelSelector: + description: NamespaceSelector will enable changedBlockTracking + on all VMs running inside namespaces that match the label + selector. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + virtualMachineLabelSelector: + description: VirtualMachineSelector will enable changedBlockTracking + on all VMs that match the label selector. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object commonInstancetypesDeployment: description: CommonInstancetypesDeployment controls the deployment of common-instancetypes resources @@ -3581,6 +3864,14 @@ spec: https://kubevirt.io/user-guide/operations/node_overcommit/#node-cpu-allocation-ratio Defaults to 10 type: integer + disabledFeatureGates: + description: |- + DisabledFeatureGates specifies a list of experimental feature gates to disable. + A feature gate must not appear in both FeatureGates and DisabledFeatureGates. + items: + type: string + type: array + x-kubernetes-list-type: atomic diskVerification: description: DiskVerification holds container disks verification limits @@ -3595,11 +3886,13 @@ spec: - memoryLimit type: object featureGates: - description: FeatureGates is the list of experimental features - to enable. Defaults to none + description: |- + FeatureGates specifies a list of experimental feature gates to enable. Defaults to none. + A feature gate must not appear in both FeatureGates and DisabledFeatureGates. items: type: string type: array + x-kubernetes-list-type: atomic logVerbosity: description: LogVerbosity sets log verbosity level of various components @@ -3630,6 +3923,7 @@ spec: "see" 2% more memory than its parent pod. Values under 100 are effectively "undercommits". Overcommits can lead to memory exhaustion, which in turn can lead to crashes. Use carefully. Defaults to 100 + minimum: 10 type: integer minimumClusterTSCFrequency: description: |- @@ -3705,6 +3999,25 @@ spec: type: object type: object type: object + hypervisors: + description: Hypervisors holds information regarding the hypervisor + configurations supported on this cluster. + items: + description: HypervisorConfiguration holds information regarding + the hypervisor present on cluster nodes. + properties: + name: + description: |- + Name is the name of the hypervisor. + Supported values are: "kvm", "hyperv-direct". + enum: + - kvm + - hyperv-direct + type: string + type: object + maxItems: 1 + type: array + x-kubernetes-list-type: atomic imagePullPolicy: description: PullPolicy describes a policy for if/when to pull a container image @@ -3816,6 +4129,12 @@ spec: description: MediatedDevicesConfiguration holds information about MDEV types to be defined, if available properties: + enabled: + description: |- + Enable the creation and removal of mediated devices by virt-handler + Replaces the deprecated DisableMDEVConfiguration feature gate + Defaults to true + type: boolean mediatedDeviceTypes: items: type: string @@ -3948,8 +4267,16 @@ spec: UnsafeMigrationOverride allows live migrations to occur even if the compatibility check indicates the migration will be unsafe to the guest. Defaults to false type: boolean + utilityVolumesTimeout: + description: |- + UtilityVolumesTimeout is the maximum number of seconds a migration can wait in Pending state + for utility volumes to be detached. If utility volumes are still present after this timeout, + the migration will be marked as Failed. Defaults to 150 + format: int64 + type: integer type: object minCPUModel: + description: deprecated type: string network: description: NetworkConfiguration holds network options @@ -4122,6 +4449,18 @@ spec: type: array x-kubernetes-list-type: atomic type: object + roleAggregationStrategy: + description: |- + RoleAggregationStrategy controls whether RBAC cluster roles should be aggregated + to the default Kubernetes roles (admin, edit, view). + When set to "AggregateToDefault" (default) or not specified, the aggregate-to-* labels are added to the cluster roles. + When set to "Manual", the labels are not added, and roles will not be aggregated to the default roles. + Setting this field to "Manual" requires the OptOutRoleAggregation feature gate to be enabled. + This is an Alpha feature and subject to change. + enum: + - AggregateToDefault + - Manual + type: string seccompConfiguration: description: SeccompConfiguration holds Seccomp configuration for Kubevirt components @@ -4236,6 +4575,17 @@ spec: - VersionTLS13 type: string type: object + virtTemplateDeployment: + description: VirtTemplateDeployment controls the deployment of + virt-template components + nullable: true + properties: + enabled: + description: Enabled controls the deployment of virt-template + resources, defaults to True when feature gate is enabled. + nullable: true + type: boolean + type: object virtualMachineInstancesPerNode: type: integer virtualMachineOptions: @@ -4679,7 +5029,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -4694,7 +5043,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -4862,7 +5210,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -4877,7 +5224,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -4971,8 +5317,8 @@ spec: most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + compute a sum by iterating through the elements of this field and subtracting + "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. items: description: The weights of all of the matched WeightedPodAffinityTerm @@ -5043,7 +5389,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -5058,7 +5403,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -5226,7 +5570,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -5241,7 +5584,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -5760,7 +6102,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -5775,7 +6116,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -5943,7 +6283,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -5958,7 +6297,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -6052,8 +6390,8 @@ spec: most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + compute a sum by iterating through the elements of this field and subtracting + "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. items: description: The weights of all of the matched WeightedPodAffinityTerm @@ -6124,7 +6462,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -6139,7 +6476,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -6307,7 +6643,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -6322,7 +6657,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -6626,14 +6960,20 @@ rules: resourceNames: - kubevirt-ca - kubevirt-export-ca + - kubevirt-backup-ca - kubevirt-virt-handler-certs - kubevirt-virt-handler-server-certs + - kubevirt-virt-handler-migration-client-certs + - kubevirt-virt-handler-vsock-client-certs - kubevirt-operator-certs - kubevirt-virt-api-certs - kubevirt-controller-certs - kubevirt-exportproxy-certs - kubevirt-synchronization-controller-certs - kubevirt-synchronization-controller-server-certs + - kubevirt-virt-template-api-certs + - kubevirt-virt-template-webhook-certs + - kubevirt-virt-template-controller-metrics-certs resources: - secrets verbs: @@ -6801,7 +7141,6 @@ rules: - watch - patch - update - - patch - apiGroups: - "" resources: @@ -6964,6 +7303,45 @@ rules: - list - watch - patch +- apiGroups: + - template.kubevirt.io + resources: + - virtualmachinetemplates + - virtualmachinetemplaterequests + verbs: + - create + - delete + - deletecollection + - get + - list + - patch + - update + - watch +- apiGroups: + - template.kubevirt.io + resources: + - virtualmachinetemplates/status + - virtualmachinetemplaterequests/status + verbs: + - get + - patch +- apiGroups: + - template.kubevirt.io + resources: + - virtualmachinetemplates/finalizers + - virtualmachinetemplaterequests/finalizers + verbs: + - update +- apiGroups: + - template.kubevirt.io + resources: + - virtualmachinetemplaterequests/source + verbs: + - create +- nonResourceURLs: + - /metrics + verbs: + - get - apiGroups: - "" resources: @@ -7055,6 +7433,22 @@ rules: - get - list - watch +- apiGroups: + - backup.kubevirt.io + resources: + - virtualmachinebackups + verbs: + - get + - list + - watch +- apiGroups: + - backup.kubevirt.io + resources: + - virtualmachinebackuptrackers + verbs: + - get + - list + - watch - apiGroups: - cdi.kubevirt.io resources: @@ -7099,6 +7493,12 @@ rules: - create - list - get +- apiGroups: + - "" + resources: + - nodes + verbs: + - get - apiGroups: - "" resources: @@ -7238,6 +7638,33 @@ rules: - update - delete - patch +- apiGroups: + - backup.kubevirt.io + resources: + - virtualmachinebackups + - virtualmachinebackups/status + - virtualmachinebackups/finalizers + verbs: + - get + - list + - watch + - create + - update + - delete + - patch +- apiGroups: + - backup.kubevirt.io + resources: + - virtualmachinebackuptrackers + - virtualmachinebackuptrackers/status + verbs: + - get + - list + - watch + - create + - update + - delete + - patch - apiGroups: - pool.kubevirt.io resources: @@ -7272,6 +7699,8 @@ rules: - virtualmachines/stop - virtualmachineinstances/addvolume - virtualmachineinstances/removevolume + - virtualmachineinstances/backup + - virtualmachineinstances/redefine-checkpoint - virtualmachineinstances/freeze - virtualmachineinstances/unfreeze - virtualmachineinstances/reset @@ -7286,12 +7715,6 @@ rules: - '*' verbs: - '*' -- apiGroups: - - k8s.cni.cncf.io - resources: - - network-attachment-definitions - verbs: - - get - apiGroups: - apiextensions.k8s.io resources: @@ -7395,12 +7818,19 @@ rules: - list - watch - get +- apiGroups: + - k8s.cni.cncf.io + resources: + - network-attachment-definitions + verbs: + - get - apiGroups: - kubevirt.io resources: - virtualmachineinstances verbs: - update + - patch - list - watch - apiGroups: @@ -7451,6 +7881,21 @@ rules: - get - list - watch +- apiGroups: + - backup.kubevirt.io + resources: + - virtualmachinebackuptrackers + - virtualmachinebackuptrackers/status + verbs: + - list + - watch + - patch +- apiGroups: + - apps + resources: + - controllerrevisions + verbs: + - get - apiGroups: - export.kubevirt.io resources: @@ -7555,6 +8000,7 @@ rules: - virtualmachineinstances/reset - virtualmachineinstances/sev/setupsession - virtualmachineinstances/sev/injectlaunchsecret + - virtualmachineinstances/evacuate/cancel verbs: - update - apiGroups: @@ -7573,6 +8019,7 @@ rules: - virtualmachines/addvolume - virtualmachines/removevolume - virtualmachines/memorydump + - virtualmachines/evacuate/cancel verbs: - update - apiGroups: @@ -7620,6 +8067,20 @@ rules: - list - watch - deletecollection +- apiGroups: + - backup.kubevirt.io + resources: + - virtualmachinebackups + - virtualmachinebackuptrackers + verbs: + - get + - delete + - create + - update + - patch + - list + - watch + - deletecollection - apiGroups: - export.kubevirt.io resources: @@ -7688,7 +8149,6 @@ rules: resources: - virtualmachineinstances/console - virtualmachineinstances/vnc - - virtualmachineinstances/vnc/screenshot - virtualmachineinstances/portforward - virtualmachineinstances/guestosinfo - virtualmachineinstances/filesystemlist @@ -7713,6 +8173,7 @@ rules: - virtualmachineinstances/reset - virtualmachineinstances/sev/setupsession - virtualmachineinstances/sev/injectlaunchsecret + - virtualmachineinstances/evacuate/cancel verbs: - update - apiGroups: @@ -7731,6 +8192,7 @@ rules: - virtualmachines/addvolume - virtualmachines/removevolume - virtualmachines/memorydump + - virtualmachines/evacuate/cancel verbs: - update - apiGroups: @@ -7776,6 +8238,19 @@ rules: - patch - list - watch +- apiGroups: + - backup.kubevirt.io + resources: + - virtualmachinebackups + - virtualmachinebackuptrackers + verbs: + - get + - delete + - create + - update + - patch + - list + - watch - apiGroups: - export.kubevirt.io resources: @@ -7890,6 +8365,15 @@ rules: - get - list - watch +- apiGroups: + - backup.kubevirt.io + resources: + - virtualmachinebackups + - virtualmachinebackuptrackers + verbs: + - get + - list + - watch - apiGroups: - export.kubevirt.io resources: @@ -8011,10 +8495,26 @@ spec: labels: kubevirt.io: virt-operator name: virt-operator + np.kubevirt.io/allow-access-cluster-services: "true" prometheus.kubevirt.io: "true" name: virt-operator spec: affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - preference: + matchExpressions: + - key: node-role.kubernetes.io/worker + operator: DoesNotExist + weight: 100 + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: node-role.kubernetes.io/control-plane + operator: Exists + - matchExpressions: + - key: node-role.kubernetes.io/master + operator: Exists podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: @@ -8036,14 +8536,14 @@ spec: - virt-operator env: - name: VIRT_OPERATOR_IMAGE - value: quay.io/kubevirt/virt-operator:v1.6.3 + value: quay.io/kubevirt/virt-operator:v1.8.2 - name: WATCH_NAMESPACE valueFrom: fieldRef: fieldPath: metadata.annotations['olm.targetNamespaces'] - name: KUBEVIRT_VERSION - value: v1.6.3 - image: quay.io/kubevirt/virt-operator:v1.6.3 + value: v1.8.2 + image: quay.io/kubevirt/virt-operator:v1.8.2 imagePullPolicy: IfNotPresent livenessProbe: httpGet: @@ -8096,6 +8596,12 @@ spec: tolerations: - key: CriticalAddonsOnly operator: Exists + - effect: NoSchedule + key: node-role.kubernetes.io/control-plane + operator: Exists + - effect: NoSchedule + key: node-role.kubernetes.io/master + operator: Exists volumes: - name: kubevirt-operator-certs secret: @@ -8103,4 +8609,4 @@ spec: secretName: kubevirt-operator-certs - emptyDir: {} name: profile-data ---- +--- \ No newline at end of file