Changelog v1.11.0

.dmtlint.yaml

@@ -13,25 +13,15 @@ linters-settings:
         - "spec.versions[0].schema.openAPIV3Schema.properties.spec.properties.contentType"
   rbac:
     exclude-rules:
-      # We exclude RBAC rules for virt-operator and cdi-operator because they create ClusterRoles and ClusterRoleBindings with wildcards.
-      # If we remove wildcard, virt-operator and cdi-operator will be unable to create them, as they do not have wildcard permissions themselves.
+      # We exclude RBAC rules for virt-operator because it creates ClusterRoles and ClusterRoleBindings with wildcards.
+      # If we remove wildcard, virt-operator will be unable to create them, as it does not have wildcard permissions itself.
       wildcards:
         - kind: ClusterRole
           name: d8:virtualization:kubevirt-operator
-        - kind: ClusterRole
-          name: d8:containerized-data-importer:cdi-operator
 
-      # We exclude RBAC rules for CDI and Kubevirt resources because they are used by upstream deployments.
+      # We exclude RBAC rules for Kubevirt resources because they are used by upstream deployments.
       # Changing these rules will require patching upstream code.
       placement:
-        - kind: ClusterRoleBinding
-          name: d8:containerized-data-importer:cdi-operator
-        - kind: ServiceAccount
-          name: cdi-operator
-        - kind: Role
-          name: cdi-operator
-        - kind: RoleBinding
-          name: cdi-operator
         - kind: ServiceAccount
           name: kubevirt-operator
         - kind: Role
@@ -40,10 +30,7 @@ linters-settings:
           name: kubevirt-operator
         - kind: RoleBinding
           name: virt-operator
-        - kind: ClusterRole
-          name: d8:containerized-data-importer:cdi-operator
       binding-subject:
-        - cdi-sa
         - kubevirt-internal-virtualization-controller
         - kubevirt-internal-virtualization-handler
   module:
@@ -52,8 +39,8 @@ linters-settings:
         directories:
           - tools/addlicense/testdata
           - test/performance/ssh
-          - test/e2e/legacy/testdata/sshkeys
           - images/dvcr-artifact/staging
+          - images/pvc-artifact/staging
   container:
     exclude-rules:
       readiness-probe:
@@ -64,3 +51,65 @@ linters-settings:
         - kind: Deployment
           name: dvcr
           container: dvcr-garbage-collection
+  no-cyrillic:
+    exclude-rules:
+      files:
+        - templates/security-events.yaml # Ru information for docs
+  templates:
+    exclude-rules:
+      # These mount-points.yaml directories pre-create mount points for containerd strict mode.
+      # They are consumed by pods that are NOT rendered from this module's Helm templates:
+      # virt-launcher (created per-VM by KubeVirt at runtime), dvcr importer/uploader (created on
+      # demand by the controllers), and the virt-* components deployed by virt-operator.
+      # The mount-points linter only inspects Helm pod controllers, so it cannot see these
+      # mountPaths and reports false positives.
+      mount-points:
+        - /auth
+        - /certs
+        - /data
+        - /dev/bus/usb
+        - /dvcr-auth
+        - /dvcr-src-auth
+        - /etc/docker/registry
+        - /etc/libvirt
+        - /etc/podinfo
+        - /etc/ssl/docker
+        - /etc/virt-api/certificates
+        - /etc/virt-controller/certificates
+        - /etc/virt-controller/exportca
+        - /etc/virt-handler/clientcertificates
+        - /etc/virt-handler/servercertificates
+        - /etc/virt-operator/certificates
+        - /etc/virtualization-api-proxy/certificates
+        - /etc/virtualization-api/certificates
+        - /etc/virtualization-audit/certificates
+        - /init/usr/bin
+        - /kubeconfig.local
+        - /opt
+        - /path
+        - /pods
+        - /profile-data
+        - /proxycerts
+        - /run/cilium
+        - /run/kubevirt
+        - /run/kubevirt-libvirt-runtimes
+        - /run/kubevirt-private
+        - /scratch
+        - /shared
+        - /tmp/k8s-webhook-server/serving-certs
+        - /usr/lib/modules
+        - /var/cache/libvirt
+        - /var/lib/kubelet/device-plugins
+        - /var/lib/kubelet/plugins
+        - /var/lib/kubelet/plugins_registry
+        - /var/lib/kubelet/pods
+        - /var/lib/kubevirt
+        - /var/lib/kubevirt-node-labeller
+        - /var/lib/libvirt
+        - /var/lib/libvirt/qemu
+        - /var/lib/libvirt/qemu/nvram
+        - /var/lib/libvirt/swtpm
+        - /var/lib/registry
+        - /var/lib/swtpm-localca
+        - /var/log/libvirt
+        - /var/run/cdi

.github/CODEOWNERS

@@ -1,14 +1,14 @@
 *                                                         @Isteb4k
 /.github/                                                 @universal-itengineer @nevermarine
 
-/crds/                                                    @fl64 @prismagod @goganat
-/docs/                                                    @fl64 @prismagod @goganat
-/openapi/                                                 @fl64 @prismagod @goganat
+/crds/                                                    @fl64 @z9r5 @goganat
+/docs/                                                    @fl64 @z9r5 @goganat
+/openapi/                                                 @fl64 @z9r5 @goganat
 /monitoring/                                              @fl64 @Isteb4k
 /tests/                                                   @hardcoretime @danilrwx
 
 /images/                                                  @universal-itengineer @nevermarine
-/images/cdi-artifact/                                     @Isteb4k @yaroslavborbat @diafour
+/images/pvc-artifact/                                     @Isteb4k @yaroslavborbat @diafour
 /images/virt-artifact/                                    @Isteb4k @yaroslavborbat @diafour
 /images/dvcr-artifact/                                    @Isteb4k @yaroslavborbat @diafour
 /images/vm-route-forge/                                   @yaroslavborbat @diafour

.github/actions/milestone-changelog/action.yml

@@ -36,6 +36,7 @@ runs:
           vdsnapshot
           vmsnapshot
           vmrestore
+          vmpool
           disks
           vd
           images

.github/scripts/bash/check-and-rebuild/check-image-digests.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+
+# Copyright 2026 Flant JSC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Check that every component image referenced by a module tag is pullable.
+# Usage: check-image-digests.sh --repo <repo> --tag <tag>
+# Exit:  0 all pullable, 1 some missing, 2 module image not found.
+
+set -Eeuo pipefail
+
+repo=""
+tag=""
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --repo) repo="$2"; shift 2 ;;
+    --tag) tag="$2"; shift 2 ;;
+    *) echo "unknown argument: $1" >&2; exit 2 ;;
+  esac
+done
+[[ -n "$repo" && -n "$tag" ]] || { echo "usage: $0 --repo <repo> --tag <tag>" >&2; exit 2; }
+
+echo "[INFO] Repo ${repo}"
+echo "[INFO] Tag  ${tag}"
+
+if ! crane digest "${repo}:${tag}" >/dev/null 2>&1; then
+  echo "::error::module image ${repo}:${tag} not found"
+  exit 2
+fi
+
+digests="$(crane export "${repo}:${tag}" - | tar -Oxf - images_digests.json)"
+
+ok_images=()
+missing_images=()
+while read -r component digest; do
+  image="${repo}@${digest}"
+  if crane digest "$image" >/dev/null 2>&1; then
+    echo "✅ ${component}"
+    ok_images+=("$(printf '%-25s %s' "${component}:" "$image")")
+  else
+    echo "❌ ${component}"
+    missing_images+=("$(printf '%-25s %s' "${component}:" "$image")")
+  fi
+done < <(echo "${digests}" | jq -r 'to_entries[] | "\(.key) \(.value)"')
+
+echo "──────────────────────────────"
+if [[ ${#missing_images[@]} -eq 0 ]]; then
+  echo "🎉 All ${#ok_images[@]} component images are pullable"
+  exit 0
+fi
+
+echo "⚠️  Missing component images:"
+for img in "${missing_images[@]}"; do
+  echo "  - $img"
+done
+echo "Total missing: ${#missing_images[@]}"
+exit 1

.github/scripts/bash/check-and-rebuild/rebuild-broken-stages.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+
+# Copyright 2026 Flant JSC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Delete stale stages so the next werf build rebuilds broken component images.
+# Usage: rebuild-broken-stages.sh --repo <repo> --report <build-report.json>
+
+set -Eeuo pipefail
+
+repo=""
+report=""
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --repo) repo="$2"; shift 2 ;;
+    --report) report="$2"; shift 2 ;;
+    *) echo "unknown argument: $1" >&2; exit 2 ;;
+  esac
+done
+[[ -n "$repo" && -n "$report" ]] || { echo "usage: $0 --repo <repo> --report <file>" >&2; exit 2; }
+[[ -f "$report" ]] || { echo "::error::report ${report} not found"; exit 1; }
+
+# Warn (don't fail) if the tag is already gone.
+delete_tag() {
+  crane delete "${repo}:$1" && echo "  deleted ${repo}:$1" || echo "::warning::failed to delete $1"
+}
+
+# A GC'd component keeps a resolvable stage tag, so werf reuses the stage and
+# re-reports the dead digest. The dead digest can't be deleted, but the tag can:
+# drop every stage by tag so werf rebuilds and re-pushes a live image.
+while read -r img; do
+  final="$(jq -r --arg i "$img" '.Images[$i].DockerImageDigest // empty' "$report")"
+  [[ -n "$final" ]] || continue
+  crane digest "${repo}@${final}" >/dev/null 2>&1 && continue
+  echo "broken: ${img} — deleting its stages"
+  while read -r t; do
+    [[ -n "$t" ]] || continue
+    delete_tag "$t"
+  done < <(jq -r --arg i "$img" '.Images[$i].Stages[].DockerTag // empty' "$report")
+done < <(jq -r '.Images | to_entries[] | select(.value.Final == true) | .key' "$report")
+
+# Regenerate the digests chain so fresh component digests reach the module :tag.
+for img in images-digests prepare-bundle; do
+  t="$(jq -r --arg i "$img" '.Images[$i].DockerTag // empty' "$report")"
+  [[ -n "$t" ]] && delete_tag "$t" || echo "::warning::no tag for ${img} in report"
+done

.github/scripts/bash/e2e/cleanup-nightly-resources.sh

@@ -23,6 +23,10 @@ source "${SCRIPT_DIR}/common.sh"
 LABEL_SELECTOR="${LABEL_SELECTOR:-test=nightly-e2e}"
 KEEP_HOURS="${KEEP_HOURS:-47}"
 FRIDAY_KEEP_HOURS="${FRIDAY_KEEP_HOURS:-71}"
+# sds-elastic (Ceph) nested clusters are heavy, so they are torn down sooner (~1 day)
+# and are not granted the Friday extension. Matched by storage type in the resource name.
+ELASTIC_KEEP_HOURS="${ELASTIC_KEEP_HOURS:-23}"
+ELASTIC_NAME_PATTERN="${ELASTIC_NAME_PATTERN:-sds-elastic}"
 
 current_date_seconds="$(date -u +%s)"
 
@@ -35,20 +39,28 @@ collect_items_json() {
 
 should_keep() {
   local created_at="$1"
+  local name="$2"
   local resource_created_at_seconds
   local age_seconds
   local weekday_of_day
+  local keep_hours="${KEEP_HOURS}"
+  local friday_keep_hours="${FRIDAY_KEEP_HOURS}"
+
+  if [[ "${name}" == *"${ELASTIC_NAME_PATTERN}"* ]]; then
+    keep_hours="${ELASTIC_KEEP_HOURS}"
+    friday_keep_hours="${ELASTIC_KEEP_HOURS}"
+  fi
 
   resource_created_at_seconds="$(date -d "${created_at}" -u +%s)"
   age_seconds="$(( current_date_seconds - resource_created_at_seconds ))"
   weekday_of_day="$(date -d "${created_at}" -u +%u)"
 
-  if [ "${age_seconds}" -lt "$(( KEEP_HOURS * 3600 ))" ]; then
+  if [ "${age_seconds}" -lt "$(( keep_hours * 3600 ))" ]; then
     echo "keep"
     return 0
   fi
 
-  if [ "${weekday_of_day}" -eq 5 ] && [ "${age_seconds}" -lt "$(( FRIDAY_KEEP_HOURS * 3600 ))" ]; then
+  if [ "${weekday_of_day}" -eq 5 ] && [ "${age_seconds}" -lt "$(( friday_keep_hours * 3600 ))" ]; then
     echo "keep"
     return 0
   fi
@@ -69,7 +81,7 @@ cleanup_kind() {
     created_at="$(echo "${item}" | jq -r '.created_at')"
     [ -z "${name}" ] && continue
 
-    decision="$(should_keep "${created_at}")"
+    decision="$(should_keep "${created_at}" "${name}")"
     if [ "${decision}" = "keep" ]; then
       printf "%-63s %22s\n" "[INFO] Keep ${kind}/${name}:" "created_at ${created_at}"
       continue