Create kubevirtbmc packs 0.4.1, 0.5.1, 0.6.0

[nctiggy]

Purpose

Adds packs for KubeVirtBMC, which provides out-of-band management for KubeVirt virtual machines via IPMI and Redfish. It exposes each VM through the same interfaces you would use against a physical server's BMC — power on/off/reset, set boot device, attach virtual media — so bare-metal provisioning tooling that has no knowledge of Kubernetes (Tinkerbell, Harvester Seeder, MAAS, Ironic) can drive VMs directly.

This pairs naturally with the Virtual Machine Orchestrator pack: VMO runs the VMs, KubeVirtBMC makes them look like physical hosts to a provisioning system.

Three versions, the latest patch of each of the last three minor lines of the upstream chart at https://charts.kubevirtbmc.io:

Pack	Chart	App	Images
kubevirtbmc-0.4.1	0.4.1	v0.7.1	starbops/virtbmc-controller, starbops/virtbmc
kubevirtbmc-0.5.1	0.5.1	v0.8.1	starbops/virtbmc-controller, starbops/virtbmc
kubevirtbmc-0.6.0	0.6.0	v0.9.0	kubevirtbmc/virtbmc-controller, kubevirtbmc/virtbmc

Packaging notes

Two images per pack. The chart only references the controller, but the controller creates one virtbmc agent pod per VirtualMachineBMC at runtime. The agent image is listed in pack.content.images so airgap mirroring picks it up.

Image org changed at chart 0.6.0 — starbops/* through 0.5.1, kubevirtbmc/* from 0.6.0. Handled per pack and called out in the READMEs for anyone mirroring across that boundary.

Namespace is pinned to kubevirtbmc-system. The controller hardcodes that namespace internally, so installing elsewhere leaves it unable to manage its own resources.

Required dependency on virtual-machine-orchestrator >= 4.8.3. KubeVirtBMC's controller watches kubevirt.io VirtualMachine and VirtualMachineInstance resources. Without those CRDs the manager fails cache sync after a two-minute timeout and exits 1, so the pod crashloops. The constraint makes Palette reject such a profile up front rather than deploying into a crashloop.

4.8.3 is the floor because it is the first VMO release shipping KubeVirt >= 1.6.0, which is what KubeVirtBMC requires:

VMO	KubeVirt
4.10.1	v1.8.4
4.9.1	v1.7.0
4.8.3	v1.6.3 — first that qualifies
4.8.2	v1.5.2
4.7.5	v1.5.2

VMO 4.8.3 through 4.9.9 are present in the public registry, so the constraint is satisfiable outside the Spectro-internal registries.

No cert-manager dependency, though the chart hard-requires it — it unconditionally creates a cert-manager Issuer/Certificate and the webhooks rely on cert-manager.io/inject-ca-from for CA injection. Palette installs and manages cert-manager on its clusters, so a pack dependency would force a redundant layer. It stays documented in the READMEs since it still applies outside Palette.

Scenarios validated

Pack 0.6.0 was pushed to an OCI pack registry, added to a cluster profile, and applied to a Palette-managed k3s v1.34.9 cluster.

Confirmed on-cluster:

• Helm release reports kubevirtbmc-0.6.0 / v0.9.0 — pack values flow through intact
• Namespace kubevirtbmc-system created
• CRD virtualmachinebmcs.bmc.kubevirt.io registered, carrying the 0.6.0 schema (spec.ipmi and status.bootOverride both present)
• Controller image resolves to kubevirtbmc/virtbmc-controller:v0.9.0, confirming the org rename is handled
• Both cert-manager Certificates and the Issuer reach READY=True
• Mutating and validating webhook configurations registered
• ServiceAccount, RBAC, metrics Service and webhook Service created
• Leader election acquired

That cluster deliberately had no KubeVirt, and the controller crashlooped exactly as expected:

ERROR controller-runtime.source.Kind  if kind is a CRD, it should be installed before calling Start
  {"kind": "VirtualMachine.kubevirt.io",
   "error": "no matches for kind \"VirtualMachine\" in version \"kubevirt.io/v1\""}

That result is what motivated the required VMO dependency. Not yet validated: a run with VMO present, which is the case where the controller should stay healthy. Happy to add that result before merge if reviewers want it.

Repo validators (validate-packs.sh, validate-values.sh) pass for all three packs, including crane resolution of all six images. Each pack's values also render byte-identical to the upstream chart defaults.

Notes for reviewers

The IPMI simulator became opt-in in chart 0.6.0 (spec.ipmi.enabled: true); before that it was always on. Anyone upgrading across that boundary silently loses UDP 623 while Redfish keeps working. Documented in the Upgrade section of the 0.6.0 README.

Helm does not upgrade CRDs shipped in a chart's crds/ directory, and VirtualMachineBMC gained fields across these releases, so the READMEs include the manual kubectl apply for the CRD when upgrading an existing install.