Skip to content

Commit 611a5f8

Browse files
jcanocanCursor AI Assistant
jcanocan
and
Cursor AI Assistant
committed
Add Windows VMs vCPU overcommit prevention VAP
Co-authored-by: Cursor AI Assistant <[email protected]> Signed-off-by: Javier Cano Cano <[email protected]>
1 parent 3bf4ac4 commit 611a5f8

11 files changed

+837
-0
lines changed

‎deploy/acm-policies/50-GENERATED-srep-vap-vcpu-overcommit.Policy.yaml‎

Lines changed: 178 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,178 @@
1+
---
2+
apiVersion: policy.open-cluster-management.io/v1
3+
kind: Policy
4+
metadata:
5+
annotations:
6+
policy.open-cluster-management.io/categories: CM Configuration Management
7+
policy.open-cluster-management.io/controls: CM-2 Baseline Configuration
8+
policy.open-cluster-management.io/standards: NIST SP 800-53
9+
name: srep-vap-vcpu-overcommit
10+
namespace: openshift-acm-policies
11+
spec:
12+
disabled: false
13+
policy-templates:
14+
- objectDefinition:
15+
apiVersion: policy.open-cluster-management.io/v1
16+
kind: ConfigurationPolicy
17+
metadata:
18+
name: srep-vap-vcpu-overcommit
19+
spec:
20+
evaluationInterval:
21+
compliant: 2h
22+
noncompliant: 45s
23+
object-templates:
24+
- complianceType: mustonlyhave
25+
metadataComplianceType: musthave
26+
objectDefinition:
27+
apiVersion: instancetype.kubevirt.io/v1beta1
28+
kind: VirtualMachineClusterPreference
29+
metadata:
30+
annotations:
31+
iconClass: icon-windows
32+
openshift.io/display-name: Microsoft Windows 11 (virtio dedicated vCPU)
33+
openshift.io/documentation-url: https://access.redhat.com
34+
openshift.io/provider-display-name: Red Hat
35+
openshift.io/support-url: https://access.redhat.com
36+
tags: hidden,kubevirt,windows
37+
labels:
38+
instancetype.kubevirt.io/os-type: windows
39+
instancetype.kubevirt.io/vendor: redhat.com
40+
name: windows.11.virtio.dedicated
41+
spec:
42+
annotations:
43+
vm.kubevirt.io/os: windows
44+
clock:
45+
preferredClockOffset:
46+
utc: {}
47+
preferredTimer:
48+
hpet:
49+
present: false
50+
hyperv: {}
51+
pit:
52+
tickPolicy: delay
53+
rtc:
54+
tickPolicy: catchup
55+
cpu:
56+
dedicatedCpuPlacement: true
57+
preferredCPUTopology: sockets
58+
devices:
59+
preferredAutoattachInputDevice: true
60+
preferredDiskBus: virtio
61+
preferredInputBus: virtio
62+
preferredInputType: tablet
63+
preferredInterfaceModel: virtio
64+
preferredTPM:
65+
persistent: true
66+
features:
67+
preferredAcpi: {}
68+
preferredApic: {}
69+
preferredHyperv:
70+
frequencies: {}
71+
ipi: {}
72+
reenlightenment: {}
73+
relaxed: {}
74+
reset: {}
75+
runtime: {}
76+
spinlocks:
77+
spinlocks: 8191
78+
synic: {}
79+
synictimer:
80+
direct: {}
81+
tlbflush: {}
82+
vapic: {}
83+
vpindex: {}
84+
preferredSmm: {}
85+
firmware:
86+
preferredEfi:
87+
persistent: true
88+
secureBoot: true
89+
preferredTerminationGracePeriodSeconds: 3600
90+
requirements:
91+
cpu:
92+
guest: 2
93+
memory:
94+
guest: 4Gi
95+
- complianceType: mustonlyhave
96+
metadataComplianceType: musthave
97+
objectDefinition:
98+
apiVersion: admissionregistration.k8s.io/v1
99+
kind: ValidatingAdmissionPolicy
100+
metadata:
101+
name: windows-vcpu-overcommit
102+
spec:
103+
failurePolicy: Fail
104+
matchConditions:
105+
- expression: (('kubevirt.io/preference-name' in object.metadata.annotations) && (object.metadata.annotations['kubevirt.io/preference-name'].lowerAscii().contains('windows'))) || (('kubevirt.io/cluster-preference-name' in object.metadata.annotations) && (object.metadata.annotations['kubevirt.io/preference-name'].lowerAscii().contains('windows'))) || (('vm.kubevirt.io/os' in object.metadata.annotations) && (object.metadata.annotations['vm.kubevirt.io/os'].lowerAscii().contains('windows')))
106+
name: windows-vcpu-overcommit
107+
matchConstraints:
108+
resourceRules:
109+
- apiGroups:
110+
- kubevirt.io
111+
apiVersions:
112+
- '*'
113+
operations:
114+
- CREATE
115+
- UPDATE
116+
resources:
117+
- virtualmachineinstances
118+
validations:
119+
- expression: |-
120+
(
121+
'kubevirt.io/cluster-preference-name' in object.metadata.annotations &&
122+
object.metadata.annotations['kubevirt.io/cluster-preference-name'].lowerAscii().contains('dedicated')
123+
) ||
124+
(
125+
'kubevirt.io/preference-name' in object.metadata.annotations &&
126+
object.metadata.annotations['kubevirt.io/preference-name'].lowerAscii().contains('dedicated')
127+
)
128+
message: Windows VM are required to use *dedicated preferences.
129+
- complianceType: mustonlyhave
130+
metadataComplianceType: musthave
131+
objectDefinition:
132+
apiVersion: admissionregistration.k8s.io/v1
133+
kind: ValidatingAdmissionPolicyBinding
134+
metadata:
135+
name: windows-vcpu-overcommit-binding
136+
spec:
137+
policyName: windows-vcpu-overcommit
138+
validationActions:
139+
- Deny
140+
pruneObjectBehavior: DeleteIfCreated
141+
remediationAction: enforce
142+
severity: low
143+
remediationAction: enforce
144+
---
145+
apiVersion: apps.open-cluster-management.io/v1
146+
kind: PlacementRule
147+
metadata:
148+
name: placement-srep-vap-vcpu-overcommit
149+
namespace: openshift-acm-policies
150+
spec:
151+
clusterSelector:
152+
matchExpressions:
153+
- key: hypershift.open-cluster-management.io/hosted-cluster
154+
operator: In
155+
values:
156+
- "true"
157+
- key: openshiftVersion-major-minor
158+
operator: NotIn
159+
values:
160+
- "4.14"
161+
- "4.15"
162+
- "4.16"
163+
- "4.17"
164+
- "4.18"
165+
---
166+
apiVersion: policy.open-cluster-management.io/v1
167+
kind: PlacementBinding
168+
metadata:
169+
name: binding-srep-vap-vcpu-overcommit
170+
namespace: openshift-acm-policies
171+
placementRef:
172+
apiGroup: apps.open-cluster-management.io
173+
kind: PlacementRule
174+
name: placement-srep-vap-vcpu-overcommit
175+
subjects:
176+
- apiGroup: policy.open-cluster-management.io
177+
kind: Policy
178+
name: srep-vap-vcpu-overcommit

‎deploy/srep-vap/config.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
deploymentMode: "SelectorSyncSet"
2+
selectorSyncSet:
3+
resourceApplyMode: "Sync"

‎deploy/srep-vap/vcpu-overcommit/101-windows-11-vcpu-restrict.yaml‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
apiVersion: instancetype.kubevirt.io/v1beta1
2+
kind: VirtualMachineClusterPreference
3+
metadata:
4+
annotations:
5+
iconClass: icon-windows
6+
openshift.io/display-name: Microsoft Windows 11 (virtio dedicated vCPU)
7+
openshift.io/documentation-url: https://access.redhat.com
8+
openshift.io/provider-display-name: Red Hat
9+
openshift.io/support-url: https://access.redhat.com
10+
tags: hidden,kubevirt,windows
11+
labels:
12+
instancetype.kubevirt.io/os-type: windows
13+
instancetype.kubevirt.io/vendor: redhat.com
14+
name: windows.11.virtio.dedicated
15+
spec:
16+
annotations:
17+
vm.kubevirt.io/os: windows
18+
clock:
19+
preferredClockOffset:
20+
utc: {}
21+
preferredTimer:
22+
hpet:
23+
present: false
24+
hyperv: {}
25+
pit:
26+
tickPolicy: delay
27+
rtc:
28+
tickPolicy: catchup
29+
cpu:
30+
preferredCPUTopology: sockets
31+
dedicatedCpuPlacement: true
32+
devices:
33+
preferredAutoattachInputDevice: true
34+
preferredDiskBus: virtio
35+
preferredInputBus: virtio
36+
preferredInputType: tablet
37+
preferredInterfaceModel: virtio
38+
preferredTPM:
39+
persistent: true
40+
features:
41+
preferredAcpi: {}
42+
preferredApic: {}
43+
preferredHyperv:
44+
frequencies: {}
45+
ipi: {}
46+
reenlightenment: {}
47+
relaxed: {}
48+
reset: {}
49+
runtime: {}
50+
spinlocks:
51+
spinlocks: 8191
52+
synic: {}
53+
synictimer:
54+
direct: {}
55+
tlbflush: {}
56+
vapic: {}
57+
vpindex: {}
58+
preferredSmm: {}
59+
firmware:
60+
preferredEfi:
61+
persistent: true
62+
secureBoot: true
63+
preferredTerminationGracePeriodSeconds: 3600
64+
requirements:
65+
cpu:
66+
guest: 2
67+
memory:
68+
guest: 4Gi

‎deploy/srep-vap/vcpu-overcommit/102-vcpu-overcommit-vap.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
apiVersion: admissionregistration.k8s.io/v1
2+
kind: ValidatingAdmissionPolicy
3+
metadata:
4+
name: windows-vcpu-overcommit
5+
spec:
6+
failurePolicy: Fail
7+
matchConditions:
8+
- expression: (('kubevirt.io/preference-name' in object.metadata.annotations) &&
9+
(object.metadata.annotations['kubevirt.io/preference-name'].lowerAscii().contains('windows'))) ||
10+
(('kubevirt.io/cluster-preference-name' in object.metadata.annotations) &&
11+
(object.metadata.annotations['kubevirt.io/preference-name'].lowerAscii().contains('windows'))) ||
12+
(('vm.kubevirt.io/os' in object.metadata.annotations) &&
13+
(object.metadata.annotations['vm.kubevirt.io/os'].lowerAscii().contains('windows')))
14+
name: windows-vcpu-overcommit
15+
matchConstraints:
16+
resourceRules:
17+
- apiGroups: ["kubevirt.io"]
18+
apiVersions: ["*"]
19+
operations: ["CREATE", "UPDATE"]
20+
resources: ["virtualmachineinstances"]
21+
validations:
22+
- expression: |-
23+
(
24+
'kubevirt.io/cluster-preference-name' in object.metadata.annotations &&
25+
object.metadata.annotations['kubevirt.io/cluster-preference-name'].lowerAscii().contains('dedicated')
26+
) ||
27+
(
28+
'kubevirt.io/preference-name' in object.metadata.annotations &&
29+
object.metadata.annotations['kubevirt.io/preference-name'].lowerAscii().contains('dedicated')
30+
)
31+
message: "Windows VM are required to use *dedicated preferences."
32+

‎deploy/srep-vap/vcpu-overcommit/103-vcpu-overcommit-vapb.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
2+
apiVersion: admissionregistration.k8s.io/v1
3+
kind: ValidatingAdmissionPolicyBinding
4+
metadata:
5+
name: "windows-vcpu-overcommit-binding"
6+
spec:
7+
policyName: "windows-vcpu-overcommit"
8+
validationActions: [Deny]

‎deploy/srep-vap/vcpu-overcommit/README.md‎

Whitespace-only changes.

‎deploy/srep-vap/vcpu-overcommit/config.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
deploymentMode: Policy
2+
clusterSelectors:
3+
matchExpressions:
4+
- key: hypershift.open-cluster-management.io/hosted-cluster
5+
operator: In
6+
values:
7+
- "true"
8+
- key: openshiftVersion-major-minor
9+
operator: NotIn
10+
values:
11+
- "4.14"
12+
- "4.15"
13+
- "4.16"
14+
- "4.17"
15+
- "4.18"
16+

0 commit comments

Comments
 (0)