Add Windows VMs vCPU overcommit prevention VAP #2535

jcanocan · 2025-09-26T10:27:47Z

What type of PR is this?

Feature

What this PR does / why we need it?

It is required to enable some sort of protection in Windows based VMs to prevent them to overcommit vCPUs. To achieve this, it is assumed that CPUmanager is enabled on, and only on, Windows Licensed nodes. This is due to the fact that, during the scheduling process, any VM with spec.domain.cpu.dedicatedCpuPlacement will be assigned to nodes with cpumanager feature enabled. Therefore, the scheduler will effectively assign those VMs to Windows Licensed nodes. Moreover, if the VM does not overcommit, vCPUs will be allowed to run.

This approach has the following drawbacks as it is:

All Windows VMs created with supported workflows will be required to no overcommit vCPUs.
It does not prevent users to manually create their own custom Windows VM manifest/preference and overcommit vCPUs.
User will be still allowed to schedule non-windows VMs overcommitting CPUs to Windows Licensed nodes.

Which Jira/Github issue(s) this PR fixes?

Fixes #

Special notes for your reviewer:

Pre-checks (if applicable):

Tested latest changes against a cluster
Included documentation changes with PR
If this is a new object that is not intended for the FedRAMP environment (if unsure, please reach out to team FedRAMP), please exclude it with:
```
matchExpressions:
- key: api.openshift.com/fedramp
  operator: NotIn
  values: ["true"]
```

app-sre-bot · 2025-09-26T10:27:51Z

Can one of the admins verify this patch?

openshift-ci · 2025-09-26T10:28:31Z

Hi @jcanocan. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

dominikholler · 2025-09-26T10:37:35Z

deploy/acm-policies/50-GENERATED-srep-vap-vcpu-overcommit.Policy.yaml

+                                        - virtualmachineinstances
+                            validations:
+                                - expression: has(object.spec.domain.cpu.dedicatedCpuPlacement) && object.spec.domain.cpu.dedicatedCpuPlacement == true
+                                  message: Windows VMIs require dedicated CPU placement. Set spec.domain.cpu.dedicatedCpuPlacement to true.


spec.domain.cpu.dedicatedCpuPlacement is quite low level. Can we point the user to an instancetype to use? If there is no instancetype available yet, let's create one

Yes, we can also follow that path. Great idea. In such case, the drawbacks will still apply. However, we will have a 100% supported way of creating Windows VMs, which is a nice advantage compared with my orginal proposal.

After thinking about this twice, if we want to follow this idea, we should force the user to pick up specific preferences for the supported Windows versions. We can include them in the common-instancetypes repo or here, whatever we find more appropriated. This will allow the user to have different windows sizes by using the different instance types we currently provide.

sounds worth a try!

Added an approximation of what it could look like, it is still required to add further preferences for all supported windows versions.

deploy/srep-vap/vcpu-overcommit/101-windows-10-vcpu-restrict.yaml

BraeTroutman · 2025-09-30T15:55:21Z

deploy/srep-vap/vcpu-overcommit/103-vcpu-overcommit-vapb.yaml

+spec:
+  policyName: "windows-vcpu-overcommit"
+  validationActions: [Deny]
+  matchResources:


should this key be set explicitly to a non-empty value or is the key with no value valid configuration?

Sorry for the late reply. No it does not, removed.

no worries! Thanks Javier

deploy/srep-vap/vcpu-overcommit/102-vcpu-overcommit-vap.yaml

deploy/srep-vap/vcpu-overcommit/103-vcpu-overcommit-vapb.yaml

deploy/acm-policies/50-GENERATED-srep-vap.Policy.yaml

jcanocan · 2025-10-03T08:04:36Z

@ksimon1 many thanks for your reviews! Much appreciated :)

openshift-ci · 2025-10-03T08:04:45Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: jcanocan
Once this PR has been reviewed and has the lgtm label, please assign robotmaxtron for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

ksimon1 · 2025-10-07T08:28:43Z

deploy/srep-vap/vcpu-overcommit/102-vcpu-overcommit-vap.yaml

+          object.metadata.annotations['kubevirt.io/preference-name'].lowerAscii().contains('dedicated')
+        )
+      message: "Windows VM are required to use *dedicated preferences."
+


missing new line at the end of file

Co-authored-by: Cursor AI Assistant <[email protected]> Signed-off-by: Javier Cano Cano <[email protected]>

openshift-ci bot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Sep 26, 2025

dominikholler reviewed Sep 26, 2025

View reviewed changes

jcanocan force-pushed the windows-vcpu-overcommit branch 2 times, most recently from 0ada4dc to 4954ab2 Compare September 26, 2025 11:40

dominikholler suggested changes Sep 26, 2025

View reviewed changes

jcanocan force-pushed the windows-vcpu-overcommit branch 2 times, most recently from 9ac0225 to 704e950 Compare September 26, 2025 11:53

BraeTroutman reviewed Sep 30, 2025

View reviewed changes

ksimon1 reviewed Oct 3, 2025

View reviewed changes

deploy/srep-vap/vcpu-overcommit/102-vcpu-overcommit-vap.yaml Outdated Show resolved Hide resolved

ksimon1 reviewed Oct 3, 2025

View reviewed changes

deploy/srep-vap/vcpu-overcommit/103-vcpu-overcommit-vapb.yaml Outdated Show resolved Hide resolved

ksimon1 reviewed Oct 3, 2025

View reviewed changes

deploy/acm-policies/50-GENERATED-srep-vap.Policy.yaml Outdated Show resolved Hide resolved

jcanocan force-pushed the windows-vcpu-overcommit branch from 704e950 to 611a5f8 Compare October 3, 2025 08:03

jcanocan marked this pull request as ready for review October 3, 2025 08:04

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Oct 3, 2025

openshift-ci bot requested review from ravitri and typeid October 3, 2025 08:06

ksimon1 reviewed Oct 7, 2025

View reviewed changes

Add Windows VMs vCPU overcommit prevention VAP

1241d17

Co-authored-by: Cursor AI Assistant <[email protected]> Signed-off-by: Javier Cano Cano <[email protected]>

jcanocan force-pushed the windows-vcpu-overcommit branch from 611a5f8 to 1241d17 Compare October 7, 2025 10:28

Uh oh!

Add Windows VMs vCPU overcommit prevention VAP #2535

Are you sure you want to change the base?

Add Windows VMs vCPU overcommit prevention VAP #2535

Uh oh!

Conversation

jcanocan commented Sep 26, 2025

What type of PR is this?

What this PR does / why we need it?

Which Jira/Github issue(s) this PR fixes?

Special notes for your reviewer:

Pre-checks (if applicable):

Uh oh!

app-sre-bot commented Sep 26, 2025

Uh oh!

openshift-ci bot commented Sep 26, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jcanocan commented Oct 3, 2025

Uh oh!

openshift-ci bot commented Oct 3, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants