Skip to content

fix(vm): secureboot vm no default storageclass#2614

Open
danilrwx wants to merge 2 commits into
mainfrom
fix/secureboot-vm-no-default-storageclass
Open

fix(vm): secureboot vm no default storageclass#2614
danilrwx wants to merge 2 commits into
mainfrom
fix/secureboot-vm-no-default-storageclass

Conversation

@danilrwx

@danilrwx danilrwx commented Jul 8, 2026

Copy link
Copy Markdown
Contributor

Description

A SecureBoot virtual machine stores its firmware state in a persistent volume, which needs a StorageClass. KubeVirt only looked at the cluster-wide default StorageClass, so on clusters that rely on the module's own default storage class for virtual disks the volume could not be created and the VM never started — with no reason shown on the VirtualMachine.

Now that module default storage class is also used for the firmware state, and if no storage class can be resolved anywhere, the VirtualMachine reports a clear reason instead of staying pending silently.

Why do we need it, and what problem does it solve?

Enabling SecureBoot without a cluster-wide default StorageClass was a dead end: the VM never started and nothing on the VirtualMachine explained why. Now it works when the module has a default disk storage class, and explains itself when a storage class truly cannot be found.

What is the expected result?

  • Module default storage class for virtual disks is set, no cluster-wide default → a SecureBoot VM starts.
  • No default storage class anywhere → the VM's Running condition turns False with a message ending in no default storage class found, and starts automatically once one appears.
  • Non-SecureBoot VMs are unaffected.

Checklist

  • The code is covered by unit tests.
  • e2e tests passed.
  • Documentation updated according to the changes.
  • Changes were tested in the Kubernetes cluster manually.

Changelog entries

section: vm
type: fix
summary: "SecureBoot virtual machines start using the module default storage class, and report a clear reason when no storage class is available instead of staying pending."

@danilrwx danilrwx force-pushed the fix/secureboot-vm-no-default-storageclass branch from 222514e to 42aff7c Compare July 8, 2026 16:09
@danilrwx danilrwx marked this pull request as ready for review July 8, 2026 16:10
@danilrwx danilrwx added this to the v1.10.0 milestone Jul 8, 2026
danilrwx added 2 commits July 8, 2026 19:00
…torageClass

SecureBoot VMs need a StorageClass for the persistent NVRAM backend-storage
PVC. When the module has a default storage class for virtual disks but the
cluster has no default k8s StorageClass, KubeVirt could not resolve one and
the VM failed to start.

Render configuration.vmStateStorageClass from virtualDisks.defaultStorageClassName
so backend-storage resolves the module default when set.

Signed-off-by: Daniil Antoshin <daniil.antoshin@flant.com>
…ult storage class

SecureBoot VMs set EFI.Persistent=true, so KubeVirt provisions a backend
storage PVC for NVRAM. Without a default StorageClass its creation fails
with "no default storage class found" on the internal VMI Synchronized
condition (reason FailedBackendStorageCreate), which the VM controller did
not recognize — the VM stalled in Starting with no explanation.

Recognize the FailedBackendStorageCreate reason so the VM moves to Pending
and relays the underlying message on its Running condition.

Signed-off-by: Daniil Antoshin <daniil.antoshin@flant.com>
@danilrwx danilrwx force-pushed the fix/secureboot-vm-no-default-storageclass branch from 42aff7c to 277d228 Compare July 8, 2026 17:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant