KubeVirt Installation¶

Prerequisites

StarlingX is up and running.
System is Alarm free.
```
$ fm alarm-list
```

Procedure

Complete the following steps to install KubeVirt.

Upload and apply the KubeVirt package (Helm).

~(keystone_admin)$ system application-upload /usr/local/share/applications/helm/kubevirt-app-26.10-62.tgz
~(keystone_admin)$ system application-apply kubevirt-app
~(keystone_admin)$ system application-show kubevirt-app
~(keystone_admin)$ system application-list

Check all the objects are up and running.
```
~(keystone_admin)$ kubectl get all -n cdi
~(keystone_admin)$ kubectl get all -n kubevirt
```
Note

When installing the containerized KubeVirt application, the virtctl client is installed on the host. You can test the client by running virtctl in an SSH / Local Console shell of the controller.

Verify if the virtctl client is available.

Note

The virtctl client is automatically installed in /home/sysadmin/bin/virtctl when the KubeVirt application is applied.

# Logout and log back in to ensure that /home/sysadmin/bin gets added to your PATH variable.
$ exit

login: sysadmin
password:

$ which virtctl
/home/sysadmin/bin/virtctl

Optionally, install noVNC in order to access a VM’s graphical console through a browser.

Note

noVNC is used to access a VM’s graphical console in a browser, where virtctl provides access to the VM’s serial console.

The upstream quay.io/samblade/virtvnc image uses the deprecated Docker Schema 1 manifest format. By default, support for Docker Schema 1 images is disabled in containerd v2.0 and later versions (StarlingX ships containerd 2.1.7), causing image pulls to fail with ImagePullBackOff. To resolve this issue, build an OCI / Docker Schema 2 image from the virtvnc source and push it to the local registry before applying the manifest.

Note

The controller does not include git or docker buildx. Download the source as a tarball using curl and build the image with docker build, which produces an OCI / Docker Schema 2 image. Run docker commands with sudo.

Build the virtvnc image and push it to the local registry.

~(keystone_admin)$ cd /home/sysadmin
~(keystone_admin)$ curl -sSL -o virtVNC.tar.gz \
                   https://github.com/wavezhang/virtVNC/archive/refs/heads/master.tar.gz
~(keystone_admin)$ tar xzf virtVNC.tar.gz
~(keystone_admin)$ cd virtVNC-master

# Replace the Dockerfile base image with a maintained kubectl image so
# the resulting image uses the OCI / Docker Schema 2 format. Choose a
# kubectl version within one minor release of the cluster's Kubernetes
# version (check with "kubectl version").

~(keystone_admin)$ cat << EOF > Dockerfile
FROM registry.k8s.io/kubectl:v1.35.0
ADD static /static
CMD ["proxy", "--www=/static", "--accept-hosts=^.*$", \
     "--address=[::]", "--api-prefix=/k8s/", "--www-prefix="]
EOF

~(keystone_admin)$ sudo docker build -t virtvnc:wrcp-v1 .
~(keystone_admin)$ sudo docker login registry.local:9001 -u admin -p <admin-keystone-user-password>
~(keystone_admin)$ sudo docker tag virtvnc:wrcp-v1 registry.local:9001/public/virtvnc:wrcp-v1
~(keystone_admin)$ sudo docker push registry.local:9001/public/virtvnc:wrcp-v1

Optionally, verify that the image is not Docker Schema 1 before using it. The mediaType must be application/vnd.docker.distribution.manifest.v2+json or application/vnd.oci.image.manifest.v1+json (not application/vnd.docker.distribution.manifest.v1+prettyjws).

~(keystone_admin)$ sudo docker manifest inspect --insecure \
                   registry.local:9001/public/virtvnc:wrcp-v1 | grep -i mediaType

Create and apply vnc-install.yaml.

apiVersion: v1
kind: ServiceAccount
metadata:
  name: virtvnc
  namespace: kubevirt
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: virtvnc
subjects:
- kind: ServiceAccount
  name: virtvnc
  namespace: kubevirt
roleRef:
  kind: ClusterRole
  name: virtvnc
  apiGroup: rbac.authorization.k8s.io
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: virtvnc
rules:
- apiGroups:
  - subresources.kubevirt.io
  resources:
  - virtualmachineinstances/console
  - virtualmachineinstances/vnc
  verbs:
  - get
- apiGroups:
  - kubevirt.io
  resources:
  - virtualmachines
  - virtualmachineinstances
  - virtualmachineinstancepresets
  - virtualmachineinstancereplicasets
  - virtualmachineinstancemigrations
  verbs:
  - get
  - list
  - watch
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: virtvnc
  name: virtvnc
  namespace: kubevirt
spec:
  ports:
  - port: 8001
    protocol: TCP
    targetPort: 8001
    nodePort: 31002
  selector:
    app: virtvnc
  type: NodePort
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: virtvnc
  namespace: kubevirt
spec:
  replicas: 1
  selector:
    matchLabels:
      app: virtvnc
  template:
    metadata:
      labels:
        app: virtvnc
    spec:
      serviceAccountName: virtvnc
      imagePullSecrets:
      - name: regcred
      nodeSelector:
        node-role.kubernetes.io/control-plane: ''
      tolerations:
      - key: "node-role.kubernetes.io/control-plane"
        operator: "Equal"
        value: ""
        effect: "NoSchedule"
      containers:
      - name: virtvnc
        image: registry.local:9001/public/virtvnc:wrcp-v1
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
            port: 8001
            path: /
            scheme: HTTP
          failureThreshold: 30
          initialDelaySeconds: 30
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 5

Create the registry secret in the kubevirt namespace, then apply the manifest.

~(keystone_admin)$ kubectl -n kubevirt create secret docker-registry regcred \
                   --docker-server=registry.local:9001 \
                   --docker-username=admin --docker-password=<admin-keystone-user-password>

~(keystone_admin)$ kubectl apply -f vnc-install.yaml

To access the VNC: http://<OAM FLOATING IP>:31002

Results

KubeVirt has been installed on the system.