OCPBUGS-77929,OCPBUGS-66890: Sync upstream main 2026-04-23

.github/workflows/e2e.yaml

@@ -4,7 +4,7 @@ on:
   push: {}
 name: e2e
 jobs:
-  integration:
+  integration-tests:
     runs-on: ubuntu-latest
     if: (github.repository == 'kubernetes-sigs/cluster-api-provider-kubevirt') && contains(github.event.pull_request.labels.*.name, 'ok-to-test')
     strategy:
@@ -29,3 +29,16 @@ jobs:
       - name: Test
         run: |
           $GITHUB_WORKSPACE/project-infra/hack/mkpj.sh --job ${{ matrix.prowjobname }} --pull-number ${{github.event.number}} --kubeconfig $GITHUB_WORKSPACE/project-infra/.kubeconfig --trigger-job --fail-with-job
+
+  integration:
+    runs-on: ubuntu-latest
+    needs: integration-tests
+    if: github.repository == 'kubernetes-sigs/cluster-api-provider-kubevirt'
+    steps:
+      - name: Check integration status
+        run: |
+          if [[ "${{ needs.integration-tests.result }}" != "success" ]]; then
+            echo "Integration tests failed or were skipped"
+            exit 1
+          fi
+          echo "All integration tests passed"

.github/workflows/test.yaml

@@ -36,6 +36,7 @@ jobs:
         mkdir -p coverprofiles
         make test
     - name: Push to coveralls.io
+      continue-on-error: true
       env:
         COVERALLS_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       run: |-
@@ -55,7 +56,7 @@ jobs:
       uses: golangci/golangci-lint-action@v7
       with:
         args: --timeout=5m -v
-        version: v2.7.2
+        version: v2.11.2
 
   check-gen:
     if: github.repository == 'kubernetes-sigs/cluster-api-provider-kubevirt'

Dockerfile

@@ -16,7 +16,7 @@
 
 # Build the manager binary
 # Run this with docker build --build-arg builder_image=<golang:x.y.z>
-ARG builder_image=docker.io/golang:1.24
+ARG builder_image=docker.io/golang:1.25
 FROM ${builder_image} as builder
 WORKDIR /workspace
 

Dockerfile.rhtap

@@ -1,4 +1,4 @@
-FROM brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_1.24 as builder
+FROM brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_1.25 as builder
 
 # Run this with docker build --build_arg $(go env GOPROXY) to override the goproxy
 ARG goproxy=https://proxy.golang.org

Makefile

@@ -341,7 +341,7 @@ goimports:
 
 GOLANGCI_LINT = $(shell pwd)/bin/golangci-lint
 golangci-lint: ## Download golangci-lint locally if necessary.
-	$(call go-install-tool,$(GOLANGCI_LINT),github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.4.0)
+	$(call go-install-tool,$(GOLANGCI_LINT),github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.11.2)
 
 .PHONY: linter
 linter: golangci-lint

config/crd/bases/infrastructure.cluster.x-k8s.io_kubevirtmachines.yaml

@@ -286,7 +286,7 @@ spec:
                                     resources:
                                       description: |-
                                         resources represents the minimum resources the volume should have.
-                                        If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
+                                        Users are allowed to specify resource requirements
                                         that are lower than previous value but must still be higher than capacity recorded in the
                                         status field of the claim.
                                         More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
@@ -880,6 +880,12 @@ spec:
                         description: |-
                           Running state indicates the requested running state of the VirtualMachineInstance
                           mutually exclusive with Running
+                          Following are allowed values:
+                          - "Always": VMI should always be running.
+                          - "Halted": VMI should never be running.
+                          - "Manual": VMI can be started/stopped using API endpoints.
+                          - "RerunOnFailure": VMI will initially be running and restarted if a failure occurs, but will not be restarted upon successful completion.
+                          - "Once": VMI will run once and not be restarted upon completion regardless if the completion is of phase Failure or Success.
                         type: string
                       running:
                         description: |-
@@ -2673,6 +2679,11 @@ spec:
                                                 please refer to Kubevirt user guide for alternatives.
                                                 Deprecated: Removed in v1.3
                                               type: object
+                                            passtBinding:
+                                              description: InterfacePasstBinding connects
+                                                to a given network using passt usermode
+                                                networking.
+                                              type: object
                                             pciAddress:
                                               description: 'If specified, the virtual
                                                 network interface will be placed on
@@ -3003,18 +3014,44 @@ spec:
                                                     type: boolean
                                                 type: object
                                               enabled:
+                                                description: |-
+                                                  Enabled determines if the feature should be enabled or disabled on the guest.
+                                                  Defaults to true.
                                                 type: boolean
                                             type: object
                                           tlbflush:
                                             description: |-
                                               TLBFlush improves performances in overcommited environments. Requires vpindex.
                                               Defaults to the machine type setting.
                                             properties:
+                                              direct:
+                                                description: |-
+                                                  Direct allows sending the TLB flush command directly to the hypervisor.
+                                                  It can be useful to optimize performance in nested virtualization cases, such as Windows VBS.
+                                                properties:
+                                                  enabled:
+                                                    description: |-
+                                                      Enabled determines if the feature should be enabled or disabled on the guest.
+                                                      Defaults to true.
+                                                    type: boolean
+                                                type: object
                                               enabled:
                                                 description: |-
                                                   Enabled determines if the feature should be enabled or disabled on the guest.
                                                   Defaults to true.
                                                 type: boolean
+                                              extended:
+                                                description: Extended allows the guest
+                                                  to execute partial TLB flushes.
+                                                  It can be helpful for general purpose
+                                                  workloads.
+                                                properties:
+                                                  enabled:
+                                                    description: |-
+                                                      Enabled determines if the feature should be enabled or disabled on the guest.
+                                                      Defaults to true.
+                                                    type: boolean
+                                                type: object
                                             type: object
                                           vapic:
                                             description: |-
@@ -3299,7 +3336,46 @@ spec:
                                           The delta between MaxGuest and Guest is the amount of memory that can be hot(un)plugged.
                                         pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                         x-kubernetes-int-or-string: true
+                                      reservedOverhead:
+                                        description: |-
+                                          ReservedOverhead configures the memory overhead applied to a VM
+                                          and its characteristics.
+                                        properties:
+                                          addedOverhead:
+                                            anyOf:
+                                            - type: integer
+                                            - type: string
+                                            description: |-
+                                              AddedOverhead determines the memory overhead that will be reserved
+                                              for the VM. It increases the virt-launcher pod memory limit.
+                                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                            x-kubernetes-int-or-string: true
+                                          memLock:
+                                            description: |-
+                                              RequiresLock determines whether the VM's and its overhead memory
+                                              need to be locked or not. It is a common practice to enable this
+                                              if vDPA, VFIO or any other specialized hardware that depends on
+                                              DMA is being used by the VM.
+                                              False - (Default) memory lock RLimits are not modified.
+                                              True - Memory lock RLimits will be updated to consider VM memory
+                                                     size and memory overhead
+                                            enum:
+                                            - NotRequired
+                                            - Required
+                                            type: string
+                                        type: object
                                     type: object
+                                  rebootPolicy:
+                                    description: |-
+                                      RebootPolicy specifies how the guest should behave on reboot.
+                                      Reboot (default): The guest is allowed to reboot silently.
+                                      Terminate: The VMI will be terminated on guest reboot, allowing
+                                      higher level controllers (such as the VM controller) to recreate
+                                      the VMI with any updated configuration such as boot order changes.
+                                    enum:
+                                    - Reboot
+                                    - Terminate
+                                    type: string
                                   resources:
                                     description: Resources describes the Compute Resources
                                       required by this vmi.
@@ -3787,9 +3863,10 @@ spec:
                                     operator:
                                       description: |-
                                         Operator represents a key's relationship to the value.
-                                        Valid operators are Exists and Equal. Defaults to Equal.
+                                        Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
                                         Exists is equivalent to wildcard for value, so that a pod can
                                         tolerate all taints of a particular category.
+                                        Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
                                       type: string
                                     tolerationSeconds:
                                       description: |-
@@ -3987,6 +4064,41 @@ spec:
                                 - topologyKey
                                 - whenUnsatisfiable
                                 x-kubernetes-list-type: map
+                              utilityVolumes:
+                                description: |-
+                                  List of utility volumes that can be mounted to the vmi virt-launcher pod
+                                  without having a matching disk in the domain.
+                                  Used to collect data for various operational workflows.
+                                items:
+                                  properties:
+                                    claimName:
+                                      description: |-
+                                        claimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume.
+                                        More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
+                                      type: string
+                                    name:
+                                      description: |-
+                                        UtilityVolume's name.
+                                        Must be unique within the vmi, including regular Volumes.
+                                      type: string
+                                    readOnly:
+                                      description: |-
+                                        readOnly Will force the ReadOnly setting in VolumeMounts.
+                                        Default false.
+                                      type: boolean
+                                    type:
+                                      description: Type represents the type of the
+                                        utility volume.
+                                      type: string
+                                  required:
+                                  - claimName
+                                  - name
+                                  type: object
+                                maxItems: 256
+                                type: array
+                                x-kubernetes-list-map-keys:
+                                - name
+                                x-kubernetes-list-type: map
                               volumes:
                                 description: List of volumes that can be mounted by
                                   disks belonging to the vmi.
@@ -4162,6 +4274,36 @@ spec:
                                       required:
                                       - image
                                       type: object
+                                    containerPath:
+                                      description: |-
+                                        ContainerPath exposes a path from the virt-launcher container to the VM via virtiofs.
+                                        The path must correspond to an existing volumeMount in the compute container.
+                                      properties:
+                                        path:
+                                          description: |-
+                                            Path is the absolute path within the virt-launcher container to expose to the VM.
+                                            The path must correspond to an existing volumeMount in the compute container.
+                                          maxLength: 4096
+                                          type: string
+                                          x-kubernetes-validations:
+                                          - message: path must be absolute (start
+                                              with '/')
+                                            rule: self.startsWith('/')
+                                          - message: path must not contain '..'
+                                            rule: '!self.contains(''..'')'
+                                        readOnly:
+                                          default: true
+                                          description: |-
+                                            ReadOnly controls whether the volume is exposed as read-only to the VM.
+                                            Defaults to true. Write access is not currently supported.
+                                          type: boolean
+                                          x-kubernetes-validations:
+                                          - message: readOnly must be true, write
+                                              access is not supported
+                                            rule: self == true
+                                      required:
+                                      - path
+                                      type: object
                                     dataVolume:
                                       description: |-
                                         DataVolume represents the dynamic creation a PVC for this volume as well as