Skip to content

Commit 407576a

Browse files
tiraboschinunnatsa
tiraboschi
and
nunnatsa
authored
[release-1.9] Revert PR #2206 as it's not needed anymore (#2341) (#2347)
Remove the support of the kubevirt.io/cpu-limit-to-request-ratio and the kubevirt.io/memory-limit-to-request-ratio annotations, as this workaround does now work as expected. Revert PR #2206 as it's not needed anymore This is a manual cherry-pick of: #2341 Signed-off-by: Nahshon Unna Tsameret <60659093+nunnatsa@users.noreply.github.com> Co-authored-by: Nahshon Unna Tsameret <60659093+nunnatsa@users.noreply.github.com>
1 parent 1a8b93a commit 407576a

File tree

10 files changed

+13
-764
lines changed

10 files changed

+13
-764
lines changed

‎deploy/cluster_role.yaml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -521,7 +521,6 @@ rules:
521521
- ""
522522
resources:
523523
- pods
524-
- resourcequotas
525524
verbs:
526525
- get
527526
- list

‎deploy/index-image/community-kubevirt-hyperconverged/1.9.0/manifests/kubevirt-hyperconverged-operator.v1.9.0.clusterserviceversion.yaml‎

Lines changed: 0 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -295,7 +295,6 @@ spec:
295295
- ""
296296
resources:
297297
- pods
298-
- resourcequotas
299298
verbs:
300299
- get
301300
- list
@@ -3928,29 +3927,6 @@ spec:
39283927
timeoutSeconds: 10
39293928
type: MutatingAdmissionWebhook
39303929
webhookPath: /mutate-ns-hco-kubevirt-io
3931-
- admissionReviewVersions:
3932-
- v1beta1
3933-
- v1
3934-
containerPort: 4343
3935-
deploymentName: hco-webhook
3936-
failurePolicy: Fail
3937-
generateName: mutate-virt-launcher-hco.kubevirt.io
3938-
objectSelector:
3939-
matchLabels:
3940-
kubevirt.io: virt-launcher
3941-
rules:
3942-
- apiGroups:
3943-
- ""
3944-
apiVersions:
3945-
- v1
3946-
operations:
3947-
- CREATE
3948-
resources:
3949-
- pods
3950-
sideEffects: NoneOnDryRun
3951-
timeoutSeconds: 10
3952-
type: MutatingAdmissionWebhook
3953-
webhookPath: /mutate-virt-launcher-hco-kubevirt-io
39543930
- admissionReviewVersions:
39553931
- v1beta1
39563932
- v1

‎deploy/olm-catalog/community-kubevirt-hyperconverged/1.9.0/manifests/kubevirt-hyperconverged-operator.v1.9.0.clusterserviceversion.yaml‎

Lines changed: 1 addition & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ metadata:
99
certified: "false"
1010
console.openshift.io/disable-operand-delete: "true"
1111
containerImage: quay.io/kubevirt/hyperconverged-cluster-operator:1.9.0-unstable
12-
createdAt: "2023-04-29 05:12:12"
12+
createdAt: "2023-05-18 15:22:36"
1313
description: A unified operator deploying and controlling KubeVirt and its supporting
1414
operators with opinionated defaults
1515
operatorframework.io/initialization-resource: '{"apiVersion":"hco.kubevirt.io/v1beta1","kind":"HyperConverged","metadata":{"annotations":{"deployOVS":"false"},"name":"kubevirt-hyperconverged","namespace":"kubevirt-hyperconverged"},"spec":{}}'
@@ -295,7 +295,6 @@ spec:
295295
- ""
296296
resources:
297297
- pods
298-
- resourcequotas
299298
verbs:
300299
- get
301300
- list
@@ -3928,29 +3927,6 @@ spec:
39283927
timeoutSeconds: 10
39293928
type: MutatingAdmissionWebhook
39303929
webhookPath: /mutate-ns-hco-kubevirt-io
3931-
- admissionReviewVersions:
3932-
- v1beta1
3933-
- v1
3934-
containerPort: 4343
3935-
deploymentName: hco-webhook
3936-
failurePolicy: Fail
3937-
generateName: mutate-virt-launcher-hco.kubevirt.io
3938-
objectSelector:
3939-
matchLabels:
3940-
kubevirt.io: virt-launcher
3941-
rules:
3942-
- apiGroups:
3943-
- ""
3944-
apiVersions:
3945-
- v1
3946-
operations:
3947-
- CREATE
3948-
resources:
3949-
- pods
3950-
sideEffects: NoneOnDryRun
3951-
timeoutSeconds: 10
3952-
type: MutatingAdmissionWebhook
3953-
webhookPath: /mutate-virt-launcher-hco-kubevirt-io
39543930
- admissionReviewVersions:
39553931
- v1beta1
39563932
- v1

‎deploy/webhooks.yaml‎

Lines changed: 0 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -213,34 +213,6 @@ metadata:
213213
labels:
214214
name: hyperconverged-cluster-webhook
215215
webhooks:
216-
- name: mutate-virt-launcher-hco.kubevirt.io
217-
admissionReviewVersions:
218-
- v1beta1
219-
- v1
220-
clientConfig:
221-
# caBundle: WILL BE INJECTED BY CERT-MANAGER BECAUSE OF THE ANNOTATION
222-
service:
223-
name: hyperconverged-cluster-webhook-service
224-
namespace: kubevirt-hyperconverged
225-
path: /mutate-virt-launcher-hco-kubevirt-io
226-
port: 4343
227-
failurePolicy: Fail
228-
matchPolicy: Equivalent
229-
objectSelector:
230-
matchLabels:
231-
kubevirt.io: virt-launcher
232-
rules:
233-
- apiGroups:
234-
- ""
235-
apiVersions:
236-
- v1
237-
operations:
238-
- CREATE
239-
resources:
240-
- pods
241-
scope: '*'
242-
sideEffects: None
243-
timeoutSeconds: 30
244216
- name: mutate-hyperconverged-hco.kubevirt.io
245217
admissionReviewVersions:
246218
- v1beta1

‎docs/cluster-configuration.md‎

Lines changed: 0 additions & 73 deletions
Original file line numberDiff line numberDiff line change
@@ -1094,76 +1094,3 @@ The `tuningPolicy` feature can be enabled using the following patch:
10941094
```bash
10951095
kubectl patch -n kubevirt-hyperconverged hco kubevirt-hyperconverged --type=json -p='[{"op": "add", "path": "/spec/tuningPolicy", "value": "annotation"}]'
10961096
```
1097-
1098-
## Enforce CPU/memory limits on namespaces with ResourceQuotas
1099-
This mechanism allows to align Kubevirt `virt-launcher` Pods with ResourceQuotas that are applied to the
1100-
namespace.
1101-
1102-
As an example, let's say that we are creating Kubevirt's `examples/vmi-fedora.yaml`.
1103-
1104-
When this VMI is created, the following `virt-launcher` pod is created (some details are omitted for simplicity):
1105-
```yaml
1106-
kind: Pod
1107-
metadata:
1108-
name: virt-launcher-vmi-fedora-lzzn6
1109-
namespace: kubevirt-hyperconverged
1110-
spec:
1111-
containers:
1112-
name: compute
1113-
resources:
1114-
limits:
1115-
devices.kubevirt.io/kvm: "1"
1116-
devices.kubevirt.io/tun: "1"
1117-
devices.kubevirt.io/vhost-net: "1"
1118-
requests:
1119-
cpu: 100m
1120-
devices.kubevirt.io/kvm: "1"
1121-
devices.kubevirt.io/tun: "1"
1122-
devices.kubevirt.io/vhost-net: "1"
1123-
ephemeral-storage: 50M
1124-
memory: "1279755392"
1125-
```
1126-
1127-
As can be seen, this `virt-launcher` has only CPU and memory requests - but not limits. This means that if this VMI is being created in a namespace that has a ResourceQuota defined in it - the virt-launcher Pod won't be able to start. This now can be solved using this feature.
1128-
1129-
To enable this mechanism, first a ratio between memory/CPU limits to request needs to be defined as an annotation in HCO object:
1130-
```yaml
1131-
kind: HyperConverged
1132-
metadata:
1133-
annotations:
1134-
kubevirt.io/cpu-limit-to-request-ratio: "2"
1135-
kubevirt.io/memory-limit-to-request-ratio: "1.5"
1136-
```
1137-
1138-
In addition, a ResourceQuota needs to exist on the relevant namespace. As an example, it's possible to create the following object:
1139-
```yaml
1140-
apiVersion: v1
1141-
kind: ResourceQuota
1142-
metadata:
1143-
name: test-rq
1144-
spec:
1145-
hard:
1146-
limits.cpu: "200"
1147-
limits.memory: "2000G"
1148-
```
1149-
Please take into account that if a ResourceQuota only sets a limit on `limits.cpu` or `limits.memory`, then CPU/memory limits will be set accordingly. If multiple ResourceQuota exist within the relevant namespace, it takes only one of then to limit CPU/memory limits in order to enforce these limits.
1150-
1151-
When these annotations are enabled along with a ResourceQuota object, a mutating webhook that's targeted to virt-launcher pods will enforce limits on the pod. It would now look like the following:
1152-
```yaml
1153-
resources:
1154-
limits:
1155-
cpu: 200m
1156-
devices.kubevirt.io/kvm: "1"
1157-
devices.kubevirt.io/tun: "1"
1158-
devices.kubevirt.io/vhost-net: "1"
1159-
memory: "1919633088"
1160-
requests:
1161-
cpu: 100m
1162-
devices.kubevirt.io/kvm: "1"
1163-
devices.kubevirt.io/tun: "1"
1164-
devices.kubevirt.io/vhost-net: "1"
1165-
ephemeral-storage: 50M
1166-
memory: "1279755392"
1167-
```
1168-
1169-
Bear in mind that if the limit is already set, HCO will not fix it according to the annotations.

‎pkg/components/components.go‎

Lines changed: 1 addition & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -471,7 +471,7 @@ func GetClusterPermissions() []rbacv1.PolicyRule {
471471
roleWithAllPermissions("", stringListToSlice("services")),
472472
{
473473
APIGroups: emptyAPIGroup,
474-
Resources: stringListToSlice("pods", "resourcequotas"),
474+
Resources: stringListToSlice("pods"),
475475
Verbs: stringListToSlice("get", "list", "watch"),
476476
},
477477
{
@@ -809,33 +809,6 @@ func GetCSVBase(params *CSVBaseParams) *csvv1alpha1.ClusterServiceVersion {
809809
WebhookPath: pointer.String(util.HCONSWebhookPath),
810810
}
811811

812-
mutatingVirtLauncherWebhook := csvv1alpha1.WebhookDescription{
813-
GenerateName: util.HcoMutatingWebhookVirtLauncher,
814-
Type: csvv1alpha1.MutatingAdmissionWebhook,
815-
DeploymentName: hcoWhDeploymentName,
816-
ContainerPort: util.WebhookPort,
817-
AdmissionReviewVersions: stringListToSlice("v1beta1", "v1"),
818-
SideEffects: &mutatingWebhookSideEffects,
819-
FailurePolicy: &failurePolicy,
820-
TimeoutSeconds: &webhookTimeout,
821-
ObjectSelector: &metav1.LabelSelector{
822-
MatchLabels: map[string]string{"kubevirt.io": "virt-launcher"},
823-
},
824-
Rules: []admissionregistrationv1.RuleWithOperations{
825-
{
826-
Operations: []admissionregistrationv1.OperationType{
827-
admissionregistrationv1.Create,
828-
},
829-
Rule: admissionregistrationv1.Rule{
830-
APIGroups: []string{""},
831-
APIVersions: stringListToSlice("v1"),
832-
Resources: stringListToSlice("pods"),
833-
},
834-
},
835-
},
836-
WebhookPath: pointer.String(util.HCOVirtLauncherWebhookPath),
837-
}
838-
839812
mutatingHyperConvergedWebhook := csvv1alpha1.WebhookDescription{
840813
GenerateName: util.HcoMutatingWebhookHyperConverged,
841814
Type: csvv1alpha1.MutatingAdmissionWebhook,
@@ -953,7 +926,6 @@ func GetCSVBase(params *CSVBaseParams) *csvv1alpha1.ClusterServiceVersion {
953926
WebhookDefinitions: []csvv1alpha1.WebhookDescription{
954927
validatingWebhook,
955928
mutatingNamespaceWebhook,
956-
mutatingVirtLauncherWebhook,
957929
mutatingHyperConvergedWebhook,
958930
},
959931
CustomResourceDefinitions: csvv1alpha1.CustomResourceDefinitions{

‎pkg/util/consts.go‎

Lines changed: 11 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,6 @@ const (
1717
KvUiPluginImageEnvV = "KV_CONSOLE_PLUGIN_IMAGE"
1818
HcoValidatingWebhook = "validate-hco.kubevirt.io"
1919
HcoMutatingWebhookNS = "mutate-ns-hco.kubevirt.io"
20-
HcoMutatingWebhookVirtLauncher = "mutate-virt-launcher-hco.kubevirt.io"
2120
HcoMutatingWebhookHyperConverged = "mutate-hyperconverged-hco.kubevirt.io"
2221
AppLabel = "app"
2322
UndefinedNamespace = ""
@@ -48,18 +47,17 @@ const (
4847
PrometheusNSLabel = "openshift.io/cluster-monitoring"
4948

5049
// HyperConvergedName is the name of the HyperConverged resource that will be reconciled
51-
HyperConvergedName = "kubevirt-hyperconverged"
52-
MetricsHost = "0.0.0.0"
53-
MetricsPort int32 = 8383
54-
HealthProbeHost = "0.0.0.0"
55-
HealthProbePort int32 = 6060
56-
ReadinessEndpointName = "/readyz"
57-
LivenessEndpointName = "/livez"
58-
HCOWebhookPath = "/validate-hco-kubevirt-io-v1beta1-hyperconverged"
59-
HCOMutatingWebhookPath = "/mutate-hco-kubevirt-io-v1beta1-hyperconverged"
60-
HCONSWebhookPath = "/mutate-ns-hco-kubevirt-io"
61-
HCOVirtLauncherWebhookPath = "/mutate-virt-launcher-hco-kubevirt-io"
62-
WebhookPort = 4343
50+
HyperConvergedName = "kubevirt-hyperconverged"
51+
MetricsHost = "0.0.0.0"
52+
MetricsPort int32 = 8383
53+
HealthProbeHost = "0.0.0.0"
54+
HealthProbePort int32 = 6060
55+
ReadinessEndpointName = "/readyz"
56+
LivenessEndpointName = "/livez"
57+
HCOWebhookPath = "/validate-hco-kubevirt-io-v1beta1-hyperconverged"
58+
HCOMutatingWebhookPath = "/mutate-hco-kubevirt-io-v1beta1-hyperconverged"
59+
HCONSWebhookPath = "/mutate-ns-hco-kubevirt-io"
60+
WebhookPort = 4343
6361

6462
WebhookCertName = "apiserver.crt"
6563
WebhookKeyName = "apiserver.key"

0 commit comments

Comments
 (0)