diff --git a/CHANGELOG.md b/CHANGELOG.md index e82db70..896b720 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,25 @@ # Changelog +## 2026-09-10 10:07 UTC — KVM provider validated on a real hypervisor; UEFI default; libvirt call tracing + +- `make test-integration-kvm` passes end to end against a libvirt 11.6 / QEMU 10.1 + host (Debian 13 image, UEFI, guest agent reporting the IP after ~20 s). Four + defects found only on the real host, all fixed on the branch: + - domain disks are now `type="file"` with resolved paths: pool-volume references + get no AppArmor rule from `virt-aa-helper`, so QEMU was denied the disks; + - domain metadata is parsed by local name: libvirt returns the element without + its namespace declaration; + - guests boot **UEFI by default** (`images..firmware: uefi|bios`, OVMF now a + host prerequisite): Debian 13's image hangs in GRUB under SeaBIOS on a headless + VM with a serial console (Debian bug #1111240, open); bookworm is unaffected; + - the image cache's raw-upload path is confirmed to produce a byte-identical file. +- Every libvirt RPC is logged at `--zap-log-level=debug` as one `libvirt call` line + (`rpc=virDomainCreate`, identifiers, duration, `libvirtError` on failure); level 2 + adds XML, metadata and addresses; cloud-init is never logged. The integration test + shows the trace in `-v` output (`KVM_TEST_LOG_LEVEL`, default 1). +- Key files: `internal/provider/kvm/{domainxml.go,metadata.go,trace.go,conn.go}`, + `internal/provider/config_kvm.go`, `docs/kvm-provider.md`. + ## 2026-09-08 11:00 UTC — KVM/libvirt provider - New `kvm` provider type: Managed proxies as VMs on your own libvirt/KVM hosts. Each @@ -14,7 +34,7 @@ `/etc/proxy-operator/kvm`; samples `config/samples/proxy_kvm.yaml` and a `kvm-home` block in `providers-config.yaml`; `docs/kvm-provider.md`; opt-in integration test (`make test-integration-kvm`) against a real hypervisor. -- Not yet validated on a real host — that is the next step on the branch. +- Not validated on a real host at the time of this entry; see 2026-09-10 above. ## 2026-08-10 09:34 CEST — kind e2e verified; fix Squid OOM in containers; quickstart goes in-cluster diff --git a/docs/plans-executions/2026-09-04-1404-kvm-provider.md b/docs/plans-executions/2026-09-04-1404-kvm-provider.md index 27b016b..cf3079e 100644 --- a/docs/plans-executions/2026-09-04-1404-kvm-provider.md +++ b/docs/plans-executions/2026-09-04-1404-kvm-provider.md @@ -532,3 +532,28 @@ the docs now name the bug rather than blaming the host, and note that bookworm images are unaffected. `latest` on cloud.debian.org was the 2026-08-31 build when this was hit, so every trixie point release to date carries it. + +### Run 6: pass + +With UEFI the full lifecycle passed in 23 s on a warm cache: Create 2 s +(domain start 0.9 s), guest agent answering with `192.168.0.89` after +20 s (ARP never did; the host had not talked to the guest), TCP 22 +reachable from the dev machine, ListByTag seeing it, Delete leaving only +the base image and marker in the pool, second Delete a no-op. Trace +excerpt worth keeping for the record: + +``` +09:44:28.603 libvirt virDomainDefineXML xmlBytes=1509 domain=proxy-hk5oavoqk45n3twq duration=13.51ms +09:44:28.603 kvm domain defined uid=9bbceb41-… firmware=uefi +09:44:29.542 libvirt virDomainCreate domain=proxy-hk5oavoqk45n3twq duration=938.705ms +09:44:49.573 libvirt virDomainInterfaceAddresses domain=proxy-hk5oavoqk45n3twq source=DomainInterfaceAddressesSrcAgent interfaces=2 duration=1.742ms +09:44:49.573 kvm KVM domain fetched state=Running ip=192.168.0.89 uid=9bbceb41-… +``` + +Worth noting: the sweep listed a second managed domain, +`proxy-qxge3dbm2mnpc3ih`, shut off, left behind by an earlier failed +run whose cleanup never ran. That is exactly the orphan GC exists for; +on the host it needs `virsh undefine --nvram` plus its two volumes by +hand. The `ListByTag` sweep costs one `virDomainGetMetadata` per +domain on the host (21 here, ~0.4 ms each over the tunnel), which is +fine at this scale but is the call to watch on a busy hypervisor. diff --git a/docs/plans-executions/2026-09-10-0805-kvm-libvirt-tracing.md b/docs/plans-executions/2026-09-10-0805-kvm-libvirt-tracing.md index f6f747c..67d10a4 100644 --- a/docs/plans-executions/2026-09-10-0805-kvm-libvirt-tracing.md +++ b/docs/plans-executions/2026-09-10-0805-kvm-libvirt-tracing.md @@ -9,7 +9,7 @@ Plan: [2026-09-10-0805-kvm-libvirt-tracing.md](../plans/2026-09-10-0805-kvm-libv - [x] Step 4 — Call sites - [x] Step 5 — Integration test output - [x] Step 6 — Unit tests -- [ ] Step 7 — Docs, execution log, CHANGELOG (docs and this log done; CHANGELOG waits for the live run) +- [x] Step 7 — Docs, execution log, CHANGELOG ## Steps 1–6 — Tracer, pool logging, tests, integration wiring @@ -98,3 +98,12 @@ trace.go:55: 09:04:33.165 libvirt virDomainCreate domain=proxy-abc123def456ghij Worth noting: `length=0` on `virStorageVolUpload` is what the provider passes (libvirt reads to EOF); the following `seed volume uploaded` line has the byte count. + +## Step 7 — Live run confirmed; CHANGELOG + +The compact trace was accepted on the first passing live run +(2026-09-10, beelink): one line per RPC with the libvirt function name, +the provider's own lines between them, `Provisioning` polls readable at +a glance (`SrcArp interfaces=0`, `SrcAgent … ErrAgentUnresponsive` +until the agent came up at +20 s), and a full `ListByTag` sweep over 21 +domains in 15 ms. CHANGELOG entry added under the KVM validation entry.