Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package kubevirt1.9 for openSUSE:Factory checked in at 2026-10-22 15:50:54 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/kubevirt1.9 (Old) and /work/SRC/openSUSE:Factory/.kubevirt1.9.new.2252680 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "kubevirt1.9" Thu Oct 22 15:50:54 2026 rev:4 rq:1386987 version:1.9.1 Changes: -------- --- /work/SRC/openSUSE:Factory/kubevirt1.9/kubevirt1.9.changes 2026-09-11 18:06:20.571408167 +0200 +++ /work/SRC/openSUSE:Factory/.kubevirt1.9.new.2252680/kubevirt1.9.changes 2026-10-22 15:54:45.507325976 +0200 @@ -1,0 +2,38 @@ +Sun Oct 18 20:59:26 UTC 2026 - Victor Carvalho <[email protected]> + +- Update to version 1.9.1: + * virt-template is pinned at v0.2.3 + * several bug fixes, see + https://github.com/kubevirt/kubevirt/releases/tag/v1.9.1 +- Drop 0001-Fix-VFIO-cdev-passthrough-on-kernels-without-CONFIG_VFIO.patch: + in 1.9.1. +- Drop 0002-use-safepath-when-dialing-the-migration-target-unix-sockets.patch + and 0003-tests-dial-migration-target-sockets-through-proc-root-layout.patch: + CVE-2026-13622 (bsc#1272840) is fixed in 1.9.1 by the final upstream + change, which also puts the migration source listener sockets + behind safepath. +- The tarball is v1.9.1 with the same go.mod/go.sum/vendor as the + 1.9.0 package (golang.org/x/crypto v0.56.0, golang.org/x/net + v0.58.0, golang.org/x/text v0.41.0, google.golang.org/grpc v1.83.2, + google.golang.org/protobuf v1.36.11); upstream's module set is + unchanged between the two tags. +- Refresh disks-images-provider.yaml to the v1.9.1 release asset. +- Add 0005-Add-grace-period-for-Running-VMIs-when-domain-is-nil.patch: + when virt-handler restarts it briefly loses the launcher socket; + Scheduled VMIs already got a 3-minute grace period before being + marked Failed, Running VMIs were failed at once, so healthy VMs were + killed during upgrades (upstream release-1.9 commit 6a21e66f30). +- Add 0006-Notify-server-Make-event-chan-private.patch and + 0007-Notify-server-Ignore-client-error.patch: + a watch error from one virt-launcher made virt-handler restart its + whole domain watcher, re-listing every domain on the node and + disrupting healthy VMs; log the error instead (upstream release-1.9 + commits b428d219c5, 6ba8edb64c). +- Ship the testing manifests in the tests subpackage on SUSE Linux: + they were generated and installed only on Tumbleweed, together with + the release manifests, so virt-tests came without the + default-config.json, rbac-for-testing.yaml, uploadproxy-nodeport.yaml + and disks-images-provider.yaml it needs to run. The release manifests + and the manifests subpackage stay Tumbleweed-only. + +------------------------------------------------------------------- Old: ---- 0001-Fix-VFIO-cdev-passthrough-on-kernels-without-CONFIG_VFIO.patch 0002-use-safepath-when-dialing-the-migration-target-unix-sockets.patch 0003-tests-dial-migration-target-sockets-through-proc-root-layout.patch kubevirt-1.9.0.tar.gz New: ---- 0005-Add-grace-period-for-Running-VMIs-when-domain-is-nil.patch 0006-Notify-server-Make-event-chan-private.patch 0007-Notify-server-Ignore-client-error.patch kubevirt-1.9.1.tar.gz ----------(Old B)---------- Old: https://github.com/kubevirt/kubevirt/releases/tag/v1.9.1 - Drop 0001-Fix-VFIO-cdev-passthrough-on-kernels-without-CONFIG_VFIO.patch: in 1.9.1. Old: in 1.9.1. - Drop 0002-use-safepath-when-dialing-the-migration-target-unix-sockets.patch and 0003-tests-dial-migration-target-sockets-through-proc-root-layout.patch: Old:- Drop 0002-use-safepath-when-dialing-the-migration-target-unix-sockets.patch and 0003-tests-dial-migration-target-sockets-through-proc-root-layout.patch: CVE-2026-13622 (bsc#1272840) is fixed in 1.9.1 by the final upstream ----------(Old E)---------- ----------(New B)---------- New:- Refresh disks-images-provider.yaml to the v1.9.1 release asset. - Add 0005-Add-grace-period-for-Running-VMIs-when-domain-is-nil.patch: when virt-handler restarts it briefly loses the launcher socket; New: killed during upgrades (upstream release-1.9 commit 6a21e66f30). - Add 0006-Notify-server-Make-event-chan-private.patch and 0007-Notify-server-Ignore-client-error.patch: New:- Add 0006-Notify-server-Make-event-chan-private.patch and 0007-Notify-server-Ignore-client-error.patch: a watch error from one virt-launcher made virt-handler restart its ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ kubevirt1.9.spec ++++++ --- /var/tmp/diff_new_pack.Uvwah3/_old 2026-10-22 15:54:46.665374518 +0200 +++ /var/tmp/diff_new_pack.Uvwah3/_new 2026-10-22 15:54:46.669374686 +0200 @@ -20,7 +20,7 @@ %define upstream_name kubevirt Name: kubevirt1.9 -Version: 1.9.0 +Version: 1.9.1 Release: 0 Summary: Container native virtualization License: Apache-2.0 @@ -29,12 +29,11 @@ Source0: %{upstream_name}-%{version}.tar.gz Source3: %{url}/releases/download/v%{version}/disks-images-provider.yaml Source100: %{name}-rpmlintrc -# PATCH-FIX-UPSTREAM 0001-Fix-VFIO-cdev-passthrough-on-kernels-without-CONFIG_VFIO.patch -- release-1.9 7d045a56dd (PR 18905/18931): guard the VFIO cdev DeviceSpec on kernels without CONFIG_VFIO_DEVICE_CDEV -Patch0: 0001-Fix-VFIO-cdev-passthrough-on-kernels-without-CONFIG_VFIO.patch -Patch1: 0002-use-safepath-when-dialing-the-migration-target-unix-sockets.patch -Patch2: 0003-tests-dial-migration-target-sockets-through-proc-root-layout.patch # FIXME: not yet upstream: --virt-*-image flags were ignored for the operator deployment -Patch3: 0004-manifest-templator-apply-the-custom-image-flags-before-rendering-the-operator-deployment.patch +Patch0: 0004-manifest-templator-apply-the-custom-image-flags-before-rendering-the-operator-deployment.patch +Patch1: 0005-Add-grace-period-for-Running-VMIs-when-domain-is-nil.patch +Patch2: 0006-Notify-server-Make-event-chan-private.patch +Patch3: 0007-Notify-server-Ignore-client-error.patch BuildRequires: glibc-devel-static BuildRequires: golang-packaging BuildRequires: libnbd-devel @@ -296,7 +295,7 @@ # upstream's quay.io images do not exist. Point it at the images built from # the virt-template package, at the version this release pins # (hack/virt-template/default.sh), through the manifest templator's -# custom-image flags (Patch3 makes the operator deployment honour them). +# custom-image flags (Patch0 makes the operator deployment honour them). vt_version=$(sed -n 's/^virt_template_version=.*:-"v\([^"]*\)".*/\1/p' hack/virt-template/default.sh) [ -n "$vt_version" ] env DOCKER_PREFIX=$reg_path DOCKER_TAG=%{version} KUBEVIRT_NO_BAZEL=true \ @@ -304,6 +303,10 @@ ./hack/build-manifests.sh [ "$(grep -c 'name: VIRT_TEMPLATE_APISERVER_IMAGE' _out/manifests/release/kubevirt-operator.yaml)" = 1 ] +%else +# No release manifests are shipped here, but the tests subpackage needs the +# testing manifests, which carry no image references. +env DOCKER_TAG=%{version} KUBEVIRT_NO_BAZEL=true ./hack/build-manifests.sh %endif %install @@ -355,6 +358,7 @@ mkdir -p %{buildroot}%{_datadir}/kube-virt-1.9/manifests/release install -m 0644 _out/manifests/release/kubevirt-operator.yaml %{buildroot}%{_datadir}/kube-virt-1.9/manifests/release/ install -m 0644 _out/manifests/release/kubevirt-cr.yaml %{buildroot}%{_datadir}/kube-virt-1.9/manifests/release/ +%endif # Install manifests for testing mkdir -p %{buildroot}%{_datadir}/kube-virt-1.9/manifests/testing @@ -363,7 +367,6 @@ # images. Overwrite it with the upstream version for testing. install -m 0644 %{S:3} %{buildroot}/%{_datadir}/kube-virt-1.9/manifests/testing/ install -m 0644 tests/default-config.json %{buildroot}%{_datadir}/kube-virt-1.9/manifests/testing/ -%endif %files virtctl %license LICENSE @@ -457,8 +460,6 @@ %doc README.md %dir %{_datadir}/kube-virt-1.9 %{_bindir}/virt-tests -%if 0%{?suse_version} >= 1699 %dir %{_datadir}/kube-virt-1.9/manifests %{_datadir}/kube-virt-1.9/manifests/testing -%endif ++++++ 0005-Add-grace-period-for-Running-VMIs-when-domain-is-nil.patch ++++++ >From 6a21e66f30c1b2dbb081e90beb4a55df7f87a0ae Mon Sep 17 00:00:00 2001 From: Itamar Holder <[email protected]> Date: Tue, 14 Jul 2026 11:00:59 +0300 Subject: [PATCH] Add grace period for Running VMIs when domain is nil When virt-handler restarts, it may temporarily lose the launcher socket connection. For Scheduled VMIs, IsLauncherClientUnresponsive provides a 3-minute grace period before marking them as Failed. Running VMIs lacked this protection and were immediately marked Failed, causing healthy VMs to be unnecessarily killed during upgrades. Mirror the Scheduled VMI grace period logic to the Running VMI path in calculateVmPhaseForStatusReason: check launcher client responsiveness before transitioning, re-enqueue if not yet initialized, and only mark Failed after the grace period expires. Assisted-by: Claude <[email protected]> Signed-off-by: Itamar Holder <[email protected]> --- pkg/virt-handler/vm.go | 21 +++----- pkg/virt-handler/vm_test.go | 103 ++++++++++++++++++++++++++++++++++++ 2 files changed, 109 insertions(+), 15 deletions(-) diff --git a/pkg/virt-handler/vm.go b/pkg/virt-handler/vm.go index d6335d9ce2..d5a8abfbea 100644 --- a/pkg/virt-handler/vm.go +++ b/pkg/virt-handler/vm.go @@ -2323,33 +2323,24 @@ func (c *VirtualMachineController) calculateVmPhaseForStatusReason(domain *api.D return vmi.Status.Phase, nil } switch { - case vmi.IsScheduled(): + case vmi.IsScheduled() || vmi.IsRunning(): isUnresponsive, isInitialized, err := c.launcherClients.IsLauncherClientUnresponsive(vmi) - if err != nil { return vmi.Status.Phase, err } if !isInitialized { c.queue.AddAfter(controller.VirtualMachineInstanceKey(vmi), time.Second*1) - return vmi.Status.Phase, err - } else if isUnresponsive { + return vmi.Status.Phase, nil + } + if isUnresponsive { if vmi.IsMigrationTarget() { return v1.WaitingForSync, nil } - // virt-launcher is gone and VirtualMachineInstance never transitioned - // from scheduled to Running. return v1.Failed, nil } - return v1.Scheduled, nil - case !vmi.IsRunning() && !vmi.IsFinal(): - return v1.Scheduled, nil + return vmi.Status.Phase, nil case !vmi.IsFinal(): - if vmi.IsMigrationTarget() { - return v1.WaitingForSync, nil - } - // That is unexpected. We should not be able to delete a VirtualMachineInstance before we stop it. - // However, if someone directly interacts with libvirt it is possible - return v1.Failed, nil + return v1.Scheduled, nil } } else { switch domain.Status.Status { diff --git a/pkg/virt-handler/vm_test.go b/pkg/virt-handler/vm_test.go index 4390af45aa..133819efad 100644 --- a/pkg/virt-handler/vm_test.go +++ b/pkg/virt-handler/vm_test.go @@ -522,6 +522,95 @@ var _ = Describe("VirtualMachineInstance", func() { Expect(updatedVMI.Status.Phase).To(Equal(v1.Failed)) }) + Context("When a Running VMI has no domain", func() { + It("should re-enqueue if the launcher client is not yet initialized", func() { + vmi := NewRunningVMI(vmiTestUUID, podTestUUID, host) + + createVMI(vmi) + + controller.launcherClients = &launcherclients.MockLauncherClientManager{ + Initialized: false, + } + + sanityExecute() + + Expect(mockQueue.GetAddAfterEnqueueCount()).To(BeNumerically(">", 0)) + updatedVMI, err := virtfakeClient.KubevirtV1().VirtualMachineInstances(metav1.NamespaceDefault).Get(context.TODO(), vmi.Name, metav1.GetOptions{}) + Expect(err).NotTo(HaveOccurred()) + Expect(updatedVMI.Status.Phase).To(Equal(v1.Running)) + }) + + It("should move to Failed if the launcher client is unresponsive", func() { + vmi := NewRunningVMI(vmiTestUUID, podTestUUID, host) + + createVMI(vmi) + + controller.launcherClients = &launcherclients.MockLauncherClientManager{ + Initialized: true, + UnResponsive: true, + } + + sanityExecute() + + testutils.ExpectEvent(recorder, VMICrashed) + Expect(mockQueue.GetAddAfterEnqueueCount()).To(Equal(0)) + updatedVMI, err := virtfakeClient.KubevirtV1().VirtualMachineInstances(metav1.NamespaceDefault).Get(context.TODO(), vmi.Name, metav1.GetOptions{}) + Expect(err).NotTo(HaveOccurred()) + Expect(updatedVMI.Status.Phase).To(Equal(v1.Failed)) + }) + + It("should stay Running if the launcher client is responsive", func() { + vmi := NewRunningVMI(vmiTestUUID, podTestUUID, host) + + createVMI(vmi) + + controller.launcherClients = &launcherclients.MockLauncherClientManager{ + Initialized: true, + UnResponsive: false, + } + + sanityExecute() + testutils.ExpectEvent(recorder, v1.SyncFailed.String()) + + Expect(mockQueue.GetAddAfterEnqueueCount()).To(Equal(0)) + updatedVMI, err := virtfakeClient.KubevirtV1().VirtualMachineInstances(metav1.NamespaceDefault).Get(context.TODO(), vmi.Name, metav1.GetOptions{}) + Expect(err).NotTo(HaveOccurred()) + Expect(updatedVMI.Status.Phase).To(Equal(v1.Running)) + }) + + It("should move to WaitingForSync if the VMI is a migration target and launcher is unresponsive", func() { + vmi := NewRunningVMI(vmiTestUUID, podTestUUID, host) + vmi.Annotations = map[string]string{ + v1.CreateMigrationTarget: "true", + } + + controller.launcherClients = &launcherclients.MockLauncherClientManager{ + Initialized: true, + UnResponsive: true, + } + + phase, err := controller.calculateVmPhaseForStatusReason(nil, vmi) + Expect(err).NotTo(HaveOccurred()) + Expect(phase).To(Equal(v1.WaitingForSync)) + }) + + It("should propagate error from IsLauncherClientUnresponsive and keep the current phase", func() { + vmi := NewRunningVMI(vmiTestUUID, podTestUUID, host) + + createVMI(vmi) + + controller.launcherClients = &launcherclients.MockLauncherClientManager{ + UnResponsiveError: fmt.Errorf("test error"), + } + + sanityExecute() + + updatedVMI, err := virtfakeClient.KubevirtV1().VirtualMachineInstances(metav1.NamespaceDefault).Get(context.TODO(), vmi.Name, metav1.GetOptions{}) + Expect(err).NotTo(HaveOccurred()) + Expect(updatedVMI.Status.Phase).To(Equal(v1.Running)) + }) + }) + It("should cleanup if vmi is finalized and domain does not exist", func() { vmi := api2.NewMinimalVMI("testvmi") vmi.UID = vmiTestUUID @@ -1159,6 +1248,10 @@ var _ = Describe("VirtualMachineInstance", func() { vmi.Status.Phase = v1.Running createVMI(vmi) + controller.launcherClients = &launcherclients.MockLauncherClientManager{ + Initialized: true, + UnResponsive: true, + } sanityExecute() @@ -3629,6 +3722,16 @@ func NewScheduledVMI(vmiUID types.UID, podUID types.UID, hostname string) *v1.Vi return vmi } +func NewRunningVMI(vmiUID types.UID, podUID types.UID, hostname string) *v1.VirtualMachineInstance { + vmi := api2.NewMinimalVMI("testvmi") + vmi.UID = vmiUID + vmi.ObjectMeta.ResourceVersion = "1" + vmi.Status.Phase = v1.Running + + vmi = addActivePods(vmi, podUID, hostname) + return vmi +} + type netConfStub struct { vmiUID types.UID SetupError error -- 2.56.0 ++++++ 0006-Notify-server-Make-event-chan-private.patch ++++++ >From b428d219c5c879cf8807d9e63183db3e174dfea4 Mon Sep 17 00:00:00 2001 From: Luboslav Pivarc <[email protected]> Date: Wed, 26 Aug 2026 10:25:40 +0200 Subject: [PATCH] Notify server: Make event chan private Signed-off-by: Luboslav Pivarc <[email protected]> --- pkg/virt-handler/notify-server/server.go | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/pkg/virt-handler/notify-server/server.go b/pkg/virt-handler/notify-server/server.go index 4719880f42..f63b3d651b 100644 --- a/pkg/virt-handler/notify-server/server.go +++ b/pkg/virt-handler/notify-server/server.go @@ -46,7 +46,7 @@ import ( const socketCheckInterval = 5 * time.Second type Notify struct { - EventChan chan watch.Event + eventChan chan watch.Event recorder record.EventRecorder vmiStore cache.Store } @@ -81,14 +81,14 @@ func (n *Notify) HandleDomainEvent(_ context.Context, request *notifyv1.DomainEv log.Log.Object(domain).V(3).Infof("Received Domain Event of type %s", request.EventType) switch request.EventType { case string(watch.Added): - n.EventChan <- watch.Event{Type: watch.Added, Object: domain} + n.eventChan <- watch.Event{Type: watch.Added, Object: domain} case string(watch.Modified): - n.EventChan <- watch.Event{Type: watch.Modified, Object: domain} + n.eventChan <- watch.Event{Type: watch.Modified, Object: domain} case string(watch.Deleted): - n.EventChan <- watch.Event{Type: watch.Deleted, Object: domain} + n.eventChan <- watch.Event{Type: watch.Deleted, Object: domain} case string(watch.Error): log.Log.Object(domain).Errorf("Domain error event with message: %s", status.Message) - n.EventChan <- watch.Event{Type: watch.Error, Object: status} + n.eventChan <- watch.Event{Type: watch.Error, Object: status} } return response, nil } @@ -131,7 +131,7 @@ func RunServer(virtShareDir string, stopChan <-chan struct{}, c chan watch.Event grpcServer := grpc.NewServer([]grpc.ServerOption{}...) notifyServer := &Notify{ - EventChan: c, + eventChan: c, recorder: recorder, vmiStore: vmiStore, } -- 2.56.0 ++++++ 0007-Notify-server-Ignore-client-error.patch ++++++ >From 6ba8edb64cfc8cd6ada3c5146148b099d7a063be Mon Sep 17 00:00:00 2001 From: Luboslav Pivarc <[email protected]> Date: Wed, 26 Aug 2026 14:23:14 +0200 Subject: [PATCH] Notify server: Ignore client error Launcher can produce watch error that currently will cause restart of domain watcher. Restart of the watcher means an expensive List is performed, forcing disruption even for clients that are healthy. Therefore this commits simply doesn't handle the error and keeps only logging. Signed-off-by: Luboslav Pivarc <[email protected]> --- pkg/virt-handler/notify-server/server.go | 1 - 1 file changed, 1 deletion(-) diff --git a/pkg/virt-handler/notify-server/server.go b/pkg/virt-handler/notify-server/server.go index f63b3d651b..469070983f 100644 --- a/pkg/virt-handler/notify-server/server.go +++ b/pkg/virt-handler/notify-server/server.go @@ -88,7 +88,6 @@ func (n *Notify) HandleDomainEvent(_ context.Context, request *notifyv1.DomainEv n.eventChan <- watch.Event{Type: watch.Deleted, Object: domain} case string(watch.Error): log.Log.Object(domain).Errorf("Domain error event with message: %s", status.Message) - n.eventChan <- watch.Event{Type: watch.Error, Object: status} } return response, nil } -- 2.56.0 ++++++ disks-images-provider.yaml ++++++ --- /var/tmp/diff_new_pack.Uvwah3/_old 2026-10-22 15:54:46.774379088 +0200 +++ /var/tmp/diff_new_pack.Uvwah3/_new 2026-10-22 15:54:46.777379213 +0200 @@ -23,7 +23,7 @@ serviceAccountName: kubevirt-testing containers: - name: target - image: quay.io/kubevirt/disks-images-provider:v1.9.0 + image: quay.io/kubevirt/disks-images-provider:v1.9.1 imagePullPolicy: Always env: - name: NUM_TEST_IMAGE_REPLICAS ++++++ kubevirt-1.9.0.tar.gz -> kubevirt-1.9.1.tar.gz ++++++ /work/SRC/openSUSE:Factory/kubevirt1.9/kubevirt-1.9.0.tar.gz /work/SRC/openSUSE:Factory/.kubevirt1.9.new.2252680/kubevirt-1.9.1.tar.gz differ: char 13, line 1
