…#2624)

Description
Virtual machines created without paravirtualization keep all their disks and CD-ROMs on the SATA bus forever, even after enableParavirtualization is turned on and the VM is restarted. The recorded bus of an existing device always took priority over the bus implied by the paravirtualization setting.

Now, when the paravirtualization mode changes, devices move to the bus of the new mode on the restart this change already requires. Devices hot-plugged on a non-default bus (for example USB) keep their bus as before.

---------

Signed-off-by: Nikita Korolev <nikita.korolev@flant.com>

… resources with d8- (#2632)

* fix(observability): default audit TLS cert paths to certificates dir

The mounted secret is at /etc/virtualization-audit/certificates (plural),
but the flag defaults pointed at /etc/virtualization-audit/certificate,
so the server failed to load TLS when started without explicit flags.

Signed-off-by: Daniil Antoshin <daniil.antoshin@flant.com>

* refactor(observability): prefix audit log-shipper resources with d8- and drop to-

Rename the ClusterLoggingConfig and ClusterLogDestination objects created for
audit shipping: to-virtualization-audit -> d8-virtualization-audit and
virtualization-audit-* -> d8-virtualization-audit-*, aligning with the d8-
naming convention for module-owned cluster-scoped resources.

Signed-off-by: Daniil Antoshin <daniil.antoshin@flant.com>

---------

Signed-off-by: Daniil Antoshin <daniil.antoshin@flant.com>

Signed-off-by: Vladislav Panfilov <vladislav.panfilov@flant.com>

update CODEOWNERS

Signed-off-by: Vladislav Panfilov <vladislav.panfilov@flant.com>

Signed-off-by: Maksim Fedotov <maksim.fedotov@flant.com>

Signed-off-by: Maksim Fedotov <maksim.fedotov@flant.com>

Signed-off-by: Valeriy Khorunzhin <valeriy.khorunzhin@flant.com>

Signed-off-by: Vladislav Panfilov <vladislav.panfilov@flant.com>
Signed-off-by: Dmitry Rakitin <dmitry.rakitin@flant.com>
Co-authored-by: Dmitry Rakitin <dmitry.rakitin@flant.com>

Signed-off-by: deckhouse-BOaTswain <89150800+deckhouse-boatswain@users.noreply.github.com>
Co-authored-by: nevermarine <nevermarine@users.noreply.github.com>

Description
Prepares the deckhouse/virtualization module to move from GitHub to GitLab by porting the CI. All development pipelines that ran on GitHub Actions now run on GitLab CI with the same behavior: build and deploy (dev/prod, all editions), lint, tests, secret/CVE/Svace scanning, changelog and backport automation, MR auto-assign, and manual release-channel dispatch.

The root .gitlab-ci.yml is a thin entrypoint; the pipeline lives in .gitlab/ci/**.

Not migrated in this iteration
e2e workflows — out of scope.
Reactive slash-commands / webhook listener — GitLab can't start pipelines from MR comments or label changes natively. Manual and scheduled jobs cover the same surface; a webhook listener is a possible follow-up.
Correctness fixes (from review)
Editions could be built/tagged wrong on release and manual pipelines. Some jobs picked up stray pipeline variables that overrode their own settings (a release tag built the CE prod image as EE; a manual precache pushed the wrong tag). The affected build/scan jobs are now isolated to their own config.
mrs:summary could never run — it expected Node.js on the shell runner, which has none; it now runs in the node container like the other JS job.
Malformed Loop release notification — the message is assembled safely, so a tag or channel value with quotes/newlines can't break or inject into it.
Generated-files check ran too much — the heavy vm-route-forge (bpf2go, docker) check now runs only on vm-route-forge changes, not on every change.

---------

Signed-off-by: Nikita Korolev <nikita.korolev@flant.com>

…ion=false (#2645)

Description
On a VM with enableParavirtualization=false, disks attached via VirtualMachineBlockDeviceAttachment were switched to the SATA bus, even though hot-plugged disks must stay on SCSI. This broke such attachments. The bus of a runtime hot-plugged disk is now preserved regardless of the paravirtualization mode.

---------

Co-authored-by: Ivan Mikheykin <ivan.mikheykin@flant.com>
Signed-off-by: Nikita Korolev <nikita.korolev@flant.com>

…tection (#2659)

Description
ProtectionService.RemoveProtection re-reads a fresh copy of the object and
removes only our finalizer under an optimistic lock, retrying on conflict,
instead of resending the whole (possibly stale) finalizers list.

Why do we need it, and what problem does it solve?
On a terminating PVC the built-in pvc-protection controller strips
kubernetes.io/pvc-protection. Patching from a stale copy resent it, and the
API server rejected the update: no new finalizers can be added if the object is being deleted. The VM deletion handler surfaced this as failed to release PVC protection, never removed the VM cleanup finalizer, and VM deletion hung.

What is the expected result?
Deleting a VM whose block-device PVC is terminating completes cleanly; the
errors above no longer appear in the vm-controller log.

Signed-off-by: Dmitry Rakitin <dmitry.rakitin@flant.com>

- fixed CVEs from #2609

Signed-off-by: Ivan Mikheykin <ivan.mikheykin@flant.com>

…#2638)

Description
The virtualization-dra USB DaemonSet pods never start — they stay in CrashLoopBackOff on every node, so USB device passthrough is unavailable. The main container is privileged and runs with a read-only root filesystem while also bind-mounting the host /sys. Under containerd this combination makes the runtime fail to set up the /sys/fs/cgroup mount on the read-only rootfs, and the container never starts.

A privileged container already gets a read-write /sys from the runtime, so the explicit /sys mount is redundant. It is removed together with its volume and the now-dead /sys entry in the SecurityPolicy host-path allow-list.

-------------

Signed-off-by: Nikita Korolev <nikita.korolev@flant.com>

Signed-off-by: Valeriy Khorunzhin <valeriy.khorunzhin@flant.com>

fix(dra): load compressed usbip kernel modules (xz, gzip)

Pre-installed usbip modules may ship compressed as .ko.xz or .ko.gz
depending on the host distribution, not only .ko or .ko.zst. Resolve all
kernel-supported compression suffixes (zstd, xz, gzip) in the module path
fallback and decompress accordingly before finit_module.

Signed-off-by: Daniil Antoshin <daniil.antoshin@flant.com>

Virtual machines with local (RWO) disks could get stuck unable to migrate whenever they had a pending restart. The "restart required to apply configuration" state can appear on its own after a module upgrade, without any user change; while it was set, volume migration of the VM's local disks was skipped entirely. Migrations initiated by evacuation (node drain), firmware updates and other workload updates then hung indefinitely — target disks were never prepared and the migration stayed Pending.

---------

Signed-off-by: Daniil Antoshin <daniil.antoshin@flant.com>

Signed-off-by: Vladislav Panfilov <vladislav.panfilov@flant.com>
Signed-off-by: Dmitry Rakitin <dmitry.rakitin@flant.com>
Co-authored-by: Dmitry Rakitin <dmitry.rakitin@flant.com>

…overy (#2664)

* chore(vmclass): discovered features should be frozen after first discovery

- Use first time discovered feature set to filter availableNodes on later reconciles.
- Add errors in case no availableNodes are present in the cluster.

---------

Signed-off-by: Ivan Mikheykin <ivan.mikheykin@flant.com>

Signed-off-by: deckhouse-BOaTswain <89150800+deckhouse-boatswain@users.noreply.github.com>
Co-authored-by: nevermarine <nevermarine@users.noreply.github.com>

Signed-off-by: Maksim Fedotov <maksim.fedotov@flant.com>

chore(core): cve mitigation 13-07-2026

Fixed vulnerability:
  - CVE-2026-39822
  - CVE-2026-42505
  - CVE-2026-39828
  - CVE-2026-39829
  - CVE-2026-39830
  - CVE-2026-39831
  - CVE-2026-39832
  - CVE-2026-39835
  - CVE-2026-42508
  - CVE-2026-46595
  - CVE-2026-46597
  - CVE-2026-39827
  - CVE-2026-39833
  - CVE-2026-39834
  - CVE-2026-46598
  - CVE-2026-25681
  - CVE-2026-27136
  - CVE-2026-33814
  - CVE-2026-39821
  - CVE-2026-25680
  - CVE-2026-42502
  - CVE-2026-42506
  - CVE-2026-39824
  - GO-2026-5932

Signed-off-by: Dmitry Lopatin <dmitry.lopatin@flant.com>

A SecureBoot virtual machine stores its Secure Boot state in a persistent volume, which needs a default StorageClass. On a cluster without one the volume can't be created and the VM never starts — and nothing on the VirtualMachine explained why, the error was only visible on internal objects.

---------

Signed-off-by: Daniil Antoshin <daniil.antoshin@flant.com>

…2443)

Signed-off-by: Valeriy Khorunzhin <valeriy.khorunzhin@flant.com>

…2682)

Description
Manual (workflow_dispatch) workflow to recheck a module tag in the dev-registry and rebuild it when some of its images can no longer be pulled.

---------

Signed-off-by: Nikita Korolev <nikita.korolev@flant.com>

Description
The manual "check and rebuild" workflow is meant to repair a published dev module tag after dev-registry GC collects some of its component images. It didn't actually repair anything: werf kept reusing the collected stages (their tags still resolve) and re-reported the same dead digests, so the rebuilt tag was still broken.

Now, for every component whose final image is no longer pullable, the workflow deletes its stages by tag (the dead digest can't be deleted), forcing werf to rebuild and re-push a live image; images-digests and prepare-bundle are dropped too so images_digests.json is regenerated and the tag republished. The check/rebuild logic moved into reusable scripts, and the same flow is ported to GitLab CI.

---------

Signed-off-by: Nikita Korolev <nikita.korolev@flant.com>

Add IPAM (IP Address Management) for virtual machine additional network interfaces, integrating with the SDN module's IPAM capabilities (address pools, IPAddress resources, DHCP delivery).

Signed-off-by: Roman Sysoev <roman.sysoev@flant.com>
Co-authored-by: Max Chervov <max.chervov@gmail.com>

Per-source-node throttling of the live-migration sync (memory transfer) phase, so that during a node drain many virtual machines can prepare their targets in parallel while only a limited number transfer memory at a time.

Mechanism (mirrors the existing inbound-migration limit): an in-memory SyncMigrationLimiter in the leader virtualization-controller, keyed by source node. A migration must acquire a sync slot before the controller fills MigrationState.MigrationConfiguration; the KubeVirt fork gates the source-side transfer start on that field, so a migration without a slot stays prepared and parked at TargetReady (target pod created and ready; memory transfer not started) until a slot frees.

---------

Signed-off-by: Daniil Loktev <lokt.daniil@gmail.com>
Signed-off-by: Daniil Antoshin <daniil.antoshin@flant.com>
Co-authored-by: Daniil Antoshin <daniil.antoshin@flant.com>

Signed-off-by: deckhouse-BOaTswain <89150800+deckhouse-boatswain@users.noreply.github.com>