Chapter 8. Managing VMs

Procedure

1. Log in to the VM by using a console or SSH.

2. Install the QEMU guest agent by running the following command:

   $ yum install -y qemu-guest-agent

3. Ensure the service is persistent and start it:

   $ systemctl enable --now qemu-guest-agent

Procedure

1. In the Windows guest operating system, use the File Explorer to navigate to the guest-agent directory in the virtio-win CD drive.
2. Run the qemu-ga-x86_64.msi installer.

Verification

1. Obtain a list of network services by running the following command:

   $ net start

2. Verify that the output contains the QEMU Guest Agent.

Procedure

1. When creating a Windows VM from a template, click Customize VirtualMachine.
2. Select Mount Windows drivers disk.
3. Click the Customize VirtualMachine parameters.
4. Click Create VirtualMachine.

Procedure

1. Navigate to the existing Windows VM, and click Actions Stop.
2. Go to VM Details Configuration Disks and click Add disk.
3. Add windows-driver-disk from container source, set the Type to CD-ROM, and then set the Interface to SATA.
4. Click Save.
5. Start the VM, and connect to a graphical console.

Procedure

1. In the Windows operating system, use the File Explorer to navigate to the virtio-win CD drive.

2. Double-click the drive to run the appropriate installer for your VM.

   For a 64-bit vCPU, select the virtio-win-gt-x64 installer. 32-bit vCPUs are no longer supported.

3. Optional: During the Custom Setup step of the installer, select the device drivers you want to install. The recommended driver set is selected by default.
4. After the installation is complete, select Finish.
5. Reboot the VM.

Verification

1. Open the system disk on the PC. This is typically C:.
2. Navigate to Program Files Virtio-Win.

Procedure

1. Start the VM and connect to a graphical console.
2. Log in to a Windows user session.

3. Open Device Manager and expand Other devices to list any Unknown device.

   1. Open the Device Properties to identify the unknown device.
   2. Right-click the device and select Properties.
   3. Click the Details tab and select Hardware Ids in the Property list.
   4. Compare the Value for the Hardware Ids with the supported VirtIO drivers.
4. Right-click the device and select Update Driver Software.
5. Click Browse my computer for driver software and browse to the attached SATA CD drive, where the VirtIO drivers are located. The drivers are arranged hierarchically according to their driver type, operating system, and CPU architecture.
6. Click Next to install the driver.
7. Repeat this process for all the necessary VirtIO drivers.
8. After the driver installs, click Close to close the window.
9. Reboot the VM to complete the driver installation.

Procedure

1. Add the container-native-virtualization/virtio-win container disk as a CD drive by editing the VirtualMachine manifest:

   # ...
   spec:
     domain:
       devices:
         disks:
           - name: virtiocontainerdisk
             bootOrder: 2 1
             cdrom:
               bus: sata
   volumes:
     - containerDisk:
         image: container-native-virtualization/virtio-win
       name: virtiocontainerdisk

   1

   OpenShift Virtualization boots the VM disks in the order defined in the VirtualMachine manifest. You can either define other VM disks that boot before the container-native-virtualization/virtio-win container disk or use the optional bootOrder parameter to ensure the VM boots from the correct disk. If you configure the boot order for a disk, you must configure the boot order for the other disks.

2. Apply the changes:

   • If the VM is not running, run the following command:

     $ virtctl start <vm> -n <namespace>

   • If the VM is running, reboot the VM or run the following command:

     $ oc apply -f <vm.yaml>

3. After the VM has started, install the VirtIO drivers from the SATA CD drive.

Procedure

1. In the Windows Guest operating system, click the Windows key and select Settings.
2. Navigate to Windows Update Advanced Options Optional Updates.
3. Install all updates from Red Hat, Inc..
4. Reboot the VM.

Verification

1. On the Windows VM, navigate to the Device Manager.
2. Select a device.
3. Select the Driver tab.
4. Click Driver Details and confirm that the virtio driver details displays the correct version.

Procedure

1. On the Virtualization VirtualMachines page, click a VM to open the VirtualMachine details page.
2. Click the Console tab. The VNC console session starts automatically.

3. Optional: To switch to the vGPU display of a Windows VM, select Ctl + Alt + 2 from the Send key list.

   • Select Ctl + Alt + 1 from the Send key list to restore the default display.
4. To end the console session, click outside the console pane and then click Disconnect.

Procedure

1. Run the following command to start the console session:

   $ virtctl vnc <vm_name>

2. If the connection fails, run the following command to collect troubleshooting information:

   $ virtctl vnc <vm_name> -v 4

Procedure

1. Enable the feature gate in the HyperConverged (HCO) custom resource (CR):

   $ oc patch hyperconverged kubevirt-hyperconverged -n openshift-cnv --type json -p '[{"op": "replace", "path": "/spec/featureGates/deployVmConsoleProxy", "value": true}]'

2. Generate a token by entering the following command:

   $ curl --header "Authorization: Bearer ${TOKEN}" \
        "https://api.<cluster_fqdn>/apis/token.kubevirt.io/v1alpha1/namespaces/<namespace>/virtualmachines/<vm_name>/vnc?duration=<duration>"

   The <duration> parameter can be set in hours and minutes, with a minimum duration of 10 minutes. For example: 5h30m. If this parameter is not set, the token is valid for 10 minutes by default.

   Sample output:

   { "token": "eyJhb..." }

3. Optional: Use the token provided in the output to create a variable:

   $ export VNC_TOKEN="<token>"

Verification

1. Log in to the cluster by entering the following command:

   $ oc login --token ${VNC_TOKEN}

2. Test access to the VNC console of the VM by using the virtctl command:

   $ virtctl vnc <vm_name> -n <namespace>

Procedure

1. On the Virtualization VirtualMachines page, click a VM to open the VirtualMachine details page.
2. Click the Console tab. The VNC console session starts automatically.
3. Click Disconnect to end the VNC console session. Otherwise, the VNC console session continues to run in the background.
4. Select Serial console from the console list.

5. Optional: To switch to the vGPU display of a Windows VM, select Ctl + Alt + 2 from the Send key list.

   • Select Ctl + Alt + 1 from the Send key list to restore the default display.
6. To end the console session, click outside the console pane and then click Disconnect.

Procedure

1. Run the following command to start the console session:

   $ virtctl console <vm_name>

2. Press Ctrl+] to end the console session.

   $ virtctl vnc <vm_name>

3. If the connection fails, run the following command to collect troubleshooting information:

   $ virtctl vnc <vm_name> -v 4

Procedure

1. On the Virtualization VirtualMachines page, click a VM to open the VirtualMachine details page.
2. Click the Console tab. The VNC console session starts automatically.
3. Click Disconnect to end the VNC console session. Otherwise, the VNC console session continues to run in the background.
4. Select Desktop viewer from the console list.
5. Click Create RDP Service to open the RDP Service dialog.
6. Select Expose RDP Service and click Save to create a node port service.
7. Click Launch Remote Desktop to download an .rdp file and launch the desktop viewer.

8. Optional: To switch to the vGPU display of a Windows VM, select Ctl + Alt + 2 from the Send key list.

   • Select Ctl + Alt + 1 from the Send key list to restore the default display.
9. To end the console session, click outside the console pane and then click Disconnect.

Procedure

1. Navigate to Virtualization VirtualMachines.
2. Click a VM to view the VirtualMachine details page.
3. On the Configuration tab, click the Network interfaces tab.
4. Click Add network interface.
5. Enter the interface name and select the network attachment definition from the Network list.
6. Click Save.
7. Restart the VM to apply the changes.

Procedure

1. Obtain the IP address of the VM by running the following command:

   $ oc describe vm <vm_name> -n <namespace>

   Example output

   # ...
   Interfaces:
     Interface Name:  eth0
     Ip Address:      10.244.0.37/24
     Ip Addresses:
       10.244.0.37/24
       fe80::858:aff:fef4:25/64
     Mac:             0a:58:0a:f4:00:25
     Name:            default
   # ...

2. Connect to the VM by running the following command:

   $ ssh <user_name>@<ip_address> -i <ssh_key>

   Example

   $ ssh cloud-user@10.244.0.37 -i ~/.ssh/id_rsa_cloud-user

Procedure

1. Click Pipelines Pipelines in the side menu.
2. Select a pipeline to open the Pipeline details page.
3. From the Actions list, select Start. The Start Pipeline dialog is displayed.
4. Keep the default values for the parameters and then click Start to run the pipeline. The Details tab tracks the progress of each task and displays the pipeline status.

Procedure

1. To run the Microsoft Windows 11 installer pipeline, create the following PipelineRun manifest:

   apiVersion: tekton.dev/v1
   kind: PipelineRun
   metadata:
     generateName: windows11-installer-run-
     labels:
       pipelinerun: windows11-installer-run
   spec:
       params:
       -   name: winImageDownloadURL
           value: <windows_image_download_url> 1
       -   name: acceptEula
           value: false 2
       pipelineRef:
           params:
           -   name: catalog
               value: redhat-pipelines
           -   name: type
               value: artifact
           -   name: kind
               value: pipeline
           -   name: name
               value: windows-efi-installer
           -   name: version
               value: 4
           resolver: hub
       taskRunSpecs:
       -   pipelineTaskName: modify-windows-iso-file
           PodTemplate:
               securityContext:
                   fsGroup: 107
                   runAsUser: 107

   1

   Specify the URL for the Windows 11 64-bit ISO file. The product’s language must be English (United States).

   2

   Example PipelineRun objects have a special parameter, acceptEula. By setting this parameter, you are agreeing to the applicable Microsoft user license agreements for each deployment or installation of the Microsoft products. If you set it to false, the pipeline exits at the first task.

2. Apply the PipelineRun manifest:

   $ oc apply -f windows11-customize-run.yaml

Procedure

1. Set limits for a VM by editing the VirtualMachine manifest. For example:

   apiVersion: kubevirt.io/v1
   kind: VirtualMachine
   metadata:
     name: with-limits
   spec:
     runStrategy: Halted
     template:
       spec:
         domain:
   # ...
           resources:
             requests:
               memory: 128Mi
             limits:
               memory: 256Mi  1

   1

   This configuration is supported because the limits.memory value is at least 100Mi larger than the requests.memory value.

2. Save the VirtualMachine manifest.

Procedure

1. Open the HyperConverged CR by running the following command:

   $ oc edit hyperconverged kubevirt-hyperconverged -n openshift-cnv

2. Add the defaultCPUModel field to the CR and set the value to the name of a CPU model that exists in the cluster:

   apiVersion: hco.kubevirt.io/v1beta1
   kind: HyperConverged
   metadata:
    name: kubevirt-hyperconverged
    namespace: openshift-cnv
   spec:
     defaultCPUModel: "EPYC"

3. Apply the YAML file to your cluster.

Procedure

1. Edit or create a VirtualMachine manifest file. Use the spec.firmware.bootloader stanza to configure UEFI mode:

   Booting in UEFI mode with secure boot active

   apiversion: kubevirt.io/v1
   kind: VirtualMachine
   metadata:
     labels:
       special: vm-secureboot
     name: vm-secureboot
   spec:
     template:
       metadata:
         labels:
           special: vm-secureboot
       spec:
         domain:
           devices:
             disks:
             - disk:
                 bus: virtio
               name: containerdisk
           features:
             acpi: {}
             smm:
               enabled: true 1
           firmware:
             bootloader:
               efi:
                 secureBoot: true 2
   # ...

   1

   OpenShift Virtualization requires System Management Mode (SMM) to be enabled for Secure Boot in UEFI mode to occur.

   2

   OpenShift Virtualization supports a VM with or without Secure Boot when using UEFI mode. If Secure Boot is enabled, then UEFI mode is required. However, UEFI mode can be enabled without using Secure Boot.

2. Apply the manifest to your cluster by running the following command:

   $ oc create -f <file_name>.yaml

Procedure

1. Configure a PXE network on the cluster:

   1. Create the network attachment definition file for PXE network pxe-net-conf:

      apiVersion: "k8s.cni.cncf.io/v1"
      kind: NetworkAttachmentDefinition
      metadata:
        name: pxe-net-conf 1
      spec:
        config: |
          {
            "cniVersion": "0.3.1",
            "name": "pxe-net-conf", 2
            "type": "bridge", 3
            "bridge": "bridge-interface", 4
            "macspoofchk": false, 5
            "vlan": 100, 6
            "disableContainerInterface": true,
            "preserveDefaultVlan": false 7
          }

      1

      The name for the NetworkAttachmentDefinition object.

      2

      The name for the configuration. It is recommended to match the configuration name to the name value of the network attachment definition.

      3

      The actual name of the Container Network Interface (CNI) plugin that provides the network for this network attachment definition. This example uses a Linux bridge CNI plugin. You can also use an OVN-Kubernetes localnet or an SR-IOV CNI plugin.

      4

      The name of the Linux bridge configured on the node.

      5

      Optional: A flag to enable the MAC spoof check. When set to true, you cannot change the MAC address of the pod or guest interface. This attribute allows only a single MAC address to exit the pod, which provides security against a MAC spoofing attack.

      6

      Optional: The VLAN tag. No additional VLAN configuration is required on the node network configuration policy.

      7

      Optional: Indicates whether the VM connects to the bridge through the default VLAN. The default value is true.

2. Create the network attachment definition by using the file you created in the previous step:

   $ oc create -f pxe-net-conf.yaml

3. Edit the virtual machine instance configuration file to include the details of the interface and network.

   1. Specify the network and MAC address, if required by the PXE server. If the MAC address is not specified, a value is assigned automatically.

      Ensure that bootOrder is set to 1 so that the interface boots first. In this example, the interface is connected to a network called <pxe-net>:

      interfaces:
      - masquerade: {}
        name: default
      - bridge: {}
        name: pxe-net
        macAddress: de:00:00:00:00:de
        bootOrder: 1

      Note

      Boot order is global for interfaces and disks.

   2. Assign a boot device number to the disk to ensure proper booting after operating system provisioning.

      Set the disk bootOrder value to 2:

      devices:
        disks:
        - disk:
            bus: virtio
          name: containerdisk
          bootOrder: 2

   3. Specify that the network is connected to the previously created network attachment definition. In this scenario, <pxe-net> is connected to the network attachment definition called <pxe-net-conf>:

      networks:
      - name: default
        pod: {}
      - name: pxe-net
        multus:
          networkName: pxe-net-conf

4. Create the virtual machine instance:

   $ oc create -f vmi-pxe-boot.yaml

   Example output

     virtualmachineinstance.kubevirt.io "vmi-pxe-boot" created

5. Wait for the virtual machine instance to run:

   $ oc get vmi vmi-pxe-boot -o yaml | grep -i phase
     phase: Running

6. View the virtual machine instance using VNC:

   $ virtctl vnc vmi-pxe-boot

7. Watch the boot screen to verify that the PXE boot is successful.

8. Log in to the virtual machine instance:

   $ virtctl console vmi-pxe-boot

Verification

1. Verify the interfaces and MAC address on the virtual machine and that the interface connected to the bridge has the specified MAC address. In this case, we used eth1 for the PXE boot, without an IP address. The other interface, eth0, got an IP address from Red Hat OpenShift Service on AWS.

   $ ip addr

   Example output

   ...
   3. eth1: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
      link/ether de:00:00:00:00:de brd ff:ff:ff:ff:ff:ff

Procedure

1. Navigate to Virtualization VirtualMachines in the web console.
2. Select a running VM to view its details.
3. On the VirtualMachine details page, click Configuration Disks.

4. Add a hot plugged disk:

   1. Click Add disk.
   2. In the Add disk (hot plugged) window, select the disk from the Source list and click Save.

5. Optional: Unplug a hot plugged disk:

   1. Click the Options menu beside the disk and select Detach.
   2. Click Detach.

6. Optional: Make a hot plugged disk persistent:

   1. Click the Options menu beside the disk and select Make persistent.
   2. Reboot the VM to apply the change.

Procedure

1. Create a DataVolume manifest as shown in the following example:

   Example DataVolume manifest

   apiVersion: cdi.kubevirt.io/v1beta1
   kind: DataVolume
   metadata:
     name: blank-image-datavolume
   spec:
     source:
       blank: {}
     storage:
       resources:
         requests:
           storage: <2Gi> 1
     storageClassName: "<storage_class>" 2

   1

   Specify the amount of available space requested for the data volume.

   2

   Optional: If you do not specify a storage class, the default storage class is used.

2. Create the data volume by running the following command:

   $ oc create -f <blank-image-datavolume>.yaml

Procedure

1. Navigate to Virtualization VirtualMachines in the web console.

2. Click the Options menu beside the virtual machine and select Migration Storage.

   You can also access this option from the VirtualMachine details page by selecting Actions Migration Storage.

3. On the Migration details page, choose whether to migrate the entire VM storage or selected volumes only. If you click Selected volumes, select any disks that you intend to migrate. Click Next to proceed.
4. From the list of available options on the Destination StorageClass page, select the storage class to migrate to. Click Next to proceed.
5. On the Review page, review the list of affected disks and the target storage class. To start the migration, click Migrate VirtualMachine storage.
6. Stay on the Migrate VirtualMachine storage page to watch the progress and wait for the confirmation that the migration completed successfully.

Verification

1. From the VirtualMachine details page, navigate to Configuration Storage.
2. Verify that all disks have the expected storage class listed in the Storage class column.