From 6ac2601a68852a0bb238ab68f9088ab10f17e41d Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <andrei.kvapil@aenix.io>
Date: Mon, 22 Jun 2026 21:39:48 +0200
Subject: [PATCH] fix(kubevirt-instancetypes): drop persistent EFI/TPM to
 unblock live-migration
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

TEMPORARY revert. Restoring persistent EFI/TPM state (4cc60e3) makes
windows.11/2k22/2k25 VMs get a backend-storage PVC that is ReadWriteOnce on the
default StorageClass, which pins the VM to its node and blocks live-migration and
node drains (with evictionStrategy: LiveMigrate this can stall cluster upgrades).
See #3005.

Strip persistent EFI/TPM from the preferences again, but with `yq del` so an
emptied preferredTPM stays `{}` (the v1.8 CRD rejects null) — the bug the original
sed strip caused. Secure Boot and the vTPM stay present, just non-persistent.

Stopgap until vm-state can request an RWX backend (RWX-Block via the upstream
KubeVirt change, or an RWX-Filesystem vmStateStorageClass).

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <andrei.kvapil@aenix.io>
---
 .../system/kubevirt-instancetypes/Makefile    |  6 +++++
 .../templates/preferences.yaml                | 24 +++++--------------
 2 files changed, 12 insertions(+), 18 deletions(-)

diff --git a/packages/system/kubevirt-instancetypes/Makefile b/packages/system/kubevirt-instancetypes/Makefile
index 99771e976..15ac774d5 100644
--- a/packages/system/kubevirt-instancetypes/Makefile
+++ b/packages/system/kubevirt-instancetypes/Makefile
@@ -16,6 +16,12 @@ update:
 	mkdir templates
 	kustomize build https://github.com/kubevirt/common-instancetypes/preferences?ref=$(COMMON_INSTANCETYPES_REF) > templates/preferences.yaml
 	yq -i 'select(.kind != "VirtualMachinePreference")' templates/preferences.yaml
+	# TEMPORARY (see #3005): drop persistent EFI/TPM state. With persistence on,
+	# KubeVirt creates a backend-storage PVC that is RWO on the default StorageClass,
+	# which pins the VM to its node and blocks live-migration / drain. Use `del` (not
+	# `sed -d`) so an emptied preferredTPM stays `{}` rather than null, which the
+	# KubeVirt v1.8 CRD structural schema rejects. Revert once vm-state can request RWX.
+	yq -i 'del(.spec.firmware.preferredEfi.persistent) | del(.spec.devices.preferredTPM.persistent)' templates/preferences.yaml
 	kustomize build https://github.com/kubevirt/common-instancetypes/instancetypes?ref=$(COMMON_INSTANCETYPES_REF) > templates/instancetypes.yaml
 	yq -i 'select(.kind != "VirtualMachineInstancetype")' templates/instancetypes.yaml
 	# Re-append Cozystack-local instancetypes the pinned catalog no longer ships
diff --git a/packages/system/kubevirt-instancetypes/templates/preferences.yaml b/packages/system/kubevirt-instancetypes/templates/preferences.yaml
index 458d8bd7b..6a42e6304 100644
--- a/packages/system/kubevirt-instancetypes/templates/preferences.yaml
+++ b/packages/system/kubevirt-instancetypes/templates/preferences.yaml
@@ -1352,8 +1352,7 @@ spec:
     preferredAutoattachInputDevice: true
     preferredDiskBus: sata
     preferredInterfaceModel: e1000e
-    preferredTPM:
-      persistent: true
+    preferredTPM: {}
   features:
     preferredAcpi: {}
     preferredApic: {}
@@ -1375,7 +1374,6 @@ spec:
     preferredSmm: {}
   firmware:
     preferredEfi:
-      persistent: true
       secureBoot: true
   preferredTerminationGracePeriodSeconds: 3600
   requirements:
@@ -1424,8 +1422,7 @@ spec:
     preferredInputBus: virtio
     preferredInputType: tablet
     preferredInterfaceModel: virtio
-    preferredTPM:
-      persistent: true
+    preferredTPM: {}
   features:
     preferredAcpi: {}
     preferredApic: {}
@@ -1447,7 +1444,6 @@ spec:
     preferredSmm: {}
   firmware:
     preferredEfi:
-      persistent: true
       secureBoot: true
   preferredTerminationGracePeriodSeconds: 3600
   requirements:
@@ -1894,8 +1890,7 @@ spec:
     preferredAutoattachInputDevice: true
     preferredDiskBus: sata
     preferredInterfaceModel: e1000e
-    preferredTPM:
-      persistent: true
+    preferredTPM: {}
   features:
     preferredAcpi: {}
     preferredApic: {}
@@ -1917,7 +1912,6 @@ spec:
     preferredSmm: {}
   firmware:
     preferredEfi:
-      persistent: true
       secureBoot: true
   preferredTerminationGracePeriodSeconds: 3600
   requirements:
@@ -1966,8 +1960,7 @@ spec:
     preferredInputBus: virtio
     preferredInputType: tablet
     preferredInterfaceModel: virtio
-    preferredTPM:
-      persistent: true
+    preferredTPM: {}
   features:
     preferredAcpi: {}
     preferredApic: {}
@@ -1989,7 +1982,6 @@ spec:
     preferredSmm: {}
   firmware:
     preferredEfi:
-      persistent: true
       secureBoot: true
   preferredTerminationGracePeriodSeconds: 3600
   requirements:
@@ -2036,8 +2028,7 @@ spec:
     preferredAutoattachInputDevice: true
     preferredDiskBus: sata
     preferredInterfaceModel: e1000e
-    preferredTPM:
-      persistent: true
+    preferredTPM: {}
   features:
     preferredAcpi: {}
     preferredApic: {}
@@ -2059,7 +2050,6 @@ spec:
     preferredSmm: {}
   firmware:
     preferredEfi:
-      persistent: true
       secureBoot: true
   preferredTerminationGracePeriodSeconds: 3600
   requirements:
@@ -2108,8 +2098,7 @@ spec:
     preferredInputBus: virtio
     preferredInputType: tablet
     preferredInterfaceModel: virtio
-    preferredTPM:
-      persistent: true
+    preferredTPM: {}
   features:
     preferredAcpi: {}
     preferredApic: {}
@@ -2131,7 +2120,6 @@ spec:
     preferredSmm: {}
   firmware:
     preferredEfi:
-      persistent: true
       secureBoot: true
   preferredTerminationGracePeriodSeconds: 3600
   requirements: