feat(vm): Add firmware handler

.helmignore

@@ -7,6 +7,5 @@ lib
 Makefile
 openapi
 *.md
-release.yaml
 werf*.yaml
 NOTES.txt

api/core/v1alpha2/virtual_machine.go

@@ -275,6 +275,8 @@ type VirtualMachineStatus struct {
 	// List of virtual machine pods.
 	VirtualMachinePods []VirtualMachinePod `json:"virtualMachinePods,omitempty"`
 	Resources          ResourcesStatus     `json:"resources,omitempty"`
+	// Firmware version.
+	FirmwareVersion string `json:"firmwareVersion,omitempty"`
 }
 
 type VirtualMachineStats struct {

api/core/v1alpha2/vmcondition/condition.go

@@ -36,9 +36,10 @@ const (
 	TypeConfigurationApplied                Type = "ConfigurationApplied"
 	TypeAwaitingRestartToApplyConfiguration Type = "AwaitingRestartToApplyConfiguration"
 	// TypeFilesystemFrozen indicates whether the filesystem is currently frozen, a necessary condition for creating a snapshot.
-	TypeFilesystemFrozen    Type = "FilesystemFrozen"
-	TypeSizingPolicyMatched Type = "SizingPolicyMatched"
-	TypeSnapshotting        Type = "Snapshotting"
+	TypeFilesystemFrozen       Type = "FilesystemFrozen"
+	TypeSizingPolicyMatched    Type = "SizingPolicyMatched"
+	TypeSnapshotting           Type = "Snapshotting"
+	TypeFirmwareUpdateRequired Type = "FirmwareUpdateRequired"
 )
 
 type Reason string
@@ -104,8 +105,10 @@ const (
 	// ReasonBlockDeviceLimitExceeded indicates that the limit for attaching block devices has been exceeded
 	ReasonBlockDeviceLimitExceeded Reason = "BlockDeviceLimitExceeded"
 
-	ReasonPodTerminatingReason      Reason = "PodTerminating"
-	ReasonPodNotExistsReason        Reason = "PodNotExists"
-	ReasonPodConditionMissingReason Reason = "PodConditionMissing"
-	ReasonGuestNotRunningReason     Reason = "GuestNotRunning"
+	ReasonPodTerminating      Reason = "PodTerminating"
+	ReasonPodNotExists        Reason = "PodNotExists"
+	ReasonPodConditionMissing Reason = "PodConditionMissing"
+	ReasonGuestNotRunning     Reason = "GuestNotRunning"
+
+	ReasonFirmwareUpdateRequired Reason = "FirmwareUpdateRequired"
 )

crds/doc-ru-virtualmachines.yaml

@@ -696,3 +696,5 @@ spec:
                           description: Накладные расходы на память во время выполнения.
                         size:
                           description: Текущий размер памяти виртуальной машины.
+                firmwareVersion:
+                  description: Версия firmware.

crds/virtualmachines.yaml

@@ -1241,6 +1241,9 @@ spec:
                         - size
                       type: object
                   type: object
+                firmwareVersion:
+                  type: string
+                  description: Firmware version.
       additionalPrinterColumns:
         - description: Virtual machine phase.
           jsonPath: .status.phase

cv/version_map.yml

@@ -1,4 +1,13 @@
 firmware:
+  # Don't touch! Generating in CI.
+  version: main
+  ## Components
   qemu: 9.2.0
   libvirt: 10.9.0
   edk2: stable202411
+
+module:
+  # Don't touch! Generating in CI.
+  version: main
+  # Should be updated manual.
+  firmwareMinSupportedVersion: "v0.17.0"

images/virtualization-artifact/cmd/virtualization-controller/main.go

@@ -73,6 +73,8 @@ const (
 	pprofBindAddrEnv                           = "PPROF_BIND_ADDRESS"
 	virtualMachineCIDRsEnv                     = "VIRTUAL_MACHINE_CIDRS"
 	virtualMachineIPLeasesRetentionDurationEnv = "VIRTUAL_MACHINE_IP_LEASES_RETENTION_DURATION"
+
+	FirmwareImageEnv = "FIRMWARE_IMAGE"
 )
 
 func main() {
@@ -110,13 +112,21 @@ func main() {
 	var metricsBindAddr string
 	flag.StringVar(&metricsBindAddr, "metrics-bind-address", getEnv(metricsBindAddrEnv, ":8080"), "metric bind address")
 
+	var firmwareImage string
+	flag.StringVar(&firmwareImage, "firmware-image", os.Getenv(FirmwareImageEnv), "Firmware image")
+
 	flag.Parse()
 
 	log := logger.NewLogger(logLevel, logOutput, logDebugVerbosity)
 	logger.SetDefaultLogger(log)
 
 	printVersion(log)
 
+	if firmwareImage == "" {
+		log.Error("firmware image is required")
+		os.Exit(1)
+	}
+
 	controllerNamespace, err := appconfig.GetRequiredEnvVar(podNamespaceEnv)
 	if err != nil {
 		log.Error(err.Error())
@@ -261,7 +271,7 @@ func main() {
 	}
 
 	vmLogger := logger.NewControllerLogger(vm.ControllerName, logLevel, logOutput, logDebugVerbosity, logDebugControllerList)
-	if err = vm.SetupController(ctx, mgr, vmLogger, dvcrSettings); err != nil {
+	if err = vm.SetupController(ctx, mgr, vmLogger, dvcrSettings, firmwareImage); err != nil {
 		log.Error(err.Error())
 		os.Exit(1)
 	}

images/virtualization-artifact/go.mod

@@ -13,6 +13,7 @@ require (
 	github.com/onsi/gomega v1.31.0
 	github.com/prometheus/client_golang v1.18.0
 	github.com/robfig/cron/v3 v3.0.1
+	github.com/rogpeppe/go-internal v1.10.0
 	github.com/spf13/cobra v1.7.0
 	github.com/stretchr/testify v1.9.0
 	go.uber.org/zap v1.26.0
@@ -85,7 +86,7 @@ require (
 	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/openshift/custom-resource-status v1.1.2 // indirect
-	github.com/pkg/errors v0.9.1 // indirect
+	github.com/pkg/errors v0.9.1
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/prometheus/client_model v0.5.0
 	github.com/prometheus/common v0.45.0 // indirect
@@ -108,7 +109,7 @@ require (
 	go.uber.org/multierr v1.11.0 // indirect
 	golang.org/x/crypto v0.31.0 // indirect
 	golang.org/x/exp v0.0.0-20220722155223-a9213eeb770e // indirect
-	golang.org/x/mod v0.17.0 // indirect
+	golang.org/x/mod v0.17.0
 	golang.org/x/net v0.25.0 // indirect
 	golang.org/x/oauth2 v0.12.0 // indirect
 	golang.org/x/sync v0.10.0 // indirect

images/virtualization-artifact/pkg/common/testutil/testutil.go

@@ -17,6 +17,10 @@ limitations under the License.
 package testutil
 
 import (
+	"context"
+	"log/slog"
+
+	"github.com/go-logr/logr"
 	corev1 "k8s.io/api/core/v1"
 	apiruntime "k8s.io/apimachinery/pkg/runtime"
 	virtv1 "kubevirt.io/api/core/v1"
@@ -41,9 +45,17 @@ func NewFakeClientWithObjects(objs ...client.Object) (client.WithWatch, error) {
 			return nil, err
 		}
 	}
-	return fake.NewClientBuilder().WithScheme(scheme).WithObjects(objs...).Build(), nil
+	return fake.NewClientBuilder().WithScheme(scheme).WithObjects(objs...).WithStatusSubresource(objs...).Build(), nil
 }
 
 func NewNoOpLogger() *log.Logger {
 	return log.NewNop()
 }
+
+func ToContext(ctx context.Context, log *log.Logger) context.Context {
+	return logr.NewContextWithSlogLogger(ctx, slog.New(log.Handler()))
+}
+
+func ContextBackgroundWithNoOpLogger() context.Context {
+	return ToContext(context.Background(), NewNoOpLogger())
+}

images/virtualization-artifact/pkg/controller/vm/internal/block_devices_test.go

@@ -20,7 +20,6 @@ import (
 	"context"
 	"fmt"
 	"log/slog"
-	"testing"
 
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
@@ -43,11 +42,6 @@ import (
 	"github.com/deckhouse/virtualization/api/core/v1alpha2/vmcondition"
 )
 
-func TestBlockDeviceHandler(t *testing.T) {
-	RegisterFailHandler(Fail)
-	RunSpecs(t, "BlockDeviceHandler Suite")
-}
-
 var _ = Describe("func areVirtualDisksAllowedToUse", func() {
 	var h *BlockDeviceHandler
 	var vdFoo *virtv2.VirtualDisk

images/virtualization-artifact/pkg/controller/vm/internal/firmware.go

@@ -0,0 +1,119 @@
+/*
+Copyright 2025 Flant JSC
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"context"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/controller-runtime/pkg/reconcile"
+
+	"github.com/deckhouse/virtualization-controller/pkg/controller/conditions"
+	"github.com/deckhouse/virtualization-controller/pkg/controller/vm/internal/state"
+	"github.com/deckhouse/virtualization-controller/pkg/version"
+	virtv2 "github.com/deckhouse/virtualization/api/core/v1alpha2"
+	"github.com/deckhouse/virtualization/api/core/v1alpha2/vmcondition"
+)
+
+const firmwareHandler = "FirmwareHandler"
+
+func NewFirmwareHandler(firmwareImage string) *FirmwareHandler {
+	return &FirmwareHandler{
+		firmwareVersion:             version.GetFirmwareVersion(),
+		firmwareMinSupportedVersion: version.GetFirmwareMinSupportedVersion(),
+		firmwareImage:               firmwareImage,
+	}
+}
+
+type FirmwareHandler struct {
+	firmwareVersion             version.Version
+	firmwareMinSupportedVersion version.Version
+	firmwareImage               string
+}
+
+func (f FirmwareHandler) Handle(ctx context.Context, s state.VirtualMachineState) (reconcile.Result, error) {
+	if s.VirtualMachine().IsEmpty() {
+		return reconcile.Result{}, nil
+	}
+	changed := s.VirtualMachine().Changed()
+
+	kvvmi, err := s.KVVMI(ctx)
+	if err != nil {
+		return reconcile.Result{}, err
+	}
+
+	if kvvmi == nil || kvvmi.Status.LauncherContainerImageVersion == f.firmwareImage {
+		// If kvvmi does not exist, update the firmware version,
+		// as any newly created kvvmi will use the currently available firmware version.
+		changed.Status.FirmwareVersion = f.firmwareVersion.String()
+		f.removeCondition(changed)
+		return reconcile.Result{}, nil
+	}
+	if f.needUpdate(changed.Status.FirmwareVersion, kvvmi.Status.LauncherContainerImageVersion) {
+		f.addCondition(changed)
+		return reconcile.Result{}, nil
+	}
+
+	f.removeCondition(changed)
+
+	return reconcile.Result{}, nil
+}
+
+func (f FirmwareHandler) Name() string {
+	return firmwareHandler
+}
+
+func (f FirmwareHandler) needUpdate(currentVersion, firmwareImage string) bool {
+	if currentVersion == "" {
+		return true
+	}
+	currVersion := version.Version(currentVersion)
+
+	if !currVersion.IsValid() {
+		return true
+	}
+
+	if f.firmwareVersion.Compare(currVersion) == 0 {
+		// Update is required if the version is 'main', but the virt-launcher images are different
+		if f.firmwareVersion.IsMain() {
+			return f.firmwareImage != firmwareImage
+		}
+		return false
+	}
+
+	// Update is required if the current version is less than the minimum supported version.
+	if currVersion.Compare(f.firmwareMinSupportedVersion) == -1 {
+		return true
+	}
+
+	// Update is required if the current version is greater than the firmware version
+	return currVersion.Compare(f.firmwareVersion) == 1
+}
+
+func (f FirmwareHandler) addCondition(changed *virtv2.VirtualMachine) {
+	conditions.SetCondition(conditions.NewConditionBuilder(vmcondition.TypeFirmwareUpdateRequired).
+		Generation(changed.GetGeneration()).
+		Status(metav1.ConditionTrue).
+		Reason(vmcondition.ReasonFirmwareUpdateRequired).
+		Message("The VM firmware is outdated and not recommended for use by the current version of the module, please migrate or reboot the VM to upgrade to the new firmware version."),
+		&changed.Status.Conditions,
+	)
+}
+
+func (f FirmwareHandler) removeCondition(changed *virtv2.VirtualMachine) {
+	conditions.RemoveCondition(vmcondition.TypeFirmwareUpdateRequired, &changed.Status.Conditions)
+}