chore(vm): add system migration policy (#2156)

Signed-off-by: Dmitry Lopatin <dmitry.lopatin@flant.com>

Author: LopatinDmitr

images/virtualization-artifact/cmd/virtualization-controller/main.go

@@ -17,6 +17,7 @@ limitations under the License.
 package main
 
 import (
+	"context"
 	"fmt"
 	"log/slog"
 	"os"
@@ -28,6 +29,7 @@ import (
 	"github.com/spf13/pflag"
 	resourcev1 "k8s.io/api/resource/v1"
 	extv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	apiruntime "k8s.io/apimachinery/pkg/runtime"
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
 	virtv1 "kubevirt.io/api/core/v1"
@@ -311,6 +313,18 @@ func main() {
 		log.Error(err.Error())
 		os.Exit(1)
 	}
+
+	systemMigrationPolicy := getSystemMigrationPolicyAnnotation(ctx, preManagerClient)
+	switch {
+	case systemMigrationPolicy == "":
+		appconfig.ResetSystemMigrationPolicyOverride()
+	case appconfig.SetSystemMigrationPolicyOverride(systemMigrationPolicy):
+		log.Info("System migration policy override is set", "value", systemMigrationPolicy)
+	default:
+		appconfig.ResetSystemMigrationPolicyOverride()
+		log.Warn("System migration policy override has invalid value, override disabled", "value", systemMigrationPolicy)
+	}
+
 	mCtrl, err := migration.NewController(preManagerClient, log)
 	if err != nil {
 		log.Error(err.Error())
@@ -508,3 +522,19 @@ func getEnv(env, defaultEnv string) string {
 	}
 	return defaultEnv
 }
+
+func getSystemMigrationPolicyAnnotation(ctx context.Context, cli client.Client) string {
+	moduleConfigName := "virtualization"
+	systemMigrationPolicyAnnotation := "virtualization.deckhouse.io/system-migration-policy"
+
+	moduleConfig := &mcapi.ModuleConfig{}
+	err := cli.Get(ctx, client.ObjectKey{Name: moduleConfigName}, moduleConfig)
+	if err != nil {
+		if !apierrors.IsNotFound(err) {
+			slog.Default().Error("failed to get ModuleConfig virtualization", logger.SlogErr(err))
+		}
+		return ""
+	}
+
+	return moduleConfig.GetAnnotations()[systemMigrationPolicyAnnotation]
+}

images/virtualization-artifact/pkg/config/load_live_migration_settings.go

@@ -25,3 +25,40 @@ import (
 const (
 	DefaultLiveMigrationPolicy = v1alpha2.PreferSafeMigrationPolicy
 )
+
+var systemMigrationPolicyOverride v1alpha2.LiveMigrationPolicy
+
+func SetSystemMigrationPolicyOverride(rawPolicy string) bool {
+	policy := v1alpha2.LiveMigrationPolicy(rawPolicy)
+	if !isValidLiveMigrationPolicy(policy) {
+		systemMigrationPolicyOverride = ""
+		return false
+	}
+	systemMigrationPolicyOverride = policy
+	return true
+}
+
+func GetSystemMigrationPolicyOverride() (v1alpha2.LiveMigrationPolicy, bool) {
+	if systemMigrationPolicyOverride == "" {
+		return "", false
+	}
+	return systemMigrationPolicyOverride, true
+}
+
+func ResetSystemMigrationPolicyOverride() {
+	systemMigrationPolicyOverride = ""
+}
+
+func isValidLiveMigrationPolicy(policy v1alpha2.LiveMigrationPolicy) bool {
+	switch policy {
+	case v1alpha2.ManualMigrationPolicy,
+		v1alpha2.NeverMigrationPolicy,
+		v1alpha2.AlwaysSafeMigrationPolicy,
+		v1alpha2.PreferSafeMigrationPolicy,
+		v1alpha2.AlwaysForcedMigrationPolicy,
+		v1alpha2.PreferForcedMigrationPolicy:
+		return true
+	default:
+		return false
+	}
+}

images/virtualization-artifact/pkg/livemigration/policy.go

@@ -39,15 +39,18 @@ func AutoConvergeForPolicy(policy v1alpha2.LiveMigrationPolicy) (autoConverge *b
 // Also, autoConverge value may be overridden from VMOP.
 func CalculateEffectivePolicy(vm v1alpha2.VirtualMachine, vmop *v1alpha2.VirtualMachineOperation) (effectivePolicy v1alpha2.LiveMigrationPolicy, autoConverge bool, err error) {
 	effectivePolicy = config.DefaultLiveMigrationPolicy
+	overridePolicy, hasSystemOverride := config.GetSystemMigrationPolicyOverride()
 
-	if vm.Spec.LiveMigrationPolicy != "" {
+	if hasSystemOverride {
+		effectivePolicy = overridePolicy
+	} else if vm.Spec.LiveMigrationPolicy != "" {
 		effectivePolicy = vm.Spec.LiveMigrationPolicy
 	}
 
 	autoConvergePtr := AutoConvergeForPolicy(effectivePolicy)
 
-	// Override autoConverge value.
-	if vmop != nil {
+	// VMOP force may override autoConverge only when system override is not set.
+	if vmop != nil && !hasSystemOverride {
 		switch effectivePolicy {
 		case v1alpha2.PreferSafeMigrationPolicy, v1alpha2.PreferForcedMigrationPolicy:
 			if vmop.Spec.Force != nil {

templates/virtualization-controller/rbac-for-us.yaml

@@ -111,6 +111,12 @@ rules:
   - patch
   - list
   - watch
+- apiGroups:
+  - deckhouse.io
+  resources:
+  - moduleconfigs
+  verbs:
+  - get
 - apiGroups:
   - cdi.internal.virtualization.deckhouse.io
   resources: