Creating VMs by using container disks

You can create virtual machines (VMs) by using container disks built from operating system images.

You can enable auto updates for your container disks. See Managing automatic boot source updates for details.

If the container disks are large, the I/O traffic might increase and cause worker nodes to be unavailable. You can perform the following tasks to resolve this issue:

You create a VM from a container disk by performing the following steps:

  1. Build an operating system image into a container disk and upload it to your container registry.

  2. If your container registry does not have TLS, configure your environment to disable TLS for your registry.

  3. Create a VM with the container disk as the disk source by using the web console or the command line.

You must install the QEMU guest agent on VMs created from operating system images that are not provided by Red Hat.

Building and uploading a container disk

You can build a virtual machine (VM) image into a container disk and upload it to a registry.

The size of a container disk is limited by the maximum layer size of the registry where the container disk is hosted.

For Red Hat Quay, you can change the maximum layer size by editing the YAML configuration file that is created when Red Hat Quay is first deployed.

Prerequisites

  • You must have podman installed.

  • You must have a QCOW2 or RAW image file.

Procedure

  1. Create a Dockerfile to build the VM image into a container image. The VM image must be owned by QEMU, which has a UID of 107, and placed in the /disk/ directory inside the container. Permissions for the /disk/ directory must then be set to 0440.

    The following example uses the Red Hat Universal Base Image (UBI) to handle these configuration changes in the first stage, and uses the minimal scratch image in the second stage to store the result:

    1. $ cat > Dockerfile << EOF
    2. FROM registry.access.redhat.com/ubi8/ubi:latest AS builder
    3. ADD --chown=107:107 <vm_image>.qcow2 /disk/ \(1)
    4. RUN chmod 0440 /disk/*
    6. FROM scratch
    7. COPY --from=builder /disk/* /disk/
    8. EOF
    1Where <vm_image> is the image in either QCOW2 or RAW format. If you use a remote image, replace <vm_image>.qcow2 with the complete URL.

  2. Build and tag the container:

    1. $ podman build -t <registry>/<container_disk_name>:latest .

  3. Push the container image to the registry:

    1. $ podman push <registry>/<container_disk_name>:latest

Disabling TLS for a container registry

You can disable TLS (transport layer security) for one or more container registries by editing the insecureRegistries field of the HyperConverged custom resource.

Prerequisites

  • Log in to the cluster as a user with the cluster-admin role.

Procedure

  • Edit the HyperConverged custom resource and add a list of insecure registries to the spec.storageImport.insecureRegistries field.

    1. apiVersion: hco.kubevirt.io/v1beta1
    2. kind: HyperConverged
    3. metadata:
    4.   name: kubevirt-hyperconverged
    5.   namespace: kubevirt-hyperconverged
    6. spec:
    7.   storageImport:
    8.     insecureRegistries: (1)
    9.       - "private-registry-example-1:5000"
    10.       - "private-registry-example-2:5000"
    1Replace the examples in this list with valid registry hostnames.

Creating a VM from a container disk by using the web console

You can create a virtual machine (VM) by importing a container disk from a container registry by using the OKD web console.

Procedure

  1. Navigate to Virtualization → Catalog in the web console.

  2. Click a template tile without an available boot source.

  3. Click Customize VirtualMachine.

  4. On the Customize template parameters page, expand Storage and select Registry (creates PVC) from the Disk source list.

  5. Enter the container image URL. Example: https://mirror.arizona.edu/fedora/linux/releases/38/Cloud/x86_64/images/Fedora-Cloud-Base-38-1.6.x86_64.qcow2

  6. Set the disk size.

  7. Click Customize VirtualMachine.

  8. Click Create VirtualMachine.

Creating a VM from a container disk by using the command line

You can create a virtual machine (VM) from a container disk by using the command line.

When the virtual machine (VM) is created, the data volume with the container disk is imported into persistent storage.

Prerequisites

  • You must have access credentials for the container registry that contains the container disk.

Procedure

  1. If the container registry requires authentication, create a Secret manifest, specifying the credentials, and save it as a data-source-secret.yaml file:

    1. apiVersion: v1
    2. kind: Secret
    3. metadata:
    4.   name: data-source-secret
    5.   labels:
    6.     app: containerized-data-importer
    7. type: Opaque
    8. data:
    9.   accessKeyId: "" (1)
    10.   secretKey:   "" (2)
    1Specify the Base64-encoded key ID or user name.
    2Specify the Base64-encoded secret key or password.

  2. Apply the Secret manifest by running the following command:

    1. $ oc apply -f data-source-secret.yaml

  3. If the VM must communicate with servers that use self-signed certificates or certificates that are not signed by the system CA bundle, create a config map in the same namespace as the VM:

    1. $ oc create configmap tls-certs (1)
    2.   --from-file=</path/to/file/ca.pem> (2)
    1Specify the config map name.
    2Specify the path to the CA certificate.

  4. Edit the VirtualMachine manifest and save it as a vm-fedora-datavolume.yaml file:

    Details

    1. apiVersion: kubevirt.io/v1
    2. kind: VirtualMachine
    3. metadata:
    4.   creationTimestamp: null
    5.   labels:
    6.     kubevirt.io/vm: vm-fedora-datavolume
    7.   name: vm-fedora-datavolume (1)
    8. spec:
    9.   dataVolumeTemplates:
    10.   - metadata:
    11.       creationTimestamp: null
    12.       name: fedora-dv (2)
    13.     spec:
    14.       storage:
    15.         resources:
    16.           requests:
    17.             storage: 10Gi (3)
    18.         storageClassName: <storage_class> (4)
    19.       source:
    20.         registry:
    21.           url: "docker://kubevirt/fedora-cloud-container-disk-demo:latest" (5)
    22.           secretRef: data-source-secret (6)
    23.           certConfigMap: tls-certs (7)
    24.     status: {}
    25.   running: true
    26.   template:
    27.     metadata:
    28.       creationTimestamp: null
    29.       labels:
    30.         kubevirt.io/vm: vm-fedora-datavolume
    31.     spec:
    32.       domain:
    33.         devices:
    34.           disks:
    35.           - disk:
    36.               bus: virtio
    37.             name: datavolumedisk1
    38.         machine:
    39.           type: ""
    40.         resources:
    41.           requests:
    42.             memory: 1.5Gi
    43.       terminationGracePeriodSeconds: 180
    44.       volumes:
    45.       - dataVolume:
    46.           name: fedora-dv
    47.         name: datavolumedisk1
    48. status: {}
    1Specify the name of the VM.
    2Specify the name of the data volume.
    3Specify the size of the storage requested for the data volume.
    4Optional: If you do not specify a storage class, the default storage class is used.
    5Specify the URL of the container registry.
    6Optional: Specify the secret name if you created a secret for the container registry access credentials.
    7Optional: Specify a CA certificate config map.

  5. Create the VM by running the following command:

    1. $ oc create -f vm-fedora-datavolume.yaml

    The oc create command creates the data volume and the VM. The CDI controller creates an underlying PVC with the correct annotation and the import process begins. When the import is complete, the data volume status changes to Succeeded. You can start the VM.

    Data volume provisioning happens in the background, so there is no need to monitor the process.

Verification

  1. The importer pod downloads the container disk from the specified URL and stores it on the provisioned persistent volume. View the status of the importer pod by running the following command:

    1. $ oc get pods

  2. Monitor the data volume until its status is Succeeded by running the following command:

    1. $ oc describe dv fedora-dv (1)
    1Specify the data volume name that you defined in the VirtualMachine manifest.

  3. Verify that provisioning is complete and that the VM has started by accessing its serial console:

    1. $ virtctl console vm-fedora-datavolume