Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package kubevirt1.9 for openSUSE:Factory checked in at 2026-09-11 18:02:28 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/kubevirt1.9 (Old) and /work/SRC/openSUSE:Factory/.kubevirt1.9.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "kubevirt1.9" Fri Sep 11 18:02:28 2026 rev:3 rq:1377009 version:1.9.0 Changes: -------- --- /work/SRC/openSUSE:Factory/kubevirt1.9/kubevirt1.9.changes 2026-08-26 19:52:41.630559927 +0200 +++ /work/SRC/openSUSE:Factory/.kubevirt1.9.new.1265/kubevirt1.9.changes 2026-09-11 18:06:20.571408167 +0200 @@ -1,0 +2,58 @@ +Wed Sep 9 18:52:13 UTC 2026 - Victor Carvalho <[email protected]> + +- Security: re-vendor the bundled Go dependencies to the current fixed + versions (no upstream source changes; the tarball is v1.9.0 with + updated go.mod/go.sum/vendor only): + * golang.org/x/crypto v0.54.0 -> v0.56.0: CVE-2026-56854, + CVE-2026-56855, CVE-2026-78662 (bsc#1278574) + * google.golang.org/grpc v1.79.3 -> v1.83.2: CVE-2026-84303 + (bsc#1279276), CVE-2026-84304 (bsc#1279184), CVE-2026-84445 + (bsc#1278869; fixed in 1.83.2, 1.83.1 is still affected) + Carried along by the above, no separate advisory open against the + versions they replace: golang.org/x/net v0.57.0 -> v0.58.0, + golang.org/x/text v0.40.0 -> v0.41.0, google.golang.org/protobuf + v1.36.5 -> v1.36.11 in the staging modules. +- Add 0004-manifest-templator-apply-the-custom-image-flags-before-rendering-the-operator-deployment.patch: + the manifest templator rendered the virt-operator deployment before + applying its --virt-*-image flags, so custom images passed at build + time never reached the release manifests. With the fix the + virt-template image references are set through the templator instead + of post-processing the rendered manifest. + +------------------------------------------------------------------- +Wed Sep 9 11:37:56 UTC 2026 - Victor Carvalho <[email protected]> + +- Add 0001-Fix-VFIO-cdev-passthrough-on-kernels-without-CONFIG_VFIO.patch: + PCI host device passthrough left the virt-launcher pod stuck in + creation on kernels that expose the vfio-dev sysfs class but do not + create /dev/vfio/devices/* (no CONFIG_VFIO_DEVICE_CDEV): kubelet + failed with "lstat /dev/vfio/devices/vfio0: no such file or + directory". Verify the cdev node exists before adding it to the + device specs (upstream release-1.9 commit 7d045a56dd, kubevirt PR + 18905, fixed after v1.9.0). +- Add 0002-use-safepath-when-dialing-the-migration-target-unix-sockets.patch: + CVE-2026-13622 (bsc#1272840) — + virt-handler dials the migration target unix sockets through + /proc/<pid>/root of the virt-launcher pod; resolve the socket path + with safepath and dial via ExecuteNoFollow so a symlink planted + inside the launcher filesystem cannot redirect the connection. + Unsupported target protocols are now rejected instead of dialed. +- Add 0003-tests-dial-migration-target-sockets-through-proc-root-layout.patch: + the migration-proxy unit tests dialed target sockets straight out of a + temporary directory, which is not below a /proc/<pid>/root and is + therefore refused by the resolution above; place those sockets under a + "root" directory so they keep the shape they have in production. + +------------------------------------------------------------------- +Tue Sep 8 12:12:01 UTC 2026 - Victor Carvalho <[email protected]> + +- Deploy virt-template from the images built from the virt-template0.2 + package: the operator manifest now sets VIRT_TEMPLATE_APISERVER_IMAGE + and VIRT_TEMPLATE_CONTROLLER_IMAGE to virt-template-apiserver and + virt-template-controller at the version this release pins (v0.2.2). + virt-operator enables the Template feature gate by default since 1.9 + and derived the virt-template references from its own registry, where + the images did not exist, so every deployment waited on two + ImagePullBackOff pods and never reported Available (bsc#1272604). + +------------------------------------------------------------------- New: ---- 0001-Fix-VFIO-cdev-passthrough-on-kernels-without-CONFIG_VFIO.patch 0002-use-safepath-when-dialing-the-migration-target-unix-sockets.patch 0003-tests-dial-migration-target-sockets-through-proc-root-layout.patch 0004-manifest-templator-apply-the-custom-image-flags-before-rendering-the-operator-deployment.patch ----------(New B)---------- New: - Add 0001-Fix-VFIO-cdev-passthrough-on-kernels-without-CONFIG_VFIO.patch: PCI host device passthrough left the virt-launcher pod stuck in New: 18905, fixed after v1.9.0). - Add 0002-use-safepath-when-dialing-the-migration-target-unix-sockets.patch: CVE-2026-13622 (bsc#1272840) — New: Unsupported target protocols are now rejected instead of dialed. - Add 0003-tests-dial-migration-target-sockets-through-proc-root-layout.patch: the migration-proxy unit tests dialed target sockets straight out of a New: v1.36.5 -> v1.36.11 in the staging modules. - Add 0004-manifest-templator-apply-the-custom-image-flags-before-rendering-the-operator-deployment.patch: the manifest templator rendered the virt-operator deployment before ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ kubevirt1.9.spec ++++++ --- /var/tmp/diff_new_pack.MlucfL/_old 2026-09-11 18:06:21.385442355 +0200 +++ /var/tmp/diff_new_pack.MlucfL/_new 2026-09-11 18:06:21.387442439 +0200 @@ -29,6 +29,12 @@ Source0: %{upstream_name}-%{version}.tar.gz Source3: %{url}/releases/download/v%{version}/disks-images-provider.yaml Source100: %{name}-rpmlintrc +# PATCH-FIX-UPSTREAM 0001-Fix-VFIO-cdev-passthrough-on-kernels-without-CONFIG_VFIO.patch -- release-1.9 7d045a56dd (PR 18905/18931): guard the VFIO cdev DeviceSpec on kernels without CONFIG_VFIO_DEVICE_CDEV +Patch0: 0001-Fix-VFIO-cdev-passthrough-on-kernels-without-CONFIG_VFIO.patch +Patch1: 0002-use-safepath-when-dialing-the-migration-target-unix-sockets.patch +Patch2: 0003-tests-dial-migration-target-sockets-through-proc-root-layout.patch +# FIXME: not yet upstream: --virt-*-image flags were ignored for the operator deployment +Patch3: 0004-manifest-templator-apply-the-custom-image-flags-before-rendering-the-operator-deployment.patch BuildRequires: glibc-devel-static BuildRequires: golang-packaging BuildRequires: libnbd-devel @@ -285,7 +291,19 @@ %{nil} %if 0%{?suse_version} >= 1699 -env DOCKER_PREFIX=$reg_path DOCKER_TAG=%{version} KUBEVIRT_NO_BAZEL=true ./hack/build-manifests.sh +# virt-operator deploys virt-template (Template feature gate, on by default +# since 1.9) from image references it derives from its own registry, where +# upstream's quay.io images do not exist. Point it at the images built from +# the virt-template package, at the version this release pins +# (hack/virt-template/default.sh), through the manifest templator's +# custom-image flags (Patch3 makes the operator deployment honour them). +vt_version=$(sed -n 's/^virt_template_version=.*:-"v\([^"]*\)".*/\1/p' hack/virt-template/default.sh) +[ -n "$vt_version" ] +env DOCKER_PREFIX=$reg_path DOCKER_TAG=%{version} KUBEVIRT_NO_BAZEL=true \ + TEMPLATOR_EXTRA_FLAGS="--virt-template-apiserver-image=$reg_path/virt-template-apiserver:$vt_version --virt-template-controller-image=$reg_path/virt-template-controller:$vt_version" \ + ./hack/build-manifests.sh +[ "$(grep -c 'name: VIRT_TEMPLATE_APISERVER_IMAGE' _out/manifests/release/kubevirt-operator.yaml)" = 1 ] + %endif %install ++++++ 0001-Fix-VFIO-cdev-passthrough-on-kernels-without-CONFIG_VFIO.patch ++++++ >From 7d045a56dd00687d0fc8655354d71965bd688b50 Mon Sep 17 00:00:00 2001 From: fossedihelm <[email protected]> Date: Mon, 24 Aug 2026 22:23:55 +0200 Subject: [PATCH] Fix VFIO cdev passthrough on kernels without CONFIG_VFIO_DEVICE_CDEV When VFIO cdev device specs were added in commit 27c59c50fd, the code unconditionally attempted to expose /dev/vfio/devices/<name> character devices to virt-launcher, even on kernels that lack CONFIG_VFIO_DEVICE_CDEV support. On such kernels (e.g., Debian 13 with 7.1.8), the sysfs vfio-dev directory may exist but the actual device files in /dev/vfio/devices/ are not created. This caused containerd to fail when trying to lstat the non-existent devices, breaking PCI passthrough entirely even with the IOMMUFD feature gate disabled. Verify the existence of the device before adding it to the device specs. On kernels without IOMMUFD support, the function now gracefully returns an empty list, allowing the legacy VFIO group interface to work as intended. Assisted-By: Claude <[email protected]> Signed-off-by: fossedihelm <[email protected]> --- pkg/virt-handler/device-manager/common.go | 11 ++++- .../device-manager/common_test.go | 43 ++++++++++++++++++- .../device-manager/export_test.go | 6 +++ pkg/virt-handler/device-manager/pci_device.go | 5 ++- 4 files changed, 61 insertions(+), 4 deletions(-) diff --git a/pkg/virt-handler/device-manager/common.go b/pkg/virt-handler/device-manager/common.go index a06c86b5a2..db7a43b6fe 100644 --- a/pkg/virt-handler/device-manager/common.go +++ b/pkg/virt-handler/device-manager/common.go @@ -304,7 +304,16 @@ func formatVFIOCdevDeviceSpecs(pciAddress string) []*v1beta1.DeviceSpec { devSpecs := make([]*v1beta1.DeviceSpec, 0, len(entries)) for _, entry := range entries { - cdevPath := filepath.Join("/dev/vfio/devices", entry.Name()) + cdevPath := filepath.Join(vfioDevicesRoot, entry.Name()) + // Only add the device spec if the actual device file exists + if _, err := os.Stat(cdevPath); err != nil { + if errors.Is(err, os.ErrNotExist) { + log.DefaultLogger().V(4).Infof("VFIO cdev %s does not exist, skipping", cdevPath) + } else { + log.DefaultLogger().Reason(err).Warningf("Failed to stat VFIO cdev %s", cdevPath) + } + continue + } devSpecs = append(devSpecs, &v1beta1.DeviceSpec{ HostPath: cdevPath, ContainerPath: cdevPath, diff --git a/pkg/virt-handler/device-manager/common_test.go b/pkg/virt-handler/device-manager/common_test.go index e605ec04e2..12e807c3f5 100644 --- a/pkg/virt-handler/device-manager/common_test.go +++ b/pkg/virt-handler/device-manager/common_test.go @@ -33,10 +33,14 @@ import ( var _ = Describe("PCI device plugin VFIO cdev allocation", func() { var tmpDir string + var vfioDevicesDir string BeforeEach(func() { tmpDir = GinkgoT().TempDir() + vfioDevicesDir = filepath.Join(tmpDir, "dev-vfio-devices") + Expect(os.MkdirAll(vfioDevicesDir, 0755)).To(Succeed()) DeferCleanup(devicemanager.SetPCIBasePath(tmpDir)) + DeferCleanup(devicemanager.SetVFIODevicesRoot(vfioDevicesDir)) }) It("should include VFIO cdev device specs in Allocate response", func() { @@ -45,6 +49,8 @@ var _ = Describe("PCI device plugin VFIO cdev allocation", func() { vfioDevDir := filepath.Join(tmpDir, pciAddr, "vfio-dev") Expect(os.MkdirAll(vfioDevDir, 0755)).To(Succeed()) Expect(os.WriteFile(filepath.Join(vfioDevDir, "vfio0"), []byte{}, 0644)).To(Succeed()) + // Create the actual device file in the mocked /dev/vfio/devices directory + Expect(os.WriteFile(filepath.Join(vfioDevicesDir, "vfio0"), []byte{}, 0644)).To(Succeed()) dpi := devicemanager.NewPCIDevicePluginForTest(map[string]string{iommuGroup: pciAddr}) @@ -57,10 +63,11 @@ var _ = Describe("PCI device plugin VFIO cdev allocation", func() { Expect(err).ToNot(HaveOccurred()) Expect(resp.ContainerResponses).To(HaveLen(1)) + expectedPath := filepath.Join(vfioDevicesDir, "vfio0") Expect(resp.ContainerResponses[0].Devices).To(ContainElement( BeEquivalentTo(&pluginapi.DeviceSpec{ - HostPath: "/dev/vfio/devices/vfio0", - ContainerPath: "/dev/vfio/devices/vfio0", + HostPath: expectedPath, + ContainerPath: expectedPath, Permissions: "mrw", }))) }) @@ -79,10 +86,42 @@ var _ = Describe("PCI device plugin VFIO cdev allocation", func() { Expect(err).ToNot(HaveOccurred()) Expect(resp.ContainerResponses).To(HaveLen(1)) + devicePaths := make([]string, 0) + for _, spec := range resp.ContainerResponses[0].Devices { + devicePaths = append(devicePaths, spec.ContainerPath) + } + Expect(devicePaths).ToNot(ContainElement(ContainSubstring(vfioDevicesDir))) + }) + + It("should skip VFIO cdev device specs when sysfs dir exists but device files don't", func() { + // This simulates kernels without CONFIG_VFIO_DEVICE_CDEV where the + // vfio-dev directory exists in sysfs but the actual character devices + // in /dev/vfio/devices/ don't exist + pciAddr := "0000:08:00.0" + iommuGroup := "42" + vfioDevDir := filepath.Join(tmpDir, pciAddr, "vfio-dev") + Expect(os.MkdirAll(vfioDevDir, 0755)).To(Succeed()) + Expect(os.WriteFile(filepath.Join(vfioDevDir, "vfio0"), []byte{}, 0644)).To(Succeed()) + + // Note: we don't create /dev/vfio/devices/vfio0, simulating the missing device + + dpi := devicemanager.NewPCIDevicePluginForTest(map[string]string{iommuGroup: pciAddr}) + + resp, err := dpi.Allocate(context.Background(), &pluginapi.AllocateRequest{ + ContainerRequests: []*pluginapi.ContainerAllocateRequest{ + {DevicesIDs: []string{iommuGroup}}, + }, + }) + + Expect(err).ToNot(HaveOccurred()) + Expect(resp.ContainerResponses).To(HaveLen(1)) + + // Should only contain legacy VFIO group devices, not cdev devices devicePaths := make([]string, 0) for _, spec := range resp.ContainerResponses[0].Devices { devicePaths = append(devicePaths, spec.ContainerPath) } Expect(devicePaths).ToNot(ContainElement(ContainSubstring("/dev/vfio/devices/"))) + Expect(devicePaths).To(ContainElement("/dev/vfio/vfio")) }) }) diff --git a/pkg/virt-handler/device-manager/export_test.go b/pkg/virt-handler/device-manager/export_test.go index 647970289e..93618960ac 100644 --- a/pkg/virt-handler/device-manager/export_test.go +++ b/pkg/virt-handler/device-manager/export_test.go @@ -33,3 +33,9 @@ func SetPCIBasePath(p string) func() { pciBasePath = p return func() { pciBasePath = old } } + +func SetVFIODevicesRoot(p string) func() { + old := vfioDevicesRoot + vfioDevicesRoot = p + return func() { vfioDevicesRoot = old } +} diff --git a/pkg/virt-handler/device-manager/pci_device.go b/pkg/virt-handler/device-manager/pci_device.go index db14a603e1..83caf3397e 100644 --- a/pkg/virt-handler/device-manager/pci_device.go +++ b/pkg/virt-handler/device-manager/pci_device.go @@ -44,7 +44,10 @@ const ( vfioMount = "/dev/vfio/vfio" ) -var pciBasePath = "/sys/bus/pci/devices" +var ( + pciBasePath = "/sys/bus/pci/devices" + vfioDevicesRoot = "/dev/vfio/devices" +) type PCIDevice struct { pciID string -- 2.55.0 ++++++ 0002-use-safepath-when-dialing-the-migration-target-unix-sockets.patch ++++++ >From ee94588903e1a6aa21af28d4e7ef1e8085ab916c Mon Sep 17 00:00:00 2001 From: Igor Bezukh <[email protected]> Date: Thu, 16 Jul 2026 13:10:51 +0300 Subject: [PATCH 1/2] use safepath when dialing the migration target unix sockets since the target socket file resides on virt-launcher, the handler constructs the path using /proc/<pid>/root. using safe path will keep the dial process protected from symlink attacks. Signed-off-by: Igor Bezukh <[email protected]> --- .../migration-proxy/migration-proxy.go | 76 ++++++++++++++++--- 1 file changed, 64 insertions(+), 12 deletions(-) diff --git a/pkg/virt-handler/migration-proxy/migration-proxy.go b/pkg/virt-handler/migration-proxy/migration-proxy.go index e7ab78a..6a4a42a 100644 --- a/pkg/virt-handler/migration-proxy/migration-proxy.go +++ b/pkg/virt-handler/migration-proxy/migration-proxy.go @@ -33,6 +33,7 @@ import ( "kubevirt.io/client-go/log" diskutils "kubevirt.io/kubevirt/pkg/ephemeral-disk-utils" + "kubevirt.io/kubevirt/pkg/safepath" "kubevirt.io/kubevirt/pkg/util" "kubevirt.io/kubevirt/pkg/util/net/ip" virtconfig "kubevirt.io/kubevirt/pkg/virt-config" @@ -443,22 +444,28 @@ func (m *migrationProxy) handleConnection(fd net.Conn) { inBoundErr := make(chan error, 1) var conn net.Conn - var err error + var dialErr error if m.targetProtocol == "tcp" && m.clientTLSConfig != nil { - conn, err = tls.Dial(m.targetProtocol, m.targetAddress, m.migrationTLSConfig) + conn, dialErr = tls.Dial(m.targetProtocol, m.targetAddress, m.migrationTLSConfig) // Check for specific error (CN missmatch), fallback to old client TLS - if err != nil { - m.logger.Reason(err).Info("fallback to old tls config") - conn, err = tls.Dial(m.targetProtocol, m.targetAddress, m.clientTLSConfig) + if dialErr != nil { + m.logger.Reason(dialErr).Info("fallback to old tls config") + conn, dialErr = tls.Dial(m.targetProtocol, m.targetAddress, m.clientTLSConfig) } else if tlsErr := conn.(*tls.Conn).Handshake(); tlsErr != nil { - m.logger.Reason(err).Info("handshake failed, fallback to old tls config") - conn, err = tls.Dial(m.targetProtocol, m.targetAddress, m.clientTLSConfig) + m.logger.Reason(tlsErr).Info("handshake failed, fallback to old tls config") + conn, dialErr = tls.Dial(m.targetProtocol, m.targetAddress, m.clientTLSConfig) } + } else if m.targetProtocol == "tcp" { + conn, dialErr = net.Dial(m.targetProtocol, m.targetAddress) + } else if m.targetProtocol == "unix" { + conn, dialErr = dialUnixNoFollow(m.targetAddress) } else { - conn, err = net.Dial(m.targetProtocol, m.targetAddress) + m.logger.Errorf("unsupported target protocol: %s", m.targetProtocol) + return } - if err != nil { - m.logger.Reason(err).Error("unable to create outbound leg of proxy to host") + + if dialErr != nil { + m.logger.Reason(dialErr).Errorf("unable to create outbound leg of proxy to host") return } @@ -476,11 +483,11 @@ func (m *migrationProxy) handleConnection(fd net.Conn) { }() select { - case err = <-outBoundErr: + case err := <-outBoundErr: if err != nil { m.logger.Reason(err).Errorf("error encountered copying data to outbound connection") } - case err = <-inBoundErr: + case err := <-inBoundErr: if err != nil { m.logger.Reason(err).Errorf("error encountered copying data into inbound connection") } @@ -489,6 +496,51 @@ func (m *migrationProxy) handleConnection(fd net.Conn) { } } +const procRootMarker = "/root/" + +type procRootPath struct { + rootBase string + elems []string +} + +func splitProcRootPath(path string) (*procRootPath, error) { + idx := strings.Index(path, procRootMarker) + if idx == -1 { + return nil, fmt.Errorf("path %q does not contain %q marker", path, procRootMarker) + } + rootBase := path[:idx+len("/root")] + relativePath := path[idx+len(procRootMarker):] + if relativePath == "" { + return nil, fmt.Errorf("path %q has empty relative path after %q marker", path, procRootMarker) + } + return &procRootPath{ + rootBase: rootBase, + elems: strings.Split(relativePath, "/"), + }, nil +} + +func dialUnixNoFollow(path string) (net.Conn, error) { + procPath, err := splitProcRootPath(path) + if err != nil { + return nil, err + } + safePath, err := safepath.JoinAndResolveWithRelativeRoot(procPath.rootBase, procPath.elems...) + if err != nil { + return nil, err + } + + var conn net.Conn + err = safePath.ExecuteNoFollow(func(safePath string) error { + var dialErr error + conn, dialErr = net.Dial("unix", safePath) + return dialErr + }) + if err != nil { + return nil, err + } + return conn, nil +} + func (m *migrationProxy) Start() error { if m.unixSocketPath != "" { ++++++ 0003-tests-dial-migration-target-sockets-through-proc-root-layout.patch ++++++ >From 6b82d6c38d82a74eea76161024b7af0cf33fdfa0 Mon Sep 17 00:00:00 2001 From: Victor Carvalho <[email protected]> Date: Tue, 4 Aug 2026 07:33:06 +0200 Subject: [PATCH 2/2] tests: dial migration target sockets through a /proc/<pid>/root layout The migration proxy resolves the target unix socket relative to the /proc/<pid>/root of the virt-launcher it belongs to, and rejects a path that is not below such a root. The unit tests dialed sockets straight out of a temporary directory, so the target proxy refused to connect and the tests blocked on a listener that never accepted. Place the sockets that act as proxy targets under a "root" directory inside the temporary directory. The paths then have the same shape as in production and exercise the same resolution. The source socket keeps its place: the source proxy listens on it and dials TCP, so it never reaches that code path. --- .../migration-proxy/migration-proxy_test.go | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/pkg/virt-handler/migration-proxy/migration-proxy_test.go b/pkg/virt-handler/migration-proxy/migration-proxy_test.go index 50c5e70..56d929c 100644 --- a/pkg/virt-handler/migration-proxy/migration-proxy_test.go +++ b/pkg/virt-handler/migration-proxy/migration-proxy_test.go @@ -39,12 +39,18 @@ import ( var _ = Describe("MigrationProxy", func() { var tlsConfig *tls.Config var tmpDir string + var launcherRoot string BeforeEach(func() { var err error tmpDir, err = os.MkdirTemp("", "migrationproxytest") Expect(err).ToNot(HaveOccurred()) os.MkdirAll(tmpDir, 0755) + // virt-handler reaches the target sockets inside the virt-launcher + // filesystem through /proc/<pid>/root. Mirror that layout so the + // proxy resolves them exactly as it does in production. + launcherRoot = filepath.Join(tmpDir, "root") + Expect(os.MkdirAll(launcherRoot, 0755)).To(Succeed()) store, err := certificates.GenerateSelfSignedCert(tmpDir, "test", "test") ephemeraldiskutils.MockDefaultOwnershipManager() @@ -107,7 +113,7 @@ var _ = Describe("MigrationProxy", func() { It("by creating both ends and sending a message", func() { sourceSock := filepath.Join(tmpDir, "source-sock") - virtqemudSock := filepath.Join(tmpDir, "virtqemud-sock") + virtqemudSock := filepath.Join(launcherRoot, "virtqemud-sock") virtqemudListener, err := net.Listen("unix", virtqemudSock) Expect(err).ShouldNot(HaveOccurred()) @@ -151,10 +157,10 @@ var _ = Describe("MigrationProxy", func() { DescribeTable("by creating both ends with a manager and sending a message", func(migrationConfig *v1.MigrationConfiguration) { directMigrationPort := "49152" - virtqemudSock := filepath.Join(tmpDir, "virtqemud-sock") + virtqemudSock := filepath.Join(launcherRoot, "virtqemud-sock") virtqemudListener, err := net.Listen("unix", virtqemudSock) Expect(err).ShouldNot(HaveOccurred()) - directSock := filepath.Join(tmpDir, "mykey-"+directMigrationPort) + directSock := filepath.Join(launcherRoot, "mykey-"+directMigrationPort) directListener, err := net.Listen("unix", directSock) Expect(err).ShouldNot(HaveOccurred()) @@ -218,12 +224,12 @@ var _ = Describe("MigrationProxy", func() { key2 := "key2" directMigrationPort := "49152" - virtqemudSock := filepath.Join(tmpDir, "virtqemud-sock") + virtqemudSock := filepath.Join(launcherRoot, "virtqemud-sock") virtqemudListener, err := net.Listen("unix", virtqemudSock) Expect(err).ShouldNot(HaveOccurred()) defer virtqemudListener.Close() - directSock := filepath.Join(tmpDir, key1+"-"+directMigrationPort) + directSock := filepath.Join(launcherRoot, key1+"-"+directMigrationPort) directListener, err := net.Listen("unix", directSock) Expect(err).ShouldNot(HaveOccurred()) defer directListener.Close() ++++++ 0004-manifest-templator-apply-the-custom-image-flags-before-rendering-the-operator-deployment.patch ++++++ From: Victor Carvalho <[email protected]> Date: Wed, 9 Sep 2026 16:40:00 +0200 Subject: [PATCH] manifest-templator: apply the custom image flags before rendering the operator deployment The templator renders the virt-operator deployment spec before it copies the --virt-*-image, --gs-image, --pr-helper-image and --sidecar-shim-image flags into the template data, so every custom image passed on the command line is silently ignored for the operator deployment in the release manifests; only the OLM CSV, rendered later, sees them. Render the deployment after the flags are applied. --- --- a/tools/manifest-templator/manifest-templator.go +++ b/tools/manifest-templator/manifest-templator.go @@ -160,7 +160,6 @@ data.PackageName = *packageName data.CreatedAt = getTimestamp() data.ReplacesCsvVersion = "" - data.OperatorDeploymentSpec = getOperatorDeploymentSpec(data, 2) data.PriorityClassSpec = getPriorityClassSpec(2) data.VirtOperatorImage = *virtOperatorImage data.VirtApiImage = *virtApiImage @@ -177,6 +176,7 @@ data.SidecarShimImage = *sidecarShimImage data.Hypervisor = *hypervisor data.WithKubeVirtControlPlaneLabel = *withKubeVirtControlPlaneLabel + data.OperatorDeploymentSpec = getOperatorDeploymentSpec(data, 2) if *featureGates != "" { data.FeatureGates = strings.Split(*featureGates, ",") } ++++++ kubevirt-1.9.0.tar.gz ++++++ /work/SRC/openSUSE:Factory/kubevirt1.9/kubevirt-1.9.0.tar.gz /work/SRC/openSUSE:Factory/.kubevirt1.9.new.1265/kubevirt-1.9.0.tar.gz differ: char 9, line 1
