Module 2: VM Lifecycle Management

apiVersion: kubevirt.io/v1
kind: VirtualMachine
metadata:
  name: rhel9-webserver
  namespace: vmlab-student
  labels:
    app: webserver
spec:
  running: false               (1)
  template:
    metadata:
      labels:
        kubevirt.io/vm: rhel9-webserver
    spec:
      domain:
        cpu:
          cores: 2             (2)
          sockets: 1
          threads: 1
        memory:
          guest: 4Gi
        devices:
          disks:
          - name: rootdisk
            disk:
              bus: virtio      (3)
          - name: cloudinitdisk
            disk:
              bus: virtio
          interfaces:
          - name: default
            masquerade: {}     (4)
      networks:
      - name: default
        pod: {}
      volumes:
      - name: rootdisk
        dataVolume:
          name: rhel9-webserver-rootdisk
      - name: cloudinitdisk
        cloudInitNoCloud:
          userData: |
            #cloud-config
            user: cloud-user
            password: redhat123
            chpasswd: { expire: False }
            runcmd:
              - dnf install -y httpd
              - systemctl enable --now httpd
  dataVolumeTemplates:         (5)
  - metadata:
      name: rhel9-webserver-rootdisk
    spec:
      storage:
        accessModes: [ReadWriteMany]
        resources:
          requests:
            storage: 30Gi
        storageClassName: ocs-storagecluster-ceph-rbd-virtualization
      source:
        pvc:
          namespace: openshift-virtualization-os-images
          name: rhel9-guest-image

#cloud-config
hostname: rhel9-webserver
user: cloud-user
password: redhat123
chpasswd: { expire: False }
ssh_authorized_keys:
  - ssh-rsa AAAA...your-public-key
packages:
  - httpd
  - firewalld
runcmd:
  - systemctl enable --now httpd
  - firewall-cmd --add-service=http --permanent
  - firewall-cmd --reload
write_files:
  - path: /var/www/html/index.html
    content: |
      <h1>Hello from OpenShift Virtualization!</h1>

curl -L https://$(oc get route hyperconverged-cluster-cli-download -n openshift-cnv -o jsonpath='{.spec.host}')/amd64/linux/virtctl.tar.gz -o virtctl.tar.gz
tar -xzf virtctl.tar.gz
chmod +x virtctl && sudo mv virtctl /usr/local/bin/

virtctl version

# Start a stopped VM
virtctl start <vm-name> -n <namespace>

# Graceful shutdown (sends ACPI power-off signal to guest OS)
virtctl stop <vm-name> -n <namespace>

# Force stop (equivalent to pulling the power cable — use with caution)
virtctl stop --force --grace-period=0 <vm-name> -n <namespace>

# Graceful restart (stop + start, preserves VM definition)
virtctl restart <vm-name> -n <namespace>

# Alternatively, use oc patch to toggle running state
virtctl patch vm <vm-name> -n <namespace> \
  --type merge -p '{"spec":{"running":true}}'

# Pause a running VM
virtctl pause <vm-name> -n <namespace>

# Verify the paused state
oc get vmi <vm-name> -n <namespace> -o jsonpath='{.status.phase}'

# Resume the VM
virtctl unpause <vm-name> -n <namespace>

# Create a 10 GiB PVC for the data disk
cat > data-disk.yaml << 'EOF'
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: <pvc-name>
  namespace: <namespace>
spec:
  accessModes: [ReadWriteOnce]
  resources:
    requests:
      storage: 10Gi
  storageClassName: ocs-storagecluster-ceph-rbd-virtualization
EOF
oc apply -f data-disk.yaml

# Wait for the PVC to be Bound
oc get pvc <pvc-name> -n <namespace> -w

# Hot-plug the PVC to the running VM
virtctl addvolume <vm-name> \
  --volume-name=<volume-name> \
  --claim-name=<pvc-name> \
  --persist \
  -n <namespace>

# Verify the disk appears inside the guest
virtctl ssh cloud-user@<vm-name> -n <namespace> -- lsblk

# Remove the disk without rebooting
virtctl removevolume <vm-name> \
  --volume-name=<volume-name> \
  -n <namespace>

NAME              AGE   PHASE     IP             NODENAME                                   READY
rhel9-webserver   32m   Running   10.131.0.214   ip-10-0-7-182.us-east-2.compute.internal   True
VM rhel9-webserver was scheduled to stop
NAME              AGE   PHASE     IP             NODENAME                                   READY
rhel9-webserver   32m   Running   10.131.0.214   ip-10-0-7-182.us-east-2.compute.internal   False
rhel9-webserver   32m   Succeeded                  ip-10-0-7-182.us-east-2.compute.internal   False
rhel9-webserver   32m   Succeeded                  ip-10-0-7-182.us-east-2.compute.internal   False
rhel9-webserver   32m   Succeeded                  ip-10-0-7-182.us-east-2.compute.internal   False

No resources found in vmlab-student namespace.

VM rhel9-webserver was scheduled to start
NAME              AGE   PHASE        IP    NODENAME   READY
rhel9-webserver   0s    Scheduling                    False
rhel9-webserver   12s   Scheduled          ip-10-0-7-182.us-east-2.compute.internal   False
rhel9-webserver   13s   Scheduled          ip-10-0-7-182.us-east-2.compute.internal   False
rhel9-webserver   13s   Running      10.131.0.216   ip-10-0-7-182.us-east-2.compute.internal   False
rhel9-webserver   13s   Running      10.131.0.216   ip-10-0-7-182.us-east-2.compute.internal   True
rhel9-webserver   13s   Running      10.131.0.216   ip-10-0-7-182.us-east-2.compute.internal   True

# Stop the VM for a consistent snapshot (preferred)
virtctl stop <vm-name> -n <namespace>

cat << 'EOF' | oc apply -f -
apiVersion: snapshot.kubevirt.io/v1beta1
kind: VirtualMachineSnapshot
metadata:
  name: <snapshot-name>
  namespace: <namespace>
spec:
  source:
    apiGroup: kubevirt.io
    kind: VirtualMachine
    name: <vm-name>
EOF

# Monitor snapshot creation
oc get vmsnapshot -n <namespace> -w

# Verify snapshot is Ready
oc get vmsnapshot <snapshot-name> -n <namespace> \
  -o jsonpath='{.status.readyToUse}'

# Restore the VM to the snapshot (VM must be stopped)
cat << 'EOF' | oc apply -f -
apiVersion: snapshot.kubevirt.io/v1beta1
kind: VirtualMachineRestore
metadata:
  name: <restore-name>
  namespace: <namespace>
spec:
  target:
    apiGroup: kubevirt.io
    kind: VirtualMachine
    name: <vm-name>
  virtualMachineSnapshotName: <snapshot-name>
EOF

# Watch restore progress
oc get vmrestore -n <namespace> -w

# Start the VM after restore completes
virtctl start <vm-name> -n <namespace>

This is the WEB server before failure.

# Step 1: Graceful stop
virtctl stop <vm-name> -n <namespace>

# Step 2: Delete snapshots (if any)
oc delete vmsnapshot -n <namespace> --all

# Step 3: Delete the VM (cascades to DVs and PVCs from dataVolumeTemplates)
oc delete vm <vm-name> -n <namespace>

# Step 4: Verify cleanup
oc get vm,vmi,dv,pvc,vmsnapshot -n <namespace>

# Note: Manually created PVCs (not in dataVolumeTemplates) are NOT
# automatically deleted. Remove them explicitly if no longer needed.
oc delete pvc <volume-name> -n <namespace>

# Add deletion protection annotation
oc annotate vm <vm-name> -n <namespace> \
  kubevirt.io/vm-deletion-protection=true

# The VM cannot be deleted until the annotation is removed
oc delete vm <vm-name> -n <namespace>
# Error: admission webhook denied the request

# Remove protection before decommissioning
oc annotate vm <vm-name> -n <namespace> \
  kubevirt.io/vm-deletion-protection-

# Check VMI events for scheduling errors
oc describe vmi <vm-name> -n <namespace> | grep -A20 Events

# Check the virt-launcher pod (may reveal image pull or resource errors)
oc get pods -n <namespace> -l kubevirt.io/vm=<vm-name>
oc describe pod <virt-launcher-pod> -n <namespace>

# Check node capacity
oc describe nodes | grep -A10 'Allocated resources'

# Check if DataVolume import is still in progress
oc get dv -n <namespace>
oc describe dv <root-disk-name> -n <namespace> | grep -A10 Conditions