home.social

Search

16 results for “heap”

  1. packet storm @packet_storm

    Pillow 12.3.0 JPEG Decoder Heap Buffer Overflow packetstorm.news/files/237261

    #exploit
  2. N-gated Hacker News @[email protected]

    🎉🚀 Behold the mighty Mistral Large 4: a monumental heap of baffling #jargon, cluttered with more parameters than your brain can process and promising the world, as if 99% of users will ever grasp the point! 🤯💸 But hey, don't forget to toggle that theme and try the studio—you know, because that's exactly what everyone needs. 🙄
    docs.mistral.ai/models/mistral #MistralLarge4 #AI #TechTrends #UserExperience #Innovation #HackerNews #ngated

    #jargon #mistrallarge4 #ai #techtrends #userexperience #innovation
  3. Emily Vale, Gendermancer @sillycoelophysis

    We surely gave it a mouth
    So it could heap on praise

    @ninlyricbot mastodon.social/@ninlyricbot/1

  4. Valentin Deleplace @deleplace

    Excellent animations AND tech content by Phuong Le
    Escape analysis in Go: stack or heap?

    youtu.be/BanG_wLnSfE?si=I-K3M-

    #golang
  5. Druid @adhdruid

    Finally updated everything. I can collapse in a heap now.

  6. SpookJ 👻 @snoopj

    I'm not loving that the fix for this involves +522-122 in the allocation machinery and *introduces* the concept of fallible heap allocation to the codebase

    odds seem bad that this will be the last we hear of it

  7. Leigh-Chantelle @[email protected]

    More #photos from Lady Elliot Island Eco Resort - last week with Ethan 📷

    It's a #coral cay in a highly protected Green Zone, a sanctuary for over 1200 species of marine life and a heap of #bird life, & run on #solar

    ladyelliot.com.au

    #LadyElliotIsland
    #QueenslandTourism
    #Travel
    #GreatBarrierReef
    #lighthouse

    #photos #coral #bird #solar #ladyelliotisland #queenslandtourism
  8. Liverpool Echo Sport @[email protected]

    Rio Ngumoha put in league of his own as Jamie Redknapp reveals training videos at his house
    liverpoolecho.co.uk/sport/foot
    Rio Ngumoha has enjoyed a sensational start to the season at Liverpool, with Jamie Redknapp heaping praise on the teenager after another stunning display in the Champions League #LFC #YNWA #DanielSturridge #JamieRedknapp #AndoniIraola #LiverpoolFC #RioNgumoha

    #lfc #ynwa #danielsturridge #jamieredknapp #andoniiraola #liverpoolfc
  9. ς๏гєɭคภς0๔3г :verified: @corelanc0d3r

    AI produces output. Your skills decide what holds up in exploit dev. Corelan Heap builds those skills. 2027 pre-reg:
    corelan-training.com/index.php

  10. Taggart :ifin: @mttaggart
    The Phermi Paradox

    If is so gnarly and so many systems are vulnerable, why hasn't half the internet fallen over?

    Couple possibilities:

    1. The exploit is still non-trivial and building the full attack chain is taking some time.

    This is at least partially true. I've yet to see a fully reliable proof-of-concept exploit that addresses all versions of PHP. Calif and Wiz showed exploit videos against targets. They didn't show what pregaming they did to prepare the exploit for those specific targets. So far, it seems like some prior work is necessary to get proper offsets, heap layouts, and payload shapes to exploit properly.

    And that's assuming the mod_php SAPI, which responds differently to this than PHP-FPM.

    2. Patching was aggressive and major targets had time to get in front of this.

    For larger orgs, I believe this is accurate. The message was clear enough, and there was time enough to get any org with a half-awake IT team to circle the wagons. Patching isn't done, surely, but I think the most enticing targets for notable attacks probably moved quickly.

    It's also worth noting that status dashboards like this are mostly a fairy tale. Look at the bottom for some whopper disclaimers. OS backports to versions other than PHP's official patched versions will muddy the picture, as will the 50% of PHP services that don't report versions. I'm not saying most of the internet is patched; I'm just saying

    But let's not ignore the alternative:

    3: The exploited won't know it's happening and won't report it.

    This is hardly a new phenomenon PHP sites have been exploited for years without anyone noticing (see: Slot Gacor). Exploitation won't look like the internet blinking off. It'll look like a bunch of gambling pages and piracy hosted on school and municipal government websites. Such attacks can lie quietly on PHP sites for years before anyone bothers to look.

    #php2shell
  11. Cheshire @[email protected]

    It does not attack for harm. It delivers. Accept what it offers and you are claimed: nothing you own will stay gone. Discard it, bury it, abandon it, and it returns by morning. Take from its heap without a claim, and the heap takes you.

    #TTRPG #TTRPGCommunity #IndieGameDev #WorldBuilding #CreatureDesign #GameDesign #KoFi #Patreon

    #ttrpg #ttrpgcommunity #indiegamedev #worldbuilding #creaturedesign #gamedesign
  12. Taggart :ifin: @mttaggart

    I have arrived at a working PoC based on a GitHub repo. But there are signficant caveats. You need 3 precise things to make it work.

    1. Initial offsets for functions are PHP version-specific, so you need those going in. That's annoying but easy.
    2. Heap layout constants based on Zend MM's memory layout for the PHP build. You get this with GDB precisely on a PHP instance you control, or fuzzing a target—messy.
    3. The specific shape of the payload to hit the OOM at the right point. This is largely based on memory limit settings in php.ini.

    So there's some prior work to hit a vulnerable target. A PHP offset "rainbow table" may be somewhere or getting built, but those specifics may explain the lag in clear evidence of exploitation.

  13. Major League Baseball @[email protected]

    What do the '82 Brewers think of the '26 Brewers and their World Series run? mlb.com/news/1982-brewers-disc MILWAUKEE -- Bud Selig’s clearest memory of the flight home from Game 7 of the 1982 World Series is walking to the back of the plane and finding his young shortstop, Robin Yount, in a heap. Nobody ached more than Yount about losing Game 7 to the Cardinals. #MLB

    #mlb
  14. Dark Web Informer :verified_paw: @darkwebinformer

    🚨 Critical pre-authentication RCE research published for two PHP core vulnerabilities; CVE-2026-109618 + CVE-2026-109619

    PoC: github.com/ikow/php2shell-poc

    The flaws affect PHP's session.upload_progress handling and can be chained through session-file injection, memory corruption, or deserialization behavior to achieve remote code execution under specific application conditions.

    CVSS: 9.2 Critical
    Affected: PHP 5.4.0 through 8.5.11
    Fixed: PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12

    The repository includes verification PoCs for session injection, a heap use-after-free, and handler-mismatch deserialization, along with a vulnerable Docker lab and detailed technical analysis.

  15. RS, Author, Novelist, Prosaist @[email protected]

    #PennedPossibilities 1162: "If your MC or SC were to carve a Jack-o’-lantern, what would it look like?"

    I imagine this convo:

    "Can you carve a Jack-o'-lantern?"

    With thinly veiled annoyance, the devil-girl would glance over the gnarly leather bound book (with a latch and lock) she's reading—she's always reading. "I don't know if I can. What is it?"

    I'd show the pumpkin, explain pumpkin carving, and say, "You use a knife—"

    "Goes with the verb 'carve.'"

    She'd nod as I would add, "Something artistic."

    "I can do that, arguably."

    With a sigh, she'd sit crosslegged on floor and thoroughly examine the pumpkin, turning it, lifting it, thumping it, and after assessing the sharpness and resilience and strength of the knife I'd have handed her by flexing it, she would sink in the knife near the crown and slightly twist it. Placing her hands in her lap, closing her eyes, she would seemingly contemplate for a minute or two. "Something challenging," she'd murmur before a glow would appear around her head.

    Over a period of a few minutes, the knife would move—swiftly and deftly and with no hesitation—to carve the most complex fractal pattern that the structure of the pumpkin could possibly support without collapsing, the seeds and fibers occasionally spitting themselves through the holes produced into a conical goopy lumpy orange heap. Pumpkin squash scent would fill the air. Eventually, the knife would insert itself back into her first test slit.

    "I'm not very artistic. Will this do?" she'd ask, once again picking up her book and dismissing my presence completely.

    I'd wisely say, "Yes. Thank you."

    [Author retains copyright (c)2026 R.S.]

    #BoostingIsSharing

    #gender #fiction #writer #author
    #cozy #mystery #sf #sff #sciencefiction
    #writing #writingcommunity #writersOfMastodon #writers
    #RSdiscussion
    #RSstory #RSReluctanceStory

    #pennedpossibilities #boostingissharing #gender #fiction #writer #author
  16. Dev Community @[email protected]

    Every platform team eventually hits the same wall: 80% of the workload is containerized, and the remaining 20% is a set of VMs nobody wants to touch — an Oracle client that only works on RHEL 7, a Windows appliance with a vendor license tied to a MAC address, a middleware box whose build pipeline left with the contractor. The business case for OpenShift Virtualization (KubeVirt packaged, supported and integrated by Red Hat) is simple: stop paying for two infrastructures and two operating models.

    The technical case is harder. A VM is a pod that cannot be killed, rescheduled in 300 ms, or restarted on a whim. Dropping VMs onto a cluster tuned for stateless pods is how you end up with 200 GB of RAM pinned on a node you need to patch, a live migration that never converges, and an etcd member starved of CPU because someone gave a VM 32 vCPUs on a control-plane-adjacent node.

    This is a field report on the three things that actually decide whether the coexistence works: storage, live migration, and secondary networking with Multus. Then we'll cover node maintenance, because that's where the design gets validated.

    Context: what changes when a VM lands on your cluster


    A VirtualMachine object is reconciled into a VirtualMachineInstance (VMI), which is backed by a virt-launcher pod running qemu-kvm inside the container. From the scheduler's point of view it's just a pod with a big memory request and a devices.kubevirt.io/kvm resource. From the operations point of view, three invariants break:

    1. Eviction is no longer free. Deleting a virt-launcher pod means hard-powering off a VM. Drains must trigger migrations, not deletions.
    2. Memory is not elastic. The guest RAM is a hard allocation plus QEMU overhead (roughly 200–300 MiB per VM plus page tables). Overcommit on a node that also runs latency-sensitive pods is a liability.
    3. Storage access mode becomes a scheduling constraint. RWO means the VM cannot live-migrate. Period.

    Start by deciding whether VMs and pods share nodes. In most retrofits, they shouldn't — not for isolation reasons, but for capacity predictability.

    oc label node worker-07 node-role.kubernetes.io/virt=""
    oc adm taint node worker-07 kubevirt.io/workload=true:NoSchedule

    Then pin the virtualization workloads via the HyperConverged CR, which is the single source of truth for the whole stack:

    apiVersion: hco.kubevirt.io/v1beta1
    kind: HyperConverged
    metadata:
    name: kubevirt-hyperconverged
    namespace: openshift-cnv
    spec:
    workloads:
    nodePlacement:
    nodeSelector:
    node-role.kubernetes.io/virt: ""
    tolerations:
    - key: kubevirt.io/workload
    operator: Equal
    value: "true"
    effect: NoSchedule
    liveMigrationConfig:
    parallelMigrationsPerCluster: 5
    parallelOutboundMigrationsPerNode: 2
    completionTimeoutPerGiB: 150
    progressTimeout: 150
    network: migration-net
    featureGates:
    enableCommonBootImageImport: true

    liveMigrationConfig.network is worth calling out early: it points to a NetworkAttachmentDefinition so migration traffic uses a dedicated NIC instead of saturating the pod network. On a 10 Gb link, a 32 GiB VM with a busy working set will happily eat the whole interface for two minutes.

    Storage: the decision that makes or breaks live migration


    Everything downstream depends on one property: can the PVC backing the root disk be attached to two nodes at once? Live migration requires ReadWriteMany (or RWX block). If your CSI driver can't do it, your VMs are pets forever.

    Check what CDI thinks your storage can do — StorageProfile objects are auto-populated per StorageClass and drive the defaults for DataVolumes:

    oc get storageprofile
    oc get storageprofile ocs-storagecluster-ceph-rbd -o jsonpath='{.status.claimPropertySets}' | jq

    For Ceph RBD you want volumeMode: Block + accessModes: [ReadWriteMany]. Block mode skips the filesystem layer, gives you a measurable IOPS gain and avoids the .img file-on-CephFS pattern.

    If a profile reports nothing useful, override it rather than patching every DataVolume:

    apiVersion: cdi.kubevirt.io/v1beta1
    kind: StorageProfile
    metadata:
    name: ocs-storagecluster-ceph-rbd
    spec:
    claimPropertySets:
    - accessModes:
    [ReadWriteMany] volumeMode: Block
    cloneStrategy: csi-clone

    Where HostPathProvisioner still fits


    HostPathProvisioner (HPP) is part of the OpenShift Virtualization bundle and provisions node-local directories. It's RWO by definition, so any VM on HPP is non-migratable. We still use it, deliberately, for two cases: scratch/swap disks and throughput-bound workloads sitting on local NVMe where the VM is already in an application-level HA pair.

    apiVersion: hostpathprovisioner.kubevirt.io/v1beta1
    kind: HostPathProvisioner
    metadata:
    name: hostpath-provisioner
    spec:
    imagePullPolicy: IfNotPresent
    storagePools:
    - name: local-nvme
    path: /var/hpvolumes
    workload:
    nodeSelector:
    node-role.kubernetes.io/virt: ""

    apiVersion: storage.k8s.io/v1
    kind: StorageClass
    metadata:
    name: hostpath-csi-local-nvme
    provisioner: kubevirt.io.hostpath-provisioner
    reclaimPolicy: Delete
    volumeBindingMode: WaitForFirstConsumer
    parameters:
    storagePool: local-nvme

    WaitForFirstConsumer is mandatory here — otherwise the PV is bound on a random node and the VM becomes unschedulable. And make sure /var/hpvolumes is a real mount point with its own device, created through a MachineConfig, not a directory carved out of the root filesystem.

    Deploying a VM you can actually operate


    Golden images live in openshift-virtualization-os-images as DataSource objects when enableCommonBootImageImport is on. Reference them with sourceRef so image updates don't require editing every VM:

    apiVersion: kubevirt.io/v1
    kind: VirtualMachine
    metadata:
    name: legacy-app-01
    namespace: legacy-apps
    labels:
    app: legacy-app
    spec:
    runStrategy: Always
    dataVolumeTemplates:
    - metadata:
    name: legacy-app-01-rootdisk
    spec:
    sourceRef:
    kind: DataSource
    name: rhel9
    namespace: openshift-virtualization-os-images
    storage:
    accessModes:
    [ReadWriteMany] volumeMode: Block
    storageClassName: ocs-storagecluster-ceph-rbd
    resources:
    requests:
    storage: 60Gi
    template:
    metadata:
    labels:
    app: legacy-app
    spec:
    evictionStrategy: LiveMigrate
    terminationGracePeriodSeconds: 180
    domain:
    cpu:
    sockets: 1
    cores: 4
    threads: 1
    model: host-model
    memory:
    guest: 8Gi
    firmware:
    bootloader:
    efi:
    secureBoot: true
    features:
    smm:
    enabled: true
    devices:
    disks:
    - name: rootdisk
    disk:
    bus: virtio
    - name: cloudinitdisk
    disk:
    bus: virtio
    interfaces:
    - name: default
    masquerade: {}
    model: virtio
    - name: vlan120
    bridge: {}
    networkInterfaceMultiqueue: true
    rng: {}
    networks:
    - name: default
    pod: {}
    - name: vlan120
    multus:
    networkName: legacy-apps/vlan120-bridge
    volumes:
    - name: rootdisk
    dataVolume:
    name: legacy-app-01-rootdisk
    - name: cloudinitdisk
    cloudInitNoCloud:
    secretRef:
    name: legacy-app-01-cloudinit

    Three details that matter more than they look:

    • cpu.model: host-model gives the guest the host CPU features but restricts migration to nodes with a compatible CPU. On heterogeneous hardware, either use a named baseline model (Nehalem, Skylake-Server) or group nodes by generation and let the scheduler handle the cpu-model node labels published by virt-handler.
    • terminationGracePeriodSeconds: 180 gives migration time to complete before anything forceful happens.
    • Cloud-init goes through a Secret, never inline in the VM spec — the VM object is readable by anyone with get virtualmachines.

    oc create secret generic legacy-app-01-cloudinit -n legacy-apps \
    --from-file=userdata=./user-data.yaml
    oc apply -f legacy-app-01.yaml
    oc get vmi -n legacy-apps -w
    virtctl console legacy-app-01 -n legacy-apps

    virtctl is downloadable straight from the cluster, which keeps versions aligned:

    oc get consoleclidownload virtctl -o jsonpath='{.spec.links

    .href}{"\n"}'

    Exposing the VM's service to the rest of the cluster


    With masquerade binding on the pod network, the virt-launcher pod has a normal cluster IP and the VM sits behind NAT inside it. That means plain Kubernetes Services work. KubeVirt labels the launcher pod with vm.kubevirt.io/name, so:

    apiVersion: v1
    kind: Service
    metadata:
    name: legacy-app
    namespace: legacy-apps
    spec:
    selector:
    vm.kubevirt.io/name: legacy-app-01
    ports:
    - name: http
    port: 8080
    targetPort: 8080

    apiVersion: route.openshift.io/v1
    kind: Route
    metadata:
    name: legacy-app
    namespace: legacy-apps
    spec:
    to:
    kind: Service
    name: legacy-app
    port:
    targetPort: http
    tls:
    termination: edge
    insecureEdgeTerminationPolicy: Redirect

    For quick checks, virtctl expose vm legacy-app-01 --name=legacy-app --port=8080 --target-port=8080 generates the equivalent Service — fine for a lab, but keep the declarative manifest in Git for anything real.

    Note that the guest keeps the same IP across a live migration on the pod network only because the masquerade NAT lives in the launcher pod and the pod IP is re-advertised; connections that are not reestablished will see a sub-second blip. For TCP sessions that must survive, use the secondary network with a stable L2 address.

    Multus: giving legacy VMs the network they expect


    Legacy VMs routinely need to be on a specific VLAN, with a specific IP, reachable by appliances that don't speak Kubernetes. That's Multus territory. Build the host bridge with NMState first:

    apiVersion: nmstate.io/v1
    kind: NodeNetworkConfigurationPolicy
    metadata:
    name: br-vlan120
    spec:
    nodeSelector:
    node-role.kubernetes.io/virt: ""
    desiredState:
    interfaces:
    - name: bond0.120
    type: vlan
    state: up
    vlan:
    base-iface: bond0
    id: 120
    - name: br-vlan120
    type: linux-bridge
    state: up
    ipv4:
    enabled: false
    ipv6:
    enabled: false
    bridge:
    options:
    stp:
    enabled: false
    port:
    - name: bond0.120

    oc get nncp br-vlan120
    oc get nnce | grep br-vlan120

    Then the attachment, in the VM's namespace:

    apiVersion: k8s.cni.cncf.io/v1
    kind: NetworkAttachmentDefinition
    metadata:
    name: vlan120-bridge
    namespace: legacy-apps
    annotations:
    k8s.v1.cni.cncf.io/resourceName: bridge.network.kubevirt.io/br-vlan120
    spec:
    config: |
    {
    "cniVersion": "0.3.1",
    "name": "vlan120-bridge",
    "type": "bridge",
    "bridge": "br-vlan120",
    "macspoofchk": true,
    "ipam": {},
    "preserveDefaultVlan": false
    }

    "ipam": {} is intentional: the guest gets its address from the VLAN's existing DHCP server or a static config, exactly like it did on vSphere. macspoofchk: true prevents a compromised guest from impersonating another MAC on a shared L2 — turn it off only for VMs that legitimately need nested MACs.

    If you're on OVN-Kubernetes and want to stay away from host bridges, the localnet topology of ovn-k8s-cni-overlay is the modern equivalent and is the direction Red Hat is pushing; the VM-side spec (multus.networkName) is identical.

    Pin MAC addresses for license-bound guests with spec.template.spec.domain.devices.interfaces[].macAddress, and make sure that MAC is unique — nothing in the cluster will check it for you across namespaces.

    Live migration and planned node maintenance


    Trigger and observe a migration explicitly before you trust a drain:

    virtctl migrate legacy-app-01 -n legacy-apps
    oc get vmim -n legacy-apps
    oc get vmi legacy-app-01 -n legacy-apps \
    -o jsonpath='{.status.migrationState}' | jq

    For VMs that dirty memory faster than the link can transfer it (databases, JVMs with large heaps), plain pre-copy migration never converges. Use a MigrationPolicy scoped by namespace or VMI labels rather than tuning each VM:

    apiVersion: migrations.kubevirt.io/v1alpha1
    kind: MigrationPolicy
    metadata:
    name: legacy-heavy-writers
    spec:
    selectors:
    namespaceSelector:
    migration-tier: heavy
    allowAutoConverge: true
    allowPostCopy: false
    completionTimeoutPerGiB: 300
    bandwidthPerMigration: 2Gi

    allowAutoConverge throttles the guest vCPUs to force convergence — a controlled slowdown instead of an aborted migration. Post-copy converges almost always but makes the VM dependent on the source node mid-flight; if that node dies, the VM dies. We keep it off outside of carefully chosen cases.

    Draining a node that hosts VMs


    KubeVirt automatically creates a PodDisruptionBudget for every VMI with evictionStrategy: LiveMigrate, which blocks the eviction API and lets virt-controller convert the disruption into a migration.

    oc adm cordon worker-07
    oc adm drain worker-07 \
    --delete-emptydir-data --ignore-daemonsets --force --timeout=1800s

    Watch the migrations in parallel, and keep in mind parallelOutboundMigrationsPerNode — with 20 VMs at 2 concurrent migrations, a drain is a 20-minute operation, not a 30-second one. Size your MachineConfigPool maxUnavailable: 1 accordingly and budget cluster upgrades in hours per pool.

    Audit before every maintenance window — any VM without LiveMigrate will be shut down by the drain:

    oc get vmi -A -o custom-columns=\
    'NS:.metadata.namespace,NAME:.metadata.name,NODE:.status.nodeName,EVICT:.spec.evictionStrategy'

    Set a cluster-wide default so nobody forgets: spec.evictionStrategy: LiveMigrate in the HyperConverged CR. For VMs that genuinely cannot migrate (HPP disks, GPU passthrough), use evictionStrategy: External and handle them with an explicit, scheduled shutdown — at least the drain won't surprise you.

    The NodeMaintenance CRD from the Node Maintenance Operator gives you the same thing as a declarative, auditable object:

    apiVersion: nodemaintenance.medik8s.io/v1beta1
    kind: NodeMaintenance
    metadata:
    name: worker-07-firmware
    spec:
    nodeName: worker-07
    reason: "BIOS 2.14.1 rollout - change CHG-4821"

    Security best practices


    • Keep virt-launcher unprivileged. Modern OpenShift Virtualization runs QEMU as non-root under the restricted-v2-like SCC with a dedicated SELinux type. Never grant privileged SCC to the VM service accounts to "fix" a device issue — fix the device plugin instead.
    • Scope RBAC on subresources. virtualmachineinstances/console and /vnc are full keyboard access to the guest. Bind kubevirt.io:view broadly, but grant console access through a dedicated role and a named group.
    • Treat secondary networks as outside the cluster. NetworkPolicy only applies to the pod network. Traffic on a Multus bridge bypasses it entirely. Either enforce at the physical fabric/VLAN level, or enable MultiNetworkPolicy support in the cluster network operator and write explicit policies per attachment.
    • Always enable macspoofchk, and prefer explicit, inventoried MAC addresses over generated ones on shared L2 segments.
    • No credentials in the VM spec. cloud-init user data goes in a Secret referenced by secretRef; SSH keys go through spec.template.spec.accessCredentials with a qemuGuestAgent propagation method so you can rotate them without rebooting.
    • UEFI Secure Boot + vTPM for Windows guests (efi.secureBoot: true with smm.enabled: true); it's a prerequisite for BitLocker and Credential Guard, and a hard requirement for Windows 11/Server 2025.
    • Encrypt at rest at the storage layer (Ceph/LUKS or the array), and additionally inside the guest for regulated data. Disk images are plain blocks in a PVC — anyone with exec on the right namespace can read them.
    • Quota the VM namespaces. A ResourceQuota on requests.memory and a LimitRange prevent a single team from allocating a node's worth of RAM, which is the most common way VM workloads starve collocated pods.
    • Isolate migration traffic. Live migration carries unencrypted guest memory. Put it on a dedicated, non-routed network via liveMigrationConfig.network.


    Key takeaways


    Running VMs next to pods is a solved problem, provided you accept that the VM dictates the constraints, not the other way around.

    • Storage decides everything. RWX + block, validated through StorageProfile, is the entry ticket to live migration. HostPathProvisioner is a deliberate, documented exception — never a default.
    • evictionStrategy: LiveMigrate is not optional. Set it cluster-wide in the HyperConverged CR and audit for exceptions before every maintenance window.
    • Multus plus NMState reproduces the legacy L2 the VMs expect, at the cost of losing NetworkPolicy — compensate with macspoofchk, fabric-level filtering, or MultiNetworkPolicy.
    • Standard Kubernetes primitives still apply to VM services: a Service selecting vm.kubevirt.io/name plus a Route is all you need to expose a legacy app, which is exactly the point of converging the platforms.
    • Drains become slow operations. Re-plan your upgrade windows around parallelOutboundMigrationsPerNode and the size of your guests, and use MigrationPolicy with auto-converge for the heavy writers.

    Get those five right and OpenShift Virtualization stops being a risk and becomes what it should be: one control plane, one RBAC model, one GitOps pipeline, for both halves of your estate.#openshift #kubevirt #kubernetes #virtualization #software #coding #development #engineering #inclusive #community
    OpenShift Virtualization: Running VMs and Pods on the Same Cluster Without Breaking Anything

    #kubevirt #openshift #virtualization #inclusive #engineering #kubernetes
Share on Mastodon

Enter the server where you have an account.