home.social

Search

29 results for “tunix”

  1. GetMusicTools @[email protected]

    Keeping your instruments in tune is essential for every musician. Explore our curated list of tuning apps and software, from guitar tuners to chromatic options for any instrument. Find the right tool to stay in pitch. getmusictools.com/categories/t #tuning #musicians #musictools

    #tuning #musicians #musictools
  2. United States News Beep @[email protected]

    TUNEXX Is Billboard’s K-Pop Up & Comer of the Month for October

    Image Credit: IST ENTERTAINMENT DONGGYU   Which part of the title track or B-sides shows off your charm…
    #NewsBeep #News #US #USA #UnitedStates #UnitedStatesOfAmerica #Music #BillboardGallery #BillboardKorea #Entertainment #genrekpop #Global #K-PopRookieoftheMonth #Korea
    newsbeep.com/us/889560/

    #korea #k #global #genrekpop #entertainment #billboardkorea
  3. Planet PostgreSQL @planetpostgres

    Karen Jex: Tuning Postgres for Analytics - PGConf.EU

    postgr.es/p/9zJ

    #postgresql
  4. Dr. Dani Sanchez @[email protected]

    Thanks for tuning in! Drop by #SatMat for Hammer Horror Dracula fun (info➡️ mastodon.social/@analgesicslee) AND I’m hosting both #SymSat (info➡️ mastodon.social/@analgesicslee) and #BaroqueSun (info➡️ mastodon.social/@analgesicslee) + next week we pregame #HappyHalloween with found horror on #LaEsoterica, Halloween tv shows on #MusComEnt & a goth dance party on #RetroView.. Enjoy the rest of your week💕

    #satmat #symsat #baroquesun #happyhalloween #laesoterica #muscoment
  5. iRexta @[email protected]

    Stop debating RAG vs Fine-Tuning. Enterprise AI requires both.

    Our hands-on MLOps implementation guide covers:
    🧩 Semantic Chunking: Local BGE-M3 embeddings with zero egress
    ⚙️ 4-Bit QLoRA: BitsAndBytes + PEFT to prevent GPU OOM crashes
    🛡️ Security Defense: Sanitizing indirect prompt injection (OWASP LLM01)
    🚀 Bare Metal Speed: Zero cloud API taxes & unmetered NVMe

    🔗 irexta.com/tutorials/rag-vs-fi

    #LLM #RAG #FineTuning #MLOps #AI #BareMetal #iRexta

    #llm #rag #finetuning #mlops #ai #baremetal
  6. DoomsdaysCW @[email protected]

    Oh ho! Tuning into an #AI workshop for work and seeing some interesting questions from the audience. Like, "What is the environmental impact of this?" or "How much is this going to cost us a year?" Yup. I'm not the only AI skeptic in this workshop. Keep asking questions, people!

    #AISucks #AIDatacentres #EnvironmentalImpact #DumbingUsDown

    #ai #aisucks #aidatacentres #environmentalimpact #dumbingusdown
  7. After Dinner Conversation® @[email protected]

    WRITING TIPS: Your Turn—Lifelines—Writing as Deep Listening: Tuning the Writer’s Ear
    Hearing what the page is telling you. #writingtips

    revisionsrevelations.substack.com/p/your-turnl...

    Your Turn—Lifelines—Writing as...

    #writingtips
  8. brozu ▪️ @[email protected]

    “#VibeCoding is the new product management.
    Training & tuning models is the new #coding."

    #NavalRavikant

    @aitech
    #ai
    #llm

    #coding #navalravikant #ai #llm
  9. Karsten Schmidt @[email protected]

    Getting ready for creating a larger contact print of this image tonight... Just some more fine tuning of the talus fields needed...

    #Photography #BlackAndWhite #NoirCountry #Darkroom #PrintMaking

    #photography #blackandwhite #noircountry #darkroom #printmaking
  10. Arsalan Zaidi @[email protected]

    kael.tech.blog/2026/10/17/my-e

    Lots of nitty gritty details on tuning local LLMs in this article.

    TLDR; inference software configuration can matter almost as much as hardware. A poorly chosen backend can make a capable local system appear unusable.

    #AI #LLM #localLLM #qwen

    #ai #llm #localllm #qwen
  11. Bishnu Bhusal @[email protected]

    Our AAAI 2026 poster on private in-context learning: LLMs can use sensitive records as in-context examples, with formal differential privacy guarantees and no fine-tuning.

    Poster: doi.org/10.48448/8as1-z797
    Paper: arxiv.org/abs/2509.13625
    Code: github.com/bhusalb/privacy-pre

    #DifferentialPrivacy #LLM #AAAI2026 #Privacy

    #differentialprivacy #llm #aaai2026 #privacy
  12. Conan the Sysadmin @[email protected]

    Faint pulses on wires lurk underneath the most lofty conversations. #Linux #OpenSource cromwell-intl.com/open-source/

    #linux #opensource
  13. michabbb @michabbb

    👂 Voxtral Small Transcribe 3 covers 50+ languages, including all 24 official EU languages, with diarization (who said what) and context biasing for domain vocabulary without fine-tuning. On FLEURS it reaches 4.1% WER, ahead of Gemini 3.5 Transcribe, Scribe v2, GPT Transcribe and Whisper large-v3. The 4B Mini variant costs $0.0035/min.

  14. Bishnu Bhusal @[email protected]

    1/ Can an LLM use sensitive records as in-context examples without leaking them? Our AAAI 2026 paper: yes, with formal differential privacy guarantees and no fine-tuning.

    Paper: arxiv.org/abs/2509.13625
    Code: github.com/bhusalb/privacy-pre

    #DifferentialPrivacy #LLM #Privacy

    #differentialprivacy #llm #privacy
  15. David Cantrell 🏏 @drhyde

    Today's sense of impending doom brought to me by unboxing a shiny new desktop computer and now having to migrate years of fine-tuning over to it.

    #apple #macmini #newshiny #worldalttextchampionshipentry #hashtag
  16. Deutschland @[email protected]

    europesays.com/de/1359159/ GT World Challenge Europe brachte Pech für Car Collection Motorsport #24StundenLeMans #24h #AktuelleNachrichten #AktuelleNews #Auto #dakar #DTM #EMobility #EU #Europa #EuropäischeUnion #Europe #EuropeanUnion #f1 #FiaWec #Formel1 #FormelE #Games #GtMasters #Headlines #MotorsportMagazin #Nachrichten #News #Nürburgring #Rallye #Schlagzeilen #SpeedMagazin #speedmagazin #Tuning #wrc

    #24stundenlemans #24h #aktuellenachrichten #aktuellenews #auto #dakar
  17. Nearskill | AI & Tech Jobs @[email protected]

    🔔 Position Open! | JavaScript / TypeScript Full-Stack Developer (Javascript)

    Remote contract with Turing, pay discussed during screening
    ✅ Building and maintaining code that trains AI models
    ✅ Running evals to benchmark model performance
    ✅ Supervised fine-tuning with task-specific datasets

    👉 Apply here: nearskill.in/jobs/javascript-t

    #RemoteJobs #Javascript #Jobs #Typescript

    #remotejobs #javascript #jobs #typescript
  18. PrivacyDigest @[email protected]

    #DHS Said They Searched Man Who Wiped #GrapheneOS Phone for #ChildAbuse Material. They Lied

    When a Department of #HomelandSecurity official sent out an alert to stop Samuel Tunick, a #StopCopCity activist, at an #airport in January 2025, they said the reason was because he was suspected of “terrorist activities,” according to new filed court records which include a screenshot of the alert and photos of Tunick’s #interrogation.

    #Tunick ultimately provided #Customs and #BorderProtection (#CBP ) officials with a code that, when entered, wiped his #security - and #privacy -focused GrapheneOS phone. Tunick is now being criminally charged for that alleged act, in one of the most high profile technology #civilrights cases in recent memory.

    The court records also showed that CBP officials lied to Tunick during his interrogation. Instead of saying he was being targeted for suspected #terrorism —… they said they needed his phone to look for “#kiddieporn.”
    #csam

    404media.co/dhs-said-they-sear

    #csam #terrorism #civilrights #privacy #security #borderprotection
  19. ekiledjian @edwardk

    DHS Said They Searched Man Who Wiped GrapheneOS Phone for Child Abuse Material. They Lied

    Officials said they wanted to search the phone of Samuel Tunick, a Stop Cop City activist, for child abuse material, 404 Media reports. According to 404 Media, the search was actually pursued because he was suspected of ‘terrorist activities’ after he wiped his GrapheneOS phone. 404media.co/dhs-said-they-sear

  20. Pullrepo @[email protected]

    🚀 Fastest-growing AI projects today

    1. Projects like Mapika/decider leading the pack with innovative approaches to decision-ma...
    2. Mapika's decider has garnered significant attention thweek, amassing 1,124 stars.
    3. The project aims to provide one-pass typed decisions with calibrated probabilities usin...

    Full report → pullrepo.com/report/todays-fin

    #AI #OpenSource #GitHub #Tech #FinetuningTraining

    #ai #opensource #github #tech #finetuningtraining
  21. Pullrepo @[email protected]

    🚀 Fastest-growing AI projects today

    1. The trend underscores the growing importance of customizing pre-trained models to speci...
    2. Mapika/decider stands out with a significant growth score of 37.08, accumulating over 1...
    3. Thproject fine-tunes System One style models from Qwen3.5-2B to make one-pass typed dec...

    Full report → pullrepo.com/report/todays-fin

    #AI #OpenSource #GitHub #Tech #FinetuningTraining

    #ai #opensource #github #tech #finetuningtraining
  22. Christof Zürn @[email protected]

    What can a traditional music ensemble teach modern startup founders about leadership?

    In a traditional Malaysian gamelan, there is no single conductor standing at the front. Instead, musicians rely on interlocking rhythms, non-standard tuning, and constant role rotation.

    musicthinking.com/the-startup-

    #gamelan #startup #ethnomusicology

    #gamelan #startup #ethnomusicology
  23. Felhasználó @[email protected]

    Csak nem hagyott nyugodt. Hat dollárt megért a próba.

    Jelenleg ráengedtem egy fejlesztés alatt álló, de messze nem éles, messze nem RC, hanem inkább késő béta projektemre.
    Hát... szedi rendesen a hibákat, pedig a flash-t, használom.

    Nyilván külön branch és nincs merge, hanem tolok rá egy Claude+Codex felülvizsgálatot is, hogy mit szólnak ehhez, mennyire volt jogos, vagy jó az észrevétel a biztonsági és logikai audit során.

    De, ahogy nézem közben én is azért itt-ott kézzel és szemmel, korrektnek tűnik elsőre.

    Oké, oké, szenzitív rendszer esetén kívánában landol majd a kód, meg mit tudom én. Igen.
    De annak a szenzitív rendszernek a kódja a többi ügynök esetén pedig az USA-ban landol, ha akar, szóval, valahogy elengedtem ezt a paranoia témát ilyen téren.

    #DeepSeek #AI #token #api

    #api #token #ai #deepseek
  24. Marcos Lobo 💙💛 @[email protected]

    The AI Stack

    1/ The AI Stack, Part 1: Building Product-First

    Application Development Layer (Product-First). This is the layer where most of the user experience is built

    newsletter.optimistengineer.co

    2/ The AI Stack, Part 2: The Art of Specialization

    Never fine-tune just to teach your model static facts (that’s what RAG is for). Use fine-tuning exclusively for behavior, tone, and formatting!

    newsletter.optimistengineer.co

    3/ The AI Stack, Part 3: The Engine Room

    In modern AI engineering, this layer is strictly dictated by one huge bottleneck: GPU/TPU scarcity and compute costs.

    newsletter.optimistengineer.co

    #ainative #ai #stack

    #ainative #ai #stack
  25. Pullrepo @[email protected]

    🚀 Fastest-growing AI projects today

    1. One of the most notable trends the growing interest in LoRA (Low-Rank Adaptation) fine-...
    2. Mapika/decider has seen substantial growth thweek, boasting a Growth Score of 38.31 and...
    3. The project aims to provide one-pass typed decisions with calibrated probabilities, fin...

    Full report → pullrepo.com/report/todays-fin

    #AI #OpenSource #GitHub #Tech #FinetuningTraining

    #ai #opensource #github #tech #finetuningtraining
  26. Pirates.BZ Tech Startup News @[email protected]

    Anglo-Finnish quantum spinout QuantrolOx, founded at Oxford and now based in Finland, has raised 12M EUR (about 14M USD) in a Series A led by IW Capital, with the EIC Fund and Transpose Capital joining. Its software automates the tuning and control of quantum computers across hardware architectures, a bottleneck holding the field back. tech.eu/2026/10/22/anglo-finni #Tech #Startup #News #Quantum

    #tech #startup #news #quantum
  27. Spooky Panda 🕸️🎃 @[email protected]

    #WordWeavers 10/21: Your MC wakes up with the ability to read minds for 24 hours. Whose thoughts do they most want to hear? Whose thoughts do they least want to hear?

    The ones she most and least wants to hear belong to the very same man: Elric. Zerika would want to hear his thoughts, and then would immediately cringe at the thought of "tuning in" to hear. What if he secretly finds her unattractive, boring as far as company goes, or think she's completely idiotic for not being good at talking to strangers? How would he feel about her not knowing how to read? (Spoiler alert, he doesn't care. In fact, he offers to teach her. He actually adores her.) All of these questions and thoughts would immediately flood her. I can feel her anxiety through the screen, poor thing.

    Also... Not even kidding about this, but it gives me some ideas for an upcoming tale in the series, so thank you for that!

    #WritingCommunity #WritersOfMastodon #TheScarletMirror #FatedByFire #CozyFantasy #Fantasy #SwordAndSorcery #Romance

    #wordweavers #writingcommunity #writersofmastodon #thescarletmirror #fatedbyfire #cozyfantasy
  28. Dev Community @[email protected]

    The Local Office Document Gap in AI Workflows


    When prototyping with Claude Code or Cursor's agent mode, I hit a recurring friction point: generating structured documents. LLMs excel at producing markdown or JSON, but translating that into actual .docx reports or .xlsx data exports meant context-switching to manual Python scripts with python-docx or copying output into Google Docs.

    The genspark-ai/genoffice project solves this by exposing a unified CLI that creates and edits native Office files locally—no API keys for document generation services, no cloud dependencies. It bundles Docs, Sheets, Slides, PDF, Markdown, and HTML editors with a built-in AI agent, plus an MCP skill spec designed for Cursor and Claude Code integration.

    Architecture: CLI + MCP Skill Registration


    genoffice operates as a standalone binary with two execution modes:

    1. Interactive GUI: Launch genoffice to open the Electron-based editor suite.
    2. Headless CLI: Use genoffice create-doc --template report.docx --output quarterly.docx for scripted workflows.

    The critical piece for Cursor integration is the MCP (Model Context Protocol) skill manifest. When registered, Cursor's agent can invoke genoffice commands directly through natural language prompts:

    {
    "mcpServers": {
    "genoffice": {
    "command": "genoffice",
    "args": ["mcp"],
    "env": {
    "OPENAI_API_KEY": "your-key-or-relay"
    }
    }
    }
    }

    Drop this into .cursor/mcp_settings.json (create if missing). Restart Cursor, and the agent gains create_document, edit_spreadsheet, generate_slides capabilities.

    Hardening the Relay Gateway for Multi-Model Fallback


    genoffice's AI agent defaults to OpenAI endpoints, but production workflows demand cost optimization and failover. I route requests through https://b-lost.com/v1 as a relay gateway to abstract provider switching:

    export OPENAI_BASE_URL="https://b-lost.com/v1"
    export OPENAI_API_KEY="your-relay-token"
    genoffice mcp

    This setup allows seamless model rotation (GPT-4 → Claude → Gemini) without reconfiguring genoffice. When testing document generation with varying context sizes, routing through the relay reduced average token costs by 22% compared to direct OpenAI calls, primarily by auto-selecting cheaper models for formatting-heavy tasks.

    Practical Integration: Automated Sprint Report Pipeline


    Here's a real workflow: generating weekly sprint reports from Jira exports.

    Step 1: Export Jira data to JSON

    curl -u user:token "https://jira.company.com/rest/api/2/search?jql=sprint=42" > sprint.json

    Step 2: Cursor agent prompt

    @genoffice create a Word document from sprint.json with sections:
    - Completed stories (table)
    - Blockers (bullet list)
    - Velocity chart (placeholder image)
    Output: sprint_42_report.docx

    Cursor's agent parses the JSON, invokes genoffice create-doc, and generates a formatted .docx in 8 seconds. The velocity chart placeholder requires manual insertion (genoffice doesn't render charts yet), but tables and text formatting are production-ready.

    Step 3: Programmatic edits via CLI

    genoffice edit-doc sprint_42_report.docx \
    --append "## Action Items" \
    --insert-table "blockers.csv" \
    --style "Heading 2"

    This avoids reopening the GUI for minor tweaks.

    Operational Boundaries and Failure Modes


    Performance: Document creation scales linearly with content size. A 50-page .docx with 20 tables takes ~15 seconds on M2 MacBook Air. This is acceptable for CI pipelines but too slow for real-time preview workflows.

    Format Fidelity: Complex PowerPoint animations and Excel macros aren't preserved. genoffice reads/writes Office Open XML (.docx, .xlsx, .pptx) but strips VBA and embedded media beyond images.

    Concurrency: The MCP server spawns one genoffice process per request. Running 5 parallel document generations maxed CPU at 340%, with no queue throttling. For batch jobs, wrap calls in xargs -P 2 to avoid resource exhaustion.

    Error Propagation: When the AI agent fails to generate valid Office XML (rare, but happens with malformed JSON input), genoffice returns exit code 1 with no intermediate output. You lose the partial document. Always validate input schemas before invoking CLI commands.

    Configuration Tuning for Cursor Agent Context


    The default MCP skill allows 8KB of context per prompt. For document generation from large datasets (e.g., 500-row CSV), this truncates input. Override in .cursor/mcp_settings.json:

    {
    "genoffice": {
    "maxContextTokens": 32768,
    "env": {
    "OPENAI_BASE_URL": "https://b-lost.com/v1",
    "GENOFFICE_TEMP_DIR": "/tmp/genoffice-cache"
    }
    }
    }

    The GENOFFICE_TEMP_DIR flag prevents cluttering /tmp with orphaned XML fragments during failed runs.

    Open Trade-Off: Native Execution vs. Containerized Isolation


    Running genoffice as a native binary on macOS/Windows/Linux simplifies installation (single Homebrew formula or .exe), but mixing Node.js dependencies with system-wide Electron bundles risks version conflicts. I've seen collision with VS Code's internal Chromium runtime on Arch Linux, causing segfaults.

    The alternative—wrapping genoffice in Docker—adds 200MB image overhead and breaks MCP socket communication unless you expose Unix domain sockets. There's no universal clean solution yet. If you're standardizing CI environments, containers win. For local dev, accept the native binary's brittleness and pin versions in package.json or brew pin.

    For teams already managing polyglot dev environments through Cursor's MCP ecosystem, does the convenience of local Office file generation outweigh the dependency surface area risk?#cursor #vscode #devtools #productivity #software #coding #development #engineering #inclusive #community
    Wiring genoffice CLI into Cursor MCP: Real Office Document Generation from AI Context

    #vscode #devtools #cursor #productivity #inclusive #engineering
  29. Dev Community @[email protected]

    Every platform team eventually hits the same wall: 80% of the workload is containerized, and the remaining 20% is a set of VMs nobody wants to touch — an Oracle client that only works on RHEL 7, a Windows appliance with a vendor license tied to a MAC address, a middleware box whose build pipeline left with the contractor. The business case for OpenShift Virtualization (KubeVirt packaged, supported and integrated by Red Hat) is simple: stop paying for two infrastructures and two operating models.

    The technical case is harder. A VM is a pod that cannot be killed, rescheduled in 300 ms, or restarted on a whim. Dropping VMs onto a cluster tuned for stateless pods is how you end up with 200 GB of RAM pinned on a node you need to patch, a live migration that never converges, and an etcd member starved of CPU because someone gave a VM 32 vCPUs on a control-plane-adjacent node.

    This is a field report on the three things that actually decide whether the coexistence works: storage, live migration, and secondary networking with Multus. Then we'll cover node maintenance, because that's where the design gets validated.

    Context: what changes when a VM lands on your cluster


    A VirtualMachine object is reconciled into a VirtualMachineInstance (VMI), which is backed by a virt-launcher pod running qemu-kvm inside the container. From the scheduler's point of view it's just a pod with a big memory request and a devices.kubevirt.io/kvm resource. From the operations point of view, three invariants break:

    1. Eviction is no longer free. Deleting a virt-launcher pod means hard-powering off a VM. Drains must trigger migrations, not deletions.
    2. Memory is not elastic. The guest RAM is a hard allocation plus QEMU overhead (roughly 200–300 MiB per VM plus page tables). Overcommit on a node that also runs latency-sensitive pods is a liability.
    3. Storage access mode becomes a scheduling constraint. RWO means the VM cannot live-migrate. Period.

    Start by deciding whether VMs and pods share nodes. In most retrofits, they shouldn't — not for isolation reasons, but for capacity predictability.

    oc label node worker-07 node-role.kubernetes.io/virt=""
    oc adm taint node worker-07 kubevirt.io/workload=true:NoSchedule

    Then pin the virtualization workloads via the HyperConverged CR, which is the single source of truth for the whole stack:

    apiVersion: hco.kubevirt.io/v1beta1
    kind: HyperConverged
    metadata:
    name: kubevirt-hyperconverged
    namespace: openshift-cnv
    spec:
    workloads:
    nodePlacement:
    nodeSelector:
    node-role.kubernetes.io/virt: ""
    tolerations:
    - key: kubevirt.io/workload
    operator: Equal
    value: "true"
    effect: NoSchedule
    liveMigrationConfig:
    parallelMigrationsPerCluster: 5
    parallelOutboundMigrationsPerNode: 2
    completionTimeoutPerGiB: 150
    progressTimeout: 150
    network: migration-net
    featureGates:
    enableCommonBootImageImport: true

    liveMigrationConfig.network is worth calling out early: it points to a NetworkAttachmentDefinition so migration traffic uses a dedicated NIC instead of saturating the pod network. On a 10 Gb link, a 32 GiB VM with a busy working set will happily eat the whole interface for two minutes.

    Storage: the decision that makes or breaks live migration


    Everything downstream depends on one property: can the PVC backing the root disk be attached to two nodes at once? Live migration requires ReadWriteMany (or RWX block). If your CSI driver can't do it, your VMs are pets forever.

    Check what CDI thinks your storage can do — StorageProfile objects are auto-populated per StorageClass and drive the defaults for DataVolumes:

    oc get storageprofile
    oc get storageprofile ocs-storagecluster-ceph-rbd -o jsonpath='{.status.claimPropertySets}' | jq

    For Ceph RBD you want volumeMode: Block + accessModes: [ReadWriteMany]. Block mode skips the filesystem layer, gives you a measurable IOPS gain and avoids the .img file-on-CephFS pattern.

    If a profile reports nothing useful, override it rather than patching every DataVolume:

    apiVersion: cdi.kubevirt.io/v1beta1
    kind: StorageProfile
    metadata:
    name: ocs-storagecluster-ceph-rbd
    spec:
    claimPropertySets:
    - accessModes:
    [ReadWriteMany] volumeMode: Block
    cloneStrategy: csi-clone

    Where HostPathProvisioner still fits


    HostPathProvisioner (HPP) is part of the OpenShift Virtualization bundle and provisions node-local directories. It's RWO by definition, so any VM on HPP is non-migratable. We still use it, deliberately, for two cases: scratch/swap disks and throughput-bound workloads sitting on local NVMe where the VM is already in an application-level HA pair.

    apiVersion: hostpathprovisioner.kubevirt.io/v1beta1
    kind: HostPathProvisioner
    metadata:
    name: hostpath-provisioner
    spec:
    imagePullPolicy: IfNotPresent
    storagePools:
    - name: local-nvme
    path: /var/hpvolumes
    workload:
    nodeSelector:
    node-role.kubernetes.io/virt: ""

    apiVersion: storage.k8s.io/v1
    kind: StorageClass
    metadata:
    name: hostpath-csi-local-nvme
    provisioner: kubevirt.io.hostpath-provisioner
    reclaimPolicy: Delete
    volumeBindingMode: WaitForFirstConsumer
    parameters:
    storagePool: local-nvme

    WaitForFirstConsumer is mandatory here — otherwise the PV is bound on a random node and the VM becomes unschedulable. And make sure /var/hpvolumes is a real mount point with its own device, created through a MachineConfig, not a directory carved out of the root filesystem.

    Deploying a VM you can actually operate


    Golden images live in openshift-virtualization-os-images as DataSource objects when enableCommonBootImageImport is on. Reference them with sourceRef so image updates don't require editing every VM:

    apiVersion: kubevirt.io/v1
    kind: VirtualMachine
    metadata:
    name: legacy-app-01
    namespace: legacy-apps
    labels:
    app: legacy-app
    spec:
    runStrategy: Always
    dataVolumeTemplates:
    - metadata:
    name: legacy-app-01-rootdisk
    spec:
    sourceRef:
    kind: DataSource
    name: rhel9
    namespace: openshift-virtualization-os-images
    storage:
    accessModes:
    [ReadWriteMany] volumeMode: Block
    storageClassName: ocs-storagecluster-ceph-rbd
    resources:
    requests:
    storage: 60Gi
    template:
    metadata:
    labels:
    app: legacy-app
    spec:
    evictionStrategy: LiveMigrate
    terminationGracePeriodSeconds: 180
    domain:
    cpu:
    sockets: 1
    cores: 4
    threads: 1
    model: host-model
    memory:
    guest: 8Gi
    firmware:
    bootloader:
    efi:
    secureBoot: true
    features:
    smm:
    enabled: true
    devices:
    disks:
    - name: rootdisk
    disk:
    bus: virtio
    - name: cloudinitdisk
    disk:
    bus: virtio
    interfaces:
    - name: default
    masquerade: {}
    model: virtio
    - name: vlan120
    bridge: {}
    networkInterfaceMultiqueue: true
    rng: {}
    networks:
    - name: default
    pod: {}
    - name: vlan120
    multus:
    networkName: legacy-apps/vlan120-bridge
    volumes:
    - name: rootdisk
    dataVolume:
    name: legacy-app-01-rootdisk
    - name: cloudinitdisk
    cloudInitNoCloud:
    secretRef:
    name: legacy-app-01-cloudinit

    Three details that matter more than they look:

    • cpu.model: host-model gives the guest the host CPU features but restricts migration to nodes with a compatible CPU. On heterogeneous hardware, either use a named baseline model (Nehalem, Skylake-Server) or group nodes by generation and let the scheduler handle the cpu-model node labels published by virt-handler.
    • terminationGracePeriodSeconds: 180 gives migration time to complete before anything forceful happens.
    • Cloud-init goes through a Secret, never inline in the VM spec — the VM object is readable by anyone with get virtualmachines.

    oc create secret generic legacy-app-01-cloudinit -n legacy-apps \
    --from-file=userdata=./user-data.yaml
    oc apply -f legacy-app-01.yaml
    oc get vmi -n legacy-apps -w
    virtctl console legacy-app-01 -n legacy-apps

    virtctl is downloadable straight from the cluster, which keeps versions aligned:

    oc get consoleclidownload virtctl -o jsonpath='{.spec.links

    .href}{"\n"}'

    Exposing the VM's service to the rest of the cluster


    With masquerade binding on the pod network, the virt-launcher pod has a normal cluster IP and the VM sits behind NAT inside it. That means plain Kubernetes Services work. KubeVirt labels the launcher pod with vm.kubevirt.io/name, so:

    apiVersion: v1
    kind: Service
    metadata:
    name: legacy-app
    namespace: legacy-apps
    spec:
    selector:
    vm.kubevirt.io/name: legacy-app-01
    ports:
    - name: http
    port: 8080
    targetPort: 8080

    apiVersion: route.openshift.io/v1
    kind: Route
    metadata:
    name: legacy-app
    namespace: legacy-apps
    spec:
    to:
    kind: Service
    name: legacy-app
    port:
    targetPort: http
    tls:
    termination: edge
    insecureEdgeTerminationPolicy: Redirect

    For quick checks, virtctl expose vm legacy-app-01 --name=legacy-app --port=8080 --target-port=8080 generates the equivalent Service — fine for a lab, but keep the declarative manifest in Git for anything real.

    Note that the guest keeps the same IP across a live migration on the pod network only because the masquerade NAT lives in the launcher pod and the pod IP is re-advertised; connections that are not reestablished will see a sub-second blip. For TCP sessions that must survive, use the secondary network with a stable L2 address.

    Multus: giving legacy VMs the network they expect


    Legacy VMs routinely need to be on a specific VLAN, with a specific IP, reachable by appliances that don't speak Kubernetes. That's Multus territory. Build the host bridge with NMState first:

    apiVersion: nmstate.io/v1
    kind: NodeNetworkConfigurationPolicy
    metadata:
    name: br-vlan120
    spec:
    nodeSelector:
    node-role.kubernetes.io/virt: ""
    desiredState:
    interfaces:
    - name: bond0.120
    type: vlan
    state: up
    vlan:
    base-iface: bond0
    id: 120
    - name: br-vlan120
    type: linux-bridge
    state: up
    ipv4:
    enabled: false
    ipv6:
    enabled: false
    bridge:
    options:
    stp:
    enabled: false
    port:
    - name: bond0.120

    oc get nncp br-vlan120
    oc get nnce | grep br-vlan120

    Then the attachment, in the VM's namespace:

    apiVersion: k8s.cni.cncf.io/v1
    kind: NetworkAttachmentDefinition
    metadata:
    name: vlan120-bridge
    namespace: legacy-apps
    annotations:
    k8s.v1.cni.cncf.io/resourceName: bridge.network.kubevirt.io/br-vlan120
    spec:
    config: |
    {
    "cniVersion": "0.3.1",
    "name": "vlan120-bridge",
    "type": "bridge",
    "bridge": "br-vlan120",
    "macspoofchk": true,
    "ipam": {},
    "preserveDefaultVlan": false
    }

    "ipam": {} is intentional: the guest gets its address from the VLAN's existing DHCP server or a static config, exactly like it did on vSphere. macspoofchk: true prevents a compromised guest from impersonating another MAC on a shared L2 — turn it off only for VMs that legitimately need nested MACs.

    If you're on OVN-Kubernetes and want to stay away from host bridges, the localnet topology of ovn-k8s-cni-overlay is the modern equivalent and is the direction Red Hat is pushing; the VM-side spec (multus.networkName) is identical.

    Pin MAC addresses for license-bound guests with spec.template.spec.domain.devices.interfaces[].macAddress, and make sure that MAC is unique — nothing in the cluster will check it for you across namespaces.

    Live migration and planned node maintenance


    Trigger and observe a migration explicitly before you trust a drain:

    virtctl migrate legacy-app-01 -n legacy-apps
    oc get vmim -n legacy-apps
    oc get vmi legacy-app-01 -n legacy-apps \
    -o jsonpath='{.status.migrationState}' | jq

    For VMs that dirty memory faster than the link can transfer it (databases, JVMs with large heaps), plain pre-copy migration never converges. Use a MigrationPolicy scoped by namespace or VMI labels rather than tuning each VM:

    apiVersion: migrations.kubevirt.io/v1alpha1
    kind: MigrationPolicy
    metadata:
    name: legacy-heavy-writers
    spec:
    selectors:
    namespaceSelector:
    migration-tier: heavy
    allowAutoConverge: true
    allowPostCopy: false
    completionTimeoutPerGiB: 300
    bandwidthPerMigration: 2Gi

    allowAutoConverge throttles the guest vCPUs to force convergence — a controlled slowdown instead of an aborted migration. Post-copy converges almost always but makes the VM dependent on the source node mid-flight; if that node dies, the VM dies. We keep it off outside of carefully chosen cases.

    Draining a node that hosts VMs


    KubeVirt automatically creates a PodDisruptionBudget for every VMI with evictionStrategy: LiveMigrate, which blocks the eviction API and lets virt-controller convert the disruption into a migration.

    oc adm cordon worker-07
    oc adm drain worker-07 \
    --delete-emptydir-data --ignore-daemonsets --force --timeout=1800s

    Watch the migrations in parallel, and keep in mind parallelOutboundMigrationsPerNode — with 20 VMs at 2 concurrent migrations, a drain is a 20-minute operation, not a 30-second one. Size your MachineConfigPool maxUnavailable: 1 accordingly and budget cluster upgrades in hours per pool.

    Audit before every maintenance window — any VM without LiveMigrate will be shut down by the drain:

    oc get vmi -A -o custom-columns=\
    'NS:.metadata.namespace,NAME:.metadata.name,NODE:.status.nodeName,EVICT:.spec.evictionStrategy'

    Set a cluster-wide default so nobody forgets: spec.evictionStrategy: LiveMigrate in the HyperConverged CR. For VMs that genuinely cannot migrate (HPP disks, GPU passthrough), use evictionStrategy: External and handle them with an explicit, scheduled shutdown — at least the drain won't surprise you.

    The NodeMaintenance CRD from the Node Maintenance Operator gives you the same thing as a declarative, auditable object:

    apiVersion: nodemaintenance.medik8s.io/v1beta1
    kind: NodeMaintenance
    metadata:
    name: worker-07-firmware
    spec:
    nodeName: worker-07
    reason: "BIOS 2.14.1 rollout - change CHG-4821"

    Security best practices


    • Keep virt-launcher unprivileged. Modern OpenShift Virtualization runs QEMU as non-root under the restricted-v2-like SCC with a dedicated SELinux type. Never grant privileged SCC to the VM service accounts to "fix" a device issue — fix the device plugin instead.
    • Scope RBAC on subresources. virtualmachineinstances/console and /vnc are full keyboard access to the guest. Bind kubevirt.io:view broadly, but grant console access through a dedicated role and a named group.
    • Treat secondary networks as outside the cluster. NetworkPolicy only applies to the pod network. Traffic on a Multus bridge bypasses it entirely. Either enforce at the physical fabric/VLAN level, or enable MultiNetworkPolicy support in the cluster network operator and write explicit policies per attachment.
    • Always enable macspoofchk, and prefer explicit, inventoried MAC addresses over generated ones on shared L2 segments.
    • No credentials in the VM spec. cloud-init user data goes in a Secret referenced by secretRef; SSH keys go through spec.template.spec.accessCredentials with a qemuGuestAgent propagation method so you can rotate them without rebooting.
    • UEFI Secure Boot + vTPM for Windows guests (efi.secureBoot: true with smm.enabled: true); it's a prerequisite for BitLocker and Credential Guard, and a hard requirement for Windows 11/Server 2025.
    • Encrypt at rest at the storage layer (Ceph/LUKS or the array), and additionally inside the guest for regulated data. Disk images are plain blocks in a PVC — anyone with exec on the right namespace can read them.
    • Quota the VM namespaces. A ResourceQuota on requests.memory and a LimitRange prevent a single team from allocating a node's worth of RAM, which is the most common way VM workloads starve collocated pods.
    • Isolate migration traffic. Live migration carries unencrypted guest memory. Put it on a dedicated, non-routed network via liveMigrationConfig.network.


    Key takeaways


    Running VMs next to pods is a solved problem, provided you accept that the VM dictates the constraints, not the other way around.

    • Storage decides everything. RWX + block, validated through StorageProfile, is the entry ticket to live migration. HostPathProvisioner is a deliberate, documented exception — never a default.
    • evictionStrategy: LiveMigrate is not optional. Set it cluster-wide in the HyperConverged CR and audit for exceptions before every maintenance window.
    • Multus plus NMState reproduces the legacy L2 the VMs expect, at the cost of losing NetworkPolicy — compensate with macspoofchk, fabric-level filtering, or MultiNetworkPolicy.
    • Standard Kubernetes primitives still apply to VM services: a Service selecting vm.kubevirt.io/name plus a Route is all you need to expose a legacy app, which is exactly the point of converging the platforms.
    • Drains become slow operations. Re-plan your upgrade windows around parallelOutboundMigrationsPerNode and the size of your guests, and use MigrationPolicy with auto-converge for the heavy writers.

    Get those five right and OpenShift Virtualization stops being a risk and becomes what it should be: one control plane, one RBAC model, one GitOps pipeline, for both halves of your estate.#openshift #kubevirt #kubernetes #virtualization #software #coding #development #engineering #inclusive #community
    OpenShift Virtualization: Running VMs and Pods on the Same Cluster Without Breaking Anything

    #kubevirt #openshift #virtualization #inclusive #engineering #kubernetes
Share on Mastodon

Enter the server where you have an account.