VEP 285: Preset launch security defaults via preference by jschintag · Pull Request #286 · kubevirt/enhancements

jschintag · 2026-04-21T11:01:30Z

This VEP proposes to enable easier management of confidential computing VMs by using common preferences.

VEP Metadata

Tracking issue: #285
SIG label: /sig api

What this PR does

Propose adding launchSecurity field to VirtualMachinePreference for configuring VMs.

Special notes for your reviewer

kubevirt-bot · 2026-04-21T11:01:35Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign vladikr for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

xpivarc · 2026-04-21T12:05:36Z

/cc @lyarwood @0xFelix

0xFelix

At least we've got a conflict with #17.

0xFelix · 2026-04-21T12:21:38Z

+- [ ] Unit tests are implemented and passing
+
+### Beta
+- [ ] Common preference types are added to common-templates for IBM Secure Execution


You mean common-instancetypes.

0xFelix · 2026-04-21T12:22:26Z

+
+The following table summarizes the outcomes:
+
+| VMI     | Preference | Outcome    |


How does it go together with instancetypes?

As far as i understand instancetypes override settings in the VMI, so it would override it here as well.
Let me add that here as well.

0xFelix · 2026-04-21T12:24:27Z

+
+## Overview
+
+Add the `launchSecurity` parameter to `VirtualMachineClusterPreference` and


IIRC the intention for providing launcheSecurity with instance types is that nodes need to have the necessary hardware i.e. the resources to support the chosen setting. It's not simply a runtime preference of the guest.

The hardware support for nodes is determined via nodeselectors (at least for AMD SEV and IBM Secure Execution, no idea about Interl/Arm).
The idea here is not related to the Hardware in the cluster, but rather to specific VM images.
For example IBM Secure Execution requires specific changes to the VM image, which would mean that image can only run in SE mode. If that is then used as a golden image in the cluster, linking it to a preference which means launchSecurity would be enabled automatically. No need for users to choose an instancetype with launchSecurity or enable it manually.

The more I think about this the more I think we need to deprecate LaunchSecurity out of the instance type spec entirely and just provide it through preferences.

@0xFelix this will bork the v1 VEP for a cycle, would you be against this?

It's hard to draw a line on deciding what belongs into an instancetype or a preference. But I agree that we should move launchSecurity to preferences.

okay, @jschintag can you deprecate the instance type field as part of this work in v1beta1?

Sure @lyarwood. I have added the removal to the beta target and added a deprecation notice to the alpha target.

jschintag · 2026-04-21T14:15:03Z

Thank you for the quick review @0xFelix.

I have updated the table to include instancetypes and fixed the mention of common-templates.

lyarwood · 2026-04-21T14:48:11Z

+	// Optionally defines the preferred LaunchSecurity
+	//
+	// +optional
+	LaunchSecurity *v1.LaunchSecurity `json:"launchSecurity,omitempty"`


I'm not a fan of it but everything is prefixed with preferred, I've wanted to drop it forever but the backwards compat required would be a nightmare.

@0xFelix if we do delay v1 maybe yet another thing to throw in the backlog?

@lyarwood Do you want this to keep using the preferred prefix? But I agree we could drop it in the future (even this cycle already?).

I'm pretty overloaded this cycle but I can write it up as a backlog VEP and we can try to address it either this cycle or next.

lyarwood · 2026-04-21T14:59:20Z

+
+## Overview
+
+Add the `launchSecurity` parameter to `VirtualMachineClusterPreference` and


The more I think about this the more I think we need to deprecate LaunchSecurity out of the instance type spec entirely and just provide it through preferences.

@0xFelix this will bork the v1 VEP for a cycle, would you be against this?

0xFelix · 2026-04-22T09:45:18Z

@0xFelix this will bork the v1 VEP for a cycle, would you be against this?

I am fine with that, let's refine the instanctype API first and not rush v1 in this cycle.

This VEP proposes to enable easier management of confidential computing VMs by using common preferences. Signed-off-by: Jan Schintag <jan.schintag@de.ibm.com>

kubevirt-bot added the dco-signoff: yes Indicates the PR's author has DCO signed all their commits. label Apr 21, 2026

kubevirt-bot requested a review from lyarwood April 21, 2026 11:01

kubevirt-bot added the sig/compute label Apr 21, 2026

kubevirt-bot requested review from vladikr and xpivarc April 21, 2026 11:01

kubevirt-bot added the size/L label Apr 21, 2026

jschintag mentioned this pull request Apr 21, 2026

VEP 285: Preset launch security defaults via preference #285

Open

6 tasks

kubevirt-bot requested a review from 0xFelix April 21, 2026 12:05

0xFelix reviewed Apr 21, 2026

View reviewed changes

jschintag force-pushed the se-preference branch from 1487f98 to 75b4206 Compare April 21, 2026 14:14

lyarwood reviewed Apr 21, 2026

View reviewed changes

jschintag force-pushed the se-preference branch from 75b4206 to 9b03d43 Compare April 21, 2026 15:11

0xFelix mentioned this pull request Apr 22, 2026

VEP 17: Instancetype API v1 graduation #272

Open

lyarwood mentioned this pull request Apr 22, 2026

VEP NNNN: Drop the preferred prefix from VirtualMachinePreference spec attributes #290

Draft

VEP 285: Preset launch security defaults via preference

d6d9f95

This VEP proposes to enable easier management of confidential computing VMs by using common preferences. Signed-off-by: Jan Schintag <jan.schintag@de.ibm.com>

jschintag force-pushed the se-preference branch from 9b03d43 to d6d9f95 Compare April 22, 2026 14:38


		The following table summarizes the outcomes:

		\| VMI \| Preference \| Outcome \|


		## Overview

		Add the `launchSecurity` parameter to `VirtualMachineClusterPreference` and

Conversation

jschintag commented Apr 21, 2026

VEP Metadata

What this PR does

Special notes for your reviewer

Uh oh!

kubevirt-bot commented Apr 21, 2026

Uh oh!

xpivarc commented Apr 21, 2026

Uh oh!

0xFelix left a comment

Choose a reason for hiding this comment

Uh oh!

0xFelix Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jschintag commented Apr 21, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

0xFelix commented Apr 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

0xFelix Apr 21, 2026 •

edited

Loading