KubeVirt Runtime Architecture

KubeVirt Runtime Architecture An architecture diagram generated by Archify. virtctl / kubectl · user CLI · Architecture component virtctl / kubectl user CLI kube-apiserver · VM / VMI CRDs · Kubernetes control plane kube-apiserver VM / VMI CRDs virt-api · webhooks + subresources · Kubernetes control plane · Deployment virt-api webhooks + subresources Deployment virt-operator · installs KubeVirt CR · Kubernetes control plane · Deployment virt-operator installs KubeVirt CR Deployment virt-controller · VM, VMI, migration ctrls · Kubernetes control plane · Deployment virt-controller VM, VMI, migration ctrls Deployment kubelet · device plugins, CNI, CSI · Worker node kubelet device plugins, CNI, CSI virt-handler · node agent, privileged · Worker node › privileged host access · DaemonSet virt-handler node agent, privileged DaemonSet virt-launcher · one pod per VMI · Worker node › virt-launcher pod, non-root, per VM · Pod virt-launcher one pod per VMI Pod libvirt + QEMU · in launcher container · Worker node › virt-launcher pod, non-root, per VM libvirt + QEMU in launcher container Host kernel / KVM · AMD SEV-SNP firmware · Worker node › privileged host access Host kernel / KVM AMD SEV-SNP firmware REST admission webhooks deploys virt-api, controller, handler watch VM / VMI creates launcher Pod starts pod watch VMIs on node gRPC unix socket: sync domain domain XML KVM ioctls, SEV launch misc.capacity, /dev Kubernetes control plane Worker node virt-launcher pod, non-root, per VM privileged host access Legend Frontend Backend Security External

Primary path: VM creation

  • • virtctl creates a VM; virt-api validates and defaults it via admission webhooks
  • • virt-controller turns the VMI into a virt-launcher Pod; the scheduler picks a node
  • • virt-handler sees the VMI land on its node and tells virt-launcher to start the libvirt domain

Trust boundaries and external deps

  • • virt-handler runs privileged on every node and is the only KubeVirt component touching the host
  • • virt-launcher runs non-root and holds exactly one VM; QEMU is confined to that pod
  • • kubelet device plugins: KVM, vhost-net, GPUs, SEV-ES capacity; CDI/CSI disks and Multus/CNI not drawn

SEV / SEV-SNP touch points

  • • WorkloadEncryptionSEV gate enables the launchSecurity domain element in the converter
  • • SEV-SNP guest capacity comes from the host misc cgroup and is advertised as devices.kubevirt.io/sev-esids
  • • Attestation session data flows through virt-api subresources to the launcher