KubeVirt DRA Device Flow

KubeVirt DRA Device Flow An architecture diagram generated by Archify. VMI author · VMI + claim template · Architecture component VMI author VMI + claim template kube-apiserver · VMI, ResourceClaim · Kubernetes control plane kube-apiserver VMI, ResourceClaim virt-api · DRA admitter · Kubernetes control plane virt-api DRA admitter virt-controller · pod template render · Kubernetes control plane virt-controller pod template render kube-scheduler · DRA plugin · Kubernetes control plane kube-scheduler DRA plugin ResourceSlices · published by driver · Kubernetes control plane ResourceSlices published by driver kubelet · DRA manager · Worker node kubelet DRA manager DRA driver · node plugin, VFIO bind · Worker node › privileged DRA driver node plugin, VFIO bind virt-launcher · hostdevice/dra · Worker node › virt-launcher pod, non-root virt-launcher hostdevice/dra device metadata · KEP-5304 JSON files · Worker node › virt-launcher pod, non-root device metadata KEP-5304 JSON files libvirt + QEMU · VFIO passthrough · Worker node libvirt + QEMU VFIO passthrough create admission: claim refs, gates watch VMI Pod with spec.resourceClaims allocate claim bind node NodePrepareResources gRPC mounts metadata dir pciBusID / mdevUUID hostdev XML Kubernetes control plane Worker node virt-launcher pod, non-root privileged Legend Frontend Backend Database Security External

Primary path

  • • VMI lists claims in spec.resourceClaims; gpus[], hostDevices[] or networks[] point at one via claimRequest
  • • virt-controller copies the claims onto the launcher Pod; the scheduler's DRA plugin allocates from ResourceSlices
  • • kubelet preps the device via the driver; virt-launcher reads the metadata file and builds a hostdev from pciBusID or mdevUUID

Who owns what

  • • KubeVirt owns admission, pod rendering and the launcher-side metadata consumer; nothing in virt-handler changes
  • • The DRA driver (NVIDIA, Intel, SR-IOV, ...) owns ResourceSlices, VFIO binding and CDI; it is external and privileged
  • • permittedHostDevices in the KubeVirt CR is bypassed for DRA devices: the DeviceClass and driver decide

Gates and limits

  • • Feature gates: GPUsWithDRA, HostDevicesWithDRA, NetworkDevicesWithDRA
  • • Exactly one device and one driver per claim request; count > 1 is rejected
  • • Metadata types are a local mirror of KEP-5304 v1alpha1 (metadata.resource.k8s.io) until upstream ships them