Understanding OpenShift Virtualization: Tutorial and Best Practices

What Is OpenShift Virtualization?

OpenShift Virtualization, an included feature of the Red Hat OpenShift platform, allows enterprises to run and manage virtual machines alongside container workloads. Its functionality integrates traditional virtual machines into a Kubernetes-native environment. This enables organizations to leverage existing virtualized infrastructures while adopting modern container-based applications.

By integrating VM management into OpenShift, companies can optimize resource usage more effectively across both containers and virtual machines—achieving a hybrid model that reduces overhead costs and complexity. OpenShift Virtualization allows organizations to maintain existing VM-based workloads while incrementally embracing container technology.

This is part of a series of articles about Kubernetes networking.

In this article:

• Benefits of OpenShift Virtualization
• OpenShift Virtualization Architecture
• Tutorial: Installing OpenShift Virtualization
• Best Practices for OpenShift Virtualization
• Networking and Security with Red Hat OpenShift Virtualization and Calico

Benefits of OpenShift Virtualization

OpenShift Virtualization bridges the gap between traditional virtual machines and modern containerized applications, offering a unified platform for managing both:

• Unified management of containers and virtual machines: OpenShift Virtualization allows enterprises to manage both containerized and virtualized workloads using the same Kubernetes-based interface.
• Transition to cloud-native environments: Organizations can run legacy VM-based applications alongside modern containerized workloads. This facilitates a gradual migration to container technologies without requiring immediate refactoring of existing applications.
• Optimized resource utilization: By enabling the co-location of VMs and containers, OpenShift Virtualization ensures better utilization of hardware resources. It helps reduce overhead by consolidating workloads onto fewer machines.
• Developer productivity: Developers can interact with VMs using the same tools and workflows they use for containers in OpenShift. This consistency minimizes learning curves and accelerates development cycles.
• CI/CD pipelines: OpenShift Virtualization integrates VMs into Kubernetes-native CI/CD workflows. This allows teams to automate testing and deployment for both virtualized and containerized applications using a single pipeline.

OpenShift Virtualization Architecture

OpenShift Virtualization is built on a modular architecture facilitated by the Operator Lifecycle Manager (OLM), which deploys and manages the operators essential for its functionality. Each operator is responsible for a specific component of the platform, including compute, storage, networking, and scaling.

Core Operators and Components

HyperConverged operator (HCO)
The HCO acts as the central management entry point, coordinating the deployment and lifecycle of other operators. It relies on the HyperConverged custom resource (CR) as a single source of truth, ensuring all configurations are consistent across components. The HCO creates additional CRs for operators, such as KubeVirt, CDI, and SSP, which in turn deploy resources like daemon sets, configuration maps, and API services.

Compute layer (KubeVirt)
The virt-operator is responsible for managing the deployment and maintenance of the virtualization stack, including key components like:

• virt-api: An API server for handling virtualization requests.
• virt-controller: Oversees the creation and lifecycle of virtual machine instances, including scheduling and resource allocation.
• virt-handler: Runs on each node to monitor and manage VM state changes.
• virt-launcher: The actual runtime environment for VMs, built on libvirt and QEMU.

Learn more in our detailed guide to OpenShift KubeVirt

Storage layer (CDI operator)
The Containerized Data Importer (CDI) handles importing virtual machine images into persistent storage. Key components include:

• cdi-apiserver: Manages secure upload tokens for disk uploads.
• cdi-uploadproxy: Directs upload traffic to storage volumes.
• cdi-importer: Imports VM images into Persistent Volume Claims (PVCs).

Networking layer (Cluster Network Addons Operator)
This operator provides networking capabilities for virtualized workloads. Key components include:

• kubemacpool-cert-manager: Manages TLS certificates for MAC address pooling.
• kubemacpool-mac-controller-manager: Provides MAC address pooling for VM network interfaces.
• bridge-marker and kube-cni-linux-bridge-plugin: Enable VM connectivity to Linux bridge networks on nodes.

Scaling and performance (SSP operator)
The Scheduling, Scale, and Performance (SSP) operator deploys common VM templates, boot sources, and validation pipelines to simplify VM provisioning and management.

Storage Provisioning (HPP operator)
The Hostpath Provisioner (HPP) operator provides local storage provisioning by:

• Running HPP workers on designated nodes to manage node-specific storage.
• Deploying CSI and legacy driver interfaces for compatibility.

Operator Lifecycle and Deployment
The deployment process starts with the OLM, which initializes operator pods for each functional area. After these operators are deployed, users create the HyperConverged CR, which drives the configuration and reconciliation process. This leads to the creation of dependent CRs and resources, such as the KubeVirt CR for virtualization. Each component operator continuously reconciles its resources to maintain the desired state.

This modular and extensible architecture allows OpenShift Virtualization to integrate with Kubernetes-native tools, ensuring flexibility and scalability while simplifying VM and container workload management.

Related content: Read our guide to Kubernetes network security

Tips from the Expert

In my experience, here are tips that can help you better utilize OpenShift Virtualization:

1. Adopt multi-networking with SR-IOV for high-performance workloads:

   Enable SR-IOV (Single Root I/O Virtualization) to provide direct access to network interfaces for high-performance workloads. This is particularly useful for applications requiring low latency and high throughput.

2. Use persistent volume snapshots for VM backups:

   Instead of traditional backups, utilize Kubernetes-native persistent volume snapshots for VM data. Snapshots are faster, more storage-efficient, and integrate seamlessly into OpenShift Virtualization workflows.

3. Enable dynamic resource scheduling with KubeVirt:

   Configure KubeVirt’s resource request and limit settings to dynamically schedule workloads. This prevents overcommitment and ensures that performance-sensitive VMs have the necessary resources during peak usage.

4. Isolate sensitive workloads with multi-tenancy policies:

   Implement OpenShift multi-tenancy features to isolate sensitive workloads. Use Kubernetes namespaces and network policies to separate VM and container traffic, minimizing cross-workload interference and security risks.

5. Apply dynamic monitoring with Prometheus and Grafana:

   Deploy Prometheus and Grafana to set up dynamic dashboards for real-time visualization of VM and container performance metrics. Automate alerts for resource spikes, network congestion, or anomalous behavior.

Peter Kelly

VP of Engineering

Peter Kelly is Chief Technology Officer at Tigera and Site Leader for Tigera's EMEA office in Cork, Ireland. He is responsible for all of Tigera’s Engineering teams and operations. Peter has two decades of experience in software development, including recently building control plane technology for open-source proxies at NGINX and later F5 Networks, where he held engineering leadership positions. Peter has a degree in Computer Science and a Masters in Advanced Software Engineering.

Tutorial: Installing OpenShift Virtualization

To add virtualization capabilities to your OpenShift cluster, follow these steps to install OpenShift Virtualization using either the OpenShift Container Platform web console or the command line. These instructions are adapted from the OpenShift documentation.

Prerequisites

Before installation, ensure the following:

1. OpenShift Container Platform version 4.17 is installed on your cluster.
2. You have cluster-admin privileges to perform the installation.

Installing the Virtualization Operator Using Web Console

1. Access the OperatorHub: Log in to the OpenShift web console as a user with cluster-admin permissions. From the Administrator perspective, navigate to Operators → OperatorHub.
2. Find the OpenShift Virtualization Operator: Use the Filter by keyword field to search for “Virtualization.” Select the OpenShift Virtualization Operator tile with the Red Hat source label.
3. Initiate Installation: Review the Operator’s details and click Install. On the Install Operator page, configure the following:
   1. Update Channel: Select stable to ensure compatibility with your OpenShift version.
   2. Installed Namespace: Choose the Operator recommended namespace option (openshift-cnv). This namespace is created automatically if it doesn’t already exist. Do not change the namespace, as doing so will cause the installation to fail.
   3. Approval Strategy: Select Automatic to enable seamless updates. Avoid selecting Manual unless you fully understand the associated risks and limitations.
4. Complete the Installation: Click Install to proceed. Once the installation is complete, click Create HyperConverged. Optionally, configure Infra and Workloads node placement options for OpenShift Virtualization components before clicking Create.
5. Verify the Deployment: Navigate to Workloads → Pods and monitor the status of OpenShift Virtualization pods. All pods should transition to a Running state, indicating a successful deployment.

Installing the Virtualization Operator Using Command Line

To install the virtualization operator via the command line, first create a YAML manifest containing the following resources:

apiVersion: v1
kind: Namespace
metadata:
  name: openshift-cnv
---
apiVersion: operators.coreos.com/v1
kind: OperatorGroup
metadata:
  name: kubevirt-hyperconverged-group
  namespace: openshift-cnv
spec:
  targetNamespaces:
    - openshift-cnv
---
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
  name: hco-operatorhub
  namespace: openshift-cnv
spec:
  source: redhat-operators
  sourceNamespace: openshift-marketplace
  name: kubevirt-hyperconverged
  startingCSV: kubevirt-hyperconverged-operator.v4.17.0
  channel: "stable"

Save this manifest as a YAML file (e.g., openshift_virtualization.yaml). Next, run the following command to create the required resources:

    $ oc apply -f openshift_virtualization.yaml

Now create another YAML file to deploy the OpenShift Virtualization Operator:

apiVersion: hco.kubevirt.io/v1beta1
kind: HyperConverged
metadata:
  name: kubevirt-hyperconverged
  namespace: openshift-cnv
Spec:

Apply the manifest using:

    $ oc apply -f <file_name>.yaml

Finally, monitor the status of the cluster service version (CSV) in the openshift-cnv namespace:

    $ watch oc get csv -n openshift-cnv

When successful, the output will show the PHASE as Succeeded.

Best Practices for OpenShift Virtualization

Organizations should implement the following best practices when using OpenShift Virtualization.

Leverage OpenShift Features for High Availability

High availability (HA) is critical for minimizing downtime in production environments. OpenShift Virtualization supports HA by leveraging Kubernetes’ built-in features like pod anti-affinity rules and ReplicaSets. Configure virtual machines with multiple replicas and ensure workload distribution across different nodes to avoid a single point of failure.

Additionally, use persistent volume (PV) storage with replication to maintain data consistency and availability during node failures. OpenShift’s dynamic storage provisioning allows administrators to set up replicated volumes with minimal manual intervention, ensuring that VMs can failover smoothly.

Leverage Multus CNI to Configure Multiple Network Interfaces for VMs

Multus CNI enables virtual machines to connect to multiple networks, which is essential for applications requiring network segmentation or access to both private and public networks. To configure Multus, define custom network attachment definitions (NADs) in the cluster and attach them to VMs during provisioning.

This setup allows VMs to access high-speed storage networks or isolated security zones without compromising connectivity. Administrators can enforce traffic isolation using network policies, ensuring robust security while meeting complex networking requirements.

Create and Manage VM Templates for Consistent Deployment configurations

VM templates simplify and standardize the provisioning process by providing predefined configurations for virtual machines. Create templates that include CPU, memory, storage, and network settings tailored to workloads.

To manage updates efficiently, use OpenShift’s versioning system for templates. Versioned templates ensure backward compatibility, allowing teams to update configurations without affecting existing deployments. This approach reduces human error and accelerates the setup of production-ready environments.

Utilize OpenShift GitOps for Declarative VM Definitions and Automated Deployments

GitOps workflows integrate seamlessly with OpenShift to manage VM configurations declaratively. Store VM definitions as YAML manifests in a Git repository and deploy them automatically using tools like ArgoCD.

This approach ensures that changes are tracked and auditable. Administrators can roll back to previous configurations quickly in case of errors, improving operational reliability. GitOps also aligns infrastructure management with development practices, streamlining collaboration between teams.

Configure OpenShift Logging to Collect and Aggregate Logs from VMs

OpenShift’s integrated logging stack, built on tools like Elasticsearch, Fluentd, and Kibana (EFK), simplifies log management for virtualized workloads. Configure Fluentd to collect logs from both containerized and virtualized workloads, ensuring consistent monitoring.

Aggregate logs in a central Elasticsearch instance and set up Kibana dashboards to visualize trends and identify issues proactively. Use OpenShift’s log forwarding capability to route critical logs to external systems for compliance or long-term retention, improving observability across the hybrid environment.

Networking and Security with Red Hat OpenShift Virtualization and Calico

Calico ​​provides a streamlined approach to managing containers, virtual machines, and hosts using Red Hat OpenShift Virtualization:

• Unified Management: A consistent networking and network security model for VMs and containers across hybrid cloud infrastructures for simplified operations.
• Enhanced Networking & Security: Key capabilities to support complex networking needs, including isolated routed tenant networks, microsegmentation, and dynamic routing.
• Granular Control: Precise network policies enhance control over allowed and denied traffic for tenant isolation and compliance.
• Observability: Real-time view of traffic flows within and outside Kubernetes clusters to understand workload dependencies, view policy enforcement, and for faster troubleshooting.
• Cluster mesh: Deploy security policy to protect traffic between pods in multi-cluster Red Hat OpenShift Virtualization environments. Easily update and enforce network security policies to a single application distributed across multiple clusters to meet regulatory and organizational requirements.

Next steps:

• Solution brief: OpenShift virtualization