fix(kubevirt): route the export proxy to the Service KubeVirt creates by lexfrei · Pull Request #4637 · cozystack/cozystack

Aleksei Sviridkin (lexfrei) · 2026-10-01T00:12:35Z

What this PR does

The VM export routes point at a Service that does not exist, and the tenant network policy would block the Ingress even if it did.

KubeVirt creates the export proxy Service under the name virt-exportproxy (VirtExportProxyName in pkg/virt-operator/resource/generate/components, v1.9.0). The Ingress and the TLSRoute that publish vm-exportproxy.<host> name a vm-exportproxy Service, and nothing creates one. The backend was virt-exportproxy when the Ingress was added in 0ddaff9. Then 3780925 renamed the hostname to vm-exportproxy and the backend along with it. The hostname stays, only the backend goes back.

Renaming the backend is not enough for the Ingress, because it is served by the ingress controller in tenant-root and tenant egress is default-deny. Each allowed destination has its own allow-to-* policy. The CDI upload proxy has allow-to-cdi-upload-proxy, the export proxy had nothing. The new allow-to-vm-exportproxy policy renders for the same tenants and the same source pods as the CDI one. Its destination is narrower: only the kubevirt.io=virt-exportproxy pods in cozy-kubevirt, on TCP 8443, the container port virt-operator gives them.

The unit tests pin the backend name for the Ingress and the TLSRoute, and the placement, selector and port of the new policy.

I checked this on a test cluster with KubeVirt v1.9.0 and ingress-nginx. Without the fix the controller logs Error obtaining Endpoints for Service "cozy-kubevirt/vm-exportproxy". With the backend renamed and the tenant allowed egress to virt-exportproxy, a passthrough request to vm-exportproxy.<host> reaches the export proxy, and it answers with its own serving certificate.

Downstream repositories

Release note

fix(kubevirt): requests to vm-exportproxy.<host> now reach the KubeVirt export proxy: the Ingress and TLSRoute route to the virt-exportproxy Service KubeVirt creates, and tenants are allowed egress to the export proxy.

Summary by CodeRabbit

New Features
- Tenant workloads can now connect to the KubeVirt export proxy over TCP port 8443.
Bug Fixes
- Updated export-proxy Ingress and TLSRoute routing to use the virt-exportproxy backend, keeping export-proxy traffic directed to the correct service.

virt-operator names the export proxy Service virt-exportproxy. The Ingress and the TLSRoute publishing vm-exportproxy.<host> named a vm-exportproxy Service instead, which nothing creates, so both routes had no backend. The public hostname stays vm-exportproxy. Assisted-by: LLM Signed-off-by: Aleksei Sviridkin <[email protected]>

coderabbitai · 2026-10-01T00:12:42Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: cozystack/cozystack/.coderabbit.yaml
Review profile: CHILL
Plan: Advanced
Run ID: aa3d38aa-584d-4fa3-8d58-73fbc5b79d2d

📥 Commits

Reviewing files that changed from the base of the PR and between c069a19 and a141665.

📒 Files selected for processing (5)

packages/apps/tenant/templates/networkpolicy.yaml
packages/apps/tenant/tests/networkpolicy_vm_exportproxy_test.yaml
packages/system/kubevirt/templates/vm-exportproxy-ingress.yaml
packages/system/kubevirt/templates/vm-exportproxy-tlsroute.yaml
packages/system/kubevirt/tests/vm_exportproxy_backend_test.yaml

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

📝 Walkthrough

Walkthrough

The tenant network policy allows egress to KubeVirt export-proxy pods on TCP port 8443. The export-proxy Ingress and TLSRoute now target the virt-exportproxy Service.

Changes

VM export-proxy connectivity

Layer / File(s)	Summary
Tenant egress policy `packages/apps/tenant/templates/networkpolicy.yaml`, `packages/apps/tenant/tests/networkpolicy_vm_exportproxy_test.yaml`	Adds a `CiliumNetworkPolicy` that allows tenant endpoints to reach `virt-exportproxy` pods in `cozy-kubevirt` on TCP port 8443. Tests cover root and nested tenants, the endpoint selector, and the egress rule.
Export-proxy route backends `packages/system/kubevirt/templates/vm-exportproxy-ingress.yaml`, `packages/system/kubevirt/templates/vm-exportproxy-tlsroute.yaml`, `packages/system/kubevirt/tests/vm_exportproxy_backend_test.yaml`	Updates the Ingress and TLSRoute backends to use `virt-exportproxy`. Tests assert the backend Service name for both resources.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: kvaps

Merge Risk: ⚪ Minimal · up to a1416

The export-proxy routing and tenant egress changes have no identified issue requiring resolution before merge. Normal checks remain appropriate.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: routing the KubeVirt export proxy to the Service that KubeVirt creates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

The vm-exportproxy Ingress is served by the ingress controller in tenant-root, and tenant egress is default-deny. Nothing allowed traffic to virt-exportproxy in cozy-kubevirt, so the Ingress stayed unreachable even with the right backend Service. The new policy renders wherever allow-to-cdi-upload-proxy does, but narrows the destination to the export proxy pods and their container port. Assisted-by: LLM Signed-off-by: Aleksei Sviridkin <[email protected]>

IvanHunters

LGTM. Verified against pinned KubeVirt v1.9.0: virt-exportproxy, port 443/targetPort 8443 and the kubevirt.io: virt-exportproxy selector all match what KubeVirt creates, and the VMExport gate is on. helm unittest green (85/85).

Non-blocking: the new allow-to-vm-exportproxy policy uses endpointSelector: {}, so every pod in the tenant gets egress to the proxy rather than just the ingress controller; it is port- and pod-scoped and the proxy is token-authenticated, so consistent with the sibling policies.

github-actions Bot added area/virtualization Issues or PRs related to virtualization (kubevirt, cdi, vmi, vm-import) kind/bug Categorizes issue or PR as related to a bug size/M This PR changes 30-99 lines, ignoring generated files labels Oct 1, 2026

Aleksei Sviridkin (lexfrei) mentioned this pull request Oct 1, 2026

feat(gateway)!: reserve a passthrough listener's name by the spec alone #4638

Merged

1 of 12 tasks

github-actions Bot added size/L This PR changes 100-499 lines, ignoring generated files and removed size/M This PR changes 30-99 lines, ignoring generated files labels Oct 7, 2026

Aleksei Sviridkin (lexfrei) force-pushed the fix/kubevirt-exportproxy-backend branch from 5c80233 to a141665 Compare October 7, 2026 03:23

Aleksei Sviridkin (lexfrei) marked this pull request as ready for review October 7, 2026 03:32

Aleksei Sviridkin (lexfrei) requested review from IvanHunters, Andrei Kvapil (kvaps), Timofei Larkin (lllamnyp), Matthieu ROBIN (matthieu-robin), mattia-eleuteri, myasnikovdaniil and scooby87 as code owners October 7, 2026 03:32

IvanHunters approved these changes Oct 7, 2026

View reviewed changes

Aleksei Sviridkin (lexfrei) enabled auto-merge October 7, 2026 08:19

Aleksei Sviridkin (lexfrei) merged commit 6addef4 into main Oct 7, 2026
20 checks passed

Aleksei Sviridkin (lexfrei) deleted the fix/kubevirt-exportproxy-backend branch October 7, 2026 08:19

Navigation Menu

Repository navigation

fix(kubevirt): route the export proxy to the Service KubeVirt creates - #4637

fix(kubevirt): route the export proxy to the Service KubeVirt creates#4637
Aleksei Sviridkin (lexfrei) merged 2 commits into
mainfrom
fix/kubevirt-exportproxy-backend

Aleksei Sviridkin (lexfrei) commented Oct 1, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Oct 1, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

IvanHunters left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Aleksei Sviridkin (lexfrei) commented Oct 1, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does

Downstream repositories

Release note

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

IvanHunters left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Aleksei Sviridkin (lexfrei) commented Oct 1, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Oct 1, 2026 •

edited

Loading