feat: add KubeVirt and CDI for VM-based workloads

k8s/bases/infrastructure/controllers/cdi/cdi-cr.yaml

@@ -0,0 +1,8 @@
+# https://github.com/kubevirt/containerized-data-importer
+---
+apiVersion: cdi.kubevirt.io/v1beta1
+kind: CDI
+metadata:
+  name: cdi
+  namespace: cdi
+spec: {}

k8s/bases/infrastructure/controllers/cdi/kustomization.yaml

@@ -0,0 +1,17 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - cdi-operator.yaml
+  - cdi-cr.yaml
+patches:
+  # Add pod-security labels to match platform convention.
+  - target:
+      kind: Namespace
+      name: cdi
+    patch: |
+      - op: add
+        path: /metadata/labels/pod-security.kubernetes.io~1enforce
+        value: privileged
+      - op: add
+        path: /metadata/labels/pod-security.kubernetes.io~1enforce-version
+        value: latest

k8s/bases/infrastructure/controllers/kubevirt/kubevirt-cr.yaml

@@ -0,0 +1,12 @@
+# https://kubevirt.io/user-guide/cluster_admin/installation/
+---
+apiVersion: kubevirt.io/v1
+kind: KubeVirt
+metadata:
+  name: kubevirt
+  namespace: kubevirt
+spec:
+  certificateRotateStrategy: {}
+  configuration: {}
+  customizeComponents: {}
+  imagePullPolicy: IfNotPresent

k8s/bases/infrastructure/controllers/kubevirt/kustomization.yaml

@@ -0,0 +1,14 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - kubevirt-operator.yaml
+  - kubevirt-cr.yaml
+patches:
+  # Add enforce-version label to match platform pod-security convention.
+  - target:
+      kind: Namespace
+      name: kubevirt
+    patch: |
+      - op: add
+        path: /metadata/labels/pod-security.kubernetes.io~1enforce-version
+        value: latest

k8s/bases/infrastructure/controllers/kustomization.yaml

@@ -3,6 +3,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - auth-proxy/
+  - cdi/
   - cert-manager/
   - cilium/
   - cloudnative-pg/
@@ -11,6 +12,7 @@ resources:
   - keda/
   - keda-http-add-on/
   - kube-prometheus-stack/
+  - kubevirt/
   - kubescape/
   - kyverno/
   - metrics-server/

k8s/providers/docker/infrastructure/controllers/kubevirt/patches/kubevirt-cr-patch.yaml

@@ -0,0 +1,11 @@
+# Enable QEMU software emulation for Docker provider (no hardware KVM).
+---
+apiVersion: kubevirt.io/v1
+kind: KubeVirt
+metadata:
+  name: kubevirt
+  namespace: kubevirt
+spec:
+  configuration:
+    developerConfiguration:
+      useEmulation: true

k8s/providers/docker/infrastructure/controllers/kustomization.yaml

@@ -26,3 +26,8 @@ patches:
       name: kubescape
       namespace: kubescape
     path: kubescape/patches/helm-release-patch.yaml
+  - target:
+      kind: KubeVirt
+      name: kubevirt
+      namespace: kubevirt
+    path: kubevirt/patches/kubevirt-cr-patch.yaml

talos/workers/kubevirt.yaml

@@ -0,0 +1,7 @@
+# KubeVirt requires KVM kernel modules for hardware-accelerated
+# virtualization on Hetzner workers.
+machine:
+  kernel:
+    modules:
+      - name: kvm
+      - name: kvm_intel