VM Restore Admission Validation#

Overview#

VMRestoreAdmitter is the validating webhook for VirtualMachineRestore objects. It lives in pkg/storage/admitters/vmrestore.go and runs on CREATE and UPDATE operations. On create, it validates the target VM, checks for in-progress restores to the same target, and validates any spec.patches supplied on the restore object.

Validation Checks#

The Admit method dispatches to several validators on CREATE:

On UPDATE, the spec is treated as immutable 1.

The validatePatches Bug#

What the code does (incorrectly)#

validatePatches parses each patch string using string splitting, not JSON parsing:

1. Strips leading/trailing {} from the patch string, then splits on , to get key-value pairs.
2. Splits each pair on : and asserts exactly two parts.
3. Checks whether the part after "path" starts with "/spec/", "/metadata/labels/", or "/metadata/annotations/".

This approach is documented in the code's own inline comment 2.

Why it fails for MAC address patches#

The clone controller's addMacAddressPatches generates RFC 6902 replace patches for each network interface:

{"op":"replace","path":"/spec/template/spec/domain/devices/interfaces/0/macAddress","value":"be:ad:00:00:be:04"}

When the admitter splits on ,, the "value":"be:ad:00:00:be:04" fragment becomes one token. When it then splits that token on :, it gets six parts instead of two, triggering the error 3:

patch format is not valid - one ":" expected in a single key-value json patch: "value": "be:ad:00:00:be:04"

The same failure affects any patch whose value contains a colon or comma — firmware serial strings, node selectors, tolerations, or any JSON object/array value 3.

Mismatch with the actual patch consumer#

The actual patch application in pkg/storage/snapshot/restore.go uses jsonpatch.DecodePatch from gopkg.in/evanphx/json-patch.v4, which is a spec-correct RFC 6902 parser. The webhook validator is therefore strictly more restrictive than the runtime — patches that reach the restore controller would succeed, but they are blocked at admission 3.

Secondary issue: missing "path" key is silently accepted#

Because the validator only emits a cause when it encounters a token whose key is "path", a patch that has no "path" key at all passes validation without error — a logic inversion 3.

Clone Controller Integration#

The clone controller creates VirtualMachineRestore objects via generateRestore in pkg/virt-controller/watch/clone/util.go, passing in patches generated by generatePatches. MAC address patches are serialized to JSON strings via json.Marshal in generateStringPatchOperations. These correctly-formed JSON strings then fail the admitter's naive string-split validation.

Fix Direction#

Replace the string-splitting logic in validatePatches with proper JSON unmarshaling: unmarshal each patch string into a struct with Op, Path, and Value fields, then validate the decoded Path field. This aligns the webhook with how patchVM actually consumes the patches. The issue is tracked at kubevirt/kubevirt#18617 3.

Key Files#