ROX-35000: pass install-virt through the openshift-4 flavor

chart/infra-server/static/flavors.yaml

@@ -333,6 +333,18 @@
         Defines a list of capabilities to explicitly enable. These capabilities are enabled in addition to the capabilities specified in the baseline capability set.
         Example: `["DeploymentConfig", "ImageRegistry"]`
 
+    - name: vm-os
+      description: Guest OS list for optional VMs (empty skips virt)
+      value: ""
+      kind: optional
+      help: |
+        Comma-separated guest OS list (`rhel8`, `rhel9`, or `rhel10`). Each
+        entry creates one VM. Empty skips OpenShift Virtualization.
+        Example: `rhel9,rhel9,rhel10`.
+        Non-empty lists require a nested-KVM `worker-node-type` (for example
+        `n2-standard-8`; not `e2`). Worker count is unchanged.
+        Roughly two VMs fit on three worker nodes.
+
   artifacts:
     - name: kubeconfig
       description: Kube config for connecting to this cluster
@@ -363,6 +375,9 @@
     - name: cluster-console-password
       description: The password to login at the openshift console
 
+    - name: vm-access
+      description: SSH credentials for optional VMs (present when vm-os is non-empty)
+
 ######################
 #  openshift-4-demo  #
 ######################
@@ -683,6 +698,18 @@
         Defines a list of capabilities to explicitly enable. These capabilities are enabled in addition to the capabilities specified in the baseline capability set.
         Example: `["DeploymentConfig", "ImageRegistry"]`
 
+    - name: vm-os
+      description: Guest OS list for optional VMs (empty skips virt)
+      value: ""
+      kind: optional
+      help: |
+        Comma-separated guest OS list (`rhel8`, `rhel9`, or `rhel10`). Each
+        entry creates one VM. Empty skips OpenShift Virtualization.
+        Example: `rhel9,rhel9,rhel10`.
+        Non-empty lists require a nested-KVM `worker-node-type` (for example
+        `n2-standard-8`; not `e2`). Worker count is unchanged.
+        Roughly two VMs fit on three worker nodes.
+
   artifacts:
     - name: kubeconfig
       description: Kube config for connecting to this cluster
@@ -713,6 +740,9 @@
     - name: cluster-console-password
       description: The password to login at the openshift console
 
+    - name: vm-access
+      description: SSH credentials for optional VMs (present when vm-os is non-empty)
+
 #####################
 #  AWS EKS          #
 #####################

chart/infra-server/static/workflow-openshift-4.yaml

@@ -34,6 +34,8 @@ spec:
         value: "vCurrent"
       - name: additional-enabled-capabilities
         value: ""
+      - name: vm-os
+        value: ""
   volumeClaimTemplates:
     - metadata:
         name: data
@@ -46,6 +48,9 @@ spec:
     - name: credentials
       secret:
         secretName: openshift-4-gcp-service-account
+    - name: registry-pull-secret
+      secret:
+        secretName: infra-image-registry-pull-secret
 
   templates:
     - name: start
@@ -91,6 +96,11 @@ spec:
             path: /data
             archive:
               tar: {}
+          - name: vm-access
+            path: /data/vm-access.md
+            optional: true
+            archive:
+              none: {}
       container:
         image: quay.io/stackrox-io/ci:automation-flavors-openshift-4-{{ .Chart.Annotations.automationFlavorsVersion }}
         imagePullPolicy: Always
@@ -157,9 +167,14 @@ spec:
             value: '{{ "{{" }}workflow.parameters.baseline-capability-set{{ "}}" }}'
           - name: ADDITIONAL_ENABLED_CAPABILITIES
             value: '{{ "{{" }}workflow.parameters.additional-enabled-capabilities{{ "}}" }}'
+          - name: VM_OS
+            value: '{{ "{{" }}workflow.parameters.vm-os{{ "}}" }}'
         volumeMounts:
           - name: data
             mountPath: /data
+          - name: registry-pull-secret
+            mountPath: /infra-secrets/quay
+            readOnly: true
 
     - name: gather
       script:

chart/infra-server/templates/openshift-4/secrets.yaml

@@ -43,3 +43,18 @@ metadata:
 data:
   REDHAT_PULL_SECRET: |-
     {{ required ".Values.openshift_4__redhat_pull_secret_json is undefined" .Values.openshift_4__redhat_pull_secret_json }}
+
+---
+
+# Workflows run in namespace default and mount this for the VM containerDisk
+# pull. The infra-namespace copy is the server's imagePullSecret.
+apiVersion: v1
+kind: Secret
+type: kubernetes.io/dockerconfigjson
+
+metadata:
+  name: infra-image-registry-pull-secret
+  namespace: default
+
+data:
+  .dockerconfigjson: {{ template "pull-secret" .Values.pullSecrets.quay }}

cmd/infractl/cli/upgrade/fancy.go

@@ -7,11 +7,11 @@ import (
 )
 
 type prettyCliUpgrade struct {
-	updatedFilename string
+	UpdatedFilename string `json:"updatedFilename"`
 }
 
 func (p prettyCliUpgrade) PrettyPrint(cmd *cobra.Command) {
-	cmd.Printf("Updated %s to match the infra server version\n", p.updatedFilename)
+	cmd.Printf("Updated %s to match the infra server version\n", p.UpdatedFilename)
 }
 
 func (p prettyCliUpgrade) PrettyJSONPrint(cmd *cobra.Command) error {

pkg/service/cluster/cluster.go

@@ -352,7 +352,7 @@ func (s *clusterImpl) create(req *v1.CreateClusterRequest, owner, eventID string
 	// insufficient or superfluous parameters.
 	workflowParams, err := checkAndEnrichParameters(flav.Parameters, req.Parameters)
 	if err != nil {
-		return nil, err
+		return nil, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 	workflow.Spec.Arguments.Parameters = workflowParams
 
@@ -977,5 +977,12 @@ func checkAndEnrichParameters(flavorParams map[string]*v1.Parameter, requestPara
 		}
 	}
 
+	if err := validateVirtWorkerNodeType(
+		workflowParameterValue(allParams, "vm-os"),
+		workflowParameterValue(allParams, "worker-node-type"),
+	); err != nil {
+		return nil, err
+	}
+
 	return allParams, nil
 }

pkg/service/cluster/helpers.go

@@ -17,6 +17,18 @@ import (
 	"k8s.io/apimachinery/pkg/selection"
 )
 
+// virtNestedKVMWorkerPrefixes are GCP series that expose nested KVM.
+// E2, ARM, AMD (except n4d), and memory-optimized series do not:
+// https://cloud.google.com/compute/docs/instances/nested-virtualization/overview
+var virtNestedKVMWorkerPrefixes = []string{
+	"a2-", "a3-", "a4-",
+	"c2-", "c3-", "c4-", "c4n-",
+	"g2-",
+	"h3-",
+	"n1-", "n2-", "n4-", "n4d-",
+	"z3-",
+}
+
 func getClusterIDFromWorkflow(workflow *v1alpha1.Workflow) string {
 	clusterID := GetClusterID(workflow)
 	if clusterID == "" {
@@ -296,6 +308,61 @@ func emailToLabelValue(email string) string {
 	return result
 }
 
+// parseVMOSList splits a comma-separated guest OS list. Empty input means no VMs.
+func parseVMOSList(vmOS string) ([]string, error) {
+	if strings.TrimSpace(vmOS) == "" {
+		return nil, nil
+	}
+	var oses []string
+	for token := range strings.SplitSeq(vmOS, ",") {
+		os := strings.ToLower(strings.TrimSpace(token))
+		if os == "" {
+			return nil, fmt.Errorf("vm-os contains an empty entry")
+		}
+		switch os {
+		case "rhel8", "rhel9", "rhel10":
+			oses = append(oses, os)
+		default:
+			return nil, fmt.Errorf("unsupported vm-os %q (valid values: rhel8, rhel9, rhel10)", os)
+		}
+	}
+	return oses, nil
+}
+
+// validateVirtWorkerNodeType rejects machine types that lack nested KVM when any VM is requested.
+func validateVirtWorkerNodeType(vmOS, workerType string) error {
+	oses, err := parseVMOSList(vmOS)
+	if err != nil {
+		return err
+	}
+	if len(oses) == 0 {
+		return nil
+	}
+	if workerTypeHasNestedKVM(workerType) {
+		return nil
+	}
+	return fmt.Errorf("vm-os requires a worker-node-type with nested kvm (for example n2-standard-8), got %q", workerType)
+}
+
+func workerTypeHasNestedKVM(workerType string) bool {
+	t := strings.ToLower(workerType)
+	for _, prefix := range virtNestedKVMWorkerPrefixes {
+		if strings.HasPrefix(t, prefix) {
+			return true
+		}
+	}
+	return false
+}
+
+func workflowParameterValue(params []v1alpha1.Parameter, name string) string {
+	for _, p := range params {
+		if p.Name == name {
+			return p.GetValue()
+		}
+	}
+	return ""
+}
+
 // validateClusterID validates that a cluster ID meets Kubernetes label value requirements.
 // Kubernetes label values must match ([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9] and be at most 63 characters.
 func validateClusterID(clusterID string) error {