VirtStack Features & Capability Reference
VirtStack turns a fleet of SUSE Linux Enterprise Server KVM hosts into a single, secure, browser-managed platform. This page separates what is available today from what is on the committed roadmap, so you can plan with confidence.
Feature matrix
| Category | Available now (Shipping Today) | Committed Roadmap |
|---|---|---|
| Fleet & host onboarding | One-line enrollment, hardware & NUMA discovery, maintenance mode | Rolling host updates, hardware certification suite |
| VM lifecycle | Start / shutdown / force off / reboot / pause / resume / delete; 16 preflight checks | Bulk power operations, power schedules |
| Console | In-browser noVNC over encrypted tunnel; live ISO attach/eject | SPICE audio, browser USB redirection |
| Virtual hardware | vCPU, RAM, disks, NICs, USB & PCI passthrough, vTPM, RNG, watchdog | Automatic balloon tuning, CPU hot-add |
| Storage | Pool discovery (dir, NFS, LVM), online volume expansion, safe external disk attach | Shared SDS orchestration, thin-provisioning alerts |
| Networking | NAT, routed, isolated & bridged networks; multi-NIC; 4-stage IP discovery | VXLAN/Geneve overlays, distributed firewall |
| Snapshots & clones | Disk + RAM snapshots, full & linked clones, live flattening, identity reset | Scheduled snapshots with retention |
| Placement | Two-stage engine, NUMA-aware pinning, decision logs | Dynamic balancing / DRS-style rebalancing |
| Observability | Live event stream, per-second metrics, datacenter dashboard | Historical trends, Prometheus/Grafana |
| High availability | Pacemaker/Corosync monitoring, SBD inspection, safe resource relocation | One-click evacuation, automated split-brain recovery |
| Security & governance | Immutable audit log, signed enrollment tokens, mTLS agent tunnel | RBAC, OIDC/SAML SSO, MFA, Vault, multi-tenancy |
| Migration | Migration wizard with capacity & compatibility validation | Live migration, live storage copy without shared storage |
Fleet onboarding & host discovery
Benefit: A new hypervisor is manageable within minutes of OS install — no firewall tickets, no key distribution.
- One-line enrollment using a time-bounded, cryptographically signed token.
- Hardware inventory: sockets, cores, threads, virtualization extensions (VT-x / AMD-V), memory.
- NUMA topology mapping of cores and memory per cell.
- Maintenance mode cordons a host from new placements while existing VMs keep running.
- Self-healing connection with exponential backoff after network interruptions.
# Illustrative — see the Quickstart for exact syntax
curl -fsSLo virtstack-agent.sh https://<control-plane>/install/agent.sh
sudo bash virtstack-agent.sh --token '<ENROLLMENT_TOKEN>'VM lifecycle & provisioning
Benefit: Fewer failed deployments and no “it fit on paper” surprises.
Supported Lifecycle Actions
Provisioning Wizard & Preflight
Sockets/cores/threads, memory with ballooning limits, disk bus (virtio-blk, virtio-scsi/SCSI, SATA, IDE) and format (QCOW2, raw), network attachment, ISO and boot order.
Operator note: Pause is not a substitute for shutdown on long maintenance windows — guest clocks and remote TCP sessions may time out while paused.
16-Point Preflight Gate Interactive Simulator
VirtStack validates host headroom, CPU overcommit, datastore capacity & bridges before submitting to libvirt.
Virtual hardware & devices
Benefit: vSphere-level hardware control, exposed through a UI rather than hand-edited domain XML.
CPU Topology & Mode
host-passthrough for maximum performance, or named CPU models (e.g. Cascadelake-Server) for migration across mixed CPU generations.
PCIe / GPU Passthrough (VFIO)
Pass physical GPUs, NVMe controllers, dedicated NICs, and USB license dongles directly to guests.
vTPM 2.0 (swtpm)
Backed by swtpm on the host; required for Windows 11 and supports BitLocker disk encryption.
RNG & Watchdogs
VirtIO RNG for entropy and i6300esb watchdogs for hung-guest automatic recovery.
<!-- Example of what VirtStack generates for a vTPM (for reference only) -->
<tpm model="tpm-crb">
<backend type="emulator" version="2.0"/>
</tpm>Snapshots, full clones & linked clones
Benefit: Stand up test and training environments in seconds, and roll back safely.
Snapshots
External disk snapshots or full memory + disk; revert to any point; delete with background block-commit to keep chains short.
Linked Clones (QCOW2)
QCOW2 overlay on a read-only base — seconds to provision, near-zero initial storage. Full backing-chain visibility.
Live Flattening & Identity
Convert a linked clone to standalone without downtime. Automatic SMBIOS UUID, MAC, and machine-id reset.
Product Roadmap
Four levels of certainty. Relative phases only — no dates are committed on this page.
Phase 8 · Scheduling & Backup
Durable cron-style snapshots/backups, retention (7 daily / 4 weekly / 12 monthly), dev/test power schedules.
Phase 11 · Identity & Compliance
RBAC personas, OIDC & SAML 2.0 SSO, TOTP & FIDO2/WebAuthn MFA, multi-tenant scoping, automated mTLS cert rotation, SIEM streaming.
Phase 12 · Fleet Scaling
Horizontally scaled gateways (50+ hypervisors), automatic gateway failover.
Phase 13 · DR & Hardening
Off-site snapshot replication, active-active control plane, host certification suite.