Running a Debian 13 VM on Fedora 42 with Bridged Networking, Podman, and Minikube

sudo dnf install -y qemu-kvm libvirt virt-install libguestfs-tools \
  genisoimage virt-top bridge-utils

sudo systemctl enable --now libvirtd

systemctl status libvirtd

sudo usermod -aG libvirt,wheel $(whoami)

groups

newgrp libvirt

virsh list --all

virsh --connect qemu:///system list --all

nmcli device status

nmcli -t -f ipv4.method,ipv4.addresses,ipv4.gateway,ipv4.dns \
  connection show "Wired connection 1"

sudo nmcli connection add type bridge ifname br0 con-name br0 \
  ipv4.method auto ipv6.method auto

sudo nmcli connection add type bridge ifname br0 con-name br0 \
  ipv4.method manual \
  ipv4.addresses 192.168.2.112/24 \
  ipv4.gateway 192.168.2.1 \
  ipv4.dns '192.168.2.1,1.1.1.1' \
  ipv6.method disabled

sudo nmcli connection add type bridge-slave ifname enp130s0 master br0 \
  con-name br0-slave-enp130s0

sudo nmcli connection delete "Wired connection 1"

sudo nmcli connection modify "Wired connection 1" connection.autoconnect no

sudo nmcli connection down "Wired connection 1" && sudo nmcli connection up br0

ip -br addr show br0
bridge link show br0
ip route list

sudo firewall-cmd --add-interface=br0 --zone=public --permanent
sudo firewall-cmd --reload

# virbr0 is already created by libvirt. Verify it:
virsh net-list --all

# If it's not active:
sudo virsh net-start default
sudo virsh net-autostart default

--network network=default,model=virtio

cat << 'EOF' | sudo tee /etc/libvirt/qemu/networks/nat-net.xml
<network>
  <name>nat-net</name>
  <forward mode='nat'/>
  <bridge name='virbr1' stp='on' delay='0'/>
  <ip address='10.100.0.1' netmask='255.255.255.0'>
    <dhcp>
      <range start='10.100.0.100' end='10.100.0.200'/>
    </dhcp>
  </ip>
</network>
EOF

sudo virsh net-define /etc/libvirt/qemu/networks/nat-net.xml
sudo virsh net-start nat-net
sudo virsh net-autostart nat-net

# No bridge setup needed. Just use macvtap directly in virt-install:
--network type=direct,source=enp130s0,source_mode=vepa,model=virtio

ssh -L 8080:localhost:8080 -L 8888:localhost:8888 -N sanjayu@<VM_IP>

cd ~
wget https://cloud.debian.org/images/cloud/trixie/daily/latest/debian-13-nocloud-amd64-daily.qcow2

qemu-img create -f qcow2 \
  -b /home/sanjayu/debian-13-nocloud-amd64-daily.qcow2 \
  -F qcow2 \
  /home/sanjayu/debian13-vm0.qcow2 \
  40G

qemu-img info /home/sanjayu/debian13-vm0.qcow2

mkdir -p /tmp/cidata

cat > /tmp/cidata/meta-data << 'EOF'
instance-id: debian13-vm0
local-hostname: debian13-vm0
EOF

cat > /tmp/cidata/user-data << 'EOF'
#cloud-config
hostname: debian13-vm0
manage_etc_hosts: true

# Automatically grow the root partition to fill the disk
growpart:
  mode: auto
  devices: ['/']

resize_rootfs: true

# Create a sudo user
users:
  - name: sanjayu
    sudo: ALL=(ALL) NOPASSWD:ALL
    shell: /bin/bash
    lock_passwd: false
    groups: sudo, adm

# Set passwords for root and sanjayu
chpasswd:
  list: |
    root:adc087c9
    sanjayu:adc087c9
  expire: false

# Enable SSH password authentication and root login
ssh_pwauth: true
disable_root: false

# Install essential packages
packages:
  - openssh-server
  - sudo
  - cloud-guest-utils
  - qemu-guest-agent

# Post-boot commands
runcmd:
  - sed -i 's/^#*PermitRootLogin.*/PermitRootLogin yes/' /etc/ssh/sshd_config
  - systemctl enable sshd
  - systemctl restart sshd
  - systemctl enable qemu-guest-agent
  - systemctl start qemu-guest-agent
EOF

genisoimage -output /home/sanjayu/debian13-vm0-seed.iso \
  -volid cidata -joliet -rock \
  /tmp/cidata/user-data /tmp/cidata/meta-data

echo "allow br0" | sudo tee -a /etc/qemu-kvm/bridge.conf

cat /etc/qemu-kvm/bridge.conf

ls -l /usr/libexec/qemu-bridge-helper
# Should show: -rwsr-xr-x

virt-install \
  --name debian13-vm0 \
  --memory 8192 \
  --vcpus 8 \
  --disk path=/home/sanjayu/debian13-vm0.qcow2,bus=virtio,format=qcow2 \
  --disk path=/home/sanjayu/debian13-vm0-seed.iso,device=cdrom,bus=sata \
  --network bridge=br0,model=virtio \
  --osinfo require=off \
  --import \
  --noautoconsole

virsh list --all

# If using bridged networking, the VM gets a DHCP lease from your LAN:
virsh domifaddr debian13-vm0

# Or use the QEMU guest agent (more reliable):
virsh domifaddr --source agent debian13-vm0

ssh sanjayu@<VM_IP>
# password: adc087c9 (or whatever you set in cloud-init)

df -h /
# Should show ~40 GB, NOT ~2 GB

whoami        # sanjayu
sudo whoami   # root

sudo apt-get update
sudo apt-get install -y podman buildah skopeo podman-compose

podman --version       # e.g., podman version 5.x
buildah --version      # e.g., buildah version 1.x
skopeo --version       # e.g., skopeo version 1.x
podman-compose --version

podman run --rm -it docker.io/library/alpine echo "Podman works!"

# Install minikube
curl -LO https://storage.googleapis.com/minikube/releases/latest/minikube-linux-amd64
sudo install minikube-linux-amd64 /usr/local/bin/minikube
rm minikube-linux-amd64

# Install kubectl
curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl
rm kubectl

minikube version
kubectl version --client

# Load required kernel modules
sudo modprobe br_netfilter overlay

# Persist them across reboots
cat << 'EOF' | sudo tee /etc/modules-load.d/k8s.conf
br_netfilter
overlay
EOF

# Sysctl settings required by Kubernetes
cat << 'EOF' | sudo tee /etc/sysctl.d/99-kubernetes.conf
net.bridge.bridge-nf-call-iptables  = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward                 = 1
EOF

sudo sysctl --system

sudo minikube start \
  --driver=podman \
  --nodes=3 \
  --cni=calico \
  --cpus=2 \
  --memory=2g \
  --disk-size=10g \
  -p k8s-cluster

mkdir -p ~/.kube
sudo cp /root/.kube/config ~/.kube/config
sudo chown -R $(id -u):$(id -g) ~/.kube
echo 'export KUBECONFIG=~/.kube/config' >> ~/.bashrc
source ~/.bashrc

kubectl get nodes -o wide

kubectl create deployment nginx --image=nginx --replicas=3
kubectl expose deployment nginx --port=80 --type=NodePort
kubectl get pods -o wide

kubectl create namespace vote

kubectl apply -n vote -f - <<'EOF'
---
apiVersion: v1
kind: Service
metadata:
  name: redis
spec:
  ports:
    - port: 6379
  selector:
    app: redis
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: redis
spec:
  replicas: 1
  selector:
    matchLabels:
      app: redis
  template:
    metadata:
      labels:
        app: redis
    spec:
      containers:
        - name: redis
          image: redis:7-alpine
          ports:
            - containerPort: 6379
---
apiVersion: v1
kind: Service
metadata:
  name: db
spec:
  ports:
    - port: 5432
  selector:
    app: db
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: db
spec:
  replicas: 1
  selector:
    matchLabels:
      app: db
  template:
    metadata:
      labels:
        app: db
    spec:
      containers:
        - name: db
          image: postgres:16-alpine
          env:
            - name: POSTGRES_USER
              value: postgres
            - name: POSTGRES_PASSWORD
              value: postgres
            - name: POSTGRES_DB
              value: votes
          ports:
            - containerPort: 5432
---
apiVersion: v1
kind: Service
metadata:
  name: vote
spec:
  type: NodePort
  ports:
    - port: 80
  selector:
    app: vote
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: vote
spec:
  replicas: 2
  selector:
    matchLabels:
      app: vote
  template:
    metadata:
      labels:
        app: vote
    spec:
      containers:
        - name: vote
          image: dockersamples/examplevotingapp_vote
          ports:
            - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: result
spec:
  type: NodePort
  ports:
    - port: 80
  selector:
    app: result
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: result
spec:
  replicas: 1
  selector:
    matchLabels:
      app: result
  template:
    metadata:
      labels:
        app: result
    spec:
      containers:
        - name: result
          image: dockersamples/examplevotingapp_result
          ports:
            - containerPort: 80
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: worker
spec:
  replicas: 1
  selector:
    matchLabels:
      app: worker
  template:
    metadata:
      labels:
        app: worker
    spec:
      containers:
        - name: worker
          image: dockersamples/examplevotingapp_worker
EOF

kubectl port-forward -n vote svc/vote 8080:80 &
kubectl port-forward -n vote svc/result 8888:80 &

ssh -L 8080:localhost:8080 -L 8888:localhost:8888 -N sanjayu@<VM_IP>

sudo apt-get install -y firefox-esr xauth

ssh -X sanjayu@<VM_IP>
firefox-esr --no-remote &

# Inside the VM:
sudo apt-get install -y tigervnc-standalone-server firefox-esr
vncpasswd
vncserver :1 -geometry 1920x1080

ssh -L 5901:localhost:5901 -N sanjayu@<VM_IP>

# Create a small app
mkdir -p ~/demo-app && cd ~/demo-app

cat > app.py << 'PYEOF'
from http.server import HTTPServer, SimpleHTTPRequestHandler
import os, socket
class Handler(SimpleHTTPRequestHandler):
    def do_GET(self):
        msg = f"Hello from podman-built image!\nPod: {os.environ.get('HOSTNAME','?')}\nNode: {socket.gethostname()}\n"
        self.send_response(200)
        self.send_header("Content-Type", "text/plain")
        self.end_headers()
        self.wfile.write(msg.encode())
if __name__ == "__main__":
    HTTPServer(("0.0.0.0", 8080), Handler).serve_forever()
PYEOF

cat > Dockerfile << 'DEOF'
FROM python:3.12-slim
WORKDIR /app
COPY app.py .
EXPOSE 8080
CMD ["python", "app.py"]
DEOF

sudo podman build -t demo-app:latest ~/demo-app

sudo podman save demo-app:latest | sudo minikube image load -p k8s-cluster -

kubectl apply -f - <<'EOF'
apiVersion: apps/v1
kind: Deployment
metadata:
  name: demo-app
spec:
  replicas: 3
  selector:
    matchLabels:
      app: demo-app
  template:
    metadata:
      labels:
        app: demo-app
    spec:
      containers:
        - name: demo-app
          image: demo-app:latest
          imagePullPolicy: Never
          ports:
            - containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: demo-app
spec:
  type: NodePort
  ports:
    - port: 8080
  selector:
    app: demo-app
EOF

# Check group membership
groups

# If 'libvirt' is missing, add it and re-login:
sudo usermod -aG libvirt $(whoami)
# Log out and back in, or:
newgrp libvirt

# Check libvirt socket permissions
ls -l /var/run/libvirt/libvirt-sock
# Should be: srwxrwx--- 1 root libvirt

# Verify POLICYKIT auth
sudo cat /etc/polkit-1/rules.d/50-libvirt.rules
# If missing, create it:
sudo tee /etc/polkit-1/rules.d/50-libvirt.rules << 'EOF'
polkit.addRule(function(action, subject) {
    if (action.id == "org.libvirt.unix.manage" &&
        subject.isInGroup("libvirt")) {
        return polkit.Result.YES;
    }
});
EOF

# 1. Check if a bridge-slave connection exists
nmcli con show | grep slave

# 2. If missing, create it (replace enp130s0 with your device):
sudo nmcli connection add type bridge-slave ifname enp130s0 master br0 \
  con-name br0-slave-enp130s0

# 3. Make sure the old wired connection doesn't conflict:
sudo nmcli connection delete "Wired connection 1"
# Or disable its autoconnect:
# sudo nmcli connection modify "Wired connection 1" connection.autoconnect no

# 4. Restart the bridge:
sudo nmcli connection down br0
sudo nmcli connection up br0

echo "allow br0" | sudo tee -a /etc/qemu-kvm/bridge.conf
# Also check /etc/qemu/bridge.conf — add it there too if it exists:
echo "allow br0" | sudo tee -a /etc/qemu/bridge.conf

# Check the partition layout
lsblk

# Install growpart
sudo apt-get install -y cloud-guest-utils

# Grow partition 1 (adjust the partition number from lsblk output)
sudo growpart /dev/vda 1

# Grow the filesystem
sudo resize2fs /dev/vda1    # for ext4
# sudo xfs_growfs /          # for XFS

# Verify
df -h /

growpart:
  mode: auto
  devices: ['/']
resize_rootfs: true
packages:
  - cloud-guest-utils

# 1. Make sure cgroups v2 is active
stat -fc %T /sys/fs/cgroup   # should print 'cgroup2fs'

# 2. Make sure kernel modules are loaded
sudo modprobe br_netfilter overlay
sudo sysctl --system

# 3. Try with explicit rootful mode
sudo minikube start --driver=podman --force

# 4. If pods keep crashing, check podman status
sudo podman ps -a
sudo podman logs <container-id>

# 5. Nuclear option — delete and recreate
sudo minikube delete -p k8s-cluster
sudo minikube start --driver=podman --nodes=3 --cni=calico \
  --cpus=2 --memory=2g --disk-size=10g -p k8s-cluster

# Check libvirt network status
virsh net-list --all

# If using a bridge, verify it's up
ip link show br0

# Check libvirt logs
sudo journalctl -u libvirtd --since "5 minutes ago"

# Try with the default NAT network to isolate the issue:
virt-install --network network=default ...

# 1. Verify the seed ISO has the right volume label
isoinfo -d -i /home/sanjayu/debian13-vm0-seed.iso | grep "Volume id"
# Should print: Volume id: cidata

# 2. Connect to the serial console to see what's happening
virsh console debian13-vm0

# 3. Check cloud-init logs (once you get in):
sudo cat /var/log/cloud-init.log
sudo cat /var/log/cloud-init-output.log

# 4. Re-run cloud-init manually:
sudo cloud-init clean
sudo cloud-init init
sudo cloud-init modules --mode=config
sudo cloud-init modules --mode=final

# Combine both commands on one line so NM transitions quickly:
sudo nmcli connection down "Wired connection 1" && sudo nmcli connection up br0

# Or use a local console / out-of-band access

# After reconnection, verify:
ip addr show br0
ping -c 3 8.8.8.8

# The image might need a serial console configured.
# Try connecting with VNC instead:
virsh vncdisplay debian13-vm0

# Or add a serial console and re-provision:
virt-install ... --serial pty --graphics vnc,listen=0.0.0.0

# Inside the VM — delete all K8s resources
kubectl delete deploy,svc --all --all-namespaces
sudo minikube delete -p k8s-cluster

# On the host — remove the VM
virsh destroy debian13-vm0
virsh undefine debian13-vm0
rm -f /home/sanjayu/debian13-vm0.qcow2 /home/sanjayu/debian13-vm0-seed.iso

# Remove the bridge (if you want to go back to direct Ethernet)
sudo nmcli connection down br0
sudo nmcli connection delete br0
sudo nmcli connection delete br0-slave-enp130s0
sudo nmcli connection add type ethernet ifname enp130s0 con-name "Wired connection 1"
sudo nmcli connection up "Wired connection 1"