Zorvia
Quickstart · Console · Docs · Leaving OpenShift? · Star on GitHub
Kubernetes VMs, run like a platform — not a pile of YAML.
KubeVirt gives you VirtualMachine objects. Zorvia gives you the control plane around them. CLI, interactive TUI and a signed-in web console — one API, live cluster objects, not a parallel mock store.
43 OS templates · 8 profiles, 5 blueprints · CLI · TUI · web, one API · Any KubeVirt cluster · Apache-2.0
What's new
v0.7.0, the MCP release: AI assistants (Claude Desktop/Code and other MCP clients) can list, create, power-cycle and snapshot VMs
through an opt-in /api/mcp endpoint or the zorvia mcp bridge, acting with their own scoped token (docs/MCP.md).
v0.6.0, the easy-deploy release: Envoy Gateway replaces nginx, remote-deploy.sh --bootstrap --image takes a bare host to a running console
with no on-host build, and the published image now ships the web console (changelog).
v0.5.0, the hardening release (changelog): found by deploying a clean host and driving every page and the
VM, snapshot, backup and revert flows end to end. Small VMs (512 MB) create, a VM can be reverted more than once, rejected
snapshots and running-VM reverts say why instead of returning an opaque 500, the Create wizard no longer submits on Next, logins no
longer stall the API, and the Golden Images page adds Windows golden builds through Kryton.
v0.4.0, the production-platform release:
| Area | What shipped |
|---|
| Data protection you can prove | Encrypted off-cluster S3 backups with read-back verification, restore (including Block volumes), recovery drills, durable operations that survive restarts |
| Identity and tenancy | Namespace allow-lists for users and API tokens, TOTP secrets sealed at rest (local key or Vault Transit), OIDC group-to-role mapping, certificate hot reload |
| High availability (Beta) | PostgreSQL store (users, operations, audit, schedules, shared lockout) and a two-replica Helm profile (values-ha.yaml) |
| Guests | Zyvor guest agent (GuestKit v1.2.5) with application-consistent snapshots, read-only guest views, a Guest agent tab |
| Hardware (Experimental) | GPU/vGPU/SR-IOV passthrough, NUMA/hugepages/dedicated CPUs, permit/remove devices from the console |
| Upgrade note | The CLI is restructured into nested subcommands (breaking): zorvia create is now zorvia vm create |
Why Zorvia
Create from a template or blueprint instead of hand-writing CRDs. Operate day-2 — hotplug, live migrate, snapshot — without downtime. Reach the guest over an authenticated console, VNC or SSH. Govern with real RBAC and quotas. Prove it afterward with an exportable audit trail. Full docs: zyvorai.github.io/zyvor-zorvia.
| When this happens… | Zorvia gives you… |
|---|
Every new VM means hand-writing a VirtualMachine CRD | 43 named OS templates, 8 resource profiles and 5 multi-VM blueprints |
Day-2 changes mean downtime or a careful virtctl session | CPU/memory/disk/NIC hotplug, live migration and disk resize, with zorvia change drift and zorvia change plan to catch problems first |
| Reaching the guest means handing out cluster credentials | Serial, VNC and in-browser SSH over authenticated, permission-checked WebSockets |
| Access control lives only in the UI | Server-side roles, per-user namespace allow-lists, ResourceQuota and NetworkPolicy — not client-only checks |
| The auditor asks who did what | A persistent audit DB and GET /api/audit/export (JSONL) for SIEM shippers |
| You're paying for OpenShift just to run KubeVirt VMs | An Apache-2.0 control plane for any KubeVirt cluster, adopted read-only first |
| Step | Surface | What it does |
|---|
| 1 · Create | Templates · profiles · blueprints | 43 OS templates, workload profiles, multi-VM stacks — no hand-written VM CRDs |
| 2 · Day-2 | Hotplug · migrate · snapshot | CPU/memory/disk/NIC hotplug, live migration, snapshots, disk resize |
| 3 · Access | Console · VNC · SSH | Authenticated WebSockets into the guest from the signed-in console |
| 4 · Guard | RBAC · namespaces · quotas · NetworkPolicy | Server-side roles, per-user namespace allow-lists, ResourceQuota, NetworkPolicy — not client-only checks |
| 5 · Audit | Trail · JSONL export | Persistent audit DB + GET /api/audit/export for SIEM shippers |
What is in the box
Zorvia vs OpenShift Virtualization
| Zorvia | OpenShift Virtualization (Red Hat) |
|---|
| VM engine | KubeVirt | KubeVirt |
| Where it runs | Any KubeVirt cluster | OpenShift only |
| Licence | Apache-2.0, no subscription to run it | Red Hat subscription |
| Front ends | CLI, interactive TUI and web console on one Fabric API | OpenShift web console and virtctl; no TUI |
| Change gating | zorvia change drift and zorvia change plan built in | Not built in |
| VMware migration | No importer of its own in production; pairs with Transiva → h2kvm → GuestKit (in-product h2kvm import is Experimental) | Integrated migration tooling |
| Support | Production support and SLAs by contract, on top of the free code | Red Hat support contract |
| Choose OpenShift Virtualization when | | You want one vendor support contract for the whole platform, multi-cluster management and integrated VMware migration |
How it stacks up
| Hand-rolled kubectl/virtctl | Generic K8s dashboards | OpenShift Virtualization | Zorvia |
|---|
| VM create/day-2 without hand-written YAML | No | Partial: view-only for VMs | Yes | Yes |
| Same capability from CLI, TUI, and web | No | No (web only) | Partial: web + virtctl, no TUI | Yes |
| Cost/right-sizing, compliance, HA built in | No | No | Partial: add-ons | Yes: real, on by default |
| Drift detection + change-plan gating | No | No | No | Yes (zorvia change drift / zorvia change plan) |
| Runs on any KubeVirt cluster | Yes | Yes | No: OpenShift only | Yes |
| Open source, Apache-2.0 | Yes | Varies | No | Yes |
Zorvia isn't a general Kubernetes dashboard — it's opinionated about one thing: VMs on KubeVirt, done like a platform.
Leaving OpenShift?
OpenShift Virtualization runs KubeVirt, so your VMs are already VirtualMachine objects. Leaving means changing the control plane around them, not rewriting them.
- Zorvia — free, Apache-2.0, no subscription. Point it at your KubeVirt cluster, read-only first: adoption runbook.
- Coming from VMware? Zorvia has no production importer of its own. Use the Zyvor suite: Transiva (export) → h2kvm (convert, deploy) → GuestKit (assure) → Zorvia (operate). Community tiers are free; h2kvm needs a paid licence for production.
- Commercial support — production support and SLAs by contract, on top of the free Apache-2.0 code. Scope and terms are agreed with sales: talk to sales, or book a demo.
Running this for a business? Commercial support gives you support and SLAs you can put in a contract. Book a demo or start a 30-day PoC on a real cluster, then follow the adoption runbook.
See it live
One continuous session on a real lab cluster (HTTPS NodePort 30152) — dashboard → VM list → in-browser console → live metrics. Not mockups.
Dashboard → VM list → open a VM's console → watch a real guest boot. ~15–20s, no audio.
| Dashboard | VM list | VM console |
|---|
| | |
| Cluster and VM overview from live objects | Every VirtualMachine, with power and status | In-browser console into a running guest |
| VM metrics | Templates | Pods: exec |
|---|
| | |
| Live metrics for one VM | Named OS templates to create from | An exec -it shell into a platform pod (admin-only, audited) |
How it fits together
One Fabric API sits behind the CLI, the interactive TUI and the web console, and every call ends in real Kubernetes objects: VirtualMachine, VirtualMachineSnapshot, NetworkPolicy, ResourceQuota, PVCs and DataVolumes. If a page shows a number, it came from the cluster. Diagram: docs/whats-inside.md.
Install
One binary, one Helm chart — bring your own KubeVirt cluster. Requires Rust 1.89+, a kubeconfig, and a cluster with KubeVirt (CDI optional for golden images / CDI clone).
git clone https://github.com/zyvorai/zyvor-zorvia.git && cd zorvia
cargo install --path . --features web # `web` is the default feature
# cluster install
helm upgrade --install zorvia charts/zorvia -n zorvia-system --create-namespace \
-f charts/zorvia/values-lab.yaml
Production values: charts/zorvia/values-production.yaml. Lab remote deploy: docs/LAB.md.
One command to a running console
From a checkout, with SSH access (and passwordless sudo) to a fresh Linux host:
# brand-new host: installs k3s + Cilium + KubeVirt + CDI + Envoy Gateway, then runs Zorvia
./deploy/remote-deploy.sh <host> <user> --bootstrap --image
# host that already has a KubeVirt cluster: just (re)deploy the published image, ~1 minute
./deploy/remote-deploy.sh <host> <user> --image # ghcr.io/zyvorai/zorvia:latest
./deploy/remote-deploy.sh <host> <user> --image=ghcr.io/zyvorai/zorvia:0.6.0 # pin a release
Nothing is compiled on the host. The script prints the console URL (https://<host>:30152) and the generated
admin password once, and exits non-zero unless /api/v1/health returns 200. Images are public on GHCR
(ghcr.io/zyvorai/zorvia), so no registry login is needed.
Quickstart
Install as above, then profile → create → start → reach the guest. One real VM.
zorvia profile show database
zorvia vm create prod-db --template ubuntu-22.04 --cpus 6 --memory 16Gi --disk-size 200Gi
zorvia vm start prod-db
zorvia guest wait-ready prod-db --timeout 120
zorvia vm status prod-db --watch
zorvia blueprint deploy lamp --prefix myapp --start # or a whole multi-VM stack
The web console is served on HTTPS NodePort 30152 (self-signed): open https://<HOST>:30152/app. Ports, the health/login/audit curl examples and the lab password Secret are in Install and quick start.
Production support and services
Everything in this repository stays Apache-2.0, free for commercial use, and works without a subscription. Paid service contracts add support coverage and services (deployment, migration, training, managed operations) around it. They are not a software licence. A contract records what was purchased. It never stops VMs, disables APIs or blocks access to your data.
Delivery is phased. Catalog, quote requests, contracts and coverage are implemented (Beta). The other areas are documented as design and labelled as not yet available in each doc.
Documentation
| Topic | Doc |
|---|
| Every guide, by area | docs/README.md |
| Install, Helm, first VM, ports and API examples | docs/getting-started.md |
| Why Zorvia, and every capability | docs/whats-inside.md |
| Web console routes and the Fabric HTTP API | docs/console-and-api.md · docs/WEB_CONSOLE.md |
| Profiles, blueprints, templates | docs/profiles-blueprints-templates.md · docs/OS_TEMPLATES.md |
| Day-2 commands and the operator toolkit | docs/day-2-ops.md · docs/operator-toolkit.md |
| Security, cost, tenancy, DR, HA, automation | docs/platform-surface.md |
| Validated versions, measured results, what is not validated | docs/SUPPORT_MATRIX.md |
| Per-user namespace restriction | |
Project security
No unsafe on the product path. CORS off unless configured. TLS verification enforced. Console, VNC and SSH sockets are permission-checked, origin-checked and audited; users can be confined to namespaces; sign-in is throttled, MFA re-enrolment needs proof, and sessions can be revoked (POST /api/v1/auth/logout). Lab mode is off by default. Profile/blueprint storage blocks path traversal. API errors are sanitized; auth inputs bounded. Report privately via GitHub Security Advisories or [email protected] — SECURITY.md.
Maturity
Roadmap: a feature-maturity registry, not a marketing slide. Only GA and documented Beta paths are production promises: docs/roadmap.md, or GET /api/v1/features on a running API. Full list: docs/FEATURE_MATURITY.md; validated versions and measured results: docs/SUPPORT_MATRIX.md.
| Level | Meaning | Examples |
|---|
| GA | Real backend, persistence, RBAC, tests, upgrade path | VM lifecycle, snapshots and restore, live migration, web console and auth, audit trail |
| Beta | Operational with documented limitations | Helm chart, OIDC, PostgreSQL store and two replicas, off-cluster S3 backups, guest agent integration, pod ops, schedulers, Rook-Ceph and Atlas storage |
| Experimental | Behind ZORVIA_EXPERIMENTAL=1; no production promise | GPU/SR-IOV/NUMA, VMware import via h2kvm Jobs, fleet multi-cluster, golden-image pipeline, cross-cluster DR |
| Model only | Internal types / demos — not marketed as working | AI troubleshooting, DR replication pairs, incremental backup fields |
Part of the Zyvor stack
| Product | Role next to Zorvia |
|---|
| Zorvia | KubeVirt VM platform: CLI, TUI and web console over one API |
| GuestKit | Offline VM assurance; Zorvia pins the GuestKit-based Zyvor guest agent (v1.2.5) for guest views and snapshot hooks |
| h2kvm | VMware → KubeVirt conversion; Zorvia can run h2kvm import Jobs (Experimental, needs ZORVIA_H2KVM_IMAGE) |
| Atlas | Storage control plane; optional integration gated on ATLAS_URL (Beta) |
| Kryton | Windows workload control plane; backs the Create VM Windows wizard when KRYTON_URL is set |
→ zyvor.dev
Get involved
- Running this in production? Production support and SLAs are available by contract; other Zyvor products are licensed separately. Book a demo or start a 30-day PoC. Tell us your cluster size and what's on your roadmap list, and we'll tell you what's already possible today. Fallback: [email protected].
- Evaluating it? Clone it and run the quickstart; every claim in this README maps to a route or command you can hit right now. Questions, bug reports and feature requests are welcome as GitHub issues; a star on the repo helps others find it.
- Contributing code? PRs welcome — see CONTRIBUTING.md.
Support
Free under Apache-2.0. If it helps you, you can donate any amount you like: https://rzp.io/rzp/utwdYh3. A donation is voluntary and supports development and maintenance. It is not a purchase: it buys no support, SLA, features, priority or license, and it is not tax-deductible (Zyvor AI Labs Private Limited is a company, not a charity). Zyvor Enterprise (supported releases, SLAs, a named contact and enterprise features) is separate: [email protected].
License
Zorvia is free and open source under the Apache License, Version 2.0. You may use, modify, and run it for personal, lab, and commercial production use at no charge, subject to Apache-2.0 (preserve notices / NOTICE where required). See NOTICE — Apache-2.0 only (not dual-licensed with MIT).
Zyvor Enterprise adds what production teams ask for: supported releases, deployment and upgrade guidance, priority incident triage, a named technical contact and 24x7 critical intake. Plans and terms: docs/SUBSCRIPTION-MODEL.md · Pricing · [email protected].
Built on KubeVirt and kube-rs.
Run your KubeVirt VMs like a platform
