fix(vm): protect hp pod with new d8 label

[yaroslavborbat]

Description

Hotplug pods (HP) must not be evicted — this is enforced via a webhook.

Bug: HP pods were labeled with kubevirt.io=hotplug-disk, but the eviction webhook was checking for kubevirt.internal.virtualization.deckhouse.io=d8v-hotplug-disk. After renaming the label, the webhook was not updated, so eviction protection was not working. Fixed the label mismatch in the webhook and added an e2e test to cover this case.

deckhouse/3p-kubevirt#83

Why do we need it, and what problem does it solve?

HP pods labeled with the old kubevirt.io key were not matched by the eviction webhook after the label was renamed to kubevirt.internal.virtualization.deckhouse.io=d8v-hotplug-disk. As a result, HP pods could be evicted unexpectedly, potentially disrupting hotplugged disk attachments.

What is the expected result?

1. Create a VM with a hotplugged disk.
2. Attempt to evict the HP pod.
3. Eviction is denied by the webhook.

Checklist

• The code is covered by unit tests.
• e2e tests passed.
• Documentation updated according to the changes.
• Changes were tested in the Kubernetes cluster manually.

Changelog entries

section: vm
type: fix
summary: "Fixed virtual machine eviction during node drain: pods responsible for block device attachments are no longer removed from a cordoned node before virtual machine migration is complete."