kata-deploy: Make runtime-rs the default runtime

Switch the per-architecture default shim from the Go runtime ("qemu") to the
Rust runtime ("qemu-runtime-rs") wherever a runtime-rs build exists, and
align CI/test fallbacks with the new default.

Document the defaultShim values and Go runtime deprecation in the Helm and
config migration guides using mkdocs admonitions.

Fixes: kata-containers#9546

Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
Assisted-by: Cursor <cursoragent@cursor.com>

docs/helm-configuration.md

@@ -55,6 +55,28 @@ default (non-custom) runtime. kata-deploy writes it as
 
 It's best to reference the default `values.yaml` file above for more details.
 
+### defaultShim
+
+`defaultShim` selects, per architecture, which shim the auto-created default
+RuntimeClass (`runtimeClasses.createDefault`) resolves to:
+
+```yaml title="values.yaml"
+defaultShim:
+  amd64: qemu-runtime-rs
+  arm64: qemu-runtime-rs
+  s390x: qemu-runtime-rs
+  ppc64le: qemu
+```
+
+Since the Kata Containers **4.0 release**, the default is the **Rust runtime**
+(`runtime-rs`, `qemu-runtime-rs`) on every architecture that ships a
+`runtime-rs` build (x86_64, aarch64, s390x). ppc64le has no `runtime-rs` build
+yet and stays on the Go runtime (`qemu`). The Go runtime remains selectable
+(e.g. via the `kata-qemu` RuntimeClass) but is
+[deprecated](migrating-config-go-runtime-to-runtime-rs.md#go-runtime-deprecation).
+See the [config migration guide](migrating-config-go-runtime-to-runtime-rs.md)
+for per-option differences when migrating.
+
 ### Custom Runtimes
 
 Kata allows you to create custom runtime configurations. This is done by overlaying one of the pre-existing runtime configs with user-provided configs. For example, we can use the `qemu-nvidia-gpu` as a base config and overlay our own parameters to it:

tests/common.bash

@@ -26,7 +26,7 @@ KATA_TESTS_DATADIR="${KATA_TESTS_DATADIR:-${KATA_TESTS_BASEDIR}/data}"
 # Directory that can be used for storing cache kata components
 KATA_TESTS_CACHEDIR="${KATA_TESTS_CACHEDIR:-${KATA_TESTS_BASEDIR}/cache}"
 
-KATA_HYPERVISOR="${KATA_HYPERVISOR:-qemu}"
+KATA_HYPERVISOR="${KATA_HYPERVISOR:-qemu-runtime-rs}"
 
 RUNTIME="${RUNTIME:-containerd-shim-kata-v2}"
 
@@ -644,7 +644,7 @@ function overwrite_containerd_config() {
 	drop_in="${conf_dir}/50-kata-containers-ci.toml"
 
 	schema="$(_containerd_resolved_schema_version)"
-	hv="${KATA_HYPERVISOR:-qemu}"
+	hv="${KATA_HYPERVISOR:-qemu-runtime-rs}"
 	cfg_path="${KATA_CONFIG_PATH:-/opt/kata/share/defaults/kata-containers/configuration-${hv}.toml}"
 	shim_binary="$(command -v "containerd-shim-kata-${hv}-v2" 2>/dev/null || true)"
 	[[ -n "${shim_binary}" ]] || shim_binary="/usr/local/bin/containerd-shim-kata-${hv}-v2"
@@ -812,7 +812,7 @@ function check_containerd_config_for_kata() {
 	declare -r containerd_path="/etc/containerd/config.toml"
 	local hv dump
 
-	hv="${KATA_HYPERVISOR:-qemu}"
+	hv="${KATA_HYPERVISOR:-qemu-runtime-rs}"
 
 	dump="$(PATH="${PATH}:/usr/local/bin:/usr/local/sbin" containerd config dump 2>/dev/null || true)"
 

tests/functional/kata-deploy/kata-deploy-custom-runtimes.bats

@@ -341,7 +341,7 @@ customRuntimes:
   enabled: true
   runtimes:
     ${CUSTOM_RUNTIME_NAME}:
-      baseConfig: "${KATA_HYPERVISOR:-qemu}"
+      baseConfig: "${KATA_HYPERVISOR:-qemu-runtime-rs}"
       dropIn: |
         [agent.kata]
         dial_timeout = 999

tests/gha-run-k8s-common.sh

@@ -1069,8 +1069,9 @@ function helm_helper() {
 	# Creates a simple verification pod that runs with the Kata runtime
 	local helm_set_file_args=""
 	if [[ "${HELM_VERIFY_DEPLOYMENT}" == "true" ]]; then
-		# Determine runtime class from HELM_DEFAULT_SHIM or default to kata-qemu
-		local runtime_class="kata-qemu"
+		# Determine runtime class from HELM_DEFAULT_SHIM, otherwise fall back to
+		# the chart's default shim (Rust runtime since the 4.0 release).
+		local runtime_class="kata-qemu-runtime-rs"
 		if [[ -n "${HELM_DEFAULT_SHIM}" ]]; then
 			runtime_class="kata-${HELM_DEFAULT_SHIM}"
 		fi

tests/integration/cri-containerd/integration-tests.sh

@@ -26,7 +26,7 @@ export PATH="${PATH}:/usr/local/go/bin"
 export CGROUP_DRIVER=""
 
 # Runtime to be used for testing
-KATA_HYPERVISOR="${KATA_HYPERVISOR:-qemu}"
+KATA_HYPERVISOR="${KATA_HYPERVISOR:-qemu-runtime-rs}"
 RUNTIME=${RUNTIME:-containerd-shim-kata-${KATA_HYPERVISOR}-v2}
 FACTORY_TEST=${FACTORY_TEST:-""}
 ARCH=$(uname -m)

tests/integration/kubernetes/confidential_kbs.sh

@@ -18,7 +18,7 @@ source "${kubernetes_dir}/../../../tools/packaging/guest-image/lib_se.sh"
 # For kata-runtime
 export PATH="${PATH}:/opt/kata/bin"
 
-KATA_HYPERVISOR="${KATA_HYPERVISOR:-qemu}"
+KATA_HYPERVISOR="${KATA_HYPERVISOR:-qemu-runtime-rs}"
 # Only the Attestation Service reaches out to the public Intel DCAP collateral
 # endpoint (api.trustedservices.intel.com) when verifying TDX quotes, so on the
 # Intel TDX CI runner it needs the corporate HTTPS proxy. HTTP_PROXY is

tests/integration/kubernetes/gha-run.sh

@@ -24,7 +24,7 @@ export DOCKER_REGISTRY="${DOCKER_REGISTRY:-quay.io}"
 export DOCKER_REPO="${DOCKER_REPO:-kata-containers/kata-deploy-ci}"
 export DOCKER_TAG="${DOCKER_TAG:-kata-containers-latest}"
 export SNAPSHOTTER_DEPLOY_WAIT_TIMEOUT="${SNAPSHOTTER_DEPLOY_WAIT_TIMEOUT:-8m}"
-export KATA_HYPERVISOR="${KATA_HYPERVISOR:-qemu}"
+export KATA_HYPERVISOR="${KATA_HYPERVISOR:-qemu-runtime-rs}"
 export CONTAINER_RUNTIME="${CONTAINER_RUNTIME:-containerd}"
 export KBS="${KBS:-false}"
 export KBS_INGRESS="${KBS_INGRESS:-}"

tests/integration/kubernetes/k8s-confidential-attestation.bats

@@ -10,7 +10,7 @@ load "${BATS_TEST_DIRNAME}/confidential_common.sh"
 
 export KBS="${KBS:-false}"
 export test_key="aatest"
-export KATA_HYPERVISOR="${KATA_HYPERVISOR:-qemu}"
+export KATA_HYPERVISOR="${KATA_HYPERVISOR:-qemu-runtime-rs}"
 export RUNTIME_CLASS_NAME="kata-${KATA_HYPERVISOR}"
 export AA_KBC="${AA_KBC:-cc_kbc}"
 

tests/integration/kubernetes/k8s-nvidia-cuda.bats

@@ -8,7 +8,7 @@
 load "${BATS_TEST_DIRNAME}/lib.sh"
 load "${BATS_TEST_DIRNAME}/confidential_common.sh"
 
-export KATA_HYPERVISOR="${KATA_HYPERVISOR:-qemu-nvidia-gpu}"
+export KATA_HYPERVISOR="${KATA_HYPERVISOR:-qemu-nvidia-gpu-runtime-rs}"
 
 TEE=false
 if is_confidential_gpu_hardware; then

tests/integration/kubernetes/k8s-nvidia-nim-service.bats

@@ -9,7 +9,7 @@
 load "${BATS_TEST_DIRNAME}/lib.sh"
 load "${BATS_TEST_DIRNAME}/confidential_common.sh"
 
-export KATA_HYPERVISOR="${KATA_HYPERVISOR:-qemu-nvidia-gpu}"
+export KATA_HYPERVISOR="${KATA_HYPERVISOR:-qemu-nvidia-gpu-runtime-rs}"
 
 TEE=false
 if is_confidential_gpu_hardware; then

tests/integration/kubernetes/k8s-nvidia-nim.bats

@@ -8,7 +8,7 @@
 load "${BATS_TEST_DIRNAME}/lib.sh"
 load "${BATS_TEST_DIRNAME}/confidential_common.sh"
 
-export KATA_HYPERVISOR="${KATA_HYPERVISOR:-qemu-nvidia-gpu}"
+export KATA_HYPERVISOR="${KATA_HYPERVISOR:-qemu-nvidia-gpu-runtime-rs}"
 
 # when using hostPath, ensure directory is writable by container user
 export LOCAL_NIM_CACHE="/opt/nim/.cache"

tests/integration/kubernetes/k8s-sealed-secret.bats

@@ -11,7 +11,7 @@ load "${BATS_TEST_DIRNAME}/lib.sh"
 load "${BATS_TEST_DIRNAME}/confidential_common.sh"
 
 export KBS="${KBS:-false}"
-export KATA_HYPERVISOR="${KATA_HYPERVISOR:-qemu}"
+export KATA_HYPERVISOR="${KATA_HYPERVISOR:-qemu-runtime-rs}"
 export AA_KBC="${AA_KBC:-cc_kbc}"
 
 setup() {

tests/integration/kubernetes/run_kubernetes_nv_tests.sh

@@ -79,7 +79,7 @@ else
 fi
 
 SUPPORTED_HYPERVISORS=("qemu-nvidia-gpu" "qemu-nvidia-gpu-snp" "qemu-nvidia-gpu-tdx" "qemu-nvidia-gpu-runtime-rs" "qemu-nvidia-gpu-snp-runtime-rs" "qemu-nvidia-gpu-tdx-runtime-rs")
-export KATA_HYPERVISOR="${KATA_HYPERVISOR:-qemu-nvidia-gpu}"
+export KATA_HYPERVISOR="${KATA_HYPERVISOR:-qemu-nvidia-gpu-runtime-rs}"
 # shellcheck disable=SC2076 # intentionally use literal string matching
 if [[ ! " ${SUPPORTED_HYPERVISORS[*]} " =~ " ${KATA_HYPERVISOR} " ]]; then
 	die "Unsupported KATA_HYPERVISOR=${KATA_HYPERVISOR}. Must be one of: ${SUPPORTED_HYPERVISORS[*]}"

tests/integration/kubernetes/run_kubernetes_tests.sh

@@ -25,7 +25,7 @@ cleanup() {
 trap cleanup EXIT
 
 TARGET_ARCH="${TARGET_ARCH:-x86_64}"
-KATA_HYPERVISOR="${KATA_HYPERVISOR:-qemu}"
+KATA_HYPERVISOR="${KATA_HYPERVISOR:-qemu-runtime-rs}"
 K8S_TEST_DEBUG="${K8S_TEST_DEBUG:-false}"
 K8S_TEST_HOST_TYPE="${K8S_TEST_HOST_TYPE:-small}"
 # Setting to "yes" enables fail fast, stopping execution at the first failed test.

tests/integration/nydus/nydus_tests.sh

@@ -15,7 +15,7 @@ dir_path=$(dirname "$0")
 # shellcheck source=/dev/null
 source "${dir_path}/../../common.bash"
 source "/etc/os-release" || source "/usr/lib/os-release"
-KATA_HYPERVISOR="${KATA_HYPERVISOR:-qemu}"
+KATA_HYPERVISOR="${KATA_HYPERVISOR:-qemu-runtime-rs}"
 
 need_restore_kata_config=false
 kata_config_backup="/tmp/kata-configuration.toml"

tests/stability/common_stability.bash

@@ -14,7 +14,7 @@ CTR_EXE="${CTR_EXE:-ctr}"
 DOCKER_EXE="${DOCKER_EXE:-docker}"
 CTR_RUNTIME="${CTR_RUNTIME:-io.containerd.kata.v2}"
 RUNTIME="${RUNTIME:-containerd-shim-kata-v2}"
-KATA_HYPERVISOR="${KATA_HYPERVISOR:-qemu}"
+KATA_HYPERVISOR="${KATA_HYPERVISOR:-qemu-runtime-rs}"
 
 http_proxy="${http_proxy:-}"
 https_proxy="${https_proxy:-}"

tests/stability/soak_parallel_rm.sh

@@ -43,7 +43,7 @@ VC_POD_DIR="${VC_POD_DIR:-/run/vc/sbs}"
 # then just set this to a very large number
 MAX_CONTAINERS="${MAX_CONTAINERS:-110}"
 
-KATA_HYPERVISOR="${KATA_HYPERVISOR:-qemu}"
+KATA_HYPERVISOR="${KATA_HYPERVISOR:-qemu-runtime-rs}"
 
 function check_vsock_active() {
 	vsock_configured=$("${RUNTIME_PATH}" kata-env | awk '/UseVSock/ {print $3}')

tools/packaging/kata-deploy/binary/src/config.rs

@@ -243,7 +243,8 @@ impl Config {
             .map(|s| s.to_string())
             .collect();
 
-        let default_shim_for_arch = get_arch_var("DEFAULT_SHIM", "qemu", &arch);
+        let default_shim_for_arch =
+            get_arch_var("DEFAULT_SHIM", get_default_shim_for_arch(&arch), &arch);
 
         // Only use arch-specific variable for allowed hypervisor annotations
         let allowed_hypervisor_annotations_for_arch =
@@ -894,6 +895,21 @@ fn get_default_shims_for_arch(arch: &str) -> &'static str {
     }
 }
 
+/// Get the default shim for a specific architecture.
+///
+/// Since the Kata Containers 4.0 release, the Rust runtime (runtime-rs,
+/// "qemu-runtime-rs") is the default wherever a runtime-rs build exists.
+/// ppc64le has no runtime-rs build yet, so it keeps the Go runtime ("qemu").
+/// This only acts as a fallback: the Helm chart normally provides DEFAULT_SHIM
+/// explicitly via values.yaml (`defaultShim`).
+fn get_default_shim_for_arch(arch: &str) -> &'static str {
+    match arch {
+        "x86_64" | "aarch64" | "s390x" => "qemu-runtime-rs",
+        "ppc64le" => "qemu",
+        _ => "qemu", // Fallback to the Go runtime for unknown architectures
+    }
+}
+
 /// Get architecture-specific variable (e.g., SHIMS_X86_64)
 /// Falls back to provided default if arch-specific variable is not found or empty
 fn get_arch_var(base_name: &str, default: &str, arch: &str) -> String {
@@ -1037,6 +1053,16 @@ mod tests {
         cleanup_env_vars();
     }
 
+    #[rstest]
+    #[case("x86_64", "qemu-runtime-rs")]
+    #[case("aarch64", "qemu-runtime-rs")]
+    #[case("s390x", "qemu-runtime-rs")]
+    #[case("ppc64le", "qemu")]
+    #[case("riscv64", "qemu")]
+    fn test_get_default_shim_for_arch(#[case] arch: &str, #[case] expected: &str) {
+        assert_eq!(get_default_shim_for_arch(arch), expected);
+    }
+
     #[serial]
     #[test]
     fn test_get_arch_var() {

tools/packaging/kata-deploy/helm-chart/kata-deploy/values.yaml

@@ -720,10 +720,17 @@ shims:
       noProxy: ""
 
 # Default shim per architecture
+#
+# Since the Kata Containers 4.0 release, the Rust runtime (runtime-rs,
+# "qemu-runtime-rs") is the default on every architecture that ships a
+# runtime-rs build. ppc64le has no runtime-rs build yet, so it stays on the
+# Go runtime ("qemu"). The Go runtime remains supported (no new features are
+# being added) and selectable (e.g. RuntimeClass "kata-qemu"); see the
+# deprecation notice in docs/migrating-config-go-runtime-to-runtime-rs.md.
 defaultShim:
-  amd64: qemu
-  arm64: qemu
-  s390x: qemu
+  amd64: qemu-runtime-rs
+  arm64: qemu-runtime-rs
+  s390x: qemu-runtime-rs
   ppc64le: qemu
 
 runtimeClasses: