feat: add hyperv-guest-agent extension

.github/renovate.json

@@ -109,6 +109,12 @@
             "matchPackageNames": [
                 "https://gitlab.nic.cz/labs/bird.git"
             ]
+        },
+        {
+            "allowedVersions": "< 6.19",
+            "matchPackageNames": [
+                "git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
+            ]
         }
     ],
     "separateMajorMinor": false,

.kres.yaml

@@ -27,6 +27,7 @@ spec:
     - hailort
     - harbor-credential-provider
     - hello-world-service
+    - hyperv-guest-agent
     - i915
     - intel-ice-firmware
     - intel-npu
@@ -346,3 +347,6 @@ spec:
     - matchPackageNames:
         - https://gitlab.nic.cz/labs/bird.git
       allowedVersions: "< 3.0.0"
+    - matchPackageNames:
+        - git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
+      allowedVersions: "< 6.19"

MAINTAINERS.md

@@ -29,6 +29,7 @@ If the field is marked as `Needs Maintainer`, it means that the package is curre
 | gvisor                                    | Sidero Labs        | NA                                                                                       |
 | gvisor-debug                              | Sidero Labs        | NA                                                                                       |
 | hello-world-service                       | Sidero Labs        | NA                                                                                       |
+| hyperv-guest-agent                        | Ryan VanGundy      | [rmvangun](https://github.com/rmvangun)                                                  |
 | i915                                      | Sidero Labs        | NA                                                                                       |
 | intel-ice-firmware                        | Sidero Labs        | NA                                                                                       |
 | intel-ucode                               | Sidero Labs        | NA                                                                                       |

Makefile

@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED BY KRES, PLEASE DO NOT EDIT.
 #
-# Generated on 2026-07-06T09:25:33Z by kres 14a38a3.
+# Generated on 2026-07-10T06:48:56Z by kres d66531d.
 
 # common variables
 
@@ -89,6 +89,7 @@ TARGETS += gvisor-debug
 TARGETS += hailort
 TARGETS += harbor-credential-provider
 TARGETS += hello-world-service
+TARGETS += hyperv-guest-agent
 TARGETS += i915
 TARGETS += intel-ice-firmware
 TARGETS += intel-npu

README.md

@@ -172,6 +172,7 @@ tiers based on support level:
 
 | Name | Tier | Image | Version | Description |
 | ---- | ---- | ----- | ------- | ----------- |
+| [hyperv-guest-agent](guest-agents/hyperv-guest-agent) | :yellow_square: extra | [ghcr.io/siderolabs/hyperv-guest-agent](https://github.com/siderolabs/extensions/pkgs/container/hyperv-guest-agent) | `6.18.38` |  This system extension provides the Hyper-V guest integration daemons: hv_kvp_daemon, which reports the guest IP, hostname, and OS to the host (populating Get-VMNetworkAdapter), and hv_vss_daemon, for application-consistent checkpoints. |
 | [metal-agent](guest-agents/metal-agent) | :green_square: core | [ghcr.io/siderolabs/metal-agent](https://github.com/siderolabs/extensions/pkgs/container/metal-agent) | `v0.1.5` |  This system extension provides talos-metal-agent |
 | [qemu-guest-agent](guest-agents/qemu-guest-agent) | :yellow_square: extra | [ghcr.io/siderolabs/qemu-guest-agent](https://github.com/siderolabs/extensions/pkgs/container/qemu-guest-agent) | `11.0.1` |  This system extension provides the QEMU Guest Agent service. |
 | [vmtoolsd-guest-agent](guest-agents/vmtoolsd-guest-agent) | :yellow_square: extra | [ghcr.io/siderolabs/vmtoolsd-guest-agent](https://github.com/siderolabs/extensions/pkgs/container/vmtoolsd-guest-agent) | `v1.5.0` |  This system extension provides talos-vmtoolsd |

guest-agents/hyperv-guest-agent/README.md

@@ -0,0 +1,73 @@
+# hyperv-guest-agent extension
+
+This system extension provides the Hyper-V Linux guest integration daemons from the
+kernel's `tools/hv` tree, run as Talos [extension services](https://docs.siderolabs.com/talos/v1.12/build-and-extend-talos/custom-images-and-development/extension-services):
+
+| Service | Binary | Purpose |
+| --- | --- | --- |
+| `ext-hyperv-kvp` | `hv_kvp_daemon` | Key-Value Pair exchange — reports guest IPv4/IPv6, hostname, and OS details to the host so `Get-VMNetworkAdapter` is populated |
+| `ext-hyperv-vss` | `hv_vss_daemon` | VSS — freezes/thaws the data partition so Hyper-V can take application-consistent checkpoints |
+
+Talos already ships the kernel side (`hv_vmbus`, `hv_utils`); this extension adds the
+missing user-space daemons. The daemons are statically linked against the base toolchain
+and require no shared libraries at runtime.
+
+## Prerequisites
+
+The daemons attach to `/dev/vmbus/hv_kvp` and `/dev/vmbus/hv_vss`, which are created by the
+`hv_utils` kernel module. Make sure the corresponding integration services are enabled on
+the VM (on the Hyper-V host):
+
+```powershell
+Enable-VMIntegrationService -VMName '<vm-name>' -Name 'Key-Value Pair Exchange'
+Enable-VMIntegrationService -VMName '<vm-name>' -Name 'VSS'
+```
+
+If `hv_utils` is not auto-loaded on your Talos version, add it via machine config:
+
+```yaml
+machine:
+  kernel:
+    modules:
+      - name: hv_utils
+```
+
+## Installation
+
+See [Installing Extensions](https://github.com/siderolabs/extensions#installing-extensions).
+
+## Testing
+
+Confirm the extension services are running:
+
+```bash
+$ talosctl -n <node> service ext-hyperv-kvp
+NODE     <node>
+ID       ext-hyperv-kvp
+STATE    Running
+HEALTH   ?
+EVENTS   [Running]: Started task ext-hyperv-kvp ...
+```
+
+```bash
+$ talosctl -n <node> logs ext-hyperv-kvp
+```
+
+On the Hyper-V host, the guest IP should now be reported:
+
+```powershell
+Get-VMNetworkAdapter -VMName '<vm-name>' | Select-Object -ExpandProperty IPAddresses
+```
+
+## Notes & limitations
+
+- **DNS/DHCP reporting is best-effort.** `hv_kvp_daemon` shells out to the distro helper
+  scripts `hv_get_dns_info` / `hv_get_dhcp_info` to report DNS servers and DHCP status to
+  the host. Those scripts are not shipped, so those two fields stay empty; IP address,
+  hostname, and OS reporting are unaffected (they come from the kernel/sysfs, not the
+  helpers).
+- **Host → guest IP injection is not supported.** The KVP feature that lets the host push a
+  static IP into the guest relies on the same (unshipped) helper scripts and a writeable
+  network-config path; Talos networking is managed by machine config instead.
+- **VSS freezes the `/var` (ephemeral) partition.** The read-only squashfs root needs no
+  freeze. Validate checkpoint consistency against your workload before relying on it.

guest-agents/hyperv-guest-agent/hyperv-kvp.yaml

@@ -0,0 +1,45 @@
+name: hyperv-kvp
+# The KVP daemon talks to the kernel over /dev/vmbus/hv_kvp, which only exists once
+# the hv_utils module is loaded and the "Key-Value Pair Exchange" integration service
+# is enabled on the VM. Gate startup on that device node.
+depends:
+  - path: /dev/vmbus/hv_kvp
+  # Start after the node has addresses so the first report to the host is complete
+  # (the daemon re-reports on each host poll regardless).
+  - network:
+      - addresses
+container:
+  entrypoint: ./hv_kvp_daemon
+  # -n / --no-daemon: stay in the foreground so the extension service supervises it.
+  args:
+    - -n
+  security:
+    writeableRootfs: false
+  mounts:
+    # /dev/vmbus/hv_kvp char device (rshared so the node is visible if it appears
+    # after the container starts; matches the qemu-guest-agent / zfs pattern).
+    - source: /dev
+      destination: /dev
+      type: bind
+      options:
+        - rshared
+        - rbind
+        - rw
+    # Network interface and MAC enumeration for the IP/hostname report.
+    - source: /sys
+      destination: /sys
+      type: bind
+      options:
+        - rbind
+        - ro
+    # Writeable location for the KVP pool files (.kvp_pool_0..3). The daemon's
+    # compiled-in KVP_CONFIG_LOC is /var/lib/hyperv; bind it to /run so state
+    # stays ephemeral and we do not patch upstream paths.
+    - source: /run/hyperv-kvp
+      destination: /var/lib/hyperv
+      type: bind
+      options:
+        - rshared
+        - rbind
+        - rw
+restart: always

guest-agents/hyperv-guest-agent/hyperv-vss.yaml

@@ -0,0 +1,36 @@
+name: hyperv-vss
+# The VSS daemon talks to the kernel over /dev/vmbus/hv_vss, which only exists once
+# the hv_utils module is loaded and the "Backup (volume checkpoint)" integration
+# service is enabled on the VM. Gate startup on that device node.
+depends:
+  - path: /dev/vmbus/hv_vss
+container:
+  entrypoint: ./hv_vss_daemon
+  # -n / --no-daemon: stay in the foreground so the extension service supervises it.
+  args:
+    - -n
+  security:
+    # Share mount propagation with the host (same pattern as the zfs extension) so
+    # the FIFREEZE/FITHAW the daemon issues act on the real host filesystems. FIFREEZE
+    # operates on the filesystem superblock, which a bind-mount shares with the host;
+    # the read-only squashfs root needs no freeze, so the mutable /var partition is
+    # the meaningful freeze target for an application-consistent checkpoint.
+    rootfsPropagation: shared
+  mounts:
+    # /dev/vmbus/hv_vss char device.
+    - source: /dev
+      destination: /dev
+      type: bind
+      options:
+        - rshared
+        - rbind
+        - rw
+    # Mutable data partition — frozen/thawed during a Hyper-V checkpoint.
+    - source: /var
+      destination: /var
+      type: bind
+      options:
+        - rshared
+        - rbind
+        - rw
+restart: always

guest-agents/hyperv-guest-agent/manifest.yaml.tmpl

@@ -0,0 +1,12 @@
+version: v1alpha1
+metadata:
+  name: hyperv-guest-agent
+  version: "{{ .VERSION }}"
+  author: Ryan VanGundy
+  description: |
+    [{{ .TIER }}] This system extension provides the Hyper-V guest integration daemons:
+    hv_kvp_daemon, which reports the guest IP, hostname, and OS to the host (populating
+    Get-VMNetworkAdapter), and hv_vss_daemon, for application-consistent checkpoints.
+  compatibility:
+    talos:
+      version: ">= v1.10.0"

guest-agents/hyperv-guest-agent/pkg.yaml

@@ -0,0 +1,58 @@
+name: hyperv-guest-agent
+variant: scratch
+shell: /bin/bash
+dependencies:
+  - stage: base
+steps:
+  # hv_kvp_daemon and hv_vss_daemon are the upstream Linux Hyper-V integration
+  # daemons that live in the kernel tree under tools/hv. They are plain C with no
+  # dependencies beyond libc, so they are extracted from the official kernel.org
+  # release tarball (checksum-verified) and linked statically against the base
+  # toolchain — the same model qemu-guest-agent uses for a static guest agent.
+  - sources:
+      - url: https://www.kernel.org/pub/linux/kernel/v6.x/linux-{{ .LINUX_HV_VERSION }}.tar.xz
+        destination: linux.tar.xz
+        sha256: {{ .LINUX_HV_TARBALL_SHA256 }}
+        sha512: {{ .LINUX_HV_TARBALL_SHA512 }}
+    prepare:
+      - |
+        set -euo pipefail
+        tar -xf linux.tar.xz --strip-components=3 \
+          linux-{{ .LINUX_HV_VERSION }}/tools/hv/hv_kvp_daemon.c \
+          linux-{{ .LINUX_HV_VERSION }}/tools/hv/hv_vss_daemon.c
+        rm linux.tar.xz
+    build:
+      - |
+        set -euo pipefail
+        gcc -Os -static -o hv_kvp_daemon hv_kvp_daemon.c
+        gcc -Os -static -o hv_vss_daemon hv_vss_daemon.c
+    install:
+      - |
+        set -euo pipefail
+        kvp_root=/rootfs/usr/local/lib/containers/hyperv-kvp
+        vss_root=/rootfs/usr/local/lib/containers/hyperv-vss
+        mkdir -p "${kvp_root}" "${vss_root}" /rootfs/usr/local/etc/containers
+
+        install -m 0755 hv_kvp_daemon "${kvp_root}/hv_kvp_daemon"
+        install -m 0755 hv_vss_daemon "${vss_root}/hv_vss_daemon"
+
+        cp /pkg/hyperv-kvp.yaml /rootfs/usr/local/etc/containers/
+        cp /pkg/hyperv-vss.yaml /rootfs/usr/local/etc/containers/
+    test:
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
+    sbom:
+      outputPath: /rootfs/usr/local/share/spdx/hyperv-guest-agent.spdx.json
+      version: {{ .LINUX_HV_VERSION }}
+      cpes:
+        - cpe:2.3:o:linux:linux_kernel:{{ .LINUX_HV_VERSION }}:*:*:*:*:*:*:*
+      licenses:
+        - GPL-2.0
+finalize:
+  - from: /rootfs
+    to: /rootfs
+  - from: /pkg/manifest.yaml
+    to: /

guest-agents/hyperv-guest-agent/vars.yaml

@@ -0,0 +1,2 @@
+VERSION: "{{ .LINUX_HV_VERSION }}"
+TIER: "extra"

guest-agents/vars.yaml

@@ -18,3 +18,7 @@ XEN_GUEST_AGENT_SHA512: 49bf15d7257f7fcb5ac919ca57e8c16bb6f8199684adef034bd1e768
 TALOS_VMTOOLSD_VERSION: v1.5.0
 # renovate: datasource=github-releases depName=siderolabs/talos-metal-agent
 TALOS_METAL_AGENT_VERSION: v0.1.5
+# renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ depName=git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
+LINUX_HV_VERSION: 6.18.38
+LINUX_HV_TARBALL_SHA256: ac26e508abd56e9f8b89872b6e10c49fc823bcc70d8068a5d8504c1a7c4ff045
+LINUX_HV_TARBALL_SHA512: c3e7bdd4e8cbd33282f29f0b4c11a707748f4785b9b301fcd93a1424a0989661c4499d1c8ffe15fa224175ea551a97bdddf3db7c1d7ad9b3e3a94dec0372cf37