VirtConsole 3.3.8

VirtConsole 3.3.8 makes the panel read like plain language. Placement results say how to make a node eligible, and task and activity names are readable everywhere. It also brings together everything shipped since 3.3.7: IPsec site-to-site VPN, VPC networking that scales to hundreds of nodes, placement policies, a guest nesting policy and local LVM and ZFS volumes.

Placement results that tell you what to do

The admin placement preview lists every node that was left out of a deployment and why. Each excluded node carries a short label and one sentence on how to make it eligible.

• A badge such as GPU not enabled, No free IPv4 or Missing required tag stands in for the reason code, and the code stays available as a tooltip.
• The hint points at the setting to change: the location’s Compute tab for GPU, the node’s storage pools, the subnet bridge, or the policy’s required tags.

Readable labels on every screen

Statuses, states, activity names, task names and deploy steps show as sentences instead of internal codes, in the admin panel and in the customer panel.

• Tasks carry a readable name alongside their type, with customer-friendly wording in the customer panel.
• The activity log, the dashboard audit feed and the admin action log show readable event names, and the deploy terminal and task logs show step text, Kubernetes steps included.
• Status, HA, Kubernetes phase, storage pool and migration state values use one shared vocabulary across pages.

Migrations

• Live and cold migrations stream over the nodes’ private addresses when both nodes have one, and use the public address otherwise.
• Backup destination forms validate rsync settings as you save them, in the admin panel and on the admin API.

IPsec site-to-site VPN

A VPN gateway can carry IPsec tunnels next to its WireGuard peers, so a VPC can connect to a firewall, router or cloud VPN service that speaks IPsec.

• Add connections from an IPsec tab on the gateway, in the customer panel and the admin panel, with presets for modern IKEv2 devices, older compatibility devices (IKEv1 included) and custom proposals.
• Each connection shows its live status: established or not, child tunnels, bytes in and out, and the last error.
• Remote networks become managed routes in the VPC, and a remote settings sheet gives the other side everything it needs, with a route hint per subnet.
• The pre-shared key is shown once when you create the connection, is stored encrypted and is write-only on the API.
• The gateway image ships with strongSwan built in, and Proxmox VE nodes are supported as well as KVM.
• The user API, the admin API, the OpenTofu provider and the MCP server all cover IPsec connections.

VPC networking at scale

VXLAN VPC networking is ready for fleets of hundreds of nodes.

• Each hypervisor group has a broadcast and multicast limit per guest, 2000 packets per second by default and adjustable per group.
• A group can move between multicast and unicast transport in staged steps from the admin group page, and a staged transition can be cancelled before it cuts over.
• Membership follows migrations, so a moving instance keeps its connectivity from admission to completion.

Placement policies

Every automatic node choice goes through one placement service with policies you set per account, plan, location or globally.

• Balanced, Packed and Dedicated policies, with weights for RAM, vCPU, storage and load.
• Node tags for dedicated hardware, and a node weight to drain a node softly while its deployment switch stays the hard gate.
• Instances, databases, load balancers, VPN gateways, sandboxes and Kubernetes nodes use the same ranking; database replicas avoid the primary’s node and Kubernetes control planes spread across nodes.
• Each placement records a decision log, and the placement preview shows the outcome before you deploy.

Guest nesting policy

Nested virtualization is a per-group choice you can allow or deny.

• Nodes report whether they can honour the policy, and new guests are placed only on nodes that can.
• A running guest is never touched by a policy change; instance lists show a Pending cold restart badge until it is stopped and started.

Storage and backups

• Standalone volumes can live on local LVM and ZFS pools, with create, resize, attach, detach, delete, backup and restore, and the admin volume plan picker offers both backends.
• A storage pool tagged any serves plans of every class, and a plan asking for any class matches every pool.
• Backups record each disk’s virtual size, and restore to a new instance creates the disk at that size.

Object storage

• Bucket names are unique across the whole platform and follow AWS naming rules on every create surface, and a deleted name stays reserved.
• Share links are time-limited signed download links, with an expiry from one minute to seven days.
• The user API can delete access keys, the admin S3 server list shows cluster status, and servers with self-signed certificates have a TLS verification setting.

Networking and security groups

• Revoking a security group rule also ends existing sessions from that address.
• Rule forms offer only sources the account can use and have a Ports selector: all ports, a single port or a range.

Access and operations

• Account owners can narrow or widen a team member’s role per project. Overrides cover instances and their volumes, VPCs, load balancers, object storage buckets, databases, Kubernetes, SSH keys and scripts, and apply to lists, search, dashboards, metrics, backups and live channels.
• Fleet alerts raise an incident when a node stops running its scheduled work.
• vc-diagnose.sh is a read-only host check for masters and nodes. It reports PASS, WARN and FAIL with a suggested step for each finding, and writes a redacted log for support.
• Instance power actions and noVNC show a pending state until the node answers.
• The customer sidebar has a menu filter box.
• Git deploy keys can be replaced from the source edit form, and a blank field keeps the stored key.

Kubernetes

• Kubernetes clusters created on 3.3.8 record an API server audit log. Changes to roles and role bindings are recorded with their content, and sensitive objects such as ConfigMaps, tokens and certificate requests are recorded by metadata only, never their content.
• Audit logs rotate at 100 MiB, keep 10 compressed files and are kept for 30 days.

Proxmox

Windows guests on Proxmox VE get the same first-boot script as KVM and have their Administrator password set at first boot.

Thanks for building on VirtConsole. Questions along the way, reach us any time.