KubeVirt

v1.9.0Orchestration & Management

Jul 30, 2026Copy link

KubeVirt v1.9.0 is a major feature release addressing two CVEs (spdystream, gRPC) and implementing significant structural changes: Beta feature gates are now enabled by default, network interface binding validation is stricter, VirtualMachineBackup conditions are simplified, and cgroup v1 is deprecated pending removal. The release includes numerous graduated feature gates, bug fixes (ARM64 GPU passthrough, hotplug deadlock, NFS storage, gRPC leak), live migration compression, and incremental backup improvements.

• securityspdystream dependency security update (CVE-2026-35469, GHSA-pc3f-x583-g7j2)

  github.com/moby/spdystream bumped from v0.5.0 to v0.5.1 (CVE-2026-35469, GHSA-pc3f-x583-g7j2). Applies unconditionally to all deployments.

• securitygRPC security fix (CVE-2026-33186)

  grpc bumped to 1.79.3 to remediate CVE-2026-33186. Applies unconditionally to all deployments.

• breakingNetwork interface binding validation tightened

  Network interface bindings with no binding or multiple bindings are now rejected at admission time instead of silently failing at runtime. Applies if you use network interface bindings in your VirtualMachine specs.

• breakingBeta feature gates enabled by default

  All Beta feature gates are now enabled by default in v1.9.0. Opt out of specific Beta features by adding their names to spec.configuration.developerConfiguration.disabledFeatureGates in the KubeVirt CR.

• breakingInstall-strategy job name changed

  Install-strategy job names changed from kubevirt-<id>-job to virt-operator-install-strategy-. Applies to any tooling or monitoring that depends on the old job naming pattern.

• breakingVirtualMachineBackup conditions simplified

  VirtualMachineBackup condition types have been reduced from five (Initializing, ExportInitiated, ExportReady, Aborting, Done) to three (Progressing, Complete, Failed) with new reason values. Applies if you parse or check VirtualMachineBackup status.conditions.

• breakingVNC/screenshot removed from kubevirt.io:edit ClusterRole

  vnc and screenshot subresource access removed from the kubevirt.io:edit ClusterRole. Applies if RBAC policies or custom roles depend on those permissions in the edit role.

• breakingcgroup v1 deprecated, removal planned

  cgroup v1 support is deprecated in v1.9.0 with removal planned for the next major release. Migrate to cgroup v2 before the next release.

• breakingRecording rules and metrics renamed; two metrics removed entirely

  kubevirt_vm_created_total recording rule and kubevirt_vm_created_by_pod_total metric are deprecated completely. Multiple other recording rules renamed for consistency with naming conventions; update Prometheus/Grafana dashboards and alerts accordingly.