deckhouse · deckhouse-BOaTswain · Jul 7, 2026
@@ -0,0 +1,179 @@
+api:
+  features:
+    - summary: >-
+        Add the Superseded phase for VirtualMachineOperation resources interrupted by a newer
+        operation.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2492
+ci:
+  fixes:
+    - summary: Pin prometheus CRD schema downloads for kubeconform to a stable commit.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2590
+    - summary: >-
+        Fix e2e nested-cluster bootstrap race that made the affinity/toleration precheck fail with 0
+        KVM-enabled master nodes.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2587
+    - summary: Enable automatic node update approval in nested e2e cluster.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2575
+    - summary: Retry transient d8 v ssh/scp failures in e2e bootstrap steps.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2563
+    - summary: >-
+        Enable hotplug feature gates in the virtualization ModuleConfig on the nested e2e cluster so
+        hotplug CPU/memory prechecks stop failing in SynchronizedBeforeSuite.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2536
+    - summary: >-
+        Fix nested e2e NFS setup on the stage registry profile by using the deckhouse-prod module
+        source.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2507
+cli:
+  fixes:
+    - summary: >-
+        d8 v vnc --proxy-only now keeps the VNC proxy listener alive so external viewers can connect
+        to the printed port.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2526
+    - summary: >-
+        d8 ssh / d8 scp now use the local OpenSSH/SCP clients via ProxyCommand; pass extra client
+        options through a single --ssh-args flag and the command via --.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2442
+core:
+  features:
+    - summary: >-
+        Automatically restore VirtualImage and ClusterVirtualImage from the ImageLost phase once the
+        image reappears in DVCR, without re-importing the data.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2564
+  fixes:
+    - summary: >-
+        Fix virt-controller crash on nil pod during in-place resize that left VMs stuck in Pending
+        with no launcher pod on slow storage.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2588
+    - summary: Do not fail VM reconcile while a hotplug image is being attached via VMBDA.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2582
+    - summary: Do not fail VM reconcile while a hotplug image is being attached via VMBDA.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2574
+    - summary: >-
+        Fixed flapping of the VirtualMachineIPAddressReady condition when the VM had no guest-agent
+        IP.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2553
+    - summary: Preserve explicit enableParavirtualization=false value during VirtualMachine updates.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2505
+    - summary: >-
+        VirtualMachineClass: for cpu.type=Discovery recompute CPU features from the current nodes on
+        every reconcile (no stale cache) and separate the discovery nodeSelector pool (basis for the
+        universal CPU model) from schedulable nodes derived from spec.nodeSelector; for
+        cpu.type=Discovery and Features restore status.cpuFeatures.notEnabledCommon population.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2501
+    - summary: Prevent node placement updates from interrupting active VM volume migration.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2497
+    - summary: >-
+        Ignore stale USB ResourceClaimTemplate and USBDevice cleanup errors during VM USB device
+        reconciliation.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2453
+cvi:
+  fixes:
+    - summary: >-
+        ClusterVirtualImage status messages are clearer and no longer expose internal implementation
+        details.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2558
+disks:
+  features:
+    - summary: >-
+        VirtualDisk names may use the full Kubernetes name length instead of being capped at 60
+        characters.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2548
+images:
+  features:
+    - summary: >-
+        VirtualImage and ClusterVirtualImage names may use the full Kubernetes name length instead
+        of being capped at 49 and 48 characters.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2548
+  fixes:
+    - summary: >-
+        Upload endpoint now follows publicDomainTemplate changes instead of keeping the host it was
+        created with.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2527
+module:
+  features:
+    - summary: >-
+        Optional per-namespace authorization for DVCR (`dvcr.tenantRegistryAuthorization`) isolating
+        container image access between namespaces.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2586
+    - summary: >-
+        Limit concurrent inbound live migrations per target node, configurable via ModuleConfig
+        annotations.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2362
+  fixes:
+    - summary: Restricted unauthorized access to the virtualization USB/IP gateway port.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2571
+test:
+  features:
+    - summary: Add an interactive fzf helper for selecting and repeatedly running e2e suites.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2510
+  fixes:
+    - summary: E2E feature gate precheck errors now include kubectl patch command to enable missing gates.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2598
+    - summary: Poll the guest CPU count after a hotplug CPU change to avoid racing the guest.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2593
+    - summary: Reduce CPU and memory requests in the migration cancel e2e VM.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2592
+    - summary: Fix EnableParavirtualization pointer comparison in VM configuration e2e test.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2579
+vd:
+  fixes:
+    - summary: >-
+        VirtualDisk status messages are clearer and no longer expose internal implementation
+        details.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2558
+vdsnapshot:
+  fixes:
+    - summary: VirtualDiskSnapshot status messages have clearer wording.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2558
+vi:
+  fixes:
+    - summary: >-
+        VirtualImage status messages are clearer and no longer expose internal implementation
+        details.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2558
+vm:
+  features:
+    - summary: >-
+        Add hotplug CPU and memory via in-place resize (alpha, behind feature gate
+        HotplugCPUAndMemoryWithInPlaceResize).
+      pull_request: https://github.com/deckhouse/virtualization/pull/2247
+  fixes:
+    - summary: >-
+        VirtualMachine status messages are clearer and no longer expose internal implementation
+        details.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2558
+    - summary: >-
+        VirtualMachine creation without an explicit VM class now reports a clear error when no
+        default VirtualMachineClass is configured.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2534
+    - summary: >-
+        A VM can start again after a failed local-disk migration restart when `kvvmi` is already
+        deleted and migrated volumes, including VMBDA-attached volumes, must be restored from target
+        PVCs back to the current source PVCs.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2506
+    - summary: >-
+        Prevent Main-only virtual machines from requiring restart due to implicit default network
+        template synchronization.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2484
+    - summary: Fix hotplug volume cleanup after migration target pod termination.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2457
+    - summary: >-
+        VM pod volume error handling now includes FailedMapVolume and surfaces more complete pod
+        volume diagnostics.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2433
+    - summary: >-
+        Fallback CPU/memory hotplug updates to restart when project quota cannot fit migration-time
+        resources.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2419
+vmbda:
+  fixes:
+    - summary: >-
+        VirtualMachineBlockDeviceAttachment status messages are clearer and no longer expose
+        internal implementation details.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2558
+vmsnapshot:
+  fixes:
+    - summary: VirtualMachineSnapshot status messages have clearer wording.
+      pull_request: https://github.com/deckhouse/virtualization/pull/2558
+
@@ -0,0 +1,59 @@
+# Changelog v1.10
+
+## Features
+
+
+ - **[api]** Add the Superseded phase for VirtualMachineOperation resources interrupted by a newer operation. [#2492](https://github.com/deckhouse/virtualization/pull/2492)
+ - **[core]** Automatically restore VirtualImage and ClusterVirtualImage from the ImageLost phase once the image reappears in DVCR, without re-importing the data. [#2564](https://github.com/deckhouse/virtualization/pull/2564)
+ - **[disks]** VirtualDisk names may use the full Kubernetes name length instead of being capped at 60 characters. [#2548](https://github.com/deckhouse/virtualization/pull/2548)
+ - **[images]** VirtualImage and ClusterVirtualImage names may use the full Kubernetes name length instead of being capped at 49 and 48 characters. [#2548](https://github.com/deckhouse/virtualization/pull/2548)
+ - **[module]** Optional per-namespace authorization for DVCR (`dvcr.tenantRegistryAuthorization`) isolating container image access between namespaces. [#2586](https://github.com/deckhouse/virtualization/pull/2586)
+ - **[module]** Limit concurrent inbound live migrations per target node, configurable via ModuleConfig annotations. [#2362](https://github.com/deckhouse/virtualization/pull/2362)
+ - **[vm]** Add hotplug CPU and memory via in-place resize (alpha, behind feature gate HotplugCPUAndMemoryWithInPlaceResize). [#2247](https://github.com/deckhouse/virtualization/pull/2247)
+
+## Fixes
+
+
+ - **[core]** Do not fail VM reconcile while a hotplug image is being attached via VMBDA. [#2574](https://github.com/deckhouse/virtualization/pull/2574)
+ - **[core]** Fixed flapping of the VirtualMachineIPAddressReady condition when the VM had no guest-agent IP. [#2553](https://github.com/deckhouse/virtualization/pull/2553)
+ - **[core]** VirtualMachineClass: for cpu.type=Discovery recompute CPU features from the current nodes on every reconcile (no stale cache) and separate the discovery nodeSelector pool (basis for the universal CPU model) from schedulable nodes derived from spec.nodeSelector; for cpu.type=Discovery and Features restore status.cpuFeatures.notEnabledCommon population. [#2501](https://github.com/deckhouse/virtualization/pull/2501)
+ - **[cvi]** ClusterVirtualImage status messages are clearer and no longer expose internal implementation details. [#2558](https://github.com/deckhouse/virtualization/pull/2558)
+ - **[images]** Upload endpoint now follows publicDomainTemplate changes instead of keeping the host it was created with. [#2527](https://github.com/deckhouse/virtualization/pull/2527)
+ - **[module]** Restricted unauthorized access to the virtualization USB/IP gateway port. [#2571](https://github.com/deckhouse/virtualization/pull/2571)
+ - **[vd]** VirtualDisk status messages are clearer and no longer expose internal implementation details. [#2558](https://github.com/deckhouse/virtualization/pull/2558)
+ - **[vdsnapshot]** VirtualDiskSnapshot status messages have clearer wording. [#2558](https://github.com/deckhouse/virtualization/pull/2558)
+ - **[vi]** VirtualImage status messages are clearer and no longer expose internal implementation details. [#2558](https://github.com/deckhouse/virtualization/pull/2558)
+ - **[vm]** VirtualMachine status messages are clearer and no longer expose internal implementation details. [#2558](https://github.com/deckhouse/virtualization/pull/2558)
+ - **[vm]** VirtualMachine creation without an explicit VM class now reports a clear error when no default VirtualMachineClass is configured. [#2534](https://github.com/deckhouse/virtualization/pull/2534)
+ - **[vm]** A VM can start again after a failed local-disk migration restart when `kvvmi` is already deleted and migrated volumes, including VMBDA-attached volumes, must be restored from target PVCs back to the current source PVCs. [#2506](https://github.com/deckhouse/virtualization/pull/2506)
+ - **[vm]** Prevent Main-only virtual machines from requiring restart due to implicit default network template synchronization. [#2484](https://github.com/deckhouse/virtualization/pull/2484)
+ - **[vm]** Fix hotplug volume cleanup after migration target pod termination. [#2457](https://github.com/deckhouse/virtualization/pull/2457)
+ - **[vm]** VM pod volume error handling now includes FailedMapVolume and surfaces more complete pod volume diagnostics. [#2433](https://github.com/deckhouse/virtualization/pull/2433)
+ - **[vm]** Fallback CPU/memory hotplug updates to restart when project quota cannot fit migration-time resources. [#2419](https://github.com/deckhouse/virtualization/pull/2419)
+ - **[vmbda]** VirtualMachineBlockDeviceAttachment status messages are clearer and no longer expose internal implementation details. [#2558](https://github.com/deckhouse/virtualization/pull/2558)
+ - **[vmsnapshot]** VirtualMachineSnapshot status messages have clearer wording. [#2558](https://github.com/deckhouse/virtualization/pull/2558)
+
+## Chore
+
+
+ - **[core]** Fixed vulnerabilities:
+    - CVE-2026-25680
+    - CVE-2026-25681
+    - CVE-2026-27136
+    - CVE-2026-33814
+    - CVE-2026-39821
+    - CVE-2026-39827
+    - CVE-2026-39828
+    - CVE-2026-39829
+    - CVE-2026-39830
+    - CVE-2026-39832
+    - CVE-2026-39835
+    - CVE-2026-41579
+    - CVE-2026-42502
+    - CVE-2026-42506
+    - CVE-2026-42508
+    - CVE-2026-46595
+    - CVE-2026-46597 [#2557](https://github.com/deckhouse/virtualization/pull/2557)
+ - **[core]** Fixed vulnerability:
+    - CVE-2026-2303 [#2515](https://github.com/deckhouse/virtualization/pull/2515)
+