openshift-docs/virt/release_notes/virt-4-16-release-notes.adoc

:_mod-docs-content-type: ASSEMBLY
[id="virt-4-16-release-notes"]
= {VirtProductName} release notes
include::_attributes/common-attributes.adoc[]
:context: virt-4-16-release-notes

toc::[]

include::modules/making-open-source-more-inclusive.adoc[leveloffset=+1]

[id="virt-doc-feedback"]
== Providing documentation feedback

To report an error or to improve our documentation, log in to your link:https://issues.redhat.com[Red Hat Jira account] and submit a link:https://issues.redhat.com/secure/CreateIssueDetails!init.jspa?pid=12323181&issuetype=1&components=12333768&priority=10200&summary=%5BDoc%5D&customfield_12316142[Jira issue].

[id="virt-about-virt"]
== About Red Hat {VirtProductName}

With Red Hat {VirtProductName}, you can bring traditional virtual machines (VMs) into {product-title} and run them alongside containers. In {VirtProductName}, VMs are native Kubernetes objects that you can manage by using the {product-title} web console or the command line.

{VirtProductName} is represented by the image:virt-icon.png[{VirtProductName},40,40] icon.

You can use {VirtProductName} with either the xref:../../networking/ovn_kubernetes_network_provider/about-ovn-kubernetes.adoc#about-ovn-kubernetes[OVN-Kubernetes] or the xref:../../networking/openshift_sdn/about-openshift-sdn.adoc#about-openshift-sdn[OpenShiftSDN] default Container Network Interface (CNI) network provider.

Learn more about xref:../../virt/about_virt/about-virt.adoc#about-virt[what you can do with {VirtProductName}].

Learn more about xref:../../virt/about_virt/virt-architecture.adoc#virt-architecture[{VirtProductName} architecture and deployments].

xref:../../virt/install/preparing-cluster-for-virt.adoc#preparing-cluster-for-virt[Prepare your cluster] for {VirtProductName}.

include::modules/virt-supported-cluster-version.adoc[leveloffset=+2]


[id="virt-guest-os"]
=== Supported guest operating systems
To view the supported guest operating systems for {VirtProductName}, see link:https://access.redhat.com/articles/973163#ocpvirt[Certified Guest Operating Systems in Red Hat OpenStack Platform, Red Hat Virtualization, OpenShift Virtualization and Red Hat Enterprise Linux with KVM].

//Ensure platform passes Windows Server Virtualization Validation Program. Otherwise, comment out the section below.
[id="virt-svvp-certification"]
=== Microsoft Windows SVVP certification

//CNV-31842 SVVP 4.15 Release Note: NEW
//NOTE: This is a recurring release note. Modify the existing note text below if recommended by QE.
{VirtProductName} is certified in Microsoft's Windows Server Virtualization Validation Program (SVVP) to run Windows Server workloads.

The SVVP certification applies to:

* Red Hat Enterprise Linux CoreOS workers. In the Microsoft SVVP Catalog, they are named __Red Hat OpenShift Container Platform 4 on RHEL CoreOS 9__.
* Intel and AMD CPUs.

[id="virt-quick-starts"]
== Quick starts

Quick start tours are available for several {VirtProductName} features. To view the tours, click the *Help* icon *?* in the menu bar on the header of the {product-title} web console and then select *Quick Starts*. You can filter the available tours by entering the keyword `virtualization` in the *Filter* field.


[id="virt-4-16-new"]
== New and changed features

This release adds new features and enhancements related to the following components and concepts:

[id="virt-4-16-installation-update"]
=== Installation and update

[id="virt-4-16-infrastructure"]
=== Infrastructure

[id="virt-4-16-virtualization"]
=== Virtualization

[id="virt-4-16-networking"]
=== Networking

[id="virt-4-16-storage"]
=== Storage

[id="virt-4-16-web"]
=== Web console


[id="virt-4-16-deprecated-removed"]
== Deprecated and removed features
//NOTE: Comment out deprecated and removed features (and their IDs) if not used in a release

[id="virt-4-16-deprecated"]
=== Deprecated features
// NOTE: When uncommenting deprecated features list, change the Removed features header level below to ===

Deprecated features are included in the current release and supported. However, they will be removed in a future release and are not recommended for new deployments.

//CNV-26426 [DOCS] Release note: Deprecate TTO
* The `tekton-tasks-operator` is deprecated and Tekton tasks and example pipelines are now deployed by the `ssp-operator`.

//CNV-26316: Release note: Align tekton tasks with instancestypes
* The `copy-template`, `modify-vm-template`, and `create-vm-from-template` tasks are deprecated.

//CNV-29048 Release note: Metrics name changes
//Commenting out for 4.15. No response from devs about updating the article link for 4.15
//* Many OpenShift Virtualization metrics have changed or will change in a future version. These changes could affect your custom dashboards. See link:https://access.redhat.com/articles/7028805[OpenShift Virtualization 4.14 metric changes] for details.

//CNV-32032 Release note: DEPRECATED FEATURE (Windows 2012R2 templates deprecated)
* Support for Windows Server 2012 R2 templates is deprecated.


[id="virt-4-16-removed"]
=== Removed features

Removed features are not supported in the current release.

[id="virt-4-16-technology-preview"]
== Technology Preview features

Some features in this release are currently in Technology Preview. These experimental features are not intended for production use. Note the following scope of support on the Red Hat Customer Portal for these features:

link:https://access.redhat.com/support/offerings/techpreview[Technology Preview Features Support Scope]

//CNV-28944 Release note: Preview Cluster level eviction strategy change
* You can now configure a xref:../../virt/nodes/virt-node-maintenance.adoc#eviction-strategies[VM eviction strategy] for the xref:../../virt/nodes/virt-node-maintenance.adoc#virt-configuring-cluster-eviction-strategy-cli_virt-node-maintenance[entire cluster].

//CNV-15028: Nested virt in virt hosts. This feature will remain in tech preview indefinitely.
* You can now enable link:https://access.redhat.com/solutions/6692341[nested virtualization on {VirtProductName} hosts].

//CNV-33125: Add CPU limits to the UI
* Cluster admins can now enable CPU resource limits on a namespace in the {product-title} web console under *Overview* -> *Settings* -> *Cluster* -> *Preview features*.

[id="virt-4-16-bug-fixes"]
== Bug fixes

[id="virt-4-16-known-issues"]
== Known issues

[discrete]
[id="virt-4-16-ki-monitoring"]
==== Monitoring
//fix targeted for 4.16
* The Pod Disruption Budget (PDB) prevents pod disruptions for migratable virtual machine images. If the PDB detects pod disruption, then `openshift-monitoring` sends a `PodDisruptionBudgetAtLimit` alert every 60 minutes for virtual machine images that use the `LiveMigrate` eviction strategy. (link:https://issues.redhat.com/browse/CNV-33834[*CNV-33834*])
** As a workaround, xref:../../observability/monitoring/managing-alerts.adoc#silencing-alerts_managing-alerts[silence alerts].

[discrete]
[id="virt-4-16-ki-networking"]
==== Networking


[discrete]
[id="virt-4-16-ki-nodes"]
==== Nodes
//4.15 Keep per Stu and Simone
* Uninstalling {VirtProductName} does not remove the `feature.node.kubevirt.io` node labels created by {VirtProductName}. You must remove the labels manually. (link:https://issues.redhat.com/browse/CNV-38543[*CNV-38543*])


[discrete]
[id="virt-4-16-ki-storage"]
==== Storage
//4.15 Keep per Alex Kalenyuk Issue is closed as "Not a bug" but is still a known issue
* If you use Portworx as your storage solution on AWS and create a VM disk image, the created image might be smaller than expected due to the filesystem overhead being accounted for twice. (link:https://issues.redhat.com/browse/CNV-32695[*CNV-32695*])
** As a workaround, you can manually expand the persistent volume claim (PVC) to increase the available space after the initial provisioning process completes.

//4.15 Keep per Adam Litke. Issue is closed as "Won't do" but is still a known issue
* In some instances, multiple virtual machines can mount the same PVC in read-write mode, which might result in data corruption. (link:https://issues.redhat.com/browse/CNV-13500[*CNV-13500*])
** As a workaround, avoid using a single PVC in read-write mode with multiple VMs.

//4.15 Keep per Dominik Holler. A new engineering bug will be created to track this. Reach out to Dominik or Jennifer Abrams to update the bug URL
* If you clone more than 100 VMs using the `csi-clone` cloning strategy, then the Ceph CSI might not purge the clones. Manually deleting the clones might also fail. (link:https://issues.redhat.com/browse/CNV-23501[*CNV-23501*])
** As a workaround, you can restart the `ceph-mgr` to purge the VM clones.



[discrete]
[id="virt-4-16-ki-virtualization"]
==== Virtualization

// new for 4.15
* A critical bug in `qemu-kvm` causes VMs to hang and experience I/O errors after xref:../../virt/virtual_machines/virtual_disks/virt-hot-plugging-virtual-disks.adoc#virt-hot-plugging-virtual-disks[disk hot plug] operations. This issue can also affect the operating system disk and other disks that were not involved in the hot plug operations. If the operating system disk stops working, the root file system shuts down. For more information, see link:https://access.redhat.com/solutions/7055333[Virtual Machine loses access to its disks after hot-plugging some extra disks] in the Red Hat Knowledgebase.
+
[IMPORTANT]
====
Due to package versioning, this bug might reappear after updating {VirtProductName} from 4.13.z or 4.14.z to 4.15.0.
====

//4.15 still unresolved
* When adding a virtual Trusted Platform Module (vTPM) device to a Windows VM, the BitLocker Drive Encryption system check passes even if the vTPM device is not persistent. This is because a vTPM device that is not persistent stores and recovers encryption keys using ephemeral storage for the lifetime of the `virt-launcher` pod. When the VM migrates or is shut down and restarts, the vTPM data is lost. (link:https://issues.redhat.com/browse/CNV-36448[*CNV-36448*])

//4.15 still unresolved
* {VirtProductName} links a service account token in use by a pod to that specific pod. {VirtProductName} implements a service account volume by creating a disk image that contains a token. If you migrate a VM, then the service account volume becomes invalid. (link:https://issues.redhat.com/browse/CNV-33835[*CNV-33835*])
** As a workaround, use user accounts rather than service accounts because user account tokens are not bound to a specific pod.

//4.15 Keep this per Stu, ETA for fixing this issue is 4.18.
* With the release of the link:https://access.redhat.com/errata/RHSA-2023:3722[RHSA-2023:3722] advisory, the TLS `Extended Master Secret` (EMS) extension (link:https://datatracker.ietf.org/doc/html/rfc7627[RFC 7627]) is mandatory for TLS 1.2 connections on FIPS-enabled {op-system-base-full} 9 systems. This is in accordance with FIPS-140-3 requirements. TLS 1.3 is not affected.
+
Legacy OpenSSL clients that do not support EMS or TLS 1.3 now cannot connect to FIPS servers running on RHEL 9. Similarly, RHEL 9 clients in FIPS mode cannot connect to servers that only support TLS 1.2 without EMS. This in practice means that these clients cannot connect to servers on RHEL 6, RHEL 7 and non-RHEL legacy operating systems. This is because the legacy 1.0.x versions of OpenSSL do not support EMS or TLS 1.3. For more information, see link:https://access.redhat.com/solutions/7018256[TLS Extension "Extended Master Secret" enforced with Red Hat Enterprise Linux 9.2].

** As a workaround, update legacy OpenSSL clients to a version that supports TLS 1.3 and configure {VirtProductName} to use TLS 1.3, with the `Modern` TLS security profile type, for FIPS mode.


[discrete]
[id="virt-4-16-ki-webconsole"]
==== Web console
//CNV-38293
* When you first deploy an {product-title} cluster, creating VMs from templates or instance types by using the web console, fails if you do not have `cluster-admin` permissions.
** As a workaround, the cluster administrator must first xref:../../nodes/pods/nodes-pods-configmaps.adoc#nodes-pods-configmap-create-from-console_configmaps[create a config map] to enable other users to use templates and instance types to create VMs. (link: https://issues.redhat.com/browse/CNV-38284[*CNV-38284*])

//CNV-38593: RN: Known issue Remove invalid annotation from "OVN Kubernetes secondary localnet network"
* When you create a network attachment definition (NAD) for an OVN-Kubernetes localnet topology by using the web console, the invalid annotation `k8s.v1.cni.cncf.io/resourceName: openshift.io/` appears. This annotation prevents the starting of the VM.
** As a workaround, remove the annotation.