KubeVirt is what happens when you look at a Kubernetes cluster and think, “You know what this needs? Virtual Machines.” And then instead of laughing it off, someone actually builds it. KubeVirt lets you run full VMs — not containers pretending to be VMs — right inside your Kubernetes clusters, managed by the same kubectl commands you already know.
The problem it solves is simple: some workloads cannot be containerized. Legacy databases, Windows applications, anything that needs direct hardware access, or workloads with licensing tied to VM fingerprints. Before KubeVirt, you had to maintain a separate virtualization stack alongside Kubernetes. With KubeVirt, you manage VMs as first-class Kubernetes objects — the same API, the same scheduling, the same networking model.
It is used by platform teams who need to run mixed container-and-VM workloads, telcos modernizing infrastructure on Kubernetes, and anyone migrating legacy applications to a cloud-native platform without rewriting them first.
Version v1.9.0 is a monster release — 1,653 changes from 108 contributors. The headline feature is CrossArchitectureVirtualization, which lets you run an ARM64 virtual machine on an AMD64 host. But there is a lot more under the hood: a brand-new plugin framework, GPU passthrough for NVIDIA Grace systems, OCI artifact export, and a pile of feature gates graduating to GA. Let us get into it.
What Is New
CrossArchitectureVirtualization: ARM64 VMs on AMD64 Hosts
This is the showstopper. CrossArchitectureVirtualization (Alpha) lets you run a virtual machine with a different CPU architecture than the host it lives on. An ARM64 VM on an AMD64 Kubernetes node. An AMD64 VM on an ARM64 server. It works through QEMU TCG, the universal emulator that translates CPU instructions on the fly.
Why does this matter? Because ARM is eating the data center. AWS Graviton, Ampere Altra, and now the entire Apple Silicon lineup have proven that ARM64 is a first-class server architecture. But your existing VM images are probably x86. CrossArchitectureVirtualization means you can migrate workloads to ARM64 hosts without rebuilding every single VM image from scratch.
apiVersion: kubevirt.io/v1
kind: VirtualMachine
metadata:
name: arm64-vm-on-amd64
spec:
architecture: arm64
template:
spec:
domain:
cpu:
model: host-passthroughThis is an Alpha feature gated behind CrossArchitectureVirtualization, so you need to enable it explicitly. See PR #17199 for implementation details.
Plugin CRD Framework: Extensible VM Customization
KubeVirt has always been opinionated about how VMs should work. The new Plugin CRD Framework (Alpha) changes that by giving you a declarative way to extend VM behavior without forking the codebase. Plugins can register domain hooks that mutate libvirt XML before the VM starts, node lifecycle hooks that react to host events, and admission references that enforce custom validation rules.
The framework uses gRPC sidecars — your plugin runs as a separate process, receives the VM spec, and returns modifications. This is clean separation of concerns: KubeVirt handles scheduling and lifecycle, your plugin handles the custom logic that makes your specific workload happy.
apiVersion: kubevirt.io/v1alpha1
kind: VirtualMachinePlugin
metadata:
name: my-custom-hooks
spec:
domainHooks:
- hookType: preStart
sidecarImage: my-registry/vm-hook:v1
nodeHooks:
- hookType: onNodeSync
sidecarImage: my-registry/node-hook:v1What makes this powerful is the CEL-based hook evaluation — you write Common Expression Language rules to decide when a hook fires, without writing Go code. See PR #17790 for the framework, PR #18102 for domain hooks, and PR #17897 for CEL evaluation.
DRA SR-IOV Networks: Kubernetes-Native Device Allocation
The Dynamic Resource Allocation (DRA) API is Kubernetes’ answer to “how do I request hardware that does not fit the CPU/memory model?” KubeVirt v1.9.0 adds DRA support for SR-IOV networks (Alpha), meaning VMs can now request SR-IOV network interfaces through Kubernetes resource claims instead of node-specific annotations.
This is a big deal for anyone running network-intensive workloads. SR-IOV gives VMs direct access to physical network adapters, bypassing the software switch entirely. Before DRA, you had to carefully annotate which nodes had which SR-IOV cards. Now Kubernetes handles the matching for you.
spec:
domain:
devices:
interfaces:
- name: sriov-net
sriov: {}
networks:
- name: sriov-net
resourceClaim:
claimName: my-sriov-device-claimSee PR #17661 for the full implementation.
OCI Artifact Export and vGPU Live Migration
Two features that solve real production headaches landed in this release:
- OCI artifact export — You can now export VM disk images as OCI artifacts using
virtctl vmexport download --format=oci. This means VM images can be stored in the same container registries you already use for container images. No more separate image management infrastructure. See PR #17944. - vGPU (mdev) live migration — You can now live-migrate VMs that have mediated GPU devices (vGPUs) attached. Previously, any VM with a GPU was stuck on its host until you shut it down. This is a huge win for GPU workloads that need maintenance windows or load balancing. See PR #16675.
Feature Gate Graduations: The Production-Ready List
A remarkable number of features graduated in this release. When a feature gate reaches GA, it means the KubeVirt team considers it production-ready and it cannot be disabled:
- Persistent Reservation — GA. SCSI persistent reservations for shared storage access. PR #16674.
- VideoConfig — GA. Custom video device configuration for VMs. PR #16599.
- PanicDevices — GA. Guest panic event reporting for crash detection. PR #16514.
- VMExport — GA. Export VM volumes and snapshots to external formats. PR #16730.
- ExpandDisk — GA. Online disk expansion without restarting the VM. PR #16604.
- IBM Secure Execution — GA. Hardware-based VM encryption for IBM Z systems. PR #17770.
- MigrationPriorityQueue — GA. Priority-based live migration scheduling. PR #17818.
Several features also moved to Beta (enabled by default but still adjustable): VirtualMachineTemplate, WorkloadEncryptionSEV, RebootPolicy, HotplugVolumes, and GPUsWithDRA / HostDevicesWithDRA.
Security and Migration Improvements
This release includes two CVE fixes and several migration enhancements:
- CVE-2026-35469 — A vulnerability in the moby/spdystream dependency was patched. Tracked as GHSA-pc3f-x583-g7j2, fixed in PR #17989.
- CVE-2026-33186 — A gRPC vulnerability addressed by bumping to v1.79.3. See PR #17497.
- Security headers — The
X-Content-Type-Options: nosniffheader is now set by default. PR #17846. - zstd live migration compression — You can now compress live migration traffic using zstd, significantly reducing bandwidth usage during VM moves. Configured via
.spec.experimental.compressionin your MigrationPolicy. PR #18331. - Migration stall detection — KubeVirt now detects when a live migration is stalling and can opportunistically trigger post-copy or stop-and-copy to complete the migration. PR #17544.
Also notable: cgroup v1 is now deprecated and removal is planned for the next release. If you are running on older systems, this is your wake-up call. PR #17809.
The Bottom Line
KubeVirt v1.9.0 is the release where VMs in Kubernetes stopped being a neat trick and started being a real platform — cross-architecture emulation, a plugin system, OCI export, and nine GA graduations make this the most production-ready version yet.
