KubeVirt 1.8.2 VMIs stuck in Scheduled on Kubernetes 1.36 hosts (checksum int32 CRD validation) #2769

What happened

On a Cozystack v1.4.2 install whose host Kubernetes is v1.36, tenant Kubernetes clusters never come up: their VMs stay in Scheduled and virt-handler logs repeat:

... is invalid: <nil>: Invalid value: "": Checked value must be of type integer with format int32 in status.volumeStatus[N].containerDiskVolume.checksum

Root cause

This is upstream kubevirt/kubevirt#17858. KubeVirt's ContainerDiskInfo / KernelInfo / InitrdInfo Checksum field is a uint32, which the CRD renders as format: int32. Before Kubernetes 1.36 the API server silently stripped format: int32 from CRD schemas, so the field was never validated. Kubernetes 1.36 (kubernetes/kubernetes#136582) enabled strict numeric-format validation for CRDs, so the API server now rejects every virt-handler status update and the VMI never leaves Scheduled.

Cozystack v1.4.2 ships KubeVirt v1.8.2. The upstream fix (kubevirt/kubevirt#17469, Format:=int64 markers on the three Checksum fields) is only in main / v1.9.0-alpha.0 and is not backported to release-1.8. KubeVirt maintainers state that Kubernetes 1.36 is not officially supported by KubeVirt 1.8.

Impact

Any Cozystack install on a Kubernetes 1.36 host cannot create tenant clusters or VMs. Confirmed by multiple users on the community channel (bare-metal Talos + k8s 1.36 among them).

Options

1. Document that Kubernetes 1.36 hosts are not yet supported and install on <= 1.35 until a fixed KubeVirt is shipped.
2. Carry a CRD patch in the kubevirt-operator package (override the checksum format to int64, or drop the field) until a KubeVirt release with the fix is available.
3. Bump KubeVirt to a release that includes the fix once one exists on the 1.8 line, or move to 1.9.

Workaround (kubectl-only, from the upstream thread)

1. kubectl scale deployment virt-operator --replicas=0 --namespace cozy-kubevirt
2. Edit CRD virtualmachineinstances.kubevirt.io, remove the checksum field from the containerDiskVolume, kernelInfo, and initrdInfo schemas
3. kubectl replace --filename the CRD (not apply)
4. Restart virt-handler

This pauses KubeVirt reconciliation until reverted.