Kubernetes VM Stack v1.36.6-kubevirt1.9.1

Each part is its own ReadyStack release. The names, tags, digests and grades below are read from the catalogue (/api/products) and our scans (/api/scans) when the page is served; each name opens that part's page.

Grades are ReadyStack's own daily scan of each published image: a syft SBOM and grype vulnerability matches, scored with cerodeo-v1, the rubric ce.rodeo published until 2026-10-26. The original grade is the first recorded scan of the release, the current grade the latest. A part's own page explains its score. A part of the stack that does not score A on this scan is published and signed but not listed in the catalogue; it is shown here as not listed, with the reason.

1. Pull the bundle and verify it. cosign checks the image against ReadyStack's release key; then the image's own check verifies every file of the bundle against its SHA256SUMS. The image has no shell, so the bundle is copied out of a container that is created but never started, and the copy is checked again on your machine.

KEY=https://readystack.dev/keys/cosign.pub
IMAGE=readystack/kubernetesvmstack:v1.36.6-kubevirt1.9.1-CE-scratch-r2@sha256:0268790dadac6fbc392784cb7f77f996526f4d1b6394bb30228d19ddaae062e9
cosign verify --key "$KEY" "$IMAGE"
docker run --rm "$IMAGE"                  # prints "Kubernetes VM Stack v1.36.6-kubevirt1.9.1: 26 files verified", or names each problem and exits 1
docker create --name kvs-bundle "$IMAGE"  # the image has no shell
docker cp kvs-bundle:/kubernetesvmstack .
docker rm kvs-bundle
(cd kubernetesvmstack && sha256sum --quiet -c SHA256SUMS)

2. Unpack it. kubernetesvmstack/install/ is the install bundle, with its README.md, the full order of operations; kubernetesvmstack/runbook/RUNBOOK.md is the operator runbook, with the checks to repeat on your own cluster; kubernetesvmstack/kubevirt-stack.json is the pin manifest.

3. Install, in this order (each step in full in install/README.md):

1. The local registry. Run readystack/registry on a machine the hosts reach, with TLS from a CA the hosts trust.
2. The registry config. Put the registry's address, CA and credential on every host, in a root-only file.
3. The host bridge. On each host, move the uplink onto a bridge (br0) with the bundle's netplan example.
4. Mirror the images. mirror-images.sh copies every image by digest into the local registry, signatures and attestations included; then check each with cosign.
5. The hosts. install-node.sh installs the host programs from the Kubernetes Node bundle and points containerd at the local registry, with no public fallback.
6. The first node. The kubeadm patches, kube-vip, then kubeadm init.
7. The other two nodes. The same patches and kube-vip, then kubeadm join as control-plane nodes.
8. Add-ons. kube-proxy, flannel and Multus, then spread CoreDNS over the nodes.
9. KubeVirt. The operator, then the KubeVirt CR; wait until it is Available.
10. VMs. A VM from an existing disk on a static local volume, with a NIC on the host bridge; then virtctl console.

• A VM on a local volume is pinned to its node: it cannot live-migrate, and it stops while that node is down.
• Kubernetes 1.37 waits for a KubeVirt release that supports it. KubeVirt 1.9 supports Kubernetes 1.34 to 1.36, so we hold the stack on the 1.36 line.
• containerd reads the registry credential from its deprecated registry.configs setting. The runbook says why, and the stack keeps containerd on a release that still reads it.
• The OCI licences labels of the pause and kubernetesnode images understate their licences: they leave out glibc, which is linked into them statically and is LGPL-2.1-or-later. Their Docker Hub pages and SBOMs say so, and each image's next revision corrects the label.
• virt-handler and virt-launcher are published and signed but not listed, because they score below A on our scan (see the table above).
• readystack/registry's health check probes 127.0.0.1, so with the registry bound to another address and TLS on, Docker reports it unhealthy while it serves.
• Built for x86-64 (linux/amd64) only.

Need a different platform built this way? Tell us the platform, its components and the machines; we check the licence and feasibility first. $250 when it ships. Your card is saved, not charged, and if we cannot take it on we remove it.