docs: add release notes for v1.4.1 (#1996)

Add release notes for v1.4.1

---------

Signed-off-by: Isteb4k <dmitry.rakitin@flant.com>
Signed-off-by: Vladislav Panfilov <vladislav.panfilov@flant.com>
Co-authored-by: Vladislav Panfilov <vladislav.panfilov@flant.com>
(cherry picked from commit d714600)
Signed-off-by: Isteb4k <dmitry.rakitin@flant.com>

# Conflicts:
#	docs/RELEASE_NOTES.md
#	docs/RELEASE_NOTES.ru.md

Author: Isteb4k

docs/RELEASE_NOTES.md

@@ -3,26 +3,32 @@ title: "Release Notes"
 weight: 70
 ---
 
+## v1.4.1
+
+### Security
+
+- [module] Fixed vulnerabilities CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, and CVE-2025-68121.
+
 ## v1.4.0
 
 ### New features
 
-- [vd] Added support for changing the storage class of disks attached via `VirtualMachineBlockDeviceAttachment` (hotplug).
-- [vd] Added support for migrating virtual machines with local disks attached via `VirtualMachineBlockDeviceAttachment` (hotplug).
+- [vd] Added support for changing the StorageClass of disks attached via [VirtualMachineBlockDeviceAttachment](/modules/virtualization/cr.html#virtualmachineblockdeviceattachment) (hotplug).
+- [vd] Added support for migrating virtual machines with local disks attached via [VirtualMachineBlockDeviceAttachment](/modules/virtualization/cr.html#virtualmachineblockdeviceattachment) (hotplug).
 - [vm] Virtual machines can now be started without a `Main` network.
 
 ### Fixes
 
 - [module] Fixed project quota accounting for resources used by system components required to create disks/images and operate virtual machines.
-- [vi,cvi] Added tracking of image availability in DVCR. If an image disappears from DVCR, the corresponding `VirtualImage` and `ClusterVirtualImage` resources enter the `Lost` phase and report an error.
-- [vmip] Fixed IP address attachment when the corresponding `VirtualMachineIPAddress` resource was created manually in advance.
-- [vm] Added support for cloning virtual machines in the `Running` phase via `VirtualMachineOperation` of type `Clone`.
+- [vi,cvi] Added tracking of image availability in DVCR. If an image disappears from DVCR, the corresponding [VirtualImage](/modules/virtualization/cr.html#virtualimage) and [ClusterVirtualImage](/modules/virtualization/cr.html#clustervirtualimage) resources enter the `Lost` phase and report an error.
+- [vmip] Fixed IP address attachment when the corresponding [VirtualMachineIPAddress](/modules/virtualization/cr.html#virtualmachineipaddress) resource was created manually in advance.
+- [vm] Added support for cloning virtual machines in the `Running` phase via [VirtualMachineOperation](/modules/virtualization/cr.html#virtualmachineoperation) of type `Clone`.
 
 ## v1.3.0
 
-### New Features
+### New features
 
-- [vmclass] Added the `.spec.sizingPolicies.defaultCoreFraction` field to the `VirtualMachineClass` resource, allowing you to set the default `coreFraction` for virtual machines that use this class.
+- [vmclass] Added the `.spec.sizingPolicies.defaultCoreFraction` field to the [VirtualMachineClass](/modules/virtualization/cr.html#virtualmachineclass) resource, allowing you to set the default `coreFraction` for virtual machines that use this class.
 
 ### Fixes
 
@@ -35,7 +41,7 @@ weight: 70
 
 ### Fixes
 
-[module] Fixed RBAC access permissions for the `d8:use:role:user` role that prevented it from managing the [VirtualMachineOperation](/modules/virtualization/cr.html#virtualmachineoperation) resource.
+- [module] Fixed RBAC access permissions for the `d8:use:role:user` role that prevented it from managing the [VirtualMachineOperation](/modules/virtualization/cr.html#virtualmachineoperation) resource.
 
 ## v1.2.1
 
@@ -47,32 +53,32 @@ weight: 70
 
 ### New features
 
-- [vmrestore] The `VirtualMachineRestore` resource is deprecated. Use the following resources instead:
-  - `VirtualMachineOperation` with type `Clone`: For cloning an existing virtual machine.
-  - `VirtualMachineOperation` with type `Restore`: For restoring an existing virtual machine to a state from a snapshot.
-  - `VirtualMachineSnapshotOperation`: For creating a new virtual machine based on a snapshot.
-- [vmsop] Added the `VirtualMachineSnapshotOperation` resource for creating a virtual machine based on a `VirtualMachineSnapshot`.
-- [vmclass] For the `VirtualMachineClass` resource, version `v1alpha2` is deprecated. Use version `v1alpha3` instead:
+- [vmrestore] The [VirtualMachineRestore](/modules/virtualization/cr.html#virtualmachinerestore) resource is deprecated. Use the following resources instead:
+  - [VirtualMachineOperation](/modules/virtualization/cr.html#virtualmachineoperation) with type `Clone`: For cloning an existing virtual machine.
+  - [VirtualMachineOperation](/modules/virtualization/cr.html#virtualmachineoperation) with type `Restore`: For restoring an existing virtual machine to a state from a snapshot.
+  - [VirtualMachineSnapshotOperation](/modules/virtualization/cr.html#virtualmachinesnapshotoperation): For creating a new virtual machine based on a snapshot.
+- [vmsop] Added the [VirtualMachineSnapshotOperation](/modules/virtualization/cr.html#virtualmachinesnapshotoperation) resource for creating a virtual machine based on a [VirtualMachineSnapshot](/modules/virtualization/cr.html#virtualmachinesnapshot).
+- [vmclass] For the [VirtualMachineClass](/modules/virtualization/cr.html#virtualmachineclass) resource, version `v1alpha2` is deprecated. Use version `v1alpha3` instead:
   - In version `v1alpha3`, the `.spec.sizingPolicies.coreFraction` field is now a string with a percentage (for example, "50%"), similar to the field in a virtual machine.
 - [module] Added validation for the virtualization ModuleConfig that prevents decreasing the DVCR storage size and changing its StorageClass.
 - [module] Improved audit events by using more informative messages that include virtual machine names and user information.
 - [module] Added the ability to clean up DVCR from non-existent project and cluster images:
   - By default, this feature is disabled.
   - To enable cleanup, set a schedule in the module settings: `.spec.settings.dvcr.gc.schedule`.
-- [vmbda] Added detailed error output in the `Attached` condition of the `VirtualMachineBlockDeviceAttachment` resource when a block device is unavailable on the virtual machine node.
+- [vmbda] Added detailed error output in the `Attached` condition of the [VirtualMachineBlockDeviceAttachment](/modules/virtualization/cr.html#virtualmachineblockdeviceattachment) resource when a block device is unavailable on the virtual machine node.
 - [module] Added new metrics for disks:
   - `d8_virtualization_virtualdisk_capacity_bytes`: Metric showing the disk size.
   - `d8_virtualization_virtualdisk_info`: Metric with information about the disk configuration.
   - `d8_virtualization_virtualdisk_status_inuse`: Metric showing the current use of the disk by a virtual machine or for creating other block devices.
 
 ### Fixes
 
-- [vmclass] Added the ability to modify or delete the `VirtualMachineClass` resource named "generic". The virtualization module will no longer restore it to its original state.
-- [vm] Fixed the MethodNotAllowed error for patch and watch operations when querying the `VirtualMachineClass` resource via command-line utilities (d8 k, kubectl).
-- [image] Fixed an issue that prevented deleting `VirtualImage` and `ClusterVirtualImage` resources for a stopped virtual machine.
+- [vmclass] Added the ability to modify or delete the [VirtualMachineClass](/modules/virtualization/cr.html#virtualmachineclass) resource named "generic". The virtualization module will no longer restore it to its original state.
+- [vm] Fixed the `MethodNotAllowed` error for `patch` and `watch` operations when querying the [VirtualMachineClass](/modules/virtualization/cr.html#virtualmachineclass) resource via command-line utilities (`d8 k`, `kubectl`).
+- [image] Fixed an issue that prevented deleting [VirtualImage](/modules/virtualization/cr.html#virtualimage) and [ClusterVirtualImage](/modules/virtualization/cr.html#clustervirtualimage) resources for a stopped virtual machine.
 - [module] Fixed RBAC for the `user` and `editor` cluster roles.
 - [module] Fixed the `D8VirtualizationVirtualMachineFirmwareOutOfDate` alert, which could be duplicated when virtualization runs in HA mode.
-- [snapshot] Fixed an error that could lead to inconsistencies between `VirtualMachineSnapshot` and `VirtualDiskSnapshot` resources when creating a snapshot of a virtual machine with multiple disks.
+- [snapshot] Fixed an error that could lead to inconsistencies between [VirtualMachineSnapshot](/modules/virtualization/cr.html#virtualmachinesnapshot) and [VirtualDiskSnapshot](/modules/virtualization/cr.html#virtualdisksnapshot) resources when creating a snapshot of a virtual machine with multiple disks.
 
 ### Security
 
@@ -92,21 +98,21 @@ weight: 70
 
 ### Fixes
 
-- [vd] Fixed live disk migration between storage classes that use different drivers. Limitations:
+- [vd] Fixed live disk migration between StorageClasses that use different drivers. Restrictions:
   - Migration between `Block` and `Filesystem` is not supported. Only migrations between the same volume mode are allowed: `Block` → `Block` and `Filesystem` → `Filesystem`.
 - [vm] In the `Migrating` state, detailed error information is now displayed when a live migration of a virtual machine fails.
 
 ## v1.1.1
 
 ### Fixes
 
-- [core] Fixed an issue in the containerd v2 where storage providing a PVC with the FileSystem type was incorrectly attached via `VirtualMachineBlockDeviceAttachment`.
+- [core] Fixed an issue in the containerd v2 where storage providing a PVC with the `Filesystem` type was incorrectly attached via [VirtualMachineBlockDeviceAttachment](/modules/virtualization/cr.html#virtualmachineblockdeviceattachment).
 - [core] Added error reporting in the status of disks and images when the data source (URL) is unavailable.
-- [vi] When creating virtual images from virtual disk snapshots, the `spec.persistentVolumeClaim.storageClassName` parameter is now respected. Previously, it could be ignored.
+- [vi] When creating virtual images from virtual disk snapshots, the `.spec.persistentVolumeClaim.storageClassName` parameter is now respected. Previously, it could be ignored.
 - [vm] Fixed the `NetworkReady` condition output: it no longer shows the `Unknown` state and appears only when needed.
-- [vm] Prohibit duplicate networks in the virtual machine `.spec.network` specification.
-- [vmip] Added validation for static IP addresses to avoid creating a `VirtualMachineIPAddress` resource with an IP already in use in the cluster.
-- [vmbda] Fixed a bug where, when detaching a virtual image through `VirtualMachineBlockDeviceAttachment`, the resource could get stuck in the Terminating state.
+- [vm] Prohibited duplicate networks in the virtual machine `.spec.network` specification.
+- [vmip] Added validation for static IP addresses to avoid creating a [VirtualMachineIPAddress](/modules/virtualization/cr.html#virtualmachineipaddress) resource with an IP already in use in the cluster.
+- [vmbda] Fixed a bug where, when detaching a virtual image through [VirtualMachineBlockDeviceAttachment](/modules/virtualization/cr.html#virtualmachineblockdeviceattachment), the resource could get stuck in the `Terminating` state.
 
 ### Other
 
@@ -123,22 +129,22 @@ weight: 70
 - [vm] Added the ability to migrate VMs using disks on local storage. Restrictions:
   - The feature is not available in the CE edition.
   - Migration is only possible for running VMs (`phase: Running`).
-  - Migration of VMs with local disks connected via `VirtualMachineBlockDeviceAttachment` (hotplug) is not supported yet.
-- [vd] Added the ability to migrate storage for VM disks (change `StorageClass`). Restrictions:
+  - Migration of VMs with local disks connected via [VirtualMachineBlockDeviceAttachment](/modules/virtualization/cr.html#virtualmachineblockdeviceattachment) (hotplug) is not supported yet.
+- [vd] Added the ability to migrate storage for VM disks (change StorageClass). Restrictions:
   - The feature is not available in the CE edition.
   - Migration is only possible for running VMs (`phase: Running`).
-  - Storage migration for disks connected via `VirtualMachineBlockDeviceAttachment` (hotplug) is not supported yet.
-- [vmop] Added an operation with the `Clone` type to create a clone of a VM from an existing VM (`VirtualMachineOperation` `.spec.type: Clone`).
+  - Storage migration for disks connected via [VirtualMachineBlockDeviceAttachment](/modules/virtualization/cr.html#virtualmachineblockdeviceattachment) (hotplug) is not supported yet.
+- [vmop] Added an operation with the `Clone` type to create a clone of a VM from an existing VM ([VirtualMachineOperation](/modules/virtualization/cr.html#virtualmachineoperation) `.spec.type: Clone`).
 - [observability] Added the `KubeNodeAwaitingVirtualMachinesEvictionBeforeShutdown` alert, which is triggered when the node hosting the virtual machines is about to shut down but VM evacuation is not yet complete.
 - [observability] Added the `D8VirtualizationDVCRInsufficientCapacityRisk` alert, which warns of the risk of insufficient free space in the virtual machine image storage (DVCR).
 
 ### Fixes
 
-- [vmclass] Fixed an issue in `VirtualMachineClass` types Features and Discovery that caused nested virtualization not to work on nodes with AMD processors.
+- [vmclass] Fixed an issue in [VirtualMachineClass](/modules/virtualization/cr.html#virtualmachineclass) types `Features` and `Discovery` that caused nested virtualization not to work on nodes with AMD processors.
 - [vmop/restore] Fixed a bug where the controller sometimes started a restored VM before its disks were fully restored, resulting in the VM starting with old (unrestored) disks.
 - [vmsnapshot] Fixed behavior when creating a VM snapshot with uncommitted changes: the snapshot now instantly captures the current state of the virtual machine, including all current changes.
 - [module] Fixed an issue with installing the module on RedOS 8.X OS.
-- [module] Improved validation to prevent adding empty values for parameters that define storage classes for disks and images.
+- [module] Improved validation to prevent adding empty values for parameters that define StorageClass for disks and images.
 - [vmop] Fixed garbage collector behavior: previously, all VMOP objects were deleted after restarting the virtualization controller, ignoring cleanup rules.
 - [observability] The virtual machine dashboard now displays statistics for all networks (including additional ones) connected to the VM.
 - [observability] Fixed the graph on the virtual machine dashboard that displays memory copy statistics during VM migration.
@@ -147,16 +153,16 @@ weight: 70
 
 ### New features
 
-- [vm] Added protection to prevent a cloud image (`VirtualImage` \ `ClusterVirtualImage`) from being connected as the first disk. Previously, this caused the VM to fail to start with the "No bootable device" error.
+- [vm] Added protection to prevent a cloud image ([VirtualImage](/modules/virtualization/cr.html#virtualimage) \ [ClusterVirtualImage](/modules/virtualization/cr.html#clustervirtualimage)) from being connected as the first disk. Previously, this caused the VM to fail to start with the "No bootable device" error.
 - [vmop] Added `Restore` operation to restore a VM from a previously created snapshot.
 
 ### Fixes
 
 - [vmsnapshot] When restoring a virtual machine from a snapshot, all annotations and labels that were present on the resources at the time of the snapshot are now restored correctly.
 - [module] Fixed an issue with queue blocking when the `settings.modules.publicClusterDomain` parameter was empty in the global ModuleConfig resource.
 - [module] Optimized hook performance during module installation.
-- [vmclass] Fixed core/coreFraction validation in the `VirtualMachineClass` resource.
-- [module] When the SDN module is disabled, the configuration of additional networks in the VM is not available.
+- [vmclass] Fixed `core`/`coreFraction` validation in the [VirtualMachineClass](/modules/virtualization/cr.html#virtualmachineclass) resource.
+- [module] When the `sdn` module is disabled, the configuration of additional networks in the VM is not available.
 
 ### Security
 
@@ -166,15 +172,15 @@ weight: 70
 
 ### Important notes before update
 
-In version v0.25.0, support for the module's operation with CRI containerd V2 has been added.
-After upgrading CRI from containerd v1 to containerd v2, it is necessary to recreate the images that were created using virtualization module version v0.24.0 and earlier.
+In version v0.25.0, support for the module's operation with CRI containerd v2 has been added.
+After upgrading CRI from containerd v1 to containerd v2, it is necessary to recreate the images that were created using the virtualization module version v0.24.0 or earlier.
 
-### New Features
+### New features
 
-- [observability] New Prometheus metrics have been added to track the phase of resources such as `VirtualMachineSnapshot`, `VirtualDiskSnapshot`, `VirtualImage`, and `ClusterVirtualImage`.
-- [vm] MAC address management for additional network interfaces has been added using the `VirtualMachineMACAddress` and `VirtualMachineMACAddressLease` resources.
-- [vm] Added the ability to attach additional network interfaces to a virtual machine for networks provided by the `SDN` module. For this, the `SDN` module must be enabled in the cluster.
-- [vmclass] An annotation has been added to set the default `VirtualMachineClass`. You can designate a `VirtualMachineClass` as the default by adding the annotation
+- [observability] New Prometheus metrics have been added to track the phase of resources such as [VirtualMachineSnapshot](/modules/virtualization/cr.html#virtualmachinesnapshot), [VirtualDiskSnapshot](/modules/virtualization/cr.html#virtualdisksnapshot), [VirtualImage](/modules/virtualization/cr.html#virtualimage), and [ClusterVirtualImage](/modules/virtualization/cr.html#clustervirtualimage).
+- [vm] MAC address management for additional network interfaces has been added using the [VirtualMachineMACAddress](/modules/virtualization/cr.html#virtualmachinemacaddress) and [VirtualMachineMACAddressLease](/modules/virtualization/cr.html#virtualmachinemacaddresslease) resources.
+- [vm] Added the ability to attach additional network interfaces to a virtual machine for networks provided by the `sdn` module. For this, the `sdn` module must be enabled in the cluster.
+- [vmclass] An annotation has been added to set the default `VirtualMachineClass`. You can designate a [VirtualMachineClass](/modules/virtualization/cr.html#virtualmachineclass) as the default by adding the annotation
   `virtualmachineclass.virtualization.deckhouse.io/is-default-class=true`.
   This allows creating VMs with an empty `spec.virtualMachineClassName` field, which will be automatically filled with the default class.
 
@@ -183,7 +189,7 @@ After upgrading CRI from containerd v1 to containerd v2, it is necessary to recr
 - [module] Added validation to ensure that virtual machine subnets do not overlap with system subnets (`podSubnetCIDR` and `serviceSubnetCIDR`).
 - [vi] To create a virtual image on a `PersistentVolumeClaim`, the storage must support the `RWX` and `Block` modes; otherwise, a warning will be displayed.
 - [vm] Fixed an issue where changing the operating system type caused the machine to enter a reboot loop.
-- [vm] Fixed an issue where a virtual machine would hang in the Starting phase when project quotas were insufficient. A quota shortage message will now be displayed in the virtual machine's status. To allow the machine to continue starting, the project quotas need to be increased.
+- [vm] Fixed an issue where a virtual machine would hang in the `Starting` phase when project quotas were insufficient. A quota shortage message will now be displayed in the virtual machine's status. To allow the machine to continue starting, the project quotas need to be increased.
 
 ### Other