Appears fixed with v4.11.1-29 HCO-Bundle

*** Bug 2133654 has been marked as a duplicate of this bug. ***

Verified on v4.11.1-42

Vm can be successfully started 

[akrgupta@fedora ~]$ oc get vm
NAME            AGE     STATUS         READY
vm-rhel86-ocs   4m36s   Provisioning   False
[akrgupta@fedora ~]$ oc get vmi
NAME            AGE     PHASE     IP             NODENAME                             READY
vm-rhel86-ocs   52s     Running   10.128.2.82    virt-akr-411b-w4wf7-worker-0-n4l8l   True
[akrgupta@fedora ~]$ virtctl migrate vm-rhel86-ocs
VM vm-rhel86-ocs was scheduled to migrate
[akrgupta@fedora ~]$ oc get vmi
NAME            AGE     PHASE     IP             NODENAME                             READY
vm-rhel86-ocs   2m49s   Running   10.129.2.79    virt-akr-411b-w4wf7-worker-0-tk2ph   True

1) created new namespace - it has default labels:[akrgupta@fedora ~]$ oc describe ns namespace-sample
Name:         namespace-sample
Labels:       kubernetes.io/metadata.name=namespace-sample
              pod-security.kubernetes.io/audit=restricted
              pod-security.kubernetes.io/audit-version=v1.24
              pod-security.kubernetes.io/warn=restricted
              pod-security.kubernetes.io/warn-version=v1.24
2) Created and started VM in this namespace - labels updated:
[akrgupta@fedora ~]$ oc describe ns namespace-sample
Name:         namespace-sample
Labels:       kubernetes.io/metadata.name=namespace-sample
              pod-security.kubernetes.io/audit=restricted
              pod-security.kubernetes.io/audit-version=v1.24
              pod-security.kubernetes.io/enforce=privileged
              pod-security.kubernetes.io/warn=restricted
              pod-security.kubernetes.io/warn-version=v1.24
              security.openshift.io/scc.podSecurityLabelSync=false

3) Removed VM - labels still the same (not reverted back):
[akrgupta@fedora ~]$ oc delete vm vm-rhel86-ocs
virtualmachine.kubevirt.io "vm-rhel86-ocs" deleted
[akrgupta@fedora ~]$ oc get vm
No resources found in namespace-sample namespace.
[akrgupta@fedora ~]$ oc describe ns namespace-sample
Name:         namespace-sample
Labels:       kubernetes.io/metadata.name=namespace-sample
              pod-security.kubernetes.io/audit=restricted
              pod-security.kubernetes.io/audit-version=v1.24
              pod-security.kubernetes.io/enforce=privileged
              pod-security.kubernetes.io/warn=restricted
              pod-security.kubernetes.io/warn-version=v1.24
              security.openshift.io/scc.podSecurityLabelSync=false


PSA feature gate is present
[akrgupta@fedora ~]$ oc get kv -n openshift-cnv kubevirt-kubevirt-hyperconverged -o json | grep -A 15 "featureGates"
                "featureGates": [
                    "DataVolumes",
                    "SRIOV",
                    "CPUManager",
                    "CPUNodeDiscovery",
                    "Snapshot",
                    "HotplugVolumes",
                    "ExpandDisks",
                    "GPU",
                    "HostDevices",
                    "DownwardMetrics",
                    "NUMA",
                    "LiveMigration",
                    "PSA",
                    "WithHostModelCPU",
                    "HypervStrictCheck",

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Virtualization 4.11.1 security and bug fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2022:8750