4.12.85

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.12.85-x86_64

Team Approvals:

Tests:

Blocking jobs
- upgrade Succeeded periodic-ci-openshift-release-master-stable-4.y-e2e-aws-ovn-upgrade
- upgrade-minor Succeeded periodic-ci-openshift-release-master-stable-4.y-e2e-aws-ovn-upgrade
Informing jobs
- aws-sdn-serial Succeeded periodic-ci-openshift-release-master-nightly-4.12-e2e-aws-sdn-serial
- aws-sdn-upgrade-4.12-minor Succeeded (1 retries) periodic-ci-openshift-release-master-nightly-4.12-upgrade-from-stable-4.11-e2e-aws-sdn-upgrade
- azure-ovn-upgrade-4.12-micro Failed (3 retries) periodic-ci-openshift-release-master-ci-4.12-e2e-azure-ovn-upgrade
- fips-scan Succeeded periodic-ci-openshift-release-master-nightly-4.12-fips-payload-scan
- gcp-sdn-upgrade-4.12-micro Succeeded (1 retries) periodic-ci-openshift-release-master-ci-4.12-e2e-gcp-sdn-upgrade
- metal-ipi-ovn-ipv6 Succeeded periodic-ci-openshift-release-master-nightly-4.12-e2e-metal-ipi-ovn-ipv6
- metal-ipi-sdn Succeeded periodic-ci-openshift-release-master-nightly-4.12-e2e-metal-ipi-sdn-bm

Upgrades from:

Untested upgrades: 4.11.14, 4.11.16, 4.11.17, 4.11.18, 4.11.19, 4.11.20, 4.11.21, 4.11.22, 4.11.23, 4.11.24, 4.11.26, 4.11.27, 4.11.28, 4.11.29, 4.11.30, 4.11.31, 4.11.32, 4.11.33, 4.11.34, 4.11.36, 4.11.37, 4.11.38, 4.11.39, 4.11.40, 4.11.41, 4.11.42, 4.11.43, 4.11.44, 4.11.45, 4.11.46, 4.11.47, 4.11.48, 4.11.50, 4.11.51, 4.11.52, 4.11.53, 4.11.54, 4.11.55, 4.11.56, 4.12.10, 4.12.11, 4.12.12, 4.12.13, 4.12.14, 4.12.15, 4.12.16, 4.12.18, 4.12.19, 4.12.20, 4.12.21, 4.12.22, 4.12.23, 4.12.24, 4.12.25, 4.12.26, 4.12.27, 4.12.28, 4.12.29, 4.12.3, 4.12.30, 4.12.31, 4.12.32, 4.12.34, 4.12.35, 4.12.36, 4.12.37, 4.12.38, 4.12.39, 4.12.4, 4.12.40, 4.12.41, 4.12.42, 4.12.44, 4.12.45, 4.12.46, 4.12.47, 4.12.48, 4.12.49, 4.12.5, 4.12.50, 4.12.51, 4.12.53, 4.12.54, 4.12.55, 4.12.56, 4.12.57, 4.12.58, 4.12.59, 4.12.6, 4.12.60, 4.12.61, 4.12.62, 4.12.63, 4.12.64, 4.12.65, 4.12.66, 4.12.67, 4.12.68, 4.12.69, 4.12.7, 4.12.70, 4.12.71, 4.12.72, 4.12.73, 4.12.74, 4.12.75, 4.12.76, 4.12.77, 4.12.78, 4.12.79, 4.12.8, 4.12.80, 4.12.81, 4.12.9

Upgrades to:

4.13.0-0.ci-2026-02-06-214554 (changes) - P F P

Loading changelog, this may take a while ...

Changes from 4.12.43

Created: 2026-02-05 15:21:41 +0000 UTC

Image Digest: sha256:ff7d04b2684670422141a33da362cef8b0475505c458ff9a74564b37e97868a9

Components

Kubernetes upgraded from 1.25.14 to 1.25.16
Red Hat Enterprise Linux CoreOS upgraded from 412.86.202311051457-0 to 412.86.202602021310-0 (diff)

Rebuilt images without code change

alibaba-cloud-csi-driver git 4d3b1125 sha256:b5ae4cde65a59cfc5345aab8ddaceb6d6808e8731b0904a89955545ebb7e6e9a
alibaba-disk-csi-driver-operator git 99bcda8d sha256:a88199cf89e6ccfba41b7ac79262d9e721e6d79cae7ab3eddc7f8a86841fd32f
azure-disk-csi-driver-operator git 988b8cc8 sha256:8f8c750a17bbbad778c9dc0c196bb977d1aa955cfe8fd11dbae31adc919b0028
azure-file-csi-driver git 15aade4d sha256:2e211af60a527a60e8302d520522cdd775e10b124db28468b7e29a67538980a3
cluster-bootstrap git 138a1cf2 sha256:0391a332b51740dea94584b4af61dcb6689f9848596b54a3c7c53841ae20d63e
cluster-platform-operators-manager git c930dc74 sha256:acef3b5367a3e5594aa44b414a6fd643432e23a056d92e9475cec721efce2de9
cluster-storage-operator git 21ebf328 sha256:fb341b0f6cc9964f910ff9db666bcd3efd8f5015fdec761aff84c0e328fab7d8
cluster-update-keys git 2796e173 sha256:d00bd1f7c4aab5538365daf6492acbe4e844c63cc024700a4f196403ebfc236e
configmap-reloader git e4d9170e sha256:a2711088892b471c19f8b33ae7b85be84f855e7e35643a4966a90ddd197cc500
csi-driver-nfs git d9099257 sha256:be48f763dff5c44895d81b66499badcfe66effaf71db17972df5d44c01190b1a
csi-external-attacher git fac7b8fd sha256:27a03c2be90e1da9683ca44d46d8a6b9f6c14165d67d58b32a7783baae5360ee
csi-external-provisioner git 3aa7c527 sha256:85dc819e23fef52c4f9d06e766698ec6590e0917819c19a1460431a8703a195e
csi-external-resizer git 5b066ba4 sha256:efe68b729065567fc67b1304b1518706e7c4a2a34a516582647cf955f5c3a54d
csi-livenessprobe git e6545e71 sha256:46bfa0f6967e05469cb16cea83ba95fff130b74eeabc5342215363ec189dc323
csi-node-driver-registrar git c316b896 sha256:9deb30d1a60ba4023d02f2a2fed4bfeb7d8ee0c3aaa62e1441f9be6e7b664d7c
egress-router-cni git a92e4157 sha256:9b270aef1c7c8105ec2b0429115888da92760054dd8ff0e2aac99c148e26a702
gcp-pd-csi-driver git 5dcfd675 sha256:04fc134b3af096960dabf7a7d4c23a10e0cbd584e0252e42fee998d2e4a1d7cb
gcp-pd-csi-driver-operator git 30e97ba5 sha256:0fbf9cf75ea4ea60ed8635880775d619171ed92b19b5541b51b303ed6ba43180
ibmcloud-machine-controllers git 31a67dac sha256:26f61a4af0418f7b91312f515a2a8a60eb092c0d993492887016c48ebda2050a
ironic-machine-os-downloader git c65c1f1c sha256:3e3bb0d1a68297cb948924dd3f37631beccda9795886934250bbd8637aff1470
ironic-static-ip-manager git a8ade8fe sha256:2bf43ef42928929ff56fa9c77523fa69a55c33511acaba14144d9112f240d6f9
keepalived-ipfailover git 7e8a0105 sha256:5c89b29806a75feb8b47d5aeefc123a3118ddaf3658a8dcdbbb29f542fa6b299
kubevirt-cloud-controller-manager git a19615cd sha256:596c6ba7d2a8cca456d36402cab684b58f82b40609da519ee6125257a8b16dc1
kubevirt-csi-driver git f407c8a7 sha256:7a6b74832f15e1fed112da057d632dae55aadb3b086958c0ef9a4b531c4cb957
kuryr-cni git 8fd2f8b0 sha256:2d3e13474125f18a759a61774f66074186aa4f4d3a012da61d7689752e91a9bb
kuryr-controller git 8fd2f8b0 sha256:94c0f2c4af761372445e7acb68815ce0fc1bb8bb488adbb9a7938899af53bd80
libvirt-machine-controllers git a2882f7a sha256:20e00ab2af71696f2e7e96ae08e0988bbd1de35bb00860c1b98cff84beb6f475
machine-os-content sha256:54879c594d7b2d54d2dcb70a402ab7046ed6825a6189403d5ae1f2a5bd39f94a
multus-route-override-cni git efd6ffbb sha256:03509b845faa02ed5ec260522c1b6de51defa62ea474b3f8707c43d2b55f1bed
network-interface-bond-cni git 30386d6b sha256:f0342b067cdff090542475b5dc6cd301de3a091e0eb22ed9b96ac7d426e5690e
network-tools git c76613c7 sha256:baa6f091dc4c3217b5a4d0127ee36cdacb7dca6cb57f29f1b4b5d73c6b80d4fb
oauth-proxy git 03e5b13b sha256:c6fa37bfaedd85e2cbfe81dc4235ed17aaf93e87b3f106e1e6243e8bb1cd8afd
openstack-cinder-csi-driver-operator git d09e51ae sha256:21e882e46981621ed50f9e03b94eab7434de3d40a759c6d6b9b9a94fbafd5e0d
openstack-machine-api-provider git 05657663 sha256:0487d71c7b3d14d07929bac16f6986e2fb7507bfe7ecee397f871e900d757094
openstack-machine-controllers git f13e381e sha256:ec195d279cea03bbd9def465d780dc10bf187144b7f031f01ed2e1017ab7daae
ovirt-machine-controllers git 03e8cb50 sha256:994bc355221732590afc6dbc0d56237dbd8290cf33e5e1f7098c2fdeb908196a
prom-label-proxy git b1907888 sha256:011af289a633ba25becfb5b14c932462f37ebd5e5f01d499438f02e31f85dd71
prometheus git 72ceaef4 sha256:36304d062e8d70e3b8da3b6b84ec0758f1e29de9b0e017d338838c4c2e88d56b
prometheus-alertmanager git 914cad82 sha256:1383fc2387f0e7ffb72587e18f6deb198ee0c7ce34419da5953c60d0589c618f
prometheus-node-exporter git 99077a3c sha256:35989cf6a686932cadb003e0d43773373f85f0df4348699565bfd93d4e37a7c2
rhel-coreos-8 sha256:f4b8dd3f39fb14ba2050d826fb752a92303df79f45bdcc45b030c281ef026e61
rhel-coreos-8-extensions sha256:254c2e772b8a29152d14d985caa1e5390d8da62f69b0d8fe55cbd1181338db9c
route-controller-manager git 0f141ce9 sha256:ff3e40f0ce278d9bc47c17675196f54940f7ce61d36681556c602c10e424e6d7
vsphere-csi-driver-operator git d7cca470 sha256:faa18ed2ec35d420f922a2c4d15a49b1c6ed45354c0c85dc4bbba3f9771d3838
vsphere-problem-detector git f25ae2ad sha256:62b310128a6500068a948d86dd520be34df2091b6be797d45d8f783c6da1aba2

agent-installer-api-server

OCPBUGS-67386: Bump logrus from 1.9.0 to 19.3 #8768
And 6 elided commits (e.g. from squash or rebase merges)
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-67388: Bump logrus v1.9.0 to v1.9.3 #1465
And 5 elided commits (e.g. from squash or rebase merges)
Full changelog

agent-installer-node-agent

OCPBUGS-67390: Bump logrus v1.9.0 to v1.9.3 #1287
And 6 elided commits (e.g. from squash or rebase merges)
Full changelog

alibaba-cloud-controller-manager

OCPBUGS-21218: Bump golang.org/x/net to v0.19.0 #45
Full changelog

alibaba-machine-controllers

Updating ose-alibaba-machine-controllers images to be consistent with ART #35
Full changelog

apiserver-network-proxy

OCPBUGS-38066: Revert “Agent: Respect HTTPS_PROXY env vars for proxied connections” #61
OCPBUGS-31984: Bump golang.org/x/net to v0.23.0 #52
HOSTEDCP-1323: Merge latest code into 4.14 branch #45
Full changelog

aws-cloud-controller-manager

OCPBUGS-32079: update for CVE-2023-45288 [release-4.12] #85
Full changelog

aws-cluster-api-controllers

OCPBUGS-20810: bump golang.org/x/net to v0.17.0 #483
Full changelog

aws-ebs-csi-driver

OCPBUGS-33457: UPSTREAM: 1919: Add reserved-volume-attachments #267
Full changelog

aws-ebs-csi-driver-operator

OCPBUGS-33457: Explicitly reserve 1 attachment for the root disk #308
Full changelog

aws-machine-controllers

OCPBUGS-24564: Reduce metrics cardinality #97
OCPBUGS-21562: Update golang.org/x/net to v0.17.0 #90
Full changelog

aws-pod-identity-webhook

OCPBUGS-32880: Upgrade go-jose module to 2.6.3 #191
OCPBUGS-21312: Upgrade golang/x/net for CVE-2023-39325 (4.12) #185
NO-ISSUE: Sync OWNERS with team members #178
Full changelog

azure-cloud-controller-manager, azure-cloud-node-manager

OCPBUGS-21401: Bump golang.org/x/net to v0.18.0 #95
Full changelog

azure-cluster-api-controllers

OCPBUGS-36021: Update go-retryablehttp to v0.7.7 #315
OCPBUGS-21489: bump golang.org/x/net to v0.17.0 #289
Full changelog

azure-disk-csi-driver

OCPBUGS-56067: tech debt: rework vendor patches #106
OCPBUGS-22941: UPSTREAM: 1755: fix: detach disk failure when there is throttling #62
OCPBUGS-22832: UPSTREAM: 2805: add disk lun check in AttachDisk to avoid race condition #60
Full changelog

azure-file-csi-driver-operator

OCPBUGS-67404: Bump github.com/sirupsen/logrus to v1.8.3 #116
Full changelog

azure-machine-controllers

OCPBUGS-36148: Fix mapi_instance_create_failed metric with accelerated networking #115
OCPBUGS-30809: Don’t create availability set when using spot instances #105
OCPBUGS-24564: Reduce cardinality #97
OCPBUGS-20741: Bump x/net package to v0.18.0 #84
Full changelog

baremetal-installer, installer, installer-artifacts

OCPBUGS-66250: Replace terraform-provider-google with Openshift fork #10144
OCPBUGS-62820: Release 4.12 bump terraform provider azurerm #10002
OCPBUGS-55035: IBMCloud: Move to IBM TF openshift fork #9670
OTA-1310: data/manifests/bootkube/cvo-overrides: Default to eus-4.12 #9373
OCPBUGS-36087: [release-4.12]: bump go-retryablehttp for CVE fix #8660
OCPBUGS-39290: Add yq v4 to ci image #8929
OCPBUGS-36179: [release-4.12]: bump github.com/container/images for CVE fix #8663
OCPBUGS-22981: IBMCloud: Add eu-es region #7686
OCPBUGS-30630: baremetal: populate customDeploy in advance #8144
OCPBUGS-32449: Updated libvirt installer to include multi-arch yq and symlink for backwards compatibility #8290
OCPBUGS-30768: update RHCOS 4.12 bootimage metadata to 412.86.202402272018-0 #8140
OCPBUGS-30134: [release-4.12] bump containerd for vulnerability fix #8091
OCPBUGS-27454: baremetal: correct external_http_url for v6-only BMCs #7900
OCPBUGS-25593: [release-4.12] OCPBUGS-16640: Update azure cli version to 2.49.0 #7849
OCPBUGS-23184: azure: validation: validate defaultMachinePlatform #7709
OCPBUGS-25476: destroy: gcp: fix destroying regional disks #7845
OCPBUGS-23302: images: installer: add xz to the container #7726
OCPBUGS-23379: images: update govc image in upi-installer #7739
OCPBUGS-22116: Add KMS encryption keys if provided #7769
OCPBUGS-23329: Specify google cloud CLI to version 447.0.0 #7731
OCPBUGS-22933: [release-4.12]: vsphere: fix validation of CPUS and CoresPerSocket #7677
Full changelog

baremetal-machine-controllers

OCPBUGS-46642: Bump x/net to 0.33.0 #230
Full changelog

baremetal-operator

OCPBUGS-53335: CVE-2025-29781 ose-baremetal-operator-container: Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRD [openshift-4.12.z] #412
OCPBUGS-30630: Do not update instance_info and deploy_interface for active nodes #338
OCPBUGS-24490: backport: Delay delete of detached hosts #326
OCPBUGS-23291: hack for deploying V6-only clusters from dualstack hubs #320
Full changelog

baremetal-runtimecfg

OCPBUGS-26930: Add .snyk file to ignore vendor and test files #296
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-30289: oc adm catalog mirror: use ToSlash and FromSlash to unify the path separators #1701
OCPBUGS-25642: Add client version in must-gather summary #1639
OCPBUGS-24462: Overwrite template’s namespace with the explicit one #1618
OCPBUGS-23222: regeneratemco: explicitly check for PlatformStatus field #1598
Full changelog

cloud-credential-operator

OCPBUGS-53420: github.com/golang/glog v1.2.4 #847
OCPBUGS-51538: Ignore SNYK-GOLANG-GOLANGORGXOAUTH2JWS-8749594 due to not being affected #832
OCPBUGS-37322: update modules: grpc, protobuf, logrus #764
OCPBUGS-42166: Resolve SNYK errors in security job. #760
OCPBUGS-37422: SNYK ignore go-client misreporting #744
NO-JIRA: Add jstuever to OWNERS #733
OCPBUGS-36027: IBM/go-sdk-core update to v5.17.4 #723
OCPBUGS-32897: Upgrade go-jose module to 2.6.3 #699
OCPBUGS-21348: Upgrade golang/x/net for CVE-2023-39325 #624
Full changelog

cloud-network-config-controller

OCPBUGS-33198: Avoid nil pointer panic while assigning private IP on Azure #141
OCPBUGS-22949: Azure: skip backend pool if attached to an outbound rule #128
Full changelog

cluster-authentication-operator

OCPBUGS-20683: CVE 2023 39325 [4.12] #653
OCPBUGS-22689: increase timeout for probes #639
Full changelog

cluster-autoscaler

OCPBUGS-45152: [release-4.12] VPA: Update OWNERS file #329
OCPBUGS-40928: update VPA golang.org/x/net for http rapid reset for CVE-2024-8421 #318
OCPBUGS-30911: Fix unstructured taint parsing in Cluster API provider #291
OCPBUGS-23274: Rebase 4.12 branch onto cluster autoscaler 1.25.3 #267
Full changelog

cluster-autoscaler-operator

OCPBUGS-32005: Update x/net to v0.25.0 #325
OCPBUGS-20754: Bump x/net package to v0.18.0 #300
Full changelog

cluster-baremetal-operator

OCPBUGS-32006: bump x/net to 0.23.0 #440
OCPBUGS-23291: hack for deploying V6-only clusters from dualstack hubs #389
Full changelog

cluster-capi-controllers

OCPBUGS-21521: bump golang.org/x/net to v0.17.0 #186
Full changelog

cluster-capi-operator

OCPBUGS-21055: Bump golang.org/x/net to v0.17.0 #138
Full changelog

cluster-cloud-controller-manager-operator

OCPBUGS-21148: Bump golang.org/x/net to v0.18.0 #297
Full changelog

cluster-config-operator

OCPBUGS-16243: retire LatencySensitive featureset #336
: OCPBUGS-21245: bump library-go to include switch to HTTP/1.1 #373
Full changelog

cluster-control-plane-machine-set-operator

OCPBUGS-48325: Add unreadyNodeGracePeriod for allowing brief node hiccups #344
OCPBUGS-35421: Improved debugging of API listing errors #306
OCPBUGS-21342: Bump golang.org/x/net to v0.17.0 #260
Full changelog

cluster-csi-snapshot-controller-operator

OCPBUGS-32429: create suitable role and roleBinding for csi-snapshot-webhook #207
Full changelog

cluster-dns-operator

OCPBUGS-52502: [release-4.12] Add runbook_url for CoreDNSErrorsHigh #435
Full changelog

cluster-etcd-operator

OCPBUGS-53508: fix CVE-2025-30204 #1416
OCPBUGS-35501: return errors in wait-for-ceo #1277
OCPBUGS-32001: update golang x net #1256
OCPBUGS-30914: Replace nodelister with master nodelister everywhere #1224
OCPBUGS-30938: fix panic in health check timeouts #1228
OCPBUGS-27776: [4.13] Remove z-upgrades from UpgradeBackupController #1185
OCPBUGS-23151: relax readiness to local serializable requests #1156
Full changelog

cluster-image-registry-operator

OCPBUGS-53868: Bump github.com/golang-jwt/jwt #1236
OCPBUGS-51594: bump golang.org/x/oauth2 #1223
OCPBUGS-36033: go.*,vendor: bump go-retryablehttp #1071
OCPBUGS-22125: increase storage account key cache expiration #939
Full changelog

cluster-ingress-operator

OCPBUGS-43703: Add e2e test for duplicate Transfer-Encoding headers #1158
OCPBUGS-43703: Add alert for RFC 7230 violation in Transfer-Encoding headers #1162
OCPBUGS-35454: internal service changed fix target port logic #1092
OCPBUGS-35304: TestHostNetworkPortBinding: Delete t.Parallel() #1083
OCPBUGS-35027: Don’t add clientca-configmap finalizer if deleting #1080
OCPBUGS-34888: desiredRouterDeployment: Set HostPort if needed #1076
OCPBUGS-34757: Avoid spurious updates for internalTrafficPolicy #1070
OCPBUGS-34110: Avoid spurious updates for scope in IngressClass #1056
OCPBUGS-34548: Use centos7 tag for quay.io/centos7/httpd-24-centos7 image #1068
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-50880: Increase waitForFallbackDegradedConditionTimeout #1811
OCPBUGS-22736: pkg/operator/configobserver: check that the serving certificate refer… #1571
: OCPBUGS-20855: bump library-go to include switch to HTTP/1.1 #1574
Full changelog

cluster-kube-cluster-api-operator

OCPBUGS-20962: bump golang.org/x/net to v0.17.0 #29
Full changelog

cluster-kube-controller-manager-operator

OCPBUGS-27068: bump(library-go)=release-4.12 #789
Full changelog

cluster-kube-scheduler-operator

OCPBUGS-27067: bump(library-go)=release-4.12 #529
OCPBUGS-21239: Sync deps CVE 2023 39325 4.12 #505
Full changelog

cluster-kube-storage-version-migrator-operator

: OCPBUGS-21336: bump library-go to include switch to HTTP/1.1 #98
Full changelog

cluster-machine-approver

OCPBUGS-23486: Filter non node CSRs in metrics #220
OCPBUGS-21430: Bump x/net package to v0.18.0 #214
Full changelog

cluster-monitoring-operator

OCPBUGS-35558: label for infra nodes for metric cluster:capacity_cpu_cores:sum #2383
OCPBUGS-28766: fix generation of telemeter token hash #2306
OCPBUGS-25389: Add RHACM telemetry metric for 4.12 #2204
OCPBUGS-21441: Set the new –disable-http2 flag for prometheus-adapter to disable HTTP2 #2148
Full changelog

cluster-network-operator

OCPBUGS-43872: manifests/02-cncc-credentials: Set skipServiceCheck for GCP #2548
OCPBUGS-38905: Add missing runbook for OVNKubernetesNorthdInactive #2479
OCPBUGS-37942: [release-4.12] update whereabouts crd #2461
OCPBUGS-29167: fix whereabouts conformance test failures #2256
OCPBUGS-29884: add env var in whereabouts-reconciler daemonset #2284
OCPBUGS-29302: Update ingressconfig_controller to use field Manager #2268
OCPBUGS-28801: [release-4.12] Add ConfigMap mount to the whereabouts-reconciler DaemonSet #2244
NO-JIRA: add kyrtapz as reviewer and approver for release 4.12 #2230
[release 4.12] OCPBUGS-23025: Add maxLogFiles config for OVN-K Audit Logging #2188
OCPBUGS-24039: remove all managed fields used by old manager #2099
OCPBUGS-21715: Bump golang.org/x/net and github.com/openshift/library-go #2124
OCPBUGS-24571: Disable weak SSH cipher suites #2164
OCPBUGS-25128: Update to go 1.19 and x/net 0.8.0 #2157
OCPBUGS-23293: IBMCloud specific: patch out management workload for dataplane component thats needed for bootstrapping #2108
OCPBUGS-20277: Edited multus-admission-controller deployment config to not add autoount a service account token #1884
Full changelog

cluster-node-tuning-operator

irqbalance: set banned cpus list to 0 (#1006) #1006
Refactor IRQ load balancing enable/disable test (#1038) #1038
Scheduler plugin: ignore IRQs (#1034) #1034
Disable HTTP/2 for webhook and metrics servers (#849) #849
Remove obsolete protocols and weak ciphers (#847) #847
Full changelog

cluster-openshift-apiserver-operator

OCPBUGS-22689: increase timeout for probes #558
: OCPBUGS-20694: bump library-go to include switch to HTTP/1.1 #556
Full changelog

cluster-openshift-controller-manager-operator

OCPBUGS-20777: bump(k8s,openshift) to address CVE-2023-44487 #311
Full changelog

cluster-policy-controller

OCPBUGS-21080: Bump deps to address CVE-2023-44487 [4.12] #136
Full changelog

cluster-samples-operator

OCPBUGS-63521: references to github.com/sclorg/django-ex.git now also refer to the branch #663
OCPBUGS-54913: add rhdmalone to owners #629
OCPBUGS-49664: add shannon and aroyoredhat as owners #600
OCPBUGS-21179: update k8s.io/apiserver version #590
Full changelog

cluster-version-operator

OCPBUGS-45333: deps: bump golang.org/x/net to 0.31.0 #1122
OCPBUGS-27443: pkg/cvo/availableupdates: Only bump LastAttempt on Cincinnati pulls #1024
Full changelog

console

OCPBUGS-74435: Bump lodash to latest #15973
OCPBUGS-44155: bump dompurify to latest #15595
OCPBUGS-57101: Add all files to vendor regardless of gitignore #15137
OCPBUGS-55210: Show Observe section without PROMETHEUS and MONITORING flags #14986
Dockerfile yarn line update #14838
OCPBUGS-45291: Application creation fail when manually entering input scaling value in local setup #14572
OCPBUGS-45235: Edit the secret and add the Chinese in the web-console, garbled characters will be displayed #14561
OCPBUGS-36561: Increase login flow state paramater length/entropy #14539
OCPBUGS-43639: Copy response code from proxied plugin requests #14423
OCPBUGS-33519: Observe > Metrics targets, Alert user if they do not have access to information on this page (e.g. 403). #14334
OCPBUGS-41600: Fix plugin proxy handler #14266
OCPBUGS-41854: Redirects to new PipelineRun logs URL from old PipelineRun logs URL #14283
OCPBUGS-34564: Routes created by devfiles do not always use HTTPS #13907
OCPBUGS-34933: Helm Plugin’s Catalog incorrectly renders a single index entry into multiple tiles #13930
OCPBUGS-32146: Bump graphql-go to v1.3.0 #13923
OCPBUGS-34845: Fix PipelineRun Logs tab navigation #13920
OCPBUGS-33778: fix issues with Edit Route form #13859
OCPBUGS-27479: Bump helm pkg #13528
OCPBUGS-29746: Add Pipeline metrics tab using plugin #13621
OCPBUGS-29348: Added Proxy to non k8s endpoints #13600
OCPBUGS-22431: Check if filtered object contains name property #13285
OCPBUGS-25213: add access review for impersonate #13440
OCPBUGS-18116: Bump helm version #13104
OCPBUGS-24236: Remove tech preview badge from Pipeline repository pages #13384
OCPBUGS-23413: Correct logout process #13342
OCPBUGS-24364: Subsequent PipelineRuns take initial PipelineRun name into account #13401
OCPBUGS-13357: add multipath device type to LocalVolumeSet #12805
OCPBUGS-23346: update the KnativeServing API version to v1beta1 for global-config extension #13334
OCPBUGS-23154: remove expandable toggle for conditional update risk d… #13322
Full changelog

console-operator

OCPBUGS-33386: Reset console operator’s conditions #898
OCPBUGS-20988: Disable HTTP/2 for webhook #876
OCPBUGS-30990: [release-4.12] Bump library-go and golang.org/x/net #867
Full changelog

container-networking-plugins

ART-13080: Fix Hermeto build issues #198
OCPBUGS-20593: build(deps): bump golang.org/x/net from 0.10.0 to 0.17.0 [backport 4.12] #131
Full changelog

coredns

OCPBUGS-59711: Bump github.com/golang/glog to v1.2.4 #151
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-58889: CARRY: don’t ignore json files #345
And 13 elided commits (e.g. from squash or rebase merges)
Full changelog

csi-driver-manila-operator

OCPBUGS-30295: Fix selector for manila-csi-driver-controller-metrics service #228
Full changelog

csi-driver-shared-resource, csi-driver-shared-resource-webhook

OCPBUGS-28953: Replace ‘coreydaley’ with ‘sayan-biswas’ in OWNERS file #169
OCPBUGS-23118: Should reference configmaps instead of secrets #154
Full changelog

csi-driver-shared-resource-operator

OCPBUGS-28959: Replace ‘coreydaley’ with ‘sayan-biswas’ in OWNERS file #105
Full changelog

csi-external-snapshotter, csi-snapshot-controller, csi-snapshot-validation-webhook

OCPBUGS-29244: cherry-pick:release-4.12: OCPBUGS-29244 Update VolumeSnapshot and VolumeSnapshotContent using JSON patch #140
Full changelog

docker-builder

OCPBUGS-43296: Bump buildah to 1.26.9 #449
OCPBUGS-43187: runc library bump to 1.1.12 #440
OCPBUGS-49345: skipping some unit tests to avoid failures as they are duplicate #437
OCPBUGS-48738: Add new team members to the OWNERS file #433
Replace ‘coreydaley’ with ‘sayan-biswas’ #408
BUILD-854: Add adambkaplan as approver #406
Full changelog

docker-registry

OCPBUGS-53652: bump jwt and oauth dependencies #442
Full changelog

driver-toolkit

OCPBUGS-63597: Remove realtime kernel from 4.12.z #176
Full changelog

etcd

OCPBUGS-28736: Rebase etcd 3.5.12 openshift 4.12 #246
OCPBUGS-27102: Rebase etcd 3.5.11 openshift 4.12 #240
OCPBUGS-21187: [4.12] Carrying fixes for CVE-2023-44487 #228
Full changelog

gcp-cloud-controller-manager

OCPBUGS-21282: Bump golang.org/x/net to v0.18.0 #44
Full changelog

gcp-cluster-api-controllers

OCPBUGS-21380: Bump golang.org/x/net to v0.17.0 #205
Full changelog

gcp-machine-controllers

OCPBUGS-24564: Reduce metrics cardinality. #76
OCPBUGS-20833: Bump x/net package to v0.18.0 #69
Full changelog

haproxy-router

OCPBUGS-43703: add duplicate_te_header_total metric #632
OCPBUGS-35875: Properly handle rewrite-target annotation #610
OCPBUGS-33432: Route ‘haproxy.router.openshift.io/timeout’ value is not validated #593
OCPBUGS-34212: Reject routes with MD5 certs #601
OCPBUGS-33517: Count active services before setting weight to 1 #581
Full changelog

hyperkube, pod

OCPBUGS-37282: UPSTREAM: 126104: Add funcs in pkg/filesystem/util that can actually … #2046
OCPBUGS-30454: CVE 2024-24786 #1974
UPSTREAM: <drop>: Bump golang.org/x/net to v0.23.0 #1940
Address CVE #13
OCPBUGS-15527: Prevent partially filled HPA behaviors from crashing kube-controller-manager #1887
OCPBUGS-25815: Fix device uncertain errors on reboot 4.12 #1833
OCPBUGS-25214: legacy-cloud-providers: prevent index out-of-range in getNextUnitNumber #1835
OCPBUGS-23568: Update to kubernetes 1.25.16 #1807
OCPBUGS-23288: UPSTREAM: 121881: Use golang library instead of mklink #1803
Full changelog

hypershift

Updating ose-hypershift-container image to be consistent with ART for 4.12 #6976
OCPBUGS-41516: set Konnectivity cipher suites #4283
Full changelog

ibm-cloud-controller-manager

OCPBUGS-24644: Add Snyk file to exclude vendor directory on scan #67
OCPBUGS-21113: Bump golang.org/x/net to v0.18.0 #57
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-58873: bump github.com/golang/glog to v1.2.4 #111
OCPBUGS-56067: tech debt: rework vendor patches #95
OCPBUGS-53908: bump github.com/golang-jwt/jwt/v4 to v4.5.2 #88
OCPBUGS-36063: CVE-2024-6104: bump github.com/hashicorp/go-retryablehttp to v0.7.7 #75
Full changelog

ibm-vpc-block-csi-driver-operator

OCPBUGS-60058: [IBM VPC] set offlineExpansion to false in e2e test manifest #153
OCPBUGS-36069: CVE-2024-6104: bump github.com/hashicorp/go-retryablehttp to v0.7.7 #124
Full changelog

ibm-vpc-node-label-updater

OCPBUGS-56067: tech debt: rework vendor patches #52
OCPBUGS-53540: bump github.com/golang-jwt/jwt/v4 to v4.5.2 #48
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-67292: [release-4.12] Fix incomplete vendor/ #134
OCPBUGS-21397: UPSTREAM: <carry>: bump golang.org/x/net to v0.18.0 #67
Full changelog

insights-operator

OCPBUGS-32004: bump golang.org/x/net version (#932) #932
OCPBUGS-28519: Add extra check in ids to bypass validations (#906) #906
adds helm information gather (#890) #890
OCPBUGS-23439: remove username & password config options (#869) #869
OCPBUGS-22922: create Prometheus rules programmatically according the… (#860) (#862) #860
Full changelog

ironic

OCPBUGS-48145, OCPBUGS-48596: Bump jinja to 3.0.1-6.el9.2 #627
OCPBUGS-43949, OCPBUGS-43957: Bump python-waitress [4.12] #609
OCPBUGS-37766, OCPBUGS-39385: Include fixes for CVE-2024-44082 #586
OCPBUGS-38513: set min version for python3-webob #558
OCPBUGS-33373: bump werkzeug #547
OCPBUGS-34897: bump jinja2 #541
OCPBUGS-32362: [4.12] remove unused prometheus-exporter #489
OCPBUGS-32386: Use unix sockets by default for reverse proxy communication #477
OCPBUGS-29229: Fix Inspector iPXE config for IPv6 addresses #454
OCPBUGS-23979: Ironic side of external_http_url (METAL-163) is not wired in correctly #431
OCPBUGS-23357: Upgrade werkzeug dependency #423
OCPBUGS-23182: Use bash process substitution instead of pipe #419
OCPBUGS-19064: Handle Eject DVD in 4.12 #417
Full changelog

ironic-agent

OCPBUGS-39385: Include fixes for CVE-2024-44082 #165
OCPBUGS-38513: set webob and bump werkzeug #153
OCPBUGS-29769: Always add ignition to set hostname on /etc/hostname #112
Full changelog

k8s-prometheus-adapter

OCPBUGS-21441: upgrade golang.org/x/net to 0.17.0 to address CVE #91
Full changelog

kube-proxy, sdn

OCPBUGS-56130: Handle openshift-host-network namespace as special when it modifies #657
OCPBUGS-20753: update x/net to v0.17.0 #615
OCPBUGS-22972: Change the permission of 80-openshift-network.conf to 600 #583
Full changelog

kube-rbac-proxy

OCPBUGS-32000: CVE-2023-45288 [4.12] #106
Full changelog

kube-state-metrics

OCPBUGS-20764: bump x/net to v0.17.0 #103
Full changelog

kube-storage-version-migrator

NO-JIRA: Add DOWNSTREAM_OWNERS (release 4-11). #231
Full changelog

machine-api-operator

OCPBUGS-43872: install/0000_30_machine-api-operator_00_credentials-request: Set skipServiceCheck again for GCP #1305
OCPBUGS-32007: Update x/net to v0.25.0 #1257
OCPBUGS-25303: Update reference URL #1189
OCPBUGS-21501: Bump golang.org/x/net to v0.18.0 #1176
Full changelog

machine-config-operator

OCPBUGS-58874: [release-4.12] Bump golang/glog to fix CVE-2024-45339 #5174
OCPBUGS-44325: Panic seen in CI job for MCC pod #4689
OCPBUGS-38382: [release-4.12] daemon/update: disable systemd unit before overwriting #4530
OCPBUGS-33665: Run resolv-prepender entirely async #4364
OCPBUGS-30829: Add existing kubeletconfig/ctrcfg mc-name-suffix annotation #4257
OCPBUGS-30823: Introduce kubelet-dependencies.target and firstboot-osupdate.target #4268
OCPBUGS-30329: set nodeStatusReportFrequency #4246
OCPBUGS-19659: After dual-stack conversion reconcile IPFamilies #3936
OCPBUGS-29366: release-4.12: fix nodeStatusUpdateFrequency #4180
OCPBUGS-29278: crio: drop automatic image cleanup on upgrades #4178
OCPBUGS-14071: Imageinspect takes type of error into account, drop podman inspect fallback #3717
Full changelog

machine-image-customization-controller

OCPBUGS-27090: configurable ironic agent vlan creation #119
Full changelog

machine-os-images

OCPBUGS-54173: Change rhcos release browser url #61
Full changelog

multus-admission-controller

OCPBUGS-60292: Bump github.com/golang/glog to v1.2.4 #107
OCPBUGS-60850: Update owners #109
OCPBUGS-21330: Update go.mod for CVE-2023-39325 [Release-4.12] #73
Full changelog

multus-cni

OCPBUGS-28520: Fix SAST scan issues for multus-cni-container [4.12] #225
OCPBUGS-21061: Update go.mod for CVE-2023-39325 [Release-4.12] #196
Full changelog

multus-networkpolicy

OCPBUGS-21420: Update go.mod for CVE-2023-39325 (#36) #36
Full changelog

multus-whereabouts-ipam-cni

OCPBUGS-37942, OCPBUGS-38019: [release-4.12] Stateful fixes #310
OCPBUGS-28801: [release-4.12] Enable whereabouts config #244
OCPBUGS-16008: Cherry pick fix assignment 4.12 #238
OCPBUGS-21499: update golang.org/x/net to v0.17.0 #209
Full changelog

must-gather

OCPBUGS-48086: Update owners #477
OCPBUGS-24523: [release-4.12] Add csi-proxy logs collection in must-gather for Windows nodes #394
Full changelog

network-metrics-daemon

-sOCPBUGS-59700:Bump github.com/golang/glog to v1.2.4 (#125) #125
Replace e2e test image (#134) #134
swtich golint install method (#133) #133
Correct 4.16 owners file (#131) #131
Added METRIC_TEST_IMAGE var (#92) #92
Update the k8s dependencies to 1.25.15 (#84) #84
Full changelog

nutanix-machine-controllers

OCPBUGS-51849: Fixing CVE-2025-22868 #121
OCPBUGS-47263: fixing CVE-2024-45338 #114
OCPBUGS-20956: bump golang.org/x/net to v0.17.0 #88
OCPBUGS-25675: Fix CI by running tests natively by default #62
Full changelog

oauth-apiserver

OCPBUGS-32010: bump x/net to 0.24.0 #113
OCPBUGS-21049: Bump K8s to v1.25 #104
Full changelog

oauth-server

OCPBUGS-27478: bump osin deps #144
Full changelog

oc-mirror

changes the owners file (#1011) #1011
OCPBUGS-48513: e2e: use same version of crane as in go.mod (#1027) #1027
Bump version to include v5.11.0 of go-git (#825) #825
OCPBUGS-385: Capability to override default channel (#749) (#796) #749
OCPBUGS-19429: Fix cross EUS channel upgrade path calculation (#779) #779
Full changelog

olm-rukpak

: OCPBUGS-27593,OCPBUGS-27678: Update go-git to v5.11.0 #76
OCPBUGS-23449: [release-4.12] Address http2 Vulnerability #64
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

openshift-apiserver

OCPBUGS-32447: ose-openshift-apiserver-container: golang: net/http, x… #481
: OCPBUGS-21429: Enable HTTP/2 CVE mitigation #399
Full changelog

openshift-controller-manager

OCPBUGS-58296: Inconsistencies in dependencies are fixed #410
OCPBUGS-58157: Set node-pullsecrets volume to read-only to protect image pull credentials #403
OCPBUGS-57171: Empty proxy variables are causing issues during the build #389
OCPBUGS-49644: Add new team members to the OWNERS file #364
OCPBUGS-41953: Add adambkaplan as approver #336
Full changelog

openshift-state-metrics

OCPBUGS-20706: bump x/net to v0.17.0 #106
Full changelog

operator-lifecycle-manager, operator-registry

OCPBUGS-61471: [release-4.12] Add NetworkPolicy as a supported kind #1054
OCPBUGS-61392: [4.12] e2e stability fixes #1087
OCPBUGS-46925, OCPBUGS-46932, OCPBUGS-47312: x/net bump to v0.34.0 [release-4.12] #943
NO-ISSUE: [release-4.12] Backport e2e fixes #880
OCPBUGS-38610: (fix) Resolver: list CatSrc using client, instead of referring to registry-server cache (#3349) #875
OCPBUGS-42161: adds paginating lister for evaluating CRs’ upgrade fitness versus new CRDs #873
OCPBUGS-41881: [CARRY] perform operator apiService certificate validity checks directly #866
OCPBUGS-32854: bump go-jose to v2.6.3 #782
OCPBUGS-35242: Unblock CI #773
OCPBUGS-27563, OCPBUGS-27568, OCPBUGS-27648, OCPBUGS-27653: bump go-git/v5 to 5.11.0 #688
OCPBUGS-27962: [CARRY] SSC RBAC #671
OCPBUGS-28229: Registry Pod Controller Flag #673
OCPBUGS-24619: Update to latest k8s v0.25.15 API server and enable HTTP/2 DoS mitigations #660
Full changelog

operator-marketplace

OCPBUGS-49426: Upgrade golang.org/x/net [release-4.12] #591
NO-ISSUE: Updating marketplace-operator images to be consistent with ART [4.12] #510
OCPBUGS-32081: update golang.org/x/net for CVE-2023-45288 #567
Full changelog

ovirt-csi-driver

OCPBUGS-23162: CVE-2023-44487: bump golang.org/x/net to v0.17.0 #131
Full changelog

ovirt-csi-driver-operator

OCPBUGS-23266: CVE-2023-44487: bump golang.org/x/net to v0.17.0 #128
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-59935: Dockerfile: Remove ovs version pinning #2698
NO-JIRA: Updating ose-ovn-kubernetes-container image to be consistent with ART for 4.12 #2092
OCPBUGS-55951: Bump ovn and ovs to latest 23.06 and 3.1 respectively #2554
OCPBUGS-50502: EgressIP: Reload certificates for the grpc heatlhcheck server #2457
OCPBUGS-35876: [release-4.12] ipv6+all protocols conntrack flush #2214
OCPBUGS-29864: CVE-2022-41723: avoid quadratic complexity in HPACK decoding #2204
OCPBUGS-34273, OCPBUGS-34414: Improves service iptables efficiency on start up + ICMP error messages to pass through #2184
OCPBUGS-32990: Bump OVS #2144
OCPBUGS-33422: [release-4.12] Full implementation of KEP-1669 ProxyTerminatingEndpoints + ETP=local fix #2135
OCPBUGS-25889: [release-4.12] OVN bump to 23.06.1-112 #2154
OCPBUGS-23259: [release-4.12] Update leaderelection config to allow retries #2017
OCPBUGS-28598: CARRY: Updates owners and adds Surya #2034
OCPBUGS-26700: [release-4.12] fixes MTU configuration on gateway router #2015
OCPBUGS-24420: OVNK/GW: Ignore headless services in syncServices #1972
OCPBUGS-23981: Netpol retryFramework cleanup #1977
OCPBUGS-26243: Fix Egress IP Deletion Handler to Prevent OVN Policy Leaks #2006
OCPBUGS-25096: Fragment oversized reply packets in LGW mode #1984
OCPBUGS-22091: Bump OVN to 23.06.1-39.el8fdp #1943
Full changelog

powervs-block-csi-driver

OCPBUGS-24733: synk: ignore vendor dir #62
Full changelog

powervs-block-csi-driver-operator

OCPBUGS-25717: snyk: ignore vendor dir #62
Full changelog

powervs-cloud-controller-manager

OCPBUGS-24740: UPSTREAM: <carry>: snyk code scan exclude vendor directory #52
Full changelog

powervs-machine-controllers

OCPBUGS-54012: Fix for CVE-2025-30204 & CVE-2024-51744 in github.com/golang-jwt/jwt/v4 in release-4.12 #123
OCPBUGS-24564: Reduce metrics cardinality #75
OCPBUGS-24738: snyk code scan exclude vendor directory #63
Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

OCPBUGS-20843: Bump golang.org/x/net to v0.17.0 #249
Full changelog

service-ca-operator

OCPBUGS-21026: CVE 2023 39325 (4.12) #231
Full changelog

telemeter

OCPBUGS-34827: fix issuer check during JWT authentication 4.12 #541
Full changelog

tests

OCPBUGS-56120: [build] Ensure Git Clone Does Not Run Privileged #29788
OCPBUGS-37799: Disable:Broken for [sig-builds][Feature:Builds][Slow] can use private repositories as build input build using an HTTP token should be able to clone source code via an HTTP token #29621
OCPBUGS-54772: Component Readiness: [Networking / ovn-kubernetes] [EgressFirewall] test regressed #29662
OCPBUGS-54147: Add/remove team members to the OWNERS file for Builds #29622
OCPBUGS-52585: Use payload pullspec for image info test #29593
OCPBUGS-41585: Removes dependency on samples operator images #29080
Full changelog

thanos

OCPBUGS-27100: Bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp to 0.44.0 #137
Full changelog

vsphere-cloud-controller-manager

OCPBUGS-21493: Bump golang.org/x/net to v0.18.0 #56
Full changelog

vsphere-cluster-api-controllers

OCPBUGS-21548: bump golang.org/x/net to v0.17.0 #24
Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

OCPBUGS-20417: syncer: fix nil pointer dereference in log message #98
Full changelog

View changelog in Markdown or change previous release:

Source code for this page located on github