4.16.23

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.16.23-x86_64

Team Approvals:

Tests:

Blocking jobs
- upgrade Succeeded release-openshift-origin-installer-e2e-aws-upgrade
- upgrade-minor Succeeded release-openshift-origin-installer-e2e-aws-upgrade
Informing jobs
- aws-ovn-serial Succeeded periodic-ci-openshift-release-master-nightly-4.16-e2e-aws-ovn-serial
- aws-ovn-upgrade-micro Succeeded periodic-ci-openshift-release-master-ci-4.16-e2e-aws-ovn-upgrade
- aws-sdn-upgrade-4.16-micro Succeeded periodic-ci-openshift-release-master-nightly-4.16-e2e-aws-sdn-upgrade
- azure-ovn-upgrade-4.16-micro Succeeded periodic-ci-openshift-release-master-ci-4.16-e2e-azure-ovn-upgrade
- fips-scan Succeeded periodic-ci-openshift-release-master-nightly-4.16-fips-payload-scan
- gcp-ovn-rt-upgrade-4.16-minor Succeeded periodic-ci-openshift-release-master-ci-4.16-upgrade-from-stable-4.15-e2e-gcp-ovn-rt-upgrade
- hypershift-ovn-conformance-4.16 Succeeded periodic-ci-openshift-hypershift-release-4.16-periodics-e2e-aws-ovn-conformance
- metal-ipi-ovn-bm Succeeded periodic-ci-openshift-release-master-nightly-4.16-e2e-metal-ipi-ovn-bm
- metal-ipi-ovn-ipv6 Succeeded (1 retries) periodic-ci-openshift-release-master-nightly-4.16-e2e-metal-ipi-ovn-ipv6

Upgrades from:

Untested upgrades: 4.15.18, 4.15.19, 4.15.20, 4.15.21, 4.15.22, 4.15.23, 4.15.24, 4.15.25, 4.15.26, 4.15.27, 4.15.28, 4.15.29, 4.15.30, 4.15.31, 4.15.32, 4.15.33, 4.15.34, 4.15.35, 4.15.36, 4.15.37, 4.16.0, 4.16.1, 4.16.10, 4.16.11, 4.16.12, 4.16.13, 4.16.14, 4.16.15, 4.16.16, 4.16.17, 4.16.18, 4.16.19, 4.16.2, 4.16.20, 4.16.21, 4.16.22, 4.16.3, 4.16.4, 4.16.5, 4.16.6, 4.16.7

Loading changelog, this may take a while ...

Changes from 4.16.9

Created: 2024-11-14 15:06:33 +0000 UTC

Image Digest: sha256:be725d2e56befbcb28068207b77d731650ad2c82ae77630f46631af750894347

Components

Kubectl 1.29.7
Kubernetes upgraded from 1.29.7 to 1.29.9
Kubernetes Tests 1.29.0
Red Hat Enterprise Linux CoreOS upgraded from 416.94.202408200132-0 to 416.94.202411111409-0 (diff)

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
ExternalRouteCertificate (0 tests)	Unconditional (Changed)	Unconditional (Changed)	Unconditional (Changed)	Unconditional (Changed)	Unconditional (Changed)	Unconditional (Changed)

Rebuilt images without code change

agent-installer-utils git 6e6bb40d sha256:521fb26c14e00a16524469ac5ff9e15fcc163854229a3d13a335c8c7e5a299c1
alibaba-cloud-controller-manager git 97e8335e sha256:c406784c4b15bcfac966b051c49a0bf94cad7b2e5aef6fcd5c0195b79fb37cef
alibaba-machine-controllers git 064d4624 sha256:85d72e68f3aa7f76220c1af1dec3d099072a623a70fefadb8bb7b2bb955b09c3
aws-cloud-controller-manager git a53e9def sha256:7c198d37b54f089ff37ac83915c7d374387149e847b8746ee84f8a627904845f
aws-ebs-csi-driver git 1d29a74a sha256:cc6472e614b4216271e7f0a116472e1ec16aa1a73684446db7fc16e3783613c8
aws-ebs-csi-driver-operator git ff69cd03 sha256:adc5e6c42b0239cf0bae5a820c950cfb66eee7af3ddb4c9d464b00394ef38111
aws-machine-controllers git 61d60f6c sha256:4f4992a78b8658120e71718025c49cd65883833531b8d3491dfde346f73e08f0
aws-pod-identity-webhook git 746491a6 sha256:e63625df136486bb02d8abff42f8ee0711f7354fde3949f4a612f951fac16772
azure-cloud-controller-manager git 0e955329 sha256:d5755ced29bfb1c767454d4e53061720b46b5923cf1e8f7cda3e53a0e783e744
azure-cloud-node-manager git 0e955329 sha256:70b5737b5ae469c5254c1a540fd5e69d7bff5229fbaff00d23f25c49210437b9
azure-cluster-api-controllers git a81e3b31 sha256:58110ceca7af6b8941f1ee473850e536a75334514c484516506fdc02e909c555
azure-disk-csi-driver git 6b55f6fb sha256:01541aa3bf506b70169ed44f6e0c79d6e151ef23cd9369839bc3312c87b72717
azure-disk-csi-driver-operator git ff69cd03 sha256:5d575425b73eaddac2ffdb352beff51ff25867e39195bb7ee63f6f6bce9cf945
azure-file-csi-driver-operator git ff69cd03 sha256:b8f1ebf4b91b8bf90f325e6c23a7c582c7a4a4583138f935f11f49e34faa9525
azure-machine-controllers git e4e11505 sha256:73224a6de2ec56a6202fbb449b05b59d9f33d088cebbf344a86052dc5d1d5bb4
azure-workload-identity-webhook git 4aca092a sha256:91c8ab14b2963a5f6c6ef5953c65cd2df6a15abc9f87cea5121b25c4d7cd64c7
baremetal-machine-controllers git 11ba601f sha256:b02ea1a69831b8c38d15b9c0b68d4d688a7fb6c0949418dc10893287661336d2
baremetal-runtimecfg git f55a330f sha256:ebb67d3991b9144728ccdba493d387f85dabf086748444c3f31e32bc02cc6555
cloud-network-config-controller git 8ceee788 sha256:d0c3fbabaf9f39715715cad424d209e3b654301e9d02caa53c7127b3f88a5920
cluster-autoscaler git eecb123a sha256:7f1df31add1512a69529ed11c7296d4d873e44f3b957dacbc7dd6596ac8c399c
cluster-autoscaler-operator git 40cadf8a sha256:dedf2d2b7b09fd5399e400dde52ec74465177a1212ccc671fd0737fadc955427
cluster-bootstrap git 27bfb59f sha256:a925e3e0df4ea327e7d5a257ba735e00bf75f5172d9a5deaa716105ce33211f0
cluster-capi-controllers git 5830a10a sha256:42643e8e85525e0e34ce883c2127f257895c90db86bc78cde116c49ab3e5a76f
cluster-capi-operator git 3a2f98fb sha256:8689f8043b51b8b8213c41a13f390aee309e1d05d625d80a67e9a45cc0e28cdf
cluster-config-operator git 441d29c9 sha256:a677c2b7665ed2a69fe3eb791c974fec3143e3fa245bb816c9568f03d93f53b5
cluster-csi-snapshot-controller-operator git 439826e1 sha256:42ccb7180c1707753293b95c4f756e835dd5489c6f43c6aa4a186069f1e277c4
cluster-dns-operator git 8ddf28f9 sha256:3a0822ac040cc9ef5d48367ca17608544a8aa617b6fbdf0e4c802002f83d0bd2
cluster-kube-apiserver-operator git de2f2ac2 sha256:c62ffa6f60bc631fdf7f169d0210df13f8f5ea57ed945d65e686441125e1e6a7
cluster-kube-cluster-api-operator git 95ceaa9e sha256:3edd94c14ea2c0692ce29d2b5a2f73043ecea7df27224e4b7c3e337bb93b4dbc
cluster-kube-controller-manager-operator git 0338b3be sha256:999db63f0cdcd3865b0ff684e6a06b783e72fcfd6ee89e5924224d042bfe68d3
cluster-kube-scheduler-operator git 630f63bc sha256:662c032441827ce83f6c8e314ea93ddc89782c87024b32acb364bf680246bf5d
cluster-machine-approver git 3eba7eed sha256:20541e20f93b98729ea6006e42c272ba5048d91d7def30447cf0cb12963b640a
cluster-olm-operator git 27bf70dd sha256:3d5397d64ef31b301022168d5bcbf8203d5ffebfd685e8f264ba602d79e34ebc
cluster-openshift-apiserver-operator git d26f3002 sha256:b692033c27bd775f0ec06cb2d54781ca1a26c3547d5597d9ec018ebcfe1e2955
cluster-policy-controller git eaea543f sha256:5f205997b18408d5b61f036babaf601e5d10dc55e06bcf737ff71518934bcad3
configmap-reloader git dc91ddc4 sha256:85289316569f64dffebd052d2d59201a9febcd10e459d87f1f904de60c7a8818
console-operator git 92447df5 sha256:109140afd40876ed3485c916e653aac38df0d1f34792bd1e525abcb1fcbfe89e
container-networking-plugins git 73b4123c sha256:30518242552a59b2d31e0debcbdd9be6504fbef1d5facae50adb361c8be3c977
containernetworking-plugins-microshift git 73b4123c sha256:26b04ff4e4653e93252bfe2ed9ede4a5aeb5b1b1c5115024b6322804985d7d4f
coredns git 1e417656 sha256:a1895cf15a94122557345c2aa2960ecec6132616b2e66789abac4faca9980e0f
csi-driver-manila git b7e9010d sha256:c4878cb3aed48ef79117a3372ddd4c434fd27208e5f9d71ef6075bae85db6eaf
csi-driver-nfs git 406cec72 sha256:0450691306a6b589801723684ebc8521290c6d7718144a1a1fbfe535c1ddd3b7
csi-driver-shared-resource git bc125def sha256:a88a3f11d562365c6a92159243941eac76a213e8951ce0cc2055b81e92fc35cb
csi-driver-shared-resource-operator git 1e1194bc sha256:54192f934589799b81c710d6410faa9696a7c8a56a176dc72e4196da10ced2c9
csi-driver-shared-resource-webhook git bc125def sha256:28b1269121cd53a65ab75da41a6ebe47238f3cebb63d25917a0095b02f483102
csi-external-attacher git 7da80aab sha256:5bc7bfb014fccf6a29753574553c1da2addaf0994d026f95990aa062fed7f6a6
csi-external-provisioner git 9e8af011 sha256:9e1fe527e4c089f137e6780699ae7aff8a0391f9f787e3d0019dd2f022bcfe1d
csi-external-resizer git bdf5bfb4 sha256:b48d8766b64e28e5765869edcea7edf4ef7355b5c69dc8e96af033e9fbc349f9
csi-external-snapshotter git 5315d37a sha256:f784ee0bb36cfa7a47985cbd507efd034c7c204f859a5bd7c6d18be99793cff4
csi-livenessprobe git f5e3ff55 sha256:b6900242fd456c8320273186ec38a971e478ed545180547df9c75502d2b902f0
csi-node-driver-registrar git 8930c368 sha256:3edd19b26087eedba087fd01d31fb5d9eaa591ad1114212b8c8104328cd8e658
csi-snapshot-controller git 5315d37a sha256:e0af3d1b7b1352b79bbd963e58c4e0d5289168d2f6faaf08edc2e764f1a1b9da
csi-snapshot-validation-webhook git 5315d37a sha256:41418dafa4fc53ff3a75edafbdbad7fb4d9905eb2d89ef6a0dfac12e9527869c
driver-toolkit git 1d5732f0 sha256:56d46f312253d113bb362792c491697a13063fc2cc57fa143ceba6c79739f326
egress-router-cni git 7089efe6 sha256:f5f1f46492246cbee0e12ab0cf99b8e54f0e922f7491c3819fb599082e247bb6
etcd git 16202ec4 sha256:5df2226c7a153b8dc48045476f66d5e44aa1ee78f125ee8945629c0c762a52e4
gcp-cloud-controller-manager git 26b43dfc sha256:5db90564d6f79157b216bfa6c42345cf7e139cf44c930537735c1b0c296563fd
gcp-cluster-api-controllers git 02432df8 sha256:faa9fbf761b7caeabbeb9767d95bb53f6e8fa06662b63dbf01b15a89ec0d43f6
gcp-machine-controllers git e72657c0 sha256:fff20daffc9647d4bd4fd71cecf422c779e8dab4352b0c7846f14f15b0df83e2
gcp-pd-csi-driver git 5ed71c64 sha256:b447089f42f352b121d39103cc2a6b4c76d3f236e7647d75b056aed406df64ac
gcp-pd-csi-driver-operator git 799327f7 sha256:c18e5cf3bcc11557d530306e55453e8477723d7f8e8a9694e8f87d2f8ca90f6a
haproxy-router git 4d9b8c4a sha256:a10db45170704ab93913db34a7f3f8ee40b05aba2e66b0649ed1c3531070b6a6
ibm-cloud-controller-manager git f961f16d sha256:15aa01188898153721b0650fe3610faade87e51631402da0ffd4ce63b3bb82d7
ibm-vpc-block-csi-driver git 95719738 sha256:ab53290e7ea1514781c1bccee380ffc356c03a0d051b330836f34eb5e03a5ab7
ironic-machine-os-downloader git 93b8b5fa sha256:9352f0a3c96e80b36c1a49035434973e4fd7da35cf18dc064a6166a6ab8bd49e
ironic-static-ip-manager git e78e4c3e sha256:baaabfbe2a3e86588682d1992eb71c239d4f0fdcc394e677ee1d86834d074078
k8s-prometheus-adapter git e4f859be sha256:60cdf1718a999af97cc29cab0d9ce903cddd0905fca8b0c85100a738e580f3ed
keepalived-ipfailover git b58673a3 sha256:1eef4b4a3b96c794f94ee51d8922f57cf2375613317fb1b262fa5b2ede6863ec
kube-state-metrics git 9b67b8d1 sha256:714d2252a5ab6e7fee4e396329345872dbf6f2854b219dc8208273a9b82f00db
kube-storage-version-migrator git 969a60e9 sha256:a7a798a99f114aaa997f950259e87e6953e3f1a3a90ffd2826f45d5e2ec61023
kubevirt-cloud-controller-manager git 3db76104 sha256:05edc21c8a327df0763f71b47e316e79d85cad20cb1b0bf7dda25ac476631265
kubevirt-csi-driver git 0693093f sha256:18265e1ada8a32fb4a4ff386f5c052427f949368b2afdf9436238e355a1bd325
libvirt-machine-controllers git a336f0b5 sha256:b27afd988f453c2e3664899a82a22035dfa0ccd417b7369b1dd376d8583b5dcd
machine-image-customization-controller git 39480963 sha256:0d18fed32abc347963d8a593876659fffeba2b4b187881b7647a56d47a1ed3f6
machine-os-images git 3cc97098 sha256:3c3c670b81807ed2e33d2965889af90bc33c3532fa6df7c8c36c98c6ca8a3dd2
multus-admission-controller git 88c596ed sha256:3cd1c2ecc0e88c69e0544813aef39582551fd115e4b710c42f39047e71f8afc3
multus-cni git c4aa21b9 sha256:66a46c4c4a266f1745f1ff556a892636457d1f4128ba6fe1daaa7795d5460638
multus-cni-microshift git c4aa21b9 sha256:667fe07e934e04aabb774a74983b1f24ee02c4b86e4a4ae8d6c2da26f7538bb2
multus-networkpolicy git f988f894 sha256:31f80b3fbf3dd0491ea335c16f8a83fd2189c5f2a506b3f9b68bee93d30745ab
multus-route-override-cni git 73594f77 sha256:f751fd4c3ec1286062b670ee07160c983409acf6ad7ae00cc5ab3c4343a327c8
multus-whereabouts-ipam-cni git dab1dd29 sha256:e3baea618ddd2d06cafc3b7592290b1b844beeceee749977726e3e570d56123f
network-interface-bond-cni git bb911451 sha256:eccd5c8e9223d5befb2791c1cdbfe4704632487ea726efec71cafa6101f781f8
network-metrics-daemon git 48059263 sha256:cfbe7b267b9d6002be156470a1462dae1ef0ef812c6b3bb622683faa04c700e6
network-tools git 39eca100 sha256:6577ffa4cfbbf8b15b8d29a8e2e370d8e25aa58b5b359da3a501eeef3f7c7d09
nutanix-cloud-controller-manager git c9bbc44c sha256:03fc08d083c65cc60000ea16de80d729f161a579c5ab011945982690c237f5b2
nutanix-machine-controllers git f053e5a0 sha256:35a4755835f834233cbb014e2aee2b11c13b2ec79b994cc23581400084254537
oauth-apiserver git fa1f097c sha256:55952992000b46d66e08566ac9f498fda8e995eb0e21990175bae8a98a02cd02
oauth-proxy git 30f80124 sha256:0241730a986af7738001571df8efdd4da43f52bb1f29b66fcc4e28fe45132e12
oauth-server git 3739138c sha256:8517207c3977f5c1864b7afe313c167e1b16b39ff7e6609bf8e0b789a854aa89
oc-mirror git 819f0115 sha256:bb466f29709f908cf72758b2bbca534d66c0070ebf7d07c0e90839e1651cc115
olm-catalogd git 79975a51 sha256:d15c8fe45eb2961f68a5f23efd37d4ad915c681315f377b5525df977562987d0
olm-operator-controller git 80b8649c sha256:fbc3f7fa637d61a894ea7c2177d7c040affa7f86d1966135570f6dad54b8226a
olm-rukpak git 282cc84c sha256:61bf9db4e85c0fd0f36a6de1df1865327631c10f3b3fcf7ed3c0dacba35e3a7c
openshift-state-metrics git 59b8a0ff sha256:d6f2825b3007c6a80ff704fa19c07039064a07a554eeebe4ebcc73f78b3a2706
openstack-cinder-csi-driver git b7e9010d sha256:d2f8d64797c6eb582e3381356c06ae6f89ce109b4cd212c5b4930684e4e8fc51
openstack-cinder-csi-driver-operator git 85b52097 sha256:f6f5abbef09136f8b6a60e9777d104305c92836e772cce620488ed5f22c3c82b
openstack-cloud-controller-manager git b7e9010d sha256:d0e9fbefd65478a280285f74e0fdf44e8b438510552f3ae09646aa1ad13b6878
operator-marketplace git 7db179fb sha256:d7052571473ed0dca5555647698b0d2a6e79b1e5af953bb6c699119bccd4a512
ovirt-csi-driver git 1db726a9 sha256:2844fa15da567828cfb8c850e26319fa56514f4add1805c7e7de1f030ff55bf2
ovirt-csi-driver-operator git ac852f3e sha256:ec896f6f6439f1994c481c27aa887df6dc602a82e3a6e5946f790e6cd6ea5ea6
ovirt-machine-controllers git abb91c84 sha256:2ecbe537e1c03355a2dde26a17a412581588cc3387b66d00cd4e0f2e9f9569e1
powervs-block-csi-driver git 26162bad sha256:200e2a98bb7af0931d9dd5f9d50f6f47cd95c1447ac7fe0ebdb46ad3e37f035a
powervs-block-csi-driver-operator git 9c5dd8d1 sha256:5142eae63d8a22219a055dca6a9307553a58a51ad42223b95fb0332c328ae8e0
powervs-cloud-controller-manager git 20e6dc70 sha256:a0d5c0c197f8cd1632ae4fb0c1aad7d11801759f4c5f07712959de7307339e49
prom-label-proxy git 5e14722e sha256:185b1dd05de4b40ffa731eb6653257cb8ad21daeacbb7db4299a5d3b7e343444
prometheus-alertmanager git e9aea929 sha256:e33560c649c233d23590288a856ba59a545ff9555dbb32810ae0bb1a15f8c77f
prometheus-node-exporter git 29ba26d1 sha256:1b166125a553d358fae3dfd78dd2f7f34d1383ff71d1dc47a46f4d68e445a1e8
rhel-coreos sha256:a237251d5d004eb0d021037b4f9fd912f9a998a5d561c2139f579306f7428177
rhel-coreos-extensions sha256:4982b3bc1020949e0d3f5f36ca28d0bae957b2a524995e1687b2b8dda3e776b5
route-controller-manager git 3112b458 sha256:537e7d51e90be64555d993300ea8ed7cc663c4104545f7504019d74406bf182c
service-ca-operator git 538c7b98 sha256:0ecac1bdbb696c99703c2182dc9063f6d9b15047d349e4701c0dbcb0d61d7c3c
telemeter git c1ecd105 sha256:fc9b840520b12f8045ba67cddb8152d9c2d98937aa2adfc60bec83c11aace8ff
thanos git 85eee25c sha256:95effccc5c64952aed4c1449fe919ba3dc280daf125df7d934dfbe209b9b42b9
vsphere-cluster-api-controllers git be22f10a sha256:0e04e0300e484ffda50ff6d486b8e50e73e18bbbbf471d8760533d5048970e53
vsphere-csi-driver-operator git 483de9c5 sha256:d23b3be55ca1e812adf9f0123a23bbfde6bf96a8833551bfa607c94be176f016
vsphere-problem-detector git 3683c120 sha256:95587f7d57d62baa8035d285bb14e4032af12846a1131c6627c490eb766ec805

agent-installer-api-server

OCPBUGS-43021: Update go-jose to v2.6.3 to mitigate CVE-2024-28180 (#6893) #6893
OCPBUGS-42570: Libraries bump to mitigate CVE-2024-27289 (#6833) #6833
OCPBUGS-36577: Switch to github.com/docker/distribution/reference to Mitigate CVE-2024-3727 (#6752) #6752
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-38466: Allow controller to continue when assisted-service (#914) #914
OCPBUGS-43025: Pick up latest CVE changes by bumping service (#920) #920
OCPBUGS-36577: Switch to github.com/docker/distribution/reference to Mitigate CVE-2024-3727 (#906) #906
Full changelog

agent-installer-node-agent

OCPBUGS-43028: Pick up latest CVE changes by bumping service (#804) #804
OCPBUGS-42300: Switch to github.com/docker/distribution/reference to Mitigate CVE-2024-3727 (#785) #785
Full changelog

apiserver-network-proxy

OCPBUGS-38062: Revert “Agent: Respect HTTPS_PROXY env vars for proxied connections” #59
Full changelog

aws-cluster-api-controllers

OCPBUGS-44234: [release-4.16] OSD-25934: Only tag NetworkInterfaces in RunInstances if IAM Allows It #531
Full changelog

aws-kms-encryption-provider

OCPBUGS-33693: Updating aws-kms-encryption-provider-container image to be consistent with ART for 4.16 #18
hack: display diff on verify-mod-tidy failure #26
Full changelog

azure-file-csi-driver

OCPBUGS-39145: bump mount-utils to treat ENODEV error as corrupted mount #76
Full changelog

azure-kms-encryption-provider

OCPBUGS-33692: Updating azure-kms-encryption-provider-container image to be consistent with ART for 4.16 #4
Full changelog

baremetal-installer, installer, installer-altinfra, installer-artifacts

OCPBUGS-44348: Cherrypick oci ccm fix to 4.16 #9188
OCPBUGS-43967: Revendor assisted service external platform oci #9150
OCPBUGS-38930: import failure when esxi config is not the same in the cluster #8898
OCPBUGS-36290: IBMCloud: Ignore failed VPC regions #8674
OCPBUGS-41885: vSphere - If template is defined skip downloading #8999
OCPBUGS-41490: Update RHCOS 4.16 bootimage metadata to 416.94.202410211619-0 #9158
OCPBUGS-43476: IBMCloud: Handle pagination for subnets #9102
OCPBUGS-41490: Update RHCOS 4.16 bootimage metadata to 416.94.202410172137-0 #9132
OCPBUGS-42014: Update terraform provider for google #9077
OCPBUGS-38732: vsphere, if secureboot is enabled, disable it in the template #8904
OCPBUGS-39415: OpenStack: Install CI dependencies from rpm #8995
OCPBUGS-41334: Fix IPv6 security group rule for schedulable master #8971
OCPBUGS-38687: only allow a single network in failure domain topology #8875
OCPBUGS-42062: OCPBUGS-41865: [release-4.16] vault version updated to 1.13.10 #9036
OCPBUGS-42012: Systemd Fails to Parse Multiline EC Keys #9037
OCPBUGS-41845: Bump extract-machine-os timout to 20m #8997
OCPBUGS-38964: IngressController subnet selection in AWS #8910
OCPBUGS-42138: add tested instance type for IBMCloud #9031
OCPBUGS-39287: Fix var_files syntax to work on older version of ansible #8936
OCPBUGS-41929: Add AWS c7g,m7g,r8g to tested instance types #9009
OCPBUGS-36855: Openstack UPI - Reintroduce unique resource names. #8724
OCPBUGS-39082: incorrect folder gen, workaround govmomi vm folder path bug #8912
OCPBUGS-39496: capi/aws/byo-vpc/multi-cidr: fix group rules #8953
OCPBUGS-36861: Updates GCP terraform worker role #8939
OCPBUGS-38956: failed to install Nutanix OCP 4.16 cluster with DHCP #8905
OCPBUGS-38822: upstream capv bug causes session timeout #8891
OCPBUGS-39468: Enable TLS for virtual media in initial ironic deployment #8955
OCPBUGS-37606: vSphere validation fails if dc is in a folder #8777
OCPBUGS-39206: Update GCP Disk Types 4.16 #8920
OCPBUGS-39087: aws: validate public-only subnets configs #8913
OCPBUGS-38821: [release-4.16] Azure: Disable shared key access when using a managed identity #8855
OCPBUGS-38302: upi/aws: update lambda runtime python version #8897
OCPBUGS-38826: aws: add support for clusters with public-only subnets #8892
OCPBUGS-38517: [release-4.16] capi/aws: bump provider for instance register fix #8848
OCPBUGS-38196: Remove timed context for gcp client #8818
Full changelog

baremetal-operator

OCPBUGS-39490: Disallow fetching secrets from namespaces different from the host’s one #378
OCPBUGS-38938: [OCP] Ability to disable agent power off after deployment #372
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-42720: Check cast result in adm prune deployments to prevent panic #1891
OCPBUGS-39341: Ignore pruning when deployment points to replicationcontroller #1862
Full changelog

cloud-credential-operator

OCPBUGS-43645: Only attempt timed token credentials on supported platforms. #772
OCPBUGS-43337: Update github.com/sirupsen/logrus v1.9.3 #767
OCPBUGS-41234: List secrets in batches to avoid api timeout #757
OCPBUGS-38376: Update google.golang.org/grpc v1.65.0 #748
Full changelog

cluster-authentication-operator

OCPBUGS-43367: manifests should not use APIs that are removed in upcoming releases #717
Full changelog

cluster-baremetal-operator

OCPBUGS-43556: SCC-pinning for metal3-baremetal-operator #453
OCPBUGS-31961: bump x/net to 0.23.0 #431
Full changelog

cluster-cloud-controller-manager-operator

OCPBUGS-42125: IBMCloud: Modify liveness probe for IBM Cloud CCM to use loopback address #366
OCPBUGS-43473: update goimports targets #372
Full changelog

cluster-config-api

OCPBUGS-38773: remove duplicate featuregate ‘ExternalRouteCertificate’ #2007
Full changelog

cluster-control-plane-machine-set-operator

OCPBUGS-44179: relax validation on delete and if failureDomains not configured #331
Full changelog

cluster-etcd-operator

OCPBUGS-33673: rename flowschema to avoid log noise in CVO #1348
Full changelog

cluster-image-registry-operator

OCPBUGS-43797: fix proxy config and leader election test flakes #1148
OCPBUGS-43555: pkg/storage/azure: also check for auth failure error code on deletion #1143
OCPBUGS-42933: azureclient: stop validating credentials when creating the client #1134
OCPBUGS-42420: Continuous pull-secret updates / slow initialization on build01 (test platform infrastructure) #1126
Revert “[release-4.16] OCPBUGS-41903: pkg/operator/azurepathfixcontroller: do not sync on non-azure storage” #1119
OCPBUGS-41903: pkg/operator/azurepathfixcontroller: do not sync on non-azure storage #1115
OCPBUGS-39098: Avoid Shared Access Key usage for Azure Storage Account when using Managed Identity based auth #1104
OCPBUGS-38894: pkg/resource/azurepathfixjob: invoke update-ca-trust extract with –output #1102
OCPBUGS-38894: pkg/resource: invoke update-ca-trust extract with –output #1098
Full changelog

cluster-ingress-operator

OCPBUGS-39324: Refine logging for accurate infra CR status updates #1139
OCPBUGS-39323: Ingress operator status not degraded when canary route fails #1138
Full changelog

cluster-kube-storage-version-migrator-operator

OCPBUGS-38269: bump protobuf #115
Full changelog

cluster-monitoring-operator

OCPBUGS-43826: Add runbook url for TelemeterClientFailures #2508
OCPBUGS-41967: disable user-defined monitoring per object #2474
OCPBUGS-42067: Reapply “chore: poll immediately in the e2e tests” #2476
OCPBUGS-41717: Configure graceful shutdown for metrics-server (4.16 backport) #2467
OCPBUGS-41910: filter alerts sent to Telemeter #2471
OCPBUGS-39170: Backport #2441 for 4.16 #2447
Full changelog

cluster-network-operator

OCPBUGS-43604: OCPBUGS-42244: Exporting environment varialbe NODE_CNI for live migration #2538
OCPBUGS-36210: Set global IP forwarding sysctl parameters while starting ovnkube-node #2422
OCPBUGS-43544: Use CNIConfDir for mounting directory to ovn-ipsec-host pod #2537
OCPBUGS-43035: Configure narrowing=yes for IPsec connections #2528
OCPBUGS-36594: Set mount propagation to HostToContainer for /var/lib/kubelet #2430
OCPBUGS-41840: Add configurable subnets while running hybrid-overlay-node binary #2502
OCPBUGS-37763: Handle random crictl errors in iptables-alerter #2452
OCPBUGS-41555: HyperShift: do not use antiaffinity on single replica control planes #2494
OCPBUGS-37937: Add proxy env vars to onvkube-node #2457
OCPBUGS-41607: set required-scc for openshift workloads #2496
Full changelog

cluster-node-tuning-operator

Fixing empty tuned submodule when using Dockerfile (#1212) #1212
OCPBUGS-38900: Drop sched_migration_cost_ns setting (#1203) #1203
Make ocp-tuned-one-shot.service restart on-failure (#1202) #1202
Unblock 4.16 CI (#1204) #1204
e2e: performance: verify tuned one-shot service vs kubelet (#1192) #1192
E2E: Add test to verify cpuset.cpus.exclusive is writeable (#1153) #1153
OCPBUGS-39005: Add cluster-wide proxy env file (#1166) #1166
OCPBUGS-36431 Fix generated cpu mask for 512+ cpus (#1152) #1152
E2E: Remove checking of reserved cpus in irqbalance file (#1156) #1156
Full changelog

cluster-openshift-controller-manager-operator

OCPBUGS-38269: CVE-2024-24786 infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON #363
Full changelog

cluster-samples-operator

OKD-225: remove only the EOL CentOS 7 images #576
Full changelog

cluster-storage-operator

OCPBUGS-43315: assets: shared-resource: hypershift: add pull-secret to operator SA #521
NO-JIRA: release-4.16: Run make update #512
Full changelog

cluster-update-keys

OCPBUGS-43467: keys: Update Red Hat keys to use SHA256 signatures #64
Full changelog

cluster-version-operator

OCPBUGS-43964: Fix desired before sync_worker’s work is initialized #1097
Full changelog

console

OCPBUGS-43834: Enabling topology e2e tests on CI #14438
OCPBUGS-35204: replace global refresh sync lock in OIDC provider with per-refresh-token one #13950
OCPBUGS-36556: Increase login flow state paramater length/entropy #14354
OCPBUGS-42369: Console crashes when ssh is selected in add secret for starting a pipeline run #14320
OCPBUGS-41904: fix annotation for ovn localnet #14366
OCPBUGS-37615: Include PatternFly-4 chart styles so they are available for dynamic plugins that still use PF4 react-charts #14091
OCPBUGS-37689: Switch to use annotations as labels from PipelineRuns created through Pipelines as Code is deprecated #14094
OCPBUGS-42015: Topology screen crashes when completed pod is selected #14298
OCPBUGS-35850: Fix: Quick Start “next” button requires double click to move to next step #13989
OCPBUGS-42382: Allow operators to enable monitoring by default #14317
OCPBUGS-41905: List of default Camel K event sources disappears when adding a custom event source #14290
OCPBUGS-41709: Need to allow blank for Project/namespace when setting SA Subject in ‘Project access tab’ #14278
OCPBUGS-42069: add Create button to Console plugins tab #14302
OCPBUGS-41996: Fix updating the “Until” field on the Silence > Edit page #14296
OCPBUGS-38112: do not directly mutate links in useMemo #14117
OCPBUGS-34518: Restore user toggle when authentification is disabled #13902
OCPBUGS-41619: Use vCenterCluster value from CM as primary resource #14268
OCPBUGS-37046: Fix TypeError: Cannot read properties of null (reading ‘metadata’) in Topology view #14059
OCPBUGS-38911: Values entered into the Instantiate Template form are automatically cleared #14187
OCPBUGS-38914: Unrelated readme opened when opening CodeReady workspaces from Quarkus using s2i quickstart #14188
OCPBUGS-38968: A value submitted in From view is wrapped with single quotation after switching to Yaml view. #14193
OCPBUGS-38424: fix bug where cluster version text appears black in da… #14144
OCPBUGS-38464: correct casing in “Lightspeed” #14148
OCPBUGS-37430: Fix utilization card limits/total display #14082
OCPBUGS-36510: DeploymentConfigs deprecation info alert should not present on the Edit deployment page #14031
OCPBUGS-37954: No access to list pipelines.tekton.dev prevents from using Delete application form #14107
OCPBUGS-36601: Tooltip on Pipeline when expression is not shows #14033
OCPBUGS-38803: CONSOLE-4108 [4.16 backport] Show deprecated operators in OperatorHub #14095
Full changelog

csi-driver-manila-operator

OCPBUGS-38458: Add missing healthchecks #241
OCPBUGS-30438: Bump protobuf dependency #237
Full changelog

docker-builder

OCPBUGS-30455: bump google.golang.org/protobuf to 1.33.0 #402
Full changelog

docker-registry

OCPBUGS-39412: pull upstream distribution changes to use a consistent multipart chunk size #410
Full changelog

hyperkube, pod

OCPBUGS-42555: Allow pod to be scheduled if node’s name and hostname mismatch #2099
OCPBUGS-42168: Bump k8s api to 1.29.9 #2090
release-4.16] OCPBUGS-42057: UPSTREAM: <drop>: bump(github.com/openshift/apiserver-library-go) #2096
OCPBUGS-39015: Bump k8s api to 1.29.8 #2066
OCPBUGS-36773: UPSTREAM: <carry>: Disable vSphere tests with pre-provisioned volumes #2021
Full changelog

hypershift

NO-JIRA: Update Konflux references (release-4.16) #5099
chore(deps): update konflux references (release-4.16) #5078
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.44 (release-4.16) #5059
NO-JIRA: chore(deps): update konflux references (release-4.16) #5058
NO-JIRA: Update Konflux references (release-4.16) #5042
chore(deps): update konflux references (release-4.16) #5024
chore(deps): update konflux references (release-4.16) #5019
NO-JIRA: Update squidfunk/mkdocs-material Docker tag to v9.5.43 (release-4.16) #5017
NO-JIRA: Update Konflux references (release-4.16) #5012
OCPBUGS-43840: add ValidIDPConfiguration condition to report IDP config issues #4985
NO-JIRA: chore(deps): update konflux references (release-4.16) #4971
OCPBUGS-43046: Do not send traffic to local audit-webhook through konnectivity #4883
NO-JIRA: chore(deps): update konflux references (release-4.16) #4954
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.42 (release-4.16) #4947
NO-JIRA: chore(deps): update konflux references (release-4.16) #4933
OCPBUGS-43104: label routes only when HCP router used #4899
OCPBUGS-43308: Use guest DNS resolution in Konnectivity HTTPS proxy by default #4905
NO-JIRA: chore(deps): update konflux references (release-4.16) #4923
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.41 (release-4.16) #4919
NO-JIRA: chore(deps): update konflux references to 674e70f (release-4.16) #4908
NO-JIRA: chore(deps): update konflux references (release-4.16) #4896
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.40 (release-4.16) #4880
OCPBUGS-42432: Use KubeClientCABundle for HostedClusterConfigOperator cluster-signer-ca #4799
OCPBUGS-42342: Let payload generation pick the release for the NodePool #4787
OCPBUGS-42431: Conditionally manage kubeconfig secrets for DNS and Ingress operators #4798
NO-JIRA: chore(deps): update konflux references (release-4.16) #4853
OCPBUGS-42608: Add Annotation to skip deleting hcp namespace #4830
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.39 (release-4.16) #4827
chore(deps): update konflux references (release-4.16) #4816
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.38 (release-4.16) #4806
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.37 (release-4.16) #4796
chore(deps): update konflux references (release-4.16) #4781
NO-JIRA: chore(deps): update konflux references (release-4.16) #4760
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.36 (release-4.16) #4759
NO-JIRA: Security fixes for openshift-ci-security job #4750
OCPBUGS-41372: CPO oauth idp converter: resolve names before dialing #4689
NO-JIRA: chore(deps): update golang docker tag to v1.23 (release-4.16) #4729
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.34 (release-4.16) #4728
NO-JIRA: chore(deps): update konflux references (release-4.16) #4727
OCPBUGS-38058: Add HTTP konnectivity proxy to OAuth server #4496
HOSTEDCP-1955: bump CCO version #4696
OCPBUGS-34803: cmd: report server version, supported OCP #4141
OCPBUGS-39293: copy image-registry AdditionalTrustedCA configmap into HC openshift-config #4647
chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.21.11-9 (release-4.16) #4685
OCPBUGS-38062: [release-4.16] Use HTTP proxy for ingress controller #4688
NO-JIRA: chore(deps): update konflux references (release-4.16) #4684
OCPBUGS-39447: handle version skewed NodePools that do not have rhel9 binaries #4664
HOSTEDCP-1895: [release-4.16] Allow setting Kube APIServer maximum requests in flight #4551
chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.21.11-7.1724661022 (release-4.16) #4600
chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.33 (release-4.16) #4602
chore(deps): update konflux references (release-4.16) #4599
OCPBUGS-38942: copy oapi ca-trust recursively when building trust anchor #4615
NO-JIRA: Flaky cert validation test #4622
OCPBUGS-38259: Set KCM node monitor grace period #4520
OCPBUGS-38726: fix: bump github.com/IBM/go-sdk-core/v5 #4611
HOSTEDCP-1764: retrieve registryOverrides when ImageStream is not ava… #4541
chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.21.11-7 (release-4.16) #4525
OCPBUGS-36781: Set Azure VM identity if user assigned identity set #4341
Full changelog

ibm-vpc-block-csi-driver-operator

OCPBUGS-42286: Reorder static resources to create RBAC first #129
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-43686: UPSTREAM: <carry>: Fix go-retryablehttp CVE - 4.16 #89
Full changelog

ibmcloud-machine-controllers

OCPBUGS-36698: IBMCloud: Handle pagination for subnets #42
Full changelog

insights-operator

gather selected clusterroles (#1023) #1023
OCPBUGS-39564: Not able to enable repositories during entitled build in OCP Cluster on IBM-Z (#1013) #1013
OCPBUGS-39394: collect some nmstate customresources (#986) (#989) (#995) #986
OCPBUGS-38021: Integration of the OpenStack CRs into the insights-operator (#974) #974
Full changelog

ironic

OCPBUGS-43950, OCPBUGS-43958: Bump python-waitress [4.16] #604
OCPBUGS-43438: Include fixes for CVE-2024-5569 #599
OCPBUGS-42511: Include fix for CVE-2024-47211 #594
OCPBUGS-39017: Bump ironic-lib to fix utf8 decoding issue #569
OCPBUGS-38797: redfish-virtualmedia fails on XFusion nodes #564
OCPBUGS-42113: Update ironic-inspector to fix the memory leak #587
OCPBUGS-37758, OCPBUGS-39383: Include fixes for CVE-2024-44082 #579
OCPBUGS-38510: set min version for python3-webob #553
Full changelog

ironic-agent

OCPBUGS-39017: Bump ironic-lib to fix utf8 decoding issue #156
OCPBUGS-39383: Include fixes for CVE-2024-44082 #161
OCPBUGS-38510: set webob and bump werkzeug #149
Full changelog

kube-metrics-server

OCPBUGS-41717: Wire server run options to flags. ([release-4.16] backport) #37
Full changelog

kube-proxy, sdn

OCPBUGS-44301: Use copy() to duplicate a net.IP #641
OCPBUGS-43344: OCPBUGS-42244: Implement namespaceSelectors on ingress with all pods IPs #635
OCPBUGS-42203: fix UDP conntrack cleanup #636
OCPBUGS-42159: fix redundant router-default iptables rule #633
Full changelog

kube-rbac-proxy

OCPBUGS-30447: protobuf bump [4.16] #111
Full changelog

machine-api-operator

OCPBUGS-39028: Updates message verbs to use %q where appropriate #1282
OCPBUGS-43433: Vsphere: Handle cloned instance with lost taskID #1298
CORS-3648: Add the hyperdisk-balanced disk type #1279
Full changelog

machine-config-operator

OCPBUGS-44337: Removal of additionalTrustBundle CA does not remove certificate from node backport #4688
MCO-1342: Backport Telemetry to 4.16 #4649
OCPBUGS-44043: Disable ESP offload for OVS attached interfaces #4676
OCPBUGS-42109: Do not use ‘restart’ for ‘oneshot’ service #4616
OCPBUGS-42744: Check for kernel arg diff in updateOnClusterBuild #4628
OCPBUGS-42722: Panic seen in CI job for MCC pod #4626
OCPBUGS-42719: MCPs report wrong number of nodes when we move nodes from one custom MCP to another custom MCP #4625
OCPBUGS-41293: Enable the use of Linux Bridge as the ovs default port connection #4563
OCPBUGS-41256: Set ESP offloads off in bonds if slaves don’t support them #4627
OCPBUGS-41806: When newly built images rolled out, the update progress is not displaying correctly (went 0 –> 3) #4584
OCPBUGS-41518: CVE-2024-3727 ose-machine-config-operator-container: containers/image: digest type does not guarantee valid type #4569
OCPBUGS-38997: Machine-config daemon ListPools panic during tech-preview CI runs #4550
OCPBUGS-38711: SCC-pinning for openshift workloads #4539
OCPBUGS-36850: Port number 22623 exposing weak ciphers to external client from master node IP #4556
Full changelog

monitoring-plugin

OCPBUGS-43239: upgrade dynamic plugin sdk to remove vulnerable dependencies 4.16 #217
OCPBUGS-42424: fix path-to-regexp dependency #197
Full changelog

must-gather

OCPBUGS-43056: Open [Release-4.16] Multus is now a Pod and will be captured by normal #449
Full changelog

openshift-apiserver

OCPBUGS-42724: fail image import when both image and error are nil #455
Full changelog

openshift-controller-manager

NO-JIRA: cleanup root and app OWNERS #347
OCPBUGS-42420: Continuous pull-secret updates / slow initialization on build01 (test platform infrastructure) #343
OCPBUGS-39191: replaces deprecated square/go-jose wtih go-jose/go-jose #329
OCPBUGS-37526: Race condition when deleting ServiceAccount #324
Full changelog

openstack-cluster-api-controllers

OCPBUGS-34931: rebase on release-0.10 (to fix trunks deletion) #321
Full changelog

openstack-machine-api-provider

OCPBUGS-34931: bump CAPO to v0.9.2 #124
Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

OCPBUGS-41540: [4.16] add optional schema migrations; default to olm.bundle.object instead of olm.csv.metadata (#1384) #859
OCPBUGS-41677: [4.17] adds paginating lister for evaluating CRs’ upgrade fitness versus new CRDs. #863
OCPBUGS-41557: Fix e2e flake: upgrade CRD with deprecated version #861
OCPBUGS-41217: (fix) registry pods do not come up again after node failure (#3366) #854
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-43344: Add SDN node subnet gateway IP to host-network address_set #2328
OCPBUGS-42942: Fix egress gateway pod cleanup for remote zone pods. #2341
OCPBUGS-36210: Implementation required to enable Forwarding if it is already disabled #2212
OCPBUGS-41551: Add subnet overlap check for transit switch subnet #2306
OCPBUGS-38697: Use more exact name match when deleting static routes to HO nodes. #2282
OCPBUGS-24386: [release-4.16] EgressService: Fix ETP=Local ingress reply for LGW #2278
OCPBUGS-38705: Delete EgressIP LRP stale nexthops when node is not found #2271
OCPBUGS-38054: Fix per-pod MCS/metadata blocking #2248
OCPBUGS-38699, OCPBUGS-38704: EgressIP VRF support & ignore localnet patch ports when bootstrapping #2267
Full changelog

powervs-machine-controllers

OCPBUGS-41976: Update go.mod to fix CVE - 4.16 #84
Full changelog

prometheus

OCPBUGS-39179: Restore Prometheus functionality to accept samples with different timestamps from the same series in a single scrape. #224
Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

OCPBUGS-38399: feat: sync proxy settings in Alertmanager configuration #299
Full changelog

tests

OCPBUGS-44105: Adjust createDNSPod() to support hypershift dual-stack test #29258
OCPBUGS-39135: Bump timeout for the pod-network-service endpoints check #29052
OCPBUGS-41611: Disable:Broken for [sig-builds][Feature:Builds][Slow] can use private repositories as build input build using an HTTP token should be able to clone source code via an HTTP token [apigroup:build.openshift.io] #29079
OCPBUGS-38707: run vsphere driver config test on non techpreview clusters #28992
OCPBUGS-38788: [4.16] egressfirewall: skip ping tests in case of hypershift kubevirt on Azure infra #28938
Full changelog

vsphere-cloud-controller-manager

OCPBUGS-37660: Bump otelgrpc to v0.53.0 #72
Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

OCPBUGS-43881: redact sensitive information when logging VCenter config #134
OCPBUGS-42878: Add compute resource entity to consider a standalone cluster for volu… #131
Full changelog

View changelog in Markdown or change previous release:

Source code for this page located on github