4.16.68

Manual Override Applied

This release was manually Accepted.

Reason: Blocking upgrade-minor failure is infrastructure-related (AWS EBS I/O pressure → etcd Raft buffer overflow → disruption monitor failures). The upgrade itself completed successfully. Same class of transient cloud provider I/O issue that justified force-accepting the source nightly 4.16.0-0.nightly-2026-08-04-124535. No product regression, no revert candidates. — https://redhat-internal.slack.com/archives/C0AMHBXQW9F/p1786001860945699

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.16.68-x86_64

Qualifiers (status api):

Tests:

Blocking jobs
- upgrade Succeeded periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
- upgrade-minor Failed (2 retries) periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
Informing jobs
- aws-ovn-serial Succeeded periodic-ci-openshift-release-main-nightly-4.16-e2e-aws-ovn-serial
- aws-ovn-upgrade-micro Failed (1 retry) periodic-ci-openshift-release-main-ci-4.16-e2e-aws-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Failed
- aws-sdn-upgrade-4.16-micro Succeeded (1 retry) periodic-ci-openshift-release-main-nightly-4.16-e2e-aws-sdn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Succeeded
- azure-ovn-upgrade-4.16-micro Failed (1 retry) periodic-ci-openshift-release-main-ci-4.16-e2e-azure-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Failed
- driver-toolkit Succeeded periodic-ci-openshift-release-main-nightly-4.16-e2e-aws-driver-toolkit
- fips-scan Succeeded (1 retry) periodic-ci-openshift-release-main-nightly-4.16-fips-payload-scan
  - Attempt 1 Failed
  - Attempt 2 Succeeded
- gcp-ovn-rt-upgrade-4.16-minor Failed (1 retry) periodic-ci-openshift-release-main-ci-4.16-upgrade-from-stable-4.15-e2e-gcp-ovn-rt-upgrade
  - Attempt 1 Failed
  - Attempt 2 Failed
- hypershift-ovn-conformance-4.16 Succeeded periodic-ci-openshift-hypershift-release-4.16-periodics-e2e-aws-ovn-conformance
- metal-ipi-ovn-ipv4 Succeeded periodic-ci-openshift-release-main-nightly-4.16-e2e-metal-ipi-ovn-ipv4
- metal-ipi-ovn-ipv6 Succeeded periodic-ci-openshift-release-main-nightly-4.16-e2e-metal-ipi-ovn-ipv6

Upgrades from:

Untested upgrades: 4.15.21, 4.15.22, 4.15.23, 4.15.24, 4.15.25, 4.15.27, 4.15.29, 4.15.30, 4.15.31, 4.15.32, 4.15.33, 4.15.34, 4.15.35, 4.15.36, 4.15.37, 4.15.38, 4.15.39, 4.15.40, 4.15.41, 4.15.42, 4.15.43, 4.15.45, 4.15.46, 4.15.47, 4.15.48, 4.15.49, 4.15.50, 4.15.51, 4.15.52, 4.15.53, 4.15.54, 4.15.55, 4.15.56, 4.15.57, 4.15.58, 4.15.59, 4.15.60, 4.15.61, 4.15.62, 4.15.63, 4.15.64, 4.16.10, 4.16.11, 4.16.12, 4.16.13, 4.16.14, 4.16.15, 4.16.16, 4.16.17, 4.16.18, 4.16.19, 4.16.20, 4.16.21, 4.16.22, 4.16.23, 4.16.24, 4.16.25, 4.16.26, 4.16.27, 4.16.28, 4.16.29, 4.16.3, 4.16.30, 4.16.31, 4.16.32, 4.16.33, 4.16.34, 4.16.35, 4.16.36, 4.16.37, 4.16.38, 4.16.4, 4.16.40, 4.16.41, 4.16.42, 4.16.43, 4.16.44, 4.16.45, 4.16.46, 4.16.47, 4.16.48, 4.16.49, 4.16.5, 4.16.51, 4.16.52, 4.16.53, 4.16.54, 4.16.55, 4.16.56, 4.16.57, 4.16.58, 4.16.6, 4.16.60, 4.16.61, 4.16.62, 4.16.63, 4.16.64, 4.16.7, 4.16.8, 4.16.9

4.16.67 (changes) - F F F F F S F S
4.16.66 (changes) - Failed
4.16.65 (changes) - Failed
4.16.59 (changes) - Failed
4.16.50 - Failed
4.16.39 (changes) - Failed
4.16.2 (changes) - Failed
4.16.1 (changes) - Failed
4.16.0 (changes) - Failed
4.15.67 (changes) - F F F F S F S
4.15.66 (changes) - Failed
4.15.65 (changes) - Failed
4.15.44 (changes) - Failed
4.15.28 (changes) - Failed
4.15.26 (changes) - Failed
4.15.20 (changes) - Failed
4.15.19 (changes) - Failed
4.15.18 (changes) - Failed
4.15.0-0.nightly-2026-07-30-110451 (changes) - Failed Failed

Loading changelog, this may take a while ...

Changes from 4.16.50

Created: 2026-08-05 12:53:04 +0000 UTC

Image Digest: sha256:70219bcd3394cbce5e1704f668b4d92a21b26fa044dadc44f3a6726e861f9579

Components

Kubectl 1.29.7
Kubernetes 1.29.14
Kubernetes Tests 1.29.0
Red Hat Enterprise Linux CoreOS upgraded from 416.94.202510081640-0 to 416.94.202608011020-0 (diff)

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
StreamingCollectionEncodingToJSON (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
StreamingCollectionEncodingToProtobuf (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)

Removed images

ovirt-csi-driver
ovirt-csi-driver-operator

Rebuilt images without code change

agent-installer-api-server git 5c16119a sha256:e299de55c4af733f69c3894fc88705b02f78b7df137a418f105d0ccf16bf3ec3
agent-installer-csr-approver git 302f47ff sha256:d43348bbc663accda05742720f0b2b121d4947192755070e69ccc7dbd1b2842e
agent-installer-node-agent git 720b5023 sha256:df0885cebbff44cf3ad10c13f36a37c1099b81ab7a79591af47b21ccf91932c2
agent-installer-orchestrator git 302f47ff sha256:c1998da1ac124b8b91411960400670ed329d6a2a14672d531c4346d0925595fa
alibaba-cloud-controller-manager git 97e8335e sha256:aac20508eead163365bc4a416a140656c8098d26d411971219b27ff1cce73a51
alibaba-machine-controllers git 248372a4 sha256:cb942c99a239c4d9fe0499de1fd122c1f805dc6201384010c37b2e132b25f1a0
apiserver-network-proxy git ca81b6a3 sha256:94e6447cd4dba8f9c1f65770aa2e1da1754a2bcfaf1c91e06872016aea53e89d
aws-cloud-controller-manager git a53e9def sha256:5db4c82ef4761b8369f946c72289100ca9d16bc565b66d07960f94b50dd5e2ea
aws-ebs-csi-driver git 1d29a74a sha256:861e7cb15833fa0a0663cb16cfa097bbf2fe587b624579f378262cb920422876
aws-kms-encryption-provider git c66065de sha256:f9319d6dfad74f74f4b50bb534d222c9eb593ab2385cebc8abac2298aeb3e674
aws-pod-identity-webhook git 459c5314 sha256:75f5a83bacf3e40fc0ec6c4c8bad66b047827b6d736ad5f80c287caccfeaa994
azure-disk-csi-driver git 6b55f6fb sha256:cae683c827570a1b929bc91108daa5aecdac07e83556883584d597a3e9a0bb0d
azure-workload-identity-webhook git 5b8d171e sha256:df195709482c561ea7891d6d9882b9978def10c414f5d1b4204b5541ce9c1c9b
cluster-authentication-operator git 0e39ace5 sha256:9b5a76f7d16d5595184833701dcb47c1e13dd16295dd974aa4e3cc3ce8cf43b6
cluster-autoscaler-operator git 70164fc6 sha256:bce35b6ebd676ebf05dde0efa315e9a0fddd086a20e45b8d5b9334f5bc743b89
cluster-bootstrap git 27bfb59f sha256:86d3457ddd71a058d94cb6e99b78dc50cadeee413b799a97368ee97af4c3ded0
cluster-capi-controllers git 5830a10a sha256:cb9489370e452441885c9fce5b611d0d9b2cc2f3200e55a1114abc13a09872de
cluster-config-operator git 441d29c9 sha256:3e694407ba583db245c445d6cf43dfd2694379ae8f587d80017f9601edcf745f
cluster-control-plane-machine-set-operator git 14571e8a sha256:ef7ffca8cef63ba6dff7e9a12b545ce7ee1db12753301af2ad11eb58e3e30781
cluster-csi-snapshot-controller-operator git 439826e1 sha256:33d968171a6053cda93cd0bf83078c3d7f05ecbcd3e65c50857661b1d91e8ca1
cluster-dns-operator git a4b1cfb4 sha256:f7590b0a738e542515e36cae2f9288dd05a95309a8683556e1b509e324355ebf
cluster-kube-cluster-api-operator git 95ceaa9e sha256:be6bfcc34152c6fd51dd205564671612819d0314c4ff600e4bb99faffebf0e9e
cluster-kube-controller-manager-operator git b3faac1f sha256:0d546174a04b3a52cfeb1d7e73f6dd21867563b1b4216c0a88682caf6727afdf
cluster-machine-approver git 7685374f sha256:6ba6bb8d8ba1f9adf17c55eb829f252da62354237a348c343a7a648875739c38
cluster-openshift-controller-manager-operator git 2ed3cf99 sha256:57938e6cf435433ed59520904db261515f9b5cc3d0f8f81618542d17a1c720fb
cluster-policy-controller git eaea543f sha256:fa5f191a5f7b5951eb110914346fe58375596733f5b646680cdb2f88cc1cfc8e
cluster-update-keys git e8478585 sha256:e933a38f1513fc4e387e5190f9d86a6a195c8be3d559d6bf1c91a8203a2f719f
cluster-version-operator git be820285 sha256:6fdbfdb35659d32843aca4915b6e7250c651ec7467cb73f889bf32c079d3215e
configmap-reloader git dc91ddc4 sha256:f94e52c87f8a7f753f22fa89bd52bd6cc3640e05461135cd803c25a0276b464c
csi-driver-manila-operator git c25d1ff2 sha256:ea3eca97294d42ed1c4ac4ec94b251e65c265f7408ef31b8628729c9c4284c3f
csi-driver-shared-resource git bc125def sha256:3e0f8629843a3258bd417e090e1b38b23339cb78314408a72eca45ca5f2764fa
csi-driver-shared-resource-operator git 1e1194bc sha256:23e583e9160533eddadc5b3de8e87c418808d2db447af213d4f897756a274c0a
csi-driver-shared-resource-webhook git bc125def sha256:043c79c80f3d37518c879c3051a0e442420048c83b92d1bc5f9fb3088de268c6
csi-external-attacher git 7da80aab sha256:01f23bdf18107c9adb3ac832d9166caa6f0b39134303f91975eb211ad89133b1
csi-external-provisioner git 9e8af011 sha256:850992ae21cebd8e41a6397fe3493a60c2b94e99380ec0c1a49b215035a722f9
csi-external-resizer git 06e08fd2 sha256:cf585a57dc322871aa22b9b2ed32a6a93585d088b527738bf653348490371387
csi-external-snapshotter git ee32ba01 sha256:fd27f78f8d33db56598a1ff2801dfb451cbdd695ec10fcfebd2bffc7fd73484d
csi-livenessprobe git f5e3ff55 sha256:8387b4fca540910141212bbbf59cd381ccd43260c871ea6885a8613fe1c695ea
csi-snapshot-controller git ee32ba01 sha256:01c651f97b4f7c63ccf8cdbce6f07257d927ae61e40743afd2c6373aa4172b6c
csi-snapshot-validation-webhook git ee32ba01 sha256:6c893dc28ac19ae78276a899be490748111aba646974cff809fc4b7f705aa176
docker-registry git 072c544c sha256:b0c945ba5824029994ef4ad946401c1abdb025278e3e5ea55d2fb4fc5db7f85c
driver-toolkit git 1d5732f0 sha256:cbae7d76b1f7aa3de5e98c5238823c006cd351225dd87375bad41edab86a67d1
egress-router-cni git 7089efe6 sha256:deda757b5e87e733e8fea7190bef11c035749c4e5c56c2ded93539cccdd465ef
etcd git e7911c0d sha256:c35782027dc3fcb62c5e48e383983ffded2d66fdcbe6d9a7190e0f33761f1f91
gcp-cloud-controller-manager git 26b43dfc sha256:fd26ad6672919b951a1a55ec05aeddb84d8ce85041e904f752fdadd72c1ba69f
gcp-pd-csi-driver-operator git 799327f7 sha256:4cd7ed0b4442a8a8921e39e51c0b06862f3775abd2588491e23dc9b5392fa966
ibm-cloud-controller-manager git f961f16d sha256:930f7ec4f1c0d133aeeda044b04b22c30fe7791424c065e7fd29203af65b8319
ibm-vpc-block-csi-driver-operator git 9ca53768 sha256:6713a98621b66ed70efba81b9383066f58c1087d2874151045f4106010beaa02
ibmcloud-machine-controllers git d29506e7 sha256:f9dcb23a05e0447e2e8b1608c73c3240d14db65ba7eb5a5abb88a6dd2659c223
ironic-machine-os-downloader git 93b8b5fa sha256:e961eeef04fb9c3c1ee733be28f0bcf403d98daebeb9c42eee992ad022de1c84
ironic-static-ip-manager git f44e8a08 sha256:a3eae66381f9d6f30e97ce81fb15228342c5bd47eae58867916500f09a45bcb1
k8s-prometheus-adapter git e4f859be sha256:9e1667c1cf6933e0db2199824b9d7be640d7e65794bbf65a833b62814ca5a690
keepalived-ipfailover git b58673a3 sha256:d9a1a0e8089438496e690ec6c4f2ed453b8f5f404be6ae28f65bce3218173318
kube-proxy git 53fea06b sha256:3707ceea6dff8ff04640f47ad4ad96200fb8b2721804fba438e6942bc2464d93
kube-rbac-proxy git c38f4734 sha256:8a3e602c884e322177d7cc95e390c5ef623b9dbe95b433558efa22e95fdc48f3
kube-storage-version-migrator git 6f213320 sha256:e17bf217c54fea0d5f2e33bc82bfb283f7ba8a9f72dc05983cef84da865e18e6
multus-admission-controller git a15bf454 sha256:1ef8dc30a5dd5a288573bf0f2781059d36167e3a1d6c8ad71d399feab6516f3b
multus-networkpolicy git f988f894 sha256:1ebe237949ed3b0e5f266925b3ed5fc8197dfeac84b34664770c1b4955d47db2
multus-route-override-cni git 73594f77 sha256:2e1680ae0253afca4cec1f1e7b26d2aa21cb13179a9c8776218ca30a2299593f
network-interface-bond-cni git e6880659 sha256:2d21055ab1dcfb00703a0ec1c1f449e92e92ea1ed5de17bef6a74b5001c6f5f2
network-metrics-daemon git 1210db38 sha256:ce35721b04f52c3b627ec186684907a3c626f890b33045aac183857289bf59b2
network-tools git 234ed43e sha256:51c54b11d6d01ca0e09ebef75cb7b40420d633633f4914314e594e00bcba8154
nutanix-cloud-controller-manager git 28bf5963 sha256:ffe7642bdd534390beb9560c3b12d42d91f618cd00ec63ecbed96bd41e22ea97
nutanix-machine-controllers git 2f2e121b sha256:37620afc69fc777014159582a44fdcdac31107a4da890ffbc576374493d08f61
oauth-server git 3739138c sha256:2c10cc1d5ee982c070e2911ca67a530f6913d06209740816609ea892fb350285
oc-mirror git b137a53a sha256:c186f2592cc3a826d6f88a4c4d10c18493564468f714aa1a8fc4ff8a09cea296
olm-catalogd git 79975a51 sha256:4271fbb78d5f16e463290cf5e32d6522ae9880eeafde2b2117cf6f17ba3c82c3
olm-operator-controller git 80b8649c sha256:057eb64a9dcd991727ef15340168e09784a83440bbb6eabc794fd3dce0aef544
olm-rukpak git 282cc84c sha256:09ab03e832f524b1de95dfe4b6c7d244357f12e61ec76a09b769860e500c5d14
openshift-controller-manager git 90f73f7e sha256:805daaf84a8459954280cf15846739eb0f8d7bcb7d2ca2962d426b2737484f0c
openshift-state-metrics git 59b8a0ff sha256:edae7f91db66fb332d32153480603a2a4dd8ffbc5d1b569ba13ddabca38dcf8d
openstack-cinder-csi-driver-operator git 85b52097 sha256:b3fcfcafe1ccf4ab5f7682da88c95b202dbb33c081c4c41e54704ef89f16d68f
openstack-cluster-api-controllers git 3b972b2b sha256:2780d883523dcd6ab2345bd5acd80c9b86bd77701ac483cce7ab32146943a20e
powervs-block-csi-driver git 26162bad sha256:d37878f45ccfc31580543c7e0db1509a82e0a7fbce850e0394039c4909d74d55
powervs-block-csi-driver-operator git 9c5dd8d1 sha256:d76a2ef83182533fb0d5da0d37fe17a11212ed47080778a6701a863888ff090b
powervs-cloud-controller-manager git 20e6dc70 sha256:be91e2d69ce60ed64d511896094880dab36492815393bc499cc83234dbbf83fd
powervs-machine-controllers git 2bfcc0f8 sha256:58ccf2506d55e7273e8bd7b419d6a19d0377df976dfee55a0e3be6c803cc37a6
prom-label-proxy git 5e14722e sha256:55c47c5a09916ed526a236059b87672c7e399bd4fe0b0798f71bfdbc82463b4c
prometheus-config-reloader git c7262a43 sha256:ab45d0c9306c2ea2be53a8ba032e6852d879d84249cd12478e24914b395fefa5
prometheus-node-exporter git 29ba26d1 sha256:0a48431dc35b19d85e8e4ccd69461a3d39a34cc07cfd1dca7dae1a8e74bf459b
prometheus-operator git c7262a43 sha256:8f8ee3c1390b004c6625829d1838fbab228687e0a9a8d7ce752bef3b19fbf2e3
prometheus-operator-admission-webhook git c7262a43 sha256:c7d2c13683488daa3fb3202085f9bebeab4a395a380fe949742b6de21c177a38
rhel-coreos sha256:59b550e25a266f8a629eb4c9d9274fdddecb94a17ccf687c609c3c9e369b98d8
rhel-coreos-extensions sha256:5f28095ce135c7da0cbf37c77c8c43a96ba79a7650a27c2ef68e0faead8969fc
sdn git 53fea06b sha256:7f74bc3da087fe7a5055c4823afc2c33e365139322e8b08ee3f9aae19ef324f1
service-ca-operator git 538c7b98 sha256:0ba48ceb660eb780fbca79d27784c5d4d0eab88a0b4684bbbc072c5bea75bd1e
telemeter git c1ecd105 sha256:397651b70b2860cca3951b34f34282d3b274a5320d1151ec41765e5dfcffd130
thanos git 85eee25c sha256:21c1545e76194e2f0c8183ffcaea3cf7efa643dd0a2eb20733c0a035c6e692bc
vsphere-csi-driver-operator git 7940ea16 sha256:0c2989418db64ac00814b7ac66971aa3f578d769efbc55f1864f624888baf391

agent-installer-utils

OCPBUGS-68046: bump github.com/sirupsen/logrus to v1.9.3 #239
Full changelog

aws-cluster-api-controllers

OCPBUGS-78227: [release-4.16] update go mod dependency for konflux #591
Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator

OCPBUGS-64831: Use 127.0.0.1 for healtz http-endpoints #467
OCPBUGS-64768: Add RBAC ClusterRole and Binding for driver node #465
Full changelog

aws-machine-controllers

OCPBUGS-73903: Fix reconciler consistency checks in Update and Exists #168
OCPBUGS-63140: client: re-use a single file for building the session instead of randomly named files #144
Full changelog

azure-cloud-controller-manager, azure-cloud-node-manager

OCPBUGS-79998, OCPBUGS-85635, OCPBUGS-85636: Bump google.golang.org/grpc to v1.79.3 #182
Full changelog

azure-cluster-api-controllers

OCPBUGS-78176: [release-4.16] update go mod dependency for konflux #364
Full changelog

azure-file-csi-driver

OCPBUGS-89335: Address CVE-2026-33186 #139
Full changelog

azure-kms-encryption-provider

OCPBUGS-79927: Bump google.golang.org/grpc to 1.64.1-sec.1 patch #48
Full changelog

azure-machine-controllers

OCPBUGS-66044: Set updateDomainCount to one when faultDomainCount is one #177
Full changelog

baremetal-installer

OCPBUGS-74885: Azure UPI ARM template: use storageAccountId #10282
OCPBUGS-76586: terraform/provider/google: Fixing GCP inconsistencies present with the service account creation #10298
OCPBUGS-73879: data/manifests/bootkube/cvo-overrides: Default to eus-4.16 #10226
OCPBUGS-54165: aws: fix NLB creation in secret regions #10031
OCPBUGS-53237: Validation for API and Ingress VIPs when using user-managed load balancer #10048
OCPBUGS-62952: Update the RHCOS 4.16 bootimage metadata #10022
OCPBUGS-62653: Release 4.16 bump terraform provider azurerm #9993
Full changelog

baremetal-machine-controllers

OCPBUGS-78099: [release-4.16] fix vendor/ for hermetic migration 4.16 #243
Full changelog

baremetal-operator

OCPBUGS-77278: Unblock BMH direct deletion when detached annotation is present #463
Full changelog

baremetal-runtimecfg

OCPBUGS-60113: Re-add ENABLE_NODEIP_DEBUG env var #362
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-64616: Help with must-gather scheduling through suggesting preferance of nodes #2151
OCPBUGS-64561: Update go-jose, x/crypto, x/net #2144
Full changelog

cloud-credential-operator

OCPBUGS-65802: ccoctl azure: retry custom role creation on consistency errors #952
OCPBUGS-63550: ccoctl: add public-key-file flag to create-all #940
Full changelog

cloud-network-config-controller

OCPBUGS-66346: [release-4.16] Fix capacity calculation #195
OCPBUGS-65567: [release-4.16] Change the capacity struct from int to ptrOfInt #192
Full changelog

cluster-autoscaler

OCPBUGS-78702: allow clusterapi provider to skip paused resources #415
Full changelog

cluster-baremetal-operator

OCPBUGS-77447: Bump github.com/go-errors/errors to v1.5.1 #562
OCPBUGS-64741: Always have a service for ironic-api port #524
OCPBUGS-63417: Fix ironic inspector container privileges #513
Full changelog

cluster-capi-operator

OCPBUGS-79943: Bump google.golang.org/grpc to v1.79.3 #573
NO-JIRA: Allow sustaining engineering to self serve dependency updates #560
Full changelog

cluster-cloud-controller-manager-operator

OCPBUGS-63168: ccm: disable unused secure-serving port and webhook #422
Full changelog

cluster-config-api

CNTRLPLANE-1982: Promote streaming list encoding to Default #2600
OCPBUGS-71202: Add HTTPKeepAliveTimeout to IngressController API #2640
NO-JIRA: Promote streaming list encoding to Default on Hypershift. #2568
CNTRLPLANE-1611: Add feature gates for StreamingCollectionEncoding #2542
Full changelog

cluster-etcd-operator

OCPBUGS-68058: Update logrus to 1.9.3 to address CVE-2025-65637 #1546
Full changelog

cluster-image-registry-operator

OCPBUGS-68059: : Bump github.com/sirupsen/logrus to v1.9.1 #1285
Full changelog

cluster-ingress-operator

OCPBUGS-86713: Add configuration override for X-SSL strip #1487
OCPBUGS-71202: Implement HTTPKeepAliveTimeout tuning option #1337
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-68064: CVE-2025-65637 openshift4/ose-cluster-kube-apiserver-rhel9-operator: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload [openshift-4.16.z] #2043
Full changelog

cluster-kube-scheduler-operator

CNTRLPLANE-2843: chore: update OWNERS #624
Full changelog

cluster-kube-storage-version-migrator-operator

OCPBUGS-68069: Bump github.com/sirupsen/logrus to v1.9.1 #144
Full changelog

cluster-monitoring-operator

OCPBUGS-77276: AlertingRule: fix duplicate PrometheusRules after MD5->SHA-224 naming change #2831
OCPBUGS-64581: Fix KSM deny-list typo #2733
OCPBUGS-64637: Add mcd_local_unsupported_packages metric from MCO to telemetry 4.16 #2735
OCPBUGS-62765: port metric acm_managed_cluster_worker_cores:max to OCP 4.16 #2719
OCPBUGS-63235: test: remove image registry e2e tests #2727
Full changelog

cluster-network-operator

OCPBUGS-84182: fix(hypershift): use net.JoinHostPort for URL construction #2981
OCPBUGS-75890: Tweak iptables-alerter to try to avoid crictl bug #2898
: NO-JIRA: Update CNO reviewers/approvers #2768
OCPBUGS-63155: Add drop flows for GARPs #2819
OCPBUGS-57354: block upgrade if a CNI migration is in progress #2760
OCPBUGS-62055: Update CNO reviewers/approvers #2803
Full changelog

cluster-node-tuning-operator

OCPBUGS-82675: Bump github.com/moby/spdystream from v0.2.0 to v0.5.1 #1551
OCPBUGS-78766: [4.16] PPC: filter out namespaces dir #1466
Full changelog

cluster-olm-operator

OCPBUGS-86243: Update grpc-go to v1.67.3-sec.1 to fix CVE-2026-33186 #206
Full changelog

cluster-openshift-apiserver-operator

OCPBUGS-68072: CVE-2025-65637 - Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.16] #654
Full changelog

cluster-samples-operator

OCPBUGS-63516: references to github.com/sclorg/django-ex.git now also refer to the branch #659
Full changelog

cluster-storage-operator

OCPBUGS-87613: remove oVirt code from CSO 4.16 #709
OCPBUGS-78769: Add patch permission to provisioner role #685
Full changelog

console

OCPBUGS-77123: [release-4.16] CVE-2026-26996 Bump minimatch library #16346
OCPBUGS-79439: Bump immutable #16657
OCPBUGS-88027: Fix JSON annotation parsing to prevent OperatorHub crash #16588
OCPBUGS-88377, OCPBUGS-88380, OCPBUGS-88412, OCPBUGS-88419, OCPBUGS-88444: CVE-2026-44495 #16612
OCPBUGS-88554: Stabilize legacy OperatorHub Cypress waits #16608
NO-JIRA: enable multi-architecture yarn builds #16417
OCPBUGS-83299: [release-4.16] openshift4/ose-console-rhel9: Axios: Remote Code Execution via Prototype Pollution escalation #16298
OCPBUGS-78673: Namespace is not persisting when switching to developer view from the topology page of admin page #16161
CONSOLE-5011: migrate to yarn berry #16078
OCPBUGS-76578: Bump axios #16032
NO-JIRA: Bump builder image to v29 #15993
OCPBUGS-74447: Bump lodash to latest #15967
OCPBUGS-69678: Disallowed Pipelines-plugin Pipelines navigation section #15857
OCPBUGS-64884: Remove required flag from ‘console.flag/model’ pipelines-plugin extension #15707
OCPBUGS-64649: /auth/error?error=missing_state&error_type=auth is showing blank page #15675
OCPBUGS-44157: bump dompurify to latest #15591
Full changelog

console-operator

OCPBUGS-77992: update go mod dependency for konflux #1115
Full changelog

container-networking-plugins, containernetworking-plugins-microshift

OCPBUGS-85669: CI Build root image tag sync with ART #234
Full changelog

coredns

OCPBUGS-77463: Modify .gitignore to not exclude vendor build folders #168
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-79978: Bump google.golang.org/grpc #389
OCPBUGS-68080: fix CVE-2025-65637 #361
Full changelog

csi-driver-nfs

OCPBUGS-84931: Replace google.golang.org/grpc with github.com/openshift-sustaining/grpc-go v1.67.3-sec.1 to avoid go version bump and fix CVE-2026-33186 #182
Full changelog

csi-node-driver-registrar

OCPBUGS-64632: update log level verbosity to not clutter logs #91
Full changelog

docker-builder

OCPBUGS-65907: BuildConfig inline Dockerfile fails with heredoc syntax #489
Full changelog

gcp-cluster-api-controllers

OCPBUGS-78280: [release-4.16] update go mod dependency for konflux #267
Full changelog

gcp-machine-controllers

OCPBUGS-79970: Bump google.golang.org/grpc to v1.79.3 #167
OCPBUGS-79970: [release-4.16] Fix setup-envtest GCS 401 by downloading binaries directly #176
Full changelog

gcp-pd-csi-driver

OCPBUGS-68087: Update logrus to 1.9.3 #92
Full changelog

haproxy-router

OCPBUGS-86713: Strip X-SSL-* headers for plain HTTP #805
OCPBUGS-79960: Bump google.golang.org/grpc to v1.79.3 #769
Full changelog

hyperkube, pod

OCPBUGS-68041, OCPBUGS-68091: CVE-2025-65637 - bump github.com/sirupsen/logrus to v1.9.3 [4.16] #2582
OCPBUGS-74299: Skip E2e: attach on previously attached volumes should work #2568
OCPBUGS-65694: Fix Concurrentmap Iteration #2519
CNTRLPLANE-1612: Backport StreamingCollectionEncoding for JSON and protobuf #2485
Full changelog

hypershift

OCPBUGS-99075: fix(backport): konnectivity agent auth #9097
OCPBUGS-84182: fix(cno): use brackets only for IPv6 in server URL #8348
OCPBUGS-76534: feat(updates): enable CVO metrics access with RHOBS monitoring flag #7704
OCPBUGS-74375, OCPBUGS-74376: Support proxy authentication when user/pass is included in URL #7578
OCPBUGS-73118: Fix Konflux EC voilation, update deprecated base … #7459
OCPBUGS-63640: [release-4.16] fix(konnectivity): resolve circular dependency causing DNS timeouts and excessive retries #7113
OCPBUGS-64680: Update DNS names for ovn-kubernetes cp metrics #7158
CNTRLPLANE-1904: Migrate 4.16 pipelines to common pipeline template #7212
CNTRLPLANE-1426: feat(konflux): tag MCE HO images with latest #6839
OCPBUGS-61252: dont use registryOverrides on kube rbac proxy image be… #6756
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-79964: Bump google.golang.org/grpc to v1.79.3 #145
OCPBUGS-77210: [release-4.16] standardize build paths #124
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-67288: [release-4.16] Fix incomplete vendor/ #138
Full changelog

insights-operator

OCPBUGS-68370: Add filtering to add other possible pod status to QEMU gatherer #1200
OCPBUGS-67009: QEMU logs are not gathered if there are pending status virt-launcher pods #1197
Full changelog

installer, installer-altinfra, installer-artifacts

OCPBUGS-74885: Azure UPI ARM template: use storageAccountId #10282
OCPBUGS-76586: terraform/provider/google: Fixing GCP inconsistencies present with the service account creation #10298
OCPBUGS-73879: data/manifests/bootkube/cvo-overrides: Default to eus-4.16 #10226
OCPBUGS-54165: aws: fix NLB creation in secret regions #10031
OCPBUGS-53237: Validation for API and Ingress VIPs when using user-managed load balancer #10048
OCPBUGS-62952: Update the RHCOS 4.16 bootimage metadata #10022
Full changelog

ironic

OCPBUGS-76457: Bump pyasn1 to 0.5.1-4 #828
OCPBUGS-69789: Bump eventlet version to 0.33.1-7 #763
Full changelog

ironic-agent

OCPBUGS-95070: Replace individual package removal with a single rpm -e loop #288
OCPBUGS-95070: Replace dnf remove with rpm -e to prevent dependency removal #276
OCPBUGS-61165: netutils: Use ethtool ioctl to get permanent mac address #215
OCPBUGS-69781: Bump eventlet version to 0.33.1-7 #232
Full changelog

kube-metrics-server

OCPBUGS-79929: Bump google.golang.org/grpc to v1.79.3 #66
Full changelog

kube-state-metrics

OCPBUGS-74875: Deduplicate CRS stores #133
Full changelog

kubevirt-cloud-controller-manager

OCPBUGS-95082: OWNERS: Update component to Cloud Compute / KubeVirt Provider #82
Full changelog

kubevirt-csi-driver

OCPBUGS-79930: Bump google.golang.org/grpc to v1.79.3 #108
Full changelog

libvirt-machine-controllers

OCPBUGS-77196: Fix incomplete vendor/ #302
Full changelog

machine-api-operator

OCPBUGS-98439: Use resource group when generating default Azure image #1516
OCPBUGS-76849: bumped logrus to v1.9.3 #1463
Full changelog

machine-config-operator

OCPBUGS-98960: Remove sensitive ControllerConfig logging #6315
OCPBUGS-98253: Bootstrap MCS logging entire ignition #6290
OCPBUGS-62171: Fix - NetworkManager restart or crash renders br-ex unusable #5354
OCPBUGS-60113: Enable debug logging for nodeip-configuration #5218
OCPBUGS-77253: Machine-config controller should not log about non-existent pull-secret changes #5694
OCPBUGS-77184: machine-config-daemon: openshift: Exposure of Sensitive Data in Log Files in the Machine Configuration Daemon. [openshift-4] #5685
OCPBUGS-63155: [release-4.16] Networking: reset ovn-remote config and allow ovnkube controller to set it #5359
OCPBUGS-60773: scope MCD node listers to current node #5260
OCPBUGS-63553: Add control-plane label for master nodes on legacy clusters #5376
OCPBUGS-57423: pkg/operator/status: Drop PoolUpdating as an Upgradeable=False condition #5119
OCPBUGS-63332: Recheck generatedByControllerVersion annotation prior to deleting a degraded MC #5364
Full changelog

machine-image-customization-controller

OCPBUGS-68093: [4.16] uplift logrus #153
Full changelog

machine-os-images

OCPBUGS-87878: Add support for hermetic builds via Cachi2 prefetched CoreOS ISOs #102
Full changelog

monitoring-plugin

Fix for OCPBUGS-94001: CVE-2026-13676 #1049
Fix for OCPBUGS-90069 OCPBUGS-90073: CVE-2026-12151 CVE-2026-9697 #1007
OCPBUGS-79441: immutable bump #898
OU-1260: [release-4.16] feat: use npm instead of yarn #813
OCPBUGS-76807: fix for CVE-2025-69873 #849
Full changelog

multus-cni, multus-cni-microshift

OCPBUGS-85251: Fix server url in kubeconfig #300
NO-ISSUE: [release-4.16] Bump Go to 1.21 and fix CI build root image #292
Full changelog

multus-whereabouts-ipam-cni

OCPBUGS-70215: Prevent accidental IP deallocation in statefulsets #396
Full changelog

must-gather

OCPBUGS-86218: Collect object size with the object count #550
OCPBUGS-66106: Separate resources with comma to fix malformed inspect #515
Full changelog

oauth-apiserver

OCPBUGS-74112: UPSTREAM: <carry>: bump kubernetes-apiserver to pick up loopback cert expiration update #166
NO-JIRA: (chore): update OWNERS file #172
Full changelog

openshift-apiserver

OCPBUGS-82682: Address CVE-2026-35469 #649
OCPBUGS-68104: CVE-2025-65637 - Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.16] #610
OCPBUGS-74113: UPSTREAM: <carry>: bump kubernetes-apiserver to pick up loopback cert expiration update #595
OCPBUGS-63394: Wire dry run option to Image API server operations #566
Full changelog

openstack-machine-api-provider

OCPBUGS-78170: hermetic 4.16 #163
OCPBUGS-76794: Fix make test #155
Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

OCPBUGS-79980, OCPBUGS-79981, OCPBUGS-87898: Fix CVE-2026-33186 with openshift-sustaining/grpc-go v1.67.3-sec.1 [release-4.16] #1318
OCPBUGS-82057: Drop github.com/distribution/distribution dep #1302
OCPBUGS-77959: Remove the collect-profiles info from the microshift kustomization file #1251
OCPBUGS-77169: Remove the collect-profiles job #1235
Full changelog

operator-marketplace

OCPBUGS-68108, OCPBUGS-68109: CVE-2025-65637 fixed in logrus v1.9.3+ #722
OCPBUGS-62220: Remove Expect func so that the test case can use the retry logic #671
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-83497: External gateway: Remove routes for external gateway pods in terminating or not ready state #3140
OCPBUGS-78033: Add pperiyasamy to OWNERS for release-4.16 #3047
OCPBUGS-77685: Clear stale conntrack UDP entries for nodePorts #3038
OCPBUGS-77187: Fix conntrack reconciliation to use service port instead of endpoint port #2998
CORENET-6055, OCPBUGS-76277: [release-4.16] Dockerfile: Unpin OVN and consume the latest from FDP #2972
OCPBUGS-71219: [release-4.16] CVE-2025-65637 Bump github.com/sirupsen/logrus to v1.9.1 through indirect dependency conversion (go-controller module) #2906
OCPBUGS-72541: NetPol & MultiNetPol: Process update only when spec fields and/or related annotation are updated #2933
OCPBUGS-68349: Add ricky-rav to OWNERS for release-4.16 #2899
OCPBUGS-66155: Skip Pending pods in EgressIP status updates #2880
OCPBUGS-64944: [release-4.16]: Configure sec nic EIPv6 address with NODAD and maximum lifetime #2853
OCPBUGS-64858: Fix stale EIP assignments during failover and controller restart #2851
OCPBUGS-63155: Fix EgressIP stale GARP post reboot + pod restart #2809
OCPBUGS-63230: Fix dnsnameresolver address set #2812
Full changelog

prometheus

OCPBUGS-88616: remote: validate snappy decoded length before allocation in read endpoint #349
OCPBUGS-79985: Bump google.golang.org/grpc #321
Full changelog

prometheus-alertmanager

OCPBUGS-76536: Include go-verify-deps expected files in gitignore #116
Full changelog

route-controller-manager

OCPBUGS-79934: Bump google.golang.org/grpc to v1.79.3 #87
Full changelog

tests

OCPBUGS-74299: Update to latest openshift/kubernetes #30825
OCPBUGS-63395: Backport pr 29834 to release-4.18 #30409
OCPBUGS-62934: Fix bearer token exposure in exit condition as well #30365
Full changelog

vsphere-cloud-controller-manager

OCPBUGS-78028: hermetic migration 4.16 #107
Full changelog

vsphere-cluster-api-controllers

OCPBUGS-78020: hermetic migration 4.16 #86
Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

OCPBUGS-86874: Bump google.golang.org/grpc #182
OCPBUGS-68119: CVE-2025-65637: Bump github.com/sirupsen/logrus to v1.8.3 #158
Full changelog

vsphere-problem-detector

OCPBUGS-86445: fix concurrent map writes #219
Full changelog

View changelog in Markdown or change previous release:

Source code for this page located on github