4.19.28

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.19.28-x86_64

Team Approvals:

Tests:

Blocking jobs
- upgrade Succeeded periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
- upgrade-minor Succeeded (1 retry) periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Succeeded
Informing jobs
- aws-ovn-serial Succeeded periodic-ci-openshift-release-main-nightly-4.19-e2e-aws-ovn-serial
- aws-ovn-single-node-upgrade-4.19-micro Failed (1 retry) periodic-ci-openshift-release-main-ci-4.19-e2e-aws-upgrade-ovn-single-node
  - Attempt 1 Failed
  - Attempt 2 Failed
- aws-ovn-upgrade-4.19-micro-fips Succeeded periodic-ci-openshift-release-main-nightly-4.19-e2e-aws-ovn-upgrade-fips
- azure-ovn-upgrade-4.19-micro Failed (1 retry) periodic-ci-openshift-release-main-ci-4.19-e2e-azure-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Failed
- driver-toolkit Succeeded periodic-ci-openshift-release-main-nightly-4.19-e2e-aws-driver-toolkit
- fips-scan Succeeded periodic-ci-openshift-release-main-nightly-4.19-fips-payload-scan
- gcp-ovn-rt-upgrade-4.19-minor Succeeded periodic-ci-openshift-release-main-ci-4.19-upgrade-from-stable-4.18-e2e-gcp-ovn-rt-upgrade
- hypershift-aks-conformance-4.19 Succeeded periodic-ci-openshift-hypershift-release-4.19-periodics-e2e-azure-aks-ovn-conformance
- hypershift-aws-ovn-conformance-4.19 Failed (1 retry) periodic-ci-openshift-hypershift-release-4.19-periodics-e2e-aws-ovn-conformance
  - Attempt 1 Failed
  - Attempt 2 Failed
- metal-ipi-ovn-bm Succeeded periodic-ci-openshift-release-main-nightly-4.19-e2e-metal-ipi-ovn-bm
- metal-ipi-ovn-ipv6 Succeeded periodic-ci-openshift-release-main-nightly-4.19-e2e-metal-ipi-ovn-ipv6
- microshift-ovn-conformance-parallel Succeeded periodic-ci-openshift-microshift-release-4.19-periodics-e2e-aws-ovn-ocp-conformance
- microshift-ovn-conformance-serial Succeeded periodic-ci-openshift-microshift-release-4.19-periodics-e2e-aws-ovn-ocp-conformance-serial

Upgrades from:

Untested upgrades: 4.18.22, 4.18.23, 4.18.24, 4.18.26, 4.18.29, 4.18.30, 4.18.31, 4.18.32, 4.18.33, 4.18.34, 4.19.10, 4.19.11, 4.19.12, 4.19.13, 4.19.14, 4.19.15, 4.19.18, 4.19.19, 4.19.20, 4.19.21, 4.19.22, 4.19.23, 4.19.24, 4.19.3, 4.19.4, 4.19.5, 4.19.6, 4.19.8, 4.19.9

Loading changelog, this may take a while ...

Changes from 4.19.7

Created: 2026-04-09 11:51:13 +0000 UTC

Image Digest: sha256:b274766f7194a7dc825e335a54078790519c0dbe3431c029fd08dbba1c431855

Components

Kubectl 1.32.1
Kubernetes upgraded from 1.32.6 to 1.32.13
Kubernetes Tests upgraded from 1.32.6 to 1.32.8
Red Hat Enterprise Linux CoreOS upgraded from 9.6.20250729-1 to 9.6.20260407-0

The CoreOS links above are for the base CoreOS layer used to build the OpenShift node image and do not contain OpenShift components. This is normally only useful to devs working closely with the CoreOS team. For info about the node image, see the Node Image Info section.

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
MachineConfigNodes (13 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled	Enabled
PinnedImages (5 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled	Enabled
RouteAdvertisements (11 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled	Enabled
StreamingCollectionEncodingToJSON (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
StreamingCollectionEncodingToProtobuf (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)

Rebuilt images without code change

agent-installer-csr-approver git 0de29205 sha256:12309e06f58c6b122ebc7ef2958ec0a0526edd9ea21b888866dcc2f753a7cf2d
agent-installer-node-agent git 1753a85e sha256:dbd96ce5c1082dd3f2de07bd34f805d64952bee798cd96f2d9f94d195acbfd2e
agent-installer-orchestrator git 0de29205 sha256:69d052085b27f034e581680b283ed51134f2d8d5c895f0b2984946c158304249
apiserver-network-proxy git 77213cc5 sha256:7406a10e78b85749cd597d3ced8b69a87a7931119611e996dd8cd660ff1ac47c
aws-cloud-controller-manager git 425c1c5b sha256:8ad00ec95b55f781061f47a2b0b7b2ae6e557bb9cdbad826c097fde6a5b7d791
aws-karpenter-provider-aws git 68ae0c26 sha256:a31c0d7654d2495710df721e8e1aa57ae47f028966ca83aaa1b74a5b57f0a276
aws-pod-identity-webhook git b0a16d53 sha256:15b866541c161693e74ad7106aec45b9713f81e1f3e2f10deb0822b58fbb884e
azure-cloud-controller-manager git 7109d6b4 sha256:249b48b699ef21517d11a3533293184b1524b5907fec00593a98f0581363dc12
azure-cloud-node-manager git 7109d6b4 sha256:660ad818c22efdd4fb965ded889c7ed08b331cb8d50c145bd4a34e74158f790a
azure-cluster-api-controllers git 2e2909cf sha256:255b3979a3a054696f21f437998c892b5738cbbcdc021b0a22752f1d9bb48712
azure-disk-csi-driver git 466334d4 sha256:1452416d5cfd9acae6f0bf60da783ec8cf632784655f4602462cf380cd7fe518
azure-kms-encryption-provider git 20a9ba53 sha256:6d2feee745979668785a904900f8c9d5327477f83361f26eb5879e87e081bd25
azure-service-operator git 0ae129b4 sha256:980e2f5e0f0676e559e91d50e2927fb9bf2f598db0d1ba043440e04d76cf46b9
azure-workload-identity-webhook git e5c6c44c sha256:4f54884bb854edec3a1a28ba089ddc068edc3ad0677637dd9b033a1c0ff8052c
baremetal-cluster-api-controllers git 06a66db1 sha256:900e5ff2f8ea86f0864c6a3cd1707a620427189f5bfffa0bb0ea9a8c0ed85330
baremetal-machine-controllers git f7a78954 sha256:99fc0e641a6014bad4027471174578ba22c0a4a99c05b6bca1e8c838bbda0a90
baremetal-operator git f4e49d5f sha256:a212996fe27771f82406dc36d68e07e29ecf975834c3cde6395b35cd259edbe9
cluster-bootstrap git 8fde9c52 sha256:d9a9c57749c9d3e56e51d0b67ac5929949a900b1e6c96a4414366afc1ef4ba3b
cluster-capi-controllers git 479f0c4e sha256:9a083427c52dcc2f9716408cf23991613eef7c41fb6eb1ee4841491276971039
cluster-capi-operator git cf9e6e9b sha256:e53bfa8ab4ae569c697bba0b37c25afb495cc6cf324fb4ed50bd8ffc737c04f9
cluster-config-operator git 96607b59 sha256:96fdf677680bf809356060d0af7fc9166608de5dc4d546e671f3071910558381
cluster-control-plane-machine-set-operator git 1dbf0c7a sha256:4cdff720094bd0b07e3dd6ae9b5b88756a890fd1ac39361629c44817766fe69e
cluster-csi-snapshot-controller-operator git cf99de97 sha256:0ac703dd7441374f349bfeb3639c1a7e364c9764aeb4b9ac05ea7879cce4a5a1
cluster-dns-operator git 65981306 sha256:5d920d843fb0958a750b86ee532642adc3a77f5e060d54cfa5327e4f41465772
cluster-kube-cluster-api-operator git 3ec30377 sha256:30a687482b427b9d447430e0e7ef60e310b9dae5032407b03da36d7795e134c9
cluster-kube-storage-version-migrator-operator git 4e514049 sha256:9073193ac055f63809d630f43508c41c2fa3bf07d6ca023667fd9fda5daf6117
cluster-olm-operator git efb91390 sha256:3a37459b3a961cc1b3f3e64198885b19dd30f013b885af167ad52eb82dc1bb5f
cluster-openshift-apiserver-operator git 5f66a3e1 sha256:b654d350a87e6e4b6a217bfc59909cbc7d1e5a4359d1c7fd18b733dfaa992a48
cluster-openshift-controller-manager-operator git 0ab30996 sha256:bce8d9eb7f66cde071409af9074772ea3865a84b1a89bdb30f72d2e0660aa67d
cluster-policy-controller git 74852478 sha256:a252f660abcad58c53b292d4c79a597ee78be4073225aa5613e265db5c12b66d
configmap-reloader git a2a48a3a sha256:324d8f98fd958c228de17a6ad0d88827b042eb651b296d76cb487300caddc254
container-networking-plugins git b09f487c sha256:0f31780ee3816f6e40944c0429b36eec3de2d2be03e85494498d3df2f2667cc4
containernetworking-plugins-microshift git b09f487c sha256:78a2368225915aca2a514c5d82ba82fff8e70e6123c08905c46839a821f4c8ab
csi-driver-nfs git 2eb5c109 sha256:3733c9a79c632dda29eb7635740f4ab45234207be76bf6689fe75037a941fd1f
csi-external-attacher git a8175e39 sha256:6eac8f9c6ff815dc2113652386ea7a0905e7ab0a008d2d89dba5d9bed116b61d
csi-external-provisioner git 9db1cdb1 sha256:7715c2111abc77e11b7544eb351b9799d0d0fc029958e34680673d225581bdbd
csi-livenessprobe git ca514478 sha256:be5b247472e8155811e40b74a539d15d649c6175e469184aae7cc7a3ae435563
driver-toolkit git 686fdac5 sha256:5b232dcf5a47400d1b1d105895df8143b50dc74613b1463b275d6d304e0e0085
egress-router-cni git 85353bb9 sha256:cba1849a3d647457c561e01daf7eda74d775430a8b95458684620c0ebb3f47d2
gcp-cloud-controller-manager git d8d3aeba sha256:ac962f2ec19c1cf0922a5af1d60c6535da0d2bb2e3b1f2bf60f559e7c91fa659
gcp-cluster-api-controllers git c8b865a1 sha256:211d64fbaf9ecb4d767c4fddea4eadf048ff3783ab8aa28bde76844eaa735361
gcp-pd-csi-driver-operator git 44c74f24 sha256:e089a7b006efdb5583e05d087a02e0e0416577e913e3d5c6f4cff6918d564436
gcp-workload-identity-federation-webhook git fbf4c1b2 sha256:c948760bcc0d498230283dc4126370ac9e98eb1d0bdceccdc0a5f20f8b851b9c
ibm-cloud-controller-manager git 7422aab2 sha256:a02dab2c1d82d33beb22f0d834e89ee5d9d000717c5c9773a86315446222e3d5
ibm-vpc-block-csi-driver-operator git 3dfcfa12 sha256:d82c48027fa2cc1aa104eaca2dfc6c556316cbf6a1bd6b0cacfb5ce8f010c028
ironic-machine-os-downloader git dacba7d7 sha256:e33a0af2825ccfcd6d29470feabfd1710adda01a7a189957f04cc76d02e504db
ironic-static-ip-manager git fcd9564e sha256:02b842b08e52152114669293b4e74a0be77c6b142157787d0a394830ea71f376
keepalived-ipfailover git b42e7cf2 sha256:bf2079d194c311cb1d41b1004f20753190145015c5dd9cdf124c46f62b9e4a15
kube-metrics-server git 037a0e7e sha256:a832bdd818c5c9aa386c7b8fc068c7e41454bd3ae5851e4a805e17c0a22485d5
kube-rbac-proxy git 59127756 sha256:dae79f64ec77c8deccdad3c4b451940387d8a081e5cdec911c43c5d475b32256
kube-state-metrics git c3da3b5f sha256:6267c3fdcdc21c0af4b42a9aa609f164956f0e996162bc87d7466453aa2aad35
kubevirt-cloud-controller-manager git 3f4542ec sha256:3062abd2eeed1e94d36b2ef11f78c951e56d14792f06c73b0de554522591f506
machine-os-images git 32b5f16c sha256:20b9ee6a4f6c462c2b53a6d449ed18c20a9f3917f94f08548a451e83e6f4a1c9
multus-admission-controller git 381c36ba sha256:6723f26e9ad3469461e1f752819e048f819faef9cbebb6ed473d08f41393256f
multus-cni git cf0f68ec sha256:97b3af6976324a521b0a6e615ce422f05dc3acee1885726abf447166939821c5
multus-cni-microshift git cf0f68ec sha256:a165973ac17958695bfe213fd4a651bb94bbd0e851fe81e97c8fe833300d8d31
multus-route-override-cni git 391c1b03 sha256:9b2dc7a7bf2ccc373348d47cb745507d6aae379b8b57c1ff828656476dd325c2
nutanix-cloud-controller-manager git db1f264a sha256:79ccd40e05ae0921c4d5b53ecbbd84872bd5321c5af2db3e2336aa6a133d147c
nutanix-machine-controllers git a26db5a0 sha256:ea20d945814432b378647144a1bd5b9d86817d313afc11344780b85b3c3bc978
oauth-proxy git f74e8e00 sha256:1f2e291faed6c919022e0aeb99da4937c21c9ea21f1d32f2012a1a9d090b35f1
openshift-state-metrics git c604f81c sha256:8e9affb2924d2c993f50e4baa132d3e3ddb4f1012154a80d9bf9114bddb10e49
openstack-resource-controller git d00bab2b sha256:784f4206de4bb479ae43476c483face9ba3b209188b3a0201f66580b944fca02
ovirt-csi-driver git 1db726a9 sha256:4e69689cecf4ba62c9a3b7305e80c15ad5fcccbc85fb59a7e2969e14c7fb85f3
powervs-cloud-controller-manager git ef83f3f5 sha256:25f2667e3ce28ce5f0326be23f78cc6eedd523d4d2cdcfee2c02565d14d16ec2
prom-label-proxy git 13666465 sha256:47e0ce843654534a810ad00a3b0703d8abbf4b8f221c479bae47cceed4d944e1
prometheus-node-exporter git c90542d8 sha256:7f8f9a3bce37f846d92e13388b17cff7e606c59abf74b88e8932cc4eb17f5828
service-ca-operator git 4dfa6916 sha256:38a241d766a8321cfda212df868c63751fab60d99d8f05c671c07b39fc2dd2bf
telemeter git d72f1570 sha256:a97fadbd51c77b4a854ecf0c403936adbf136dc83af3213fcc35fd6d5d67679e
thanos git 95f7bb21 sha256:a116039d2376221a308ad495493553e704358e9cfc2fa4104785f7dd7242b90a
vsphere-csi-driver-operator git c2b41c36 sha256:bcba79c5b4e0adf2cb63a96b2d7a089bc5a7ef0960ea5a54d50a36761ea7033e

agent-installer-api-server

MGMT-23439: Pin gotestsum to v1.12.2 for Go 1.21 compatibility #10020
OCPBUGS-74630: Retry incomplete cluster registration in ABI #8809
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

agent-installer-utils

OCPBUGS-68295: bump github.com/sirupsen/logrus to v1.9.3 #236
OCPBUGS-60938: Update ISOBuilder OCP 4.19 Dev Preview Release notes #142
OCPBUGS-60107: Add ISOBuilder Release notes #137
Full changelog

aws-cluster-api-controllers

OCPBUGS-61794: UPSTREAM <carry>: revert: Only tag NetworkInterfaces in RunInstances if IAM Allows It #568
Full changelog

aws-ebs-csi-driver

OCPBUGS-72365: Fix incomplete vendor/ after vendoring #295
Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator

OCPBUGS-56898: Fix Cinder, Manila driver metrics #386
OCPBUGS-63559: Add RBAC ClusterRole and Binding for driver node #455
OCPBUGS-62926: Add withCABundleDaemonSetHook() to AWS EFS operator #444
OCPBUGS-60595: Bump library-go #420
OCPBUGS-59893: Remove stale conditions #411
Full changelog

aws-kms-encryption-provider

OCPBUGS-45666: Updating aws-kms-encryption-provider-container image to be consistent with ART for 4.19 #27
Full changelog

aws-machine-controllers

OCPBUGS-73729: Fix reconciler consistency checks in Update and Exists #165
OCPBUGS-63137: client: re-use a single file for building the session instead of randomly named files #152
OCPBUGS-63137: revert: client: re-use a single file for building the session instead of randomly named files #149
OCPBUGS-63137: client: re-use a single file for building the session instead of randomly named files #147
Full changelog

azure-file-csi-driver

OCPBUGS-61975: Rebase to upstream v1.32.3 for OCP 4.19 #103
Full changelog

azure-machine-controllers

OCPBUGS-65782: Set updateDomainCount to one when faultDomainCount is one #174
OCPBUGS-63578: Support DataDisks on Azure Stack Hub #166
Full changelog

baremetal-installer, installer, installer-artifacts

OCPBUGS-79503: Increase size of /var/ostreecontainer mount #10433
OCPBUGS-57323: Power VS: Provide detailed error when entered VPCName cannot be found #9779
OCPBUGS-78496: fix wavelength zone name regex #10391
OCPBUGS-73781: pkg/asset/manifests/azure: save cidr blocks #10216
OCPBUGS-74940: Increase agent-installer pre-network-manager timeout #10284
OCPBUGS-74675: [release-4.19] GCP: skip AI zones #10274
OCPBUGS-74629: add support for NVIDIA H100 and H200 enabled machine series #10270
OCPBUGS-66358: Update the RHCOS 4.19 bootimage metadata to 9.6.20260112-0 #10248
OCPBUGS-68296: [4.19] uplift logrus #10165
OCPBUGS-65610: Azure UPI ARM template: use storageAccountId #10151
OCPBUGS-63437: vSphere 7 deprecation #10026
OCPBUGS-66999: Use separate tmpfs for ostree checkout on live ISO #10153
OCPBUGS-65512: Remove pending items on gcp no-op #10074
Revert “OCPBUGS-65587: Update the RHCOS 4.19 bootimage metadata to 9.6.20251113-0” #10094
OCPBUGS-65587: Update the RHCOS 4.19 bootimage metadata to 9.6.20251113-0 #10085
OCPBUGS-63634: Update the RHCOS 4.19 bootimage metadata to 9.6.20251023-0 #10038
OCPBUGS-63702: Prevent duplicate noProxy when adding nodes #10045
OCPBUGS-62981: Catch gcp destroy cases where the operation is nil #10013
OCPBUGS-62159: Update the RHCOS 4.19 bootimage metadata #9996
OCPBUGS-62911: None: Allow IPv6 Primary DualStack installs on platforms None and External #10008
OCPBUGS-61313: Use less permissive access for /var/lib/etcd for SNO #9927
OCPBUGS-59573: Checking for selected PE retrieved data and returning errors for missing values #9842
OCPBUGS-60832: node-joner ignore error if SSH key was not found #9910
OCPBUGS-61109: Misleading error when confidentialCompute: Enabled #9920
OCPBUGS-60925: Update the RHCOS 4.19 bootimage metadata #9915
OCPBUGS-60652: PowerVS: config variables not honored #9901
OCPBUGS-60666: Azure: change LB and pubic IP skus to Standard #9903
OCPBUGS-59607: Refine check for supported SNO platforms #9843
Revert “Update RHCOS 4.19 bootimage metadata to 9.6.20250811-0” #9906
OCPBUGS-60402: baremetal: always set external v6 URL on dualstack #9879
OCPBUGS-58905: Update RHCOS 4.19 bootimage metadata to 9.6.20250811-0 #9888
Full changelog

baremetal-runtimecfg

OCPBUGS-60110: Re-add ENABLE_NODEIP_DEBUG env var #365
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-77802: Makefile: Strip debugging symbols by default #2217
OCPBUGS-65757: pkg/cli/admin/upgrade: Tighten force warnings #2146
OCPBUGS-65594: fix(must-gather): do not set node affinity if nodename is set #2143
OCPBUGS-64585: Help with must-gather scheduling through suggesting preferance of nodes #2124
OCPBUGS-59487: adm, inspect, ns: Collect UserDefinedNetwork CRs #2061
Full changelog

cloud-credential-operator

OCPBUGS-74547: Resolve nil pointer exception in hasResourceTags #971
OCPBUGS-65799: ccoctl azure: retry custom role creation on consistency errors #949
OCPBUGS-65478: ccoctl: use pagination when listing resources in aws #946
OCPBUGS-63547: ccoctl: add public-key-file flag to create-all #937
OCPBUGS-60970: ccoctl: aws to use proper issuer url on subsequent runs #906
OCPBUGS-60617: ccoctl azure dnszone-resource-group-name now optional #900
Full changelog

cloud-network-config-controller

OCPBUGS-65513: Fix capacity calculation #190
OCPBUGS-63753: Change the capacity struct from int to ptrOfInt #186
Full changelog

cluster-authentication-operator

OCPBUGS-65602: set appropriate rolling update settings #809
Full changelog

cluster-autoscaler

OCPBUGS-78697: allow clusterapi provider to skip paused resources #412
OCPBUGS-63676: update node info processors to include unschedulable nodes #392
OCPBUGS-63603: refactor cloud provider options #388
OCPBUGS-63455: Fixes histograms becoming empty after loaded from checkpoints #395
OCPBUGS-60900: revert openshift replica fix #374
OCPBUGS-59638: fix checkpoint gc of unknown recommenders #366
Full changelog

cluster-autoscaler-operator

OCPBUGS-73954: Add rbac for volumeattachments #359
Full changelog

cluster-baremetal-operator

OCPBUGS-78457: Explicitly set the ReadOnlyRootFilesystem flag to false #574
OCPBUGS-78704: Update kubebuilder tools to more latest version #578
OCPBUGS-63134: Always have a service for ironic-api port #512
OCPBUGS-60286: Remove webhookport (9447) as HostPort #498
Full changelog

cluster-cloud-controller-manager-operator

OCPBUGS-63165: ccm: disable unused secure-serving port and webhook #420
OCPBUGS-56788: Fix config-sync-controller logging #390
OCPBUGS-60950: Default cloud.conf if no configmap is found #412
OCPBUGS-59847: Adds service for cloud-controller-manager #402
OCPBUGS-59847: Update service selector to match deployment label #401
Full changelog

cluster-config-api

OCPBUGS-68378: Add HTTPKeepAliveTimeout to IngressController API #2627
OWNERS: update approvers/reviewers #2624
OCPBUGS-66984: Introduce ClosedClientConnectionPolicy to IngressController API #2616
CNTRLPLANE-1979: Promote streaming list encoding to Default #2597
NO-JIRA: Promote streaming list encoding to Default on Hypershift. #2559
CNTRLPLANE-1609: Add feature gates for StreamingCollectionEncoding #2517
OCPBUGS-62155: Add ‘AGE’ print column to MachineConfigNode object #2500
OCPBUGS-61096: Add default value for MachineHealthCheck’s maxUnhealthy to the description #2464
MCO-1766: Promote PinnedImageSets feature gate to default #2377
MCO-1720: Promote MachineConfigNode feature gate to default #2376
CORENET-6148: Promote RouteAdvertisements feature gate to default feature set #2425
OCPBUGS-60414: MachineOSConfig name should match MachineConfigPool #2449
Update crd-schema.json to release 1.33 branch #2447
Full changelog

cluster-etcd-operator

OCPBUGS-78353: Prefer to remove members where they have another healthy machine in the same failure domain index #1565
OCPBUGS-74628: Add priority field to prevent early shutdown #1539
OCPBUGS-63338: Ensure revision.json persists on ungraceful shutdown #1502
OCPBUGS-61019: add individual context to the health check #1475
OCPBUGS-60443: Vendor latest mixin, including additional and modified alerts for etcdDatabaseQuotaLowSpace #1472
OCPBUGS-59802: add missing informer syncs #1454
OCPBUGS-59285: fix ordering on bootstrap IP selection #1446
Full changelog

cluster-image-registry-operator

OCPBUGS-60517: fix(azure): resolve credential caching issues around UAMI support #1243
Full changelog

cluster-ingress-operator

OCPBUGS-65723: IngressOperator not exposing some metrics for degraded… #1308
OCPBUGS-68378: Implement HTTPKeepAliveTimeout tuning option #1323
NO-JIRA: Add new NID team members to OWNERS [release-4.19] #1318
OCPBUGS-66984: Implement ClosedClientConnectionPolicy field #1320
NE-2102: Bump to OSSM 3.1.0 and Istio 1.26.2 #1264
NO-JIRA: [release-4.19] docs - correct Istio version format in ossm-overrides.md #1255
OCPBUGS-60204: Update GatewayAPI test to check if deployment has 1 or more pod #1260
NE-2109: Add OSSM channel and version override annotations #1252
NE-2105: desiredIstio: Enable GIE if InferencePool found #1251
NE-2103: Bump to OSSM 3.0.1 and Istio 1.24.4 #1244
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-74628: Add priority field to prevent early shutdown #1959
OCPBUGS-65525: OpenShift cluster got degraded after rotating the kube-apiserver-service-network-signer cert #1964
Revert “[release-4.19] OCPBUGS-65560: Optimistically update Kube Server and Client CA bundles” #1963
OCPBUGS-63342: [release-4.19] Revert “Revert “OCPBUGS-58116: certregenerationcontroller: start configInformers #1945
OCPBUGS-60682: Optimistically update Kube Server and Client CA bundles #1920
OCPBUGS-60121: [release-4.19] Set goaway chance to 0.001 #1887
OCPBUGS-60677: certrotation: ensure that all rotated secrets/configmaps have RefreshOnlyWhenExpired set #1901
OCPBUGS-60495: certrotationcontroller: extend node-system-admin-signer lifetime #1897
OCPBUGS-59957: Add missing service ports to apiserver service #1880
Full changelog

cluster-kube-controller-manager-operator

OCPBUGS-64687: Add priority field to prevent early shutdown #893
OCPBUGS-60682: Throttle resourcesynccontroller on pairs with dual writers. #884
OCPBUGS-60682: certrotationcontroller: set RefreshOnlyWhenExpired for CA bundle #861
OCPBUGS-60132: Missing endpoint slices for open ports the operator uses #853
Full changelog

cluster-kube-scheduler-operator

CNTRLPLANE-2843: chore: update OWNERS #621
OCPBUGS-74628: Add priority field to prevent early shutdown #609
Full changelog

cluster-machine-approver

OCPBUGS-63586: port 9193 need to be internal and port 9194 need to have a service #281
Full changelog

cluster-monitoring-operator

OCPBUGS-77273: AlertingRule: fix duplicate PrometheusRules after MD5->SHA-224 naming change #2834
OCPBUGS-67167: Add the collection of MTV migration metrics #2773
OCPBUGS-67003: make CMO Upgradeable=false if invalid Prometheus externalLabels are used #2775
OCPBUGS-62830: Remove cluster from non-multicluster dashboards #2760
OCPBUGS-63236: Remove AlertManager endpoints when disabled #2716
OCPBUGS-64578: Fix KSM deny-list typo #2730
OCPBUGS-63409: chore(prometheus/remotewrite): [release-4.19] clarify that the in-cluster proxy env vars set in prometheus container can be used in all configs that support proxyConfig.proxyFromEnvironment #2722
OCPBUGS-63197: add flag –watch-referenced-objects-in-all-namespaces to prometheus-operator #2678
OCPBUGS-62965, OCPBUGS-62966, OCPBUGS-62967, OCPBUGS-62968, OCPBUGS-62969: [Backport] non-HA alert cases #2709
OCPBUGS-62752: Add mcd_local_unsupported_packages metric from MCO to telemetry 4.19 #2697
OCPBUGS-62453: test: remove image registry e2e tests #2690
OCPBUGS-61486: chore(jsonnet): use prometheus_remote_storage_queue_highest_timestamp_seconds in PrometheusRemoteWriteBehind #2666
OCPBUGS-59932: operator: increase wait time till degraded to max 4 times 5m #2629
Full changelog

cluster-network-operator

CORENET-6311, OCPBUGS-74205: Skip running _stackmanager for libreswan 5.3+ #2885
OCPBUGS-67208: Fix whereabouts-token-watcher DaemonSet improvements #2857
OCPBUGS-70328: Tweak iptables-alerter to try to avoid crictl bug #2867
OCPBUGS-57134: whereabouts-config is a reserved name for user interaction. #2719
OCPBUGS-63447, OCPBUGS-63448: Annotate whereabouts-controller #2822
OCPBUGS-62670: Add drop flows for GARP #2809
OCPBUGS-61460: Set maxUnavailable 10% on MultiNetworkPolicy DS #2794
OCPBUGS-61185: Consume latest OCP API in 4.19 #2790
OCPBUGS-60983: Update CNO reviewers/approvers #2765
OCPBUGS-60761: Allow overriding OVN-Kubernetes configuration #2781
OCPBUGS-60534: Fix multus webhook match condition for spec changes #2777
OCPBUGS-60095: Add release version annotation to whereabouts-controller/whereabouts-token-watcher #2762
Full changelog

cluster-node-tuning-operator

OCPBUGS-73797: PPC: ghw: filter out namespaces dir #1455
OCPBUGS-63418: Do not cause kubelet failed dependency by ocp-tuned-one-shot.service #1416
And 4 elided commits (e.g. from squash or rebase merges)
Full changelog

cluster-samples-operator

OCPBUGS-63510: references to github.com/sclorg/django-ex.git now also refer to the branch #656
Full changelog

cluster-storage-operator

OCPBUGS-77007: add vsphere permissions for checking if users is authorized to see metrics #667
OCPBUGS-62667: Move metrics to vsphere driver #631
OCPBUGS-60152: hypershift: add app label to csdriveroperators running in HCP #604
Full changelog

cluster-update-keys

NO-ISSUE: Updating ose-cluster-update-keys-container image to be consistent with ART for 4.19 #80
Full changelog

cluster-version-operator

OCPBUGS-70181: OCPBUGS-70181: Unify capitalization when comparing architectures for available updates #1291
NO-ISSUE: hongkai becomes an approver release-4.19 #1285
OCPBUGS-70296: add the ports Field into the CVO’s container spec #1283
OCPBUGS-62868: temporarily disable metrics auth for hypershift clusters #1245
OCPBUGS-55937: Gate 4.19 -> 4.20 upgrade due to admissionregistration.k8s.io/v1beta1 API removal #1193
OCPBUGS-60168: CVO protects /metrics with authorization #1222
Full changelog

console

OCPBUGS-81515: Visiting Group Detail Page > RoleBindings will show error #16234
OCPBUGS-78292: Fix infinite recursion in project access form #16130
CONSOLE-5011: migrate to yarn berry #16071
OCPBUGS-76950: “Import from Git” should not force HTTPS/443 for Git providers (GitHub/GitLab/Bitbucket) #16028
OCPBUGS-74464: Bump lodash to latest #15964
OCPBUGS-74341: Do not resolve disabled catalog type extensions #15945
OCPBUGS-70335: OpenShift Console can only show user name instead of full name as the display name #15888
OCPBUGS-72399: Fix Helm chart installation with CA/TLS certificates #15898
OCPBUGS-70135: Update client initialization in checkPackageManifestHandler #15877
OCPBUGS-69677: Spread operand details across 2 col #15859
OCPBUGS-69860: PVC shows negative Available space in OpenShift Console on RHOCP 4 #15866
OCPBUGS-62725: Fixes namespace-scoped operators that were not showing as installed when viewing OperatorHub in “All Projects” mode #15816
OCPBUGS-67361: Disallowed Pipelines-plugin Pipelines navigation section #15839
OCPBUGS-66245: The number of Quick Starts item is wrong #15793
OCPBUGS-66179: Fix unnecessary rerenders with pod-connect #15784
OCPBUGS-62438: Updation of label from edit label doesn’t work #15547
OCPBUGS-65930: Preserve query string in perspective switch + remove dev console folks from reviewers #15760
OCPBUGS-63703: Fix dynamic form spacing and layout issues #15706
OCPBUGS-64834: Preserve path on perspective switch #15697
OCPBUGS-64849: HPA Form View in RHOCP Web Console Incorrectly Requires Both CPU and … #15698
OCPBUGS-64746: Fix Bare Metal Hosts nav item #15687
OCPBUGS-63588: Expose prometheus tenancy label path as a proxy #15645
OCPBUGS-63607: limit node log length to 1000 lines #15647
OCPBUGS-63530: Remove required flag from ‘console.flag/model’ pipelines-plugin extension #15642
OCPBUGS-63156: Initialize log package #15610
OCPBUGS-62999: switch to dev perspective for /dev-monitoring #15598
OCPBUGS-59953: fix: Fix negative CPU util graphs #15345
OCPBUGS-62643: bump dompurify to latest #15588
OCPBUGS-62083: /auth/error?error=missing_state&error_type=auth is showing blank page #15523
OCPBUGS-62087: Help dropdown should be closed automatically after tour model opened #15527
OCPBUGS-61821: Refactor PodConnect and Terminal to TypeScript #15503
OCPBUGS-61781: Fix improper DescriptionList refactor #15497
NO-JIRA: Update CHANGELOG in relation to 4.18 plugin SDK package publish #15457
OCPBUGS-60420: QuickStarts Link buttons to other quickstarts are duplicate #15391
OCPBUGS-50571: Make sure CSP violations are only reported to telemetry once per day per browser #15366
OCPBUGS-60279: Remove ancient X-XSS-Protection header #15381
OCPBUGS-60038: Resolving API Version Conflicts in Tekton Pipeline Runs #15354
OCPBUGS-60294: OpenShift Console’s “Start Job” action overrides configured “backoffLimit” to “6” #15382
NO-JIRA: Update CHANGELOG for latest 4.19 plugin SDK package publish #15406
OCPBUGS-60039: Fix i18n string for event stream (again) #15388
OCPBUGS-60039: Fix i18n string for event stream #15355
OCPBUGS-56651: Recognize Detached BMH status #15083
OCPBUGS-58214: Incorrect i18n translations in 4.19 batch #15218
OCPBUGS-59790: Move alertmanager settings route #15331
Full changelog

console-operator

OCPBUGS-61879: pluginOrder field should only contain available plugins #1047
OCPBUGS-61119: Consolidate telemetry values oscilation #1037
Full changelog

coredns

OCPBUGS-60246: UPSTREAM: 7083 and 6836: Fix failing TestZoneExternalCNAMELookupWithProxy #148
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-64812: Merge https://github.com/kubernetes/cloud-provider-openstack:release-1.31 into release-4.19 #335
Full changelog

csi-external-resizer

OCPBUGS-62468: Requeue PVC over PV creation #177
Full changelog

csi-external-snapshotter, csi-snapshot-controller

OCPBUGS-58463: UPSTREAM: 1303: Fix requeueing snapshot content after deletion error #182
Full changelog

csi-node-driver-registrar

OCPBUGS-63193: update log level verbosity to not clutter logs #88
Full changelog

docker-builder

OCPBUGS-66993: bump buildah to 1.39.7 to fix CVE-2025-52881 #497
OCPBUGS-65624: BuildConfig inline Dockerfile fails with heredoc syntax #485
Full changelog

docker-registry

OCPBUGS-68302: update logrus to v1.9.1 #463
Full changelog

etcd

OCPBUGS-74602: 4.19 rebase 3.5.26 #360
OCPBUGS-63476: 4.19 rebase 3.5.24 #348
OCPBUGS-61041: Revert “OCPBUGS-52181: Ensure cluster id changes during force-new-cluster” #340
Full changelog

gcp-machine-controllers

OCPBUGS-59386: Add max-concurrent-reconciles flag to machine actuator #125
Full changelog

gcp-pd-csi-driver

OCPBUGS-68307: Update logrus to 1.9.3 #88
OCPBUGS-62116: UPSTREAM: 2054: Fix Hyperdisk Resize That Requires Iops/Throughput Adjustment #82
OCPBUGS-59749: 4.19: UPSTREAM: 2116: Remove check on snapshot create support for multi-writer HyperDisk-HA and let such validations occur at the PD control plane layer #80
Full changelog

haproxy-router

OCPBUGS-66984: Add option abortonclose to HAProxy configuration template #701
Full changelog

hyperkube, kube-proxy, pod

OCPBUGS-77478: Rebase v1.32.13 to release-4.19 #2602
OCPBUGS-76518: Rebase v1.32.12 #2592
OCPBUGS-65552: Rebase v1.32.10 #2515
OCPBUGS-59651: Fix Concurrentmap Iteration #2509
CNTRLPLANE-1609: Backport StreamingCollectionEncoding for JSON and protobuf #2478
OCPBUGS-61556: Rebase v1.32.9 #2464
OCPBUGS-61488: UPSTREAM: <carry>: backporting fix for concurrent map iteration and write #2456
OCPBUGS-60510: Unrevert bump to v1.32.8 #2439
OCPBUGS-61021: UPSTREAM: <carry>: Revert “Rebase v1.32.8 to 4.19” #2433
OCPBUGS-60510: Rebase v1.32.8 to 4.19 #2412
OCPBUGS-60074: UPSTREAM: 132028: podresources: list: use active pods #2391
OCPBUGS-59534: Rebase v1.32.7 to 4.19 #2367
Full changelog

hypershift

OCPBUGS-81161: [release-4.19] fix(cpo): Don’t remove HCP Ingress from routes when CapabilityRoute is disabled #8093
OCPBUGS-78742: fix(sync-global-pullsecret): compare content ignoring trailing newlines #7992
OCPBUGS-74106: Fix CVE-2025-58183 #7547
OCPBUGS-76531: feat(updates): enable CVO metrics access with RHOBS monitoring flag #7698
OCPBUGS-77367, OCPBUGS-77844: Fix ignition-server pod restarts #7858
OCPBUGS-75932: [release-4.19] fix(cpo): Correct route labeling logic for HCP router infrastructure #7643
OCPBUGS-72393: Fix Konflux EC voilation, nginx image deprecated #7440
CNV-70889: use csi-resizer image from release provider #7102
OCPBUGS-65829: The Containerfile in the repo has hypershift-no-cgo, but the published image quay.io/hypershift/hypershift-operator:latest doesn’t #7256
CNTRLPLANE-1709: feat: Backport Customer Global Pull Secret to OpenShift 4.19.z #7316
OCPBUGS-69415: test: remove unit tests that depend on network communication [release-4.19] #7395
OCPBUGS-65693: specify SCC annotation for pods in data plane #7255
OCPBUGS-62959: fix(cvo): support image overrides annotation for CVO deployment #7065
OCPBUGS-64817: Add CPO hotfix arm64 builds #7195
OCPBUGS-63129: resolve initContainer permission issue after node reboot #7145
OCPBUGS-63636: [release-4.19] fix(konnectivity): resolve circular dependency causing DNS timeouts and excessive retries #7110
OCPBUGS-63368: Make the hypershift CLI binary FIPS-compliant #7092
OCPBUGS-61407: fix: Do not admit OAuth route by private router unless… #6780
OCPBUGS-62807: Fix driver-config ConfigMap content flapping due to random ordering #6944
CNTRLPLANE-1423: feat(konflux): tag MCE HO images with latest #6833
OCPBUGS-62183: fix(kas-bootstrap): increase wait timeouts to avoid KAS startup races #6886
OCPBUGS-62202: Enable VolumeAttributesClass runtime config #6890
OCPBUGS-60630: order ICSPs for determinism of OPENSHIFT_IMG_OVERRIDES #6674
OCPBUGS-61567: [release-4.19] fix(proxy): ensure URLs have scheme before proxy resolution #6792
OCPBUGS-61677: resolve MIRRORED_RELEASE_IMAGE flapping #6825
OCPBUGS-61206: use common MCE konflux pipeline #6748
OCPBUGS-61031: [release-4.19]: set default goaway-chance to 0.001 #6712
OCPBUGS-60483: feat(validations): add wildcard support to DNS SAN conflict detection #6648
OCPBUGS-60147: Always compress and encode payload in token secret for inplace upgrades #6606
OCPBUGS-60152: add missing app label to some components #6636
OCPBUGS-60125: fix(OCPBUGS-60125): Allow HCCO to set registry managementState to Removed; delete VAP during HC deletion #6689
OCPBUGS-60648: Cache Azure KMS TokenCredential for ARO HCP and clarify CPO credentials cache naming #6677
OCPBUGS-60100: fix: add dynamic security context uid to 4.19 missing components #6675
OCPBUGS-57141: HCP payload doesn’t respect multiple mirrors #6517
CNTRLPLANE-1270: Red Hat Konflux update control-plane-operator-4-19 #6660
Red Hat Konflux purge control-plane-operator-4-19 #6659
CNTRLPLANE-1267: conditional builds for mce-2.9 #6657
OCPBUGS-57588: Update PSA from v1beta1 to v1 #6302
OCPBUGS-59805: Router publish strategy related changes for IBM Cloud platform #6490
OCPBUGS-59933: Use the image reference for the cache in the image metadata provider #6535
CNTRLPLANE-1016: Support day2 tags changes for AWS default SecurityGroup #6455
CNTRLPLANE-1034: chore: Relax the kas healthcheck for aro when AllowedCIDRBlocks #6617
OCPBUGS-60100: feat: let ARO honour cp namespace annotation for default SC uids in 4.19 #6592
CNTRLPLANE-1226: feat(konflux): Make CPO builds hermetic #6596
CNTRLPLANE-1213: New API to support specifying cluster-autoscaler flags #6558
OCPBUGS-57331: Set default security context on everything #6257
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-77206: [release-4.19] standardize build paths #119
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-52542: CVE-2025-22869 Update golang.org/x/crypto to patched OpenShift fork #118
Full changelog

ibmcloud-machine-controllers

OCPBUGS-81483: bump vpc go sdk #90
NO-JIRA: Modernize test infrastructure to align with other MAPI providers #86
Full changelog

insights-operator

OCPBUGS-76962: Extends the time for the extractor liveness probe #1230
OCPBUGS-75902: [bugfix] The ConfigMap value for StoragePath is ignored on basic routine #1224
OCPBUGS-66202: Add filtering to add other possible pod status to QEMU gatherer #1190
OCPBUGS-66058: [bugfix] The archive’s records may include files whose names are out of bounds #1183
OCPBUGS-66061: QEMU logs are not gathered if there are pending status virt-launcher pods #1184
OCPBUGS-62489: Update error message for missing SCA certificates #1152
OCPBUGS-61971: add missing permissions for replicasets and events #1145
And 3 elided commits (e.g. from squash or rebase merges)
Full changelog

insights-runtime-exporter, insights-runtime-extractor

OCPBUGS-77779: remove dnf cache from the container images #68
Full changelog

ironic

OCPBUGS-74406: Update sushy to include DGX B200 credentials fix #819
OCPBUGS-74116: Bump keystonemiddleware version to 10.9.0-0.20260216145500.557d173 for CVE-2026-22797 fix #794
OCPBUGS-77028: Update ironic hash for 4.19 with heartbeat inspection fix #797
OCPBUGS-69785: Bump eventlet version to 0.33.1-7 #759
OCPBUGS-65572: Include Handle HTTP 400 and 409 race condition in Redfish power opera… #724
OCPBUGS-62961: Bump sushy to include fix #700
Full changelog

ironic-agent

OCPBUGS-69783: Bump eventlet version to 0.33.1-7 #229
OCPBUGS-67304: Include Test advertised ip reachability before assigning it #224
OCPBUGS-62441: netutils: Use ethtool ioctl to get permanent mac address #198
Full changelog

kube-storage-version-migrator

NO-JIRA: Add DOWNSTREAM_OWNERS (release 4-19). #223
Full changelog

kubevirt-csi-driver

OCPBUGS-79322: Add annotation-based fallback for infra VM node ID resolution #85
OCPBUGS-78389: Updating ose-kubevirt-csi-driver-container image to be consistent with ART for 4.19 #79
Full changelog

libvirt-machine-controllers

OCPBUGS-77193: Fix incomplete vendor/ #299
Full changelog

machine-api-operator

OCPBUGS-78715: : [release-4.19] Use resource group when generating default Azure image #1479
OCPBUGS-61096: bump openshift/api #1411
fix for OCPBUGS-60427: userDataSecret.name should be a Required value on AWS #1403
OCPBUGS-59386: Enabled 10 concurrent reconciles on GCP #1391
Full changelog

machine-config-operator

OCPBUGS-76920: Degrade MCPs status based on MCN NodeDegraded condition #5662
OCPBUGS-81282: Re-order logger setting to eliminate race condition #5822
OCPBUGS-81144: Update AMI Whitelist #5817
OCPBUGS-79473: set default-timeout-stop to 200s globally #5802
OCPBUGS-77955: Update AMI Whitelist #5749
OCPBUGS-77221: Prevent unnecessary systemd unit disable #5688
OCPBUGS-77828: Update AMI Whitelist #5742
OCPBUGS-77725: reduce MCO image size #5737
OCPBUGS-74147: enable nodeip-configuration for platform external #5579
OCPBUGS-77229: Backport: Add delays to reduce TestOSBuildController failures #5690
OCPBUGS-77420: Remove MCD liveness probe #5711
OCPBUGS-77306: mcd_config_drift not working properly #5700
OCPBUGS-77240: Fix MCN conditions not updating during OCL sync #5693
OCPBUGS-77071: Machine-config controller should not log about non-existent pull-secret changes #5674
OCPBUGS-76831: machine-config-daemon: openshift: Exposure of Sensitive Data in Log Files in the Machine Configuration Daemon. [openshift-4] #5658
OCPBUGS-76362: Update AMI script and list #5640
OCPBUGS-43435: After OCL is enabled few phases in MCN are not updating as expected #5606
OCPBUGS-71210: MCP is not correctly degraded when a pivotError happens #5532
OCPBUGS-70325: Remove log exposing kubeconfig #5526
OCPBUGS-67264: cherry pick to few fixes that needed for missing services and configuration #5490
OCPBUGS-67198: Fix cleanup in TestInstallRPMAndCheckMCDMetrics to decrease risk of test failures due to interference #5496
OCPBUGS-64922: Update timing of MCN desired config spec update to align with node annotation setting #5439
OCPBUGS-65839: Remove –mount directives #5430
OCPBUGS-62168: Fix - NetworkManager restart or crash renders br-ex unusable #5352
OCPBUGS-64844: Create temporal allow policy #5398
OCPBUGS-63126: Ensure the node passed to RunCordonOrUncordon comes from the latest updated state #5348
OCPBUGS-62670: [release-4.19] Networking: reset ovn-remote config and allow ovnkube controller to set it #5324
OCPBUGS-62746: Fix MCP updated machine count for image mode disabling case #5336
OCPBUGS-62788: Skip rpm-ostree local rebase if no PIS #5337
OCPBUGS-61738: Recheck generatedByControllerVersion annotation prior to deleting a degraded MC #5283
OCPBUGS-62706: Cert Controller should live fetch SAN IPs during cert rotation #5330
OCPBUGS-62649: configure-ovs: work around a Cisco switch issue #5323
OCPBUGS-62003: Machine-config controller should actively manage cordon while draining #5300
OCPBUGS-62164: Add mcd_local_unsupported_packages recording rule #5306
OCPBUGS-62114: Improve MCN CRD clean-up script #5299
OCPBUGS-61835: Override NMState service definition #5287
OCPBUGS-61284: Make MCN e2e tests blocking #5275
OCPBUGS-60110: Enable debug logging for nodeip-configuration #5221
OCPBUGS-59871: Understand and eliminate noisy logs for MCN #5199
OCPBUGS-60767: Update the OnClusterBuild payload tests to reflect the validation rule requiring MCP & MOSC names to match #5258
OCPBUGS-60265: Reintroduce cronjob that deletes MCN v1alpha1 CRD #5243
OCPBUGS-60224: Invalid architecture value found in annotation during 4.19 update #5227
OCPBUGS-60080: use channel to signal controller shutdown #5217
OCPBUGS-59928, OPNET-681: Support migration to NMState #5208
OCPBUGS-59899: Add workaround fix for static pod race #5204
OCPBUGS-59978: ARO cert rotate fix #5210
Full changelog

machine-image-customization-controller

OCPBUGS-81713: Return error when network data Secret lacks nmstate key #173
OCPBUGS-77567: Clean up dnf cache to reduce container image size #166
Full changelog

metallb-frr

OCPBUGS-66055: Dockerfile: unpin FRR rpm #113
Full changelog

monitoring-plugin

OCPBUGS-77407: koa bump #867
OCPBUGS-76579: [release-4.19]CVE-2026-25639 openshift4/ose-monitoring-plugin-rhel9: Axios affected by Denial of Service via proto Key in mergeConfig #789
OCPBUGS-78360: fix for CVE-2025-69873 #847
OCPBUGS-78397: Updating monitoring-plugin-container image to be consistent with ART for 4.19 #842
NO-JIRA: simplify dockerfile by removing cachito dependencies [release-4.19] #806
OCPBUGS-76937: fix: update vulnerable dependencies #773
OU-1233: monitoring testing on release-4.19 branch - fix #785
OU-1233: automation task - main into 419 and alerting conditional filtering #772
OCPBUGS-74166: fix: update qs vulnerable dependency #737
OU-1157: remove random multiplication #706
OU-1131: Merge main into release-4.19 #693
OCPBUGS-66388: Time range and Refresh interval dropdown button lack of unique identifier #671
OU-863: [release-4.19]: Fix step calculation for metric explorer 4.19 #655
OCPBUGS-63531: [release-4.19] Improve alignment with console SDK #647
OCPBUGS-63588: [release-4.19] allow tenancy access to metrics tags #618
OU-1060: remove troubleshooting panel links from non-admin #629
NO-JIRA: [release-4.19] OCPBUGS-60296: fix legend height to avoid scroll overlap #498
NO-JIRA: improve consistency in tab string #496
: NO-JIRA: update the i18n #495
OCPBUGS-60129: feat: add alerting rules tab to dev console #488
OU-943: remove broken useEffect #484
Full changelog

multus-networkpolicy

OCPBUGS-77778: Clean up dnf cache #103
OCPBUGS-77158: Fix modified vendor/ and go.sum after vendoring #82
Full changelog

multus-whereabouts-ipam-cni

OCPBUGS-59640: Prevent accidental IP deallocation in statefulsets #375
Full changelog

must-gather

OCPBUGS-59487: network: Gather OVN-Kubernetes CUDN CRs #499
Full changelog

network-interface-bond-cni

OCPBUGS-62107: Use netlinksafe instead of netlink to avoid netlink.ErrDumpInterrupted #96
Full changelog

network-metrics-daemon

OCPBUGS-58851: Bump github.com/golang/glog to v1.2.4 (#110) #110
OCPBUGS-60172: Replace e2e test image (#119) #119
Full changelog

network-tools

NO-JIRA: fix prefetch-dependencies step failure #166
Full changelog

networking-console-plugin

OCPBUGS-41199: Fix NAD creation using default namespace instead of selected one #351
CNV-76277: Fix name generator with unprofessional names #318
OCPBUGS-60137: Fix ingress details #261
OCPBUGS-59841: Fix requiremenets with no value #255
Full changelog

oauth-apiserver

NO-JIRA: (chore): update OWNERS file #169
OCPBUGS-61760: bump kubernetes-apiserver to pick up loopback certificate expiration update #152
OCPBUGS-63051: (bugfix): useroauthaccesstokens: cast delete validation object to correct type for admission #150
Full changelog

oauth-server

OCPBUGS-58892: Fix mixup with Spanish and French locale variable names #192
Full changelog

oc-mirror

OCPBUGS-78147: Fix registriesd “unknown userid” failure for arbitrary UIDs #1367
OCPBUGS-77663: Fix reg config detection for explicit false values #1363
OCPBUGS-66410: fix: return only requested version #1323
OCPBUGS-65968: Remove empty status field from generated IDMS/ITMS files #1318
OCPBUGS-64683: removes unintended exec permissions #1307
OCPBUGS-62311: v2/cli: show binary version in output #1277
OCPBUGS-62606: generate the archive only after mirroring #1282
OCPBUGS-62062: [release-4.19] changes the warning message of 4.21 #1271
And 7 elided commits (e.g. from squash or rebase merges)
Full changelog

olm-catalogd, olm-operator-controller

OCPBUGS-63405, OPRUN-4216: Port CRD upgrade safety carry from 4.20 without bumping deps #543
And 2 elided commits (e.g. from squash or rebase merges)
Full changelog

openshift-apiserver

OCPBUGS-66920: Add ValidatingAdmissionPolicy and check for omissions next time. #588
OCPBUGS-61662: Adding validation directly and calling existing library-go validation #576
OCPBUGS-65962: pkg/image: conditionally parse raw image manifest #582
NO-JIRA: add .0 to go version #583
OCPBUGS-65863: update pkg/image/OWNERS #578
OCPBUGS-61759: bump kubernetes-apiserver to pick up loopback certificate expiration update #569
OCPBUGS-57043: Updating ose-openshift-apiserver-container image to be consistent with ART for 4.19 #564
Full changelog

openshift-controller-manager

OCPBUGS-56614: legacy image pull secret rollback controller #384
Full changelog

openstack-cluster-api-controllers

OCPBUGS-64815: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.12 into release-4.19 #370
Full changelog

openstack-machine-api-provider

OCPBUGS-69646: Don’t record event for every reconcile #144
OCPBUGS-76791: Fix make test #158
OCPBUGS-74586: Revendor CAPO #151
Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

OCPBUGS-79700: Fix nil pointer dereference in sortUnpackJobs when sorting non-failed jobs #1270
OCPBUGS-77437: Remove the collect-profiles info from the microshift kustomization file #1240
OCPBUGS-76587: Remove the collect-profiles job #1229
OCPBUGS-64925: Fix TOCTOU race condition in ensureInstallPlan (#3682) #1145
OCPBUGS-61363: [4.19] e2e stability fixes #1079
OCPBUGS-60525: Add NetworkPolicy as a supported kind #1047
Full changelog

operator-marketplace

OCPBUGS-73882: Increase default catalog polling interval to 4h (240m) #706
OCPBUGS-62217: Remove Expect func so that the test case can use the retry logic #668
Full changelog

ovirt-csi-driver-operator

OCPBUGS-68321: Bump github.com/sirupsen/logrus to v1.9.3 #149
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-81526: Branch Sync release-4.20 to release-4.19 [03-03-2026] #3034
OCPBUGS-77442: Clear stale conntrack UDP entries for nodePorts #3015
OCPBUGS-77082, OCPBUGS-77096: [release-4.19] combined backport PR for 2 escalations #2986
OCPBUGS-74269: release-4.19 fix(localnet, ipamless): Prevent LSP deletion on sync #2942
OCPBUGS-70345: Branch Sync release-4.20 to release-4.19 [12-31-2025] #2915
OCPBUGS-66139: Branch Sync release-4.20 to release-4.19 [12-03-2025] #2890
CORENET-6055, OCPBUGS-65658, OCPBUGS-65909, OCPBUGS-65956: Branch Sync release-4.20 to release-4.19 [11-26-2025] #2872
OCPBUGS-64854: Fix stale EIP assignments during failover and controller restart #2848
OCPBUGS-64645: kubevirt: fix bad release of IPs of live migratable pods #2842
OCPBUGS-63660: Skip Pending pods in EgressIP status updates #2834
OCPBUGS-63234: [release-4.19] DownStream Merge Sync from 4.20 [10-16-2025] #2810
OCPBUGS-62670: Fix EgressIP stale GARP post reboot + pod restart #2774
OCPBUGS-62800: [release-4.19] DownStream Merge Sync from 4.20 [10-07-2025] #2786
OCPBUGS-61454: [4.19] allow default network -> localnet on the same node for any localnet subnet #2753
OCPBUGS-48709, OCPBUGS-60797, OCPBUGS-60979: DownStream Merge Sync from 4.20 [08-22-2025] #2733
OCPBUGS-48709: DownStream Merge Sync from 4.20 [08-06-2025] #2704
OCPBUGS-48709: DownStream Merge Sync from 4.20 [07-28-2025] #2688
Full changelog

powervs-block-csi-driver

OCPBUGS-75601: Mitigate CVE-2025-61726 by bumping golang to 1.24.13 #119
Full changelog

powervs-block-csi-driver-operator

OCPBUGS-80498: Fix CVE-2026-33186 by bumping google.golang.org/grpc to v1.79.3 #109
Full changelog

powervs-machine-controllers

OCPBUGS-61134: Use OS_GIT_VERSION in Makefile when found (for Konflux builds) #124
Full changelog

prometheus

OCPBUGS-62429: chore(scrape): default to legacy validation/escaping scheme until utf-8 is fully supported by prometheus-operator #275
OCPBUGS-61486: chore: compute highestTimestamp at queryManager level #265
Full changelog

prometheus-alertmanager

OCPBUGS-73759: Include go-verify-deps expected files in gitignore #111
Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

OCPBUGS-77297: backport upstream fix to reconcile resources with inconsistent status #368
OCPBUGS-77269: Validate webhookURL secret for MSTeams receiver in AlertmanagerConfig CRD #363
OCPBUGS-63197: reconcile workload configurations when a referenced secret/configmap key is updated #339
Full changelog

rhel-coreos, rhel-coreos-extensions

Merge #1853
Merge #1851
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

route-controller-manager

OCPBUGS-77172: filter ingress namespace on UnmanagedRoutes metric #75
Full changelog

tests

: run resource request/limit check early #30898
OCPBUGS-77825: add the missing namespace from managed openshift #30836
OCPBUGS-77790: Update MCN tests to better handle condition transitions through the “Unknown” state #30833
OCPBUGS-74201: Unrevert TLS tests with fixes #30707
OCPBUGS-67146: Fix MachineConfigNode test in two-node fencing clusters #30590
OCPBUGS-67365: Updated the upgrade duration limit to 100 minutes for ppc64le #30606
OCPBUGS-63727: CNTRLPLANE-1767:fix(disruption): Using correct internal LB of apiserver for monitor test on ARO and Baremetal Hypershift #30440
OCPBUGS-63609: Migrate OCP-32383 to upstream #30429
OCPBUGS-63637: Add imagestream update dryrun test #30432
OCPBUGS-62642: Fix endpoint admission test namespace creation for ROSA #30331
OCPBUGS-61172: OCPBUGS-60883: Fix PinnedImageSet test instability & update flow for tests using custom MCPs #30205
OCPBUGS-56213: Skip GatewayAPIController tests on clusters without OLM capabilities #29815
OCPBUGS-61666: chore(test/extended/prometheus): bump the series limit of total series sent via telemetry from each cluster #30249
OCPBUGS-59512: disruptioninclusterapiserver: bump timeout to 10 mins #29999
OCPBUGS-60510: Bump to latest openshift/kubernetes (v1.32.8) #30229
OCPBUGS-60244: Wait 30s after the upgrade is complete to validate workloads #30144
OCPBUGS-60797: Don’t check for remote node subnet BGP routes #30156
NO-JIRA: Update extended/networking OWNERS #30088
OCPBUGS-60569: images/tests: Remove rteval #30124
OCPBUGS-60429: Load our MCO’s OTE binary #30043
OCPBUGS-59757: OCPBUGS-59758: Improve MCN test stability #30018
OCPBUGS-60117: Enable test for LGW L2 #30052
OCPBUGS-60234: Move the legacy container failures #30073
OCPBUGS-60092: feat(azure): skip metrics collection for ARO HCP hypershift #30051
Full changelog

vsphere-cloud-controller-manager

OCPBUGS-77513: hermetic migration 4.19 #104
Full changelog

vsphere-cluster-api-controllers

OCPBUGS-61650: Fix unit tests #69
Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

OCPBUGS-68315: CVE-2025-65637: Bump github.com/sirupsen/logrus to v1.9.3 #155
Full changelog

vsphere-problem-detector

OCPBUGS-76081: fix concurrent map writes #210
OCPBUGS-66198: Fixed logic for vSphere compute cluster permission #198
OCPBUGS-60535: Check for number of FailureDomain-s in GetVCenter() #188
Full changelog

Node Image Info

Loading node image info, this may take a while ...

Unable to show node image info: could not generate RPM diff for quay.io/openshift-release-dev/ocp-release@sha256:bd4cd954feebfe3a6b2847c20271e8f3ba21e99ac1e234db6ce4cf2207f8955a to quay.io/openshift-release-dev/ocp-release@sha256:b274766f7194a7dc825e335a54078790519c0dbe3431c029fd08dbba1c431855: could not run oc command: error: fetching rpmdb for from image: retrieving image config for rhel-coreos: unable to read image quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:11cd36d62109eaeb37138be6c532cc23f898fafa28474e8297df31f41ae103ab: Get "https://quay.io/v2/openshift-release-dev/ocp-v4.0-art-dev/manifests/sha256:11cd36d62109eaeb37138be6c532cc23f898fafa28474e8297df31f41ae103ab": received unexpected HTTP status: 502 Bad Gateway

View changelog in Markdown or change previous release:

Source code for this page located on github