4.21.17

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.21.17-x86_64

Team Approvals:

Accepted
- QE

Tests:

Blocking jobs
- upgrade Succeeded (1 retry) periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Succeeded
- upgrade-minor Succeeded periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
Informing jobs
- aws-ovn-serial-1of2 Succeeded periodic-ci-openshift-release-main-nightly-4.21-e2e-aws-ovn-serial-1of2
- aws-ovn-serial-2of2 Succeeded periodic-ci-openshift-release-main-nightly-4.21-e2e-aws-ovn-serial-2of2
- aws-ovn-single-node-upgrade-4.21-micro Succeeded periodic-ci-openshift-release-main-ci-4.21-e2e-aws-upgrade-ovn-single-node
- aws-ovn-upgrade-4.21-micro-fips Succeeded periodic-ci-openshift-release-main-nightly-4.21-e2e-aws-ovn-upgrade-fips
- aws-ovn-upgrade-4.21-micro-fips-no-nat-instance Succeeded periodic-ci-openshift-release-main-nightly-4.21-e2e-aws-ovn-upgrade-fips-no-nat-instance
- azure-ovn-upgrade-4.21-micro Succeeded periodic-ci-openshift-release-main-ci-4.21-e2e-azure-ovn-upgrade
- driver-toolkit Succeeded (1 retry) periodic-ci-openshift-release-main-nightly-4.21-e2e-aws-driver-toolkit
  - Attempt 1 Failed
  - Attempt 2 Succeeded
- fips-scan Succeeded (2 retries) periodic-ci-openshift-release-main-nightly-4.21-fips-payload-scan
- gcp-ovn-rt-upgrade-4.21-minor Succeeded (1 retry) periodic-ci-openshift-release-main-ci-4.21-upgrade-from-stable-4.20-e2e-gcp-ovn-rt-upgrade
  - Attempt 1 Failed
  - Attempt 2 Succeeded
- hypershift-ovn-conformance-4.21 Succeeded periodic-ci-openshift-hypershift-release-4.21-periodics-e2e-aws-ovn-conformance
- metal-ipi-ovn-bm Succeeded periodic-ci-openshift-release-main-nightly-4.21-e2e-metal-ipi-ovn-bm
- metal-ipi-ovn-ipv6 Succeeded periodic-ci-openshift-release-main-nightly-4.21-e2e-metal-ipi-ovn-ipv6
- microshift-ovn-conformance-parallel Succeeded periodic-ci-openshift-microshift-release-4.21-periodics-e2e-aws-ovn-ocp-conformance
- microshift-ovn-conformance-serial Succeeded periodic-ci-openshift-microshift-release-4.21-periodics-e2e-aws-ovn-ocp-conformance-serial

Upgrades from:

Untested upgrades: 4.21.11, 4.21.12, 4.21.3, 4.21.4, 4.21.5, 4.21.6, 4.21.7, 4.21.8

4.21.16 (changes) - S S S S F F S
4.21.15 (changes) - Success
4.21.14 (changes) - Success
4.21.13 (changes) - Success
4.21.10 (changes) - Success
4.21.9 (changes) - Success
4.21.2 (changes) - Failed
4.21.1 - Failed
4.21.0 (changes) - Success
4.20.23 (changes) - Success Success
4.20.22 (changes) - Success
4.20.21 (changes) - Failed
4.20.20 (changes) - Success
4.20.19 (changes) - Success
4.20.18 (changes) - Success
4.20.17 (changes) - Failed
4.20.16 (changes) - Failed
4.20.15 (changes) - Failed
4.20.0-0.nightly-2026-05-21-014012 (changes) - Failed Success

Upgrades to:

4.22.0-rc.4 (changes) - Failed

Loading changelog, this may take a while ...

Changes from 4.21.1

Created: 2026-05-21 19:24:17 +0000 UTC

Image Digest: sha256:52a9c863ddc434eedee8c0e75cf610805db2b6b91502688857bc8afa62ed1dd6

Components

Kubectl 1.34.1
Kubernetes upgraded from 1.34.2 to 1.34.8
Kubernetes Tests 1.34.1
Red Hat Enterprise Linux CoreOS upgraded from 9.6.20260204-0 to 10.2.20260513-0

The CoreOS links above are for the base CoreOS layer used to build the OpenShift node image and do not contain OpenShift components. This is normally only useful to devs working closely with the CoreOS team. For info about the node image, see the Node Image Info section.

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
EventTTL (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled	Enabled
IngressControllerDynamicConfigurationManager (0 tests)	Disabled	Disabled	Enabled	Enabled	Enabled (Changed)	Enabled (Changed)
KMSEncryptionProvider (0 tests)	Disabled	Disabled	Enabled	Enabled	Disabled (Changed)	Disabled (Changed)
KMSEncryption (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)

Removed images

cluster-kube-cluster-api-operator
libvirt-machine-controllers

Rebuilt images without code change

agent-installer-node-agent git e5713826 sha256:59cb7551e6285adeb8d62ffa19a72749cd3811310d8f1b7e01cdddd4dbbd15ff
apiserver-network-proxy git 35ba137a sha256:583f7fa8f863fc94fa64701fdc9f73d3cb2e3489a824c0acce5bbe7be316c3f0
aws-cluster-api-controllers git 10ceef5e sha256:33d3b0a841e965c04e003231f843d29151af86963cb666ee559bad2927c4a686
aws-karpenter-provider-aws git ff9c8d4e sha256:71afe8c9691ee703ac13b0890907f33c75a228b59c814d6b82f2a65a1e47ade4
aws-machine-controllers git 938565c9 sha256:944aa629155f7178117d9a0bbd7bb0ed004d3366fbcf57631fbfe83a2bc368c6
aws-pod-identity-webhook git 5cd42ed1 sha256:79cba6d8170de79871ba17cab38590214ac607cbb70f8cea3b6d5e2e02459ef2
azure-cloud-controller-manager git 83b3f9ec sha256:eb42844eab339ea395b4602416c980869df131dba59919427f2030c8637584cb
azure-cloud-node-manager git 83b3f9ec sha256:8aae47deb7ed9c93ea1550a4e7a095b27929b445c6da66b357481ecea7547696
azure-machine-controllers git b8b8cb1c sha256:92da519b676d1e67fca18661be99dc37bf6dc8b495e2a8f6014bd1f73c0ebd26
azure-workload-identity-webhook git 3f2a6e0d sha256:6b9b731bd9507e7697e44ad1d50b69ba887ff289c38487dcf9b20066fa9907f3
baremetal-cluster-api-controllers git 659138fe sha256:1089968ddd8b2f384bc430585b52186ee5e8a1e87b22828829a5070177c699fb
baremetal-machine-controllers git 4e6a729c sha256:42e915db33cda8eff13c9059b0f08f0726a1022e904de8aff549a62999c7b095
cluster-autoscaler-operator git dec12ba6 sha256:079857ea9446e9f5271915305cad92a6058525c138e95ca9e0d1adc607c453b9
cluster-bootstrap git dc0d4a5c sha256:3a7fea6d73c0058ab2ab3b389a11fd287ed94bd4b84044ad3845f837327ae893
cluster-cloud-controller-manager-operator git 6148c0cc sha256:aa5612c01cd4a3b8ed4536fd0210bc340cd487f1c5db55e76e1fe0a4d7e1b2b5
cluster-config-operator git 1eb450a3 sha256:4dcca96cc1098fc9f8caa84312eb5bb95bf9b40f7e68fbe70dfa2f036107b884
cluster-control-plane-machine-set-operator git 2dde33fb sha256:066088b2da98cbd11eba710779b1702bcebe5f4e0edb1e5a1f3c0d106b70b7d0
cluster-dns-operator git 41a53fed sha256:0d072ef32cfb35efa4839aa9322dd996f6ada6a1184841b96a0c5b988b2679ad
cluster-image-registry-operator git b2dfc3bb sha256:9858c6a18b4544829492b23c8d512c1ccf59bb85accf7391d1757ea9927b2507
cluster-kube-controller-manager-operator git 395de967 sha256:220ae5ead3716b681dd35b1b64079ff6ddbba18decef051da11d400f92550933
cluster-kube-storage-version-migrator-operator git 8a42beeb sha256:57d040a42eb53bc8628369ab2a2ba5e8c0896116c9f12135c2c7a1f05a94c6ff
cluster-machine-approver git d864813c sha256:edd04f343ab4194bdc35d712025a89ed3d61753579c4893d97676d93361a34b7
cluster-openshift-controller-manager-operator git 2617a201 sha256:582a6829822f50c3c10b715fe097f313e572ad2c20599df7eca8546b78102397
cluster-policy-controller git 8b775487 sha256:14abc306d7f63b16821732a58721bf5628000a779000f968afd96b3a91412469
cluster-samples-operator git 11ed1942 sha256:ecd4ee7a1176a302b15ce61590357556b54e1891601f066ce2a73b1c192cd388
cluster-update-keys git b3cae8f2 sha256:fefeb4a35d5f9084d0c7d83e0d627ee588eddaca612ebc02858144fda631b16d
configmap-reloader git 16114b8d sha256:b0655c6feb7794fc5e9fa846df5bf8cf6f7b78e3b841eb6f3d147fb9a8674fe9
container-networking-plugins git 747ad66c sha256:6d66d598d56b94ac48ee79fcc1689a42f01fac275e580ff8c675ad2bbe1b5e86
containernetworking-plugins-microshift git 747ad66c sha256:f0eb5b2d683f328d91690623964225dfd1ea42e367fa389dcaf2c8b149416b07
coredns git 7486e9e4 sha256:4ca89c81b23abca0cf93995f22124a23766d7464f1a0463699ef631cb19674c2
csi-external-resizer git d880a1ec sha256:9ffb919975c2dbd4845c5050a712308f6ae5e118a4784d1e5e81dc5778d77320
csi-external-snapshot-metadata git af250fdb sha256:2af6d3e8950104eb2203fff51cdd99418d427a45b42d611ca6f992770fa256b6
csi-external-snapshotter git 9098db0e sha256:34689de4f996279d60f5480b01476eaf830f873ad847107b40727f18cbb63758
csi-livenessprobe git 78dacb7c sha256:ccfde1461ce4f6a60cd9d3459207678edcb4bc7c6a0430b2fc89878335c42596
csi-node-driver-registrar git d29f3f7a sha256:dc6794c5e79a02d025b945b7911af163f032bb99061e6147aedfc07c0985afcc
csi-snapshot-controller git 9098db0e sha256:372ac8398d433b5d51ce8ce2a8fd2475d35778ab342c3d9c36b796d2cb1c6056
docker-registry git 602f51c7 sha256:aa05d64cd9cc32ec7bf6d32a4fba8ae7e5488c13b19284d6a316c466ff07b55c
egress-router-cni git 5e0f8d1b sha256:ac0430e800549977b3bbb5804232b80d351ecb8b8c81d1fb64d4ef0a94fdb8e1
etcd git 806f690e sha256:4f7d601dce0c9b7b1d4edc2fd940c93a6c57bf5cc554d2cc80bf4c36fa8d304f
gcp-workload-identity-federation-webhook git d481e5cb sha256:295ee351f218fe3be2fb62b9e8edfee6ea271d7c29bb8a2b0af21c17ec494e77
ibm-cloud-controller-manager git c566572b sha256:e3c73ba0b80d326752bcd06823b69cac75a531694b193ea9247384f7330601a5
ibm-vpc-block-csi-driver-operator git 00bc7407 sha256:d3c2edad5f743036f72a171f01e338e2e37ab1f30ecbbe94627272050b5575c2
ibmcloud-cluster-api-controllers git f7e3ec30 sha256:a85169465b210fdde8cb1378f7dd3933fb5d486e2f6041707698ff2ddc25fdf4
ironic-static-ip-manager git b95b05fe sha256:eb8769392df4c6e768f21ddef17c0945a29ebf6467a2a2864d32a094abff7db1
kube-rbac-proxy git cd636680 sha256:3531cbdb9512d8c734ae154a9694632d14e60efbc06fa3a68cc9bd1180a8e3e8
kube-storage-version-migrator git ce5ff17e sha256:90ba12ba7ca5ee59968b770afdb405672b640f700cca06ca61a03148c57feaef
metallb-frr git c82bfaad sha256:4b7c13993cebe8fbbb1635a0cc0106bc1928d1fcaffce0cdc7acc0926583833c
multus-admission-controller git d95feb67 sha256:9481c720231b8bb67f2435fba83853b403c758f309c20f81df20f5629a4125e0
multus-route-override-cni git 08af4127 sha256:b461f896b98bb85815039629d8ef18acbc59826bf021092dfc3e6ce3ac73d11e
multus-whereabouts-ipam-cni git d691040e sha256:39645dff4db76fe5cb0530c0b0bca9c84c1207c60eb573b423604ccae459366d
network-interface-bond-cni git 297eeb43 sha256:84174d5e6b89733c77584d02e68f03864aa78cb00bcea0450e6a8b2615f22a26
network-metrics-daemon git 844fa588 sha256:5b0c3d11eb635e5cd767ee8d8875a8dd2440bef70fc8f8b590907ec082509753
network-tools git d6717e45 sha256:c104280d7af3a0f04784dd79820dfdaa2ec62270773c40b8b75883c1b4c6e25e
nutanix-cloud-controller-manager git 33b7bec6 sha256:15516b07973f5385e132e485e188d38b88a4a7849afec7272a4cc664f9038d5a
nutanix-machine-controllers git b15a665c sha256:7c946026731604397631c26c2da88dbb5925c14aae10dcf8378205ef60876b54
oauth-apiserver git 71c41b2d sha256:5a8d0da9a7966e8ab8e78666629c5ce5360d83ba01522628a5a33b93564c7968
oauth-proxy git 7f518c02 sha256:226ad38862b86cd05a686b3bf208058c6695af8879b1a1e854591ea8f82f5bc9
openshift-apiserver git 64dea074 sha256:3652dfabddf5ba8c179ce722452b614da6742b6e1cbd201d956a7faa7c303c8a
openshift-controller-manager git 438d52e7 sha256:4d4bca54cd1a13d86447ef7a1e31cccda52e73929905d787be7eb9ab127dc276
openshift-state-metrics git ab605a4b sha256:3d9762437f5f7247f0dc502a2569349218ec102cc4ce850265ae2e6bc3ef3cf8
openstack-resource-controller git 70f5ad34 sha256:04ffa5b7d6c2e53f6f01752d1933f9aac1918946546d8b82cdd4a57efbbee7b6
powervs-cloud-controller-manager git 969a04e9 sha256:42a2a7180e59596904ee6021f4cea29816aeb53a80dcbe4e4f6c897d352ae7d7
powervs-machine-controllers git 551974ef sha256:12a768b391a6d8e74f4269a0dc38e6e9b32eed70102890105989147de6aa1b25
prom-label-proxy git 610c11b5 sha256:1bdd73e09e5963d35446bd36b970a515bdd77c25dde05135af4da59417ac6e4c
prometheus-alertmanager git 3dbe0b64 sha256:e703320d7dc1864bf5bf8a56a80f16e40a1854955afaca0375ed3fac224883c2
prometheus-node-exporter git 39d72873 sha256:0a7e1fde6f39e9c3f3015cb12e4512a4018235eac347f9506e88dfa3d0a45c60
service-ca-operator git e9622ba1 sha256:423f66d9163e855ac9c975b399ad56d2c524711fe3e063c3301d98fb4284160f
volume-data-source-validator git 8b929332 sha256:38808191b42e57fc9a77e776f1d7e33ab130a73d500c5494b201e3f252d32239
vsphere-cloud-controller-manager git f69584d6 sha256:5fcbf3b2f0a4e8b45c883cdfb8f0bd40d6df8e2b6c77f0b124849e0c0d006a61
vsphere-problem-detector git a35d685a sha256:53044bc5800772175d491fd3f2455de1c87fd37f9221f4c6e851f9f14b87b1e0

agent-installer-api-server

OCPBUGS-81843: Mark raw FC/iSCSI multipath members as ineligible #10148
OCPBUGS-81843: Prefer multipath disk in ABI disk selection #10112
OCPBUGS-79580: Fix multi-document YAML parsing for NMStateConfig #10058
AGENT-1431: Backport feature NoRegistryClusterInstall to 4.21 #8806
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-81642: fix: allow workers to join TNA cluster when 1 master + arbiter are ready #2066
OCPBUGS-77536: Fix root partition before copying IRI registry data #2038
Full changelog

agent-installer-ui

OCPBUGS-85541: Bump msw pkg version to 2.13.5 (#3729) #3729
fix monted pull secret parsing (#3727) #3727
OCPBUGS-84235: add pull secret auto populate logic to ABI local UI (#3509) #3509
Allow to install SNO topology (#3722) #3722
OCPBUGS-85261: [release-4.21] OCPBUGS-84147 | [Below the sea UI] Leaky Abstraction: Transient 500 errors exposed during host binding process (#3684) #3684
Remove 2 node arbiter option from the control plane dropdown option (#3680) #3680
OCPBUGS-84608, OCPBUGS-84830, OCPBUGS-84993, OCPBUGS-85009, OCPBUGS-85039: Bump axios to ^1.15.1 (#3690) #3690
MGMT-24152: UI allows editing pull secret in draft cluster (#3674) #3674
Update OWNERS file (#3654) #3654
Bump happy-dom from 20.0.2 to 20.8.9 (#3525) #3525
fix operators list in ABI below the sea (#3599) #3599
OCPBUGS-81589: bump react-router-dom-v5-compat to ^6.30.3 to address CVE-2026-22029 (#3581) #3581
OCPBUGS-83303: bump axios to ^1.15.0 for fixing CVE-2026-40175 (#3583) #3583
OCPBUGS-81587: upgrade lodash and lodash-es to 4.17.23 to address CVE-2025-13465 (#3535) #3535
Add support for release branches in PR workflow (#3528) #3528
populate default values in local ui from infraEnv (#3503) #3503
Full changelog

agent-installer-utils

OCPBUGS-84120: Update OCP version for Konflux #301
OCPBUGS-85526: update konflux references #287
OCPBUGS-83852: Pass environment through to podman #292
OCPBUGS-82588: Update OCP version in Konflux #285
OCPBUGS-82539: Update Konflux references #265
OCPBUGS-81645: Update operator versions #282
OCPBUGS-78393: Update Konflux release version to 4.21.5 #270
OCPBUGS-78188: Add a flag to provide a custom appliance image #273
OCPBUGS-78144: Update to use the 4.21 Catalog #271
OCPBUGS-77538: (Backport) Override prefilled rendezvousIP #263
OCPBUGS-77302: Remove multiple redhat-operator-index catalogs #262
OCPBUGS-77236: Update quay.io/konflux-ci/konflux-vanguard/task-rpms-signature-scan:0.2 Docker digest to 2f3015a #222
OCPBUGS-77220: Update Konflux references #251
OCPBUGS-76590: Update Konflux files to build 4.21.1 #254
OCPBUGS-76411: Include additional operators in OVE config #253
AGENT-1431: Backport feature NoRegistryClusterInstall to 4.21 #248
Full changelog

aws-cloud-controller-manager

OCPCLOUD-3341: Updates ecr-credential-provider make target #134
Full changelog

aws-ebs-csi-driver

OCPBUGS-80734: Bump google.golang.org/grpc to v1.79.3 #310
Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator

OCPBUGS-85234: Mount writable /tmp in SMB CSI driver #551
OCPBUGS-80844: Bump google.golang.org/grpc to v1.79.3 #539
OCPBUGS-78779: Fix readonly root fs in Azure init containers #528
OCPBUGS-78155: Add only to tags to volume object, if volume is not already tagged #521
Full changelog

aws-kms-encryption-provider

OCPBUGS-80711: Bump google.golang.org/grpc to v1.79.3 #40
Full changelog

azure-cluster-api-controllers

OCPBUGS-80740: Bump google.golang.org/grpc to v1.79.3 #383
Full changelog

azure-disk-csi-driver

OCPBUGS-85285: check for node name in waitForDiskManagedByTobeRemoved #147
UPSTREAM: 3569: OCPBUGS-80741: Bump grpc to v1.79.3 #137
OCPBUGS-78012: 4.21 rebase v1.34.2 #126
Full changelog

azure-file-csi-driver

UPSTREAM: 3023: OCPBUGS-80744: Bump grpc to v1.79.3 #125
Full changelog

azure-kms-encryption-provider

OCPBUGS-80712: Bump google.golang.org/grpc to 1.64.1-sec.1 patch #34
Full changelog

azure-service-operator

OCPBUGS-80713: Bump google.golang.org/grpc to v1.79.3 #28
OCPBUGS-83864: UPSTREAM: <carry>: add openshift/e2e-tests.sh #24
Full changelog

baremetal-installer, installer, installer-artifacts

OCPBUGS-84225: ibmcloud: bump vpc-go-sdk and capibm #10514
OCPBUGS-82439: [release-4.21] Mount pullsecret manifest to UI container #10489
OCPBUGS-79074: [release 4.21] - Allow all instance types in the install config for GCP #10417
OCPBUGS-79378: Use correct Project ID with GCP Shared VPC #10423
OCPBUGS-79424: Do not discard NMStateConfig when agent-config is on disk for unconfigured-ignition #10428
OCPBUGS-79421: Fix race condition: wait for agent-register-infraenv before showing UI URL #10425
no-jira: fix SC2328 shellcheck errors #10424
OCPBUGS-77900: Add c8g* to tested_instance_types_aarch64 #10366
OCPBUGS-79375: Don’t auto-calculate RendezvousIP in unconfigured-ignition #10410
OCPBUGS-78696: [release-4.21] : Disable LoadBalancer in cloud config when Octavia is unavailable #10399
OCPBUGS-78241: Increase timeout for waiting control plane #10383
OCPBUGS-77504: fix wavelength zone name regex #10343
OCPBUGS-77551: Increase size of /var/ostreecontainer mount #10346
OCPBUGS-73878: handle SSH rule deletion for Azure private #10225
OCPBUGS-76358: [release-4.21] Fix destroy bootstrap command for Azure #10293
AGENT-1431: Backport feature NoRegistryClusterInstall to 4.21 #10250
Full changelog

baremetal-operator

OCPBUGS-82141: Fix PPI for ACM #476
OCPBUGS-65683: OCPBUGS-78835: PR2774 and PR2793 backports [release-4.21] #469
Bug OCPBUGS-76492: BMO fails to start servicing despite updates to HFC spec #459
Full changelog

baremetal-runtimecfg

OCPBUGS-77168: Install dbus-tools, needed in pkg/monitor/dnsmasqmonitor.go #383
Full changelog

cli, cli-artifacts, deployer, tools

MCO-1961: Allow multiple machine-os versions #2244
COS-4005: Allow periods in display name labels for version validation #2243
OCPBUGS-77486: Makefile: Strip debugging symbols by default #2211
OCPBUGS-77168: Install subscription-manager in required images #2208
Full changelog

cloud-credential-operator

OCPBUGS-79367: google.golang.org/grpc v1.79.3 #993
OCPBUGS-78199: Fix infrastructure resource name filtering in watch predicate #988
OCPBUGS-71222: test-ext: remove kubernetes module dependency #958
OCPBUGS-74545: Resolve nil pointer exception in hasResourceTags #969
Full changelog

cloud-network-config-controller

OCPBUGS-77154: Refrain from adding Egress IP to public LB backend pool #205
Full changelog

cluster-authentication-operator

OCPBUGS-81677: Do not return error when an IdP returns 500 during a grant check #868
OCPBUGS-74418: Bump library-go to get KMS #847
OCPBUGS-74418: carry test assertion #848
OCPBUGS-74418: Conditionally add the KMS plugin volume mount to the oauth-apiserver container #846
OCPBUGS-74418: Add KMS test scenarios #844
Full changelog

cluster-autoscaler

OCPBUGS-78684: allow clusterapi provider to skip paused resources #410
OCPBUGS-76296: Pick upstream commits to Fix VPA recommender concurrent access panic #404
Full changelog

cluster-baremetal-operator

OCPBUGS-78580: Allow ProvisioningCIDR for unmanaged network #576
OCPBUGS-77418: Fix ironic-proxy service routing for port 6385 #560
OCPBUGS-77035: Update kubebuilder tools to more latest version #558
OCPBUGS-74204: Fix libguestfs /tmp access in machine-os-downloader init container #551
Full changelog

cluster-capi-controllers

OCPBUGS-80749: Bump google.golang.org/grpc to v1.79.3 #293
Full changelog

cluster-capi-operator

NO-JIRA: Allow sustaining engineering to self serve dependency updates #554
OCPBUGS-80753: Bump google.golang.org/grpc to v1.79.3 #550
Full changelog

cluster-config-api

OCPBUGS-83756: fix(config/v1): define constants for authentication types as typed constants #2815
CNTRLPLANE-2796: promote the event-ttl feature #2809
OCPBUGS-82578: [release-4.21] postpone the removal of the DeploymentConfig API #2801
OCPBUGS-74418: Introduce KMSEncryption feature gate #2670
OCPBUGS-76408: Move DynamicConfigurationManager back to TPNU #2703
Full changelog

cluster-csi-snapshot-controller-operator

OCPBUGS-82971: Fix PDB unhealthyPodEvictionPolicy field name #272
Full changelog

cluster-etcd-operator

OCPBUGS-84336: fix(tnf): align Pacemaker kubelet and etcd retry pacing #1604
OCPBUGS-77921: Prefer to remove members where they have another healthy machine in the same failure domain index #1563
OCPBUGS-77097: Wait for revision stability before removing etcd members #1555
OCPBUGS-74489: configure inertia for all controllers, bump to 10m #1535
Full changelog

cluster-ingress-operator

OCPBUGS-82544: set trustBundleName in Istio global values #1418
OCPBUGS-77432, OCPBUGS-77433: Ensure canary cert matches the default ingress controller’s cert #1367
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-85563: [4.21] operator should not override authentication config serviceAccountIssuer with the default one during the operator initialization #2151
OCPBUGS-85270: fsync static pod cert and manifest writes for crash durability #2144
OCPBUGS-83855: Allow setting the oauthMetadata when auth type is None #2116
OCPBUGS-78548: [release-4.21] : Always set service-account-jwks-uri to LB URL even with custom issuer #2071
OCPBUGS-78784: [4.21] move event-ttl test to its own suite #2073
OCPBUGS-74418: Bump library-go to get KMS #2063
OCPBUGS-77969: Add support for event-ttl cases and go test cases in Kube API Server Operator #2066
OCPBUGS-74418: Carry test assertion #2064
OCPBUGS-74418: Conditionally add the KMS plugin volume mount to the kube-apiserver container #2061
OCPBUGS-74418: Add KMS test scenarios #2054
OCPBUGS-74181: SCC: allow image volume type for all SCCs #2007
Full changelog

cluster-kube-scheduler-operator

OCPBUGS-83737: add /var/run/kubernetes as emptyDir #641
CNTRLPLANE-2843: chore: update OWNERS #619
Full changelog

cluster-monitoring-operator

OCPBUGS-80765: bump 4.21 grpc to v1.79.3 #2875
OCPBUGS-74425: Include kube_pod_labels in minimal profile #2797
OCPBUGS-77908: [release-4.21] add app.kubernetes.io/part-of=openshift-monitoring label to thanos-ruler pod #2840
OCPBUGS-76541: Fix NodeRAIDDegraded & NodeRAIDDiskFailure alerts #2815
OCPBUGS-77271: AlertingRule: fix duplicate PrometheusRules after MD5->SHA-224 naming change #2829
Full changelog

cluster-network-operator

OCPBUGS-84169: Handle zero-worker HyperShift clusters in daemonset rollout [4.21 backport] #2972
OCPBUGS-83422: wait for patch port to apply drop garp flows #2946
OCPBUGS-76333: Silence ovnkube-lib.sh to avoid mass of logs to collectors #2900
OCPBUGS-77147: Add config override for openflow-probe #2917
OCPBUGS-76285: Remove duplicated openssl parameter #2899
Full changelog

cluster-node-tuning-operator

OCPBUGS-85016: e2e: Add irqbalance StartLimitBurst >= 100 config test #1505
OCPBUGS-81122: CNF-21333: [4.21]:perfprof: enable exec-cpu-affinity by default #1484
OCPBUGS-76375: AA: E2E: LLC: Add tests related to odd cpus #1467
OCPBUGS-77464: E2E: Add test case to check Infrastructure pods affinity #1476
OCPBUGS-78173: workloadhints: use IsVM to skip BM-only tests #1480
Full changelog

cluster-olm-operator

OCPBUGS-80769: Bump google.golang.org/grpc to v1.79.3 #197
OCPBUGS-76269: add resources to clusterOperator relatedObjects #170
OCPBUGS-81311: Fix golangci-lint timeout in CI #189
OCPBUGS-77826: cluster-olm-operator sets Progressing=True during upgrade #177
Full changelog

cluster-openshift-apiserver-operator

OCPBUGS-74418: Bump library-go to get KMS #666
OCPBUGS-74418: Conditionally add the KMS plugin volume mount to the openshift-apiserver container #664
OCPBUGS-74418: Add KMS test scenarios #656
Full changelog

cluster-storage-operator

OCPBUGS-79531: volume-data-source-validator should run on master nodes #687
OCPBUGS-74569: add vsphere permissions for checking if users is authorized to see metrics #660
Full changelog

cluster-version-operator

OCPBUGS-77256: Implement mTLS authentication and authorization for CVO metrics endpoint #1326
Full changelog

console

OCPBUGS-85520: Fix create visual connector in Topology #16439
NO-JIRA: enable multi-architecture yarn builds #16420
OCPBUGS-85040: Remove PII from events #16401
OCPBUGS-84967: Add bottom pagination to ConsoleDataView for mobile responsiveness #16396
OCPBUGS-84858: Fix ConsoleDataView filter order: Name and Label shoul… #16386
OCPBUGS-83494: remove dev to admin links as dev monitoring views are enabled #16164
OCPBUGS-83572: fix Developer Sandbox telemetry #16286
OCPBUGS-83418: Fix resource log dropdown TypeError #16281
OCPBUGS-81517: Follow up on fixing the remaining issues in the multi-group impersonation feature #16236
OCPBUGS-81714: Add missing i18n translations for Pagination component #16255
OCPBUGS-79351: Make folder field optional for vsphere #16189
OCPBUGS-79040: Fix incorrect OLMv1 documentation URL #16186
OCPBUGS-81308: Fix VolumeSnapshot and VolumeSnapshotContent tables sorting #16216
OCPBUGS-79037: Fix useOperatorCatalogCategories hook. #16185
OCPBUGS-81330: Fix entire app suspending to load perspective switcher icon #16226
OCPBUGS-81488: Add robots.txt policy to console #16227
OCPBUGS-80931: Hide filter category selector when only one filter exists #16199
OCPBUGS-77246: AsyncComponent type improvements #16058
OCPBUGS-79035: Fix TypeError in OLS code import to console #16184
OCPBUGS-78799: Fix search component to not pass ALL_NAMESPACES_KEY to… #16170
OCPBUGS-79533: enable keyboard shortcut for DataViewTextFilter #16195
OCPBUGS-78927, OCPBUGS-78928: OLM prompts for GCP Workload Identity parameters during Kiali Operato… #16176
OCPBUGS-78308: “Import from Git” should not force HTTPS/443 for Git providers (GitHub/GitLab/Bitbucket) #16050
OCPBUGS-78599: Migrate InstallPlan components table to PatternFly Table #16159
OCPBUGS-78599: Reset pagination page when changing namespace #16158
OCPBUGS-77029: Fixed Metrics page React error #306 by exporting QueryBrowser component #16038
OCPBUGS-77251: Fix editing secrets with mixed text and binary data #16060
OCPBUGS-77561: Fix ConsolePluginStatus icon #16090
OCPBUGS-75000: Clean up old session cookies to prevent accumulation #15985
OCPBUGS-77957: [CI] Fix the VolumeSnapshot CRUD flaky test failures #16118
OCPBUGS-77882: Fix infinite recursion in project access form #16112
OCPBUGS-65948: prep for 4.21 GA SDK publish #16116
OCPBUGS-76385: Workloads - Edit pod count and Edit parallelism : Content is in English #16005
OCPBUGS-76387: DataView Pagination page menus : i18n misses #16007
OCPBUGS-76386: i18n upload/download routine task - 4.21 / 281 (Latest) #16006
OCPBUGS-77430: run and enforce yarn dedupe #16075
CONSOLE-5011: migrate to yarn berry #16059
OCPBUGS-76389: Use Actions button instead of kebab menu on Subscription details page #16008
Full changelog

console-operator

OCPBUGS-82037: Redeploy console pods upon cert rotation #1139
OCPBUGS-78929: Remove orphaned console-conversion-webhook deployment and related resource #1128
Sync Dockerfile.ocp image #1126
OCPBUGS-72562: Add missing relatedObjects + small refactoring #1090
OCPBUGS-74686: Add rhel8 and rhel9 oc binaries for Linux OS in CLI downloads #1104
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

UPSTREAM-SYNC: Sync release-4.21 with upstream release-1.34 #371
Full changelog

csi-driver-nfs

OCPBUGS-80783: CVE-2026-33186: bump google.golang.org/grpc v1.79.3 #176
Full changelog

csi-external-attacher

OCPBUGS-80784: Bump google.golang.org/grpc to v1.79.3 #102
Full changelog

csi-external-provisioner

OCPBUGS-80785: Bump google.golang.org/grpc to v1.79.3 #132
Full changelog

docker-builder

OCPBUGS-70149: bump buildah to 1.39.7 to fix CVE-2025-52881 #495
Full changelog

driver-toolkit

OCPBUGS-78535: Support ubi minimal base image #186
OCPBUGS-77887: Clean up cruft in /var/cache/dnf #183
Full changelog

gcp-cloud-controller-manager

OCPBUGS-83615: Fix OSD ILB bug #108
Full changelog

gcp-cluster-api-controllers

OCPBUGS-80805: Bump google.golang.org/grpc to v1.79.3 #287
Full changelog

gcp-machine-controllers

OCPBUGS-80828: Bump gRPC-Go package for CVE fix #154
Full changelog

gcp-pd-csi-driver

OCPBUGS-80809: Bump google.golang.org/grpc to v1.79.3 in release-4.21 #104
OCPBUGS-77716: Support Downward API node name #101
Full changelog

gcp-pd-csi-driver-operator

OCPBUGS-77494: Pass node name to csi-driver container #173
OCPBUGS-77310: Add RBAC permission for node driver to get Node objects #171
Full changelog

haproxy-router

OCPBUGS-79374: Lower verbosity for parseIPList empty list logging #752
Full changelog

hyperkube, kube-proxy, pod

OCPBUGS-85500: Bump Kubernetes v1.34.8 to release-4.21 #2665
“OCPBUGS-83608: Bump to k8s v1.34.7” #2647
NO-JIRA: UPSTREAM: <carry>: Add jacobsee and jubittajohn to DOWNSTREAM_OWNERS #2636
OCPBUGS-78991: Bump 1.34.6 to release-4.21 #2634
OCPBUGS-77475: Bump v1.34.5 to release-4.21 #2601
OCPBUGS-76516: Bump v1.34.4 #2590
Full changelog

hypershift

OCPBUGS-85781: Add AWS ISO domains to konnectivity IsCloudAPI #8531
OCPBUGS-85621: fix CVE-2026-33186 by updating grpc-go #8518
OCPBUGS-83710: fix(kubevirt): filter link-local addresses from EndpointSlice endpoints #8270
OCPBUGS-85538: [release-4.21] Set unhealthyPodEvictionPolicy to AlwaysAllow on all PDBs #8214
OCPBUGS-85538: [release-4.21] CNTRLPLANE-2740: Add KAS liveness readiness sidecar to OAS and OAuth API Server #8213
OCPBUGS-76447: Add UserAgent telemetry to CPO Azure SDK clients #7685
OCPBUGS-81745: [release-4.21] Honor AWS AMI override in NodePool token generation #8170
OCPBUGS-81836: OCPBUGS-81670: fix(cpo-v2): preserve HCCO modifications to OCM Controllers field #8157
OCPBUGS-81490: fix(cpo): skip router LB services for ARO HCP #8135
OCPBUGS-77966: fix: global-pull-secret-syncer pod ~15-minute delay scheduling on new nodes #8129
OCPBUGS-81287: fix(release): allow multiple machine-os component versions #8103
OCPBUGS-81285: fix(releaseinfo): allow periods in version display name regex #8102
OCPBUGS-78933: fix(cpo): Don’t remove HCP Ingress from routes when CapabilityRoute is disabled #8014
CNTRLPLANE-3006: Azure web identity webhook 4.21 #7997
OCPBUGS-78957: fix(hostedcluster): Remove referenced resource annotations regardless of hcp status #7975
OCPBUGS-78473: Fix deadlock when changing release image during initial provisioning #7954
OCPBUGS-78484: fix(catalogs): update catalog image version cap to 4.21 #7956
OCPBUGS-77456: Add dynamic NodePort range validation #7820
OCPBUGS-77647: remove resource limits from Agent CAPI provider #7844
OCPBUGS-78304: Fix context cancel accumulation in getMirrorFromICSPOrIDMS #7891
OCPBUGS-78196: fix(sync-global-pullsecret): compare content ignoring trailing newlines #7914
CNTRLPLANE-2812: feat(aro): Swift support #7826
OCPBUGS-77365: Fix ignition-server pod restarts due to MIRRORED_RELEASE_IMAGE flapping #7834
OCPBUGS-75930: [release-4.21] fix(cpo): Correct route labeling logic for HCP router infrastructure #7641
OCPBUGS-75884: feat(updates): enable CVO metrics access with RHOBS monitoring flag #7632
fix: OCPBUGS-74104: Fix CVE-2025-58183 #7545
OCPBUGS-71133: fix(ingress): clear LoadBalancerSourceRanges when AllowedCIDRBlocks is removed #7433
OCPBUGS-74893: fix: add hypershift.openshift.io/nodepool-globalps-enabled label to be ignored in cluster-autoscaler deployment #7618
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-80815: Bump google.golang.org/grpc to v1.79.3 #146
OCPBUGS-77203: [release-4.21] standardize build paths #121
Full changelog

ibmcloud-machine-controllers

OCPBUGS-77445: [release-4.21] bump vpc go sdk #81
NO-JIRA: Modernize test infrastructure to align with other MAPI providers #84
Full changelog

insights-operator

OCPBUGS-80818: Bump google.golang.org/grpc to v1.79.3 #1285
OCPBUGS-81573: kubeletconfig gatherer #1266
OCPBUGS-79534: [release-4.21] Add OpenTelemetry CR Gatherer #1258
OCPBUGS-76960: Extends the time for the extractor liveness probe #1233
Full changelog

insights-runtime-exporter, insights-runtime-extractor

Updating ose-insights-runtime-extractor-container image to be consistent with ART for 4.21 #78
Updating ose-insights-runtime-exporter-container image to be consistent with ART for 4.21 #77
Updating ose-insights-runtime-exporter-container image to be consistent with ART for 4.21 #75
Updating ose-insights-runtime-exporter-container image to be consistent with ART for 4.21 #71
Updating ose-insights-runtime-extractor-container image to be consistent with ART for 4.21 #72
Revert “Bump Go to 1.25” #73
Bump Go to 1.25 #70
OCPBUGS-77491: remove dnf cache from the container images #64
Fix EAP 8.1 e2e test #65
Full changelog

ironic

OCPBUGS-84853: Bump pyasn to 0.5.1-5 #823
OCPBUGS-82298: Bump sushy hash to include Supermicro ARS-111GL-NHR fix #840
ART-14497: Fix ART builds with -minimal #809
OCPBUGS-76934: Bump keystonemiddleware version to 10.9.0-0.20260216145500.557d173 for CVE-2026-22797 fix #791
OCPBUGS-76474: Update requirements.cachito for 4.21 with heartbeat inspection fix commit #785
OCPBUGS-76282: Update ironic hash #780
OCPBUGS-74603: fix for minimal builds #774
Full changelog

ironic-agent

OCPBUGS-74603: fixes for minimal builds #241
Full changelog

ironic-machine-os-downloader

OCPBUGS-74204: Export TMPDIR to be available to child processes #112
Full changelog

keepalived-ipfailover

OCPBUGS-78048: openshift-enterprise-base: remove subscription-manager, dbus, systemd #226
Full changelog

kube-metrics-server

OCPBUGS-80716: Bump google.golang.org/grpc to v1.79.3 #61
Full changelog

kube-state-metrics

OCPBUGS-80823: Bump google.golang.org/grpc to v1.79.3 #138
Full changelog

kubevirt-cloud-controller-manager

OCPBUGS-76994: [release-4.21] Sync Upstream 2026-01-27 #61
Full changelog

kubevirt-csi-driver

OCPBUGS-79038: Add annotation-based fallback for infra VM node ID resolution #83
Full changelog

machine-api-operator

OCPBUGS-77943: Remove cluster-api-provider-libvirt references #1473
Full changelog

machine-config-operator

OCPBUGS-86037: use --delete-if-present for karg removal #6058
OCPBUGS-85645: Add terminationMessagePolicy to build pod containers #6045
OCPBUGS-85386: Fix CVE-2026-34986 #6025
OCPBUGS-85286: Fix Admin Ack message for azure/vsphere clusters upgrading to 4.22 #6017
OCPBUGS-85126: Fix units rollback if update failure #6008
OCPBUGS-84941: Fix ssh and password rollbacks #5987
OCPBUGS-84970: Fix encapsulated IGN version #5996
OCPBUGS-84878: Update AMI Whitelist #5915
OCPBUGS-84253: improve JSON unmarshalling for secret decoding #5877
OCPBUGS-83874: Allow enablement of systemd units with existing files #5869
OCPBUGS-83708: Update AMI Whitelist #5857
OCPBUGS-83390: Use HA leader election defaults for MCO on SNO #5838
OCPBUGS-81711: When adding new nodes, MCD executes commands after setting the nodes’ state as Done #5836
OCPBUGS-79482: Skip boot image updates until cluster is stable #5804
OCPBUGS-79426: Update AMI Whitelist #5798
OCPBUGS-79372: set default-timeout-stop to 200s globally #5793
OCPBUGS-78800: Re-order logger setting to eliminate race condition #5779
OCPBUGS-78528: Fix e2e iri tests #5759
OCPBUGS-78201: kubelet: Less aggressive low memory reservation #5756
OCPBUGS-77833: Update AMI Whitelist #5743
OCPBUGS-77689: Create admin-ack gates for azure/vsphere clusters upgrading to 4.22 #5735
OCPBUGS-77577: Fix failure domain matching during vsphere boot image updates #5727
OCPBUGS-77534: Update AMI Whitelist #5722
OCPBUGS-77354: Clean up vsphere login error logging #5705
OCPBUGS-76555: Remove MCD liveness probe #5651
OCPBUGS-77072: mcd_config_drift not working properly #5675
OCPBUGS-76823: reduce MCO image size #5657
OCPBUGS-76833: Machine-config controller should not log about non-existent pull-secret changes #5659
OCPBUGS-73805: Prevent unnecessary systemd unit disable #5648
MCO-2017: Backport OSImageStreams to 4.21 #5515
OCPBUGS-76356: crio: disable short_name_mode until we introduce ctrcfg api for it #5636
OCPBUGS-76359: Update AMI script and list #5639
OCPBUGS-76271: machine-config-daemon: openshift: Exposure of Sensitive Data in Log Files in the Machine Configuration Daemon. [openshift-4] #5624
AGENT-1431: Backport InternalReleaseImage support #5610
OCPBUGS-74145: enable nodeip-configuration for platform external #5581
Full changelog

machine-image-customization-controller

OCPBUGS-78536: Return error when network data Secret lacks nmstate key #171
OCPBUGS-77031: Add IPA messages for console and SSH login #163
OCPBUGS-77490: Clean up dnf cache to reduce container image size #164
Full changelog

machine-os-images

OCPBUGS-85478: Force rebuild for OCP 4.21 #89
Full changelog

monitoring-plugin

OCPBUGS-79460: immutable bump: fix for CVE-2026-29063 [4.21] #947
OU-1368: reset queries when namespace changes in dev perspective #940
OU-1367: prevent namespace and project desync #937
NO-JIRA: release-4.21 e2e-monitoring and e2e-coo working #904
OCPBUGS-83494: [release-4.21] feat: re enable dev console views #856
OCPBUGS-83304: [release-4.21] openshift4/ose-monitoring-plugin-rhel9: Axios: Remote Code Execution via Prototype Pollution escalation #890
OCPBUGS-82302: [release-4.21] fix: re encode params when redirecting from graph to query-browser #871
OCPBUGS-78358: fix for CVE-2025-69873 #845
NO-JIRA: [release-4.21] e2e-monitoring fixing loop on legacy dashboard #828
OCPBUGS-77227: [openshift-4.21] CVE-2026-25639 openshift4/ose-monitoring-plugin-rhel9:Axios affected by Denial of Service via proto Key in mergeConfig #795
OU-1062: [release-4.21] feat: mark alert menu active for incidents tab #761
NO-JIRA: [release-4.21] simplify frontend build in Dockerfile.art #808
OCPBUGS-74909: fix: update vulnerable dependencies #751
Full changelog

multus-cni, multus-cni-microshift

OCPBUGS-82064: Bump CNI version to 1.1.0 #284
Full changelog

multus-networkpolicy

OCPBUGS-77489: Clean up dnf cache #100
Full changelog

must-gather

OCPBUGS-85050: Collect object size with the object count #542
Full changelog

networking-console-plugin

OCPBUGS-81620: Update lodash to 4.18.1 for CVE-2026-4800 #372
OCPBUGS-83388: Fix CVE-2026-34043 in serialize-javascript #369
OCPBUGS-82161: Migrate to npm #359
OCPBUGS-66283, OCPBUGS-67252, OCPBUGS-70285, OCPBUGS-74473: Fix CVEs via upgrading yarn.lock #346
CNV-59877: Fix permissions request for NADs #353
OCPBUGS-77887: Clean up cruft in /var/cache/dnf #361
OCPBUGS-77225: Fix NAD creation using default namespace instead of selected one #349
Full changelog

oauth-server

OCPBUGS-77454: groupmapper: avoid mutating original group users slice when removing user #213
Full changelog

oc-mirror

OCPBUGS-82546: Only print catalog rebuild message if there are catalogs to rebuild #1388
OCPBUGS-82543: Fix printing collection messages with 0 collection items #1387
OCPBUGS-81743: Remove status field from CatalogSource, ClusterCatalog… #1383
CLID-549, OCPBUGS-78458: Update Dockerfile.tests to run Go integration tests #1371
OCPBUGS-77222: Fix registriesd “unknown userid” failure for arbitrary UIDs #1358
OCPBUGS-76126: Fix reg config detection for explicit false values #1349
OCPBUGS-74981: fix conversion issue for catalog #1346
Full changelog

olm-catalogd, olm-operator-controller

OCPBUGS-81993, OCPBUGS-81994: Bump github.com/go-jose/go-jose/v4 to 4.1.4 #718
OCPBUGS-80839, OCPBUGS-80840: Bump google.golang.org/grpc to v1.79.3 #721
OCPBUGS-79059: update OCP-75441 to support multi-arch[release-4.21] #671
Full changelog

openstack-cluster-api-controllers

UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.13 into release-4.21 #394
Full changelog

openstack-machine-api-provider

OCPBUGS-76789: Fix make test #156
OCPBUGS-69644: Don’t record event for every reconcile #146
Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

OCPBUGS-81995, OCPBUGS-81996, OCPBUGS-81997: Bump github.com/go-jose/go-jose/v4 to v4.1.4 #1294
OCPBUGS-80847, OCPBUGS-80848, OCPBUGS-80849: Bump google.golang.org/grpc to v1.79.3 for CVE-2026-33186[Release-4.21] #1289
OCPBUGS-79398: Fix SA restore resourceVersion conflict error #1266
OCPBUGS-79400: Fix nil pointer dereference in sortUnpackJobs when sorting non-failed jobs #1265
OCPBUGS-79380: enhance case to make it pass per test bundle change #1263
OCPBUGS-78558: Re-Apply Fix admin context race condition in parallel tests #1261
OCPBUGS-77712: Update NetworkPolicy egress to support HyperShift custom API ports #1246
OCPBUGS-77067: Remove the collect-profiles info from the microshift kustomization file #1234
OCPBUGS-76325: [release-4.21]remove qe case of testing collect-profiles #1222
OCPBUGS-76266: Remove the collect-profiles job #1220
Full changelog

operator-marketplace

OCPBUGS-77580: Update NetworkPolicy egress to support HyperShift custom API ports #729
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-84923: Branch Sync release-4.22 to release-4.21 [04-27-2026] #3160
OCPBUGS-81634, OCPBUGS-83814: Branch Sync release-4.22 to release-4.21 [04-16-2026] #3145
OCPBUGS-83566: Branch Sync release-4.22 to release-4.21 [03-25-2026] #3087
OCPBUGS-81475: node: fix serviceUpdateNotNeeded nil pointer comparison #3098
OCPBUGS-77257, OCPBUGS-78094: Branch Sync release-4.22 to release-4.21 [03-23-2026] #3080
OCPBUGS-78771: Branch Sync release-4.22 to release-4.21 [03-11-2026] #3050
OCPBUGS-76472: OCPBUGS-72532: Branch Sync release-4.22 to release-4.21 [12-19-2025] #3022
OCPBUGS-77147: Minimize ACLs by combining ipBlocks into single ACL #2995
OCPBUGS-77309: Clear stale conntrack UDP entries for nodePorts #3002
OCPBUGS-77046, OCPBUGS-77086: [release-4.21] combined backport PR for 2 escalations #2984
Full changelog

powervs-block-csi-driver

OCPBUGS-80852: Fix CVE-2026-33186 by bumping google.golang.org/grpc to 1.79.3 #127
OCPBUGS-82924: Fix CVE-2026-35469 by bumping github.com/moby/spdystream to v0.5.1 #121
Full changelog

powervs-block-csi-driver-operator

Updating ose-powervs-block-csi-driver-operator-container image to be consistent with ART for 4.21 #107
OCPBUGS-80853: Fix CVE-2026-33186 by bumping google.golang.org/grpc to v1.79.3 #106
Full changelog

prometheus

OCPBUGS-80855: Bump google.golang.org/grpc to v1.79.3 #309
OCPBUGS-78581: [release-4.21] chore(kubernetes): deduplicate warning logs from the API #298
Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

OCPBUGS-77295: backport upstream fix to reconcile resources with inconsistent status #365
OCPBUGS-74477: Validate webhookURL secret for MSTeams receiver in AlertmanagerConfig CRD #359
Full changelog

rhel-coreos, rhel-coreos-10, rhel-coreos-10-extensions, rhel-coreos-extensions

OCPBUGS-82523: post-process: Remove workaround for openvswitch additional group #1926
- [release-4.21] extensions: Add rhel-9.6-server-ose-4.21 #1914
NO-JIRA: [release-4.21] extensions: Fix repo name to match 4.21 #1913
COS-3946: Backport rhel-10.2 support to release-4.21 branch #1898
NO-JIRA: rhaos-pkgs-match-openshift: exclude known package mismatches #1889
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

route-controller-manager

OCPBUGS-76641: filter ingress namespace on UnmanagedRoutes metric #73
Full changelog

telemeter

OCPBUGS-80868: Bump google.golang.org/grpc to v1.79.3 #589
OCPBUGS-81817: [release-1.21] Fix CVE-2026-34986 #593
Full changelog

tests

OCPQE-32041: bump(k8s): move docker types into container package #31169
OCPBUGS-74373: Remove restriction of unmanaged x-k8s.io #30718
OCPBUGS-84655: fix openshift/network/third-party suite selecting zero tests #31091
OCPBUGS-84978: Skip image-registry operator tests for Libvirt platform in upgrade jobs. #31123
OCPBUGS-84947: test: add monitortest to detect pods stuck in Pending state #31117
OCPBUGS-84947: Add [Late] test to collect CRI-O goroutine dumps via SIGUSR1 #31118
OCPBUGS-81638: Manual cherry-pick node swap feature testcases to 4.21 #30973
OCPBUGS-82064: Assert CNI version greater than equal to 1.0.0 #30977
OCPBUGS-81638: Add openshift/disruptive-longrunning testsuite in release-4.21 branch #30976
OCPBUGS-78780: changed http to https for three places to reduce test false positives and false negatives #30902
OCPBUGS-79365: Verify etc pod should start with oom_score_adj as system-node-critical #30916
OCPBUGS-78485: run resource request/limit check early #30879
OCPBUGS-78192: Exclude disruption during NoExecuteTaintManager serial tests #30857
OCPBUGS-78064: Update optimized builds test to use rpm -qa instead of dnf #30856
OCPBUGS-78064: Allow test to tolerate running on minimal images #30852
OCPBUGS-77823: add the missing namespace from managed openshift #30838
OCPBUGS-77826: Remove exception for monitoring OLM Progression condition #30839
OCPBUGS-77097: Add test for CPMS OnDelete strategy with full master replacement #30802
: OCPBUGS-76856:cert tests: mark TLS registry test as informing #30779
OCPBUGS-76529: Fix flakiness in MutableCSINodeAllocatableCount test #30772
OCPBUGS-76955: co/kube-storage-version-migrator reports Available=False in a non-upgrade job #30740
Full changelog

thanos

OCPBUGS-84492: Revert “OCPBUGS-80870: CVE-2026-33186 openshift4/ose-thanos-rhel9: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation [openshift-4.21]” #180
OCPBUGS-80870: CVE-2026-33186 openshift4/ose-thanos-rhel9: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation [openshift-4.21] #174
Full changelog

vsphere-cluster-api-controllers

OCPBUGS-80875: Bump google.golang.org/grpc to v1.79.3 #102
Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

OCPBUGS-80878: Bump google.golang.org/grpc to 1.79.3 #171
Full changelog

vsphere-csi-driver-operator

OCPBUGS-74701: Fix update of stable-generation annotation #330
Full changelog

Node Image Info

Loading node image info, this may take a while ...

Unable to show node image info: too many concurrent oc adm release info --rpmdb/--rpmdb-diff operations (limit 16)

View changelog in Markdown or change previous release:

Source code for this page located on github