5.0.0-0.nightly-2026-05-27-134409

Download the installer for your operating system or run

oc adm release extract --tools registry.ci.openshift.org/ocp/release-5:5.0.0-0.nightly-2026-05-27-134409

Team Approvals:

Tests:

Blocking jobs
- aggregated-aws-ovn-single-node-upgrade-5.0-micro Succeeded periodic-ci-openshift-release-main-ci-5.0-e2e-aws-upgrade-ovn-single-node
- aggregated-aws-ovn-upgrade-5.0-micro-fips Succeeded periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-upgrade-fips
- aggregated-azure-ovn-upgrade-5.0-micro Succeeded periodic-ci-openshift-release-main-ci-5.0-e2e-azure-ovn-upgrade
- aggregated-gcp-ovn-rt-upgrade-5.0-major Succeeded periodic-ci-openshift-release-main-ci-5.0-upgrade-from-stable-4.22-e2e-gcp-ovn-rt-upgrade
- aggregated-hypershift-ovn-conformance-5.0 Succeeded periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-aws-ovn-conformance
- aws-ovn-serial-1of2 Succeeded periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-serial-1of2
- aws-ovn-serial-2of2 Succeeded periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-serial-2of2
- aws-ovn-techpreview Succeeded periodic-ci-openshift-release-main-ci-5.0-e2e-aws-ovn-techpreview
- aws-ovn-techpreview-serial-1of3 Succeeded periodic-ci-openshift-release-main-ci-5.0-e2e-aws-ovn-techpreview-serial-1of3
- aws-ovn-techpreview-serial-2of3 Succeeded periodic-ci-openshift-release-main-ci-5.0-e2e-aws-ovn-techpreview-serial-2of3
- aws-ovn-techpreview-serial-3of3 Succeeded periodic-ci-openshift-release-main-ci-5.0-e2e-aws-ovn-techpreview-serial-3of3
- fips-scan Succeeded periodic-ci-openshift-release-main-nightly-5.0-fips-payload-scan
- install-analysis-all Succeeded periodic-ci-openshift-release-main-nightly-5.0-install-analysis-all
- metal-ipi-ovn-ipv4 Succeeded periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-ovn-ipv4
- metal-ipi-ovn-ipv6 Succeeded (1 retry) periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-ovn-ipv6
  - Attempt 1 Failed
  - Attempt 2 Succeeded
- overall-analysis-all Succeeded (1 retry) periodic-ci-openshift-release-main-nightly-5.0-overall-analysis-all
  - Attempt 1 Failed
  - Attempt 2 Succeeded
Informing jobs
- aggregated-hypershift-aks-conformance-5.0 Succeeded periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-azure-aks-ovn-conformance
- aws-console Failed periodic-ci-openshift-release-main-nightly-5.0-console-aws
- aws-control-plane-machine-set-operator Succeeded periodic-ci-openshift-cluster-control-plane-machine-set-operator-release-5.0-periodics-e2e-aws
- aws-csi Succeeded periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-csi
- aws-ovn Succeeded periodic-ci-openshift-release-main-ci-5.0-e2e-aws-ovn
- aws-ovn-cgroupsv2 Failed periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-cgroupsv2
- aws-ovn-fips Failed periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-fips
- aws-ovn-single-node Failed periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-single-node
- aws-ovn-single-node-csi Succeeded periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-single-node-csi
- aws-ovn-single-node-serial Failed periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-single-node-serial
- aws-ovn-single-node-techpreview Succeeded periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-single-node-techpreview
- aws-ovn-single-node-techpreview-serial Failed periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-single-node-techpreview-serial
- aws-ovn-single-node-upgrade-major Failed periodic-ci-openshift-release-main-nightly-5.0-upgrade-from-stable-4.22-e2e-aws-upgrade-ovn-single-node
- aws-ovn-upgrade-5.0-micro-fips-no-nat-instance Failed periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-upgrade-fips-no-nat-instance
- aws-ovn-upgrade-out-of-change Succeeded periodic-ci-openshift-release-main-ci-5.0-e2e-aws-ovn-upgrade-out-of-change
- aws-upi Succeeded periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-upi
- azure-control-plane-machine-set-operator Succeeded periodic-ci-openshift-cluster-control-plane-machine-set-operator-release-5.0-periodics-e2e-azure
- azure-csi Succeeded periodic-ci-openshift-release-main-nightly-5.0-e2e-azure-csi
- azure-ovn Failed periodic-ci-openshift-release-main-ci-5.0-e2e-azure-ovn
- azure-ovn-serial Succeeded periodic-ci-openshift-release-main-ci-5.0-e2e-azure-ovn-serial
- azure-ovn-techpreview Failed periodic-ci-openshift-release-main-ci-5.0-e2e-azure-ovn-techpreview
- azure-ovn-techpreview-serial-1of2 Succeeded periodic-ci-openshift-release-main-ci-5.0-e2e-azure-ovn-techpreview-serial-1of2
- azure-ovn-techpreview-serial-2of2 Succeeded periodic-ci-openshift-release-main-ci-5.0-e2e-azure-ovn-techpreview-serial-2of2
- azure-ovn-upgrade-out-of-change Failed periodic-ci-openshift-release-main-ci-5.0-e2e-azure-ovn-upgrade-out-of-change
- cnv Failed periodic-ci-openshift-release-main-cnv-nightly-5.0-deploy-azure-kubevirt-ovn
- driver-toolkit Failed (2 retries) periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-driver-toolkit
- gcp-control-plane-machine-set-operator Succeeded periodic-ci-openshift-cluster-control-plane-machine-set-operator-release-5.0-periodics-e2e-gcp
- gcp-ovn Succeeded periodic-ci-openshift-release-main-ci-5.0-e2e-gcp-ovn
- gcp-ovn-csi Succeeded periodic-ci-openshift-release-main-nightly-5.0-e2e-gcp-ovn-csi
- gcp-ovn-rt Failed periodic-ci-openshift-release-main-nightly-5.0-e2e-gcp-ovn-rt
- gcp-ovn-serial Succeeded periodic-ci-openshift-release-main-nightly-5.0-e2e-gcp-ovn-serial
- gcp-ovn-techpreview Failed periodic-ci-openshift-release-main-ci-5.0-e2e-gcp-ovn-techpreview
- gcp-ovn-techpreview-serial-1of2 Succeeded periodic-ci-openshift-release-main-ci-5.0-e2e-gcp-ovn-techpreview-serial-1of2
- gcp-ovn-techpreview-serial-2of2 Succeeded periodic-ci-openshift-release-main-ci-5.0-e2e-gcp-ovn-techpreview-serial-2of2
- gcp-ovn-upgrade-5.0-major Failed periodic-ci-openshift-release-main-ci-5.0-upgrade-from-stable-4.22-e2e-gcp-ovn-upgrade
- gcp-ovn-upgrade-micro Succeeded periodic-ci-openshift-release-main-ci-5.0-e2e-gcp-ovn-upgrade
- hypershift-kubevirt-ovn-conformance-5.0 Failed periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-azure-kubevirt-ovn
- metal-ipi-ovn-dualstack Succeeded periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-ovn-dualstack
- metal-ipi-ovn-dualstack-techpreview Succeeded periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-ovn-dualstack-techpreview
- metal-ipi-ovn-ipv6-techpreview Failed periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-ovn-ipv6-techpreview
- metal-ipi-ovn-serial Failed periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-ovn-serial-ipv4
- metal-ipi-ovn-serial-virtualmedia-1of2 Succeeded periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-ovn-serial-virtualmedia-1of2
- metal-ipi-ovn-serial-virtualmedia-2of2 Failed periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-ovn-serial-virtualmedia-2of2
- metal-ipi-ovn-techpreview Succeeded periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-ovn-techpreview
- metal-ipi-ovn-upgrade Succeeded periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-ovn-upgrade
- metal-ipi-ovn-upgrade-major Succeeded periodic-ci-openshift-release-main-nightly-5.0-upgrade-from-stable-4.22-e2e-metal-ipi-ovn-upgrade
- metal-ipi-serial-ipv6 Failed periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-serial-ovn-ipv6
- metal-ipi-serial-ovn-dualstack Failed periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-serial-ovn-dualstack
- metal-ipi-upgrade-ovn-ipv6 Succeeded periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-upgrade-ovn-ipv6
- metal-ipi-upgrade-ovn-ipv6-major Failed periodic-ci-openshift-release-main-nightly-5.0-upgrade-from-stable-4.22-e2e-metal-ipi-upgrade-ovn-ipv6
- metal-ovn-single-node-recert-cluster-rename Failed periodic-ci-openshift-release-main-nightly-5.0-metal-ovn-single-node-recert-cluster-rename
- microshift-ovn-conformance-parallel Succeeded periodic-ci-openshift-microshift-release-5.0-periodics-e2e-aws-ovn-ocp-conformance
- microshift-ovn-conformance-serial Succeeded periodic-ci-openshift-microshift-release-5.0-periodics-e2e-aws-ovn-ocp-conformance-serial
- openshift-dedicated-gcp-conformance Failed periodic-ci-openshift-release-main-nightly-5.0-e2e-osd-ccs-gcp
- ovn-proxy Succeeded periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-proxy
- ovn-single-node-live-iso Succeeded periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ovn-single-node-live-iso
- qe-perfscale Failed periodic-ci-openshift-eng-ocp-qe-perfscale-ci-main-aws-5.0-nightly-x86-payload-control-plane-6nodes
- telco5g Failed periodic-ci-openshift-release-main-nightly-5.0-e2e-telco5g
- telcov10n-metal-single-node-spoke Failed periodic-ci-openshift-kni-eco-ci-cd-main-nightly-5.0-telcov10n-metal-single-node-spoke
- telcov10n-metal-single-node-spoke-kpis Failed periodic-ci-openshift-kni-eco-ci-cd-main-nightly-5.0-telcov10n-metal-single-node-spoke-kpis
- upgrade-analysis-all Failed (2 retries) periodic-ci-openshift-release-main-nightly-5.0-upgrade-analysis-all
- vsphere-ovn Failed periodic-ci-openshift-release-main-nightly-5.0-e2e-vsphere-ovn
- vsphere-ovn-csi Failed periodic-ci-openshift-release-main-nightly-5.0-e2e-vsphere-ovn-csi
- vsphere-ovn-serial Failed periodic-ci-openshift-release-main-nightly-5.0-e2e-vsphere-ovn-serial
- vsphere-ovn-techpreview Failed periodic-ci-openshift-release-main-nightly-5.0-e2e-vsphere-ovn-techpreview
- vsphere-ovn-techpreview-serial Failed periodic-ci-openshift-release-main-nightly-5.0-e2e-vsphere-ovn-techpreview-serial
- vsphere-ovn-upgrade-major Succeeded periodic-ci-openshift-release-main-ci-5.0-upgrade-from-stable-4.22-e2e-vsphere-ovn-upgrade
- vsphere-ovn-upgrade-micro Failed periodic-ci-openshift-release-main-ci-5.0-e2e-vsphere-ovn-upgrade
- vsphere-ovn-upi Succeeded periodic-ci-openshift-release-main-nightly-5.0-e2e-vsphere-ovn-upi
- vsphere-ovn-upi-serial Failed periodic-ci-openshift-release-main-nightly-5.0-e2e-vsphere-ovn-upi-serial
- vsphere-static-ovn Failed periodic-ci-openshift-release-main-nightly-5.0-e2e-vsphere-static-ovn
Async jobs
- claude-payload-agent Succeeded periodic-ci-openshift-release-main-claude-payload-agent

Upgrades from:

5.0.0-0.nightly-2026-05-27-055607 (changes) - S S S S F S F F S S
4.22.0-0.nightly-2026-05-27-041427 - S F S F S F

Upgrades to:

5.0.0-0.nightly-2026-05-27-205543 (changes) - S S S S F F F S S S

Loading changelog, this may take a while ...

Changes from 4.22.0-0.nightly-2026-05-27-041427

Created: 2026-05-27 13:47:17 +0000 UTC

Image Digest: sha256:b1e921edec4e9ef8765ab2404b1ee29a52fa8406139cb3e7ae93868994661d76

Components

Kubectl 1.35.2
Kubernetes upgraded from 1.35.5 to 1.35.3
Kubernetes Tests 1.35.1
Red Hat Enterprise Linux CoreOS 10.2.20260521-0

The CoreOS links above are for the base CoreOS layer used to build the OpenShift node image and do not contain OpenShift components. This is normally only useful to devs working closely with the CoreOS team. For info about the node image, see the Node Image Info section.

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	OKD Hypershift	OKD SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
ConsolePluginContentSecurityPolicy (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
DRAPartitionableDevices (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
KMSEncryptionProvider (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
RouteExternalCertificate (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
UserNamespacesPodSecurityStandards (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
UserNamespacesSupport (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
MutatingAdmissionPolicy (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled
OpenShiftPodSecurityAdmission (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled
NetworkObservabilityInstall (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
OLMLifecycleAndCompatibility (0 tests)				Enabled (New)				Enabled (New)

Rebuilt images without code change

aws-karpenter-provider-aws git f0be9c72 sha256:87988c03ccdd9a327e10089edd2a2e2c895094293cc423b500a7793de39f32ac
aws-pod-identity-webhook git 82088287 sha256:96a53600b3427a4a1c1b7094aa5a79b69cd302e0b147ff955ff65434e0753c7c
baremetal-machine-controllers git 8d863b95 sha256:daae883ab3315b229d4de2841c31ccd460fdc78d1d08f5fd23e90eb6dddda1cb
cloud-network-config-controller git 2d69ad95 sha256:406bd5563c03aef3633d6a54d8375031dd16622eaf741cb9e2c7f12c5810c049
cluster-csi-snapshot-controller-operator git 108f37f0 sha256:97e1612adc49055f95b8f9b03c5dc189b1735be358f2b61d5f3d342ab01f5a04
cluster-dns-operator git 3d214118 sha256:e1be5144f006b1ce750ea2041ff87e08ff52e7ff14746c3c7b06cc9f1c8d59bc
cluster-storage-operator git 8dfdf2ef sha256:cdc3ff0bb1d17d7cdb373e66a2517ed2e54898cbdf23c367876a694ce6922a62
cluster-update-keys git 3b5c59cc sha256:f5376167220d9a25a15b0b4dbd721200da001800a54bcfc5571ca677682627a0
configmap-reloader git 94e41c4c sha256:cba30d37335366a7cb095c87798bbfeac555e2d789404fbeda7a3f744f4641df
container-networking-plugins git 747ad66c sha256:be1bcd93c6f09103f977fbda73c0843e3b4595e2d1e74212faacb4dd691fc201
containernetworking-plugins-microshift git 747ad66c sha256:bfe2abfc336ee1f26782da9ffafb878289292d7a1150b3e0cec6e13cca961aac
csi-external-resizer git 4e74a4aa sha256:525f81bc2a524fd6714019e870e20c149c3d9d29e93d5d89e447cfaad0ba84de
csi-external-snapshot-metadata git 76523185 sha256:67398dd723cf6999e98727bdbc79469414cbed46e31d2c778c279dbe65bffcd4
csi-livenessprobe git 4d5e959a sha256:5c4256caf3177290c24f8cc07d2a3093bf53461fbc8826201ebbdb896ed413d7
csi-node-driver-registrar git cf174b30 sha256:e6527e9bee2dc9ab104c86fca575ee3f2042a3f16122e04ce88db981cd2733cf
driver-toolkit git 7aa4007a sha256:68d508e5a39713a18a62cf413c48ee65f5a67d21e19a94942be515360d9581e6
gcp-workload-identity-federation-webhook git d7675f31 sha256:fb9d11bc5a21404e3523a51de43ec5be280641c0e2d39262e277810072c9dd80
ibm-vpc-block-csi-driver-operator git f859eac9 sha256:8241017b70e478bb66a1086bac3437e3a1b7c8404eeea67f4403d699000bd94c
insights-runtime-exporter git 70256457 sha256:3e7d278a67e50a30c1f608651133e4566cc70e34c77fe7c6215c4bf85f0e2313
insights-runtime-extractor git 70256457 sha256:f662765837b3b967dd5b7e249be5bec831b2fe776901dae264a9236d94c1f9ea
ironic-machine-os-downloader git 9953d2b7 sha256:ca63c425055f424ffc5fc21eaf3a5fb708c9f0732485f3b9e195c52d3bbe94a9
ironic-static-ip-manager git a379d09f sha256:d65ccb7f24f65250ba87ce7c031d4d2dfa928155696da1404d29d285d0ebf773
kube-metrics-server git 38c16c46 sha256:e67c61a58fdb77f9b2952c60e8a7e4c9b694e0c8383692b69183162ec1fead15
kube-rbac-proxy git d12e2746 sha256:021ef755badbca515d58b612e314b021ef2f50312811c9721b1f4c5f2c6b8529
kube-state-metrics git 6fa06eac sha256:4adc3e51d3c322faad6b5f6b6f72f00c5a41db49e89da110d45401f6fcc745c9
kube-storage-version-migrator git 72835e43 sha256:5adb01a603d8c45bdbf2a9d398ec3d812389c08053393c50645d8f62c95092ef
kubevirt-cloud-controller-manager git 76dd5a6f sha256:e3d4c174879699cda91a2b652b9e950e5107affb9b41bbde6a182b0eb41a50a4
kubevirt-csi-driver git 771b562d sha256:02b4907e0764131f067b3bb4dd07c7b3f4ac2e7b856c2be130ee4347eab63812
multus-cni git b4ec7d82 sha256:23e6a5081c097fed85dd637c81e7c89925931ac952efa36622b140171c05e27d
multus-cni-microshift git b4ec7d82 sha256:0d60eed5435b727796d71713f0e4edae2f8cf009e0c5af2c42747a1b100dfd33
multus-route-override-cni git 08af4127 sha256:4e8d3e3d511bd40f436a48428ec2134b575d9a0294064fe11867ddc575cdd150
multus-whereabouts-ipam-cni git d691040e sha256:de3a78b738eafd3c6ed5bea4b533bf9315e00008a374515d049bd01c8b5fcf2d
network-metrics-daemon git 5b233ea1 sha256:dc63e9032cbef871a195a838c4b30f6b739ce701606219e9e9ec691a7b85dfd3
openshift-state-metrics git e71e0996 sha256:6620579c0d7a1a9a44cdc2d2f73c4f44ebb27a9b240c39b2d717aef8524117cf
openstack-machine-api-provider git 8a8c354b sha256:787550a3ef690f5e3e8cac5c0eb5bed5a8d183d70fd56fdd4d424d652a366ced
powervs-machine-controllers git e88cf81d sha256:85dadb5348082244d9637f9589907493ab35566362a274b37a467c8fdd1181fe
rhel-coreos git f41264dc sha256:eab1a81086f3cb1ce9a016a73262c16ce89fe1cce88a63bce0aa873df6da9775
rhel-coreos-10 git f41264dc sha256:6fe960e88362a5e34682bcf5775e208c2c05e9820e03dffcb5032f0185eefee9
rhel-coreos-10-extensions git f41264dc sha256:94424ea839baeda2cc163edaf7d34af19d2adab4d456c9a753a5072444d0573d
rhel-coreos-extensions git f41264dc sha256:99293dbf7a7e3cffc8a00c86408d9a5935cc84c2c110cfd6b114b5c02233638c
thanos git 5d9d0f38 sha256:10dd35c6df1aec06ef7212e3cee5560361b2e570894986eb80655d789126a27c
volume-data-source-validator git 8e176cec sha256:8a1fe05298c3dddbabd80cc3b07ac182126f54ba5f2fb6c4efeac28d02f2373d
vsphere-csi-driver git cf21e121 sha256:a17818bde05ed266d50b23f01acbdbb5b298a41ae721763fbeee457a55bb1e1b
vsphere-csi-driver-syncer git cf21e121 sha256:f4550f2d52b9b0d8c27b2c93f06087753075d239c621915fc0353a840948c160

agent-installer-api-server

NO-ISSUE: Update registry.access.redhat.com/ubi9/go-toolset Docker tag to v1.26 #10354
NO-ISSUE: Fix resource leak and inconsistency in manifest download #10322
MGMT-21834: deprecate supported-platforms endpoint #10122
NO-ISSUE: [master] Bump OCP versions: 4.14, 4.19, 4.18, 4.21, 4.20, 4.16 #10342
NO-ISSUE: fix typo: ‘occured’ -> ‘occurred’ in main.go error wraps #10316
NO-ISSUE: increase the timout waiting for assisted-image-service #10327
MGMT-20634: Revert mac-identifier and global DNS workarounds as RHEL-91250 and RHEL-72440 resolved #10318
ACM-33836: CVE-2026-35469 bump github.com/moby/spdystream #10314
NO-ISSUE: [master] Bump OCP versions: 4.22, 4.13, 4.16, 4.17 #10296
NO-ISSUE: [master] Bump OCP versions: 4.21, 4.20, 4.18, 4.19 #10287
MGMT-19930: upgrade PostgreSQL stack to pgx v5 and ocm-sdk-go v0.1.499 #10230
NO-ISSUE: [master] Bump OCP versions: 4.21 #10284
MGMT-24236: Exclude post-installation hosts from pending-user-action timeout #10266
MGMT-24138: Order network by bootstrap host #10257
NO-ISSUE: Remove unused RegisterAddHostsOCPCluster functions #10265
NO-ISSUE: [master] Bump OCP versions: 4.16, 5.0, 4.22 #10272
MGMT-24119: Correct the namespace to install Loki Operator as “openshift-operators-redhat” instead of “openshift-loki” #10209
MGMT-23755: Validate & trim MCS certificates when adding to ignition override #10262
NO-ISSUE: [master] Bump OCP versions: 4.21, 4.19 #10263
MGMT-23680: CVE-2026-32285 Bump github.com/buger/jsonparser to v1.1.2 #10240
NO-ISSUE: Update operator bundle channel to backplane-5.0 #10215
MGMT-24115: allow empty image checksum/url in getChecksumAndURL #10246
MGMT-23971: Add a timeout for installing-pending-user-action #10202
NO-ISSUE: Modify Konflux YAMLs to backplane-5.0 #10237
MGMT-23802: Fix manifest format in log bundles #10121
MGMT-23861: Fix oci detection for day2 clusters #10231
NO-ISSUE: [master] Bump OCP versions: 4.22 #10220
ACM-33186: Revert Renovate configuration for Hive updates #10203
MGMT-23553: Automate events table bloat cleanup #10140
MGMT-23665: fixing CVE-2026-33186 #10173
NO-ISSUE: Allow restoring soft deleted hosts #10185
NO-ISSUE: [master] Bump OCP versions: 4.20, 4.21, 4.22, 4.18 #10201
NO-ISSUE: Bump go modules and linters #10181
MGMT-23861: Revert MGMT-22385 for oci iscsi day2 #10170
ACM-32996: Missing nil check in BMACReconciler causes controller panic #10164
MGMT-23920: 4.22 SNO doesn’t support 4 cpu cores node #10153
NO-ISSUE: add shay23bra to owners #10163
NO-ISSUE: [master] Bump OCP versions: 4.13, 4.19 #10162
NO-ISSUE: Remove urlAuth from credentials endpoint #10161
MCO-2223: Add osImageStream install-config overrides #10156
NO-ISSUE: [master] Bump OCP versions: 4.21 #10152
NO-ISSUE: [master] Bump OCP versions: 4.22, 4.18, 4.20 #10146
OCPBUGS-79576: Mark raw FC/iSCSI multipath members as ineligible #10142
OCPBUGS-83401: Fix IRI patcher feature check #10141
MGMT-23227: Skip host operator validation for day2 clusters #10029
ACM-32735: Add better API docs to CRDs #10124
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

NO-ISSUE: Refresh RPM lockfiles #2160
MGMT-23784: CVE-2026-34986 Bump github.com/go-jose/go-jose/v3 to v3.0.5 using replace directive #2121
NO-ISSUE: Modify Konflux YAMLs to backplane-5.0 #2119
ACM-33186: Revert Renovate configuration for Hive updates #2107
NO-ISSUE: upgrade go.opentelemetry.io/otel/sdk to … #2097
MGMT-23789: CVE-2026-34986 Bump github.com/go-jose/go-jose/v4 to v4.1.4 through indirect dependency conversion #2081
Full changelog

agent-installer-node-agent

NO-ISSUE: Update registry.access.redhat.com/ubi9/go-toolset Docker tag to v1.26 #1461
NO-ISSUE: Upgrade linter #1453
NO-ISSUE: Modify Konflux YAMLs to backplane-5.0 #1431
ACM-31642: fix CVE-2026-33186 #1417
OCPBUGS-63472: add –copy-network when manual network config is detected #1374
MGMT-23790: CVE-2026-34986 Bump github.com/go-jose/go-jose/v4 to v4.1.4 through indirect dependency conversion #1404
NO-ISSUE: Refactor flag Parsing to avoid multiple calls #1401
NO-ISSUE: Refresh RPM lockfiles #1389
MGMT-23300: Ensure /boot dir has enough space during reclaim #1316
Full changelog

agent-installer-ui

Revert “OCPBUGS-84038 | [Below the sea UI] Lack of visual feedback (spinner) …” (#3757) #3757
Fix disk encryption parsing for cluster details (#3737) #3737
Reset search field on ‘Clear all filters’ (#3736) #3736
MGMT-24444: Apply sentence case to networking management type labels … (#3747) #3747
Operators section should not be displayed on review and installation progress pages when no operators are selected (#3745) #3745
Remove Arbiter button (#3744) #3744
chore(deps): update typescript (#3743) #3743
chore(deps): update konflux references (#3741) #3741
Update Konflux Quay image address (#3740) #3740
Bump ws from 8.18.3 to 8.20.1 (#3726) #3726
fix monted pull secret parsing (#3692) #3692
chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.25.9-1778675823 (#3720) #3720
chore(deps): update dependency qs to ^6.15.2 (#3719) #3719
chore(deps): update konflux references (#3718) #3718
chore(deps): update dependency dpdm to v4 (#3555) #3555
Implement useAgents hook for the CIM wizard (#3711) #3711
Ugrade axios to 1.15.2 (#3710) #3710
chore(deps): update dependency qs to ^6.15.1 (#3678) #3678
chore(deps): update dependency eslint to ^8.57.1 (#3677) #3677
chore(deps): update konflux references (#3707) #3707
chore(deps): update dependency redux to ^4.2.1 (#3708) #3708
chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.25.9-1778171507 (#3709) #3709
Bump fast-uri from 3.1.0 to 3.1.2 (#3706) #3706
OCPBUGS-84038 | [Below the sea UI] Lack of visual feedback (spinner) on disabled “Next” button during background validation (#3687) #3687
MGMT-23490: Refactor Troubleshooting Web Console (#3688) #3688
Bump basic-ftp from 5.3.0 to 5.3.1 (#3698) #3698
Bump ip-address from 7.1.0 to 10.1.1 (#3689) #3689
Read from aipVIPs and ingressVIPs in getClusterProperties function (#3661) #3661
Memoize the wizard footer on CIM Review step (#3686) #3686
MGMT-19002: [nmstate] UI form view missing autoconf field for ipv6 (#3681) #3681
Add custom-manifests-requirements-satisfied to soft validations on networking wizard step (#3682) #3682
OCPBUGS-84147 | [Below the sea UI] Leaky Abstraction: Transient 500 errors exposed during host binding process (#3672) #3672
MGMT-21857: [UI] - Missing “No Matching Clusters” Message (#3667) #3667
Hide internally generated custom manifests on the Cluster Review page (#3646) #3646
chore(deps): update konflux references (#3675) #3675
MGMT-23950: [Staging] [UI] - Cluster name missing in page header for draft clusters (#3669) #3669
chore(deps): update dependency @reduxjs/toolkit to ^1.9.7 (#3647) #3647
chore(deps): update dependency axios to ^1.15.2 (#3648) #3648
MGMT-24152: UI allows editing pull secret in draft cluster (#3662) #3662
Remove 2 node arbiter option from the control plane dropdown option (#3644) #3644
Bump postcss from 8.5.6 to 8.5.10 (#3641) #3641
Update OWNERS file (#3643) #3643
chore(deps): update konflux references (#3640) #3640
chore(config): migrate config renovate.json (#3639) #3639
MGMT-23800: Upgrade Vite (#3589) #3589
chore(deps): update dependency msw to v2.13.5 (#3587) #3587
chore(deps): update dependency @vitejs/plugin-react-swc to v4 (#3553) #3553
chore(deps): update dependency happy-dom to v20.9.0 (#3591) #3591
Add renovate.json (#3637) #3637
chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.25.8-1776962329 (#3588) #3588
chore(deps): update dependency @redhat-cloud-services/eslint-config-redhat-cloud-services to v3.1.0 (#3577) #3577
chore(deps): update dependency @types/uuid to v11 (#3544) #3544
chore(deps): update yarn to v3.8.7 (#3495) #3495
Add cursor rules for imports (#3595) #3595
NO-ISSUE: Cursor rules for comments and variables (#3592) #3592
Add CLAUDE.md (#3632) #3632
Bump uuid from 8.3.2 to 14.0.0 (#3629) #3629
Bump follow-redirects from 1.15.11 to 1.16.0 (#3586) #3586
ACM-30344: ACM Console should support ClusterImageSets with by-digest pullspecs (#3609) #3609
Allow to install SNO topology (#3578) #3578
Support third party CNI in CIM (#3600) #3600
Fix Cisco Intersight editing (#3523) #3523
Pull secret appears editable in draft cluster but changes are not applied (#3597) #3597
fix operators list in ABI below the sea (#3590) #3590
MGMT-23913: Missing breadcrumbs in on-prem Assisted Installer (#3598) #3598
Update build-tools (#3593) #3593
Upgrade lodash to 4.18.1 (#3566) #3566
Bump basic-ftp from 5.2.1 to 5.3.0 (#3594) #3594
OCPBUGS-83428: bump axios to ^1.15.0 for fixing CVE-2026-40175 (#3585) #3585
chore(deps): update dependency @redhat-cloud-services/frontend-components to v7.3.1 (#3568) #3568
chore(deps): update dependency @redhat-cloud-services/tsc-transform-imports to v1.0.58 (#3570) #3570
chore(deps): update dependency @redhat-cloud-services/frontend-components-config to v6.8.4 (#3569) #3569
MGMT-23090: Support single stack IPv6 (#3414) #3414
NO-ISSUE: Remove orphan files (#3460) #3460
MGMT-23328: remove breadcrumbs for OCM and use logo as a link (#3510) #3510
NO-ISSUE: Update translation files to match new i18next format (#3567) #3567
Full changelog

agent-installer-utils

OCPBUGS-86036: Filter out link-local IPv6 addresses #305
OCPBUGS-85524: update konflux references #286
AGENT-1476: Configure CI integration and add Prow e2e test to Konflux #245
AGENT-1193: Add mirror-path and registry-cert support for OVE ISO builder #218
OCPBUGS-83575: Remove Konflux cert-preflight test #290
NO-JIRA: Add 4.23 appliance-config #289
NO-JIRA: Add 5.0 appliance-config.yaml for iso_builder #288
Full changelog

apiserver-network-proxy

CNTRLPLANE-3380: Merge https://github.com/kubernetes-sigs/apiserver-network-proxy:master (588e629) into main #109
CNTRLPLANE-3380: Update OWNERS with HyperShift core team #107
CNTRLPLANE-3359: Rebase to v0.34.0 for OCP 4.23 #102
Full changelog

aws-cloud-controller-manager

OCPBUGS-85643: UPSTREAM: <drop>: bump google.golang.org/grpc to v1.79.3 #154
NO-JIRA: Update OWNERS #145
Full changelog

aws-cluster-api-controllers

OCPBUGS-85567: Bump github.com/go-jose/go-jose/v4 to 4.1.4 #607
NO-JIRA: manifests-gen: scope provider webhooks to capi namespace #605
OCPCLOUD-3359: Add TLS substitutions #598
NO-JIRA: Update manifests generator #604
UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-aws:v2.11.1 (eaa4c99) into main #602
UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-aws:v2.11.0 (815a1b0) into main #600
NO-JIRA: Update OWNERS #599
Full changelog

aws-ebs-csi-driver

NO-ISSUE: UPSTREAM: 2911: CVE-2026-33186: bump google.golang.org/grpc v1.80.0 #315
Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator

OCPBUGS-85457: Add init container for Manila node daemonset #552
OCPBUGS-84052: Mount writable /tmp in SMB CSI driver #545
OSASINFRA-3675: Rework authentication in Manila CSI Driver Operator #373
OCPBUGS-80930: Add VolumeAttributesClass e2e test manifests for Azure disk #538
Full changelog

aws-kms-encryption-provider

CNTRLPLANE-3380: Update OWNERS with HyperShift core team #45
Full changelog

aws-machine-controllers

OCPBUGS-83873: Changed timeout for node ready logic in OTE #185
SPLAT-2715: Fixed broken test and simplified some logic #182
NO-JIRA: Update OWNERS #183
Full changelog

aws-node-termination-handler

CNTRLPLANE-3380: Update OWNERS with HyperShift core team #7
Full changelog

azure-cloud-controller-manager, azure-cloud-node-manager

OCPBUGS-85641, OCPBUGS-85642: UPSTREAM: <drop>: bump google.golang.org/grpc to v1.79.3 #184
NO-JIRA: Update OWNERS #174
Full changelog

azure-cluster-api-controllers

NO-JIRA: manifests-gen: scope provider webhooks to capi namespace #387
OCPCLOUD-3359: Add TLS substitutions #379
NO-JIRA: Update manifests generator #382
OCPBUGS-84694: Merge https://github.com/kubernetes-sigs/cluster-api-provider-azure:v1.23.1 (dbeb413) into main #380
NO-JIRA: Update OWNERS #376
Full changelog

azure-disk-csi-driver

OCPBUGS-78197: check for node name in waitForDiskManagedByTobeRemoved #144
UPSTREAM: 3569: OCPBUGS-83733: Bump grpc to v1.79.3 #135
Full changelog

azure-file-csi-driver

UPSTREAM: 3023: OCPBUGS-83329: Bump grpc to v1.79.3 #124
Full changelog

azure-kms-encryption-provider

CNTRLPLANE-3380: Add rebasebot-compatible commit prefixes #41
CNTRLPLANE-3380: Update OWNERS with HyperShift core team #35
CNTRLPLANE-3204: feat: add workload identity support to Azure KMS plugin #33
CNTRLPLANE-3358: Sync with upstream Azure/kubernetes-kms #32
Full changelog

azure-machine-controllers

NO-JIRA: Update OWNERS #190
Full changelog

azure-service-operator

OCPBUGS-83613: Bump grpc package for CVE fix #21
OCPBUGS-69898: Updating ose-azure-service-operator-container image to be consistent with ART for 4.22 #16
NO-JIRA: UPSTREAM: <carry>: add openshift/e2e-tests.sh #22
NO-JIRA: Update OWNERS #20
Full changelog

azure-workload-identity-webhook

OCPBUGS-84709: github.com/go-jose/go-jose/v4 v4.1.4 #46
Full changelog

baremetal-cluster-api-controllers

NO-JIRA: manifests-gen: scope provider webhooks to capi namespace #79
OCPCLOUD-3359: Add TLS substitutions #74
NO-JIRA: Update manifests generator #75
Full changelog

baremetal-installer, installer

METAL-1731: baremetal: Add coreos.openshift.io/stream label to BMH and hostSelector #10502
OCPBUGS-78126: baremetal: fix gather bootstrap failing with provisioningNetwork Disabled #10395
SPLAT-2452: Add SetSecurityGroups IAM permission to master nodes for BYO SG support for AWS NLBs #10512
MCO-2164: use machine-config-osimagestream to avoid hard-coding image tag names #10416
no-jira: images: bump UPI image dependencies to 4.22 #10538
MCO-2200: refactored node-joiner to use embedded rhcos data #10537
OCPBUGS-79536: Removing AWS security group OVNDB ports as they are no longer used #10441
OCPBUGS-85232: PowerVS: Add port 80 security group rule #10541
no-jira: tests: verify AWS instance type minimum cpu and mem requirement tests #10536
NO-JIRA: pkg/types/nutanix: warn about unused context #10430
SPLAT-2710: Added vSphere day 2 support #10529
OCPBUGS-67159: openstack: Reserve addresses for load balancer #10375
OCPBUGS-77760: verify FIPS mode after installation completes #10348
OCPBUGS-84873: Fix to agent integration test finding agent-tui files #10530
OCPBUGS-84335: vSphere - Missing unit tests to cover polarion workitems #10516
OCPBUGS-84548: add unit tests for Nutanix to replace polarion workitems #10520
no-jira: update to Google Cloud SDK 563.0.0 #10460
MULTIARCH-5824: PowerVS: Fix supported system types retrieval for PowerVS regions #10268
CORS-3933: Add a retry backoff for checking storage in progress #10463
SPLAT-2719: vsphere - remove HostGroup zonal feature gate checks #10497
OCPEDGE-2255: baremetal: reject SNO installation on baremetal platform #10420
OCPBUGS-78932: Improved DHCP network deletion reliability by proactively cleaning up attached network interfaces before retrying deletion #10325
OCPBUGS-83327: PowerVS: update CAPI to v0.12.2 #10488
OCPBUGS-83335: dont save CAPI secrets #10498
AGENT-1417: Add kind verification in InternalReleaseImage check #10332
Full changelog

baremetal-operator

NO-ISSUE: Merge upstream #483
Full changelog

baremetal-runtimecfg

NO-ISSUE: Bump go to fix security vulnerabilities #389
Full changelog

cli, cli-artifacts, deployer, tools

NO-JIRA: Bump go-jose dependency #2269
NO-JIRA: Making oc cli case blocking #2260
OCPBUGS-62799: Add required-scc annotation to node-joiner pod #2230
OTA-1817: Adding unit tests for the extend recommended alerts #2262
OCPBUGS-78768: Skip filter validation for RFC2307 group query when groupUIDAttribute is “dn” #2259
RFE-3594: Add group membership info #2255
NO-JIRA: claude: Change learn-* agents into skills #2257
NO-JIRA: claude: Improve AGENTS.md and add agents for storing project knowledge #2251
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

cloud-credential-operator

OCPBUGS-82165: Add retry logic for concurrent IAM policy changes in GCP #1014
OCPBUGS-58181: Fix nil pointer dereference in ensureRolesAssignedToManagedIdentity #987
CCO-683: Remove go-autorest dependency for Azure Stack Cloud configuration #1024
CCO-845: use AlwaysAllow UnhealthyPodEvictionPolicy option in PDBs #1019
CCO-770: Docs: consolidate and simplify short-term token workflows #986
CCO-711: docs: improve the filter when getting the capi pod #1016
OCPBUGS-84712: github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3 #1021
OCPBUGS-84043: go.opentelemetry.io/otel v1.43.0 #1011
OCPBUGS-84044: github.com/go-jose/go-jose/v4 v4.1.4 #1012
OCPBUGS-83449: test-ext: hypershift skip CCO metrics endpoint validation #1010
Full changelog

cluster-authentication-operator

CNTRLPLANE-3431: restart operator upon config change #897
NO-JIRA: Bump auth with latest library-go changes #900
CNTRLPLANE-3210: Refactor externaloidc controller to support different configuration generation logic #893
CNTRLPLANE-3364: add the kms suite and migrate the kms tests of auth-o to ote #895
CNTRLPLANE-3237: Bump library-go and sync plugin changes #896
CNTRLPLANE-3237: Bump library-go and sync encryption tests with APIServerEncryption struct change #894
CNTRLPLANE-3431: enable tls config injection #892
NO-JIRA: Bump latest library-go changes #890
OCPBUGS-69977: Fix OAuth page showing OKD branding instead of OpenShift #887
OCPBUGS-84951: Fix terminationMessagePolicy on network policy e2e test pods #882
NO-JIRA: Update library-go for latest changes #873
CNTRLPLANE-2523: deploy oauth-apiserver in new OIDC mode when authentication type is OIDC #858
NO-JIRA: Add control-plane-approvers to OWNERS #871
Full changelog

cluster-autoscaler

OCPBUGS-84130: UPSTREAM: 9458: fix(clusterapi): use kind-aware version discovery for infra references #418
Full changelog

cluster-autoscaler-operator

OCPBUGS-52155: Add machinesets to cluster operator related objects #369
AUTOSCALE-660: add enforce node group min size flag #374
Full changelog

cluster-baremetal-operator

OCPBUGS-85824: Fix empty IRONIC_BASE_URL #603
OCPBUGS-85496: Fix webhook to validate the actual admission request object #601
OCPBUGS-82526: Fix webhook server not starting due to missing WithValidator #587
OCPBUGS-82531: Bind the plain HTTP 8080 metrics port to localhost #586
OCPBUGS-83612: Fix image-cache to use HTTPS for metal3-state downloads #592
Full changelog

cluster-bootstrap

NO-JIRA: Add control-plane-approvers to OWNERS #127
Full changelog

cluster-capi-controllers

OCPBUGS-53005: Remove references to master branch #235
NO-JIRA: manifests-gen: scope provider webhooks to capi namespace #292
OCPCLOUD-3359: Add TLS substitutions #290
NO-JIRA: Update manifests generator #287
UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api:v1.12.7 (b5fa593) into master #286
OCPCLOUD-3419: Adopt IPAM CRDs on upgrade #274
OCPBUGS-83513: Merge https://github.com/kubernetes-sigs/cluster-api:v1.12.5 (efc7142) into master #275
NO-JIRA: Update OWNERS #278
Full changelog

cluster-capi-operator

NO-JIRA: Remove stale TODO comment for HostPlacement conversion #569
NO-JIRA: Allow sustaining engineering to self serve dependency updates #553
OCPBUGS-84815: fix: scope webhook to capi namespace, remove unused webhook endpoints #543
OCPCLOUD-2664: Update operatorstatus to write correct sub-Conditions #552
OCPCLOUD-3429: Mount provider images with image volumes #527
NO-JIRA: manifests-gen: scope provider webhooks to capi namespace #544
OCPBUGS-84673: fix: remove retired Microsoft.ClassicStorage permission #547
NO-JIRA: bump controller-runtime-common to latest main #540
NO-JIRA: Updates gemini powered skills / agents #542
NO-JIRA: manifests-gen: set scc annotation in providers Deployments spec #524
NO-JIRA: Adds deep review skill #541
NO-JIRA: fix: re-enable setting/diffing httpProtocolIpv6, CAPA now supports it #537
NO-JIRA: fix: conversion: handle HTTPProtocolIPv6, temporarily disable its diffing #531
OCPBUGS-84378: Refactor e2e newAWSMachineTemplate to use mapi2capi #532
OCPBUGS-84340: Fix e2e flake when workers are in us-west-2b #529
NO-JIRA: fix: tolerate not-found upon infra machine deletion #528
NO-JIRA: Update e2e diagnostics #488
OCPCLOUD-3345, OCPCLOUD-3359: Add support for TLS envsubst substitution #519
OCPBUGS-83601: Bump grpc package for CVE fix #523
NO-JIRA: Fix crdcompatibility flakes after webhook creation #525
NO-JIRA: Update OWNERS #522
Full changelog

cluster-cloud-controller-manager-operator

OCPCLOUD-3436: use AlwaysAllow UnhealthyPodEvictionPolicy option in PDBs #457
SPLAT-2651: Added support to manage kube-cloud-config for vSphere in openshift-config-managed #442
NO-JIRA: fix: add pod annotation: openshift.io/required-scc: hostaccess #450
NO-JIRA: bump controller-runtime-common to latest main #456
SPLAT-2562: Refactored OTE and added new 3CMO OTE binary #446
OCPBUGS-83399: e2e/ote/ccm-aws fix hairpin traffic on NLB and CLB in EUSC #449
NO-JIRA: Update OWNERS #448
Full changelog

cluster-config-api

CNTRLPLANE-3361: make transitMount required #2847
MON-4579: Remove NodeSelector and Tolerations from NodeExporterConfig #2837
CORENET-6714: Enable Network Observability on Day 0 #2752
OCPBUGS-74511: remove RouteExternalCertificate feature gate #2693
CNTRLPLANE-3361: update vault kms plugin validation #2836
OCPSTRAT-3036: Promote MutatingAdmissionPolicy feature to Default #2832
OPRUN-4590: Add OLMLifecycleAndCompatibility feature gate #2824
CNTRLPLANE-3237: Rename KMSConfig Struct to KMSPluginConfig #2833
SRVKP-11558: remove deprecated k8s.io/api packages removed in v0.36.0 #2834
CORENET-6861: Promote EVPN Feature Gate #2799
Revert “OCPBUGS-83492: Allow :ref suffix in additionalLayerStores path for stargz-store to support lazy image pulling” #2823
MON-4561: API: Add softirqs node-exporter collector to ClusterMonitoring CRD #2825
Clarify cluster operator Progressing condition #2829
OCPNODE-4498: features: drop DRAPartitionableDevices awareness #2828
OCPBUGS-43353: Add pattern validation for registry entries in image config #2787
SPLAT-2649: Added vSphere Day 2 logic to CRDs #2784
OCPBUGS-74506: Remove ConsolePluginSecurityPolicy featuregate #2683
CNTRLPLANE-2711: add vault kms plug configuration api #2805
OCPBUGS-74525: OCPBUGS-74526: Remove UserNamespacesPodSecurityStandards and UserNamespacesSupport #2762
OCPBUGS-82584: Add labelSelector to MachineSet status for scale subresource #2807
OCPBUGS-83754: fix(config/v1): define constants for authentication types as typed constants #2814
OCPBUGS-83492: Allow :ref suffix in additionalLayerStores path for stargz-store to support lazy image pulling #2806
MON-4037: Add MonitoringPluginConfig to ClusterMonitoring API #2768
fix: small typos in comments in types.go #2804
OCPBUGS-82292: extend supported values for MCN IRI image status field #2800
MON-4036: Add NodeExporterConfig to ClusterMonitoring API #2744
OCPCLOUD-3359: Add component names, manifestSubstitutions, and observedGeneration to CAPI revisions #2786
Full changelog

cluster-config-operator

SPLAT-2747: Updated kube cloud config controller to react to feature gate updates #489
SPLAT-2717: Migrate vSphere sync of kube-cloud-config to 3CMO #481
CNTRLPLANE-1544: manifests: Use restricted-v3 scc for deployment #451
Full changelog

cluster-control-plane-machine-set-operator

NO-JIRA: bump controller-runtime-common to latest main #403
NO-JIRA: Update OWNERS #399
Full changelog

cluster-etcd-operator

OCPBUGS-83332: fix cluster-restore-tnf.sh for FQDN hostnames #1622
NO-JIRA: Fixed spelling in files and file names #1624
OCPEDGE-2604, OCPEDGE-2605: feat: add update-fencing-credentials.sh script for TNF fencing credentials rotation #1611
CNTRLPLANE-3392: Migrating etcd otp cases to ote #1612
NO-JIRA: Replace bash env var validator with go implementation #1606
NO-JIRA: separate grpc from http server #1598
NO-JIRA: fix CI failure #1599
NO-JIRA: Refactor render test validation #1597
NO-JIRA: Add control-plane-approvers to OWNERS #1594
Full changelog

cluster-image-registry-operator

NO-JIRA: fix flaky TestGlobalTLSCopy unit test #1341
OCPBUGS-84725: Fix stale config cache causing incorrect deployment #1329
OCPBUGS-63691: replace node-ca shell script with go implementation #1325
IR-486: use AlwaysAllow UnhealthyPodEvictionPolicy option in PDBs #1326
NO-JIRA: Add control-plane-approvers to OWNERS #1324
OCPBUGS-83282: Allow longer window before going Degraded #1318
CNTRLPLANE-2660: e2e testing automation: Image Registry network policy #1320
OCPBUGS-66225: ImageConfigController: add inertia before ImageConfigC… #1319
Full changelog

cluster-ingress-operator

OCPBUGS-83923: Update grpc-go and x/net #1447
NE-2662: use AlwaysAllow UnhealthyPodEvictionPolicy option in PDBs #1431
OCPBUGS-80966: Fix malformed PEM bundle when tls.crt lacks trailing newline #1405
OCPBUGS-84773: Allow host network connections to the ingress canary #1430
OCPBUGS-81442: TestUnsupportedConfigOverride: Ignore featuregate and defaults #1408
OCPBUGS-84551: isFIPSEnabled: Check FIPS_ENABLED env. var. first #1427
OCPBUGS-54702: change default timeout tunnel if using AWS NLB #1349
OCPBUGS-81192: Fix race condition in internal-to-external LB migration test #1407
NE-2390: Adding AGENTS.md file #1341
OCPBUGS-25739: Fix PDB MaxUnavailable for 2-replica ingress controllers #1380
Full changelog

cluster-kube-apiserver-operator

NO-JIRA: Add KMS dummy case #2161
NO-JIRA: Bump latest library-go changes #2160
CNTRLPLANE-3238: Add New kms suite #2156
CNTRLPLANE-3237: Bump library-go and sync plugin changes #2155
CNTRLPLANE-3237: pull https://github.com/openshift/library-go/pull/2220 #2150
OCPSTRAT-3036: Temporarily extend MutatingAdmissionPolicy runtime-config range to <1.37.0 #2148
CNTRLPLANE-3347: Migrate testKMSEncryptionOnOff to ote #2127
OCPBUGS-78016: Use SkipInClusterAuthenticationLookup in check-endpoints #2113
NO-JIRA: Removal of unuse suites #2132
OCPBUGS-76588: operator should not override authentication config serviceAccountIssuer with the default one during the operator initialization #2062
CNTRLPLANE-3327: Migrate TestEncryptionTypeAESCBC to OTE #2122
NO-JIRA: Add control-plane-approvers to OWNERS #2110
CNTRLPLANE-3326: Remove unstable TestBoundTokenOperatorSecretDeletion #2123
NO-JIRA: Update library-go changes #2107
OCPBUGS-79663: Allow setting the oauthMetadata when auth type is None #2105
CNTRLPLANE-3228: Implement 5.0 EUS schedule in KAS-O #2101
CNTRLPLANE-2991: Do not configure KAS with Structured Authentication when authentication type is OIDC #2075
CNTRLPLANE-2935: Enable configurable PKI for managed certificate rotation #2051
Full changelog

cluster-kube-controller-manager-operator

CNTRLPLANE-3107: e2e testing automation Create network network policy test cases #924
NO-JIRA: Add control-plane-approvers to OWNERS #926
Full changelog

cluster-kube-scheduler-operator

WRKLDS-1126: e2e network policy tests #637
NO-JIRA: Add control-plane-approvers to OWNERS #639
OCPBUGS-82503: add /var/run/kubernetes as emptyDir #638
Full changelog

cluster-kube-storage-version-migrator-operator

OCPBUGS-65984: add PodDisruptionBudget for migrator deployment #172
OCPBUGS-62629: update library-go for deployment controller updates #159
NO-JIRA: Add control-plane-approvers to OWNERS #158
OCPBUGS-51091: schedule migrator pods on control-plane nodes #157
Full changelog

cluster-machine-approver

NO-JIRA: fix: add pod annotation: openshift.io/required-scc: restricted-v2 #297
NO-JIRA: bump controller-runtime-common to latest main #302
NO-JIRA: Deploy cluster-machine-approver without host networking #301
NO-JIRA: Migrate away from deprecated ioutil #284
OCPCLOUD-3347: tls: use centralized TLS profile (unrevert) #292
NO-JIRA: Update OWNERS #296
Full changelog

cluster-monitoring-operator

MON-4525: manifests: merge TelemeterClientConfig from ClusterMonitoring CRD #2928
MON-4566: chore: add telemetry_report tool to help with telemetry change review #2885
MON-4529: manifests: merge PrometheusOperatorAdmissionWebhookConfig from ClusterMonitoring CRD #2923
OCPBUGS-85709: fix: use numeric ports in NetworkPolicies and add enforcement e2e test #2925
NO-JIRA: [bot] Synchronize versions of the downstream components #2921
OCPBUGS-83284: validate more CMO configmap fields #2877
MON-4524: MetricsServerConfig resources merge #2907
NO-JIRA: [bot] Synchronize versions of the downstream components #2918
MON-4528: merge monitoringPluginConfig #2908
NO-JIRA: [bot] Synchronize versions of the downstream components #2893
MON-4520: follow up AlertManagerConfig and PrometheusOp PR changes #2900
TRT-2649: Revert “MON-4558: enable zoneinfo node-exporter collector via config” #2910
NO-ISSUE: chore(e2e): verify Prometheus Mantine UI is served on port 9090 and refactor ForwardPort helpers #2905
NO-ISSUE: Update AGENTS.md #2899
MON-4563: use AlwaysAllow UnhealthyPodEvictionPolicy option in PDBs #2892
MON-4558: enable zoneinfo node-exporter collector via config #2886
TRT-2644: Revert “MON-4517: Minimal and telemetry CP monitors” #2901
NO-ISSUE: [bot] Update jsonnet dependencies #2894
MON-4492: ClusterMonitoring alertmanagerConfig logic #2889
MON-4517: Minimal and telemetry CP monitors #2814
MON-4560: enable softirqs node-exporter collector via config #2887
NO-JIRA: refactor config merging #2890
OCPBUGS-54806: Add telemetry for user-defined networks #2596
CNTRLPLANE-3217: Enable configurable PKI for GRPC TLS certificates #2882
NO-ISSUE: [bot] Update jsonnet dependencies #2878
MON-4115: expose label metrics for jobs and cronjobs #2553
MON-4480: set minimum TLS version for Thanos ruler #2862
MON-4442: Add AGENTS.md to CMO #2761
NO-JIRA: [bot] Synchronize versions of the downstream components #2884
MON-4493: add MetricsServerConfig support to ClusterMonitoring CRD #2809
Full changelog

cluster-network-operator

OCPBUGS-83863: Remove version-specific CNI binary copy logic #2967
OCPBUGS-84519: Add terminationMessagePolicy to missing ovn-kubernetes containers #3004
NVIDIA-596: Enable dpu healthcheck #2941
TRT-2657: Revert “add remaining CNO NetworkPolicies” (#2959) #2999
OCPBUGS-83800: add remaining CNO NetworkPolicies #2959
NVIDIA-554: DPU-host mode: use ConfigMap for OVN feature enablement instead of per-node script gating #2944
OCPBUGS-83406, OCPBUGS-83407: fix issue for managed mode of no-overlay #2960
OCPBUGS-53187: Update self-referencing URLs from master to main #2984
GCP-430: Wire GCP WIF credentials for CNCC in HyperShift HCP mode #2915
OCPBUGS-65631: Use dedicated service accounts for multus pods #2961
NO-JIRA: cleanup unused code and refactor for allowlist controller #2846
CORS-4332: Add GCP to the allowed platforms for dual stack #2894
OCPBUGS-82973: Frrk8s tls manifests #2963
KONFLUX-11591: Fix ovn-acl-logging CrashLoopBackOff due to startup race condition #2923
CORENET-6572: only report Progressing for active network rollouts #2937
Full changelog

cluster-node-tuning-operator

OCPBUGS-83865: Revert stalld backend to sched_debug #1515
NO-JIRA: E2E: remove obsolete ContainerRuntimeConfig runtime-switch test #1510
OCPBUGS-80952: perf: latency: compute memory resources dynamically #1517
OCPBUGS-62277: Requeue PerformanceStatus update when status write fails #1495
NO-JIRA: ote: embed extended testdata in cluster-node-tuning-operator-test-ext binary #1512
TRT-2659: Revert #1499 “NO-JIRA: ote: embed extended testdata in cluster-node-tuning-operator-test-ext binary” #1511
NO-JIRA: e2e: fix tuned deferred tests on Hypershift #1494
NO-JIRA: test/extended: scope oc process to NTO namespace #1508
NO-JIRA: ote: embed extended testdata in cluster-node-tuning-operator-test-ext binary #1499
OCPBUGS-84938: e2e: Add irqbalance StartLimitBurst >= 100 config test #1493
Full changelog

cluster-olm-operator

OPRUN-4599: dynamically resolve catalog image tag from OCP release version #203
OCPBUGS-62517: Scale to replicas=2 and enable PDB on HighlyAvailable topology #202
Full changelog

cluster-openshift-apiserver-operator

NO-JIRA: Bump latest library-go changes #692
CNTRLPLANE-3364: add the kms suite and migrate the kms tests of oas-o to ote #690
CNTRLPLANE-3237: Bump library-go and sync encryption tests with APIServerEncryption struct change #689
NO-JIRA: Bump latest library-go changes #688
API-1768: e2e network policy tests #675
NO-JIRA: Add control-plane-approvers to OWNERS #677
NO-JIRA: Update library-go for latest changes #678
Full changelog

cluster-openshift-controller-manager-operator

CNTRLPLANE-2907: e2e network policy tests #428
NO-JIRA: Add control-plane-approvers to OWNERS #427
Full changelog

cluster-policy-controller

NO-JIRA: Add control-plane-approvers to OWNERS #179
Full changelog

cluster-samples-operator

CNF-23044: Migrate away from deprecated ioutil #668
CNTRLPLANE-3176: implements operator tls config compliance #684
Full changelog

cluster-version-operator

OTA-1966: Manage proposals #1382
OTA-1935: pkg: Use risk.Source framework to feed Upgradeable #1368
OTA-1967: Take official CRDs from the OpenShift Lightspeed operator #1387
MON-4477: chore: add permissions on endpointslice to Prometheus Role and use serviceDiscoveryRole: EndpointSlice in ServiceMonitors #1305
OTA-1966: Init the Proprosal Lifecycle Controller #1381
NO-JIRA: OpenShiftUpdateRiskMightApply: bump pending to 15m from 10m #1372
OTA-1836: chore(deps): Bump general OpenShift dependencies #1377
OTA-1979: Revert “lightspeed: Add a new image holding Lightspeed skills” #1378
NO-JIRA: how-to: troubleshoot bootstrap CVO #1369
OTA-1965: Add Lightspeed CustomResourceDefinitions #1380
NO-ISSUE: Fix TestOperator_upgradeableSync #1373
OTA-1962: lightspeed: Add a new image holding Lightspeed skills #1376
OTA-1813: Extend alert risk e2e #1371
Full changelog

console

OCPBUGS-83767: Helm upgrade — preserve release values when changing chart version #16364
OCPBUGS-86491: Fix macOS Option key in pod terminal #16492
CONSOLE-5293: Update Dockerfile.downloads for 4.22 and add RHEL ⁸⁄₉ oc binaries #16455
CONSOLE-5298: enable http2 on the backend #16471
CONSOLE-5253: Extend Unit Tests: Console-App - Core Navigation & Orchestration #16452
OCPBUGS-86488: Bump to PatternFly 6.5.1 #16491
CONSOLE-5244: Migrate webterminal-plugin Cypress tests to Playwright #16461
CONSOLE-5110: update to PatternFly 6.5.0 #16172
OCPBUGS-82512: Fix knative e2e test failures caused by createRoot timing #16289
CONSOLE-5300: Parallelize context detection to reduce initial load time #16477
HELM-703: Add authentication for Helm chart URLs #16360
CONSOLE-5194: Audit and fix Claude Code skills for accuracy #16316
OCPBUGS-84876: Remove DataViewToolbar wrapper from bottom pagination #16479
NO-JIRA: Add eslint-plugin-no-barrel-files #16476
OCPBUGS-84214: Fix Shipwright detail pages crashing with React error #310 #16474
CONSOLE-5197: Improve Playwright artifact collection and add safety checks #16463
OCPBUGS-71878: Show empty state instead of 403 error for users without projects #16464
OCPBUGS-82505: Re-enable add-flow-ci.feature e2e tests disabled for createRoot adoption #16285
NO-JIRA: Update Console plugin SDK CHANGELOG files #16465
CONSOLE-5280: Migrate cluster-settings Cypress tests to Playwright #16444
OCPBUGS-81521: Adapt dashboard Prometheus polling interval based on query response time #16441
CONSOLE-5245: Install and configure eslint-plugin-playwright for e2e directory #16433
CONSOLE-5197: Collect Playwright test artifacts for Prow CI #16453
OCPBUGS-85649: bump gRPC-Go package #16442
OCPBUGS-82513: Enable Topology e2e tests #16273
CONSOLE-5200: add qa-verify skill for automated PR visual verification #16429
OCPBUGS-84669: Fix ProjectLink to update active namespace in Redux #16430
CONSOLE-5212: Fix ESM compatibility for Playwright e2e tests #16445
OCPBUGS-79521: Restore list page text and row filter functionality #16440
OCPBUGS-59404: Allow VolumeSnapshot restore when parent PVC is deleted #16447
OCPBUGS-83569: [main] CVE-2026-26996 Bump minimatch library #16301
CONSOLE-5211: Add Cypress-to-Playwright migration skills and context #16315
CONSOLE-5229: Enable RTL ESLint rules in Knative tests by removing file-level no-container / no-node-access suppressions #16405
CONSOLE-5197: Add Playwright E2E test infrastructure for Prow/CI #16374
CONSOLE-5034: Migrate tile-view-page and value-from-pair to TypeScript #16412
OCPBUGS-85242: Add Suspense boundary to LazyRoutePage for plugin routes #16409
OCPBUGS-77952: Fix devfile sample import by adding fallback for parent resolution failures #16149
OCPBUGS-70273: Prevent binary secret data corruption when editing #16053
OCPBUGS-65950: Update template whenever settings are updated #16143
CONSOLE-5212: Migrate Playwright setup to project dependencies #16408
CONSOLE-5285: remove corepack dep for build-(frontend/demos), bump yarn #16426
OCPBUGS-81518: Increase Resource Dropdown visible items cap to 250. #16398
CONSOLE-5273: Expose useToast in the SDK #16400
OCPBUGS-59353: Fix authentication redirect loop on repeated 401 responses #15814
CONSOLE-5015: Migrate NameValueEditor to TypeScript and PatternFly drag-drop #16406
NO-JIRA: Add approvers and reviewers to helm-plugin OWNERS #16361
OCPBUGS-85043: Remove @console imports from SDK dist #16399
OCPBUGS-77931: Loosen default img-src CSP #16388
OCPBUGS-84324: Update outdated documentation links and references #16362
CONSOLE-5212: Set up Playwright e2e test infrastructure #16320
OCPBUGS-84844: VSphere plugin changes broke i18n translations - missing strings in locales/en/ #16384
OCPBUGS-80940: Fix SDK publish workflow for Yarn Berry #16392
HELM-613: Reject basic auth over non-HTTPS for Helm chart repositories #16317
OCPBUGS-81519: Fix Search page state mutation and unnecessary component remounts #16266
OCPBUGS-84876: Add bottom pagination to ConsoleDataView for mobile responsiveness #16391
OCPBUGS-84856: Fix ESLint Testing Library plugin PR review feedback #16387
OCPBUGS-82140: Remove PII from events #16365
NO-JIRA: Align Dockerfile.dev with multi-arch Dockerfile structure #16390
OCPBUGS-79363: Move xterm to its own chunk #16370
NO-JIRA: zsh compatibility for microcopy-review #16389
NO-JIRA: Add fsgreco to frontend reviewers #16381
CONSOLE-5184: Enable ESLint Plugins for React Testing Library #16270
OCPBUGS-84710: Fix ConsoleDataView filter order: Name and Label should appear first #16375
OCPBUGS-84227: i18n upload/download routine task - version 4.22 #16318
OCPBUGS-84230: [release-4.22] - Re-enable cluster-settings/update-modal.cy.ts e2e test disabled for createRoot adoption #16319
OCPBUGS-81522: Reduce dashboard re-renders by memoizing cards and stabilizing prop references #16367
CONSOLE-5203: Remove old QE team from our repos #16312
OCPBUGS-81518: Fix ResourceListDropdown performance on large clusters #16252
OCPBUGS-79067: Fix crash when switching language to English #16366
NO-JIRA: Remove broken entrypoints and unused packages #16357
OCPBUGS-82511: re-enable helm-release.feature #16274
CONSOLE-5227: Upgrade ESLint from v6 to v8 and @typescript-eslint to v8 #16353
OCPBUGS-84338: Update resolveDynamicModuleMaps to skip unavailable packages #16340
OCPBUGS-84320: Use popover token in QS modal #16339
OCPBUGS-84296: fix Helm list page redirect after upgrade/rollback #16336
NO-JIRA: prepare for 4.22-prerelease.3 sdk publish #16338
CONSOLE-5144, OCPBUGS-81319, OCPBUGS-83823: 4.22 SDK fixes #15655
OCPBUGS-83812: Fix race conditions in OLM descriptors Cypress test #16304
OCPBUGS-83816: Fix race conditions in create-namespace Cypress tests #16306
NO-JIRA: enable multi-architecture yarn builds #16228
OCPBUGS-83813: Fix race conditions in debug pod Cypress tests #16305
OCPBUGS-81668: Fix User Preferences responsive breakpoints bug #16279
OCPBUGS-77864: Add gRPC probe support to container details view #16245
CONSOLE-5176: Refactor RTL Tests from fireEvent to userEvent #16294
OCPBUGS-82504: Re-enable cluster-settings/update-modal.cy.ts e2e test disabled for createRoot adoption #16283
NO-JIRA: Replace deprecated io/ioutil pkg #15902
OCPBUGS-81630: Fix unnecessary error on Node Terminal tab #16263
OCPBUGS-78365: Fix create visual connector in Topology #16241
OCPBUGS-83532: Add empty state visibility check to CRD test #16303
CONSOLE-5204: Merge PR templates #16287
OCPBUGS-82510: Fix web-terminal-adminuser e2e tests broken by createRoot #16284
OCPBUGS-83446: Fix Cypress test timeouts by using correct timeout option #16280
OCPBUGS-83532: Fix race condition in CRD Cypress test #16288
NO-JIRA: enable Cypress Cloud in CI #16277
And 3 elided commits (e.g. from squash or rebase merges)
Full changelog

console-operator

OCPBUGS-86117: Add unit and e2e test coverage for cert rotation redeployment #1160
OCPBUGS-85650: bump gRPC-Go package #1156
MON-4510: Migrate Prometheus targets discovering from Endpoints to EndpointSlices #1106
OCPBUGS-85060: feat: use 2 replicas for console on tnf #1151
CONSOLE-5204: Add PR template #1141
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

coredns

OCPBUGS-83943: Bump gRPC to v1.79.3 to resolve CVE-2026-33186 #183
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

UPSTREAM-SYNC: Sync main with latest upstream (release-1.35) #370
OCPBUGS-77578: Updating ose-openstack-cinder-csi-driver-container image to be consistent with ART for 4.22 #374
OCPBUGS-77755: Updating ose-openstack-cloud-controller-manager-container image to be consistent with ART for 4.22 #376
OCPBUGS-77592: Updating csi-driver-manila-container image to be consistent with ART for 4.22 #375
Full changelog

csi-driver-nfs

UPSTREAM-SYNC: Merge https://github.com/kubernetes-csi/csi-driver-nfs:master into main #179
UPSTREAM-SYNC: Merge https://github.com/kubernetes-csi/csi-driver-nfs:master into main #175
UPSTREAM-SYNC: Merge https://github.com/kubernetes-csi/csi-driver-nfs:master into main #170
Full changelog

csi-external-provisioner

NO-JIRA: OCPBUGS-82033: Bump google.golang.org/grpc to 1.79.3 #124
Full changelog

csi-external-snapshotter, csi-snapshot-controller

NO-JIRA: Bump google.golang.org/grpc to v1.79.3 #215
OCPBUGS-77492: UPSTREAM: 1392: Fix VolumeSnapshotContent deletion #207
Full changelog

docker-builder

OCPBUGS-77610: Updating openshift-enterprise-builder-container image to be consistent with ART for 4.22 #503
Full changelog

docker-registry

OCPBUGS-84680: pin cloud.google.com/go/storage to v1.30.1 to fix blob deletion #469
Full changelog

egress-router-cni

OCPBUGS-83286: Fix swallowed errors in cmdAdd/cmdDel causing empty CNI result #95
NO-JIRA: Update OWNERs file #96
Full changelog

etcd

OCPBUGS-85258: 5.0 rebase 3.6.11 #375
OCPBUGS-82495: 5.0/4.23 rebase 3.6.10 #368
Full changelog

gcp-cloud-controller-manager

OCPBUGS-85551, OCPBUGS-85552: Upgrade spdystream and grpc to fix CVEs #115
NO-JIRA: Remove custom vendor scripts in favour of standard tooling #111
NO-JIRA: Update OWNERS #105
Full changelog

gcp-cluster-api-controllers

OCPBUGS-53005: Remove references to master branch #297
UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-gcp:v1.12.0 (b9b055d) into master #295
OCPBUGS-85101: Merge https://github.com/kubernetes-sigs/cluster-api-provider-gcp:v1.11.2 (14609a0) into master #273
NO-JIRA: manifests-gen: scope provider webhooks to capi namespace #292
OCPCLOUD-3359: Add TLS substitutions #284
NO-JIRA: Update manifests generator #285
OCPBUGS-77684: Updating ose-gcp-cluster-api-controllers-container image to be consistent with ART for 4.22 #272
NO-JIRA: Update OWNERS #280
Full changelog

gcp-machine-controllers

NO-JIRA: Update OWNERS #157
Full changelog

gcp-pd-csi-driver

UPSTREAM: 2297: OCPBUGS-83423: Bump google.golang.org/grpc to v1.79.3 #121
Full changelog

gcp-pd-csi-driver-operator

NO-JIRA: Bump google.golang.org/grpc to v1.79.3 to address CVE-2026-33186 #182
STOR-2798: Update image-snapshot CSI manifest to use operator provided imageVolumeSnapshotClass #179
STOR-2798: Add test e2e manifest and VolumeSnapshotClass for image volumeSnapshotClass CSI tests #178
Full changelog

haproxy-router

NE-2572: use add/del haproxy api calls #763
OCPBUGS-86168: Bump google.golang.org/grpc to v1.79.3 #777
Reapply “OCPBUGS-55506: Prevent startup failures due to name resolution” #677
OCPBUGS-77263: create self-signed crt if failing to read default #740
OCPBUGS-62267: fix forwarded header for IPv6 on IPv4 stack #713
OCPBUGS-49738: fix handling of host conflict #736
Full changelog

hyperkube, kube-proxy, pod

OCPBUGS-74511: remove RouteExternalCertificate feature gate #2585
OCPBUGS-77243: test: skip private registry test #2621
OCPBUGS-78044: Improve WatchList test robustness #2622
CNTRLPLANE-2553: Update the KAS admission plugin for fields to be compilable at admission time #2627
OCPBUGS-83502: devicemanager: constrain topology hints to device NUMA nodes #2645
OCPBUGS-78576: Update the csi-driver-host-path version to 1.17.1 #2641
OCPBUGS-81740: UPSTREAM: 138259: Filter out unschedulable nodes in kubectl describe test #2640
Full changelog

hypershift

OCPBUGS-86296: Propagate management cluster proxy env vars to konnectivity sidecar #8569
OCPBUGS-65730: add –tls-cipher-suites to oauth-apiserver deployment #8554
OCPBUGS-85351: Revert “fix(azure): prevent externalDNSDomain from shadowing cluster apps domain” #8585
OCPBUGS-84955: bootstrap serving certs at hypershift operator startup #8545
ci(deps): bump codecov/codecov-action from 6.0.0 to 6.0.1 #8574
CNTRLPLANE-3040: add regression tests for CAS pause/unpause replica clamping #8262
NO-JIRA: chore(deps): weekly dependabot consolidation #8578
GCP-688: Port v1 E2E validations to envtest, unit tests, and v2 Ginkgo specs #8511
NO-JIRA: fix(e2e): lower pull secret in-place propagation test gate to 4.22 #8553
OCPBUGS-86075: docs(nodepool): fixing incomplete stuck node drain documentation in section Scaling To Zero #8544
CNTRLPLANE-3222: Port v1 lifecycle tests to v2 Ginkgo framework #8527
AUTOSCALE-692: remove default debug log level from karpenter container #8561
OCPBUGS-86310: Handle CA bundle aggregation delay by requeuing revocation #8563
CNTRLPLANE-3329: Use fuse-overlayfs for build cache instead of full copy #8568
NO-JIRA: fix(e2e): use public multi-arch image for ARM64 karpenter test #8532
OCPBUGS-86238: set limits for aro.openshift.io/swift-nic in request overrides for ARO swift #8552
OCPBUGS-85351: fix(azure): prevent externalDNSDomain from shadowing cluster apps domain #8480
CNTRLPLANE-3371: Fix AllowedCIDRs e2e test for Route-based KAS #8469
NO-JIRA: build(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 in /hack/tools #8547
NO-JIRA: Update Konflux Tekton task bundles #8557
NO-JIRA: chore(deps): weekly dependabot consolidation #8464
CNTRLPLANE-3070: Support KMS on self-managed Azure without affecting ARO HCP #8088
OCPBUGS-59142: fix ValidReleaseImage condition message to show minor version #8519
NO-JIRA: Add onboarding guide for new HCP team members #8132
OCPBUGS-85011: fix(cpo): use check-first pattern for EBS CSI operator serving cert #8418
CNTRLPLANE-3329: Extend EFS-backed build cache to lint, verify, and envtest workflows #8495
NO-JIRA: ci(deps): bump cloudflare/wrangler-action from 3.15.0 to 4.0.0 #8524
OCPBUGS-85763: Fix metrics-proxy deployment failure due to dots in volume names #8530
GCP-636: feat(gcp): support for managing GCP OIDC discovery documents #8413
OCPBUGS-84307: Clarify –base-domain flag default behavior #8381
AUTOSCALE-681: various karpenter and karpenterupgrade test fixes #8510
CNTRLPLANE-3329: Replace actions/cache with EFS-backed build cache in unit tests #8494
OCPBUGS-85577: Update external-dns image from 1.1.0-3 to 1.2.1 #8506
OCPBUGS-77827: fix(api): add missing has() guards to servingCerts CEL validation rule #8331
CNTRLPLANE-3380: docs: add aws-node-termination-handler to repositories list #8514
OCPBUGS-85580: Fix webhook TLS failure after service-ca to self-managed cert migration #8504
build(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.0 in /hack/tools #8481
OCPBUGS-85344: Add version gates for 4.22 backward compatibility in e2e tests #8466
AUTOSCALE-681: remove TechPreviewNoUpgrade gate from karpenter upgrade test #8498
CNTRLPLANE-3329: Mount EFS-backed Go build cache PV on ARC runner pods #8493
NO-JIRA: docs: add repositories page listing team-owned repos #8505
CNTRLPLANE-3329: Add nightly CronJob to warm EFS-backed Go build cache #8496
CNTRLPLANE-3324: Restore non-obvious comments after gocyclo refactor #8487
AUTOSCALE-558: Expose KubeletConfig on OpenShiftEC2Nodeclass as structured fields + preserveunknown/overflow #8192
NO-JIRA: Fix docs deploy preview by replacing gh CLI with curl #8488
CNTRLPLANE-2946: Move AWS NLB annotation inside LoadBalancer strategy block #7993
OCPBUGS-78539: re-add crash toleration for dns-operator during upgrades #8483
CNTRLPLANE-3384: Remove unconditional low-quality log messages from controllers #8428
OCPBUGS-84971: Gate AWSDefaultSecurityGroupDeleted condition to AWS platform #8415
CNTRLPLANE-3324: Enable gocyclo linter and reduce cyclomatic complexity #8309
NO-JIRA: fix(karpenter): resolve HCP karpenter finalizer when AutoNode is disabled #8404
OCPBUGS-62177: verify cert revocation against all KAS pods #8263
NO-JIRA: Document CEL over webhooks policy for AI agents #8478
NO-JIRA: docs(kubevirt): add how-to for configuring VMs with JSON patches #8473
CNTRLPLANE-1741: Migrate gomaxprocs-webhook pipelines to use common-operator-build #7122
NO-JIRA: docs: update api-sme agent and api/AGENTS.md conventions #8477
OCPBUGS-81686: fix(authentication): use v2 auth validation for CEL and expression support. #8246
OCPBUGS-85084: fix(ci): use explicit lease in dependabot commit fix push #8476
OCPBUGS-75887: fix(inplaceupgrader): include node name in degraded upgrade error message #8244
NO-JIRA: fix(e2e): prevent agent unbinding and node reboots during backup/restore #8356
NO-JIRA: Update GHA docs for reusable workflow pattern #8453
GCP-413: add image registry v2 e2e tests for hosted clusters #8412
NO-JIRA: docs: make CLAUDE.md a symlink to AGENTS.md across the repo #8444
CNTRLPLANE-2778: feat(tooling): overhaul pr-report skill and Python script #7754
ACM-33601: use the latest ubi9 nginx image #8432
GCP-414: add image registry operational guide #8455
OCPBUGS-84528: clarify pull secret in-place update behavior and add CP watches #8327
OCPBUGS-84955: Add render-sensitive flag to hypershift install render #8436
OCPBUGS-84857: bump go builder and ubi images #8437
GCP-410: fix(gcp): add registry SA WIF binding for image registry GCS access #8445
CNTRLPLANE-3381: CPO: Surface cloud resource deletion timeout as a status condition #8426
OCPBUGS-85084: fix(ci): rewrite dependabot commit messages to pass gitlint #8435
NO-JIRA: docs: detail release branch e2e config steps in branch-process guide #8441
CNTRLPLANE-3222: Migrate self-managed Azure e2e tests to v2 Ginkgo framework #8204
GCP-412: add envtest cases for GCP imageRegistry CEL validation #8411
CNTRLPLANE-2939: Coordinate CRD lifecycle with Cluster CAPI Operator #7996
OCPBUGS-77040: Add AWS ISO domains to konnectivity IsCloudAPI #8251
OCPBUGS-83328: fix skipProxyForKAS to use standard NO_PROXY matching #8254
OCPBUGS-84969: fix(e2e): wait for Karpenter node cleanup in parallel tests to prevent vCPU flake #8414
CNTRLPLANE-3343: Extract support/k8sutil package from support/util #8396
TRT-2653: Revert #8357 “OCPBUGS-84572: fix(cpo): generate EBS CSI driver operator serving cert in CPO” #8417
NO-JIRA: chore(deps): weekly dependabot consolidation #8410
NO-JIRA: Skip TestKarpenter for releases < 4.22 #8409
CNTRLPLANE-3351: e2e: add opt-in CPU resource request overrides for control plane components #8385
OCPBUGS-84509: Add AWS LB Controller cross-zone load balancing annotation #8344
OCPBUGS-84572: fix(cpo): generate EBS CSI driver operator serving cert in CPO #8357
OCPBUGS-81631: fix(metrics): remove noisy vCPU log for non-AWS platforms #8169
NO-JIRA: Extend timeout for CRD removal during integration tests #8366
NO-JIRA: chore(deps): weekly dependabot consolidation #8395
OCPBUGS-83868: prevent IAM resource leaks during cluster destroy #8303
GCP-635: feat(gcp): make JWKS file optional when OIDC issuer URL is provided #8339
OCPBUGS-83757: Remove network dependencies from unit tests #8277
ci(deps): bump actions/setup-go from 5.6.0 to 6.4.0 #8393
OCPBUGS-84508: Fix NLB name parsing for EKS Auto Mode hostnames #8343
AUTOSCALE-615: include Karpenter node vCPUs in billing metric #8265
CNTRLPLANE-3352: Convert GHA callers to use reusable workflows @main #8387
CNTRLPLANE-3342: Extract support/netutil package from support/util #8360
CNTRLPLANE-3352: Add reusable GHA workflow definitions #8386
GCP-410: feat(gcp): add HCCO credential propagation for GCP image registry #7896
OCPBUGS-84551: fix(ingress): set FIPS_ENABLED env var on ingress operator #8375
CNTRLPLANE-3307: add unit tests for Azure Private Link Service controllers #8285
CNTRLPLANE-3160: Drop AutoNodeKarpenter feature gate and promote EC2NodeClass to v1 #8166
NO-JIRA: Improve commit and PR guidance in AGENTS.md #8373
OCPBUGS-83790: change Azure workload identity webhook FailurePolicy from Fail to Ignore #8288
NO-JIRA: chore(deps): weekly dependabot consolidation #8334
NO-JIRA: Add API dependency import restriction tool #8364
SPLAT-2587: aws/ccm: introduce configuration to CCM managed Security Groups for NLB #7460
NO-JIRA: add –max-depth flag to nav order verification #8372
NO-JIRA: Do not import external dependencies into API packages #8355
CNTRLPLANE-3340: Extract support/podspec package from support/util #8354
OCPBUGS-84251: fix(azure): detect and replace stale role assignments on cluster re-creation #8322
OCPBUGS-84236: Guard Infrastructure CR lookup in AWSEndpointServiceReconciler #8315
fix: OCPBUGS-78575: create virt-launcher NetworkPolicy on external infra cluster #8056
CNTRLPLANE-3330: ci: improve unit test speed with sharding and parallelism #8330
CNTRLPLANE-3313: add Etcd Snapshot Backup (Tech Preview) DR documentation #8299
CNTRLPLANE-2834: add e2e test for etcd snapshot backup method on AWS #8231
docs: NO-JIRA: clarify serialization tag behaviour in api/AGENTS.md #8328
OCPBUGS-84248: Remove hardcoded quay.io credentials from EnsureGlobalPullSecret test #8320
NO-JIRA: ci(deps): bump GitHub Actions dependencies #8333
OCPBUGS-77529: clean stale mock files before make generate function #8237
OCPBUGS-79471: fix(test): reduce e2e autorepair flakes from unhealthy node conditions #8278
NO-JIRA: docs: clarify that control plane downgrades are not supported #8314
CNTRLPLANE-2204: improve AllNodesHealthy and AllMachinesReady conditions #8247
GCP-431: feat: Add CNCC support for GCP WIF in HyperShift #7824
OCPBUGS-83410: fix, cno, skip cloud-network-config-controller check on non-cloud platforms #8238
Revert “OCPBUGS-83730: Add *.apps wildcard to base domain Private DNS zone for Azure private clusters” #8301
NO-JIRA: docs: add jira:ready-to-solve to agentic SDLC workflow #8304
OCPBUGS-83397: Fix concurrent CRD reconciliation race #8266
NO-JIRA: MCE 5.0 branch cut #8290
OCPBUGS-83751: add missing RBAC for webhook configurations #8276
OCPBUGS-83730: Add *.apps wildcard to base domain Private DNS zone for Azure private clusters #8273
NO-JIRA: chore: pass COMMIT_HASH build arg to support git worktrees #8279
OCPBUGS-78539: revert temporary crash toleration for dns-operator #7994
CNTRLPLANE-3296: fix: auto-create python venv in Makefile for verify targets #8269
OCPSTRAT-2499: docs(e2e): add AI agent guidance for v2 test framework #8207
AUTOSCALE-490: increase autonode test coverage #7979
OCPBUGS-83604: fix(kubevirt): filter link-local addresses from EndpointSlice endpoints #8264
NO-JIRA: fix(test): set 1h time limit on e2e capacity reservations #8208
NO-JIRA: docs(agents): add CRD API machinery fundamentals and envtest docs #8236
OCPBUGS-83585: Wait for CRD removal in GenerateCRDInstallTest to fix flaky envtest #8261
NO-JIRA: drop redundant api_ux_validation e2e test #8210
CNTRLPLANE-3255: enable CodeRabbit reviews on draft PRs #8250
CNTRLPLANE-635: Enable nilness and unparam checks in golangci-lint #8258
AUTOSCALE-590: karpenter version logging verification #8058
CNTRLPLANE-3259: Add sdminonne, clebs, and Nirshal to core-reviewers #8252
ci(claude): add konflux-build command for manual non-expiring builds #7964
NO-JIRA: fix(e2e): handle uint64 underflow in karpenter version computation for 5.x #8227
CNTRLPLANE-3174: Add unit tests for v2 CPO controller packages #8215
OCPBUGS-83538: fix(metrics-proxy): resolve ports from pods instead of deployments #8221
CNTRLPLANE-3260: fix(ci): split docs-preview into build+deploy to eliminate pwn request #8256
CNTRLPLANE-3203: Add autoscaling documentation for self-managed Azure #8239
NO-JIRA: add ENVTEST_JOBS knob for parallel envtest execution #8243
CNTRLPLANE-3260: ci: harden GitHub Actions workflows #8253
CNTRLPLANE-3214: add envtest suites for HCPEtcdBackup CRD validation #8199
CNTRLPLANE-3254: Sort how-to guides alphabetically and add CI enforcement #8248
OCPBUGS-67228: fix(shared-ingress): bump haproxy to 3.0.5-4.el10_1.1 #7370
CNTRLPLANE-3065: docs: add Agentic Software Development Life Cycle page #8235
OCPCLOUD-3347: feat(machine-approver): add TLS configuration options to deployment manifests #8019
OCPBUGS-83389: fix(supportedversion): normalize OCP 5.x versions for skew and release validation #8225
SREP-4438: refactor(karpenter): tidy Cincinnati version resolution #8206
NO-JIRA: revert: remove .git/ from .dockerignore #8201
CNTRLPLANE-3197: add release-4.22 branch to renovate configuration #8196
CNTRLPLANE-3197: update builder images from 4.22 to 4.23 #8194
CNTRLPLANE-3216: Add codecov.yml validation to make verify #8202
GCP-368: add GCP CCM v2 e2e tests #7840
CNTRLPLANE-3233: ci(gha): add release-4.22 branch to GitHub Actions workflows #8217
And 5 elided commits (e.g. from squash or rebase merges)
Full changelog

ibm-cloud-controller-manager

OCPBUGS-83587: bump google.golang.org grpc v1.79.3 #106
NO-JIRA: Update OWNERS #95
Full changelog

ibm-vpc-block-csi-driver

NO-JIRA: Bump gRPC library to v1.79.3 and replace golang.org/x/net/context with context #149
Full changelog

ibmcloud-cluster-api-controllers

NO-JIRA: manifests-gen: scope provider webhooks to capi namespace #160
OCPCLOUD-3359: Add TLS substitutions #158
NO-JIRA: Update manifests generator #159
NO-JIRA: Update OWNERS #156
Full changelog

ibmcloud-machine-controllers

NO-JIRA: Update OWNERS #93
Full changelog

insights-operator

OCPBUGS-85710: add trusted-ca-bundle to gatherin job #1289
CCXDEV-16348: tls metrics #1275
OCPBUGS-77351: fix: add terminationMessagePolicy to runtime extractor containers #1286
NO-JIRA: remove BaiyangZhou from OWNERS #1273
OCPBUGS-85201: Bump google.golang.org/grpc to v1.79.3 #1288
NO-JIRA: Update golang version #1277
NO-JIRA: add write-test claude skill #1274
CCXDEV-15561: Improve test coverage 4 #1226
Full changelog

installer-artifacts

CORS-4495: Populate RHCOS10 Marketplace Stream #10556
MCO-2181: Set OSImageStream default in install-config #10570
OCPBUGS-84656: Update RHCOS-release-4.22 bootimage metadata to 10.2.20260423-0 / 9.8.20260428-0 #10524
no-jira: PowerVS: Remove unrequired logging #10552
CORS-4005: refactor worker manifest serialization #10407
OCPEDGE-2115: types: support MAC address as alternative identifier for fencing credential #10513
METAL-1731: baremetal: Add coreos.openshift.io/stream label to BMH and hostSelector #10502
OCPBUGS-78126: baremetal: fix gather bootstrap failing with provisioningNetwork Disabled #10395
SPLAT-2452: Add SetSecurityGroups IAM permission to master nodes for BYO SG support for AWS NLBs #10512
MCO-2164: use machine-config-osimagestream to avoid hard-coding image tag names #10416
no-jira: images: bump UPI image dependencies to 4.22 #10538
MCO-2200: refactored node-joiner to use embedded rhcos data #10537
OCPBUGS-79536: Removing AWS security group OVNDB ports as they are no longer used #10441
OCPBUGS-85232: PowerVS: Add port 80 security group rule #10541
no-jira: tests: verify AWS instance type minimum cpu and mem requirement tests #10536
NO-JIRA: pkg/types/nutanix: warn about unused context #10430
SPLAT-2710: Added vSphere day 2 support #10529
OCPBUGS-67159: openstack: Reserve addresses for load balancer #10375
OCPBUGS-77760: verify FIPS mode after installation completes #10348
OCPBUGS-84873: Fix to agent integration test finding agent-tui files #10530
OCPBUGS-84335: vSphere - Missing unit tests to cover polarion workitems #10516
OCPBUGS-84548: add unit tests for Nutanix to replace polarion workitems #10520
no-jira: update to Google Cloud SDK 563.0.0 #10460
MULTIARCH-5824: PowerVS: Fix supported system types retrieval for PowerVS regions #10268
CORS-3933: Add a retry backoff for checking storage in progress #10463
SPLAT-2719: vsphere - remove HostGroup zonal feature gate checks #10497
OCPEDGE-2255: baremetal: reject SNO installation on baremetal platform #10420
OCPBUGS-78932: Improved DHCP network deletion reliability by proactively cleaning up attached network interfaces before retrying deletion #10325
OCPBUGS-83327: PowerVS: update CAPI to v0.12.2 #10488
OCPBUGS-83335: dont save CAPI secrets #10498
AGENT-1417: Add kind verification in InternalReleaseImage check #10332
Full changelog

ironic

NO-ISSUE: Update requirements.cachito with latest openshift forks commits #821
OCPBUGS-83618: Bump sushy to latest #838
NO-ISSUE: Fix update requirements workflow #842
NO-ISSUE: Document how to use gerrit change hash for testing #839
OKD-362: Add watchdog to python-requirements.okd #837
Full changelog

ironic-agent

NO-ISSUE: Update requirements.cachito with latest ironic-python-agent #255
NO-ISSUE: Update requirements.cachito with latest ironic-python-agent #254
NO-ISSUE: Remove openstack repo workaround #249
NO-ISSUE: Update requirements.cachito with latest ironic-python-agent #253
NO-ISSUE: Update requirements.cachito with latest ironic-python-agent #248
METAL-1779: Add podman package for bootc deploy #247
NO-ISSUE: Fix update requirements workflow #252
NO-ISSUE: Document how to use gerrit change hash for testing #250
NO-ISSUE: Update requirements.cachito with latest ironic-python-agent #246
Full changelog

keepalived-ipfailover

Revert “OCPBUGS-84344: yum.conf: omit docs, weak deps” #234
OCPBUGS-84344: yum.conf: omit docs, weak deps #231
Full changelog

machine-api-operator

OCPBUGS-85416: Enable actuators to set terminal failure on Exists and Update #1499
SPLAT-2745: Changed vSphere cloud config to be read from openshift-config-managed #1495
OCPBUGS-82584: Populate status label selector for scale subresource. #1490
NO-JIRA: machine-api-termination-handler: add scc annotation, terminationMessage: FallbackToLogsOnError #1494
NO-JIRA: bump controller-runtime-common to latest main #1493
NO-JIRA: fix: importing nutanix test to in the binary #1491
NO-JIRA: Update OWNERS #1486
Full changelog

machine-config-operator

AGENT-1488: Aggregate IRI status from MachineConfigNodes #5841
OCPBUGS-63750: fix Go build tag behavior #5494
OCPBUGS-86474: Tests using realtime kernel should not be limited to a… #6084
OCPBUGS-86332: remove tests using base images older than 4.13 #6077
NO-ISSUE: Update TC-88366 to check osImageStream status after update completes #6078
AGENT-1491: reclaim disk space from the node when IRI resource is deleted #5988
OCPBUGS-86035: Adapt test ‘54922 - daemon: add check before updating kerne… #6056
AGENT-1517: fix iri deletion test #6070
OCPBUGS-83987: Fix CVE-2026-33186 #6065
OCPBUGS-84814: Skip chrony-wait on first node join #5990
MCO-2273: MCO-2215: MCO-2183: Migrate remaining TCs from mco.go to MCO, units, kublet suite #6024
AGENT-1517: disable iri-registry service on IRI delete #6041
OCPBUGS-85237: Manually uncordoned nodes are not automatically re-cordoned #6028
OCPBUGS-15157: Replace wildcard permissions with explicit verbs and resources in MCC ClusterRole #6000
OCPBUGS-65645: Verify extension packages are installed #6010
OCPBUGS-79502: Enable AutoSizingReserved for Hypershift workers #5847
NO-JIRA: daemon: expand os image presence check #6005
MCO-2212: MCO-2213: Migrate mco_observability and mco_daemon test-suite #5875
OCPBUGS-63650: configure-ovs: copy lldp mode to br-ex port #5698
OCPBUGS-85498: BareMetal skew e2e fails patching provisioning CR after CBO webhook fix #6031
OCPBUGS-85497: only check password hash in /etc/shadow #6030
NO-JIRA: Add fix for ossImagestream status #6018
MCO-2025: OCP-88366 and add OCP-88814 for osImageStream with osImageURL #6014
OCPBUGS-83830: Apply password only if changes exist #5889
AGENT-1514: Add ML-KEM verification test for IRI registry #6003
OCPBUGS-84516: Add terminationMessagePolicy to build pod containers #5993
OCPBUGS-85117: Fix 2 flakes happening in the ocl test suite #6004
OCPBUGS-84842: Bootloader update attempt should be conditional #5907
OCPBUGS-75894: use --delete-if-present for karg removal #5914
OCPBUGS-84661: Fix wrong early exit during kubelet MCs regeneration #5898
AGENT-1443: IRI Add certificate regeneration to MCS cert rotation controller #5721
OCPBUGS-84691: prom rules: add alert for nodes using runc #5874
MCO-1908, MCO-2213: Migrate MCD related MCO test-cases #5843
OCPBUGS-84867: Fix OCL test to handle temporarily empty current-machine-os-build annotation #5913
OCPBUGS-84832: daemon: don’t pull/extract extensions for all OS updates #5905
OCPBUGS-84852: Update AMI Whitelist #5910
OCPBUGS-84150: MachineOSConfig “build was not found” error #5878
OCPBUGS-84699: Custom pool booting must handle matchExpressions in nodeSelector #5899
OCPBUGS-84565: Fix CVE-2026-34986 #5890
OCPBUGS-83871: Support bootloader update #5868
OCPBUGS-84332: Fix ssh and password rollbacks #5884
MCO-2222: /automate-test skill for generating e2e tests from specifications #5864
OCPBUGS-84652: Include RootCA in the temporal CC #5896
OCPBUGS-83492: Auto-append :ref suffix to additionalLayerStores in storage.conf #5888
OCPBUGS-83826: deploy-from-self when skopeo < 1.22.2 #5867
OCPBUGS-84490: Bump image build timeout for status reporting test #5886
MCO-2201: Improve /migrate-tests skill: default labels and ordering verification #5879
OCPBUGS-83859: Fix encapsulated IGN version #5872
MCO-1494: Remove monolithic e2e-ocl test suite #5880
AGENT-1449: Add IRI registry authentication support to MCO #5765
OCPBUGS-84218: Fix units rollback if update failure #5876
OCPBUGS-79425: improve JSON unmarshalling for secret decoding #5813
OCPBUGS-83401: add RootCA cert to the sysContextBuilder certs #5861
OCPBUGS-82500: ClusterHostedDNS on AWS/Azure/GCP: Modify Corefile template to better handle empty record types #5844
MCO-2201: Add Claude /migrate-tests command for MCO test migration #5837
MCO-1908: Migrate Kernel related MCO test-cases #5827
OCPBUGS-83539: Update AMI Whitelist #5851
OCPBUGS-78524: Allow enablement of systemd units with existing files #5846
OCPBUGS-82974: Make IRI registry read-only via environment variable #5845
OCPBUGS-81572: order corosync after OVS configuration on TNF clusters #5834
OCPBUGS-83517: Revert ovs increase CPU priority for Open vSwitch Forwarding Unit #5849
OCPBUGS-63152: Fail wait-for-node-ip if primary IP(s) disappear #5350
Full changelog

machine-image-customization-controller

METAL-1730: Add stream selection for multi-version support #175
Full changelog

machine-os-images

METAL-1730: Add stream symlinks for multi-stream support #83
OCPBUGS-85476: Force rebuild for OCP 5.0 #87
METAL-1786: Include RHEL10 in image #82
Full changelog

metallb-frr

Bump to frr 10 #127
OCPBUGS-82973: Sync 25-3-2026 #128
Full changelog

monitoring-plugin

OU-1275: remove byte order mark from dashboard text #960
COO-1776: fix: throw error for unsupported dashboard level datasources #948
OU-1269: Update monitoring-console-plugin for 4.22 #923
OU-1281: show disabled project bar while loading #936
OU-1351: prevent namespace and project desync #933
OU-1315: reset queries when namespace changes in dev perspective #932
OU-1348: fix: panel actions index so they are visible on click #928
OU-1347: fix: avoid throwing error to fallback to global datasource #920
OU-1203: upgrade perses dependencies #914
Full changelog

multus-admission-controller

OCPBUGS-85053: Bump Go version to 1.25.0 for ML-KEM/PQC support #115
Full changelog

multus-networkpolicy

CNF-21001: Remove iptables compatibility commits #108
Full changelog

must-gather

no-jira: collect OS Image Stream resource #533
CNV-41714: Add a collector for basic virt related data #539
no-jira: chore: address the linting issues in the scripts #525
MG-246: remove redundant oc inspect command and unused resources #537
Full changelog

network-interface-bond-cni

NO-JIRA: Sync upstream k8snetworkplumbingwg/master (2026-05-19) #117
NO-JIRA: Openshift Only - update owners file #111
NO-JIRA: Fix diverged git histories via upstream merge #108
Full changelog

network-tools

NO-ISSUE: Add myself back to the bug script #177
NO-JIRA: Add mattedallo, marty-power, taanyas as reviewers #172
NO-JIRA: Refresh list of team members #176
NO-JIRA: Updates to handle changes after migrating to Atlasian cloud #174
Full changelog

networking-console-plugin

CONSOLE-5218: Add project documentation and rewrite README #417
CNV-74110: new translations #404
Update dependencies for upcoming Console 4.22 release #371
OCPBUGS-83638: CVE dependency remediation #379
Full changelog

nutanix-cloud-controller-manager

NO-JIRA: Update OWNERS #61
Full changelog

nutanix-machine-controllers

NO-JIRA: Update OWNERS #136
Full changelog

oauth-apiserver

CNTRLPLANE-2518: Add support for sourcing external claims from a source that requires client credential authentication #197
CNTRLPLANE-2516: feat: externaloidc: add support for externally sourcing claims #195
CNTRLPLANE-2516: Add local configuration API for external oidc mode #194
NO-JIRA: Add control-plane-approvers to OWNERS #192
CNTRLPLANE-3226: chore: sync with openshift repositories #189
Full changelog

oauth-proxy

OCPBUGS-69836: Updating golang-github-openshift-oauth-proxy-container image to be consistent with ART for 4.22 #341
Full changelog

oauth-server

CNTRLPLANE-3226: chore: sync with openshift repositories #221
Full changelog

oc-mirror

OCPBUGS-86264: Upgrade go-jose to v4.1.4 to fix CVE-2026-34986 #1414
CLID-579: Validate BlockedImage regex #1401
OCPBUGS-64640: remove environment setup output #1384
CLID-623: Encapsulate unit test data into tests/unit #1407
CLID-479: OTE migration #1375
NO-JIRA: Update README.md for Enclave Support link #1404
CLID-612: Move integration tests within oc-mirror #1400
CLID-592: pkg/cli: add unit tests for environment setup #1391
Full changelog

olm-catalogd, olm-operator-controller

OPRUN-4607: Remove test-experimenal-e2e #732
NO-ISSUE: Synchronize From Upstream Repositories #733
NO-ISSUE: Synchronize From Upstream Repositories #730
OPRUN-4608: UPSTREAM: <carry>: Delete openshift/registry.Dockerfile #729
NO-ISSUE: Synchronize From Upstream Repositories #726
OPRUN-4607: Fix flags passed to test-experimental-e2e #723
OCPBUGS-85508: Synchronize From Upstream Repositories #725
NO-ISSUE: Synchronize From Upstream Repositories #724
NO-ISSUE: Synchronize From Upstream Repositories #722
OCPBUGS-62517: Set replicas=1, PDB, and pod anti-affinity for HA topology #709
OCPBUGS-84943: fix(test): drop blocking namespace-deletion wait between both-watch-modes scenarios #712
OCPBUGS-62517: Synchronize from Upstream Repositories #710
NO-ISSUE: UPSTREAM: <carry>: remove dead e2e registry push job and related variables #711
OPRUN-4587: Make OTE local output easier to read #704
NO-ISSUE: Synchronize From Upstream Repositories #707
NO-ISSUE: Synchronize From Upstream Repositories #706
NO-ISSUE: Synchronize From Upstream Repositories #701
OPRUN-4574: UPSTREAM: <carry>: Disable upstream TLSProfile tests #702
OPRUN-4577: OTE: Simplify by remove option to configure tests to run outside of OCP #703
OPRUN-4572: Expand OTE docs with more comprehensive details #697
OCPBUGS-77972, OCPBUGS-81452: Synchronize From Upstream Repositories #696
Full changelog

openshift-apiserver

OCPBUGS-38120: Ensure Project delete requests are passed through admission #632
NO-JIRA: Add control-plane-approvers to OWNERS #630
OCPBUGS-74511: remove RouteExternalCertificate feature gate #604
CNTRLPLANE-3226: Sync with openshift apiserver 4.22 kubernetes 1.34.1 #629
Full changelog

openshift-controller-manager

CNF-23051: Migrate away from deprecated ioutil #422
NO-JIRA: Add control-plane-approvers to OWNERS #438
Full changelog

openstack-cluster-api-controllers

NO-JIRA: manifests-gen: scope provider webhooks to capi namespace #416
OCPCLOUD-3359: Add TLS substitutions #408
UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.14 into main #390
NO-JIRA: Update manifests generator #411
OCPBUGS-77542: Updating openstack-cluster-api-controllers-container image to be consistent with ART for 4.22 #399
Full changelog

openstack-resource-controller

UPSTREAM-SYNC: Sync main with latest upstream (release-2.0) #36
UPSTREAM-SYNC:Merge https://github.com/k-orc/openstack-resource-controller:release-1.0 into main #20
Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

NO-ISSUE: Synchronize From Upstream Repositories #1307
NO-ISSUE: Synchronize From Upstream Repositories #1306
NO-ISSUE: Synchronize From Upstream Repositories #1299
OPRUN-4610: Revert lifecycle server changes #1300
OCPBUGS-54790: Fix packageserver PDB annotation for HyperShift #1297
OPRUN-4588: use AlwaysAllow UnhealthyPodEvictionPolicy option in PDBs #1280
NO-ISSUE: Synchronize From Upstream Repositories #1298
OPRUN-4601: use resource-based RBAC for lifecycle-server auth #1290
OCPBUGS-84642: Synchronize From Upstream Repositories #1291
OPRUN-4597: Fix lifecycle-server readiness probe to allow empty index #1288
OPRUN-4541, OPRUN-4544: add lifecycle-server for serving FBC catalog lifecycle metadata #1284
NO-ISSUE: Synchronize From Upstream Repositories #1286
NO-ISSUE: Synchronize From Upstream Repositories #1282
NO-ISSUE: Synchronize From Upstream Repositories #1279
Full changelog

operator-marketplace

NO-ISSUE: Bump github.com/onsi/gomega from 1.40.0 to 1.41.0 #752
NO-ISSUE: Bump github.com/fsnotify/fsnotify from 1.9.0 to 1.10.1 #747
NO-ISSUE: Bump github.com/onsi/ginkgo/v2 from 2.28.1 to 2.28.3 #746
NO-ISSUE: Bump the k8s-dependencies group across 1 directory with 3 updates #741
NO-ISSUE: Bump github.com/operator-framework/operator-lifecycle-manager from 0.41.0 to 0.42.0 #740
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

NO-JIRA: Revert “OCPBUGS-61065: Adding ovndb-raft-functions.sh to ovnk image” #3192
NO-JIRA: DownStream Merge [05-07-2026] #3177
TRT-2652: Allow OTE info and list tests commands to work without KUBECONFIG #3170
NO-JIRA: DownStream Merge [04-30-2026] #3169
NO-JIRA: DownStream Merge [04-27-2026] #3159
NO-JIRA: OTE: run EVPN external traffic tests which use random subnet for VTEP #3148
OCPBUGS-84037: OTE: tolerate missing OpenShift CRDs on MicroShift #3150
CORENET-6537: OTE: Add external container support to infra provider #2975
NO-JIRA: openshift tests: demote to informing #3131
Full changelog

powervs-block-csi-driver

MULTIARCH-6066: Rebase branch with upstream #126
Full changelog

powervs-cloud-controller-manager

OCPBUGS-83391: Merge https://github.com/IBM-Cloud/cloud-provider-ibm:release-1.35 (e48649f) into main #83
Full changelog

prom-label-proxy

NO-ISSUE: [bot] Bump openshift/prom-label-proxy to v0.13.0 #394
Full changelog

prometheus

NO-ISSUE: [bot] Bump openshift/prometheus to v3.11.3 #318
NO-ISSUE: [bot] Bump openshift/prometheus to v3.11.3 #317
OCPBUGS-62118: fix TLS client cert rotation when no CA is configured #312
NO-JIRA: Upgrade Prometheus to 3.11.2 #305
Full changelog

prometheus-alertmanager

NO-ISSUE: remove ui/app/dist/.build_stamp #133
NO-ISSUE: [bot] Bump openshift/prometheus-alertmanager to v0.32.1 #132
NO-ISSUE: Bump openshift/prometheus-alertmanager to v0.32.0 #129
NO-ISSUE: update OWNERS #130
Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

NO-ISSUE: [bot] Bump openshift/prometheus-operator to v0.91.0 #380
Full changelog

prometheus-node-exporter

OCPBUGS-83863: Strip debug symbols from Go binaries #180
NO-JIRA: [bot] Bump openshift/node_exporter to v1.11.1 #177
Full changelog

route-controller-manager

OCPBUGS-39598: Remove all duplicate ingress IP addresses in clearPersistedAllocation #91
OCPBUGS-83892: Update grpc-go and x/net #88
Full changelog

service-ca-operator

CNTRLPLANE-2894: e2e network policy test cases #338
NO-JIRA: Add control-plane-approvers to OWNERS #345
NO-JIRA: controller/servingcerts: Align log verbosity #323
Full changelog

telemeter

OCPBUGS-85082: update google.golang.org/grpc #601
NO-ISSUE: add .coderabbit.yaml #603
NO-ISSUE: bump golangci-lint to v2.11.3 #602
NO-ISSUE: update OWNERS #604
OCPBUGS-84383: fix(deps): bump go-jose/v3 to v3.0.5 for JWE unwrap DoS #588
Full changelog

tests

NO-ISSUE: Automated - Update synthetic test data #31192
OCPBUGS-86328: if rhcos9-10 in the job name,update jobname test #31198
OCPNODE-4535: Automate OCP-44820 change container registry config #31182
OCPBUGS-85363: Fixed flakiness of oc set image E2E tests #31191
OCPNODE-4125: fix imagepolicy image config testcase #31185
CNTRLPLANE-3428: tls fix HyperShift guest-side CO wait and Custom profile handling #31194
TRT-2669: Revert #31112 “NO-JIRA: Remove fixed bugs on CO conditions (2)” #31201
AGENT-1517: refactored the logic to filter IRI related MachineConfigs #31179
OPRUN-4569: test: remove OLMv1 OTE exceptions; scope OLMv0 exceptions to SNO #31172
NO-JIRA: Remove fixed bugs on CO conditions (2) #31112
OCPBUGS-85378: Fix OCP E2E test - Object count when exceed openshift.io/image-tags will ban to create new image references in the project #31155
NO-ISSUE: Automated - Update synthetic test data #31181
NO-JIRA: Fix flaky storage-admin e2e test #31180
CNTRLPLANE-3428: tls: introduce narrow target types and migrate test functions #31160
Revert “OCPBUGS-85363: Fixed flakiness of oc set image E2E tests” #31188
OCPBUGS-85370: Raise OpenStack operator watch limits #31154
OCPBUGS-85363: Fixed flakiness of oc set image E2E tests #31152
OCPBUGS-85058: monitortests: allow etcd CO blips during TNF jobs on two-node upgrades #31138
OCPBUGS-85486: stage the creation of test pods to minimize etcd impact #31164
OCPNODE-4505: Automation creation of OCP-57401 #31142
OCPBUGS-83623: fix: add distruption tolerance for DualReplica (two-node) topology #31127
OCPBUGS-85531: Fixed flakiness in OCP E2E tests - oc debug image stream #31168
Revert “OPRUN-4569: test: remove OTE exceptions for OLM” #31171
OCPNODE-4108: add E2E tests for upstream dra-example-driver #31064
OPRUN-4569: test: remove OTE exceptions for OLM #31150
OCPEDGE-2386: Add tnf_etcd_disruption test with 5 new etcd resilience tests. #30880
NO-JIRA: Improve graceful shutdown LB test output with more details of late requests #31158
OCPNODE-4047: Implement kubelet TLS 1.3 via KubeletConfig on workers #31016
NO-ISSUE: Automated - Update synthetic test data #31146
CNTRLPLANE-3374: remove multus exception from monitor test #31130
CNTRLPLANE-3428: tls: extract annotation and ConfigMap update helpers #31156
OCPBUGS-83580: Skip dev fuse test on runc runtime #31140
OCPBUGS-84516: remove openshift-machine-config-operator exemption from terminationMessagePolicy monitor #31120
CNTRLPLANE-3387: Update list of pending namespaces in the required-scc monitor test #31135
NO-ISSUE: improve error reporting in cpumetriccollector #31132
no-jira: tls: deduplicate ConfigMap helpers into standalone functions #31136
OCPBUGS-84500: Verify dynamic revision bump for etcd during kernel crash #30915
OCPNODE-3983: Add e2e tests for KubeletEnsureSecretPulledImages feature gate #31102
OCPNODE-4381: Migrate OCP-38271 from openshift-tests-private #30960
OCPBUGS-85087: Allow OVN-Kubernetes CIDROverlap pathological events #31131
NO-JIRA: Increase pathological event thresholds for API server rollout scenarios #31122
CNTRLPLANE-2554: Add ExternalOIDCWithUpstreamParity e2e tests #31028
: no-jira: tls: extract injectTLSAnnotation constant #31125
OCPSTRAT-3036: Update etcd test data for k8s 1.36 release #31113
OCPNODE-4043: Fix NVIDIA DRA driver helm repo configuration #31104
TRT-2644: Run CP tests everywhere #31094
NO-JIRA: Remove fixed bugs on CO conditions #31081
OCPBUGS-84831: Optimize NetworkPolicy reconciliation test to reduce timeout #31114
NO-ISSUE: Automated - Update synthetic test data #31109
OCPBUGS-84809: Disable particular CSI tests if CSI driver is removed #31107
NO-JIRA: check jobname for upgrade #31106
OCPBUGS-84520: remove openshift-catalogd exemption from terminationMessagePolicy monitor #31100
OCPNODE-2994: Add ArtifactVolume tests and register artifact image #31017
NO-ISSUE: add QSEs as approvers #31087
SPLAT-2562: Added 3CMO OTE binary to extensionBinary list #31004
OCPCLOUD-3429: Ignore excessive image volume events from CAPI operator #31093
TRT-2622: copy OTE attrs to junit properties #31052
OCPBUGS-83580: Skip dev fuse test on runc runtime #31044
SREP-4676: add exception for managed cluster namespaces #31082
OCPBUGS-84257: fix openshift/network/third-party suite selecting zero tests #31084
TRT-2084: comment bugs filed for terminationMessage exemptions #31079
OCPBUGS-84504: retry transient kubeconfig read failures in GetClientConfig #31080
TRT-2565: Add simple benchmark for risk analysis HTTP requests #30965
NO-JIRA: Fix ListImages JSON parsing when extension binaries emit log lines #31009
OCPBUGS-84255: Fix project name error during wait #31062
NO-JIRA: Skip network policy cases on microshift and hypershift #31075
OCPBUGS-79544: test: add monitortest to detect pods stuck in Pending state #31045
OCPBUGS-79544: Add [Late] test to collect CRI-O goroutine dumps via SIGUSR1 #31013
NO-ISSUE: Automated - Update synthetic test data #31063
OCPBUGS-82072, OCPBUGS-82077: fix: skip unused tests for two node #30998
OCPBUGS-82144: Remove EnsureMemberRemoved from graceful shutdown test #30981
OCPEDGE-2381: Validate no WAL corruption when both nodes shutdown gracefully #30925
SPLAT-2562: Added VVCDO OTE binary to extensionBinary list #31014
NO-JIRA: harden watch loop to prevent thread exhaustion #30956
OCPBUGS-84244: cache kube client instance #30997
OCPBUGS-83281: Fix Gateway cleanup in parallel e2e test workers #31023
OCPBUGS-84237: skip on BM which has insufficient host #31002
OCPBUGS-83405: remove unnecessary exceptions from monitoring test #30924
NO-ISSUE: baremetal: update OWNERS #31055
OTA-1977: Skip test case updateLifecycle if the worker pool is paused #31040
OCPBUGS-82160: Skip image-registry operator tests for Libvirt platform in upgrade jobs. #31001
OCPEDGE-2284: Rename two_node directory to edge_topologies #30623
OCPBUGS-83402: Bump oc request-timeout to deflake tests #31008
OCPBUGS-82304: Add sleep to give cvo time to reconcile #30988
OCPBUGS-63307: Move imagepolicy test to disruptive long-running suite #31043
NO-JIRA: OVNK BGP: allow max unavailability for NNCPs on VRF-Lite test case #31037
OCPBUGS-83801: skip serial and disruptive cases from suite #31042
TRT-2635: coderabbit: enable request changes workflow #31047
TRT-2084: terminationmessagepolicy: correctly fail on violations #30993
OCPBUGS-84036: CNTRLPLANE-2751:Adding e2e network policy cases for config-operator #30995
OCPEDGE-2510: fix(two-node): bump node replacement timeouts for new node installer pods #31005
OCPBUGS-81476: Fix timeout in PinnedImages GC test #30962
OCPBUGS-63307: honor firstTimestamp annotation value #31021
no-jira: test/monitoring: increase load balancer readiness and curl connection timeout #30994
NO-JIRA: Fix UpgradeTargetPayloadImagePullSpec #31025
OCPSTRAT-3082: TLS propagation test #30801
NO-JIRA: OVNK BGP: improve debug and increase NNCP timeout for VRF-Lite test case #31022
OCPBUGS-83286: Fix case-sensitive error matching in Whereabouts IP allocation test #31012
OCPBUGS-83267: Use upgrades.Skippable for Gateway API upgrade test skip logic #31000
OCPEDGE-2381: Add test to verify for backup container exists when etcd crashes #30922
STOR-2807: Add e2e test to verify CSI driver operators use service CA signed certificates #30980
OCPEDGE-2381: Verify etc pod should start with oom_score_adj as system-node-critical #30982
Full changelog

vsphere-cloud-controller-manager

NO-JIRA: Update OWNERS #119
Full changelog

vsphere-cluster-api-controllers

OCPBUGS-53005: Remove references to master branch #111
OCPBUGS-83600: Merge https://github.com/kubernetes-sigs/cluster-api-provider-vsphere:v1.15.3 (e917f8e) into master #107
NO-JIRA: manifests-gen: scope provider webhooks to capi namespace #106
OCPCLOUD-3359: Add TLS substitutions #99
NO-JIRA: Update manifests generator #100
NO-JIRA: Update OWNERS #96
Full changelog

vsphere-csi-driver-operator

SPLAT-2562: Created OTE extension with tests for hybrid env #335
Full changelog

vsphere-problem-detector

OCPBUGS-56274: add datacenter consistency check #212
Full changelog

Node Image Info

Loading node image info, this may take a while ...

Unable to show node image info: too many concurrent oc adm release info --rpmdb/--rpmdb-diff operations (limit 16)

View changelog in Markdown or change previous release:

Source code for this page located on github