4.13.59

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.13.59-x86_64

Team Approvals:

Accepted
- QE

Tests:

Blocking jobs
- upgrade Succeeded release-openshift-origin-installer-e2e-aws-upgrade
- upgrade-minor Succeeded release-openshift-origin-installer-e2e-aws-upgrade
Informing jobs
- aws-sdn-serial Succeeded periodic-ci-openshift-release-master-nightly-4.13-e2e-aws-sdn-serial
- aws-sdn-upgrade-4.13-micro Succeeded periodic-ci-openshift-release-master-nightly-4.13-e2e-aws-sdn-upgrade
- azure-ovn-upgrade-4.13-micro Succeeded periodic-ci-openshift-release-master-ci-4.13-e2e-azure-ovn-upgrade
- fips-scan Succeeded periodic-ci-openshift-release-master-nightly-4.13-fips-payload-scan
- gcp-ovn-rt-upgrade-4.13-minor Succeeded (1 retries) periodic-ci-openshift-release-master-ci-4.13-upgrade-from-stable-4.12-e2e-gcp-ovn-rt-upgrade
- metal-ipi-ovn-ipv6 Succeeded periodic-ci-openshift-release-master-nightly-4.13-e2e-metal-ipi-ovn-ipv6
- metal-ipi-sdn-bm Succeeded (1 retries) periodic-ci-openshift-release-master-nightly-4.13-e2e-metal-ipi-sdn-bm

Upgrades from:

Untested upgrades: 4.12.19, 4.12.20, 4.12.21, 4.12.22, 4.12.23, 4.12.24, 4.12.25, 4.12.26, 4.12.27, 4.12.28, 4.12.29, 4.12.31, 4.12.32, 4.12.33, 4.12.34, 4.12.35, 4.12.36, 4.12.37, 4.12.38, 4.12.39, 4.12.40, 4.12.41, 4.12.42, 4.12.43, 4.12.44, 4.12.45, 4.12.46, 4.12.48, 4.12.49, 4.12.50, 4.12.51, 4.12.53, 4.12.54, 4.12.56, 4.12.57, 4.12.58, 4.12.59, 4.12.60, 4.12.61, 4.12.62, 4.12.63, 4.12.64, 4.12.65, 4.12.66, 4.12.67, 4.12.68, 4.12.69, 4.12.70, 4.12.71, 4.12.72, 4.12.73, 4.12.74, 4.12.75, 4.13.10, 4.13.11, 4.13.13, 4.13.14, 4.13.15, 4.13.16, 4.13.17, 4.13.18, 4.13.19, 4.13.21, 4.13.22, 4.13.23, 4.13.24, 4.13.25, 4.13.26, 4.13.27, 4.13.28, 4.13.29, 4.13.3, 4.13.30, 4.13.31, 4.13.32, 4.13.33, 4.13.34, 4.13.36, 4.13.37, 4.13.38, 4.13.39, 4.13.4, 4.13.40, 4.13.41, 4.13.42, 4.13.43, 4.13.44, 4.13.45, 4.13.46, 4.13.48, 4.13.49, 4.13.5, 4.13.50, 4.13.51, 4.13.52, 4.13.53, 4.13.55, 4.13.6, 4.13.7, 4.13.8, 4.13.9

Upgrades to:

4.14.0-0.ci-2025-07-11-082316 (changes) - Pending Pending

Loading changelog, this may take a while ...

Changes from 4.13.35

Created: 2025-07-10 09:31:35 +0000 UTC

Image Digest: sha256:48a6e945ec773cc836607c47e7c0d99b58a28e98a55a41879c664e7f759452d8

Components

Kubernetes upgraded from 1.26.13 to 1.26.15
Red Hat Enterprise Linux CoreOS upgraded from 413.92.202402201247-0 to 413.92.202507061732-0 (diff)

Rebuilt images without code change

alibaba-cloud-controller-manager git e41e11cc sha256:e764ac278d8ec6daa75d5231d8ef4c209b177a355cac989ec0d016c036f0be4f
alibaba-cloud-csi-driver git 6384f904 sha256:54cab31d870455c7c027792f34a1026ecc0804f46ee018f98f568ff3dff7bdb9
alibaba-disk-csi-driver-operator git 7e415973 sha256:77548312f4d9a58c61a7e4cdaf4d437e75d2fc5997e1da1523892b5cac400838
alibaba-machine-controllers git 4c0f96a6 sha256:a4ffbbce7b2cde7e315980c1a27d261fa6c0634bbb12e52ce2a692bae82bc387
aws-machine-controllers git e1a57b5e sha256:349d763a966890c51e62f1740cc558b03447ec2cc3857a20c9264e472dd4d681
azure-cloud-controller-manager git bf9bd022 sha256:40ce4157fffa063319225ee605e362f318d8a90ed10ca0975d688c46bf9cc677
azure-cloud-node-manager git bf9bd022 sha256:d78045cb629230d139657952ea3e058fe4f7d7c20b1bec79fc8b381e03c50893
azure-disk-csi-driver git b6d3fbcb sha256:8fcd80c0f4d0e23fe9c0133bec5ba203c3ff3556163a5688e7ea731aed6e6a5b
azure-disk-csi-driver-operator git 8534d756 sha256:6612ce12789cf6e593d7912675e898f7205d96445d4b12332e89408111539eed
azure-file-csi-driver-operator git 70e05302 sha256:e11a05833524567e8efdb9a8b762b6c05c49585ec738bf96f893278b75c69adc
baremetal-runtimecfg git 1280cf54 sha256:088a75b47dd4b2382309b1d10034dc0086fe3a612af24081c5ebb67d476a2101
cluster-authentication-operator git 1801056c sha256:b07ba5c9349681a435fd065eecfec809420c76ffada75cf48a00b22078ebb5d3
cluster-bootstrap git ee908b6b sha256:1255260eb601709ee2ab8551933d5e06db7a84228b6296d2d64094a86c5e7ff9
cluster-capi-controllers git 12f767b2 sha256:d52e1956166164f0be942c480084a4887540bc0ac3189f8acdb2d1fd57710040
cluster-capi-operator git b247793d sha256:808d4a3410320019ce938e32a6fbc1e1caece0da51dfb930fbd62e5dc1620897
cluster-kube-cluster-api-operator git 18c076b1 sha256:4f10fc297e274895484bddd01c517a380f660d4f2d88897d48958185cd93124b
cluster-kube-controller-manager-operator git dac71136 sha256:78fa5c33b81e1da83156e06f81bae0078794d6fed09fa4e3eb828de9853984c3
cluster-kube-scheduler-operator git 2e7c269b sha256:a032bcc352135dfcd9b8558a421bab589470f7c8ceb445d39c81f815c1542833
cluster-kube-storage-version-migrator-operator git 721de5d6 sha256:e93d57caa773b45c3bc33e67e185a0f7645cd21d03293936fe94fbca30f62cc4
cluster-machine-approver git 25fe7b4b sha256:5dc606a2faec2818bcabb68a7aa211d2d1c1c53c5afe78799b5493f61505018d
cluster-openshift-apiserver-operator git 9abb220a sha256:291406ee9368b6d47fa976c248db5a4a1497fb792af3c814a4be984f076b12b0
cluster-platform-operators-manager git 312c5f24 sha256:7a1466f93131d9dbe215005895b9f85e835e265cd10f3f632e1c1809b4100029
cluster-policy-controller git 3b0d0755 sha256:4f57cac0fa19a12df8372e976bf1de7add90b28ae1886a06bce7e280b50c2ce8
configmap-reloader git 9adad592 sha256:9561dd170598249403770b1e8d602e8cb8bae6ba33f426946be20f999dc5fbc8
csi-driver-nfs git 2b914c21 sha256:c50ba0833160f2eb7c5899be2ff1462c8604ee32e0a4d1b20d22860ab1a49641
csi-driver-shared-resource git 01bbb23b sha256:71a23fa424ba44cee93b5dcdf6bebf451a13fd3dea512e1788746876620ed07c
csi-driver-shared-resource-operator git bc169d2d sha256:800e9dfd6132b55c43c03df458da0b711885056839fd1254e3d0bb6e159c6d68
csi-driver-shared-resource-webhook git 01bbb23b sha256:6f4c911885b38e51fec381d29ec67723e6857007510b7e9c11b1e7b560e9c35e
csi-external-attacher git d9290843 sha256:a5f6386d1323148c0c5efd36bfdc928e2677809915483e8226d23dc0c0c13c6e
csi-external-provisioner git 0bf126b7 sha256:f959683a2d97f54b0c3b5e0dda4fcfc31217926255b97ffdc49081f8ee539165
csi-external-resizer git e8036caf sha256:e14c2062bef3ba0b43590aa9db3ea6ccd66171bcb6d6b57d55c9f6a1e29faf62
csi-livenessprobe git 3587db51 sha256:38edec4cc00be803b413bf38453bfaee617bbd783c36c76f1146cde2b37a7bd2
csi-node-driver-registrar git 9ea90f34 sha256:1591a04c72c7d19f43acfcc2d8101f43cb3f0c43431f731c9c2074433f249e6e
docker-registry git 47a15ac8 sha256:615d6e87740ab7326f36bac40839b185011559fc0fbfd7b328052114e473cd61
driver-toolkit git d719bdcf sha256:225e93c377a9b3db2c3fae488b0af146b3d52701fb051b452a792e25ab4019b5
egress-router-cni git dfe03737 sha256:8a5d7d579917231728a7b4b5dc91df7b1ca2491b63ef0ac13243147598324461
gcp-cloud-controller-manager git 507fea98 sha256:d9d1689b172702e058423d1f3bf3ee932887fd5767a2eafdbe6566565e55f21d
gcp-cluster-api-controllers git b8a27725 sha256:b2658c92af3c9ddd29bd1eadd388cfaa1f2bd99e0a3aad1c4c1cebe31709b002
gcp-pd-csi-driver git 81e60746 sha256:8f52f73d650922617e95b2b304b5e104f7b48feb4fa93fa2f666a4ab8f70aaf4
gcp-pd-csi-driver-operator git 08c561b8 sha256:12c008f05951486fbcf1104b204c6e87c780eeec56aed17cfdf170595aa913b3
ibm-cloud-controller-manager git b5bcaf9c sha256:c489ce62fa2d26d028936098c703adabacb25b826118a98651cf49bed0ea7ca8
ironic-machine-os-downloader git ce291779 sha256:95d47a0dfb64a00ec5ef36e567dcb67f00ba84a2e98a58f0c610db7740e13cc2
ironic-static-ip-manager git 4536724a sha256:e7451a8989fd65db78c05721b3c42ec958a8b6f671434b032f09105735ea5005
k8s-prometheus-adapter git 0fce7c7c sha256:df448abfa01107f3c6d164de406d523a6c96ef7e01c20911e805963365469438
keepalived-ipfailover git 1a14e5c9 sha256:4275f84fb948c6e8b9db72d20db9cc7d200fcd5b62bca91d30f54a6a1e658fff
kube-state-metrics git fd791df5 sha256:f1609a001e09626b689796d4a27af4f982272586ef8e14a3c33853e5370bcdd4
kube-storage-version-migrator git bad104d1 sha256:a3f8ffd1609da633fb59b3e977c9fc42065f39ea56cd6191309e0948f0f6377f
kubevirt-cloud-controller-manager git ee2033ec sha256:7cf02d8d12a1876f4f4ed332028e8aca50edd08f54df1eba2dd93b2127b5e909
kuryr-cni git 36754b7b sha256:a1a56aed36470fcf3b16157c69a71cf8d1b7908910accc9b9a71bf8cab91d9f1
kuryr-controller git 36754b7b sha256:d0d09e29c21679c60051be98e5fd6462e73d390705b4f2d93bb315cb0ecfc82f
libvirt-machine-controllers git d4b7a8ab sha256:4114f5f529c1d5337436eea2cf3d9212586a0fad8516eae79696d50747fe2bac
machine-image-customization-controller git 34a4abe6 sha256:8a3770a02c679fe8673a9216d2e2c115fc103b6067b11555e0a5f3c1db9f39c3
machine-os-content sha256:c00edd726d349a534139df2d0751714bafa0e4ef74d9d5635cc9d76fabe7f0ef
multus-admission-controller git 9b0656af sha256:d2a04e5d6a6c79089d4e31da84cefd3e552c9e45b9ccfe58978344f104b50c9e
multus-networkpolicy git 7176ab75 sha256:5542c2f49451ddbd1513b49510790c601789c6735d4762dba1547cf891629fea
multus-route-override-cni git ca3bbec5 sha256:8f5e351eaf8ee099753472cc7158e8245ba0bc5821b26a67c007f3267deb1eaf
network-interface-bond-cni git 84bda2af sha256:c757259e6036f3737ea581c5072a0ea54d5d086bd98172085fcd6e1794c414e0
network-metrics-daemon git 3ef81a5c sha256:1973f7c398ba2286b4dd5c0210535cf7a00c7d45a60177797401d917f57dae9b
network-tools git 073feda1 sha256:b3dcc98dbccc9c5fe3b64718040a44f0c8c28f0e9e33f3dad1745951724d6c2d
oauth-proxy git 44af5a3a sha256:19830dfac6051a3a849b5ddc02d5a859e2a627e5cf34703daa8820d9f42e9af9
oauth-server git eb54be28 sha256:81deab807e0511a636cdeaa2bc3666b598aa55674587dd75e0186393d82d77c4
openshift-state-metrics git 9be421f0 sha256:62fdd8e8949409d671352e47ce99c2b3b9d6485b4781621fdbf50b9aec6896fa
openstack-cinder-csi-driver-operator git b50a649b sha256:8ef6ac1fffe20102fd03675bf310b1b149a83c14f87a4e42bea00d4ff2a593d2
ovirt-csi-driver git 54958deb sha256:8251bb7db268064b8d55f7ee002a535df163dbb56c3e78b836fe16ab47189950
ovirt-csi-driver-operator git b293972f sha256:721d36a6cd38059f2aded343dfc80a730143fb192e27adad06fb4dad082b59a7
ovirt-machine-controllers git 22d89b3f sha256:490de72c01049c7cd8692169188bdbf2048c609e3a33b926d2ab89cec6ab102c
powervs-block-csi-driver-operator git e70c980e sha256:2cf5f9ee9dc43d6875a147df7f4cbae2f4a385c355bf0e2f728ca570bfb50bd8
prom-label-proxy git b501d5e2 sha256:1e00a5bb235d12344958075e40efb491e54f87201aaf19b0fbe6bfe11eb5e6d1
prometheus git 72886096 sha256:4e7779257499277b8d996fe2fee091f7640861010344b9a5a5013d60d6b3c86b
prometheus-alertmanager git df2f11e2 sha256:f8f517cce96d81ab669af76e97100f9a3b43b7d394ef76920835513c4c8c00a9
prometheus-config-reloader git 30fdccd1 sha256:07ad0cc6703479fef7ebaf554e126bae0b5c709caac9d33af415ad91a1039a78
prometheus-node-exporter git 59d699ca sha256:13dbd20afc2ca03f006267227eca5f1643e57c907d3652897dba4435d2d63f23
prometheus-operator git 30fdccd1 sha256:1a83b3ce2209a018e5864384aae09c1f21e4114a4e37c859d77e234d882c5d36
prometheus-operator-admission-webhook git 30fdccd1 sha256:4cc9cb9f1870e00e0ee3b8ffa6f05d6bb12390d096a6c9fa0ca3ce002faf6c25
rhel-coreos sha256:d03153a924941343be443dbcf934d2306f7d0c05b5863de22ef455eb23f911da
rhel-coreos-extensions sha256:8b72c24cbc3f0f164ebfe88588acda1d92875f5c023795b489d3a3ccd48c5a5f
route-controller-manager git 6667a6cb sha256:58d82dd25cdbfbabd1fcd72621b4c85a912d9e127c36f1f8d8e3d3518d9bd23d
service-ca-operator git dba00dc5 sha256:8f4043c1001436305972e9fbd43b2b906fec024411a4342fe868a297fe9b6651
thanos git 70fb57fb sha256:ef023528f4456809961faa1097f7a3d8599c15894d9f27ab3eda7c43f513e0c6
vsphere-cloud-controller-manager git f56d57ba sha256:488aa26bbe4342dc369484b6fb12e11411c334af783661d1494a706910c51043
vsphere-cluster-api-controllers git da63f2b9 sha256:720954a495223aed5eef002462713a18121e584cf33c99a608a639fa0ea89d90
vsphere-csi-driver git 4d3036a6 sha256:cf5fd4b0800a0776e7c931a6c82f1cf54cb270f28b9a1fb0f0ad31ef930abe16
vsphere-csi-driver-operator git a9e5036e sha256:f226409e1143f653ae425b94997759fdd1963cc3ce566c32aab32327c5294ca2
vsphere-csi-driver-syncer git 4d3036a6 sha256:e42372d82647f19255766d7afeb1ac04b04364be5d832f191677bae64c56637b
vsphere-problem-detector git 3ad7408f sha256:fc5b3ac8b07b53edfb48499de01112b5107c499bb695acca817a5d91e22ab580

agent-installer-api-server

OCPBUGS-53693: Bump jwt to 4.5.2 in release-4.13 (#7512) #7512
OCPBUGS-13611: Update version go-http-metrics/gin (#6919) #6919
MGMT-17595: Bump x/net to v0.24.0 to mitigate CVE-2023-45288 (#6215) #6215
MGMT-17588: Bump runc to v1.1.12 to mitigate CVE-2024-21626 (#6202) #6202
MGMT-17541: Replace broken golangci reference (#6196) #6196
NO-ISSUE: replace postgres images as current one disappeared from quay (#6133) #6133
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-53717: Bump jwt to 4.5.2 in release-4.13 (#1094) #1094
Bump golang.org/x/net to 0.33.0 (#1015) #1015
OCPBUGS-13612: Update version go-http-metrics/gin (#935) #935
MGMT-17595: Bump x/net to at least v0.24.0 to mitigate CVE-2023-45288 (#835) #835
MGMT-17588: Bump runc to v1.1.12 to mitigate CVE-2024-21626 (#829) #829
MGMT-17541: Replace broken golangci reference (#826) #826
Full changelog

agent-installer-node-agent

OCPBUGS-53709: Bump golang-jwt/jwt/v4 to 4.5.2 in release-4.13 (#974) #974
OCPBUGS-46952: Bump golang.org/x/net to 0.33.0 (#886) #886
MGMT-17595: Bump x/net to at least v0.24.0 to mitigate CVE-2023-45288 (#706) #706
NO-ISSUE: Quick fix for broken ignition download test in 4.13 release (#700) #700
MGMT-17588: Bump runc to v1.1.12 to mitigate CVE-2024-21626 (#702) #702
MGMT-17541: Replace broken golangci reference (#697) #697
Full changelog

apiserver-network-proxy

OCPBUGS-38066: Revert “Agent: Respect HTTPS_PROXY env vars for proxied connections” #61
OCPBUGS-31984: Bump golang.org/x/net to v0.23.0 #52
Full changelog

aws-cloud-controller-manager

OCPBUGS-32073: update for CVE-2023-45288 [release-4.13] #84
Full changelog

aws-cluster-api-controllers

OCPBUGS-32470: UPSTREAM: 4670:Update awsmachine providerID and instanceID immediately after ec2:RunInstances is called #509
Full changelog

aws-ebs-csi-driver

OCPBUGS-33363: [release-4.13] UPSTREAM: 1919: Add reserved-volume-attachments #266
Full changelog

aws-ebs-csi-driver-operator

OCPBUGS-33363: Explicitly reserve 1 attachment for the root disk #307
Full changelog

aws-pod-identity-webhook

OCPBUGS-32882: Upgrade go-jose module to 2.6.3 #190
Full changelog

azure-cluster-api-controllers

OCPBUGS-36022: Update go-retryablehttp to v0.7.7 #314
Full changelog

azure-file-csi-driver

OCPBUGS-41678: bump mount-utils to treat ENODEV error as corrupted mount #81
Full changelog

azure-machine-controllers

OCPBUGS-29906: Don’t create availability set when using spot instances #104
Full changelog

baremetal-installer, installer, installer-artifacts

OCPBUGS-55034: IBMCloud: Move to IBM TF openshift fork #9668
OCPBUGS-39217: Add yq v4 to ci image #8922
OCPBUGS-36088: [release-4.13]: bump go-retryablehttp for CVE fix #8659
OCPBUGS-29124: IBMCloud: Handle disk delete errors #7989
OCPBUGS-37168: Add yq-v4 to the upi-installer image for CI #8743
OCPBUGS-35976: [release-4.13] bump github.com/containers/image for CVE fix #8651
OCPBUGS-33732: preserve category name when trying to find tag category #8419
OCPBUGS-33062: openstack: Honour worker server group policy #8323
OCPBUGS-32359: Updated libvirt installer to include multi-arch yq and symlink for backwards compatibility #8284
OCPBUGS-22979: IBMCloud: Add eu-es region #7685
OCPBUGS-30629: baremetal: populate customDeploy in advance #8129
OCPBUGS-29627: update RHCOS 4.13 bootimage metadata to 413.92.202402131523-0 #8038
OCPBUGS-30000: [release-4.13] Bump containerd for vulnerability fix #8073
Full changelog

baremetal-machine-controllers

OCPBUGS-46640: Bump x/net 0.33.0 #229
OCPBUGS-29822: Extend metal3remediation aggregation role #212
Full changelog

baremetal-operator

OCPBUGS-53334: BMO can expose any secret via BMCEventSubscription CRD 4.13 #411
OCPBUGS-30629: Do not update instance_info and deploy_interface for active nodes #337
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-30288: oc adm catalog mirror: use ToSlash and FromSlash to unify the path separators #1700
Full changelog

cloud-credential-operator

OCPBUGS-53419: github.com/golang/glog v1.2.4 #846
OCPBUGS-51546: Ignore SNYK-GOLANG-GOLANGORGXOAUTH2JWS-8749594 due to not being affected #831
OCPBUGS-43340: Update github.com/sirupsen/logrus v1.8.3 #770
OCPBUGS-37834: Resolve SNYK errors in security job. #743
OCPBUGS-37421: SNYK ignore go-client misreporting #740
OCPBUGS-36028: IBM/go-sdk-core update to v5.17.4 #722
OCPBUGS-32898: Upgrade go-jose module to 2.6.3 #698
Full changelog

cloud-network-config-controller

OCPBUGS-32180: Avoid nil pointer panic while assigning private IP on Azure #139
Full changelog

cluster-autoscaler

OCPBUGS-45151: [release-4.13] VPA: Update OWNERS file #328
OCPBUGS-40929: update VPA golang.org/x/net for http rapid reset for CVE-2024-8421 #317
OCPBUGS-31702: add check for taint.value == nil #295
OCPBUGS-30874: Fix unstructured taint parsing in Cluster API provider #289
Full changelog

cluster-autoscaler-operator

OCPBUGS-31992: Update x/net to v0.25.0 #324
Full changelog

cluster-baremetal-operator

OCPBUGS-31993: bump x/net to 0.23.0 #439
Full changelog

cluster-cloud-controller-manager-operator

OCPBUGS-35562: update azure and ash tolerations on node manager #353
OCPBUGS-35562: update unit tests [release-4.13] #354
Full changelog

cluster-config-operator

OCPBUGS-28802: Add required PSa labels #404
Full changelog

cluster-control-plane-machine-set-operator

OCPBUGS-48259: Add unreadyNodeGracePeriod for allowing brief node hiccups #342
OCPBUGS-35380: Improved debugging of API listing errors #304
OCPBUGS-30156: Never delete a Machine when there’s a single Machine in an index #286
Full changelog

cluster-csi-snapshot-controller-operator

OCPBUGS-32334: create suitable role and roleBinding for csi-snapshot-webhook #206
Full changelog

cluster-dns-operator

OCPBUGS-52501: [release-4.13] Add runbook_url for CoreDNSErrorsHigh #434
OCPBUGS-11449: Enable topology-aware hints iff nodes in >=2 zones #418
OCPBUGS-11449: Ignore max unavailable for status #417
Full changelog

cluster-etcd-operator

OCPBUGS-53509: fix CVE-2025-30204 #1415
OCPBUGS-35077: return errors in wait-for-ceo #1273
OCPBUGS-31988: update golang x net #1255
OCPBUGS-30248: fix panic in health check timeouts #1217
OCPBUGS-30245: [4.13] Replace nodelister with master nodelister everywhere #1216
Full changelog

cluster-image-registry-operator

OCPBUGS-51602: bump golang.org/x/oauth2 #1222
OCPBUGS-36034: go.*,vendor: bump go-retryablehttp #1070
OCPBUGS-29935: pkg/storage/s3: enable bucket key on encryption settings #1007
Full changelog

cluster-ingress-operator

OCPBUGS-43095: Add alert for RFC 7230 violation in Transfer-Encoding headers #1161
OCPBUGS-43095: Add e2e test for duplicate Transfer-Encoding headers #1150
OCPBUGS-36551: Add Regexp Anchor to TestAll #1104
OCPBUGS-35453: [release-4.13] internal service changed fix target port logic #1089
OCPBUGS-35094: TestHostNetworkPortBinding: Delete t.Parallel() #1082
OCPBUGS-34765: Don’t add clientca-configmap finalizer if deleting #1073
OCPBUGS-34409: desiredRouterDeployment: Set HostPort if needed #1062
OCPBUGS-33990: Avoid spurious updates for internalTrafficPolicy [Backport to 4.13] #1055
OCPBUGS-34476: Use centos7 tag for quay.io/centos7/httpd-24-centos7 image #1065
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-50850: Increase waitForFallbackDegradedConditionTimeout #1809
OCPBUGS-34062: [4.13] add a controller that reconciles SCCs’ volumes #1677
OCPBUGS-25922: [release-4.13] dashboard: use recording rules for most metrics #1611
Full changelog

cluster-monitoring-operator

OCPBUGS-33581: label for infra nodes for metric cluster:capacity_cpu_cores:sum #2344
OCPBUGS-28767: fix generation of telemeter token hash #2305
Full changelog

cluster-network-operator

OCPBUGS-43856: manifests/02-cncc-credentials: Set skipServiceCheck for GCP #2547
OCPBUGS-38403: Add missing runbook for OVNKubernetesNorthdInactive #2471
OCPBUGS-37941: update whereabouts crd #2458
OCPBUGS-30150: ipsec: fix openssl typo #2290
OCPBUGS-29674: add env var in whereabouts-reconciler daemonset #2279
Full changelog

cluster-node-tuning-operator

E2E: workload hints: compare existing profile with changes being made to avoid mcp getting stuck (#1069) #1069
OCPBUGS-33030: [release-4.13][manual]Reduce number of reboots in offline tests (#1048) #1048
Scheduler plugin: ignore IRQs (#1027) #1027
irqbalance: set banned cpus list to 0 (#1003) #1003
OCPBUGS-24353: rps: cherry-picks of rps fixes (#865) #865
Full changelog

cluster-openshift-controller-manager-operator

OCPBUGS-38455: Update opentelemetry to mitigate CVE #365
Full changelog

cluster-samples-operator

OCPBUGS-54812: add rhdmalone to owners #628
OCPBUGS-49663: add shannon and aroyoredhat as owners #599
OCPBUGS-21198: update k8s.io/apiserver version #589
Full changelog

cluster-storage-operator

OCPBUGS-33468: Fix problem-detector proxy setting #473
Full changelog

cluster-update-keys

OCPBUGS-43886: keys: Update Red Hat keys to use SHA256 signatures #67
Full changelog

cluster-version-operator

OCPBUGS-45332: deps: bump golang.org/x/net to 0.31.0 #1121
Full changelog

console

OCPBUGS-57100: Add all files to vendor regardless of gitignore #15136
OCPBUGS-54892: Show Observe section without PROMETHEUS and MONITORING flags #14960
OCPBUGS-45292: A value submitted in From view is wrapped with single quotation after switching to Yaml view. #14573
OCPBUGS-44356: Application creation fail when manually entering input scaling value in local setup #14509
OCPBUGS-45197: Edit the secret and add the Chinese in the web-console, garbled characters will be displayed #14552
OCPBUGS-44585: Need to allow blank for Project/namespace when setting SA Subject in ‘Project access tab’ #14497
OCPBUGS-36557: Increase login flow state paramater length/entropy #14483
OCPBUGS-42951: The filepath including leading slash makes error during parsing devfile using Gitlab #14383
OCPBUGS-41594: Redirects to new PipelineRun logs URL from old PipelineRun logs URL #14263
OCPBUGS-35259: fix vCenter cluster being empty #13952
OCPBUGS-32147: Bump graphql-go to v1.3.0 #13922
OCPBUGS-33978: Helm Plugin’s Catalog incorrectly renders a single index entry into multiple tiles #13872
OCPBUGS-34342: Fix PipelineRun Logs tab navigation #13890
OCPBUGS-24395: Extra space is in the translation text(Chinese) of ‘Create rolebinding’ and ‘replicate rolebinding’ #13405
OCPBUGS-33777: restrict Masthead logo to max-height to 60px #13860
OCPBUGS-33749: Add visual connector between VMs and non VMs workloads #13857
OCPBUGS-33382: Routes created by devfiles do not always use HTTPS #13827
OCPBUGS-33650: fix issues with Edit Route form #13851
OCPBUGS-32500: PipelineRuns in Console show wrong status or load indefinitely #13780
OCPBUGS-31077: Pipeline Name gets changed to “new-pipeline” on the Edit Pipeline YAML/Builder #13683
OCPBUGS-31595: Fix operands list endpoint. #13714
OCPBUGS-29063: add additional check to determine if file is binary #13579
OCPBUGS-28788: Copy response code from proxied plugin requests #13561
Full changelog

console-operator

OCPBUGS-18674: Reset console operator’s conditions #894
OCPBUGS-30599: Disable HTTP/2 for webhook #875
OCPBUGS-21008: [release-4.13] Bump library-go and golang.org/x/net #866
OCPBUGS-6208: Updating openshift-enterprise-console-operator images to be consistent with ART #872
Full changelog

container-networking-plugins

ART-13080: Fix Hermeto build issues #197
Full changelog

coredns

OCPBUGS-38431: UPSTREAM: 6354: openshift: key cache on Checking Disabled (CD) bit #129
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-52414: Merge https://github.com/kubernetes/cloud-provider-openstack:release-1.26 into release-4.13 #313
Full changelog

csi-driver-manila-operator

OCPBUGS-26224: Fix selector for manila-csi-driver-controller-metrics service #224
Full changelog

csi-external-snapshotter, csi-snapshot-controller, csi-snapshot-validation-webhook

OCPBUGS-29728: cherry-pick:release-4.13: OCPBUGS-29244 Update VolumeSnapshot and VolumeSnapshotContent using JSON patch #141
Full changelog

docker-builder

OCPBUGS-43295: Buildah dependency bump to 1.29.5 #460
OCPBUGS-43191: runc library bump to 1.1.12 #439
OCPBUGS-48836: skipping some unit tests to avoid failures as they are duplicate #434
OCPBUGS-48655: Add new team members to the OWNERS file #431
Replace ‘coreydaley’ with ‘sayan-biswas’ #407
BUILD-854: Add adambkaplan as approver #405
Full changelog

etcd

OCPBUGS-32920: Revert “Merge pull request #262 from Elbehery/rebase-etcd-3.5.13-open… #266
OCPBUGS-31653: Rebase etcd 3.5.13 openshift 4.13 #262
ETCD-537: Revert “bump build root go1.20” #263
OCPBUGS-28734: Rebase etcd 3.5.12 openshift 4.13 #245
ETCD-537: bump build root go1.20 #252
Full changelog

gcp-machine-controllers

OCPBUGS-56916: Disable shielded VMs for non-UEFI disks #120
Full changelog

haproxy-router

OCPBUGS-43095: add duplicate_te_header_total metric #626
OCPBUGS-34673: Properly handle rewrite-target annotation #608
OCPBUGS-33911: Reject routes with MD5 certs #600
OCPBUGS-33448: Count active services before setting weight to 1 #594
OCPBUGS-33280: Route ‘haproxy.router.openshift.io/timeout’ value is not validated #591
Full changelog

hyperkube, pod

OCPBUGS-41678: mount-utils: treat syscall.ENODEV as corrupted mount #2083
OCPBUGS-37280: UPSTREAM: 126104: Add funcs in pkg/filesystem/util that can actually … #2045
OCPBUGS-28660: UPSTREAM: <carry>: kubelet/cm: use MkdirAll when creating cpuset to ignore file exists error #1875
UPSTREAM: <drop>: Bump golang.org/x/net to v0.23.0 #1938
OCPBUGS-31505: Update to kubernetes 1.26.15 #1930
Address CVE #14
OCPBUGS-29663: Update to kubernetes 1.26.14 #1889
Full changelog

hypershift

OCPBUGS-53901: bump golang-jwt v4 #5948
OCPBUGS-39184: fix: bump github.com/IBM/go-sdk-core/v5 #4627
OCPBUGS-41515: set Konnectivity cipher suites #4284
NO-JIRA: hack: make the e2e script generic #4202
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-53909: bump github.com/golang-jwt/jwt/v4 to v4.5.2 #87
OCPBUGS-36064: CVE-2024-6104: bump github.com/hashicorp/go-retryablehttp to v0.7.7 #74
Full changelog

ibm-vpc-block-csi-driver-operator

OCPBUGS-36070: CVE-2024-6104: bump github.com/hashicorp/go-retryablehttp to v0.7.7 #123
Full changelog

ibm-vpc-node-label-updater

OCPBUGS-53541: bump github.com/golang-jwt/jwt/v4 to v4.5.2 #47
OCPBUGS-36010: CVE-2024-6104: bump github.com/hashicorp/go-retryablehttp to v0.7.7 #43
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-36076: UPSTREAM: <carry>: Fix go-retryablehttp CVE - 4.13 #90
Full changelog

ibmcloud-machine-controllers

OCPBUGS-36082: Bump dependency for CVE #56
Full changelog

insights-operator

OCPBUGS-36475: properly encode the URL for the advisor links (#962) (#965) #962
OCPBUGS-33449: anonymization - externalIP can be nil (#931) (#933) (#935) #931
OCPBUGS-31991: bump golang.org/x/net version (#927) #927
OCPBUGS-28157: Add extra check in ids to bypass validations (#905) #905
Full changelog

ironic

OCPBUGS-48146, OCPBUGS-48595: Bump jinja2 to 3.0.1-6.el9.2 #626
OCPBUGS-43952, OCPBUGS-43960: Bump python-waitress [4.13] #608
OCPBUGS-37764, OCPBUGS-39384: Include fixes for CVE-2024-44082 #585
OCPBUGS-38509: set min version for python3-webob #557
OCPBUGS-33374: bump werkzeug #543
OCPBUGS-34898: bump jinja2 #538
OCPBUGS-37116: Update eventlet version #525
OCPBUGS-32363: [4.13] remove unused prometheus-exporter #488
OCPBUGS-32387: Use unix sockets by default for reverse proxy communication #476
Full changelog

ironic-agent

OCPBUGS-39384: Include fixes for CVE-2024-44082 #164
OCPBUGS-38509: set webob and bump werkzeug #152
OCPBUGS-29725: Always add ignition to set hostname on /etc/hostname #111
Full changelog

kube-proxy, sdn

OCPBUGS-55758: Handle openshift-host-network namespace as special when it modifies #656
Full changelog

kube-rbac-proxy

OCPBUGS-31987: CVE-2023-45288 [4.13] #107
Full changelog

kubevirt-csi-driver

“OCPBUGS-29791: [release-4.13] Address CVE-2024-1725: Restrict access to infrastructure PVCs by requiring matching infraClusterLabels on tenant PVCs” #35
Full changelog

machine-api-operator

OCPBUGS-43856: install/0000_30_machine-api-operator_00_credentials-request: Set skipServiceCheck again for GCP #1304
OCPBUGS-32015: Fix zone tag value reconciliation for vSphere machines #1225
OCPBUGS-31994: Update x/net to v0.25.0 #1245
NO-JIRA: [release-4.13] Fix data race conditions in unit tests #1254
Full changelog

machine-config-operator

OCPBUGS-44206: Panic seen in CI job for MCC pod #4680
OCPBUGS-38372: Revert “MCD-pull: run after network-online.target in Azure” #4527
OCPBUGS-38295: daemon/update: disable systemd unit before overwriting #4522
OCPBUGS-37783: Openshift uncordoned compute-node that was intentionally cordoned #4507
OCPBUGS-37160: MCD-pull: run after network-online.target in Azure #4474
OCPBUGS-36782: daemon: Handle correctly OS Version for 4.1 and 4.2 bootimages #4464
OCPBUGS-32208: Run resolv-prepender entirely async #4314
OCPBUGS-33327: make verify should use MCO’s kube version #4352
OCPBUGS-29721: Add existing kubeletconfig/ctrcfg mc-name-suffix annotation #4206
OCPBUGS-30285: set nodeStatusReportFrequency #4243
Full changelog

machine-os-images

OCPBUGS-54172: Change rhcos release browser url #60
Full changelog

multus-cni

OCPBUGS-28020: Fix SAST scan issues for multus-cni-container [4.13] #224
Full changelog

nutanix-machine-controllers

OCPBUGS-20976: bump golang.org/x/net to v0.17.0 #86
Full changelog

oauth-apiserver

OCPBUGS-31996: bump x/net to 0.24.0 #112
Full changelog

oc-mirror

changes the owners file (#1012) #1012
OCPBUGS-48513: e2e: use same version of crane as in go.mod (#1025) #1025
Bump version to include v5.11.0 of go-git (#823) #823
Full changelog

openshift-apiserver

OCPBUGS-32446: bump(x/net) to v0.23.0 #430
Full changelog

openshift-controller-manager

OCPBUGS-58035: Set node-pullsecrets volume to read-only to protect image pull credentials #402
OCPBUGS-57051: Empty proxy variables are causing issues during the build #388
OCPBUGS-48656: Add new team members to the OWNERS file #362
[release 4.13] OCPBUGS-38407, OCPBUGS-38408: Update opentelemetry dependency #326
OCPBUGS-41952: Add adambkaplan as approver #335
Full changelog

openstack-machine-api-provider

OCPBUGS-34422: Ensure portSecurity is correctly set in the Instance Ports #119
Full changelog

operator-lifecycle-manager, operator-registry

OCPBUGS-46924, OCPBUGS-46931, OCPBUGS-47311: x/net bump to v0.34.0 [release-4.13] #942
OCPBUGS-47507: CRD upgrade existing CR validation fix (#3442) #924
NO-ISSUE: [release-4.13] Backport e2e fixes #876
OCPBUGS-42146: adds paginating lister for evaluating CRs’ upgrade fitness versus new CRDs. #871
OCPBUGS-38254: [CARRY] perform operator apiService certificate validity checks directly #836
OCPBUGS-38608: (fix) Resolver: list CatSrc using client, instead of referring to registry-server cache (#3349) #843
OCPBUGS-32856: bump go-jose to v2.6.3 #780
OCPBUGS-35241: Unblock CI #772
Full changelog

operator-marketplace

OCPBUGS-49430: Upgrade golang.org/x/net [release-4.13] #590
OCPBUGS-32074: update golang.org/x/net for CVE-2023-45288 #566
Full changelog

ovn-kubernetes-microshift-rhel-9, ovn-kubernetes-rhel-9

OCPBUGS-55950: Bump ovs and ovn to latest patch releases #2553
OCPBUGS-38264: [release-4.13] Bump OVSDBTimeout and make it configurable #2289
OCPBUGS-37119: EgressIP: Reload certificates for the grpc heatlhcheck server #2226
OCPBUGS-35100: [release-4.13] ipv6+all protocols conntrack flush #2200
OCPBUGS-34669, SDN-4186: Introduce a validating webhook for ovnkube-node #2053
OCPBUGS-29865: CVE-2022-41723: net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding #2095
OCPBUGS-33730: Improves service iptables efficiency on start up #2172
OCPBUGS-32988: Bumping OVS #2143
OCPBUGS-33421: [release-4.13] Full implementation of KEP-1669 ProxyTerminatingEndpoints + ETP=local fix #2130
OCPBUGS-33218: [release-4.13] OVN bump to 23.06.1-112 #2153
OCPBUGS-28983, OCPBUGS-30920: Update netpol namespace address sets usage to the old ways #2097
OCPBUGS-29851: Egress IP, Services: use all node IP addresses #2090
Full changelog

powervs-block-csi-driver

OCPBUGS-36094: Fix CVE-2024-6104 by updating http-retryable to 0.7.7 #91
OCPBUGS-33638: Fix CVE2023-45288 by bumping x/net to v0.24.0 -4.13 #82
Full changelog

powervs-cloud-controller-manager

OCPBUGS-36104: UPSTREAM: <carry>: Fix go-retryablehttp CVE 4.13 #76
Full changelog

powervs-machine-controllers

OCPBUGS-41980: Update go.mod to fix CVE - 4.13 #87
Full changelog

telemeter

OCPBUGS-34829: fix issuer check during JWT authentication 4.13 #540
Full changelog

tests

OCPBUGS-55954: [build] Ensure Git Clone Does Not Run Privileged #29769
OCPBUGS-54771: Component Readiness: [Networking / ovn-kubernetes] [EgressFirewall] test regressed #29661
OCPBUGS-53285: Add/remove team members to the OWNERS file for Builds #29608
OCPBUGS-53297: Disable:Broken for [sig-builds][Feature:Builds][Slow] can use private repositories as build input build using an HTTP token should be able to clone source code via an HTTP token #29610
OCPBUGS-52584: Use payload pullspec for image info test #29592
OCPBUGS-37921: Removes dependency on samples operator images #29007
OCPBUGS-35053: updated timeout to 3 seconds to account for network timing issues #28862
OCPBUGS-36501: test/extended: skip etcd leader change check on hypershift #28922
OCPBUGS-35857: Use centos7 tag instead of latest for cmd images tests #28895
OCPBUGS-33985: Provide SCC access via RBAC #28835
Full changelog

View changelog in Markdown or change previous release:

Source code for this page located on github