4.16.43

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.16.43-x86_64

Team Approvals:

Tests:

Blocking jobs
- upgrade Succeeded release-openshift-origin-installer-e2e-aws-upgrade
- upgrade-minor Succeeded release-openshift-origin-installer-e2e-aws-upgrade
Informing jobs
- aws-ovn-serial Succeeded periodic-ci-openshift-release-master-nightly-4.16-e2e-aws-ovn-serial
- aws-ovn-upgrade-micro Succeeded periodic-ci-openshift-release-master-ci-4.16-e2e-aws-ovn-upgrade
- aws-sdn-upgrade-4.16-micro Succeeded periodic-ci-openshift-release-master-nightly-4.16-e2e-aws-sdn-upgrade
- azure-ovn-upgrade-4.16-micro Pending (2 retries) periodic-ci-openshift-release-master-ci-4.16-e2e-azure-ovn-upgrade
- fips-scan Succeeded periodic-ci-openshift-release-master-nightly-4.16-fips-payload-scan
- gcp-ovn-rt-upgrade-4.16-minor Succeeded periodic-ci-openshift-release-master-ci-4.16-upgrade-from-stable-4.15-e2e-gcp-ovn-rt-upgrade
- hypershift-ovn-conformance-4.16 Succeeded periodic-ci-openshift-hypershift-release-4.16-periodics-e2e-aws-ovn-conformance
- metal-ipi-ovn-bm Succeeded periodic-ci-openshift-release-master-nightly-4.16-e2e-metal-ipi-ovn-bm
- metal-ipi-ovn-ipv6 Succeeded periodic-ci-openshift-release-master-nightly-4.16-e2e-metal-ipi-ovn-ipv6

Upgrades from:

Untested upgrades: 4.15.21, 4.15.22, 4.15.23, 4.15.24, 4.15.25, 4.15.26, 4.15.27, 4.15.29, 4.15.30, 4.15.31, 4.15.33, 4.15.34, 4.15.36, 4.15.37, 4.15.38, 4.15.39, 4.15.40, 4.15.41, 4.15.42, 4.15.43, 4.15.44, 4.15.45, 4.15.46, 4.15.47, 4.15.48, 4.15.49, 4.15.50, 4.16.10, 4.16.11, 4.16.12, 4.16.13, 4.16.14, 4.16.15, 4.16.16, 4.16.17, 4.16.18, 4.16.19, 4.16.20, 4.16.21, 4.16.23, 4.16.24, 4.16.25, 4.16.27, 4.16.28, 4.16.29, 4.16.3, 4.16.30, 4.16.32, 4.16.33, 4.16.34, 4.16.35, 4.16.36, 4.16.37, 4.16.38, 4.16.39, 4.16.4, 4.16.6, 4.16.7, 4.16.9

4.16.42 (changes) - S F F P S S S
4.16.41 (changes) - Success
4.16.40 (changes) - Failed
4.16.26 - Success
4.16.8 (changes) - Failed
4.16.5 (changes) - Success
4.16.2 (changes) - Success
4.16.1 (changes) - Success
4.16.0 (changes) - Failed
4.15.53 (changes) - Failed Success
4.15.52 (changes) - Success
4.15.51 (changes) - Failed
4.15.35 (changes) - Failed
4.15.32 (changes) - Failed
4.15.28 (changes) - Success
4.15.20 (changes) - Success
4.15.19 (changes) - Success
4.15.18 (changes) - Failed
4.15.0-0.nightly-2025-06-25-030440 (changes) - Success

Loading changelog, this may take a while ...

Changes from 4.16.26

Created: 2025-06-26 10:41:40 +0000 UTC

Image Digest: sha256:0ac57a43408916ba0b3812d3d3e8beb2a8451cb0cf1f0e23bf96f65896ff426a

Components

Kubectl 1.29.7
Kubernetes upgraded from 1.29.10 to 1.29.14
Kubernetes Tests 1.29.0
Red Hat Enterprise Linux CoreOS upgraded from 416.94.202412040832-0 to 416.94.202506251808-0 (diff)

Removed images

ovirt-machine-controllers

Rebuilt images without code change

agent-installer-utils git 6e6bb40d sha256:9b72d0766204203b964ba5cb27d27d081ea2d1b6039a734234b265a8145eb637
alibaba-cloud-controller-manager git 97e8335e sha256:e985fe1ce8fcb7c1833952eaceebf8315375e2a5d8ce8e208894fe94412eda69
apiserver-network-proxy git ca81b6a3 sha256:ba7f9524e3e8c0c0a10f292fdba3f8389c032f48f699adf68de81a07c66a2179
aws-cloud-controller-manager git a53e9def sha256:1186fe2fa717d15baa44a26bfc2cd7a498c037d981d0008f8871cda5fb1f8bf8
aws-ebs-csi-driver git 1d29a74a sha256:ca633b9ae18741591ea625a514e7c3a99dfb11bc0cea5bdd1c1a231e80cd2a95
aws-ebs-csi-driver-operator git ff69cd03 sha256:37bd4c8a66f0eb6041e90294a335879f8f13cd765c8f4b62352b4719162c41f6
aws-kms-encryption-provider git c66065de sha256:2684dff77b68b4f2f32c2377f16f3f5eb13ad2f7531280537f54974c4036d752
azure-cluster-api-controllers git a81e3b31 sha256:a01eb386b4cfa663572c23e769de50e88b23989b1193d3c0ed09dac63019efc1
azure-disk-csi-driver git 6b55f6fb sha256:e4d559e8b6d2ce528f9aac1575cd80e997ce73f9ed785314a4d2301a54841a5b
azure-disk-csi-driver-operator git ff69cd03 sha256:c02ae264101879fbf9e37040a0f87d58195cc1faa857e697ae6cd2f38a2317b1
azure-file-csi-driver git 7a36778a sha256:90bcf2855969cdf6f95a60e40f222492ec1eea15259853a049aacef026f9b209
azure-file-csi-driver-operator git ff69cd03 sha256:ee7ed5cf4cc92e6d12938ed2ba82e24d8a6207a7a2a7c96ab916e6eb65809b79
baremetal-runtimecfg git f55a330f sha256:fda5363ddba30f05187aabff77c24d3c0eed8f694a5637b853b416e7545895d2
cluster-bootstrap git 27bfb59f sha256:23034549a0d566e93369beab38b4f8790331e0c7eb26d7f52292f8e80110df01
cluster-capi-controllers git 5830a10a sha256:8a3e06335fbac03d84cb862b3749256d374e83061270180addc3ed544948f533
cluster-cloud-controller-manager-operator git 1c26756f sha256:8fc122ff7d9f151cf8bfe833efee4ed2949497a6b10363071199f705a75f065e
cluster-config-api git b7d0481c sha256:b867136d90fe7f94f0eaec843d09e09ad83f3a2bcf1e475e8e421dfa74807d16
cluster-config-operator git 441d29c9 sha256:bc8f23868645a6409f83b2e5561d14765d35eeecd29c49c3d5a93c797aadf99a
cluster-control-plane-machine-set-operator git 14571e8a sha256:f5003f930a03d4398fa8301cc10bc2efb37b7df2a3b44116608343a1a759d4e0
cluster-csi-snapshot-controller-operator git 439826e1 sha256:4f9adbfbdadece41a4cbc63c51312932cd272db1375ee185d81898b67b0a249d
cluster-ingress-operator git 57f9674e sha256:3eb99d6633d894ed8d94bf607e8245b82cf1cc090e6b79d4fbb551df9590c468
cluster-kube-cluster-api-operator git 95ceaa9e sha256:85d3ce2677a7ab59c9b3c288f03c98075b6fcc4fe029e4a9311d8657439520c0
cluster-kube-controller-manager-operator git 0338b3be sha256:4cba5448b011456a0888abbfd0cfeb8ba8955a3000c18a9a02d77bde9d5bcb30
cluster-kube-scheduler-operator git 630f63bc sha256:b7baccdfe39445564ff376f7662865e405bbf5d0ccfd45554db7cda69f0dd324
cluster-kube-storage-version-migrator-operator git e8258113 sha256:069f579e8a4068700353738562a9e61c40b9d0c55591a162a1937c3be9090e81
cluster-olm-operator git 27bf70dd sha256:8f9a83c60ef3fc66c4293a3e3488ba0530f59a87b7aa9854addcfebfd2808755
cluster-openshift-apiserver-operator git d26f3002 sha256:5f52518f17657e5273d381bb61629b867ed515da6e8ea1fce826acf3d658e572
cluster-policy-controller git eaea543f sha256:5ef895ddbf89d1883148a5fc656c2e565d0c9d22cb9ba31ba001b295ba9337c0
cluster-update-keys git e8478585 sha256:6e709e944518ac0d2380a5d84c24b411c8fb8ec8e72580865b6d219b36052ee4
configmap-reloader git dc91ddc4 sha256:664b8addadfe7ac0d0d623cee305e1f7c296ca7c49c10466a7f9c46e06c758cd
coredns git 1e417656 sha256:c74c58f66fea1d8e2926032c6aa2d5809cfc9bdd2febbbc191e8534fa4f05a3c
csi-driver-manila-operator git c25d1ff2 sha256:00747f81de56bd94b0fd28a2a0436a988b7d0528916eba4924b62179d166a2e3
csi-driver-nfs git 406cec72 sha256:d9bc83a7b0306779f9c9c7a0ea8b8ed0172ebf301b46dacbaec2a668f2a70ee4
csi-driver-shared-resource git bc125def sha256:f6c70d7a9bc681fdf20ff2ec862b56f09485434d0ec9a2fd5e8232a6819f15ae
csi-driver-shared-resource-operator git 1e1194bc sha256:6b9de3e5176898e224cbb9f22b716621e746f948fc988ae1429013e40ce70e66
csi-driver-shared-resource-webhook git bc125def sha256:ee1caf7ee47d9ed81df6e470a4eb4b810b2424b55e5ed666c7c262a916dc3ef7
csi-external-attacher git 7da80aab sha256:fb81aecbd8be35bf8ce4d69e0d9129519491ad6c0d6d4d906323e330867cddc5
csi-external-provisioner git 9e8af011 sha256:3f7fa1326b543e44eac160beed9c892857b6607ba2f6ac5d1a0ce15db4c178d8
csi-external-resizer git bdf5bfb4 sha256:aef6195cd36c032ee3d2e067fe26a6534a60182b0a0a15dda2c4b0101a5a8f0e
csi-external-snapshotter git 5315d37a sha256:d76632ae8359b0c8e0a39f9c9cf86deec45d57bfb1b3afdfeafbe9cac9cd47ca
csi-livenessprobe git f5e3ff55 sha256:39b06e46d6d3be67dd02a59a96c392f0d48fdf094422bb4392f227b1105cf88c
csi-node-driver-registrar git 8930c368 sha256:c7d5b1485a28c91434a9e4fa168e9a788dc97b3e2f9d4692b92c331f53589e10
csi-snapshot-controller git 5315d37a sha256:b44fcf7159145b47994e73b220bdc8381bd85685eb8345abbbbf9fbde857aa67
csi-snapshot-validation-webhook git 5315d37a sha256:8fc54e6640f371bdf345afc840291a1569519cc756dd8eab2515d9409ae399b5
driver-toolkit git 1d5732f0 sha256:e5a144bcf4ae2edeca2e2ebc063705e71f41a368f5e33a68e0eb8b778aecc22b
egress-router-cni git 7089efe6 sha256:5eb5a95a0f552115da354eaf2fcd7ce6d63c0fd05651529d86ea2a3b38edab6f
gcp-cloud-controller-manager git 26b43dfc sha256:e57f756c76ba91f820a2c157abc5e0fe5819e2343e36800b1343ab2feada0718
gcp-cluster-api-controllers git 02432df8 sha256:a1f01d29a58fe845fe2632b653ee12fe728a8e1e226c81a7067ec8711dc8d1f1
gcp-pd-csi-driver git 5ed71c64 sha256:90b22a26d6c044961708ae76f9728c7361c9d19daaf93d589e03c127ca5ddabd
gcp-pd-csi-driver-operator git 799327f7 sha256:87fb27bbcc1a2a1f365215e35a144cc67a71fa8148bcfcbf895dba32136a2fda
ibm-cloud-controller-manager git f961f16d sha256:2bfeee9ca50303f74efec8f5473160e49134b2a824a1fbe3e9a8621459e210e0
ibm-vpc-block-csi-driver-operator git 5d5d8010 sha256:1a8e769cd33d3099818fcf89d4a6866a9409ade0ee189e4c12ea8b09bcbf2a2e
ibmcloud-cluster-api-controllers git 7d4f93ef sha256:4c7f8fd6aa21493431859c947a9b5e78da63c4185cb6ff3b7b683ba3a38dac73
ibmcloud-machine-controllers git d29506e7 sha256:057988be836d1c9d757b24219f9b0abb94609e068ddc277ef5d771bd6d43c620
ironic-machine-os-downloader git 93b8b5fa sha256:10125b20d42fdb3279137ae77c2fe38a556330bdb4109519b8a1264602d3453e
k8s-prometheus-adapter git e4f859be sha256:043c150f8902636fd72be1d0106576753a50ffb78ff7554c46b3653e0152fa40
keepalived-ipfailover git b58673a3 sha256:898e3c1bba81fc2a3bbe7b7d1a14e3181249ed0734cb6aa0c9b36eb2dcc39d1a
kube-rbac-proxy git c38f4734 sha256:58b431f675256f0a76c9e374fd9dccf73523ab6fca85a9cad83c332ca7af6244
kube-state-metrics git 9b67b8d1 sha256:fea9428352053e61803d3a2981764a0256f06dbd029e6d2fb96cac74fb676c73
kube-storage-version-migrator git 969a60e9 sha256:344fa1922c30062cc9e6313c1df86a217ae5fe352d1befc211b5410b8debc3c1
kubevirt-cloud-controller-manager git 3db76104 sha256:cf82a13ffa13146a62247ce89064f96238af4d3d042ff4c261c1f57a74436cb6
libvirt-machine-controllers git a336f0b5 sha256:71ad84a49a8f4aa0d9f1aa1fd3b187fc5215f743c966c43087a6b78f51eaaeec
machine-image-customization-controller git 39480963 sha256:565fe3e7d015cc2d5535edafb252e0d384f991bdb8b5a11651d3dfca13dae0bf
multus-admission-controller git 88c596ed sha256:23b6ce082986943826d27df3d0297bff4a8ac71fb4ee1320d2e3174182cca4c9
multus-networkpolicy git f988f894 sha256:82ed9a23b7a0e6d7e591cda94378eec17d1615025ee69c2c14bce4f83264a17b
multus-route-override-cni git 73594f77 sha256:a553159812fbf6c03dbca9b6718632a843b15f81b1c64ad7c2ba5a5a29cdcd5c
network-interface-bond-cni git bb911451 sha256:407f2bbd37e23a2be81c18def6e412b08cfdf769caa15bf3f866ee7de0772bbe
network-metrics-daemon git 48059263 sha256:df72791b1febade03571de8dd8dcaed7568f82c12ba73849c5096e3f6841bd14
nutanix-cloud-controller-manager git 28bf5963 sha256:4b26396428abe73a0edaf0f2a9a292749fd7c324569e8f5a669036b170b6de05
oauth-proxy git 30f80124 sha256:513ab39084e682afd0eba552554d213b55588c85e1a6d86dc00a19182d0fb25a
oauth-server git 3739138c sha256:1550d4827c55cc5be07a6725b62cf94ad1d612bfd1a48ea3b791c40d53c6bbd1
olm-catalogd git 79975a51 sha256:9442077694665e6c681bb2ce1c773907ead9f1a6489b03ee1fb32afba154b076
olm-operator-controller git 80b8649c sha256:30a4cad5205aa0f8dd4052d87993818821b2eff380a98f57de6a9808f96f95fd
olm-rukpak git 282cc84c sha256:388a363f090ce44775319cd2ddb4d9ac4bd944199a04124e1e4f40e0df36be4f
openshift-state-metrics git 59b8a0ff sha256:33aeaa9f85603278cf3451c4d2bfd95513df61f7fd82c1cc7f90bba3e20fc088
openstack-cinder-csi-driver-operator git 85b52097 sha256:7f62842cb54be8543b4b90020a324e85aa97550e9e957965acbe8ab1b1b8aa1e
openstack-machine-api-provider git 5ada1cba sha256:4fc79fb8606950481730ef35c1bf86a226770a6bc874044cd6f438ca4a368deb
ovirt-csi-driver git 1db726a9 sha256:3af633ea7ac719c19c6508e2034ad131ed89031c9e3ae3c930f319cae05a1b83
ovirt-csi-driver-operator git ac852f3e sha256:62f147cd95a753dde048e2887a4c2be1a50ff47fe92dc853bf9a6b3e4ffba653
powervs-block-csi-driver git 26162bad sha256:8218bad3f3ceec7bc820390e41a327bceddf086069d323486da17fd1bd9a29f6
powervs-block-csi-driver-operator git 9c5dd8d1 sha256:73ae2c17451369306eda6c29af59fb21c4acf23bd3bd134a6d6a22388c36b336
powervs-cloud-controller-manager git 20e6dc70 sha256:ac92b6da710396fcdf12db9a8fde988356737b540728138f756bfccdb388e13b
powervs-machine-controllers git 60ebedf0 sha256:cbf2ee4a47b47555b2d2df4eebc61d255aa6eedd95f46187f6931d2654762c79
prom-label-proxy git 5e14722e sha256:2514fe8806245488d6d5975cbaf22d0ad87458f4979fe9c8c9bc34eb65fa7d15
prometheus-alertmanager git e9aea929 sha256:3005b915dec26696a9942cecb71cbbff1bef5d0d583bacf5dc2d679f4c5f4ea3
prometheus-config-reloader git c7262a43 sha256:fa91c3bd4512919c2469a6a21c2258051bbe2c33598f8f4167805ddf7ba97b0d
prometheus-node-exporter git 29ba26d1 sha256:734b605d22dce6332f777fe5a6f75e39da6fbb4e3d82a82b63a0720c705eb1f6
prometheus-operator git c7262a43 sha256:17c823148e771f5f1d081e469592c4cf4c026f7aeecdf8576bef7f2637824257
prometheus-operator-admission-webhook git c7262a43 sha256:1a5751aad5b5ab15deeaec38a73fdc68ea1b31cb9ea111c3d6f616f224afe853
rhel-coreos sha256:e6d89b7d5786d8ed2af66be8d1c8f5b8aef732139440cb7c8356a364ff6efa68
rhel-coreos-extensions sha256:14a70c800f47e31ef85ee226fe1ce3732dc09b6ddb6143012cc21719ff722bc8
service-ca-operator git 538c7b98 sha256:f5eae5e96be10a91d1e9b9dd3635ea4094f764faa7f31d53265212df5acd1c92
telemeter git c1ecd105 sha256:3faaa32742662dcc8b549af1e33a33aee79b91124e131680bedac2449ce1e9fb
thanos git 85eee25c sha256:c2c5beace95fb35152c69a3c17525ee50a84aea73ce5bea328723819cf9c6f22
vsphere-cluster-api-controllers git be22f10a sha256:adb863dad9b9e678f8b70d6f08a35ece84764a878d64aeb987195f3584127b0c
vsphere-csi-driver git 03b7e8eb sha256:1dc0058d25ca5965bd1560496c50adb4825e4c58eb86fab5c5733436558c15fe
vsphere-csi-driver-syncer git 03b7e8eb sha256:358d6556c914dde74969d7a462553dd77a40898d889a30488070262687863992
vsphere-problem-detector git 3683c120 sha256:055c48999cb833a2a596f3a0701a2259d0fc1e3a9cb932a7346ca77e7b9e0d0c

agent-installer-api-server

OCPBUGS-54402: Bump go-jwt to 4.5.2 to fix CVE-30204 (#7486) #7486
OCPBUGS-45244: Bump moby from v26.0.0 to v27.2.1 (#7189) #7189
MGMT-19537: Bump golang.org/x/net to 0.33.0 (#7130) #7130
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-53718: Bump jwt to 4.5.2 in release-4.16 (#1091) #1091
abi: let the bootstrap waiting for workers before rebooting (#1047) #1047
OCPBUGS-47494: MGMT-19537: Bump golang.org/x/net to 0.33.0 (#990) #990
Full changelog

agent-installer-node-agent

run go mod tidy / vendor #1019
Full changelog

alibaba-machine-controllers

OCPBUGS-44242: change the VERSION makefile variable to use OS_GIT_VERSION #58
Full changelog

aws-cluster-api-controllers

OCPBUGS-53726: Update golang-jwt to v4.5.2 #547
Full changelog

aws-machine-controllers

OCPBUGS-46508: fix Associate*IpAddress flag on launch EC2 #121
Full changelog

aws-pod-identity-webhook

OCPBUGS-52513: github.com/go-jose/go-jose/v4 v4.0.5 #203
Full changelog

azure-cloud-controller-manager, azure-cloud-node-manager

OCPBUGS-47645: Prevent panic when informer receives cache.DeletedFinalStateUnknown #133
Full changelog

azure-kms-encryption-provider

OCPBUGS-53494: bump golang-jwt v4 #13
Full changelog

azure-machine-controllers

OCPBUGS-56656: Fix failure when attempting to modify immutable availabilitySet #151
OCPBUGS-56092: Update eviction policy for Spot VMs from Deallocate to Delete #142
OCPBUGS-54990: Re-reconcile machine on NIC provisioning failure #137
OCPBUGS-50966: dynamically setting the amount of fault domains #129
Full changelog

azure-workload-identity-webhook

OCPBUGS-53798: github.com/golang-jwt/jwt/v4 v4.5.2 #33
OCPBUGS-52510: github.com/go-jose/go-jose/v4 v4.0.5 #29
Full changelog

baremetal-installer, installer, installer-altinfra, installer-artifacts

OCPBUGS-54240: Update timeout for GCP WaitFor operation #9715
OCPBUGS-35040: Power VS: Add ports needed for private clusters to security group #8546
OCPBUGS-54327: Remove error logging when determining image arch #9610
OCPBUGS-54345: Remove tmp directory used for agent pxe files #9611
OCPBUGS-54263: IBMCloud: Move to IBM TF openshift fork #9604
OCPBUGS-50547: aws/edge/byovpc: tag edge subnets with shared value #9482
OCPBUGS-52191: [release-4.16] capi/aws: bump provider for LB DNS lookup fix #9547
OCPBUGS-51207: Log correct hostname for validation status #9511
OCPBUGS-51111: PowerVS: destroy dhcp hack #9502
OCPBUGS-48762: Update RHCOS-release-4.16 bootimage metadata to 416.94.202501270445-0 #9478
OCPBUGS-43469: pkg/asset/installconfig/azure: send full certifcate chain #9467
OCPBUGS-49416: [Nutanix] Installation failed with timeout when uploading images to PC #9412
OCPBUGS-47663: [release-4.16] Power VS: Create region-zone-sysType hierarchy #9338
OCPBUGS-48442: Ensure rendezvousIP is checked against host IP #9369
OCPBUGS-45999: Always set cross_tenant_replication_enabled parameter to false #9321
OCPBUGS-45669: aws: fix Node Port Service rule removal #9312
OCPBUGS-45669: [release-4.16] capi/aws: remove allow-all Node Port Service #9281
OCPBUGS-39434: dropping this warning as the move from terraform is transparent to the end user #8951
OCPBUGS-45852: Update upi references to api-internal #9290
OCPBUGS-41813: Validate MTU for custom network #9104
Full changelog

baremetal-machine-controllers

OCPBUGS-46645: Bump x/net to 0.33.0 #226
Full changelog

baremetal-operator

OCPBUGS-53322: BMO can expose any secret via BMCEventSubscription CRD #407
OCPBUGS-49703: Handle HFC for non-redfish HW #396
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-51043: Add HOST env var in oc debug for sos report collects more #1977
Full changelog

cloud-credential-operator

OCPBUGS-56981: Azure: resolve nil pointer exception when role assignment exists #867
OCPBUGS-53416: github.com/golang/glog v1.2.4 #843
OCPBUGS-53822: update github.com/golang-jwt/jwt #839
OCPBUGS-51544: Ignore SNYK-GOLANG-GOLANGORGXOAUTH2JWS-8749594 due to not being affected #829
OCPBUGS-52512: github.com/go-jose/go-jose/v4 v4.0.5 #826
OCPBUGS-47070: golang.org/x/net v0.33.0 #805
OCPBUGS-45939: Add AWS region to aws-pod-identity-webhook #800
OCPBUGS-45007: Add retry to ccoctl gcp create functions #794
Full changelog

cloud-network-config-controller

OCPBUGS-56359: Increase API call timeout to 30 second #172
Full changelog

cluster-authentication-operator

OCPBUGS-54655: Avoid duplicate OAuth client creation #766
Full changelog

cluster-autoscaler

OCPBUGS-54326: improve replica counting and decrease target size behavior #353
OCPBUGS-48732: UPSTREAM: <carry>: 🐛(metrics) Initialize metrics for autoscaler errors, scale events, and pod evictions #339
Full changelog

cluster-autoscaler-operator

OCPBUGS-52329: set max soft bulk taint count to zero #341
Full changelog

cluster-baremetal-operator

OCPBUGS-54546: Add missing relatedObjects #470
Full changelog

cluster-capi-operator

OCPBUGS-49603: fix: always update clusteroperator status versions when differing #253
Full changelog

cluster-dns-operator

OCPBUGS-52498: [release-4.16] Add runbook_url for CoreDNSErrorsHigh #431
Full changelog

cluster-etcd-operator

OCPBUGS-53510: fix CVE-2025-30204 #1403
Full changelog

cluster-image-registry-operator

OCPBUGS-53870: bump github.com/golang-jwt/jwt #1219
OCPBUGS-51600: bump golang.org/x/oauth2 #1210
OCPBUGS-51167: ensure that storage names don’t end in dashes #1181
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-50575: Increase waitForFallbackDegradedConditionTimeout #1805
Full changelog

cluster-machine-approver

OCPBUGS-48258: Fix race condition in CO status controller test #267
OCPBUGS-47704: Filter CSRs by signerName #263
OCPBUGS-45974: Ensure trailing dots on DNS names do not block serving cert auth #257
OCPBUGS-45974: Client internal DNS checks should ignore trailing dot #251
Full changelog

cluster-monitoring-operator

OCPBUGS-46066: Add new metrics for OpenShift logging telemetry #2537
Full changelog

cluster-network-operator

OCPBUGS-56195: Fix live migration with feature migration configured explicitly #2710
OCPBUGS-53317: Fix feature migration for EgressIP #2673
OCPBUGS-52952: Unexpected Behavior During Cluster Upgrade for the ovn-ipsec-host pods #2663
[Release 4.16] OCPBUGS-50712: Not update status.migration of the network.config CR to empty #2651
OCPBUGS-51074: Update egressfirewall CRD to be consistent with ovn-kubernetes repo #2650
OCPBUGS-43803: Start feature migration when the cluster CNI is changed to the target type #2552
OCPBUGS-43715: Skip including default crypto policies to avoid authby issue #2598
OCPBUGS-44338: Prevent live migration process from flapping between step-2 and step-3 #2565
OCPBUGS-46148: Remove ip xfrm state when IPsec is disabled #2595
OCPBUGS-45593: Pass transit_switch_subnet options in ovnkube-node pod #2584
Full changelog

cluster-node-tuning-operator

use ROLE_WORKER_CNF environment variable to determine mcp name (#1292) #1292
e2e: tuned degraded test fix (#1282) #1282
Adjust Workload Hints test cases based on Intel or AMD (#1277) (#1281) #1277
e2e:performance: decode to valid kubeletconfig object (#1273) #1273
cmd: PPC: support tolerating heterogeneous core IDs (#1252) (#1268) #1252
e2e: add irdma to module_blacklist kernel args (#1267) #1267
OCPBUGS-47678: performanceprofile cpuset input validation (#1264) #1264
Fix context deadlines in ExecCommandOnPod() (#1263) #1263
OCPBUGS-46496: [release-4.16] Add vendor and architecture specific tuning options (#1254) #1254
OCPBUGS-45264: Normalize cpu sets when rendering to Tuned profiles (#1238) (#1251) #1238
Full changelog

cluster-openshift-controller-manager-operator

OCPBUGS-48657: Add new team members to owners file #378
Full changelog

cluster-samples-operator

OCPBUGS-55457: Adding mutex to func createSamples on handler.go #633
OCPBUGS-54420: add rhdmalone to owners #620
OCPBUGS-48848: add shannon and aroyoredhat as owners #596
Full changelog

cluster-storage-operator

OCPBUGS-52353: fix Vsphere cluster Storage operator in Unavailable state #563
OCPBUGS-46077: Fix PodStartupStorageOperationsFailing alert #548
Full changelog

cluster-version-operator

OCPBUGS-55156: Fix a panic caused by a data race #1178
OCPBUGS-50590: Set openshift.io/required-scc: privileged annotation in version pods #1153
OCPBUGS-46408: Filter out shallowly UpdateEffectNone errors from a MultipleErrors message in the Failing condition #1128
OCPBUGS-45329: deps: bump golang.org/x/net to 0.31.0 #1118
Full changelog

console

OCPBUGS-57326: Remove logoutOpenShift method call #15172
OCPBUGS-57270: Debug pod logs are not accessible when debugging a node via OpenShift Console #15165
OCPBUGS-57096: Add all files to vendor regardless of gitignore #15133
OCPBUGS-57089: Sample segment sessions #15130
OCPBUGS-56858: remove 60 day alert from cluster update modal #15102
OCPBUGS-56715: update the Deployment pod on change in imageStream #15091
OCPBUGS-56472: Remove the devconsole backend common internet proxy and replace it with dedicated ones #15072
OCPBUGS-55378: Do not load CSRs if user does not have permissions #15000
OCPBUGS-55644: fix bug where operator appears twice #15016
OCPBUGS-45142: Add missing pipelines plugin name to known plugins #14550
OCPBUGS-48628: Added token to proxy header #14693
OCPBUGS-54174: Update the monitoring topic used by the console team #14900
OCPBUGS-52450: fix run time error when no completed version exists #14840
OCPBUGS-52851: Show Observe section without PROMETHEUS and MONITORING flags #14849
OCPBUGS-52288: While upgrading the cluster from UI observed Warning alert:Admission Webhook Warning #14821
OCPBUGS-49409: ERROR in search tool: Cannot read properties of undefined (reading ‘state’) #14703
OCPBUGS-52418: While accessing the node terminal from UI observed ‘Warning alert:Admission Webhook Warning` #14837
OCPBUGS-49979: Set default build option as BUILDS for Builder Image sample #14730
OCPBUGS-49800: Fix Function Import: An error occurred Cannot read properties of undefined (reading ‘filter’) #14715
OCPBUGS-49801: use default StorageClass for ServerlessFunction pipelineVolumeClaimTemplate #14716
OCPBUGS-46388: fix alert rule link #14808
OCPBUGS-52252: Fix alert rule link to alert in dev perspective #14817
OCPBUGS-46441: Do not pass CSV name to operand list page when an exen… #14627
OCPBUGS-36963: Manually create an API token for a ServiceAccount #14057
OCPBUGS-35394: sessions: fix sessions pruning #13969
OCPBUGS-46602: ReRun of Resolver based PipelineRuns fails from UI #14641
OCPBUGS-46567: ImagePullSecret getting duplicated when editing DeploymentConfig in Form View #14636
OCPBUGS-48162: OCP web console show pod status as Init:0/1 after using Native sidecars #14668
OCPBUGS-43672: Disable GQL introspection #14638
OCPBUGS-45334: fix table combination #14576
OCPBUGS-41342: fix namespace for networkpolicy #14244
OCPBUGS-46022: Plugins that use very old PF4 dropdown or menu components with grouped items have bullets and padding that needs to be removed. #14612
OCPBUGS-45229: Unable to remove finally tasks in pipeline builder mode #14558
OCPBUGS-45245: use TaskRuns results.tekton.dev/record annotation to get the logs #14563
OCPBUGS-41523: i18n upload/download routine task - Sprint 254 #14258
Full changelog

console-operator

OCPBUGS-46481: Dont disable console when authConfig type is set to None #952
Full changelog

container-networking-plugins, containernetworking-plugins-microshift

OCPBUGS-55648: Check error returned by ipv6 SettleAddresses #188
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-43426: Merge https://github.com/kubernetes/cloud-provider-openstack:release-1.29 into release-4.16 #303
Full changelog

docker-builder

OCPBUGS-53076: Upgraded Kubernetes dependency from 1.28.2 to 1.29.0 #468
OCPBUGS-42893, OCPBUGS-42914: buildah dependency bump to fix - Buildah allows arbitrary directory mount and symlink traversal vulnerability in the containers/storage library #450
OCPBUGS-43186: runc library bump to 1.1.12 #420
OCPBUGS-47775: skipping some unit tests to avoid failures as they are duplicate #424
OCPBUGS-48159: Add team members to the OWNERS file #426
Full changelog

docker-registry

OCPBUGS-53654: bump jwt and oauth dependencies #432
OCPBUGS-49696: bump docker distribution #423
Full changelog

etcd

NO-ISSUE: Add support for cachi2 based deps #298
Full changelog

gcp-machine-controllers

OCPBUGS-55249: Disable shielded VMs for non-UEFI disks #116
OCPBUGS-48484: Refactor exists() to handle gcp API change #106
Full changelog

haproxy-router

OCPBUGS-49391: Reject All CA-Signed Certs Using SHA1 #651
Full changelog

hyperkube, pod

OCPBUGS-57290: UPSTREAM: <carry>: Bump cadvisor version to fix kubelet #2325
OCPBUGS-49906: Bump k8s api to 1.29.14 #2211
OCPBUGS-45931: UPSTREAM: <carry>: kubelet/cm: fix bug where kubelet restarts from missing cpuset cgroup #2158 #2200
OCPBUGS-46003: Bump k8s api to 1.29.11 #2161
Full changelog

hypershift

OCPBUGS-57494: Add proxy variables for the MCD Pod #6286
OCPBUGS-55697: Add validation to avoid conflicts between KubeAPIServer and NamedCertificates SANs #6114
CNTRLPLANE-919: Konflux build pipeline service account migration #6087
CNTRLPLANE-919: Konflux build pipeline service account migration #6082
OCPBUGS-51804: Fix golang crypto dependency go.mod replacement #5994
OCPBUGS-54914: Add konnectivity-proxy sidecar to openshift-oauth-apiserver #6026
OCPBUGS-54632: Sync RBAC for attaching volumes on VM level #5998
OCPBUGS-49914: Reconcile proxy CA bundle into hosted cluster #5983
OCPBUGS-53902: bump golang-jwt v4 and v5 #5907
Red Hat Konflux update control-plane-operator-4-16 #5957
ART-11792: update go mod dependency for konflux #5922
OCPBUGS-51733, OCPBUGS-51804: Bump dependencies to OCP fork in backports #5901
OCPBUGS-53308: fix(deps): bump go-jose #5866
OCPBUGS-52506: refactor aws identity health check into new controller #5781
OCPBUGS-52857: Make managed-trust-bundle optional #5809
OCPBUGS-52426: change plaform to platform #5773
OCPBUGS-50993: Honor proxy vars in the util insecure http client #5662
OCPBUGS-46466: Consistently look up and dial cloud API hostnames #5301
OCPBUGS-50698: add region to AWS creds passed to operators managed by CPO #5670
OCPBUGS-51296: 4.17 Add HostedCluster additional trustbundles to konnectivity-https-proxy #5707
NO-JIRA: chore(deps): update dependency mkdocs-material to v9.6.5 #5686
OCPBUGS-50694: OCPBUGS-50692: Fix IsIPv4 function identifying also addresses instead of CIDRs #5620
NO-JIRA: chore(deps): update dependency mkdocs-material to v9 #5635
OCPBUGS-50557: Prevent IgnitionServer from flooding the API server with patch requests #5599
NO-JIRA: chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v9.5-1739267472 #5597
NO-JIRA: chore(deps): update dependency mkdocs-material to v8.5.11 #5591
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.6.3 #5587
NO-JIRA: chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v9.5-1738746453 #5574
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.6.2 #5575
NO-JIRA: chore(deps): update dependency mkdocs to v1.6.1 #5531
NO-JIRA: chore(deps): update dependency mkdocs-glightbox to v0.4.0 #5532
OCPBUGS-49640: fix overwriting PKI operator HCP conditions #5506
NO-JIRA: chore(deps): chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v9.5-1737480393 - abandoned #5484
NO-JIRA: chore(deps): update konflux references (release-4.16) #5477
NO-JIRA: Update squidfunk/mkdocs-material Docker tag to v9.5.50 (release-4.16) #5437
NO-JIRA: Update Konflux references (release-4.16) #5431
NO-JIRA: chore(deps): update konflux references (release-4.16) #5384
NO-JIRA: Update registry.access.redhat.com/ubi9/go-toolset Docker tag to v9 (release-4.16) #5298
NO-JIRA: [release-4.16] Bump golang.org/x/crypto and golang.org/x/net #5370
NO-JIRA: Update Konflux references (release-4.16) #5328
NO-JIRA: Red Hat Konflux update control-plane-operator-4-16 #5337
OCPBUGS-47539: Separate CPO containerfiles #5333
chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.22.7-1733160835 (release-4.16) #5295
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.49 (release-4.16) #5297
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.48 (release-4.16) #5294
NO-JIRA: Update Konflux References and Perform Migration for Release-4.16 #5261
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-53910: bump github.com/golang-jwt/jwt/v4 to v4.5.2 #84
Full changelog

insights-operator

Ignore previous status when disabling alerts (#1061) #1061
OCPBUGS-45203: LokiStack gatherer (#1051) #1051
OCPBUGS-45044: insightsoperator.operator.openshift.io resource is create-only (#1054) #1054
Full changelog

ironic

METAL-1306: Do not use openstack packages #648
OCPBUGS-49895: Drop quiet option of grep to avoid race condition with pipefail #634
OCPBUGS-48151, OCPBUGS-48598: Bump jinja2 to 3.0.1-6.el9.2 #623
Full changelog

ironic-agent

METAL-1306: Do not use openstack packages #180
Full changelog

ironic-static-ip-manager

OCPBUGS-49595: Fix subnet validation #48
Full changelog

kube-metrics-server

: OCPBUGS-46663: Disable HTTP2 #41
Full changelog

kube-proxy, sdn

OCPBUGS-54457: Drop SYNACK as well in MCS side #658
OCPBUGS-44674: Handle openshift-host-network namespace as special when it modifies #648
OCPBUGS-46493: Raise the minSyncPeriod for NetworkPolicies to 10s during migration #649
OCPBUGS-46048: clean up containernetworking/plugins vendoring in sdn #645
OCPBUGS-45806: Stop checking ruleVersion [4.16] #643
Full changelog

kubevirt-csi-driver

OCPBUGS-54632: Ensure volume stays attached through reboots #57
OCPBUGS-44622: During detach don’t return error if VM is not found #49
Full changelog

machine-api-operator

OCPBUGS-55248, OCPBUGS-55249: Updates GCP credentials request #1355
OCPBUGS-53045: add image/read permissions #1348
OCPBUGS-52342: Drop oVirt support #1336
OCPBUGS-45947: vSphere klog initialization preventing verbose log messages #1312
OCPBUGS-45998: Ensure deletion annotation takes priority and oldestPolicy can distinguish longer ages #1313
Full changelog

machine-config-operator

OCPBUGS-48283: Do not run resolv-prepender from NM dispatcher #4784
OCPBUGS-56868: daemon: fix ostree-finalize-staged race workaround for package mode RHEL workers #5090
OCPBUGS-56626: error from generateAndValidateRenderedMachineConfig function can be misleading #5075
OCPBUGS-54831: Make mtu-migration run after wait-for-primary-ip #4990
OCPBUGS-55684: MSBIC should not update windows machinesets #5028
OCPBUGS-35921: userCA and cloudCA certfiicates are not removed from nodes and ignition config #4419
OCPBUGS-53248: Enforce VIPs to be collocated at the same host #4923
OCPBUGS-53043: Enable nmstate-configuration on all platforms #4910
OCPBUGS-52952: Add ipsec connect wait service #4931
OCPBUGS-54163: Fixing typos for MachineConfigNode #4942
OCPBUGS-53434: Update ObservedGeneration in KubeletConfig #4935
OCPBUGS-53313: daemon: ensure ostree-finalize-staged is started before rebooting #4928
OCPBUGS-52421: Update format verbs for alert logs #4901
OCPBUGS-51347: Update the storage.conf configuration file template #4881
OCPBUGS-52593: Update cluster-reader ClusterRole permissions #4905
OCPBUGS-52404: create /run/nodeip-configuration before use #4897
OCPBUGS-52310: configure-ovs workaround for ovs-if-br-ex bug #4892
OCPBUGS-50862: Auto-recover from MC with invalid extension #4853
OCPBUGS-43680: Regenerate the rendered MC in use when deleted #4655
OCPBUGS-49976: Add clarification to invalid maxUnavailable alert #4837
OCPBUGS-39224: Do not enable on-prem-resolv-prepender.path for UPI #4573
OCPBUGS-48290: Pausing Master MCP results in Alerts #4786
OCPBUGS-43765: openstack: fix non-old systemd compatible unit #4660
OCPBUGS-43741: Soften haproxy timeout for kubeapi probe #4662
OCPBUGS-48116: OCPBUGS-47801: trying to wait for sub-controllers #4777
OCPBUGS-45974: Remove trailing periods from AWS provided hostnames #4744
Full changelog

machine-os-images

OCPBUGS-54169: Change rhcos release browser url #57
Full changelog

monitoring-plugin

OU-559: fix log based alerts namespace for dev console #320
Full changelog

multus-cni, multus-cni-microshift

OCPBUGS-47472: adds getcontext (backport 4.16) #261
Full changelog

multus-whereabouts-ipam-cni

OCPBUGS-55618: Fixes leftover podref issue #365
OCPBUGS-50005: [Release-4.17]Kubeconfig loop #340
Full changelog

must-gather

OCPBUGS-42960: Gather OSUS data #455
OCPBUGS-48082: Update owners #473
OCPBUGS-46407: Support gathering IPsec data #469
OCPBUGS-42969: Collect etcd object count #454
Full changelog

network-tools

add missing go vendors #140
Full changelog

nutanix-machine-controllers

OCPBUGS-47266: fixing CVE-2024-45338 #93
Full changelog

oauth-apiserver

OCPBUGS-30525: Update dependencies to address CVE-2024-24786 #124
Full changelog

oc-mirror

changes the owners file (#1015) #1015
OCPBUGS-48513: e2e: use same version of crane as in go.mod (#1021) #1021
Full changelog

openshift-apiserver

OCPBUGS-49656: prevent panic when no image and error are set #494
OCPBUGS-49656: validate image property isn’t nil before using #493
OCPBUGS-49656: move on to the next digest/tag during failures #492
OCPBUGS-45010: Pass expected type to deploymentconfig/scale object validation. #461
Full changelog

openshift-controller-manager

OCPBUGS-57513: Set node-pullsecrets volume to read-only to protect image pull credentials #394
OCPBUGS-56354: Empty proxy variables are causing issues during the build #382
OCPBUGS-44186: user system:serviceaccount:openshift-infra:serviceaccount-pull-secrets-controller in ns/openshift-infra must not produce too many applies #351
OCPBUGS-48202: Add team members to the OWNERS file #358
Full changelog

openstack-cluster-api-controllers

OCPBUGS-58028: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.10 into release-4.16 #346
Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

OCPBUGS-56358: fix(olm): improve error logging for missing olm.managed label (#3558) #1006
OCPBUGS-53395: Ensure that PSA label is latest instead of pinning versions #987
OCPBUGS-48696: Fix excessive catalog source snapshots cause severe performance regression #957
OCPBUGS-48661: Fix concurrent namespace resolution #947
OCPBUGS-46928, OCPBUGS-46935, OCPBUGS-47315: x/net bump to v0.34.0 [release-4.16] #939
OCPBUGS-47738: catalog-operator: Delete Pods that were evicted (#3459) #925
OCPBUGS-46434: CRD upgrade existing CR validation fix #916
Full changelog

operator-marketplace

OCPBUGS-49429: Upgrade golang.org/x/net [release-4.16] #587
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-55282: Fix hybrid overlay node subnets collision with cluster subnets #2621
OCPBUGS-48121: Increase InformerSyncTimeout to 60s #2624
OCPBUGS-56242: Handles unspecified protocol in network policy port #2571
OCPBUGS-56812: egressfirewall: avoid nil dereference on node delete #2591
OCPBUGS-52503: Fixes unexpected mp0 route removal during start up #2479
OCPBUGS-54204: Update OVN to FDP25.A.1 24.03.5-40. #2497
OCPBUGS-50595: kubevirt, localnet: Reduce live migration downtime #2469
OCPBUGS-50594: fixes overzealous deletion of SNAT in egressIP #2456
OCPBUGS-47634: Let OVN-northd bind remote ports #2406
OCPBUGS-45958: bump OVS to 3.3.0-62.el9fdp for OCP 4.16 #2388
OCPBUGS-44457: Add static route to the hairpin masquerade IPs to pod #2346
OCPBUGS-45942: pin libreswan to 4.6-3.el9_0.3 #2386
OCPBUGS-45343: Dockerfile: Update OVN to the 24.03.2-32.el9fdp minor release. #2377
Full changelog

prometheus

OCPBUGS-56739: BACKPORT: fix promtool analyze block shows metric name with 0 cardinality #255
OCPBUGS-54942: Scraping: Bump cache iteration after error to avoid false duplicate detection. #250
OCPBUGS-43668: fix(discovery): Handle cache.DeletedFinalStateUnknown in node informers’ DeleteFunc #231
Full changelog

route-controller-manager

OCPBUGS-56152: Added error event for failed ingress to route conversion #61
OCPBUGS-55201: ingress: Reset metrics when ingress is deleted #58
Full changelog

tests

OCPBUGS-57203: fix: remove un-needed test #29849
OCPBUGS-34163: Fix regex parser for censoring private key #29805
OCPBUGS-56704: aws/edge: prevent test using unschedulable nodes #29847
OCPBUGS-55476: support provider type external #29738
OCPBUGS-55636: [build] Ensure Git Clone Does Not Run Privileged #29746
OCPBUGS-54768: Fix egress firewall tests by updating the URL from docs.openshift.com to redhat.com #29663
OCPBUGS-52581: Use payload pullspec for image info test #29589
OCPBUGS-52343: Try also user CA for getting openshift-tests image #29578
OCPBUGS-44119: Ignore infra nodes on tap cni tests #29261
OCPBUGS-48448: Add team members to the OWNERS file for PR approvals #29443
OCPBUGS-48348: Fixing build s2i ruby test data inline with latest ruby version(>=3.0) #29431
Full changelog

vsphere-cloud-controller-manager

OCPBUGS-46341: update check-fmt goimports command #83
Full changelog

vsphere-csi-driver-operator

OCPBUGS-51206: Set reconcile-sync to 10 minute for ListVolume #294
OCPBUGS-49862: List only linux nodes #289
Full changelog

View changelog in Markdown or change previous release:

Source code for this page located on github