Back to index
Download the installer for your operating system or run
oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.16.44-x86_64 Team Approvals:
Tests:
Blocking jobs Informing jobs Upgrades from:
Untested upgrades:
4.15.22 ,
4.15.23 ,
4.15.24 ,
4.15.26 ,
4.15.27 ,
4.15.28 ,
4.15.29 ,
4.15.30 ,
4.15.31 ,
4.15.32 ,
4.15.33 ,
4.15.34 ,
4.15.35 ,
4.15.36 ,
4.15.37 ,
4.15.38 ,
4.15.39 ,
4.15.40 ,
4.15.41 ,
4.15.42 ,
4.15.43 ,
4.15.44 ,
4.15.45 ,
4.15.46 ,
4.15.48 ,
4.15.49 ,
4.15.50 ,
4.15.51 ,
4.16.10 ,
4.16.11 ,
4.16.12 ,
4.16.13 ,
4.16.14 ,
4.16.16 ,
4.16.17 ,
4.16.18 ,
4.16.19 ,
4.16.20 ,
4.16.21 ,
4.16.23 ,
4.16.24 ,
4.16.25 ,
4.16.26 ,
4.16.27 ,
4.16.28 ,
4.16.29 ,
4.16.3 ,
4.16.30 ,
4.16.32 ,
4.16.34 ,
4.16.35 ,
4.16.36 ,
4.16.37 ,
4.16.38 ,
4.16.39 ,
4.16.40 ,
4.16.5 ,
4.16.6 ,
4.16.7 ,
4.16.8 ,
4.16.9 Loading changelog, this may take a while ...
Changes from 4.16.0
Created: 2025-07-11 11:36:36 +0000 UTC
Image Digest: sha256:f41be65a929742f584bb4299dfa48135b093b3cc86dc76c3ab77265574bdd4fe
Components
FeatureGate Changes
FeatureGate
Default
Default
DevPreviewNoUpgrade
DevPreviewNoUpgrade
TechPreviewNoUpgrade
TechPreviewNoUpgrade
ExternalRouteCertificate
Unconditionally Enabled
Unconditionally Enabled
Unconditionally Enabled
Unconditionally Enabled
Unconditionally Enabled
Unconditionally Enabled
New images
Removed images
ovirt-machine-controllers
Rebuilt images without code change
OCPBUGS-33693 : Updating aws-kms-encryption-provider-container image to be consistent with ART for 4.16 #18 hack: display diff on verify-mod-tidy failure #26
Full changelog
use ROLE_WORKER_CNF environment variable to determine mcp name (#1292) #1292
e2e: tuned degraded test fix (#1282) #1282
Adjust Workload Hints test cases based on Intel or AMD (#1277) (#1281) #1277
e2e:performance: decode to valid kubeletconfig object (#1273) #1273
cmd: PPC: support tolerating heterogeneous core IDs (#1252) (#1268) #1252
e2e: add irdma to module_blacklist kernel args (#1267) #1267
OCPBUGS-47678 : performanceprofile cpuset input validation (#1264) #1264 Fix context deadlines in ExecCommandOnPod() (#1263) #1263
OCPBUGS-46496 : [release-4.16] Add vendor and architecture specific tuning options (#1254) #1254 OCPBUGS-45264 : Normalize cpu sets when rendering to Tuned profiles (#1238) (#1251) #1238 E2E: fix modify node selector to use lowercase (#1209) #1209
Fixing empty tuned submodule when using Dockerfile (#1212) #1212
OCPBUGS-38900 : Drop sched_migration_cost_ns setting (#1203) #1203 Make ocp-tuned-one-shot.service restart on-failure (#1202) #1202
Unblock 4.16 CI (#1204) #1204
e2e: performance: verify tuned one-shot service vs kubelet (#1192) #1192
E2E: Add test to verify cpuset.cpus.exclusive is writeable (#1153) #1153
OCPBUGS-39005 : Add cluster-wide proxy env file (#1166) #1166 OCPBUGS-36431 Fix generated cpu mask for 512+ cpus (#1152) #1152
E2E: Remove checking of reserved cpus in irqbalance file (#1156) #1156
Fix the destination of asset’s copy (#1134) #1134
Full changelog
OCPBUGS-55156 : Fix a panic caused by a data race #1178 OCPBUGS-50590 : Set openshift.io/required-scc: privileged annotation in version pods #1153 OCPBUGS-46408 : Filter out shallowly UpdateEffectNone errors from a MultipleErrors message in the Failing condition #1128 OCPBUGS-45329 : deps: bump golang.org/x/net to 0.31.0 #1118 OCPBUGS-43964 : Fix desired before sync_worker’s work is initialized #1097 OCPBUGS-37853 : Revert “OCPBUGS-35994: Revert “OCPBUGS-24535: pkg/payload/precondition/clusterversion/rollback: Allow previous version within z-stream”” #1077 OCPBUGS-36898 : vendor: Update openshift/api to pick up zz_generated.crd-manifests #1069 OCPBUGS-36764 : Revert “OCPBUGS-24535: pkg/payload/precondition/clusterversion/rollback: Allow previous version within z-stream” #1065 Full changelog
OCPBUGS-58505 : [release-4.16] Add missing service network DNS entries to KAS cert #6393 OCPBUGS-57494 : Add proxy variables for the MCD Pod #6286 OCPBUGS-55697 : Add validation to avoid conflicts between KubeAPIServer and NamedCertificates SANs #6114 CNTRLPLANE-919 : Konflux build pipeline service account migration #6087 CNTRLPLANE-919 : Konflux build pipeline service account migration #6082 OCPBUGS-51804 : Fix golang crypto dependency go.mod replacement #5994 OCPBUGS-54914 : Add konnectivity-proxy sidecar to openshift-oauth-apiserver #6026 OCPBUGS-54632 : Sync RBAC for attaching volumes on VM level #5998 OCPBUGS-49914 : Reconcile proxy CA bundle into hosted cluster #5983 OCPBUGS-53902 : bump golang-jwt v4 and v5 #5907 Red Hat Konflux update control-plane-operator-4-16 #5957
ART-11792 : update go mod dependency for konflux #5922 OCPBUGS-51733 , OCPBUGS-51804 : Bump dependencies to OCP fork in backports #5901 OCPBUGS-53308 : fix(deps): bump go-jose #5866 OCPBUGS-52506 : refactor aws identity health check into new controller #5781 OCPBUGS-52857 : Make managed-trust-bundle optional #5809 OCPBUGS-52426 : change plaform to platform #5773 OCPBUGS-50993 : Honor proxy vars in the util insecure http client #5662 OCPBUGS-46466 : Consistently look up and dial cloud API hostnames #5301 OCPBUGS-50698 : add region to AWS creds passed to operators managed by CPO #5670 OCPBUGS-51296 : 4.17 Add HostedCluster additional trustbundles to konnectivity-https-proxy #5707 NO-JIRA: chore(deps): update dependency mkdocs-material to v9.6.5 #5686
OCPBUGS-50694 : OCPBUGS-50692: Fix IsIPv4 function identifying also addresses instead of CIDRs #5620 NO-JIRA: chore(deps): update dependency mkdocs-material to v9 #5635
OCPBUGS-50557 : Prevent IgnitionServer from flooding the API server with patch requests #5599 NO-JIRA: chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v9.5-1739267472 #5597
NO-JIRA: chore(deps): update dependency mkdocs-material to v8.5.11 #5591
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.6.3 #5587
NO-JIRA: chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v9.5-1738746453 #5574
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.6.2 #5575
NO-JIRA: chore(deps): update dependency mkdocs to v1.6.1 #5531
NO-JIRA: chore(deps): update dependency mkdocs-glightbox to v0.4.0 #5532
OCPBUGS-49640 : fix overwriting PKI operator HCP conditions #5506 NO-JIRA: chore(deps): chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v9.5-1737480393 - abandoned #5484
NO-JIRA: chore(deps): update konflux references (release-4.16) #5477
NO-JIRA: Update squidfunk/mkdocs-material Docker tag to v9.5.50 (release-4.16) #5437
NO-JIRA: Update Konflux references (release-4.16) #5431
NO-JIRA: chore(deps): update konflux references (release-4.16) #5384
NO-JIRA: Update registry.access.redhat.com/ubi9/go-toolset Docker tag to v9 (release-4.16) #5298
NO-JIRA: [release-4.16] Bump golang.org/x/crypto and golang.org/x/net #5370
NO-JIRA: Update Konflux references (release-4.16) #5328
NO-JIRA: Red Hat Konflux update control-plane-operator-4-16 #5337
OCPBUGS-47539 : Separate CPO containerfiles #5333 chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.22.7-1733160835 (release-4.16) #5295
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.49 (release-4.16) #5297
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.48 (release-4.16) #5294
NO-JIRA: Update Konflux References and Perform Migration for Release-4.16 #5261
OCPBUGS-39372 : Fixed NodePool version validation #5219 NO-JIRA: Update squidfunk/mkdocs-material Docker tag to v9.5.47 (release-4.16) #5209
NO-JIRA: chore(deps): update konflux references (release-4.16) #5207
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.46 (release-4.16) #5189
OCPBUGS-43930 : Return the right tagReference on Catalogs ImageStream #5133 NO-JIRA: chore(deps): update konflux references (release-4.16) #5161
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.45 (release-4.16) #5163
chore(deps): update konflux references (release-4.16) #5135
OCPBUGS-44277 : Configure OAuth https proxy to dial cloud endpoints directly #5069 chore(deps): update konflux references (release-4.16) #5119
OCPBUGS-43973 : Add network policies for konnectivity server and ignition server proxy #4998 NO-JIRA: Update Konflux references (release-4.16) #5112
NO-JIRA: Update Konflux references (release-4.16) #5099
chore(deps): update konflux references (release-4.16) #5078
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.44 (release-4.16) #5059
NO-JIRA: chore(deps): update konflux references (release-4.16) #5058
NO-JIRA: Update Konflux references (release-4.16) #5042
chore(deps): update konflux references (release-4.16) #5024
chore(deps): update konflux references (release-4.16) #5019
NO-JIRA: Update squidfunk/mkdocs-material Docker tag to v9.5.43 (release-4.16) #5017
NO-JIRA: Update Konflux references (release-4.16) #5012
OCPBUGS-43840 : add ValidIDPConfiguration condition to report IDP config issues #4985 NO-JIRA: chore(deps): update konflux references (release-4.16) #4971
OCPBUGS-43046 : Do not send traffic to local audit-webhook through konnectivity #4883 NO-JIRA: chore(deps): update konflux references (release-4.16) #4954
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.42 (release-4.16) #4947
NO-JIRA: chore(deps): update konflux references (release-4.16) #4933
OCPBUGS-43104 : label routes only when HCP router used #4899 OCPBUGS-43308 : Use guest DNS resolution in Konnectivity HTTPS proxy by default #4905 NO-JIRA: chore(deps): update konflux references (release-4.16) #4923
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.41 (release-4.16) #4919
NO-JIRA: chore(deps): update konflux references to 674e70f (release-4.16) #4908
NO-JIRA: chore(deps): update konflux references (release-4.16) #4896
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.40 (release-4.16) #4880
OCPBUGS-42432 : Use KubeClientCABundle for HostedClusterConfigOperator cluster-signer-ca #4799 OCPBUGS-42342 : Let payload generation pick the release for the NodePool #4787 OCPBUGS-42431 : Conditionally manage kubeconfig secrets for DNS and Ingress operators #4798 NO-JIRA: chore(deps): update konflux references (release-4.16) #4853
OCPBUGS-42608 : Add Annotation to skip deleting hcp namespace #4830 NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.39 (release-4.16) #4827
chore(deps): update konflux references (release-4.16) #4816
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.38 (release-4.16) #4806
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.37 (release-4.16) #4796
chore(deps): update konflux references (release-4.16) #4781
NO-JIRA: chore(deps): update konflux references (release-4.16) #4760
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.36 (release-4.16) #4759
NO-JIRA: Security fixes for openshift-ci-security job #4750
OCPBUGS-41372 : CPO oauth idp converter: resolve names before dialing #4689 NO-JIRA: chore(deps): update golang docker tag to v1.23 (release-4.16) #4729
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.34 (release-4.16) #4728
NO-JIRA: chore(deps): update konflux references (release-4.16) #4727
OCPBUGS-38058 : Add HTTP konnectivity proxy to OAuth server #4496 HOSTEDCP-1955 : bump CCO version #4696 OCPBUGS-34803 : cmd: report server version, supported OCP #4141 OCPBUGS-39293 : copy image-registry AdditionalTrustedCA configmap into HC openshift-config #4647 chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.21.11-9 (release-4.16) #4685
OCPBUGS-38062 : [release-4.16] Use HTTP proxy for ingress controller #4688 NO-JIRA: chore(deps): update konflux references (release-4.16) #4684
OCPBUGS-39447 : handle version skewed NodePools that do not have rhel9 binaries #4664 HOSTEDCP-1895 : [release-4.16] Allow setting Kube APIServer maximum requests in flight #4551 chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.21.11-7.1724661022 (release-4.16) #4600
chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.33 (release-4.16) #4602
chore(deps): update konflux references (release-4.16) #4599
OCPBUGS-38942 : copy oapi ca-trust recursively when building trust anchor #4615 NO-JIRA: Flaky cert validation test #4622
OCPBUGS-38259 : Set KCM node monitor grace period #4520 OCPBUGS-38726 : fix: bump github.com/IBM/go-sdk-core/v5 #4611 HOSTEDCP-1764 : retrieve registryOverrides when ImageStream is not ava… #4541 chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.21.11-7 (release-4.16) #4525
OCPBUGS-36781 : Set Azure VM identity if user assigned identity set #4341 OCPBUGS-37936 : set proxy envvars on aws and azure CCMs #4476 OCPBUGS-38486 : hcco: reconcile apiserver config into hosted cluster #4559 NO-JIRA: fix(KONFLUX-3663): format PipelineRun files and upload SAST results #4534
OCPBUGS-38131 : Let the CPO oidc check resolve through data plane #4505 NO-JIRA: test: relax mgmt KAS egress check #4561
chore(deps): update quay.io/openshift/origin-base docker tag to v4.16 (release-4.16) #4528
chore(deps): update golang docker tag to v1.22 (release-4.16) #4527
NO-JIRA: Update Konflux references (release-4.16) #4524
OCPBUGS-34801 : remove weak ciphers from security profile #4518 OCPBUGS-37060 : OCPBUGS-35905: E2E test to verify openshift-apiserver TLS certificates #4366 NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9 (release-4.16) #4482
NO-JIRA: chore(deps): update konflux references (release-4.16) #4481
OCPBUGS-37065 : OCPBUGS-35899: Doubled machineHealthCheck timeout on Agent and None #4367 OCPBUGS-30282 : Multiple MachineConfigs in one CM #4398 OCPBUGS-36937 : [release-4.16] Add HTTP(s) konnectivity proxy and use it with OpenShift APIServer #4357 OCPBUGS-36766 : Delete IDMS in dataplane once HCP ICS field is removed #4434 NO-JIRA: Konflux migration for release-4.16 #4436
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v8.5.11 (release-4.16) #4430
HOSTEDCP-1569 : test: e2e: skip unknown conditions instead of erroring #4440 OCPBUGS-37645 : Set right endpointSlice port #4431 OCPBUGS-37214 : Separate ibmcloud kms encryption configuration types #4380 OCPBUGS-37302 : fix(api): Nodepool CEL validation fix #4395 NO-JIRA: Red Hat Konflux update hypershift-release-mce-26 #4392
OCPBUGS-37241 : extract rhel9 MCO binaries for rhel8 based MCO images #4383 NO-JIRA: [release-4.16] test/e2e: remove api budget checks #4368
HOSTEDCP-1795 , HOSTEDCP-1796 : Customize the self-generated cert validity and rotation #4371 NO-JIRA: chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.21.11-2 (release-4.16) - abandoned #4364
NO-JIRA: trivial typo fixes to configuring-storage.md #4353
OCPBUGS-36849 : Add newline after TLS certs referenced by image.config #4352 OCPBUGS-36589 : Fix Hypershift dump for non-OpenShift Management Clusters #4317 NO-JIRA: chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.21.10-1.1719562237 (release-4.16) - abandoned #4328
OCPBUGS-36358 : enable audit log for oauth-openshift #4302 OCPBUGS-35522 : Copy infra-volumesnapshot-class-mapping to core binding #4291 NO-JIRA: chore(deps): update konflux references (release-4.16) #4299
OCPBUGS-36227 : kubevirt-csi-driver: Pass infra kubeconfig in case of external infra #4276 OCPBUGS-35341 : [release-4.16] Fixed ValidReleaseInfo condition #4204 OCPBUGS-36220 : Make guest cluster components use the correct KAS port #4275 OCPBUGS-35934 : check mgmt cluster for route capability before DeleteIfNeeded for ovn sbdb route #4264 NO-JIRA: chore(deps): update konflux references (release-4.16) #4260
OCPBUGS-34545 : Disable PersistentVolumeLabel admission plugin #4241 OCPBUGS-35838 : Remove KMS V1 provider support for IBM Cloud #4250 NO-JIRA: chore(deps): update konflux references (release-4.16) #4251
OCPBUGS-35369 : OCPBUGS-35252: Enforce Privileged Instead of Restricted PSA in 4.16 #4193 NO-JIRA: chore(deps): update konflux references (release-4.16) #4245
OCPBUGS-35557 : Complete KAS migration to none endpoint reconciler type #4227 NO-JIRA: chore(deps): update konflux references (release-4.16) #4238
NO-JIRA: feat(olm): Set packageserver replicas to 2 for IBMCloudPlatform #4230
OCPBUGS-35268 : Add hypershift-cluster-version-operator image to release providers #4185 NO-JIRA: chore(deps): update konflux references (release-4.16) #4235
NO-JIRA: Red Hat Konflux update hypershift-release-mce-26 #4233
OCPBUGS-35056 : Generate default worker security group rules based on machineCIDR #4174 Full changelog
Ignore previous status when disabling alerts (#1061) #1061
OCPBUGS-45203 : LokiStack gatherer (#1051) #1051 OCPBUGS-45044 : insightsoperator.operator.openshift.io resource is create-only (#1054) #1054 gather selected clusterroles (#1023) #1023
OCPBUGS-39564 : Not able to enable repositories during entitled build in OCP Cluster on IBM-Z (#1013) #1013 OCPBUGS-39394 : collect some nmstate customresources (#986) (#989) (#995) #986 OCPBUGS-38021 : Integration of the OpenStack CRs into the insights-operator (#974) #974 Add haproxy metric (#977) #977
OCPBUGS-37671 : Ingress controller related certificates’ validate dates gathering (#970) #970 fix the configmapobserver notifications (#969) #969
OCPBUGS-35882 : properly encode the URL for the advisor links (#957) #957 Full changelog
OCPBUGS-57513 : Set node-pullsecrets volume to read-only to protect image pull credentials #394 OCPBUGS-56354 : Empty proxy variables are causing issues during the build #382 OCPBUGS-44186 : user system:serviceaccount:openshift-infra:serviceaccount-pull-secrets-controller in ns/openshift-infra must not produce too many applies #351 OCPBUGS-48202 : Add team members to the OWNERS file #358 NO-JIRA: cleanup root and app OWNERS #347
OCPBUGS-42420 : Continuous pull-secret updates / slow initialization on build01 (test platform infrastructure) #343 OCPBUGS-39191 : replaces deprecated square/go-jose wtih go-jose/go-jose #329 OCPBUGS-37526 : Race condition when deleting ServiceAccount #324 OCPBUGS-36862 : 4.16 “Bad” reconciliation loops can cause unbounded dockercfg secret creation #323 Full changelog
OCPBUGS-56739 : BACKPORT: fix promtool analyze block shows metric name with 0 cardinality #255 OCPBUGS-54942 : Scraping: Bump cache iteration after error to avoid false duplicate detection. #250 OCPBUGS-43668 : fix(discovery): Handle cache.DeletedFinalStateUnknown in node informers’ DeleteFunc #231 OCPBUGS-39179 : Restore Prometheus functionality to accept samples with different timestamps from the same series in a single scrape. #224 OCPBUGS-36918 : cherry-pick upstream fix to make PrometheusRemoteWriteBehind fire when remote endpoint is never reached. #214 OCPBUGS-37446 : backport of upstream fix #217 OCPBUGS-36854 : cherry-pick upstream remote-write fix #212 Full changelog
Source code for this page located on github