4.17.23

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.17.23-x86_64

Team Approvals:

Accepted
- QE

Tests:

Blocking jobs
- upgrade Succeeded release-openshift-origin-installer-e2e-aws-upgrade
- upgrade-minor Succeeded release-openshift-origin-installer-e2e-aws-upgrade
Informing jobs
- aws-ovn-serial Succeeded periodic-ci-openshift-release-master-nightly-4.17-e2e-aws-ovn-serial
- aws-ovn-upgrade-4.17-micro Succeeded periodic-ci-openshift-release-master-ci-4.17-e2e-aws-ovn-upgrade
- aws-ovn-upgrade-micro Succeeded periodic-ci-openshift-release-master-ci-4.17-e2e-aws-ovn-upgrade
- azure-ovn-upgrade-4.17-micro Succeeded periodic-ci-openshift-release-master-ci-4.17-e2e-azure-ovn-upgrade
- fips-scan Succeeded periodic-ci-openshift-release-master-nightly-4.17-fips-payload-scan
- gcp-ovn-rt-upgrade-4.17-minor Succeeded periodic-ci-openshift-release-master-ci-4.17-upgrade-from-stable-4.16-e2e-gcp-ovn-rt-upgrade
- hypershift-ovn-conformance-4.17 Succeeded periodic-ci-openshift-hypershift-release-4.17-periodics-e2e-aws-ovn-conformance
- metal-ipi-ovn-bm Succeeded periodic-ci-openshift-release-master-nightly-4.17-e2e-metal-ipi-ovn-bm
- metal-ipi-ovn-ipv6 Succeeded periodic-ci-openshift-release-master-nightly-4.17-e2e-metal-ipi-ovn-ipv6

Upgrades from:

Untested upgrades: 4.16.11, 4.16.12, 4.16.13, 4.16.14, 4.16.15, 4.16.16, 4.16.17, 4.16.18, 4.16.20, 4.16.21, 4.16.23, 4.16.25, 4.16.26, 4.16.28, 4.16.29, 4.16.30, 4.16.32, 4.16.33, 4.16.34, 4.16.35, 4.17.10, 4.17.11, 4.17.12, 4.17.13, 4.17.16, 4.17.18, 4.17.19, 4.17.3, 4.17.4, 4.17.5, 4.17.6, 4.17.7, 4.17.8, 4.17.9

4.17.22 (changes) - S S S S S
4.17.21 (changes) - Success
4.17.20 (changes) - Failed
4.17.17 (changes) - Success
4.17.15 (changes) - Failed
4.17.14 (changes) - Failed
4.17.2 (changes) - Failed
4.17.1 (changes) - Success
4.17.0 - Failed
4.16.38 (changes) - Success
4.16.37 (changes) - Success Failed
4.16.36 (changes) - Failed
4.16.27 (changes) - Failed
4.16.24 (changes) - Success
4.16.19 (changes) - Success
4.16.10 (changes) - Failed
4.16.9 (changes) - Success
4.16.8 (changes) - Failed
4.16.0-0.nightly-2025-03-26-035518 (changes) - Success

Upgrades to:

4.18.7 (changes) - Success
4.18.0-0.nightly-2025-04-01-084444 (changes) - Success
4.18.0-0.nightly-2025-04-01-014150 (changes) - Success
4.18.0-0.nightly-2025-03-31-191404 (changes) - Failed Success
4.18.0-0.nightly-2025-03-31-102945 (changes) - Success
4.18.0-0.nightly-2025-03-31-031443 (changes) - Success
4.18.0-0.nightly-2025-03-29-124702 (changes) - Success
4.18.0-0.nightly-2025-03-29-055207 (changes) - Success
4.18.0-0.nightly-2025-03-28-224822 (changes) - Success
4.18.0-0.nightly-2025-03-28-145816 (changes) - Success
4.18.0-0.nightly-2025-03-27-214022 (changes) - Success
4.18.0-0.ci-2025-04-01-084037 (changes) - S F P
4.18.0-0.ci-2025-04-01-024037 (changes) - Success Success
4.18.0-0.ci-2025-03-31-145406 (changes) - S F F S
4.18.0-0.ci-2025-03-31-072005 (changes) - F S F S
4.18.0-0.ci-2025-03-31-012005 (changes) - Success Success
4.18.0-0.ci-2025-03-30-192005 (changes) - Success Success
4.18.0-0.ci-2025-03-30-080821 (changes) - S F F S
4.18.0-0.ci-2025-03-30-000858 (changes) - S F S
4.18.0-0.ci-2025-03-29-135403 (changes) - Success Success
4.18.0-0.ci-2025-03-29-025922 (changes) - S F F F
4.18.0-0.ci-2025-03-28-200830 (changes) - Success Success
4.18.0-0.ci-2025-03-28-083911 (changes) - S F F S
4.18.0-0.ci-2025-03-28-014959 (changes) - Success Success
4.18.0-0.ci-2025-03-27-194959 (changes) - Success Success
4.18.0-0.ci-2025-03-27-075407 (changes) - Failed

Loading changelog, this may take a while ...

Changes from 4.17.0

Created: 2025-03-27 09:36:21 +0000 UTC

Image Digest: sha256:7e8b4557c0a15765440c543ab50cd591bb94f0745c20564e5f15d57bf5f76a82

Components

Kubectl upgraded from 1.30.2 to 1.30.5
Kubernetes upgraded from 1.30.4 to 1.30.10
Kubernetes Tests 1.30.0
Red Hat Enterprise Linux CoreOS upgraded from 417.94.202409121747-0 to 417.94.202503241418-0 (diff)

New images

gcp-workload-identity-federation-webhook git 08579e9f sha256:53b5ae474ba3e8d1e690faabaf26e3501fd9459207e94cd894576356e3bca2ec

Removed images

ovirt-machine-controllers

Rebuilt images without code change

agent-installer-utils git 3b99303b sha256:bba1318eede1922844b614c14edc028a9bc615cfbc4570bf438d0947db2a6165
apiserver-network-proxy git cd426416 sha256:947fdc92cc6259648fa0797dd0219794257bfc52d05526aeaf00bb42654248d9
aws-cloud-controller-manager git 8c77f418 sha256:67d72b99e9ecf6d83fc150f58eded1e66407961cab4c8dc2d9650e0440b7cbd6
aws-ebs-csi-driver git 2bb5b316 sha256:2faf6bf1e4a1ea111f7fd40e94298ff9019fcde94c0b963eec82ef415ce66096
azure-cluster-api-controllers git d359bfe5 sha256:ebbbad42e8e73fe1627e977b82934fd081c1fe0dfe8bc072d94aad994482691a
azure-disk-csi-driver git a544f30b sha256:da250d0796e6dca8ca5674301a5761933bd9fc2665b23a4109b4c67ec3152f22
azure-file-csi-driver git 9f4c38c2 sha256:65aea95139ed464789dc7744cdff7a73ffc762b6ceb9b5f8ed57fa24dda3c42d
cloud-network-config-controller git 779b346c sha256:09c440a57b2cd7d7f23faa3dffb5574723a16a6a0e1f7c3657d93751c70224d4
cluster-capi-controllers git 77ef4fc5 sha256:00918720a378341d5df16ac036d4f25cebef65a51d12d4eb1bd8308949be4520
cluster-config-operator git 0dc084f4 sha256:555a82ebbe8ac34f1791867371407dd6f63b75d5fc509e8fbc003dffe5cc7c9d
cluster-csi-snapshot-controller-operator git ffba005b sha256:7bbf0e539f413e5dd900435ff32fed9cc7c7c6fc53a6b90d3cc51192586343a6
cluster-ingress-operator git cb5306d7 sha256:f624c275931f4b5047f71f97dcad6453793096022a36f533cbc8e8fbfb325323
cluster-kube-controller-manager-operator git 0a9ed573 sha256:dd226eb7488a5c4e66d8f227179a3aca0713efb2f8ec1aca70f667e37911416a
cluster-kube-scheduler-operator git 98ca953b sha256:92b4673342741df726601b3d40cb014ac9e36295e161a89bcf920b0dea43ed67
cluster-olm-operator git e31b7775 sha256:bc13bce4917b84bae4170badd623e7828ad3e494a5c5bc1933beec87b220c3a9
cluster-policy-controller git 7209e90d sha256:a5e9191ce0a117cc1bf3717f9a67341d3f44209e1aa5bceafb85d67d97bf9cc9
cluster-update-keys git 2ce31fc5 sha256:63bf995d8cf0939a250a1eda14c5997a591a4e776d0bfbad281b781d8a3ee7e1
configmap-reloader git b877222b sha256:a12b766c424944182a160055ccc20e3bcca638d25cea01f5029021da00b4ec8f
container-networking-plugins git 24a65329 sha256:257665a5b3f9c41d98a84385082c10b49b4c40b23d215f96d142618c300d5c72
containernetworking-plugins-microshift git 24a65329 sha256:43148395076f93776886ff5bf4e61f572f2add2b16229914c493a2b6149507da
coredns git d3b441c1 sha256:da1680f5cb1a52583d0ae54f4b25a3763e36fdac3c4f4f4cbe8051deace50ad9
csi-driver-nfs git 6a72c254 sha256:648d2f390c8a9d044aa0313732d18e141a6e4098a6fb0599ec47e43b7699597c
csi-driver-shared-resource-operator git c095a1f2 sha256:39cc31ed90f3dc40b31ff74f58df885a31b3eb009e723d1adafd1f78c229a2b8
csi-external-attacher git c3fe8e2e sha256:e26bd52db16edc90545044a3ed5178c0516907d33fbfa76b65926923acf62456
csi-external-provisioner git fe460e56 sha256:5766b9d93f681a584853361fe3292e033bf9b0f57b1cf70e232a71a058e29115
csi-external-resizer git ab87a938 sha256:f78d823e12fd576c67215047d6e734c436619ef920f7d30317c560643a3fd893
csi-external-snapshotter git aa558ca4 sha256:ff81e9b8c6c59ade5cb328582f15eba8bcdbafd1137e8d41c7848a5e8e18617d
csi-livenessprobe git 075ebcdc sha256:978ad50bc2114ce78bfe9a77e9962c2c76e232577a9a0b2e65b43333fec030fb
csi-node-driver-registrar git 436a1f33 sha256:b521f4d6e83f9fc3fc231b4fd4687c5b1bb610afaf03e4785f164b02e564f914
csi-snapshot-controller git aa558ca4 sha256:ad4f10498cac0e4b55b0cdca4579146196c986387c0a4b604e9d302768875a6e
csi-snapshot-validation-webhook git aa558ca4 sha256:e6a33ee3cd0c885d801a201d09e2280644efd09f6fd7f4b3a2adfbcbb62a88eb
driver-toolkit git 859518f6 sha256:c857b54ee3dcac08d50114b4ceb464212e43ae724cdfc8e70ac59d599e212ae9
egress-router-cni git 3193a756 sha256:318bcdb853f83a43563be42b3ffe5c8670a693ebc95fe16167779969d3581a55
gcp-cloud-controller-manager git 8ce997d7 sha256:d9eabec9995dee27909d1d4ef508fbb77a44bccaf40d01307f5914f87fde141e
gcp-cluster-api-controllers git 9c561f2d sha256:d4e88fa8cee5537aa2969044002d795a7690023fba3f03110be140b28e723247
gcp-pd-csi-driver git c770b412 sha256:aba417b951adae615c083cfeb9f29d89092232f8cde8de30a2e5ebde277de24b
gcp-pd-csi-driver-operator git c23b064f sha256:cbe6f1d4a13f57bf5ee87297c5fc020a0ecd9d8428a73aa8e0479cd9a0ab56ad
haproxy-router git a33f2b6a sha256:83dacde2460b57671d199d19682f896a8e615a16a5e4499d01f861d10f6c63f9
ibm-cloud-controller-manager git ad8f7eb0 sha256:8e71af7b34a2cebe1f6eff3923cc72b59a3677a5cae05fa470c7e4011f8e1860
ibm-vpc-block-csi-driver git 3a3a62f7 sha256:bf5134797bb52ea5118a788e0864dcbf1f5fd7f44c592989550c5106564869e9
ironic-machine-os-downloader git b698ea3e sha256:e19753d14985e2dcf5fd6071ca4dd62d09dce80f86ef273ed49b858a906cf484
keepalived-ipfailover git e3879e9e sha256:8d3a8cab91c10aa2a2b70120f3b1e4c2bee9784e788d70b1598db0629ee35fcb
kube-state-metrics git 462e63f6 sha256:07ad31a30a5e3c195dcc780be27d3e03ce4ccd90a4f44fca38d73203b6742c3d
kube-storage-version-migrator git 34fafc04 sha256:8c45669e7d8cb6a09b41d77552b85b19a7655673f8770761fa4dce4166909ab8
kubevirt-cloud-controller-manager git 3f4542ec sha256:900ab8149e7f6d160df068ff016975005e8b753f0d816cc5225bef9574b01742
libvirt-machine-controllers git a336f0b5 sha256:1856f65ab412cfb419a784d4aabc64acf5e76d4cc2ca5f729bd5b3745a5dc08a
machine-image-customization-controller git 74bee374 sha256:5b12de1b52763e98fd96b587c7ae8ad953be24e2219a9d40bcb9a794512bad02
multus-admission-controller git 076f0caa sha256:2108abcdab31f99c30a322d1c83a69054d982f33febb5a9c821be76565c4a81b
multus-cni git b8d8d5c0 sha256:d2260aaeba67412ed4c4a1088814e7f69b85eab071ac45e1e149335f7f8693e4
multus-cni-microshift git b8d8d5c0 sha256:c0f93cbbd028d351a9233d751909be9c1d604c2e7a0a26f775910c2eaa670334
multus-networkpolicy git 7d01ea1c sha256:d972d7160c5275406d387aa920ca4abbc269f49cb3bd84bf122659c8a9414795
multus-route-override-cni git 391c1b03 sha256:2aa54a8c8b4ce481efb3999a294b92159e1c4c62ba705251c465a2b8bad0fb50
network-interface-bond-cni git 8630f336 sha256:9b525a0f7ec8e29ad7bccb7b3a0ec7544bcdc724914cd17c4975ec0c75e2c28b
network-tools git 8e170b4f sha256:bac956538f4c2842af4fc0222f707b75cd9aeae423cc7e93767a168175a0e720
nutanix-cloud-controller-manager git c9f6cd1f sha256:19ad50abb4e65d5833c3491bcad08c0597fa8b1767d675a9368cede8ea9709f1
nutanix-machine-controllers git 68aa2bbf sha256:d8ae425ab174e0d984eae0cd56ce7c0e909f10c4e44d23bf836985601fabc06a
openshift-state-metrics git 1e963eb5 sha256:80179a25badd2ff898c3bdd888576918e29417de7c67cbf22343082149f3df20
openstack-cinder-csi-driver-operator git f89b6dbc sha256:2d1447f5dc07c2171a5b632434f8018fc98319bc513f8831f7df14028bd9d6db
openstack-machine-api-provider git 68971874 sha256:68721ad2c493e78913eb766ed7f1f0e9a2162b053f3595ee56b7b47b4ec0994c
ovirt-csi-driver git 1db726a9 sha256:3d8ee8689d814af96325d3753442980fd76bbf1b4c55e8575685f4fc6abb53da
ovirt-csi-driver-operator git 0feae256 sha256:ad10c5c781c2ec18084139b7fc7e369a7f197f6ec9b464b54a0ac77ebd7709fb
powervs-block-csi-driver git aaa6afa9 sha256:3ae3ce110153c49afb3d04d3968153778dbf687dde0b12391bc39cd1525bba42
powervs-block-csi-driver-operator git f6f037c5 sha256:331ea7c34da6b61256bff418498ccd550ffd6f5169de7da91a9ef987236df4a7
powervs-cloud-controller-manager git bd3d72e5 sha256:15cc407260b9c3473cca72ee703fce25cef8a4b65b2616e7e10b06e8fd4f02cd
powervs-machine-controllers git fe7a877c sha256:80883851e11bf7c9c37db57bc56ac3ca3f10c9706e10bd3126c09cdd49c104f7
prom-label-proxy git d80e9044 sha256:d8bfcdce053bad735a860f097f07d642a2fc55f7ad13123a177493fd8db4a791
prometheus-alertmanager git d7c1a7c6 sha256:3bb944b961edcd1991f69ce37607da48e1a6c3ed484fc4d54016dd42d8d25751
prometheus-node-exporter git d88fd69b sha256:7530f64516bfca456857a0dec8a5c683998b3335bde80105f8115f5d46cd888b
rhel-coreos sha256:2260f75d655d9f6ce9292d950fbcce73c87bcee316709ee2eba00f07b0224bd3
rhel-coreos-extensions sha256:0121d09f860038c0832e8ab472bcfcc0511f3ef1aa8cce5492e187a41cde6b1b
route-controller-manager git a47f6be3 sha256:0f0cc261d4b4252fe740ef489c0cc91233a85ab0c4e10e8e187774cb1b26baf0
service-ca-operator git 1f7d6472 sha256:db09b4618ecb561d858ab191f63a26b6c2b349a71180abaf7730bcc61544561d
telemeter git e2b25245 sha256:7005fac988346de9d582f811e1c0875e05f56b54f0364e9a0768f8ab98d008d2
thanos git 5b567365 sha256:90047501a88866147ba8b96ff0bf89f4b8795d6a891cd7fcad596ba79858053e
vsphere-cluster-api-controllers git 1661cc3f sha256:cc79327a7371e8e91a107e198ce7ec20ba2e91b6f9caaee0408d4be21d723bec
vsphere-problem-detector git cd0df71f sha256:2f0325eabcc07286999ccf064a631f80201135b936afaa86a6e0ed6e310f0675

agent-installer-api-server

OCPBUGS-48390: Bump moby from v26.0.0 to v27.2.1 (#7188) #7188
MGMT-19537: Bump golang.org/x/net to 0.33.0 (#7129) #7129
OCPBUGS-42525: Disable pprof for agent-based installer (#6897) #6897
OCPBUGS-43020: Update go-jose to v2.6.3 to mitigate CVE-2024-28180 (#6892) #6892
Updating ose-agent-installer-api-server-container image to be consistent with ART for 4.17 (#6709) #6709
OCPBUGS-42569: Libraries bump to mitigate CVE-2024-27289 (#6832) #6832
MGMT-17805: Fix MCO reboot error for s390x (#6727) #6727
OCPBUGS-36577: Switch to github.com/docker/distribution/reference to mitigate CVE-2024-3727 (#6750) #6750
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

abi: let the bootstrap waiting for workers before rebooting (#1028) #1028
OCPBUGS-47493: MGMT-19537: Bump golang.org/x/net to 0.33.0 (#989) #989
OCPBUGS-44904: Rhcos fails to reboot for skip mco reboot on s390x (#942) #942
OCPBUGS-38466: Allow controller to continue when assisted-service (#918) #918
OCPBUGS-43023: Pick up latest CVE changes by bumping service (#919) #919
OCPBUGS-42156: Switch to github.com/docker/distribution/reference to Mitigate CVE-2024-3727 (#904) #904
Full changelog

agent-installer-node-agent

NO-ISSUE: Increase image pull timeout during install (#922) #922
MGMT-19537: Bump golang.org/x/net to 0.33.0 (#873) #873
OCPBUGS-43024: Pick up latest CVE changes by bumping service (#805) #805
OCPBUGS-42157: Switch to github.com/docker/distribution/reference to Mitigate CVE-2024-3727 (#783) #783
Full changelog

aws-cluster-api-controllers

OCPBUGS-51309: UPSTREAM: 5339: Bump glog for recent fixes #539
OCPBUGS-43921: OSD-25934: Only tag NetworkInterfaces in RunInstances if IAM Allows It #528
Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator

OCPBUGS-46512: remove EFS driver metrics #350
OCPBUGS-44974: Set separate secrets for file and disk config on HyperShift #331
OCPBUGS-42949: add tag matching to Azure File storage class #291
OCPBUGS-43789: add ability to control kube rbac proxy container image… #310
OCPBUGS-42997: Correct aws efs csi driver config as removable #296
Full changelog

aws-kms-encryption-provider

OCPBUGS-34314: Updating aws-kms-encryption-provider-container image to be consistent with ART for 4.17 #19
hack: display diff on verify-mod-tidy failure #25
Full changelog

aws-machine-controllers

OCPBUGS-45186: fix Associate*IpAddress flag when launch EC2 #118
Full changelog

aws-pod-identity-webhook

OCPBUGS-51232: github.com/go-jose/go-jose/v4 v4.0.5 #202
Full changelog

azure-cloud-controller-manager, azure-cloud-node-manager

OCPBUGS-46039: Prevent panic when informer receives cache.DeletedFinalStateUnknown #132
Full changelog

azure-kms-encryption-provider

OCPBUGS-34277: Updating azure-kms-encryption-provider-container image to be consistent with ART for 4.17 #7
Full changelog

azure-machine-controllers

OCPBUGS-52359: Remove unused vnet package #130
OCPBUGS-50017: dynamically setting the amount of fault domains #127
Full changelog

azure-workload-identity-webhook

OCPBUGS-51234: github.com/go-jose/go-jose/v4 v4.0.5 #28
Full changelog

baremetal-cluster-api-controllers

OCPBUGS-47049: Bump x/net to 0.33.0 #32
Full changelog

baremetal-installer, installer, installer-altinfra, installer-artifacts

OCPBUGS-53459: aws: fix NLB creation in secret regions #9071
OCPBUGS-52961: Remove tmp directory used for agent pxe files #9552
OCPBUGS-43528: Prevent race with provisioning-interface service #9110
OCPBUGS-44058: Log correct hostname for validation status #9162
OCPBUGS-50967: PowerVS: destroy dhcp hack #9494
OCPBUGS-50846: OCPBUGS-50702: [release-4.17] MGMT-19771: Convert IDS to proper IDMS manifest #9470
OCPBUGS-50876: correct typo #9484
OCPBUGS-49975: aws/edge/byovpc: subnets tag kube cluster tag to shared #9445
OCPBUGS-48761: Update RHCOS 4.17 bootimage metadata to 417.94.202501301529-0 #9448
OCPBUGS-49993: Disable IP Forwarding for CAPG Machines #9446
OCPBUGS-41300: Azure: Update SecurityType passed in at Image creation #9409
OCPBUGS-49362: [Nutanix] Installation failed with timeout when uploading images to PC #9406
OCPBUGS-48645: azure: use separate /var to avoid growfs timeouts #9381
OCPBUGS-45340: move GCP zone filtering client-side #9264
OCPBUGS-48257: remove the types which failed by RHEL-59521 and add the new gpu vm type #9354
OCPBUGS-45813: Remove unused variable from ASH arm template 06_workers.json #9285
OCPBUGS-48359: Allow more time for Service Account Creation #9362
OCPBUGS-45344: support additionalNTPSources in node-joiner tool #9265
OCPBUGS-48119: Always set AllowCrossTenantReplication parameter to false #9346
OCPBUGS-46432: Power VS: Create region-zone-sysType hierarchy #9319
OCPBUGS-46360: aws: add ec2:AllocateAddress perm requirement. #9313
no-jira: Collect bootstrap logs when control plane provisioning fails #9308
OCPBUGS-45726: IBMCloud: Add service overrides #9267
OCPBUGS-42117: Remove destroy search for regional target tcp proxies #9025
OCPBUGS-45484: PowerVS: Listen to machineNetwork #9271
OCPBUGS-44848: aws: user right perm for untagging BYO IAM profiles #9228
OCPBUGS-45276: Bump Azure Machine Timeout #9257
ARO-12457: Include bootstrap docker config file in go module #9258
OCPBUGS-43047: fix slice init length #9089
OCPBUGS-43800: pkg/asset/installconfig/azure: send full certifcate chain #9140
CORS-3753: Allow mocking of the Azure client everywhere #9219
OCPBUGS-44611: [release-4.17] capi/aws: set Node Port Service CIDR override #9209
OCPBUGS-44230: Add C4A instance types #9181
OCPBUGS-44231: [release-4.17] capi/aws: bump provider for LB DNS lookup fix #9179
OCPBUGS-44261: Ensure rendezvousIP is checked against host IP #9184
OCPBUGS-43972: Cherrypick oci ccm fix to 4.17 #9152
OCPBUGS-44247: PowerVS: Update 4.17 CAPI ibmcloud to 9b077049 #9182
OCPBUGS-41642: vendor: Update openshift/api to pick up v4.17 capability sets #9013
OCPBUGS-44226: PowerVS: Fix MissingSecurityGroupRules #9175
OCPBUGS-44227: PowerVS: Fix destroy persistent TG #9176
OCPBUGS-44228: PowerVS: Change CAPI verbosity level #9177
OCPBUGS-43846: add chrony.conf file when additional NTP sources are configured #9142
OCPBUGS-43735: Add C4 instance validation #9130
OCPBUGS-43897: Revendor assisted service external platform oci #9147
OCPBUGS-43786: Limit GCP API firewall rule for internal clusters #9138
OCPBUGS-43547: Power VS: Fix incorrect error handling for AddSecurityGroupRule #9112
OCPBUGS-43088: GCP Validate Disk and Instance Type #9091
OCPBUGS-43329: IBMCloud: Handle pagination for subnets #9096
OCPBUGS-42716: Update RHCOS 4.17 bootimage metadata to 417.94.202410090854-0 #9092
OCPBUGS-42806: gather: simplify service regex for analyze #9079
OCPBUGS-42996: Power VS Ensure Metadata populated for CAPI/private cluster case on PowerVS #9086
OCPBUGS-42115: Add validation for gcp disk and instance types #9023
OCPBUGS-42842: add new tested azure instance types detected during QE 4.17 full function test #9080
OCPBUGS-41812: Validate MTU for custom network #9084
OCPBUGS-42794: PowerVS: Add support for persistent Transit Gateways #9078
OCPBUGS-42699: machines: don’t sort mpool zones #9065
OCPBUGS-42483: PowerVS: update capi ibmcloud c6bcd313 for 4.17 #9054
OCPBUGS-39414: OpenStack: Install CI dependencies from rpm #8994
OCPBUGS-42142: Skip private managed zone creation for xpn installs #9033
OCPBUGS-42183: Add GCP N4 Machine Series to tested instances for OCP #9041
OCPBUGS-42126: add tested IBMCloud instance types in 4.17 test #9030
OCPBUGS-42118: Set default release image to 4.17 #9026
OCPBUGS-42116: Remove bindings for XPN installs #9024
OCPBUGS-39409: Fix IPv6 security group rule for schedulable master #8970
OCPBUGS-41622: update RHCOS 4.17 bootimage metadata to 417.94.202409120353-0 #9019
OCPBUGS-42051: Fix integration tests #9018
OCPBUGS-41300: Azure CAPI: Improve handling of security features configured on the MachinePools and OSDisk #9007
OCPBUGS-39286: Fix var_files syntax to work on older version of ansible #8933
OCPBUGS-41896: Add AWS c7g,m7g,r8g to tested instance types #9005
OCPBUGS-41542: Azure CAPI: Update publicAccess for Blob Containers #9006
OCPBUGS-41702: aws: bump capa to fix EIP leak on bootstrap when BYOIP #8991
Full changelog

baremetal-machine-controllers

OCPBUGS-46646: Bump x/net to 0.33.0 #225
Full changelog

baremetal-operator

OCPBUGS-42387: Remove dataImage finalizer if BMH is missing #390
OCPBUGS-49701: Handle HFC for non-redfish HW #395
Full changelog

baremetal-runtimecfg

OCPBUGS-48766: Extend haproxy-monitor fall time #340
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-49607: Address golang.org/x/* CVEs #1962
OCPBUGS-50984: Add HOST env var in oc debug for sos report collects more #1976
OCPBUGS-49605: Address github.com/docker/docker CVE #1968
OCPBUGS-45344: additional rbac policy rules #1937
OCPBUGS-45517: add retry in case of image pull error #1940
OCPBUGS-44508: Show node-joiner container logs when error occurs #1912
OCPBUGS-44830: Fix newapp unit test failure by using different image #1913
OCPBUGS-43696: Bump k8s dependencies to 1.30.5 #1902
OCPBUGS-41642: vendor: Update openshift/api to pick up the v4.17 capability set #1876
OCPBUGS-42176: Fix copy artifacts for all CPU architectures #1880
OCPBUGS-42721: Update push targets of digest with new appended tags #1892
OCPBUGS-42580: fix outputname flag for node-image create command #1888
OCPBUGS-42164: Check cast result in adm prune deployments to prevent panic #1879
Full changelog

cloud-credential-operator

OCPBUGS-51548: Ignore SNYK-GOLANG-GOLANGORGXOAUTH2JWS-8749594 due to not being affected #828
OCPBUGS-51238: github.com/go-jose/go-jose/v4 v4.0.5 #825
OCPBUGS-47071: golang.org/x/net v0.33.0 #804
OCPBUGS-45938: Add AWS region to aws-pod-identity-webhook #799
OCPBUGS-45006: Add retry to ccoctl gcp create functions #793
OCPBUGS-45001: github.com/golang-jwt/jwt/v4 v4.5.1 #787
OCPBUGS-44123: Add GCP pod identity webhook #776
OCPBUGS-43644: Only attempt timed token credentials on supported platforms. #773
OCPBUGS-43335: Update github.com/sirupsen/logrus v1.9.3 #766
Full changelog

cluster-authentication-operator

OCPBUGS-43657: audit: do not log requests to /livez #724
OCPBUGS-42784: manifests should not use APIs that are removed in upcoming releases #712
OCPBUGS-42545: when no type is specified, don’t make illegal condition #703
Full changelog

cluster-autoscaler

OCPBUGS-48606: UPSTREAM: <carry>: 🐛(metrics) Initialize metrics for autoscaler errors, scale events, and pod evictions #337
OCPBUGS-45147: [release-4.17] VPA: Update OWNERS file #324
Full changelog

cluster-autoscaler-operator

OCPBUGS-45929: set max soft bulk taint count to zero #337
Full changelog

cluster-baremetal-operator

OCPBUGS-41926: SCC-pinning for metal3-baremetal-operator #444
Full changelog

cluster-bootstrap

OCPBUGS-34034: Updating ose-cluster-bootstrap-container image to be consistent with ART for 4.17 #108
Full changelog

cluster-capi-operator

OCPBUGS-48493: fix: always update clusteroperator status versions when differing #250
OCPBUGS-41576: Use CAPO v0.10 and API v1beta1 #205
Full changelog

cluster-cloud-controller-manager-operator

OCPBUGS-43389: update goimports targets #371
OCPBUGS-41941: IBMCloud: Modify liveness probe for IBM Cloud CCM to use loopback address #365
Full changelog

cluster-config-api

OCPBUGS-39130: Added checks to prevent vCenters from changing after install past 1 vCenter #2014
Full changelog

cluster-control-plane-machine-set-operator

OCPBUGS-44047: relax validation on delete and if failureDomains not configured #330
Full changelog

cluster-dns-operator

OCPBUGS-52497: [release-4.17] Add runbook_url for CoreDNSErrorsHigh #430
Full changelog

cluster-etcd-operator

OCPBUGS-38574: use pooled client for etcd single member health checks #1327
Full changelog

cluster-image-registry-operator

OCPBUGS-51103: ensure that storage names don’t end in dashes #1180
OCPBUGS-43564: fix proxy config and leader election test flakes #1144
OCPBUGS-43350: pkg/storage/azure: also check for auth failure error code on deletion #1139
OCPBUGS-42812: azureclient: stop validating credentials when creating the client #1130
OCPBUGS-42394: pkg/storage/azure: use cluster-api tag key to discover vnet #1125
OCPBUGS-42362: Continuous pull-secret updates / slow initialization on build01 (test platform infrastructure) #1124
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-50516: Increase waitForFallbackDegradedConditionTimeout #1803
OCPBUGS-43657: audit: do not log requests to /livez #1758
OCPBUGS-34310: Updating ose-cluster-kube-apiserver-operator-container image to be consistent with ART for 4.17 #1738
Full changelog

cluster-kube-cluster-api-operator

OCPBUGS-42612: Sync Release 4.17 with UPSTREAM #48
Full changelog

cluster-kube-storage-version-migrator-operator

OCPBUGS-46593: “gracefully” shutdown KSVM pod. #123
Full changelog

cluster-machine-approver

OCPBUGS-48155: Fix race condition in CO status controller test #266
OCPBUGS-46429: Filter CSRs by signerName #261
OCPBUGS-45918: Ensure trailing dots on DNS names do not block serving cert auth #256
OCPBUGS-45918: Client internal DNS checks should ignore trailing dot #250
OCPBUGS-43312: Client internal DNS checks should be case insensitive #242
Full changelog

cluster-monitoring-operator

OCPBUGS-44971: Add new metrics for OpenShift logging telemetry #2526
OCPBUGS-44003: fix(monitoring-plugin): disable emitting nginx version on error pages #2511
OCPBUGS-43690: chore: introduce a config parsing check via a strict unmarshaller for… #2494
OCPBUGS-43788: Add runbook url for TelemeterClientFailures #2507
OCPBUGS-43545: Fix api doc on Thanos Ruler default retention #2501
OCPBUGS-41341: disable user-defined monitoring per object #2458
OCPBUGS-41908: filter alerts sent to Telemeter #2470
Full changelog

cluster-network-operator

OCPBUGS-49816: ovn-k, rbac: Enable users read & modify UserDefinedNetwork CRs #2655
OCPBUGS-49961: Update egressfirewall CRD to be consistent with ovn-kubernetes repo #2642
: OCPBUGS-44863: Add nodeslicepool #2574
OCPBUGS-44807: ovn-k, cudn: Add missing permissions to ovnkube-node #2575
OCPBUGS-43714: Skip including default crypto policies to avoid authby issue #2597
OCPBUGS-46146: Remove ip xfrm state when IPsec is disabled #2594
OCPBUGS-44415: Pass transit_switch_subnet options in ovnkube-node pod #2561
OCPBUGS-44807, SDN-4930, SDN-5297: OVN-Kubernetes node RBAC tightening #2568
OCPBUGS-44807, SDN-5297, SDN-5472: bindata, ovn-k: Add ClusterUserDefinedNetwork CRD and RBAC #2566
OCPBUGS-44807, SDN-4930, SDN-5297: ovn-k, udn: Update UserDefinedNetwork CRD #2551
OCPBUGS-44807, SDN-4930, SDN-5297: Adds UDN list/watch to ovnknode rbac #2540
OCPBUGS-44779, SDN-5436: Provide support for user owned IPsec machine configs #2564
OCPBUGS-44330: Add controlplane cli image envar for use with hypershift #2542
OCPBUGS-43343: OCPBUGS-42244: Exporting environment varialbe NODE_CNI for live migration #2536
OCPBUGS-43317: Use CNIConfDir for mounting directory to ovn-ipsec-host pod #2533
OCPBUGS-39300: rebase openshift/api for openshift-sdn removal [4.17] #2477
OCPBUGS-39121: Live migration: report network overlap via live_migration_blocked metric #2483
OCPBUGS-42260: Configure narrowing=yes for IPsec connections #2510
Full changelog

cluster-node-tuning-operator

use ROLE_WORKER_CNF environment variable to determine mcp name (#1290) #1290
Add missing Polarion test case id (#1288) #1288
e2e: tuned degraded test fix (#1259) #1259
OCPBUGS-48213: [release-4.17][manual] Adjust Workload Hints test cases based on Intel or AMD (#1277) #1277
PPC: correct EnableHardwareTuning flag value (#1271) #1271
e2e: add irdma to module_blacklist kernel args (#1266) #1266
OCPBUGS-45964: performanceprofile cpuset input validation (#1247) #1247
OCPBUGS-43664: Add vendor and architecture specific tuning options (#1191) #1191
OCPBUGS-44644: cmd: PPC: support tolerating heterogeneous core IDs (#1252) #1252
OCPBUGS-45264: Normalize cpu sets when rendering to Tuned profiles (#1238) (#1248) #1238
e2e: wait for node inspector deletion (#1205) #1205
Fixing empty tuned submodule when using Dockerfile (#1211) #1211
E2E: fix modify node selector to use lowercase (#1186) #1186
OCPBUGS-38900: Drop sched_migration_cost_ns setting (#1201) #1201
Make ocp-tuned-one-shot.service restart on-failure (#1187) #1187
Fix context deadlines in ExecCommandOnPod() (#1189) #1189
OCPBUGS-43566: CI: unblock (#1188) #1188
E2E: wait for ovs services affinity to reset after deployment deletion (#1160) #1160
OCPBUGS-38721: tuned: distinguish deferred updates (#1149) #1149
OCPBUGS-39005: Add cluster-wide proxy env file (#1145) #1145
Full changelog

cluster-openshift-apiserver-operator

OCPBUGS-43657: audit: do not log requests to /livez #599
Full changelog

cluster-openshift-controller-manager-operator

OCPBUGS-47770: Add team members to the OWNERS file #375
Full changelog

cluster-samples-operator

OCPBUGS-48786: add shannon and aroyoredhat as owners #595
OCPBUGS-39120: Sync the non-OKD assets from master to release-4.17 #577
OKD-225: remove only the EOL CentOS 7 images #575
Full changelog

cluster-storage-operator

OCPBUGS-52222: fix Vsphere cluster Storage operator in Unavailable state #560
OCPBUGS-44997: Fix PodStartupStorageOperationsFailing alert #543
OCPBUGS-43794: add ability to control kube rbac proxy container image on controlplane #529
OCPBUGS-43112: assets: shared-resource: hypershift: add pull-secret to operator SA #520
Full changelog

cluster-version-operator

OCPBUGS-50589: Set openshift.io/required-scc: privileged annotation in version pods #1154
OCPBUGS-39558: Filter out shallowly UpdateEffectNone errors from a MultipleErrors message in the Failing condition #1114
OCPBUGS-45328: deps: bump golang.org/x/net to 0.31.0 #1117
OCPBUGS-43586: Upgradeable=False should not block a 4.(y+1).z to 4.(y+1).z’ retarget #1095
OCPBUGS-41642: vendor: Update openshift/api to pick up the v4.17 capability sets #1087
Full changelog

console

OCPBUGS-53086: Update the monitoring topic used by the console team #14871
OCPBUGS-52205: Show Observe section without PROMETHEUS and MONITORING flags #14811
OCPBUGS-51292: fix run time error when no completed version exists #14796
OCPBUGS-51126: Fix alert rule link to alert in dev perspective #14785
OCPBUGS-49795: ‘create a Project’ button on Getting started page doesn’t work #14714
OCPBUGS-39602: Set default build option as BUILDS for Builder Image sample #14241
OCPBUGS-45740: Fix Function Import: An error occurred Cannot read properties of undefined (reading ‘filter’) #14595
OCPBUGS-45625: use default StorageClass for ServerlessFunction pipelineVolumeClaimTemplate #14589
OCPBUGS-41596: No need to supply ‘User workload notifications’ option on ‘User Preference’ page for normal user #14265
OCPBUGS-44220: disable flaking and change pre-condition test for knative e2e #14467
OCPBUGS-43751: Added token to proxy header #14430
OCPBUGS-48161: ERROR in search tool: Cannot read properties of undefined (reading ‘state’) #14667
OCPBUGS-48227: fix navigation from non-General User Preference tab to… #14674
OCPBUGS-41672: Update vendor imports to include all PatternFly components #14272
OCPBUGS-46344: OCP web console show pod status as Init:0/1 after using Native sidecars #14616
OCPBUGS-47497: Getting Oh no, something went wrong error when trying to install operator. #14645
OCPBUGS-43673: Disable GQL introspection #14640
OCPBUGS-45949: ReRun of Resolver based PipelineRuns fails from UI #14605
OCPBUGS-45954: Fixed capitalization in OpenShift Lightspeed #14607
OCPBUGS-45948: ImagePullSecret getting duplicated when editing DeploymentConfig in Form View #14604
OCPBUGS-45667: Do not pass CSV name to operand list page when an exen… #14591
OCPBUGS-46000: The description and name for GCP Pool ID is not consist #14611
OCPBUGS-42558: Plugins that use very old PF4 dropdown or menu components with grouped items have bullets and padding that needs to be removed. #14344
OCPBUGS-44656: update ConditionalUpdates release type #14505
OCPBUGS-43888: While accessing the node terminal from UI observed ‘Warning alert:Admission Webhook Warning` #14444
OCPBUGS-43441: fix table combination #14546
OCPBUGS-44169: use TaskRuns results.tekton.dev/record annotation to get the logs #14538
OCPBUGS-44873: Unable to remove finally tasks in pipeline builder mode #14527
OCPBUGS-42791: Add missing pipelines plugin name to known plugins #14377
OCPBUGS-44699: Add multiline support to template instantiation #14508
OCPBUGS-44183: Remove ClusterTask dependency in console from Pipelines 1.17 #14512
OCPBUGS-44764: Add IBM Block Storage CSI driver support for RWX #14517
OCPBUGS-43795: While upgrading the cluster from UI observed Warning alert:Admission Webhook Warning #14433
OCPBUGS-44722: include external labels so silenced alerts not displayed in notifications #14511
OCPBUGS-44358: BuildConfig form breaks on manually enter the Git URL #14478
OCPBUGS-43073: Telemetry userPreference results in empty nodes output to the DOM #14392
OCPBUGS-44587: Start last run do not work in buildConfig details page #14499
OCPBUGS-44586: Collapse/Expand Feature Added, Removal Option Removed in Version 4.16 #14498
OCPBUGS-44450: Don’t request user settings configmap if no user has been loaded. #14482
OCPBUGS-44479: conditionally display MachineConfig details page Confi… #14488
OCPBUGS-43878: Add flag to hide the pipelines-plugin pipeline builder extensions #14457
OCPBUGS-42824: remove axios as it is no longer in use #14381
OCPBUGS-42955: Enabling topology e2e tests on CI #14402
OCPBUGS-43009: Project is “Undefined” on “VolumeSnapshot” create page #14389
OCPBUGS-42607: add role exclusion to avoid unexpected triggering the namespace menu #14351
OCPBUGS-42606: make createdBy mandatory and auto fill with the current user #14352
OCPBUGS-42585: Red Hat Camel K Operator installation via cli #14346
OCPBUGS-42299: Increase login flow state paramater length/entropy #14318
OCPBUGS-42391: change “Partial cluster update” to “Control plane onl… #14323
OCPBUGS-42380: Allow operators to enable monitoring by default #14316
OCPBUGS-42060: Console crashes when ssh is selected in add secret for starting a pipeline run #14301
OCPBUGS-42223: restore Spotlight removal on next click #14314
OCPBUGS-39181: add Create button to Console plugins tab #14220
OCPBUGS-39091: update Events ChipGroup to use integrated close #14211
OCPBUGS-38563: do not directly mutate links in useMemo #14159
OCPBUGS-41685: Topology screen crashes when completed pod is selected #14276
OCPBUGS-41482: Unit Tests for the new Ask Lightspeed Button #14249
OCPBUGS-39601: Console user settings resources misses ownerRef, removing a user results in remaining data #14240
Full changelog

console-operator

OCPBUGS-45302: console/status: set initial value of Message field #943
OCPBUGS-46390: Dont disable console when authConfig type is set to None #951
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-52416: Merge https://github.com/kubernetes/cloud-provider-openstack:release-1.30 into release-4.17 #319
OCPBUGS-43427: Merge https://github.com/kubernetes/cloud-provider-openstack:release-1.30 into release-4.17 #314
OCPBUGS-43427: Merge https://github.com/kubernetes/cloud-provider-openstack:release-1.30 into release-4.17 #302
Full changelog

csi-driver-manila-operator

OCPBUGS-38457: Add missing healthchecks #240
Full changelog

csi-driver-shared-resource, csi-driver-shared-resource-webhook

OCPBUGS-34217: Updating ose-csi-driver-shared-resource-container image to be consistent with ART for 4.17 #188
OCPBUGS-44510: Updating ose-csi-driver-shared-resource-webhook-container image to be consistent with ART for 4.17 #233
Full changelog

docker-builder

OCPBUGS-53075: Upgraded Kubernetes dependency from 1.28.2 to 1.30.2 #465
OCPBUGS-42894: buildah dependency bump to 1.37.6 #452
OCPBUGS-33889: Updating openshift-enterprise-builder-container image to be consistent with ART for 4.17 #393
OCPBUGS-47768: Add team members to the OWNERS file #423
OCPBUGS-47712: skipping some unit tests to avoid failures as they are duplicate #421
Full changelog

docker-registry

OCPBUGS-49695: bump docker distribution #422
Full changelog

etcd

DOWNSTREAM: <carry>: OCPBUGS-53447: fix a compaction induce latency issue #321
ETCD-714: Rebase etcd 3.5.18 openshift 4.17 #310
NO-ISSUE: Add support for cachi2 based deps #297
OCPBUGS-42680: Rebase etcd 3.5.16 openshift 4.17 #291
NO-JIRA: use golang 1.22 image #286
Full changelog

gcp-machine-controllers

OCPBUGS-48064: Refactor exists() to handle gcp API change #105
OCPBUGS-46082: update a2 gpu detection logic to be dynamic #100
OCPBUGS-43738: Add c4a instance as arm type #95
Full changelog

hyperkube, pod

OCPBUGS-51006: Bump k8s api to 1.30.10 #2210
OCPBUGS-49905: Bump k8s api to 1.30.9 #2198
: OCPBUGS-46364: Fix grace period used for immediate evictions #2164
OCPBUGS-46002: Bump k8s api to 1.30.7 #2160
OCPBUGS-39318: UPSTREAM: 126994: Add required FieldManager for validatingadmissionpolicy e2e #2070
OCPBUGS-43820: UPSTREAM: <carry>: kubelet/cm: fix bug where kubelet restarts from missing cpuset cgroup #2126
OCPBUGS-44897: Backport format library to enable usage in 4.18 #2140
OCPBUGS-44512: Bump k8s api to 1.30.6 #2134
OCPBUGS-42427: UPSTREAM: 125398: Fix issue with scheduler failing on hostname mismatch #2097
OCPBUGS-42640: Unrevert Bump k8s api to 1.30.5” #2107
OCPBUGS-42640: Revert #2089 “OCPBUGS-42167: Bump k8s api to 1.30.5” #2100
OCPBUGS-42167: Bump k8s api to 1.30.5 #2089
OCPBUGS-42019: UPSTREAM: <drop>: bump(github.com/openshift/apiserver-library-go) #2087
Full changelog

hypershift

OCPBUGS-48439: kubevirt, Don’t break on hostname NodePort.Address #5394
OCPBUGS-51240: bump go-jose #5863
OCPBUGS-52657: Make managed-trust-bundle optional #5794
OCPBUGS-52425: [release-4.17] refactor aws identity health check into new controller #5772
OCPBUGS-46340: change plaform to platform #5562
OCPBUGS-51339: [release-4.17] Fix IsProgressing condition in HostedClusters #5712
OCPBUGS-50697: add region to AWS creds passed to operators managed by CPO #5671
OCPBUGS-51098: 4.17 Add HostedCluster additional trustbundles to konnectivity-https-proxy #5675
NO-JIRA: Update dependency mkdocs-material to v9.6.5 #5682
OCPBUGS-50596: Honor proxy vars in the util insecure http client #5605
OCPBUGS-49828: Duplicate hostDevices.name when hostDevices.deviceName has multiple types. #5558
OCPBUGS-48487, OCPBUGS-48488, OCPBUGS-48490: Fix IPv6 Disconnected HCP deployments #5402
OCPBUGS-47533: Prevent IgnitionServer from flooding the API server with patch requests #5332
NO-JIRA: Update dependency mkdocs-material to v9.6.3 #5590
OCPBUGS-45268: Reconcile proxy CA bundle into hosted cluster #5228
OCPBUGS-46465: Consistently look up and dial cloud API hostnames #5302
NO-JIRA: Update dependency mkdocs-material to v9.6.1 #5528
OCPBUGS-49638: fix overwriting PKI operator HCP conditions #5504
OCPBUGS-46440: Allow ARM64 arch deployment on Agent platform #5296
OCPBUGS-48170: fix disconnected via CLI #5465
OCPBUGS-38810: nodepoolcontroller: List() PerformanceProfile status per NodePool #4585
NO-JIRA: Update dependency mkdocs-mermaid2-plugin to v1.2.1 (release-4.17) #5428
NO-JIRA: Update dependency mkdocs-material to v9.5.50 (release-4.17) #5427
OCPBUGS-44927: Add multi-arch validation for HC/NodePool compatibility #5238
NO-JIRA: [release-4.17] Bump golang.org/x/crypto and golang.org/x/net #5368
NO-JIRA: Update Konflux references (release-4.17) #5329
OCPBUGS-46412: Separate CPO containerfiles #5285
NO-JIRA: chore(deps): update konflux references (release-4.17) #5289
NO-JIRA: chore(deps): update dependency mkdocs to v1.6.1 (release-4.17) #5290
OCPBUGS-44114: Add external kas address to no proxy skip list #5028
NO-JIRA: Red Hat Konflux update hypershift-release-mce-28 #5174
NO-JIRA: chore(deps): update konflux references (release-4.17) #5249
OCPBUGS-44630: Use ingress role in private link controller for DNS operations #5142
NO-JIRA: chore(deps): update konflux references (release-4.17) #5183
NO-JIRA: chore(deps): update konflux references (release-4.17) #5154
NO-JIRA: chore(deps): update konflux references (release-4.17) #5144
OCPBUGS-44184: dont use registryOverrides on kube rbac proxy image be… #5033
NO-JIRA: chore(deps): update konflux references (release-4.17) #5113
OCPBUGS-43929: Return the right tagReference on Catalogs ImageStream #4993
OCPBUGS-44276: Configure OAuth https proxy to dial cloud endpoints directly #5070
OCPBUGS-44268: Fix order rendering HCP objects #5064
NO-JIRA: Update Konflux references (release-4.17) #5098
chore(deps): update konflux references (release-4.17) #5075
HOSTEDCP-2046: CPO 4.17 tekton builds #5006
NO-JIRA: chore(deps): update konflux references (release-4.17) #5053
NO-JIRA: Update Konflux references to fedcfe0 (release-4.17) #5041
chore(deps): update konflux references (release-4.17) #5023
chore(deps): update konflux references to f53fe54 (release-4.17) #5018
NO-JIRA: Update Konflux references (release-4.17) #5009
OCPBUGS-42879: Add network policies for konnectivity server and ignition server proxy #4865
NO-JIRA: bump catalog operators version #4992
NO-JIRA: chore(deps): update konflux references (release-4.17) #4972
OCPBUGS-43746: add ValidIDPConfiguration condition to report IDP config issues #4969
NO-JIRA: chore(deps): update konflux references (release-4.17) #4958
OCPBUGS-43464: Pass feature flags to clusterpolicy controller #4928
NO-JIRA: chore(deps): update konflux references (release-4.17) #4931
OCPBUGS-42704: Run 2 replicas of active/passive HA components #4843
OCPBUGS-43316: Enforce privileged PSA by default #4834
NO-JIRA: chore(deps): update konflux references (release-4.17) #4921
OCPBUGS-43374: release-4.17 openstack/e2e: re-work nodepool tests #4914
NO-JIRA: chore(deps): update konflux references to 674e70f (release-4.17) #4907
NO-JIRA: chore(deps): update konflux references (release-4.17) #4895
OCPBUGS-43051: Use guest DNS resolution in Konnectivity HTTPS proxy by default #4885
HOSTEDCP-2020: [release-4.17] Add support for SharedVPC #4873
HOSTEDCP-2023: [release-4.17] Split worker and vpc endpoint security groups #4882
OCPBUGS-42974: [release-4.17] Do not send traffic to local audit-webhook through konnectivity #4869
NO-JIRA: Remove EnsurePSANotPrivileged check #4855
OCPBUGS-42714: label routes only when HCP router used #4845
NO-JIRA: chore(deps): update konflux references to 37b9187 (release-4.17) #4854
OCPBUGS-42390: Add Annotation to skip deleting hcp namespace #4792
NO-JIRA: chore(deps): update konflux references (release-4.17) #4812
NO-JIRA: e2e: openstack: fix nil deref in route53 teardown #4810
OCPBUGS-42261: Conditionally manage kubeconfig secrets for DNS and Ingress operators #4764
OCPBUGS-42098: Use KubeClientCABundle for HostedClusterConfigOperator cluster-signer-ca #4736
chore(deps): update konflux references to 5ac9b24 (release-4.17) #4780
OCPBUGS-41552: Let payload generation pick the release for the NodePool #4691
chore(deps): update konflux references to 2c3426a (release-4.17) #4774
NO-JIRA: chore(deps): update konflux references (release-4.17) #4761
NO-JIRA: Security fixes for openshift-ci-security job #4748
NO-JIRA: chore(deps): update konflux references (release-4.17) #4726
HOSTEDCP-1953: bump CCO version #4694
Full changelog

ibm-vpc-block-csi-driver-operator

OCPBUGS-42277: Reorder static resources to create RBAC first #128
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-44880: Fetch service instance id from spec of IBMPowerVSCluster object while setting provider id #94
OCPBUGS-37369: UPSTREAM: <carry>: Fix go-retryablehttp CVE - 4.17 #86
Full changelog

ibmcloud-machine-controllers

OCPBUGS-37379: Bump dependency for CVE #49
Full changelog

insights-operator

AUTH-482: set required-scc for dataGahtering jobs & pods #1049
Full changelog

ironic

METAL-1305: Do not use openstack packages #647
OCPBUGS-52292: Fix runlogwatch script #643
OCPBUGS-50673: Install python3-inotify pkg explicitly #640
OCPBUGS-49998: Fix runlogwatch failure if LOG_DIR does not exist #637
OCPBUGS-49822: Drop quiet option of grep to avoid race condition with pipefail #633
OCPBUGS-49756: Use pynotify instead of inotify-tools #631
OCPBUGS-48149: Bump jinja2 to 3.1.5 #622
OCPBUGS-43955, OCPBUGS-43963: Bump python-waitress [4.17] #603
OCPBUGS-42692: Include fixes for CVE-2024-5569 #590
OCPBUGS-42509: Include fix for CVE-2024-47211 #593
Full changelog

ironic-agent

METAL-1305: Do not use openstack packages #179
OCPBUGS-39013: Bump ironic-lib to fix utf8 decoding issue #155
Full changelog

ironic-static-ip-manager

OCPBUGS-49350: Fix subnet validation #47
Full changelog

kube-metrics-server

: OCPBUGS-46491: Disable HTTP2 #40
Full changelog

kube-proxy

OCPBUGS-43807: Revendor to a patched k/k with our prefer-local-DNS hack #640
Full changelog

kube-rbac-proxy

OCPBUGS-42697: protobuf bump [4.17] #112
Full changelog

kubevirt-csi-driver

OCPBUGS-44623: During detach don’t return error if VM is not found #50
Full changelog

machine-api-operator

OCPBUGS-52576: add image/read permissions #1344
OCPBUGS-52359: Remove unneeded VNet permissions from Azure CredentialsRequest #1337
OCPBUGS-51370: Drop oVirt support #1334
OCPBUGS-43851: vSphere klog initialization preventing verbose log messages #1302
OCPBUGS-42414: Ensure deletion annotation takes priority and oldestPolicy can distinguish longer ages #1293
Full changelog

machine-config-operator

OCPBUGS-53441: Fixing typos for MachineConfigNode #4936
OCPBUGS-53186: Update ObservedGeneration in KubeletConfig #4919
OCPBUGS-53225: daemon: ensure ostree-finalize-staged is started before rebooting #4920
OCPBUGS-52160: Enforce VIPs to be collocated at the same host #4884
OCPBUGS-52303: Enable nmstate-configuration on all platforms #4891
OCPBUGS-51003: daemon: add nil check for annotation fetching #4862
OCPBUGS-51353: Update cluster-reader ClusterRole permissions #4882
OCPBUGS-50955: create /run/nodeip-configuration before use #4858
OCPBUGS-51334: Update format verbs for alert logs #4880
OCPBUGS-52257: configure-ovs workaround for ovs-if-br-ex bug #4889
OCPBUGS-49973: Update the storage.conf configuration file template #4836
OCPBUGS-49363: Auto-recover from MC with invalid extension #4824
OCPBUGS-49716: MCO CO degrades are stuck on until master pool updates complete #4826
OCPBUGS-49639: Add clarification to invalid maxUnavailable alert #4820
OCPBUGS-47475: Pausing Master MCP results in Alerts #4769
OCPBUGS-47802: OCPBUGS-47801: trying to wait for sub-controllers #4775
OCPBUGS-38292: controller: default to runc when upgrading clusters from 4.17 to 4.18 #4715
OCPBUGS-45918: Remove trailing periods from AWS provided hostnames #4738
OCPBUGS-39223: Do not enable on-prem-resolv-prepender.path for UPI #4572
OCPBUGS-38292: Revert “controller: default to runc when upgrading clusters from 4.17 to 4.18” #4716
OCPBUGS-38292: controller: default to runc when upgrading clusters from 4.17 to 4.18 #4635
OCPBUGS-44561: Disable tx chksum for driver IDPF on GCP C3/C4 #4701
MCO-1343: Backport Telemetry to 4.17 #4650
OCPBUGS-43917: Disable ESP offload for OVS attached interfaces #4667
OCPBUGS-43719: Soften haproxy timeout for kubeapi probe #4657
OCPBUGS-42577: openstack: fix non-old systemd compatible unit #4620
OCPBUGS-42108: Do not use ‘restart’ for ‘oneshot’ service #4615
OCPBUGS-42979: Regenerate the rendered MC in use when deleted #4634
OCPBUGS-42677: The MCO does not properly degrade when pools are failing to render a new config #4623
OCPBUGS-42081: Check for kernel arg diff in updateOnClusterBuild #4595
OCPBUGS-41255: Set ESP offloads off in bonds if slaves don’t support them #4598
OCPBUGS-42256: Panic seen in CI job for MCC pod #4603
OCPBUGS-42200: MCPs report wrong number of nodes when we move nodes from one custom MCP to another custom MCP #4602
OCPBUGS-41357: Enable the use of Linux Bridge as the ovs default port connection #4567
OCPBUGS-41686: MCPs with RHEL nodes are degraded when a userCA bundle is added to the cluster #4580
Full changelog

machine-os-images

OCPBUGS-54146: Change rhcos release browser url #56
Full changelog

metallb-frr

OCPBUGS-44111: Use metrics for readiness/liveness probes #77
Full changelog

monitoring-plugin

OCPBUGS-51117: Fix overview links #357
OCPBUGS-44394: remove unused package and upgrade vulnerable dependency #271
OCPBUGS-43238: upgrade dynamic plugin sdk to remove vulnerable dependencies 4.17 #216
OCPBUGS-42408: fix path-to-regexp dependency #196
Full changelog

multus-whereabouts-ipam-cni

OCPBUGS-48745: [Release-4.17]Kubeconfig loop #334
Full changelog

must-gather

OCPBUGS-48068: Update owners #452
OCPBUGS-46281: Support gathering IPsec data #467
OCPBUGS-42835: Removes reference to gather_multus_logs in 4.17 #459
OCPBUGS-42964: Collect etcd object count #453
OCPBUGS-42958: Gather OSUS data #443
OCPBUGS-42835: [Release-4.17] Network logs collection: skip unready nodes #445
Full changelog

network-metrics-daemon

Updating ose-network-metrics-daemon-container image to be consistent with ART for 4.17 (#93) #93
swtich golint install method (#103) #103
Full changelog

networking-console-plugin

OCPBUGS-49758: Fix weight width #208
OCPBUGS-45791: fix path-to-regex CVE #196
OCPBUGS-48704: fix service name #188
OCPBUGS-48267: UI crash accessing a Service in pending state #168
OCPBUGS-46553: fix ports as number instead of strings #169
OCPBUGS-45876: Bump nanoid from 3.3.7 to 3.3.8 #172
OCPBUGS-44140: Bump dompurify from 2.4.9 to 2.5.8 #166
OCPBUGS-44397: OCPBUGS-44679: upgrade packages for cve #141
OCPBUGS-44650: Routes list page shows correct status and location #139
OCPBUGS-44648: Add Route Filter in route list #138
OCPBUGS-43037: hide routes metrics non-admin users #129
OCPBUGS-43065: Routes list sort by status #131
CNV-49305: fix for virt perspective #128
OCPBUGS-42678: OCPBUGS-42352: add service weight #125
OCPBUGS-39390: fix sorting on lists #123
OCPBUGS-42582: fix html in translations #122
OCPBUGS-42581: Route edit form #121
CNV-48190: move title networkpolicies above tabs #120
Fix alert ServiceSelector #111
CNV-47528: Fix key value in selector #110
Revert IPAM (subnets input) #115
OCPBUGS-42248: fix pagination during sorting #109
OCPBUGS-41868: Add destination ca cert #106
Full changelog

oauth-apiserver

OCPBUGS-46044: Update dependencies to address CVE-2024-24786 #127
Full changelog

oauth-proxy

OCPBUGS-46659: Fix oauth-proxy e2e-component tests #303
Full changelog

oauth-server

OCPBUGS-44118: escape spaces in oauth callback path #167
OCPBUGS-43587: Fix login path for go1.22 mux pattern matching #162
Full changelog

oc-mirror

fixes CVEs upgrading go-git dependency (#1033) #1033
OCPBUGS-47453: Use one of the newer sha256 keys to verify release signatures (#1000) (#1024) #1000
changes the owners file (#1017) #1017
OCPBUGS-48513: e2e: use same version of crane as in go.mod (#1020) #1020
OCPBUGS-37867: Use tag only when image by tag and digest (#911) (#932) #911
Full changelog

openshift-apiserver

OCPBUGS-49399: prevent panic when no image and error are set #488
OCPBUGS-49399: validate image property isn’t nil before using #489
OCPBUGS-49399: move on to the next digest/tag during failures #487
OCPBUGS-42752: Pass expected type to deploymentconfig/scale object validation. #457
OCPBUGS-42232: fail image import when both image and error are nil #450
Full changelog

openshift-controller-manager

OCPBUGS-47769: Add team members to the OWNERS file #357
OCPBUGS-44093: user system:serviceaccount:openshift-infra:serviceaccount-pull-secrets-controller in ns/openshift-infra must not produce too many applies #350
NO-JIRA: cleanup root and app OWNERS #346
OCPBUGS-42362: Continuous pull-secret updates / slow initialization on build01 (test platform infrastructure) #339
Full changelog

openstack-cluster-api-controllers

OCPBUGS-44455: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.10 into release-4.17 #342
OCPBUGS-44959: Makefile changes for merge-bot #340
OCPBUGS-44455: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.10 into release-4.17 #329
OCPBUGS-43584: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.10 into release-4.17 #323
Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

OCPBUGS-53071: add missing pod disruption reasons to isPodDead #982
OCPBUGS-53283: Ensure that PSA label is latest instead of pinning versions #985
OCPBUGS-50829, OCPBUGS-50831, OCPBUGS-50835: CVE-2025-24976 Bump github.com/distribution/distribution/v3 [release-4.17] #968
OCPBUGS-48695: Fix excessive catalog source snapshots cause severe performance regression #956
OCPBUGS-45845: Fix concurrent namespace resolution #944
OCPBUGS-46929, OCPBUGS-46936, OCPBUGS-47316: x/net bump to v0.34.0 [release-4.17] #938
OCPBUGS-46598: catalog-operator: Delete Pods that were evicted (#3459) #922
OCPBUGS-46054: CRD upgrade existing CR validation fix #913
OCPBUGS-44760: fix: call TokenRequest API when service account token secret is missing #898
OCPBUGS-43965: Return an error when the IP status cannot be updated #885
Full changelog

operator-marketplace

OCPBUGS-53179: Ensure that PSA label is latest instead of pinning versions #607
OCPBUGS-49431: Upgrade golang.org/x/net [release-4.17] #585
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-54203: Update OVN to FDP25.A.1 24.03.5-40. #2496
OCPBUGS-52409: Change dynamic_neigh_routers to false for the Interconnect topology. #2476
OCPBUGS-50519: kubevirt, localnet: Reduce live migration downtime #2458
OCPBUGS-48777: Fixes unexpected mp0 route removal during start up #2423
OCPBUGS-48828: fixes overzealous deletion of SNAT in egressIP #2425
OCPBUGS-47506: Let OVN-northd bind remote ports #2404
OCPBUGS-45953: bump OVS version to 3.4.0-18 #2393
OCPBUGS-45312: pin libreswan to 4.6-3.el9_0.3 #2384
OCPBUGS-45339: Dockerfile: Update OVN to the 24.03.2-32.el9fdp minor release. #2376
OCPBUGS-43454: Ignore cluster manager topology not managed errors for localnet with no subnets #2362
OCPBUGS-44303: Add hybird overlay pod IPs to the namespace address_set #2340
OCPBUGS-42931: Add static route to the hairpin masquerade IPs to pod #2315
OCPBUGS-39200: Dockerfile: Bump OVS to 3.4.0-1 #2287
OCPBUGS-42940: Fix egress gateway pod cleanup for remote zone pods. #2316
Full changelog

prometheus

OCPBUGS-43667: fix(discovery): Handle cache.DeletedFinalStateUnknown in node informers’ DeleteFunc #230
Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

OCPBUGS-48069: fix: validate smtp smarthost and smtp from fields #323
Full changelog

tests

OCPBUGS-52580: Use payload pullspec for image info test #29588
OCPBUGS-38835: Try also user CA for getting openshift-tests image #29029
OCPBUGS-49411: Add a monitor test to detect concurrent installer pod or static pod #29487
OCPBUGS-48634: Revert “[release-4.17] OCPBUGS-48459, SDN-4930: ovn-k, udn crd e2e: Fix status report consumer assertion” #29453
OCPBUGS-48459, SDN-4930: ovn-k, udn crd e2e: Fix status report consumer assertion #29301
OCPBUGS-48345: Add team members to the OWNERS file for PR approvals #29430
OCPBUGS-48188: Fixing build s2i ruby test data inline with latest ruby version(>=3.0) #29409
: OCPBUGS-48093: fix unit test for compare against string #29405
OCPBUGS-44190: Fix UnexpectedNodeNotReady and UnexpectedNodeUnreachable #29306
OCPBUGS-43576, SDN-4930: Don’t modify pod routes in tests #29250
OCPBUGS-43576, SDN-4930: Set startup probe for UDN tests #29244
OCPBUGS-43576, SDN-4930: UserDefinedPrimaryNetworks: curl the KAPI IP through eth0 #29241
OCPBUGS-44795: fix: adding oslat updates and outputting test results to the artifacts #29193
OCPBUGS-43576, SDN-4930: network_segmentation: allow multiple UDN status conditions #29259
OCPBUGS-44494: removing rteval from the realtime test suite #29194
OCPBUGS-44496: fix: adding in a SNO time override for AWS Metal #29192
OCPBUGS-44062: Adjust createDNSPod() to support hypershift dual-stack test #29254
OCPBUGS-44045: Ignore infra nodes on tap cni tests #29251
OCPBUGS-43569: feat: update to use pullspec image #29207
OCPBUGS-43576: Porting testing for netConfig and UDN and CIDR overlapping tests from upstream #29181
OCPBUGS-39606: Add image registry capability check #29174
OCPBUGS-42814: ruby:3.0-ubi8 => ruby:3.1-ubi8 #29162
OCPBUGS-42336: Fix image ecosystem tests 4.17 #29126
OCPBUGS-41817: Update the NotFound case for CNI plugin to reflect changes #29091
Full changelog

vsphere-cloud-controller-manager

OCPBUGS-43432: update check-fmt goimports command #78
Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

OCPBUGS-43705: redact sensitive information when logging VCenter config #133
Full changelog

vsphere-csi-driver-operator

OCPBUGS-52207: fix panic when vcenter address is incorrect #295
OCPBUGS-50593: Set reconcile-sync to 10 minute for ListVolume #291
OCPBUGS-49858: Escape backslash in vCenter username #288
OCPBUGS-49685: List only linux nodes #285
OCPBUGS-43778: Fix panic on nil infrastructure Spec.PlatformSpec.VSphere #264
OCPBUGS-42327: Fix the config loading warning #259
OCPBUGS-42007: Remove conditions and controllers #254
OCPBUGS-42006: Add check for vCenter version #253
OCPBUGS-42008: Implement minor quality of life improvements. #255
Full changelog

View changelog in Markdown or change previous release:

Source code for this page located on github