4.17.44

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.17.44-x86_64

Team Approvals:

Tests:

Blocking jobs
- upgrade Succeeded release-openshift-origin-installer-e2e-aws-upgrade
- upgrade-minor Succeeded periodic-ci-openshift-release-master-stable-4.y-e2e-aws-ovn-upgrade
Informing jobs
- aws-ovn-serial Succeeded periodic-ci-openshift-release-master-nightly-4.17-e2e-aws-ovn-serial
- aws-ovn-upgrade-4.17-micro Succeeded periodic-ci-openshift-release-master-ci-4.17-e2e-aws-ovn-upgrade
- aws-ovn-upgrade-micro Succeeded periodic-ci-openshift-release-master-ci-4.17-e2e-aws-ovn-upgrade
- azure-ovn-upgrade-4.17-micro Succeeded periodic-ci-openshift-release-master-ci-4.17-e2e-azure-ovn-upgrade
- fips-scan Succeeded (1 retries) periodic-ci-openshift-release-master-nightly-4.17-fips-payload-scan
- gcp-ovn-rt-upgrade-4.17-minor Succeeded periodic-ci-openshift-release-master-ci-4.17-upgrade-from-stable-4.16-e2e-gcp-ovn-rt-upgrade
- hypershift-ovn-conformance-4.17 Succeeded periodic-ci-openshift-hypershift-release-4.17-periodics-e2e-aws-ovn-conformance
- metal-ipi-ovn-bm Succeeded (1 retries) periodic-ci-openshift-release-master-nightly-4.17-e2e-metal-ipi-ovn-bm
- metal-ipi-ovn-ipv6 Succeeded periodic-ci-openshift-release-master-nightly-4.17-e2e-metal-ipi-ovn-ipv6

Upgrades from:

Untested upgrades: 4.16.11, 4.16.12, 4.16.14, 4.16.15, 4.16.16, 4.16.17, 4.16.18, 4.16.19, 4.16.20, 4.16.21, 4.16.23, 4.16.24, 4.16.25, 4.16.26, 4.16.27, 4.16.28, 4.16.29, 4.16.30, 4.16.33, 4.16.34, 4.16.35, 4.16.36, 4.16.37, 4.16.38, 4.16.39, 4.16.40, 4.16.41, 4.16.43, 4.16.44, 4.16.45, 4.16.46, 4.16.47, 4.16.48, 4.16.49, 4.17.10, 4.17.11, 4.17.12, 4.17.13, 4.17.14, 4.17.15, 4.17.16, 4.17.17, 4.17.18, 4.17.19, 4.17.20, 4.17.21, 4.17.22, 4.17.23, 4.17.24, 4.17.26, 4.17.27, 4.17.28, 4.17.29, 4.17.3, 4.17.30, 4.17.31, 4.17.32, 4.17.33, 4.17.34, 4.17.35, 4.17.37, 4.17.38, 4.17.39, 4.17.4, 4.17.40, 4.17.5, 4.17.7, 4.17.8, 4.17.9

4.17.43 (changes) - S S S S S
4.17.42 (changes) - Success
4.17.41 (changes) - Failed
4.17.36 (changes) - Success
4.17.25 - Success
4.17.6 (changes) - Failed
4.17.2 (changes) - Failed
4.17.1 (changes) - Success
4.17.0 (changes) - Failed
4.16.52 (changes) - Success Success
4.16.51 (changes) - Failed
4.16.50 (changes) - Failed
4.16.42 (changes) - Failed
4.16.32 (changes) - Failed
4.16.13 (changes) - Success
4.16.10 (changes) - Success
4.16.9 (changes) - Failed
4.16.8 (changes) - Failed
4.16.0-0.nightly-2025-11-12-152857 (changes) - Success

Loading changelog, this may take a while ...

Changes from 4.17.25

Created: 2025-11-13 13:50:26 +0000 UTC

Image Digest: sha256:e3d5a7ccc804f95867a4fa9b9802739898be8814a429368521b12d7822de51a0

Components

Kubectl 1.30.5
Kubernetes upgraded from 1.30.11 to 1.30.14
Kubernetes Tests upgraded from 1.30.0 to 1.30.14
Red Hat Enterprise Linux CoreOS upgraded from 417.94.202504080421-0 to 417.94.202511121758-0 (diff)

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
StreamingCollectionEncodingToJSON (0 tests)	Enabled (New)		Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
StreamingCollectionEncodingToProtobuf (0 tests)	Enabled (New)		Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)

Rebuilt images without code change

aws-ebs-csi-driver git 2bb5b316 sha256:f17f3472d01c87c74ed5c5198ecbef097601f4a6b9e48814bab12e402ec13931
aws-kms-encryption-provider git 9d401670 sha256:07ef9d4d550fe447f7a4d9add85ff81f3d0d7ba22c7991f1318e28c85632d1b4
aws-pod-identity-webhook git 80efc4ea sha256:c40c7ec955b395097a71c821382b6805e675f3304b5e1ac28c4387f9e78a3c99
azure-cloud-controller-manager git 626ecd1c sha256:9d4b1e9a9a7595537abf39740e8a6a3d0b8bd29ffb70768f33e3f137ec04f716
azure-cloud-node-manager git 626ecd1c sha256:21711314570f0504f9435f09de7801b45bc23f54a4bdb0e273957d2f4014bfbd
azure-cluster-api-controllers git d359bfe5 sha256:a2ddc31ddcfedb6713acc1de3218bee5cece239b24052ab632b2f8f89e6a943a
azure-disk-csi-driver git a544f30b sha256:dda6c2e26db0df7bc3cb1f1e6c35a7a9419c65e2e6e0c6c65c6cae42ed5ea5bd
azure-file-csi-driver git 9f4c38c2 sha256:314e84db24b2d92dfe95d79f7403ee1622109256ae08a042c3bc8a1143bb20af
azure-workload-identity-webhook git 6707f899 sha256:7e396f3208ffd16ad4dd1aafb3990e2850df22c7e96c7a505c7d098c821dd225
baremetal-machine-controllers git 6e7aa77e sha256:3e6c0a01be9f9f08d199db4bd159830ffa4392631048fd56fd00025eb894b8ec
baremetal-operator git e6e5d54a sha256:b595bec98b18b83c0ade348cf17d74fb83fc24d50d0337ecf0e65e57e259bfcb
cluster-authentication-operator git f641a4c6 sha256:80b95bcb5092847af416ba7dae09154fb074fdec54addc3e82827b0f32dab3bf
cluster-autoscaler-operator git ea4a8878 sha256:f56b3b70bb7ea26021e73dd07ded9acce12f4f6bb89cad56994a9e41b5e331f6
cluster-bootstrap git 95dd9129 sha256:f58d8c7ebee99fe9b233d92492710543b5a0ed5ecad159d4caf40289a0f8c3a4
cluster-capi-controllers git 77ef4fc5 sha256:6e3685ad8046032dd6f72a9e38fa1c449936c142979647e6fe7e302906bab221
cluster-control-plane-machine-set-operator git f7e01c2f sha256:01c0db58fa3c178cca7ca48fa21b9c54ba771b192007749044066702df84400e
cluster-csi-snapshot-controller-operator git ffba005b sha256:81a9c0e85fb72d79c800ec660053782b210176af212d8f5d0130fe15eda9055d
cluster-dns-operator git 81507f04 sha256:a160f9ac35871d72e058d200d5808ac78f21f6addb7452acb535a0deb65527bb
cluster-kube-cluster-api-operator git aed5f6c7 sha256:b55cdb947c45fe50cc1390564112a9d52f7d4aadb35cf88cf1c996535fd3b2b0
cluster-kube-scheduler-operator git 98ca953b sha256:672ea1f80e300a848522ead7435596e9ef8115b3bee53aaa4462dc43b9c37af3
cluster-kube-storage-version-migrator-operator git ab40b611 sha256:f6c279a992022ab18707798dfc90cdf940a07ab20a8176fc87657f7d5aa2c97f
cluster-machine-approver git acc2380e sha256:4abd402b113bf434a5aa9eab25646e5a564a6ae7e2e2e8e81e9be3a9fcd8fd01
cluster-olm-operator git e31b7775 sha256:f3045b6cbf0b693ea431cb4c3a4165c4fa2069e055baee187af5330b17de142d
cluster-openshift-apiserver-operator git 2b2ba3be sha256:98e20543c98050a3f5361c97a855a38612058dd20fdead16c230ebd3f173a4a3
cluster-openshift-controller-manager-operator git b05a249d sha256:d4dd291e0e0a1dee580d411ba8221f3a89cf520dfc85459999210a764e4dfbd5
cluster-policy-controller git 7209e90d sha256:7796ab73917eddc61fde114558075ef5efc89efa13e7ace8d92164153dd57578
csi-driver-manila-operator git efc99a2a sha256:eb9fb4a394b19f18b2c0d1c68c9c959fd57907626a0a3594b4a32d38cd767ef2
csi-driver-shared-resource-operator git c095a1f2 sha256:3447d8f40beb6be88553c8a5cd19495e9ef1e6b568008d0807c86de0302ddbec
csi-external-attacher git c3fe8e2e sha256:0c7add0bc2a75f4ecf7148b8859da19d6fe80fd63ba83e43c5e0443bce699d5c
csi-external-provisioner git fe460e56 sha256:7f45266f6051c9555bdb2be557d30feaa6848b74d4e8e7895ec95c05e5174b17
driver-toolkit git 859518f6 sha256:9a156f4524dea8121a7fba4e23c29cf9c7b31a846e0f79fa3986435fdf6e9ad4
egress-router-cni git 3193a756 sha256:2218d4bd33f428f84f53037f65a7764bc2c531cb0df8b5cbf998565d0d6a462e
etcd git 0d9e0a90 sha256:922a79afe9a68ff5c8181d86f80986aa100828b3c5f6a3007ba83e7aa9556d3a
gcp-cloud-controller-manager git 8ce997d7 sha256:e66985e6a3cc1e01cf12bbb3d363d7f78a63df5e8df56eae49824612cb3d28be
gcp-cluster-api-controllers git 9c561f2d sha256:17e20b0429d55d6ca7830437faca2574eae43d4322df435bc926e3731789c0ae
gcp-pd-csi-driver git c770b412 sha256:0bf5c7ee6608936c43e9a36e9c053fbfef20a565a7ff35d8c35990c4a3420ea9
gcp-pd-csi-driver-operator git c23b064f sha256:80df8988c926d423451f1fba16c48cd6597c11491dc26c5c7e16442e93206f2e
gcp-workload-identity-federation-webhook git 08579e9f sha256:344eaac980de0a2f8caba438c864cd6fa5ec98e4dd641aa5e52d06966e9690bd
ibm-cloud-controller-manager git ad8f7eb0 sha256:6c8b5f10d9cf5dcd9991cb377ca845db8bf4c9954cfec5a290a372bc8ddd9270
ironic git 391f57f8 sha256:3ecd1b75c371a3013a90790948b04116a624c02486803253fe92ec9a462d0985
ironic-static-ip-manager git bc5b8a2c sha256:505bd9f95199700aafa0064c755c9cc1edffc34b14bff00b6c4ef69b34639326
keepalived-ipfailover git e3879e9e sha256:cd975059c1a1bc6532b5222c2d5b6af6e96d7687a8a2b817f7ab5aaac4f7515c
kube-proxy git dee082de sha256:f852fc18917de1bd6bddbf9c1d25a0c7d0826addc96337b9b314d6b7f2ade46c
kube-state-metrics git 462e63f6 sha256:bf886caac6a1317c2fd64ba6a04d4d7ca796fa2807f4ec41ae7736944ce6dec5
kubevirt-csi-driver git 757a8894 sha256:b35a63e889dcbc2ab10aef750e4a382da347f4f9bb89fce9da6b91c38d38a5dc
libvirt-machine-controllers git a336f0b5 sha256:010e8fe9e61418f2969d8613e86e817ff74d6aca9a75d94926aa4566634f74df
machine-os-images git f85666be sha256:aa3143ac20fe122cb577cc4973638877b832e24cef6fce8be7498c6fddafa694
multus-route-override-cni git 391c1b03 sha256:617d25a4f954631a481833aef5905947b25a2178768f525c0f2ea2b3d65ff08d
nutanix-cloud-controller-manager git c9f6cd1f sha256:ee2e603f7363a29da845b10477896b4108702d7fd6fceeb5e0d6cc66ffc6f83c
olm-catalogd git c740e056 sha256:41f7a69e8ace12b873c564a671c44191fa7242abc6e3f3f3a4664a73172161f0
openstack-cinder-csi-driver-operator git f89b6dbc sha256:da37eb965e9e88c0147b30a676df4488baa5cff9da2f19fdcbda706d8888bb9c
openstack-machine-api-provider git 68971874 sha256:abba97b92e980a0c272840f7db1de5bcdc10d43b6fe0c8254cd09e85131213e0
ovirt-csi-driver git 1db726a9 sha256:bc0b281a4680656190d8a5ba54020dfbf5846834a3cb88077044ab52af718f72
ovirt-csi-driver-operator git 0feae256 sha256:0f91ebc196de0e1a01b8ff7cf6a64c223d2a652f012c97119b19bace0a303d0a
powervs-block-csi-driver git aaa6afa9 sha256:3ac22f0bddd359c0016177b01b6000c5994dccbf9f830cf683c696fe918bbc59
powervs-block-csi-driver-operator git f6f037c5 sha256:4312e08bf12f4611296497d05b987fee498b13a52166edb54127707576598438
powervs-cloud-controller-manager git bd3d72e5 sha256:e4a6389e86cb9011170ac5d85e73193cbea61671e4593df73a7f41644bb7137f
rhel-coreos sha256:f312e338cceb367dd913b21e3faffc2da681a04d15e36b6c996f386e216a7437
rhel-coreos-extensions sha256:6e615a6d4f5759a33bc7a90038ac7688273efc66b254bb898f3e4fc7e1ffcee6
vsphere-cloud-controller-manager git 097d823b sha256:08b12c638d5630165ce1614ab97192cd69c8b1fc04c832800b0e2a5a569e0d0c
vsphere-csi-driver git 039ee368 sha256:4200a8240a324d9cd8af07ac192583ea79ce5a3538f773bbef696c51f1f284da
vsphere-csi-driver-operator git e1de36a2 sha256:302854f3400baa729a627ca8c592ac2ee2bd822efb931a78ccc32b5fbfc4a43d
vsphere-csi-driver-syncer git 039ee368 sha256:ed5370f2fb927567bf8efe54545f19f7036372e83abf7987b74e9f1969b1f81a

agent-installer-api-server

NO-ISSUE: pin gotestsum to v1.12.3 (#8017) #8017
OCPBUGS-58634, OCPBUGS-58639: Bump glog to v1.2.5 in release-4.17 (#7895) #7895
OCPBUGS-47627: dnsmasq service on OCP SNO fails to read /etc/resolv.conf file during system startup (#7724) #7724
OCPBUGS-51230: Revert go-jose from v4.0.5 to v0.3.04 (#7605) #7605
OCPBUGS-51230: Bump github.com/go-jose/go-jose/v4 to v4.0.5 in release-4.17 (#7574) #7574
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-58649: Bump glog pkg to 1.2.4 (#1182) #1182
Updating ose-agent-installer-csr-approver-container image to be consistent with ART for 4.17 (#1088) #1088
Updating ose-agent-installer-orchestrator-container image to be consistent with ART for 4.17 (#1087) #1087
OCPBUGS-53719: Bump jwt to 4.5.2 in release-4.17 (#1086) #1086
Full changelog

agent-installer-node-agent

OCPBUGS-58654, OCPBUGS-58659: Bump glog to v1.2.5 in release-4.17 (#1070) #1070
OCPBUGS-52994: Update to latest ghw version (#986) #986
Full changelog

agent-installer-utils

append .0 to go.mod version #110
Full changelog

apiserver-network-proxy

append .0 to go.mod version #82
Full changelog

aws-cloud-controller-manager

append .0 to go.mod version #109
Full changelog

aws-cluster-api-controllers

OCPBUGS-61940: UPSTREAM <carry>: revert: Only tag NetworkInterfaces in RunInstances if IAM Allows It #571
OCPBUGS-58669, OCPBUGS-58674: bump github.com/golang/glog to v1.2.5 #559
Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator

OCPBUGS-64704: Use 127.0.0.1 for healtz http-endpoints #462
OCPBUGS-63557: Add RBAC ClusterRole and Binding for driver node #453
OCPBUGS-62974: Add withCABundleDaemonSetHook() to AWS EFS operator #449
OCPBUGS-60597: Bump library-go to fix assignment to nil map issue #422
OCPBUGS-60470: Backport stale conditions fix #416
Full changelog

aws-machine-controllers

OCPBUGS-63139: client: re-use a single file for building the session instead of randomly named files #145
Full changelog

azure-kms-encryption-provider

append .0 to go.mod version #19
Full changelog

azure-machine-controllers

OCPBUGS-63700: Support datadisks on Stack Hub #168
OCPBUGS-56168: [release-4.17] Update virtualmachines service to armcompute/v5 SDK #146
OCPBUGS-56655: Fix failure when attempting to modify immutable availabilitySet #152
OCPBUGS-55729: Update eviction policy for Spot VMs from Deallocate to Delete #140
OCPBUGS-54393: Re-reconcile machine on NIC provisioning failure #136
Full changelog

baremetal-cluster-api-controllers

ART-13124: Update go.mod to include patch version in go directive #46
Full changelog

baremetal-installer, installer, installer-altinfra, installer-artifacts

OCPBUGS-53236: Validation for API and Ingress VIPs when using user-managed load balancer #10047
OCPBUGS-62951: Update the RHCOS 4.17 bootimage metadata #10021
OCPBUGS-62054: Make swift containers removal not fatal for UPI. #9952
OCPBUGS-54599: Update the RHCOS 4.17 bootimage metadata #9902
OCPBUGS-58319: vSphere - remove unit tests using nip.io #9821
OCPBUGS-57293: sort zone slices extracted from map of byo subnets #9778
OCPBUGS-56448: vsphere - check if host is powered down or on standby before uploading template #9726
OCPBUGS-57292: ensure ctrplane nodes can access bootstrap MCS #9775
OCPBUGS-57304: IBI nmstate unit test fix #9777
OCPBUGS-55224: Fix Load balancer IP setup #9675
OCPBUGS-51116: update resolv.conf every time on bootstrap node #9504
OCPBUGS-51210: Fixes panic during GCP tags fetch due to unstable network #9512
OCPBUGS-46375: Allow spaces in the aws tags [release-4.17] #9315
Full changelog

baremetal-runtimecfg

OCPBUGS-60112: Re-add ENABLE_NODEIP_DEBUG env var #363
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-56734: Adding sos.conf file for default sos config into the tools image #2027
OCPBUGS-58091: avoid transfering permissions when copying artifacts from node-joiner pod #2053
OCPBUGS-57446: Use fedora image in unit tests instead of centos #2038
Full changelog

cloud-credential-operator

OCPBUGS-63549: ccoctl: add public-key-file flag to create-all #939
OCPBUGS-55128: snyk to ignore SNYK-GOLANG-GOLANGORGXNETHTML-9572088 #917
OCPBUGS-60972: ccoctl: aws to use proper issuer url on subsequent runs #908
OCPBUGS-58679: github.com/golang/glog v1.2.5 #892
OCPBUGS-58248: ccoctl: only add owned tag to azure resources on create #883
OCPBUGS-56980: Azure: resolve nil pointer exception when role assignment exists #868
OCPBUGS-54828: Render: configure proxy on bootstrap static pod #863
Full changelog

cloud-network-config-controller

OCPBUGS-56257: Increase API call timeout to 30 second #171
Full changelog

cluster-autoscaler

OCPBUGS-60913: revert openshift replica fix #376
OCPBUGS-60608: fix checkpoint gc of unknown recommenders #371
OCPBUGS-59266: Fix cool down status condition to trigger scale down #362
Full changelog

cluster-baremetal-operator

OCPBUGS-63715: Always have a service for ironic-api port #519
OCPBUGS-63666: Allow provisioningIP when network disabled #518
OCPBUGS-61097: Remove webhookport (9447) as HostPort #505
Full changelog

cluster-capi-operator

append .0 to go.mod version #314
Full changelog

cluster-cloud-controller-manager-operator

OCPBUGS-63167: ccm: disable unused secure-serving port and webhook #423
OCPBUGS-60211: Update service selector to match deployment label #406
OCPBUGS-60211: Add Service using common resource templating #407
Full changelog

cluster-config-api

NO-JIRA: Promote streaming list encoding to Default on Hypershift. #2567
CNTRLPLANE-1611: Add feature gates for StreamingCollectionEncoding #2538
OCPBUGS-57285: Add IPsec API for NAT-T UDP encapsulation support #2363
OCPBUGS-49702: Add IdleConnectionTerminationPolicy field to IngressControllerSpec #2186
Full changelog

cluster-config-operator

append .0 to go.mod version #441
Full changelog

cluster-etcd-operator

OCPBUGS-61337: Vendor latest mixin, including additional and modified alerts for etcdDatabaseQuotaLowSpace #1480
OCPBUGS-60220: add missing ports to svc and pod spec #1461
OCPBUGS-53511: fix CVE-2025-30204 #1414
Full changelog

cluster-image-registry-operator

OCPBUGS-53871: bump github.com/golang-jwt/jwt #1218
OCPBUGS-51604: bump golang.org/x/oauth2 #1209
Full changelog

cluster-ingress-operator

OCPBUGS-49702: Add e2e tests for IdleConnectionTerminationPolicy #1225
OCPBUGS-49702: Add support for IdleConnectionTerminationPolicy #1223
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-60398: Add missing service ports to apiserver service #1893
Full changelog

cluster-kube-controller-manager-operator

OCPBUGS-60249: Missing endpoint slices for open ports the operator uses #855
Full changelog

cluster-monitoring-operator

OCPBUGS-63489: Add mcd_local_unsupported_packages metric from MCO to telemetry 4.17 #2725
OCPBUGS-63123: test: remove image registry e2e tests #2715
OCPBUGS-61766: chore(jsonnet): use prometheus_remote_storage_queue_highest_timestamp_seconds in PrometheusRemoteWriteBehind #2672
OCPBUGS-60017: operator: increase wait time till degraded to max 4 times 5m #2634
Full changelog

cluster-network-operator

OCPBUGS-63154: Add drop flows for GARPs #2818
[Release 4.17] OCPBUGS-61765: Update CNO reviewers/approvers #2799
OCPBUGS-58066: [release-4.17]: Manual feature backport of cert rotation for whereabouts #2784
OCPBUGS-57285: Implement IPsec NAT-Traversal encapsulation option #2726
OCPBUGS-55518: iptables-alerter streamlining #2698
OCPBUGS-55033: Add IPv6 NGINX configuration #2689
Full changelog

cluster-node-tuning-operator

OCPBUGS-63504: Do not cause kubelet failed dependency by ocp-tuned-one-shot.service #1418
Full changelog

cluster-samples-operator

OCPBUGS-63515: references to github.com/sclorg/django-ex.git now also refer to the branch #658
OCPBUGS-55800: only update LastTransitionTime if operator status change #640
OCPBUGS-55795: Adding filter to clusterOperatorInformerEventHandler #639
OCPBUGS-55894: Samples Operator should sort failing image imports #641
OCPBUGS-55042: Adding mutex to func createSamples on handler.go #632
Full changelog

cluster-storage-operator

OCPBUGS-41160: Move metrics to vsphere driver #633
Full changelog

cluster-update-keys

NO-ISSUE: Updating ose-cluster-update-keys-container image to be consistent with ART for 4.17 #79
Full changelog

cluster-version-operator

OCPBUGS-58451: Failing=Unknown upon long CO updating #1212
Full changelog

configmap-reloader

append .0 to go.mod version #70
Full changelog

console

OCPBUGS-64599: Remove required flag from ‘console.flag/model’ pipelines-plugin extension #15665
OCPBUGS-62631: /auth/error?error=missing_state&error_type=auth is showing blank page #15554
OCPBUGS-63212: switch to dev perspective for /dev-monitoring #15614
OCPBUGS-63397: fix bug where Roles list was displaying invalid data f… #15627
OCPBUGS-62282: Fix desync of console and variable namespace #15545
OCPBUGS-44154: bump dompurify to latest #15590
OCPBUGS-61737: Remove ancient X-XSS-Protection header #15494
OCPBUGS-54241: VolumeSnapshots are not displayed in OpenShift Web Console #15465
OCPBUGS-59747: OpenShift console PVC clone cannot use B as the unit #15324
NO-JIRA: Increase the timeout on the cypress test #15420
OCPBUGS-58365: change ‘/metrics/usage’ endpoint to ‘/api/metrics/usage’ #15271
OCPBUGS-59544: Secret key with binary file changes when edited via Console #15301
OCPBUGS-59784: Update the golang.org/x/crypto/ssh to 0.31.0 in the openshift-console image #15329
OCPBUGS-58337: Tolerate unknown fields in Infrastructur… #15236
OCPBUGS-59492: Cannot read properties of undefined (reading ‘node-role.kubernetes.io/master’) error while accessing node logs from console #15294
OCPBUGS-59879: add data-test attrs to console plugins … #15338
OCPBUGS-59510: Not able to launch terminal window from OCP web console due to console plugin conflicts #15297
OCPBUGS-59265: fix bug where / in console.tab/horizontalNav href brea… #15270
OCPBUGS-58318: Implement sessions in openshift authenticator #15238
OCPBUGS-58224: Add the ability to launch multiple modals with useModal hook #15222
OCPBUGS-58378: Cannot read properties of undefined (reading ‘filter’) error while accessing nodes from console. #15241
OCPBUGS-57835: Add flags in console static plugin for all the components of this epic #15192
OCPBUGS-57932: Fix TypeError Cannot read properties of null (reading ‘metadata’) #15197
OCPBUGS-57182: Fix ‘/metrics’ endpoint token review to handle interna… #15154
OCPBUGS-56895: HorizontalPodAutoscalers via console require CPU resource limit even though HPAs use requests for scaling #15108
OCPBUGS-57095: Add all files to vendor regardless of gitignore #15132
OCPBUGS-57114: Debug pod logs are not accessible when debugging a node via OpenShift Console #15142
OCPBUGS-56975: Sample segment sessions #15114
OCPBUGS-56844: Enable knative tests #14387
OCPBUGS-56375: remove 60 day alert from cluster update modal #15062
OCPBUGS-55924: Fetching taskRuns in PLR details page using PLR UID also #15029
OCPBUGS-55756: update the Deployment pod on change in imageStream #15022
OCPBUGS-56238: Remove the devconsole backend common internet proxy and replace it with dedicated ones #15049
OCPBUGS-55447: Authenticate user token in openshift Authenticate func #15010
OCPBUGS-55415: fix bug where operator appears twice #15002
OCPBUGS-55202: Do not load CSRs if user does not have permissions #14985
OCPBUGS-52999: Pipeline visualisation shows all tasks as Failed and after that goes to Running state #14862
OCPBUGS-53168: Remove logoutOpenShift method call #14883
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

console-operator

OCPBUGS-60298: Update downloads deployment configuration to use master node selector #1033
Full changelog

container-networking-plugins, containernetworking-plugins-microshift

OCPBUGS-55622: Check error returned by ipv6 SettleAddresses #187
Full changelog

coredns

OCPBUGS-62825: UPSTREAM: 7083 and 6836: Fix failing TestZoneExternalCNAMELookupWithProxy #155
append .0 to go.mod version #135
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-58839: CARRY: don’t ignore json files #340
Full changelog

csi-driver-nfs

append .0 to go.mod version #156
Full changelog

csi-driver-shared-resource, csi-driver-shared-resource-webhook

append .0 to go.mod version #372
Full changelog

csi-external-resizer

OCPBUGS-62466: Requeue PVC over PV creation #175
Full changelog

csi-external-snapshotter, csi-snapshot-controller, csi-snapshot-validation-webhook

OCPBUGS-60449: UPSTREAM: 1238: Snapshot Controller startup should not LIST all volumesnapshots #184
Full changelog

csi-livenessprobe

append .0 to go.mod version #73
Full changelog

csi-node-driver-registrar

OCPBUGS-63682: update log level verbosity to not clutter logs #90
append .0 to go.mod version #80
Full changelog

docker-builder

OCPBUGS-57939: S2I build cpu limits observed by assemble are limited to 1 cpu #474
Full changelog

docker-registry

OCPBUGS-60090: bump docker distribution to fix purgeuploads panic #440
OCPBUGS-53655: bump jwt and oauth dependencies #431
Full changelog

gcp-machine-controllers

OCPBUGS-53037: Disable shielded VMs for non-UEFI disks #115
Full changelog

haproxy-router

OCPBUGS-49390: Reject All CA-Signed Certs Using SHA1 #650
OCPBUGS-49702: Add support for IdleCloseTerminationPolicy #652
Full changelog

hyperkube, pod

OCPBUGS-63460: UPSTREAM: <carry>: backporting fix for concurrent map iteration and write #2456 #2496
CNTRLPLANE-1611: Backport StreamingCollectionEncoding for JSON and protobuf #2486
OCPBUGS-61584: UPSTREAM: <carry>: Don’t retry storage calls with side effects. #2458
OCPBUGS-60552: [4.17] podresources: list: use active pods #2426
4.17: OCPBUGS-60998: scheduler: Improve CSILimits plugin accuracy by using VolumeAttachments #2434
OCPBUGS-57888: Bump k8s api to 1.30.14 #2355
OCPBUGS-57196: UPSTREAM: 130047: adjusting loopback certificate validity in kube-apiserver #2328
OCPBUGS-57289: kubelet: fix a stall on startup from waiting too long for a stat call #2206
OCPBUGS-55269: Bump k8s api to 1.30.12 #2280
Full changelog

hypershift

CNTRLPLANE-1903: Migrate 4.17 pipelines to use common pipeline #7215
OCPBUGS-63639: [release-4.17] fix(konnectivity): resolve circular dependency causing DNS timeouts and excessive retries #7112
OCPBUGS-64604: Update DNS names for ovn-kubernetes cp metrics #7150
OCPBUGS-63370: fix: Make the hypershift CLI binary FIPS-compliant #7094
CNTRLPLANE-1425: feat(konflux): tag MCE HO images with latest #6838
OCPBUGS-57143: [release-4.17] HCP payload doesn’t respect multiple mirrors #6771
OCPBUGS-61290: Update KCM node monitor grace period #6760
OCPBUGS-61208: use common MCE konflux pipeline #6749
OCPBUGS-60149: [release-4.17] Always compress and encode payload in token secret for inplace upgrades #6740
OCPBUGS-61101: Use system trust bundle in CPO IDP https client #6735
OCPBUGS-60921: konflux for hcp-cli #6699
CNTRLPLANE-1204: HO MCE change to hermetic ta build #6653
CNTRLPLANE-1230: Move CPO pipeline to hermetic builds #6598
CNTRLPLANE-936: fix(tekton): drop multiarch builds on PR #6224
OCPBUGS-57432: Add proxy variables for the MCD Pod #6258
CNTRLPLANE-918: Konflux build pipeline service account migration #6088
CNTRLPLANE-918: Konflux build pipeline service account migration #6083
OCPBUGS-55723: Don’t check if olm images exist if guest cluster #6115
OCPBUGS-55500, RHOCPPRIO-433: Add validation to avoid conflicts between KubeAPIServer and NamedCertificates SANs #6098
OCPBUGS-51808: Fix golang crypto dependency go.mod replacement #5993
OCPBUGS-54841: Add konnectivity-proxy sidecar to openshift-oauth-apiserver #6017
OCPBUGS-53323: Handle multiple mirror entries for source #5894
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-58740: bump github.com/golang/glog to version v1.2.4 #105
OCPBUGS-56062: tech debt: rework vendor patches #90
append .0 to go.mod version #100
OCPBUGS-53911: bump github.com/golang-jwt/jwt/v4 to v4.5.2 #83
Full changelog

ibm-vpc-block-csi-driver-operator

OCPBUGS-58435: [IBM VPC] set offlineExpansion to false in e2e test manifest #146
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-51823: CVE-2025-22869 Update golang.org/x/crypto to patched OpenShift fork #121
OCPBUGS-50566: Fix for CVE-2024-45338 in golang.org/x/net/html in release-4.17 #101
Full changelog

ibmcloud-machine-controllers

OCPBUGS-52957: IBMCloud: MAPI replacing unhealthy CP nodes #63
Full changelog

insights-operator

OCPBUGS-63500: add missing permissions for replicasets and events #1165
And 4 elided commits (e.g. from squash or rebase merges)
Full changelog

ironic-agent

OCPBUGS-55680: Delay determining the hostname to put into ignition #185
Full changelog

ironic-machine-os-downloader

append .0 to go.mod version #104
Full changelog

kube-metrics-server

append .0 to go.mod version #43
Full changelog

kube-rbac-proxy

ART-13124: Update go.mod to include patch version in go directive #120
Full changelog

kube-storage-version-migrator

NO-JIRA: Add DOWNSTREAM_OWNERS (release 4-17). #226
ART-13124: Update go.mod to include patch version in go directive #217
Full changelog

kubevirt-cloud-controller-manager

OCPBUGS-34447: Updating ose-kubevirt-cloud-controller-manager-container image to be consistent with ART for 4.17 #44
Full changelog

machine-api-operator

OCPBUGS-57073: Updates GCP CredentialsRequest #1377
OCPBUGS-53036, OCPBUGS-53037: Updates GCP credentials request #1345
Full changelog

machine-config-operator

OCPBUGS-63154: [release-4.17] Networking: reset ovn-remote config and allow ovnkube controller to set it #5358
OCPBUGS-63540: Add control-plane label for master nodes on legacy clusters #5375
OCPBUGS-63364: Invalid architecture value found in annotation during 4.19 update #5368
OCPBUGS-63055: Recheck generatedByControllerVersion annotation prior to deleting a degraded MC #5346
OCPBUGS-62741: Add /etc/docker/certs.d to template #5335
OCPBUGS-62683: Add mcd_local_unsupported_packages recording rule #5327
OCPBUGS-60890: Race in configure-ovs.sh affects bonding interface configuration. #5267
OCPBUGS-61859: Override NMState service definition #5289
OCPBUGS-59930, OPNET-681: Support migration to NMState #5206
OCPBUGS-56752: Support NODEIP_HINT in IPI deployments too #5080
OCPBUGS-60704: operator: switch out VAP v1beta1 to v1 #5256
OCPBUGS-57084: scope MCD node listers to current node #5107
OCPBUGS-60239: Add workaround fix for static pod race #5231
OCPBUGS-58292: Do not set cpu system reserve below the default value #5157
OCPBUGS-58063: Update desired config in MCN on OCL update #5139
OCPBUGS-56625: Give keepalived container chroot cap #5072
OCPBUGS-58219: Boot image controller should correctly handle marketplace boot images #5151
OCPBUGS-58218: add MachineConfiguration to CO related objects #5150
OCPBUGS-57135: pkg/operator/status: Drop PoolUpdating as an Upgradeable=False condition #5111
OCPBUGS-56901: Fix dynamic-system-reserved-calc.sh when only true parameter is used #5096
OCPBUGS-56976: Boot Image Controller should not degrade when golden configmap is slow to update #5101
OCPBUGS-56990: Only update boot disks during GCP boot image updates #5102
OCPBUGS-56828: daemon: fix ostree-finalize-staged race workaround for package mode RHEL workers #5087
OCPBUGS-52313: Update machine-config-daemon-pull.service to use custom policy for Podman < 4.4.1 #4893
OCPBUGS-56665: Add hot loop detection in the boot image controller #5077
OCPBUGS-56395: error from generateAndValidateRenderedMachineConfig function can be misleading #5060
OCPBUGS-56218: Rewrote TestFirstBootHasSSHKeys e2e test in pure Go #5053
OCPBUGS-55615: MSBIC should not update windows machinesets #5021
OCPBUGS-55490: MCO should fall back to us-east-1 for AWS bootimages if no region specific-AMI exists #5020
OCPBUGS-54830: Make mtu-migration run after wait-for-primary-ip #4989
OCPBUGS-52314: on-prem/resolv-prepender: stop leaking tmp files #4894
OCPBUGS-45989: Do not run resolv-prepender from NM dispatcher #4785
Full changelog

machine-image-customization-controller

append .0 to go.mod version #135
Full changelog

metallb-frr

OCPBUGS-55021: Backport DynamicASN #92
OCPBUGS-55344: OpenShift Only: TEMPORARY: pin FRR version to known working rpm #89
Full changelog

monitoring-plugin

OU-1058: Don’t show TP button in non-administrator #637
OCPBUGS-62282: align dev and admin persective tab names #602
OCPBUGS-62282: add missing translation string #587
OCPBUGS-61891: feat: add alerting rules tab to dev console #538
OCPBUGS-59399: Fix “Export as CSV” #468
Full changelog

multus-admission-controller

OCPBUGS-58770: Update the github.com/golang/glog module to v1.2.4 #102
append .0 to go.mod version #97
Full changelog

multus-cni, multus-cni-microshift

OCPBUGS-43391: Update net-attach-def client library to 1.7.5 for cri-o functionality [backport 4.17] #257
Full changelog

multus-networkpolicy

append .0 to go.mod version #71
Full changelog

multus-whereabouts-ipam-cni

OCPBUGS-55617: Fixes leftover podref issue #364
Full changelog

must-gather

NO-JIRA: append .0 to go.mod version #492
Full changelog

network-interface-bond-cni

OCPBUGS-59620: Bump github.com/containernetworking/plugins from to 1.7.1 #83
NO-JIRA: Add ci-operator file #82
Full changelog

network-metrics-daemon

append .0 to go.mod version #105
And 2 elided commits (e.g. from squash or rebase merges)
Full changelog

network-tools

append .0 to go.mod version #148
Full changelog

networking-console-plugin

OCPBUGS-60180: Fix ingress details #265
OCPBUGS-60128: Fix requiremenets with no value #260
Add translations 4.17 #239
Add translations scripts #235
Full changelog

nutanix-machine-controllers

OCPBUGS-51859: CVE-2025-22868 #111
OCPBUGS-47267: fixing CVE-2024-45338 #92
OCPBUGS-55728: Fix link-local addresses being added to machine #102
Full changelog

oauth-apiserver

OCPBUGS-61584: Bump openshift/kubernetes-apiserver for etcd retry patches. #143
append .0 to go.mod version #133
Full changelog

oauth-proxy

OCPBUGS-61445: Update x/crypto to v0.31.0 #334
OCPBUGS-58472: fix e2e tests #327
OCPBUGS-30443: Update dependencies to address CVE-2024-24786 #298
Full changelog

oauth-server

OCPBUGS-61584: Bump openshift/kubernetes-apiserver for etcd retry patches. #198
append .0 to go.mod version #185
Full changelog

oc-mirror

Adding r4f4 and Prashanth684 as approvers and removing contributors who are not working with oc-mirror anymore. (#1269) #1269
Full changelog

openshift-apiserver

OCPBUGS-63392: Wire dry run option to Image API server operations #565
OCPBUGS-61584: Bump openshift/kubernetes-apiserver for etcd retry patches. #554
OCPBUGS-53382: Skip blocked registry check for registries with mirrors #500
OCPBUGS-58821: Fix image reference in TestImageStreamImportQuayIO #515
append .0 to go.mod version #525
Full changelog

openshift-controller-manager

OCPBUGS-61199: legacy image pull secret rollback controller #413
OCPBUGS-57950: ignore error failing to find pull/push secrets #400
OCPBUGS-57480: Set node-pullsecrets volume to read-only to protect image pull credentials #393
OCPBUGS-55826: Empty proxy variables are causing issues during the build #379
Full changelog

openshift-state-metrics

append .0 to go.mod version #124
Full changelog

openstack-cluster-api-controllers

OCPBUGS-44455: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.10 into release-4.17 #343
append .0 to go.mod version #364
Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

OCPBUGS-57092: [release-4.17] e2e stability fixes #1081
OCPBUGS-60791: Add NetworkPolicy as a supported kind #1058
OCPBUGS-57428: reduce cache expiry frequency [release-4.19] #1021
OCPBUGS-59253: Reduce Frequency of Update Requests for Copied CSVs (#3597) #1036
OCPBUGS-57438: operatorgroup: ensure clusterroleselectors in clusterrole aggregation rules are sorted #1025
OCPBUGS-56250: fix(olm): improve error logging for missing olm.managed label (#3558) #1004
OCPBUGS-51226, OCPBUGS-51228, OCPBUGS-51246: (vendor) pin go-jose/v4@v4.0.5 #998
Full changelog

operator-marketplace

OCPBUGS-62219: Remove Expect func so that the test case can use the retry logic #670
OCPBUGS-61036: Update memoryTarget on catalog source pods #663
ART-13124: append .0 to go.mod version #638
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-64674: [release-4.17]: Configure sec nic EIPv6 address with NODAD and maximum lifetime #2843
OCPBUGS-63154: Fix EgressIP stale GARP post reboot + pod restart #2807
OCPBUGS-61749: [release-4.17] Fix dnsnameresolver address set #2796
OCPBUGS-60484: Update OWNERS file: Add Patryk/Martin as approvers #2717
OCPBUGS-59381: [release-4.17] Fix default network -> localnet #2667
OCPBUGS-58160: Unpin OVS patch versions, move to ovs 3.5 #2647
OCPBUGS-57109: Fix hybrid overlay node subnets collision with cluster subnets #2620
OCPBUGS-57107: Increase InformerSyncTimeout to 60s #2623
OCPBUGS-56443: Fix predicate for cluster subnet route to gateway router #2578
OCPBUGS-56244: Allow default network pods to reach localnet on the same node #2572
OCPBUGS-52480: Handles unspecified protocol in network policy port #2478
Full changelog

powervs-machine-controllers

OCPBUGS-61204: Use OS_GIT_VERSION in Makefile when found (for Konflux builds) #126
append .0 to go.mod version #117
OCPBUGS-54750: Fix for CVE-2024-51744 in github.com/golang-jwt/jwt/v4 in release-4.17 #113
Full changelog

prom-label-proxy

append .0 to go.mod version #381
Full changelog

prometheus

OCPBUGS-61766: chore: compute highestTimestamp at queryManager level #268
append .0 to go.mod version #258
OCPBUGS-56738: BACKPORT: fix promtool analyze block shows metric name with 0 cardinality #254
OCPBUGS-54941: Scraping: Bump cache iteration after error to avoid false duplicate detection. #249
Full changelog

prometheus-alertmanager

append .0 to go.mod version #102
Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

OCPBUGS-58408: Fix: One Alertmanager Config failing blocks all others. (#6585) #336
Full changelog

prometheus-node-exporter

append .0 to go.mod version #167
Full changelog

route-controller-manager

OCPBUGS-55943: Added error event for failed ingress to route conversion #60
OCPBUGS-53077: ingress: Reset metrics when ingress is deleted #57
Full changelog

service-ca-operator

append .0 to go.mod version #266
Full changelog

telemeter

ART-13124: Update go.mod to include patch version in go directive #562
Full changelog

tests

OCPBUGS-64927: update telemtery limit for 4.17 e2e case #30472
OCPBUGS-64641: Migrate OCP-32383 to upstream #30455
OCPBUGS-63392: Backport pr 29834 to release-4.18 #30408
OCPBUGS-61162: images/tests: Remove rteval #30202
NO-JIRA: Update extended/networking OWNERS #30090
OCPBUGS-57324: Fix bearer token exposure in exit condition as well #29910
OCPBUGS-57888: Bump to Kubernetes v1.30.14 #29983
OCPBUGS-50664: Replace RunHostCmd with Exec function to censor bearer token being exposed #29539
OCPBUGS-56221: aws/edge: prevent test using unschedulable nodes #29792
OCPBUGS-55451: support provider type external #29737
OCPBUGS-55269: Bump to Kubernetes v1.30.12 #29771
OCPBUGS-55498: [build] Ensure Git Clone Does Not Run Privileged #29743
OCPBUGS-54767: Fix egress firewall tests by updating the URL from docs.openshift.com to redhat.com #29660
Full changelog

thanos

append .0 to go.mod version #161
Full changelog

vsphere-cluster-api-controllers

OCPBUGS-61652: Fix unit tests #71
Full changelog

vsphere-problem-detector

OCPBUGS-61755: Check for number of FailureDomain-s in GetVCenter() #190
Full changelog

View changelog in Markdown or change previous release:

Source code for this page located on github