4.17.52

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.17.52-x86_64

Team Approvals:

Accepted
- QE

Tests:

Blocking jobs
- upgrade Succeeded periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
- upgrade-minor Succeeded periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
Informing jobs
- aws-ovn-serial Succeeded periodic-ci-openshift-release-main-nightly-4.17-e2e-aws-ovn-serial
- aws-ovn-upgrade-4.17-micro Succeeded periodic-ci-openshift-release-main-ci-4.17-e2e-aws-ovn-upgrade
- aws-ovn-upgrade-micro Succeeded periodic-ci-openshift-release-main-ci-4.17-e2e-aws-ovn-upgrade
- azure-ovn-upgrade-4.17-micro Failed (1 retry) periodic-ci-openshift-release-main-ci-4.17-e2e-azure-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Failed
- driver-toolkit Succeeded periodic-ci-openshift-release-main-nightly-4.17-e2e-aws-driver-toolkit
- fips-scan Succeeded periodic-ci-openshift-release-main-nightly-4.17-fips-payload-scan
- gcp-ovn-rt-upgrade-4.17-minor Succeeded periodic-ci-openshift-release-main-ci-4.17-upgrade-from-stable-4.16-e2e-gcp-ovn-rt-upgrade
- hypershift-ovn-conformance-4.17 Succeeded (1 retry) periodic-ci-openshift-hypershift-release-4.17-periodics-e2e-aws-ovn-conformance
  - Attempt 1 Failed
  - Attempt 2 Succeeded
- metal-ipi-ovn-bm Failed (1 retry) periodic-ci-openshift-release-main-nightly-4.17-e2e-metal-ipi-ovn-bm
  - Attempt 1 Failed
  - Attempt 2 Failed
- metal-ipi-ovn-ipv6 Succeeded periodic-ci-openshift-release-main-nightly-4.17-e2e-metal-ipi-ovn-ipv6

Upgrades from:

Untested upgrades: 4.16.11, 4.16.13, 4.16.14, 4.16.15, 4.16.16, 4.16.17, 4.16.18, 4.16.19, 4.16.20, 4.16.21, 4.16.23, 4.16.24, 4.16.25, 4.16.26, 4.16.27, 4.16.28, 4.16.30, 4.16.32, 4.16.33, 4.16.34, 4.16.35, 4.16.36, 4.16.37, 4.16.38, 4.16.39, 4.16.40, 4.16.42, 4.16.43, 4.16.44, 4.16.45, 4.16.46, 4.16.47, 4.16.48, 4.16.49, 4.16.50, 4.16.51, 4.16.52, 4.16.53, 4.16.54, 4.16.55, 4.16.56, 4.17.10, 4.17.11, 4.17.12, 4.17.13, 4.17.14, 4.17.15, 4.17.16, 4.17.17, 4.17.18, 4.17.19, 4.17.20, 4.17.21, 4.17.22, 4.17.23, 4.17.24, 4.17.25, 4.17.26, 4.17.27, 4.17.29, 4.17.3, 4.17.30, 4.17.31, 4.17.32, 4.17.33, 4.17.34, 4.17.35, 4.17.37, 4.17.38, 4.17.39, 4.17.4, 4.17.40, 4.17.41, 4.17.42, 4.17.43, 4.17.45, 4.17.46, 4.17.47, 4.17.48, 4.17.5, 4.17.6, 4.17.7, 4.17.8, 4.17.9

4.17.51 (changes) - S S F F S F
4.17.50 (changes) - Success
4.17.49 (changes) - Success
4.17.44 (changes) - Failed
4.17.36 - Success
4.17.28 (changes) - Success
4.17.2 (changes) - Success
4.17.1 (changes) - Success
4.17.0 (changes) - Success
4.16.59 (changes) - Success
4.16.58 (changes) - Success Failed
4.16.57 (changes) - Success
4.16.41 (changes) - Failed
4.16.29 (changes) - Failed
4.16.12 (changes) - Success
4.16.10 (changes) - Failed
4.16.9 (changes) - Success
4.16.8 (changes) - Failed
4.16.0-0.nightly-2026-03-25-212509 (changes) - Success

Loading changelog, this may take a while ...

Changes from 4.17.36

Created: 2026-03-26 16:26:07 +0000 UTC

Image Digest: sha256:51723b1449a55cd6489cd60689b42d4c53ceb6956765ff51087fa90f806ac65d

Components

Kubectl 1.30.5
Kubernetes 1.30.14
Kubernetes Tests 1.30.14
Red Hat Enterprise Linux CoreOS upgraded from 417.94.202507132309-0 to 417.94.202603242359-0 (diff)

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
StreamingCollectionEncodingToJSON (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
StreamingCollectionEncodingToProtobuf (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)

Rebuilt images without code change

apiserver-network-proxy git ea660559 sha256:d682c5746679d8dd8534b3d9c4b913880ef9d5713b7febaa3c7573fe7900b61b
aws-cloud-controller-manager git 144bace6 sha256:f1fc196ec3db364df254fda90a46e6b12bd50d50c01f2996f970ff8f9c1ea1f8
aws-ebs-csi-driver git 2bb5b316 sha256:8d89ffb1ab74d5e02fcc13d2a00d5e1fcca30720d987c140544e061ca7fc6629
aws-kms-encryption-provider git 9d401670 sha256:e6165bb623041db07759616b297f0541fcc87dc3bbb91cc77399cebe96c1b647
aws-pod-identity-webhook git 80efc4ea sha256:d2005b9ade6f74ee3df518d9f124b8acfa909d0dbd34c1c3b9e044c0556fb268
azure-cloud-controller-manager git 626ecd1c sha256:f673fdfb5f29159fce99cb0ce47a31fdae2f57533aa49b84228ec7fe03274aba
azure-cloud-node-manager git 626ecd1c sha256:54319cca65ce76d81bd7a392eb841bffc14867bdc1ae341bf8ee6f84d10c867d
azure-disk-csi-driver git a544f30b sha256:53babfe25e9258b6e8564df67e1d465c9f144976af5be7b30d95b0dd910f6101
azure-file-csi-driver git 9f4c38c2 sha256:4e01b88be4742c25c24977471d81262f8f0f391ccd5c49250b306e726e1d32e6
azure-kms-encryption-provider git 190a0fab sha256:b43e298d73fb723ce446344fac3e136b0d3347b38e7d199a09d2bfb85c231249
azure-workload-identity-webhook git 6707f899 sha256:3b7157d6c737fa70532d96c62fa68e35fe547eedc6c50580cb89f4ce9fff4fe8
baremetal-cluster-api-controllers git 41b34248 sha256:152e3c57d0bcd719bf1e20ef7d43ccadaf30939c8c9899a2ce115a55ad7be983
cluster-autoscaler-operator git ea4a8878 sha256:5f148616ca51bcf1c30183e095a8b5a981a9be858254938ed45229e4b4ebfdd1
cluster-bootstrap git 95dd9129 sha256:c84a3e6dfc4b3abe1c2f3e6f63018a8d45fa3333969ac2792dce86ed5dc5f7f6
cluster-capi-controllers git 77ef4fc5 sha256:1f379914cc47321de26756b1fd2fb634ab93f0d50400467df35dd4303100ad1a
cluster-capi-operator git a2cdab1b sha256:bbd338c6ca660031115a11f293b165aef23ad28150c6a8964dad403618cef28b
cluster-control-plane-machine-set-operator git f7e01c2f sha256:20dcf9ed5dab0354410b6c14f8476980d2bea66f42bd64ae0c1e354e185bd820
cluster-csi-snapshot-controller-operator git ffba005b sha256:c8ce750189b017ec94762b6691cb9a911f97f04927615f0c802149aa3f7282fa
cluster-dns-operator git 81507f04 sha256:9cfa1d58c7bc0f875b5b2d704afcc95c4321388c94202c7ecba217a12164e8c2
cluster-kube-cluster-api-operator git aed5f6c7 sha256:2a221eeae6e50cc04e9466e5777f829f58311b2506aa149094e5e31e0cbe6e09
cluster-machine-approver git acc2380e sha256:43a9f7284fc596378453b6e3a6fa1eb553d403ee25492c8c10107aaa77d92412
cluster-olm-operator git e31b7775 sha256:9865d9323ac25a120e3dbf34644b7343e650cd04b201d65518940b49432f564b
cluster-openshift-controller-manager-operator git b05a249d sha256:78d85dae433ada85e1fb57166d278887f652a03531326bce186c7d3b207df288
cluster-policy-controller git 7209e90d sha256:6717dfcf0c98ffe25190b97c977daafdfa53ca406572d81143430f4218a17382
configmap-reloader git 62d56d6a sha256:1d9d3b4b90eefd1714e4814e4c340d11a88f1208852b7c624fac4096ec3bae65
csi-driver-manila-operator git efc99a2a sha256:7e2fdd43861a1be04f8f6cdf2fe2651d1f7ad194d7a43326e8d65d7757ee3d7d
csi-driver-nfs git 79885550 sha256:cb11c30ff4bbdad9e25e12e2960d754cdfaa7af1507b07e74e21aa31a45b0390
csi-driver-shared-resource git 66aee5b0 sha256:dd74aefdaae0c24dca43a36548e371ce292af5423751718b1a6480224d5e5680
csi-driver-shared-resource-operator git c095a1f2 sha256:38f286396ef7e0557eff8cc665ca46c4248e2b060aa9b170873e13eb691b207b
csi-driver-shared-resource-webhook git 66aee5b0 sha256:6e201b3e5b45494f8ecd6d607bac314cc10b419d4f3a695c1aa9824b6eb9b8bc
csi-external-attacher git c3fe8e2e sha256:fac44a7144ca9e888a74db83f6eeda24224d05238af0f8cb54627b74148f51a9
csi-external-provisioner git fe460e56 sha256:29f0f10ec928c8face73cd03bad8478ab4b8386f0df20ee2482102f870f198c3
csi-livenessprobe git e7d841dc sha256:382ba71516ae6c2ce3670b92bb206e5bdaf5dd0519b2f1a6fcb417b99f0ccb13
driver-toolkit git 859518f6 sha256:07d09ce1d5c97a717dc1c0f540e21fbf7fc2ae0c27be6fd0869ce0dabc0591fc
egress-router-cni git 3193a756 sha256:2554ae05f488567b3c752c16c59f852ecfcb90746a47d48bdd39825aede43c21
etcd git 0d9e0a90 sha256:bc326e66fe857b4090cd0e717a9976857d63a5538890171adc420d47946b2c95
gcp-cloud-controller-manager git 8ce997d7 sha256:93f2305b36ca634a2b8fbbeb4bfdc1a5c868e791430d389f0e0326ca839920f7
gcp-machine-controllers git 86a1d902 sha256:aecbb57cc9a6d72de8520437e911255e51c97e4c40b55ef207fa98fa7c9dac9b
gcp-pd-csi-driver-operator git c23b064f sha256:87ef275495cae4c69268a6375eb5e07d9895913b019bf1a73dcc5043b3a24a30
gcp-workload-identity-federation-webhook git 08579e9f sha256:9f31f2da3caeba8ef97368c1ebdd3fb1df9aa911df241460d27fbecd2cfc9da8
haproxy-router git 1e29d8cc sha256:bb4b4fa70f8193a7cc49e278475052e1c053e1dca44298f02cf8a0c1bb95c740
ibm-cloud-controller-manager git ad8f7eb0 sha256:9beab497bfb41b47b9f8599920563efcb58961c2a8166225f1935f45657843b4
ibmcloud-machine-controllers git 0b8dd7ab sha256:1099ddf483c4cfe64f687fdbe5587648756fb5b9a3d01538724b2ea2fd5ca6e2
ironic-machine-os-downloader git 9e6596c3 sha256:16a4f25c37894fe7ce7a943322dee37d8419bae36e7c7ca7b4e73dbccf8372e8
ironic-static-ip-manager git bc5b8a2c sha256:3144944813148f5acd4234b279b5569e5bc8942f390c76a5a88789fda81afc56
keepalived-ipfailover git e3879e9e sha256:18b95158ab8c6470ea281f81f5f1dd2c0d1c198be78d3007b02f5a7937ade62d
kube-metrics-server git 07f8cd9e sha256:a95c36cb709d7f9fb89eb6aedcd7cebc104b90f8d9f1be6591981dc9f96af398
kube-rbac-proxy git f708b5ec sha256:e654a7604401da1deff9d8baedf0f7567831fe5f86f75e06fea3e5d140bb579e
kubevirt-csi-driver git 757a8894 sha256:6dde5ab62c9f5e35b853112e3c04a8c856ef9260318dad58352ae36c2d30bfb6
machine-os-images git f85666be sha256:64863687e7fde678af49d370c9fdd5045d47dc2c3b921b179dfe0b392aa4b447
multus-networkpolicy git 4d0b1703 sha256:55402c1e07f5de8bae74f8fc9a579c2403cd12e65f9b6714c4d6b57ed42b4250
multus-route-override-cni git 391c1b03 sha256:142d516609c278895aa3302ba638724fb63ecfcfd232e1fc6571f5856aa4e034
network-tools git e59e7b25 sha256:dbf382ce2e7158ff2483336643ede99b2a4fe4cc888af72e92e19ab864c62291
nutanix-cloud-controller-manager git c9f6cd1f sha256:83c6087954a19cc11c7042079ec3ca528c8a18678928c3ad9ed8b22ff07df36b
nutanix-machine-controllers git a4fadcbc sha256:209a01330e1894300123bfbcafc53948760feb80e0c7c81e521ea7abef269d69
olm-catalogd git c740e056 sha256:905e494751d1e26c98857f7ec4f41b4321344f9e86d710186d9e9bf410f6e983
olm-operator-controller git e245e661 sha256:e616c0d47555235cc1c7e275538b48fd10b842cd11c831a4dc719afe4dfc5092
openshift-state-metrics git adf64920 sha256:49f6f4761d886208cc262f1f8e23ddcc0c05d5b4566f6cdc8abcb1a328c8c5ce
openstack-cinder-csi-driver-operator git f89b6dbc sha256:4ed2d42fdc6e8fa9d3d08152849754d1827dd54ed86be4507d75f5c90bdde542
openstack-cluster-api-controllers git 5593c5f7 sha256:770cacd7e4e04a786a2e55a3cd9ec21048131c8eefb7baa4225e73a09f0f0901
ovirt-csi-driver git 1db726a9 sha256:f239cce00d46794f91479cfa3c94a2edd14e206f85e684131fe857a80215fe6c
powervs-block-csi-driver git aaa6afa9 sha256:20dc4b1b9ab504d4192bda76eace70933c264628c091ccb4ac78faf01104f356
powervs-block-csi-driver-operator git f6f037c5 sha256:195460691d14dc4f518717e3678a9ea780eb548fea8904c5bd4e2d554b81233c
powervs-cloud-controller-manager git bd3d72e5 sha256:32acad5511e808b1b3a80aa96458ed7f1800b4f19aebc9edc4f85ec3613b8ab7
prom-label-proxy git c84c4898 sha256:b0802c5220abce4c73b650e105e42d0c1a57c5248c4f55819e15053c59f2680a
prometheus-node-exporter git 8f095361 sha256:cdf9da2745d57ceb97761e08b560f2de7a212f860362eea3fd445fe4f6f7c769
rhel-coreos sha256:c9448a52542ca0db7aa3bd6871a687bb82d57ccc88ee6dee8b724f1652d8ff3f
rhel-coreos-extensions sha256:5799f4d297c3ef266f7a69533a3b74fe05bfee40b03ae6971ba079b602d4eac5
route-controller-manager git 02bbf80a sha256:b9cc7a6280455a8a36e26494744d9ba540689594f8a1d8f625cd1811eec2b0b4
telemeter git 0238640e sha256:ef89f2da22f7b0c0f445b7e700b29cdf9ce229cfd7866ac6c7bd2ec367db3bc4
thanos git 98c99371 sha256:a951a17fbd50a051cde6c2fc4e863bd70e29485fcb085c4d0c977a0bfdda5ea6
vsphere-csi-driver-operator git e1de36a2 sha256:b5291a1306ef132559dcf0405c4a15d2921133356d904aba886e2577030b1af2

agent-installer-api-server

MGMT-23439: Pin gotestsum to v1.12.2 for Go 1.20 compatibility #10016
And 2 elided commits (e.g. from squash or rebase merges)
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-58649: Bump glog pkg to 1.2.4 (#1182) #1182
Full changelog

agent-installer-node-agent

OCPBUGS-58654, OCPBUGS-58659: Bump glog to v1.2.5 in release-4.17 (#1070) #1070
Full changelog

agent-installer-utils

OCPBUGS-68141: bump github.com/sirupsen/logrus to v1.9.3 #238
Full changelog

aws-cluster-api-controllers

OCPBUGS-78175: [release-4.17] update go mod dependency for konflux #590
OCPBUGS-61940: UPSTREAM <carry>: revert: Only tag NetworkInterfaces in RunInstances if IAM Allows It #571
OCPBUGS-58669, OCPBUGS-58674: bump github.com/golang/glog to v1.2.5 #559
Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator

OCPBUGS-64704: Use 127.0.0.1 for healtz http-endpoints #462
OCPBUGS-63557: Add RBAC ClusterRole and Binding for driver node #453
OCPBUGS-62974: Add withCABundleDaemonSetHook() to AWS EFS operator #449
OCPBUGS-60597: Bump library-go to fix assignment to nil map issue #422
OCPBUGS-60470: Backport stale conditions fix #416
Full changelog

aws-machine-controllers

OCPBUGS-73822: Fix reconciler consistency checks in Update and Exists #167
OCPBUGS-63139: client: re-use a single file for building the session instead of randomly named files #145
Full changelog

azure-cluster-api-controllers

OCPBUGS-77983: [release-4.17] update go mod dependency for konflux #363
Full changelog

azure-machine-controllers

OCPBUGS-65954: Set updateDomainCount to one when faultDomainCount is one #176
OCPBUGS-63700: Support datadisks on Stack Hub #168
OCPBUGS-56168: [release-4.17] Update virtualmachines service to armcompute/v5 SDK #146
Full changelog

baremetal-installer, installer, installer-altinfra, installer-artifacts

OCPBUGS-67204: Update the RHCOS 4.17 bootimage metadata #10285
OCPBUGS-77791: [Release 4.17] pkg/asset/manifests/azure: save cidr blocks #10218
OCPBUGS-74677: [release-4.17] GCP: skip AI zones #10276
OCPBUGS-74555: Azure UPI ARM template: use storageAccountId #10264
OCPBUGS-68142: [4.17] uplift logrus #10167
OCPBUGS-53236: Validation for API and Ingress VIPs when using user-managed load balancer #10047
OCPBUGS-62951: Update the RHCOS 4.17 bootimage metadata #10021
OCPBUGS-62054: Make swift containers removal not fatal for UPI. #9952
OCPBUGS-54599: Update the RHCOS 4.17 bootimage metadata #9902
Full changelog

baremetal-machine-controllers

OCPBUGS-68143: [4.17] uplift logrus #239
Full changelog

baremetal-operator

OCPBUGS-77185: Unblock BMH direct deletion when detached annotation is present #462
Full changelog

baremetal-runtimecfg

OCPBUGS-71209: Bump logrus version #377
OCPBUGS-60112: Re-add ENABLE_NODEIP_DEBUG env var #363
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-64615: Help with must-gather scheduling through suggesting preferance of nodes #2150
OCPBUGS-56734: Adding sos.conf file for default sos config into the tools image #2027
Full changelog

cloud-credential-operator

OCPBUGS-65801: ccoctl azure: retry custom role creation on consistency errors #951
OCPBUGS-65480: ccoctl: use pagination when listing resources in aws #945
OCPBUGS-63549: ccoctl: add public-key-file flag to create-all #939
OCPBUGS-55128: snyk to ignore SNYK-GOLANG-GOLANGORGXNETHTML-9572088 #917
OCPBUGS-60972: ccoctl: aws to use proper issuer url on subsequent runs #908
OCPBUGS-58679: github.com/golang/glog v1.2.5 #892
Full changelog

cloud-network-config-controller

OCPBUGS-66132: [release-4.17] Fix capacity calculation #194
OCPBUGS-65520: Change the capacity struct from int to ptrOfInt #191
Full changelog

cluster-authentication-operator

OCPBUGS-68150: Update library-go to fix CVE-2025-65637 #840
Full changelog

cluster-autoscaler

OCPBUGS-68151: update logrus to version 1.9.3 #398
OCPBUGS-60913: revert openshift replica fix #376
OCPBUGS-60608: fix checkpoint gc of unknown recommenders #371
OCPBUGS-59266: Fix cool down status condition to trigger scale down #362
Full changelog

cluster-baremetal-operator

OCPBUGS-63715: Always have a service for ironic-api port #519
OCPBUGS-63666: Allow provisioningIP when network disabled #518
OCPBUGS-61097: Remove webhookport (9447) as HostPort #505
Full changelog

cluster-cloud-controller-manager-operator

OCPBUGS-63167: ccm: disable unused secure-serving port and webhook #423
OCPBUGS-60211: Update service selector to match deployment label #406
OCPBUGS-60211: Add Service using common resource templating #407
Full changelog

cluster-config-api

CNTRLPLANE-1981: Promote streaming list encoding to Default #2599
OCPBUGS-71184: Add HTTPKeepAliveTimeout to IngressController API #2639
NO-JIRA: Promote streaming list encoding to Default on Hypershift. #2567
CNTRLPLANE-1611: Add feature gates for StreamingCollectionEncoding #2538
Full changelog

cluster-config-operator

OCPBUGS-75998: Update logrus to 1.9.3 to address CVE-2025-65637 #465
Full changelog

cluster-etcd-operator

OCPBUGS-68156: Update logrus to 1.9.3 to address CVE-2025-65637 #1542
OCPBUGS-61337: Vendor latest mixin, including additional and modified alerts for etcdDatabaseQuotaLowSpace #1480
OCPBUGS-60220: add missing ports to svc and pod spec #1461
Full changelog

cluster-image-registry-operator

OCPBUGS-68157: Bump github.com/sirupsen/logrus to 1.9.3 #1284
Full changelog

cluster-ingress-operator

OCPBUGS-71184: Implement HTTPKeepAliveTimeout tuning option #1335
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-68162: CVE-2025-65637 openshift4/ose-cluster-kube-apiserver-rhel9-operator: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload [openshift-4.17] #2055
OCPBUGS-63614: SCC: add hostmount-anyuid-v2 #1954
OCPBUGS-60398: Add missing service ports to apiserver service #1893
Full changelog

cluster-kube-controller-manager-operator

OCPBUGS-68164: CVE-2025-65637 openshift4/ose-cluster-kube-controller-manager-rhel9-operator: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload [openshift-4.17] #908
OCPBUGS-60249: Missing endpoint slices for open ports the operator uses #855
Full changelog

cluster-kube-scheduler-operator

CNTRLPLANE-2843: chore: update OWNERS #623
OCPBUGS-68165: deps: Update library-go and logrus to fix a CVE #613
Full changelog

cluster-kube-storage-version-migrator-operator

OCPBUGS-68167: Bump github.com/sirupsen/logrus to 1.9.1 #140
Full changelog

cluster-monitoring-operator

OCPBUGS-77275: AlertingRule: fix duplicate PrometheusRules after MD5->SHA-224 naming change #2832
OCPBUGS-64580: Fix KSM deny-list typo #2732
OCPBUGS-63489: Add mcd_local_unsupported_packages metric from MCO to telemetry 4.17 #2725
OCPBUGS-63123: test: remove image registry e2e tests #2715
OCPBUGS-61766: chore(jsonnet): use prometheus_remote_storage_queue_highest_timestamp_seconds in PrometheusRemoteWriteBehind #2672
OCPBUGS-60017: operator: increase wait time till degraded to max 4 times 5m #2634
Full changelog

cluster-network-operator

OCPBUGS-73799: Tweak iptables-alerter to try to avoid crictl bug #2878
: NO-JIRA: Update CNO reviewers/approvers #2767
OCPBUGS-74348: [release-4.17] fix typo in release annotation for whereabouts-token-watcher deamonset #2888
OCPBUGS-45086: Re-disable metrics server #2579
OCPBUGS-63154: Add drop flows for GARPs #2818
[Release 4.17] OCPBUGS-61765: Update CNO reviewers/approvers #2799
OCPBUGS-58066: [release-4.17]: Manual feature backport of cert rotation for whereabouts #2784
Full changelog

cluster-node-tuning-operator

OCPBUGS-78214: PPC: filter out namespaces dir #1481
OCPBUGS-63504: Do not cause kubelet failed dependency by ocp-tuned-one-shot.service #1418
Full changelog

cluster-openshift-apiserver-operator

OCPBUGS-68170: CVE-2025-65637 - Update library-go to bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.17] #653
Full changelog

cluster-samples-operator

OCPBUGS-63515: references to github.com/sclorg/django-ex.git now also refer to the branch #658
Full changelog

cluster-storage-operator

OCPBUGS-41160: Move metrics to vsphere driver #633
Full changelog

cluster-update-keys

NO-ISSUE: Updating ose-cluster-update-keys-container image to be consistent with ART for 4.17 #79
Full changelog

cluster-version-operator

OCPBUGS-58451: Failing=Unknown upon long CO updating #1212
Full changelog

console

CONSOLE-5011: migrate to yarn berry #16074
NO-JIRA: Bump builder image to v29 #15994
OCPBUGS-74452: Bump lodash to latest #15966
OCPBUGS-69403: Disallowed Pipelines-plugin Pipelines navigation section #15849
OCPBUGS-65933: Preserve URL in perspective switch + remove dev console folks from reviewers #15762
OCPBUGS-64942: Expose prometheus tenancy label path as a proxy #15710
OCPBUGS-64599: Remove required flag from ‘console.flag/model’ pipelines-plugin extension #15665
OCPBUGS-62631: /auth/error?error=missing_state&error_type=auth is showing blank page #15554
OCPBUGS-63212: switch to dev perspective for /dev-monitoring #15614
OCPBUGS-63397: fix bug where Roles list was displaying invalid data f… #15627
OCPBUGS-62282: Fix desync of console and variable namespace #15545
OCPBUGS-44154: bump dompurify to latest #15590
OCPBUGS-61737: Remove ancient X-XSS-Protection header #15494
OCPBUGS-54241: VolumeSnapshots are not displayed in OpenShift Web Console #15465
OCPBUGS-59747: OpenShift console PVC clone cannot use B as the unit #15324
NO-JIRA: Increase the timeout on the cypress test #15420
OCPBUGS-58365: change ‘/metrics/usage’ endpoint to ‘/api/metrics/usage’ #15271
OCPBUGS-59544: Secret key with binary file changes when edited via Console #15301
OCPBUGS-59784: Update the golang.org/x/crypto/ssh to 0.31.0 in the openshift-console image #15329
OCPBUGS-58337: Tolerate unknown fields in Infrastructur… #15236
OCPBUGS-59492: Cannot read properties of undefined (reading ‘node-role.kubernetes.io/master’) error while accessing node logs from console #15294
OCPBUGS-59879: add data-test attrs to console plugins … #15338
OCPBUGS-59510: Not able to launch terminal window from OCP web console due to console plugin conflicts #15297
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

console-operator

OCPBUGS-77862: update go mod dependency for konflux #1114
OCPBUGS-60298: Update downloads deployment configuration to use master node selector #1033
Full changelog

container-networking-plugins, containernetworking-plugins-microshift

OCPBUGS-68135: Bump logrus to v1.9.1 #224
Full changelog

coredns

OCPBUGS-62825: UPSTREAM: 7083 and 6836: Fix failing TestZoneExternalCNAMELookupWithProxy #155
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-68209: fix CVE-2025-65637 #357
Full changelog

csi-external-resizer

OCPBUGS-62466: Requeue PVC over PV creation #175
Full changelog

csi-external-snapshotter, csi-snapshot-controller, csi-snapshot-validation-webhook

OCPBUGS-60449: UPSTREAM: 1238: Snapshot Controller startup should not LIST all volumesnapshots #184
Full changelog

csi-node-driver-registrar

OCPBUGS-63682: update log level verbosity to not clutter logs #90
Full changelog

docker-builder

OCPBUGS-66988: bump buildah to 1.37.7 to fix CVE-2025-52881 #499
OCPBUGS-65816: BuildConfig inline Dockerfile fails with heredoc syntax #488
Full changelog

docker-registry

OCPBUGS-68182: update logrus to v1.9.1 #465
OCPBUGS-60090: bump docker distribution to fix purgeuploads panic #440
Full changelog

gcp-cluster-api-controllers

OCPBUGS-78279: [release-4.17] update go mod dependency for konflux #266
Full changelog

gcp-pd-csi-driver

OCPBUGS-68186: Update logrus to 1.9.3 #90
Full changelog

hyperkube, pod

OCPBUGS-68132, OCPBUGS-68190: CVE-2025-65637 - bump github.com/sirupsen/logrus to v1.9.3 #2573
OCPBUGS-72531: Skip E2e: attach on previously attached volumes should work #2566
OCPBUGS-65695: Fix Concurrentmap Iteration #2520
OCPBUGS-63460: UPSTREAM: <carry>: backporting fix for concurrent map iteration and write #2456 #2496
CNTRLPLANE-1611: Backport StreamingCollectionEncoding for JSON and protobuf #2486
OCPBUGS-61584: UPSTREAM: <carry>: Don’t retry storage calls with side effects. #2458
OCPBUGS-60552: [4.17] podresources: list: use active pods #2426
4.17: OCPBUGS-60998: scheduler: Improve CSILimits plugin accuracy by using VolumeAttachments #2434
Full changelog

hypershift

OCPBUGS-76533: feat(updates): enable CVO metrics access with RHOBS monitoring flag #7703
OCPBUGS-74230, OCPBUGS-74294: [release-4.17] Support proxy authentication when user/pass is included in URL #7568
fix: OCPBUGS-72956: Fix Konflux EC voilation, update deprecated base … #7457
OCPBUGS-69865: test: remove unit tests that depend on network communication [release-4.17] #7411
OCPBUGS-57123: Add support for registry root entry only in the IDMS/ICSP #6230
CNTRLPLANE-1903: Migrate 4.17 pipelines to use common pipeline #7215
OCPBUGS-63639: [release-4.17] fix(konnectivity): resolve circular dependency causing DNS timeouts and excessive retries #7112
OCPBUGS-64604: Update DNS names for ovn-kubernetes cp metrics #7150
OCPBUGS-63370: fix: Make the hypershift CLI binary FIPS-compliant #7094
CNTRLPLANE-1425: feat(konflux): tag MCE HO images with latest #6838
OCPBUGS-57143: [release-4.17] HCP payload doesn’t respect multiple mirrors #6771
OCPBUGS-61290: Update KCM node monitor grace period #6760
OCPBUGS-61208: use common MCE konflux pipeline #6749
OCPBUGS-60149: [release-4.17] Always compress and encode payload in token secret for inplace upgrades #6740
OCPBUGS-61101: Use system trust bundle in CPO IDP https client #6735
OCPBUGS-60921: konflux for hcp-cli #6699
CNTRLPLANE-1204: HO MCE change to hermetic ta build #6653
CNTRLPLANE-1230: Move CPO pipeline to hermetic builds #6598
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-77209: [release-4.17] standardize build paths #123
OCPBUGS-58740: bump github.com/golang/glog to version v1.2.4 #105
Full changelog

ibm-vpc-block-csi-driver-operator

OCPBUGS-58435: [IBM VPC] set offlineExpansion to false in e2e test manifest #146
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-67287: [release-4.17] Fix incomplete vendor/ #139
OCPBUGS-51823: CVE-2025-22869 Update golang.org/x/crypto to patched OpenShift fork #121
Full changelog

insights-operator

OCPBUGS-68193: OCPBUGS-68194: [vuln] Update logrus library to 1.9.3 #1227
OCPBUGS-67008: Add filtering to add other possible pod status to QEMU gatherer #1196
OCPBUGS-66395: QEMU logs are not gathered if there are pending status virt-launcher pods #1194
OCPBUGS-66394: [bugfix] The archive’s records may include files whose names are out of bounds #1193
OCPBUGS-64629: add permissions to gather clusterrole #1170
OCPBUGS-63500: add missing permissions for replicasets and events #1165
And 4 elided commits (e.g. from squash or rebase merges)
Full changelog

ironic

OCPBUGS-74114: Bump keystonemiddleware version to 10.7.1-0.20260216144200.4c001ba for CVE-2026-22797 fix #796
OCPBUGS-69792: Bump eventlet version to 0.33.1-7 #761
Full changelog

ironic-agent

OCPBUGS-69775: Bump eventlet version to 0.33.1-7 #231
OCPBUGS-62490: netutils: Use ethtool ioctl to get permanent mac address #214
Full changelog

kube-proxy

OCPBUGS-68165: deps: Update library-go to fix a CVE #661
Full changelog

kube-state-metrics

OCPBUGS-74874: Deduplicate CRS stores #132
Full changelog

kube-storage-version-migrator

NO-JIRA: Add DOWNSTREAM_OWNERS (release 4-17). #226
Full changelog

kubevirt-cloud-controller-manager

OCPBUGS-34447: Updating ose-kubevirt-cloud-controller-manager-container image to be consistent with ART for 4.17 #44
Full changelog

libvirt-machine-controllers

OCPBUGS-77195: Fix incomplete vendor/ #301
Full changelog

machine-api-operator

OCPBUGS-79373: [release-4.17] Use resource group when generating default Azure image #1481
Full changelog

machine-config-operator

OCPBUGS-74149: enable nodeip-configuration for platform external #5577
OCPBUGS-77979: hermetic 4.17 #5733
OCPBUGS-77889: reduce MCO image size #5746
OCPBUGS-77812: mcd_config_drift not working properly #5741
OCPBUGS-77422: Remove MCD liveness probe #5709
OCPBUGS-77242: After OCL is enabled few phases in MCN are not updating as expected #5575
OCPBUGS-77186: Machine-config controller should not log about non-existent pull-secret changes #5679
OCPBUGS-77090: machine-config-daemon: openshift: Exposure of Sensitive Data in Log Files in the Machine Configuration Daemon. [openshift-4] #5678
OCPBUGS-61190: MCO report “failed to list *v1alpha1.MachineOSConfig” when enable TechPreview after upgrading from 4.16 to 4.17 with one mcp paused #5584
OCPBUGS-60112: Enable debug logging for nodeip-configuration #5219
OCPBUGS-62170: Fix - NetworkManager restart or crash renders br-ex unusable #5355
OCPBUGS-66037: Remove –mount directives #5443
OCPBUGS-63154: [release-4.17] Networking: reset ovn-remote config and allow ovnkube controller to set it #5358
OCPBUGS-63540: Add control-plane label for master nodes on legacy clusters #5375
OCPBUGS-63364: Invalid architecture value found in annotation during 4.19 update #5368
OCPBUGS-63055: Recheck generatedByControllerVersion annotation prior to deleting a degraded MC #5346
OCPBUGS-62741: Add /etc/docker/certs.d to template #5335
OCPBUGS-62683: Add mcd_local_unsupported_packages recording rule #5327
OCPBUGS-60890: Race in configure-ovs.sh affects bonding interface configuration. #5267
OCPBUGS-61859: Override NMState service definition #5289
OCPBUGS-59930, OPNET-681: Support migration to NMState #5206
OCPBUGS-56752: Support NODEIP_HINT in IPI deployments too #5080
OCPBUGS-60704: operator: switch out VAP v1beta1 to v1 #5256
OCPBUGS-57084: scope MCD node listers to current node #5107
OCPBUGS-60239: Add workaround fix for static pod race #5231
Full changelog

machine-image-customization-controller

OCPBUGS-68192: [4.17] Uplift logrus #152
Full changelog

metallb-frr

OCPBUGS-76548: Dockerfile: unpin FRR rpm #124
Full changelog

monitoring-plugin

OCPBUGS-76809: fix for CVE-2025-69873 #848
OCPBUGS-70290: Manual cherry pick qs vulnerability 4 17 #747
OCPBUGS-64942: Use tenancy access to metric lables #639
OU-1058: Don’t show TP button in non-administrator #637
OCPBUGS-62282: align dev and admin persective tab names #602
OCPBUGS-62282: add missing translation string #587
OCPBUGS-61891: feat: add alerting rules tab to dev console #538
OCPBUGS-59399: Fix “Export as CSV” #468
Full changelog

multus-admission-controller

OCPBUGS-58770: Update the github.com/golang/glog module to v1.2.4 #102
Full changelog

multus-cni, multus-cni-microshift

OCPBUGS-77854: hermetic 4.17 #277
OCPBUGS-43391: Update net-attach-def client library to 1.7.5 for cri-o functionality [backport 4.17] #257
Full changelog

multus-whereabouts-ipam-cni

OCPBUGS-73728: Update tag on ci-operator.yaml file #395
OCPBUGS-70256: Prevent accidental IP deallocation in statefulsets #393
Full changelog

must-gather

OCPBUGS-60607: Separate resources with comma to fix malformed inspect #504
Full changelog

network-interface-bond-cni

OCPBUGS-59620: Bump github.com/containernetworking/plugins from to 1.7.1 #83
NO-JIRA: Add ci-operator file #82
Full changelog

network-metrics-daemon

OCPBUGS-58780: Bump github.com/golang/glog to v1.2.4 (#112) #112
OCPBUGS-60177: Replace e2e test image (#121) #121
Full changelog

networking-console-plugin

CNV-76277: Fix name generator with unprofessional names #320
OCPBUGS-60180: Fix ingress details #265
OCPBUGS-60128: Fix requiremenets with no value #260
Full changelog

oauth-apiserver

OCPBUGS-66228: UPSTREAM <carry>: bump kubernetes-apiserver to pick up loopback certificate expiration update #157
NO-JIRA: (chore): update OWNERS file #171
OCPBUGS-61584: Bump openshift/kubernetes-apiserver for etcd retry patches. #143
Full changelog

oauth-proxy

OCPBUGS-61445: Update x/crypto to v0.31.0 #334
Full changelog

oauth-server

OCPBUGS-61584: Bump openshift/kubernetes-apiserver for etcd retry patches. #198
Full changelog

oc-mirror

Adding r4f4 and Prashanth684 as approvers and removing contributors who are not working with oc-mirror anymore. (#1269) #1269
Full changelog

openshift-apiserver

OCPBUGS-68208: CVE-2025-65637 - Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.17] #609
OCPBUGS-74143: pkg/image: conditionally parse raw image manifest #596
OCPBUGS-66229: UPSTREAM <carry>: bump kubernetes-apiserver to pick up loopback certificate expiration update #584
OCPBUGS-63392: Wire dry run option to Image API server operations #565
OCPBUGS-61584: Bump openshift/kubernetes-apiserver for etcd retry patches. #554
OCPBUGS-53382: Skip blocked registry check for registries with mirrors #500
OCPBUGS-58821: Fix image reference in TestImageStreamImportQuayIO #515
Full changelog

openshift-controller-manager

OCPBUGS-61199: legacy image pull secret rollback controller #413
Full changelog

openstack-machine-api-provider

OCPBUGS-78169: hermetic 4.17 #162
OCPBUGS-76793: Fix make test #160
Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

OCPBUGS-77838: Remove the collect-profiles info from the microshift kustomization file #1250
OCPBUGS-76953: Remove the collect-profiles job #1232
OCPBUGS-67301: Fix TOCTOU race condition in ensureInstallPlan (#3682) #1172
OCPBUGS-57092: [release-4.17] e2e stability fixes #1081
OCPBUGS-60791: Add NetworkPolicy as a supported kind #1058
OCPBUGS-57428: reduce cache expiry frequency [release-4.19] #1021
OCPBUGS-59253: Reduce Frequency of Update Requests for Copied CSVs (#3597) #1036
Full changelog

operator-marketplace

OCPBUGS-68212, OCPBUGS-68213: [release-4.17] CVE-2025-65637 fixed in logrus v1.9.3+ #710
OCPBUGS-62219: Remove Expect func so that the test case can use the retry logic #670
OCPBUGS-61036: Update memoryTarget on catalog source pods #663
Full changelog

ovirt-csi-driver-operator

OCPBUGS-68230: Bump github.com/sirupsen/logrus to v1.8.3 #151
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-77568: Clear stale conntrack UDP entries for nodePorts #3035
CORENET-6055, OCPBUGS-74492: [release-4.17] Dockerfile: Unpin OVN and consume the latest from FDP #2959
[release:4.17] OCPBUGS-71985: Fix conntrack reconciliation to use service port instead of endpoint port #2936
OCPBUGS-71218: [release-4.17] CVE-2025-65637 Bump github.com/sirupsen/logrus to v1.9.1 through indirect dependency conversion (go-controller module) #2905
OCPBUGS-71198: NetPol & MultiNetPol: Process update only when spec fields and/or related annotation are updated #2923
OCPBUGS-68348: Add ricky-rav to OWNERS for release-4.17 #2898
OCPBUGS-65928: Skip Pending pods in EgressIP status #2871
OCPBUGS-65569: [release-4.17]: kubevirt: fix bad release of IPs of live migratable pods #2857
OCPBUGS-64856: Fix stale EIP assignments during failover and controller restart #2850
OCPBUGS-64674: [release-4.17]: Configure sec nic EIPv6 address with NODAD and maximum lifetime #2843
OCPBUGS-63154: Fix EgressIP stale GARP post reboot + pod restart #2807
OCPBUGS-61749: [release-4.17] Fix dnsnameresolver address set #2796
OCPBUGS-60484: Update OWNERS file: Add Patryk/Martin as approvers #2717
OCPBUGS-59381: [release-4.17] Fix default network -> localnet #2667
Full changelog

powervs-machine-controllers

OCPBUGS-61204: Use OS_GIT_VERSION in Makefile when found (for Konflux builds) #126
Full changelog

prometheus

OCPBUGS-61766: chore: compute highestTimestamp at queryManager level #268
Full changelog

prometheus-alertmanager

OCPBUGS-75885: Include go-verify-deps expected files in gitignore #115
Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

OCPBUGS-77452: Validate webhookURL secret for MSTeams receiver in AlertmanagerConfig CRD #369
OCPBUGS-58408: Fix: One Alertmanager Config failing blocks all others. (#6585) #336
Full changelog

service-ca-operator

OCPBUGS-68220: Update logrus to 1.9.3 to address CVE-2025-65637 #316
Fix for OCPBUGS-68221: CVE-2025-65637 bump github.com/sirupsen/logrus to v1.9.3 #309
Full changelog

tests

OCPBUGS-65492: Add imagestream update dryrun test #30479
OCPBUGS-64927: update telemtery limit for 4.17 e2e case #30472
OCPBUGS-64641: Migrate OCP-32383 to upstream #30455
OCPBUGS-63392: Backport pr 29834 to release-4.18 #30408
OCPBUGS-61162: images/tests: Remove rteval #30202
NO-JIRA: Update extended/networking OWNERS #30090
OCPBUGS-57324: Fix bearer token exposure in exit condition as well #29910
Full changelog

vsphere-cloud-controller-manager

OCPBUGS-78027: hermetic migration 4.17 #106
Full changelog

vsphere-cluster-api-controllers

OCPBUGS-78019: hermetic migration 4.17 #85
OCPBUGS-61652: Fix unit tests #71
Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

OCPBUGS-68224: CVE-2025-65637: Bump github.com/sirupsen/logrus to v1.8.3 #157
Full changelog

vsphere-problem-detector

OCPBUGS-61755: Check for number of FailureDomain-s in GetVCenter() #190
Full changelog

View changelog in Markdown or change previous release:

Source code for this page located on github