4.17.54

Manual Override Applied

This release was manually Accepted.

Reason: Manually accepted by ART

Download the installer for your operating system or run

oc adm release extract --tools registry.ci.openshift.org/ocp/release:4.17.54

Qualifiers (status api):

Tests:

Blocking jobs
- upgrade Failed (2 retries) periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
- upgrade-minor Failed (2 retries) periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
Informing jobs
- aws-ovn-serial Failed (1 retry) periodic-ci-openshift-release-main-nightly-4.17-e2e-aws-ovn-serial
  - Attempt 1 Failed
  - Attempt 2 Failed
- aws-ovn-upgrade-4.17-micro Failed (1 retry) periodic-ci-openshift-release-main-ci-4.17-e2e-aws-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Failed
- aws-ovn-upgrade-micro Failed (1 retry) periodic-ci-openshift-release-main-ci-4.17-e2e-aws-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Failed
- azure-ovn-upgrade-4.17-micro Succeeded periodic-ci-openshift-release-main-ci-4.17-e2e-azure-ovn-upgrade
- driver-toolkit Succeeded periodic-ci-openshift-release-main-nightly-4.17-e2e-aws-driver-toolkit
- fips-scan Succeeded periodic-ci-openshift-release-main-nightly-4.17-fips-payload-scan
- gcp-ovn-rt-upgrade-4.17-minor Failed (1 retry) periodic-ci-openshift-release-main-ci-4.17-upgrade-from-stable-4.16-e2e-gcp-ovn-rt-upgrade
  - Attempt 1 Failed
  - Attempt 2 Failed
- metal-ipi-ovn-ipv6 Succeeded periodic-ci-openshift-release-main-nightly-4.17-e2e-metal-ipi-ovn-ipv6

Upgrades from:

Untested upgrades: 4.16.12, 4.16.13, 4.16.14, 4.16.15, 4.16.16, 4.16.17, 4.16.18, 4.16.19, 4.16.20, 4.16.21, 4.16.23, 4.16.24, 4.16.25, 4.16.26, 4.16.27, 4.16.28, 4.16.29, 4.16.30, 4.16.32, 4.16.33, 4.16.34, 4.16.35, 4.16.36, 4.16.37, 4.16.38, 4.16.39, 4.16.40, 4.16.41, 4.16.42, 4.16.43, 4.16.44, 4.16.45, 4.16.46, 4.16.47, 4.16.48, 4.16.50, 4.16.51, 4.16.52, 4.16.53, 4.16.55, 4.16.56, 4.16.57, 4.16.58, 4.16.59, 4.17.11, 4.17.12, 4.17.13, 4.17.14, 4.17.15, 4.17.16, 4.17.17, 4.17.18, 4.17.19, 4.17.20, 4.17.21, 4.17.22, 4.17.23, 4.17.24, 4.17.25, 4.17.26, 4.17.27, 4.17.28, 4.17.29, 4.17.3, 4.17.30, 4.17.31, 4.17.32, 4.17.33, 4.17.34, 4.17.36, 4.17.37, 4.17.38, 4.17.39, 4.17.4, 4.17.40, 4.17.41, 4.17.42, 4.17.43, 4.17.44, 4.17.45, 4.17.46, 4.17.48, 4.17.49, 4.17.5, 4.17.50, 4.17.6, 4.17.7, 4.17.8, 4.17.9

4.17.53 (changes) - F F F F S F F F F
4.17.52 (changes) - Success
4.17.51 (changes) - Failed
4.17.47 (changes) - Failed
4.17.35 - Failed
4.17.10 (changes) - Success
4.17.2 (changes) - Failed
4.17.1 (changes) - Success
4.17.0 (changes) - Failed
4.16.62 (changes) - F F F F F S F
4.16.61 (changes) - Success
4.16.60 (changes) - Failed
4.16.54 (changes) - Failed
4.16.49 (changes) - Failed
4.16.11 (changes) - Failed
4.16.10 (changes) - Failed
4.16.9 (changes) - Failed
4.16.8 (changes) - Failed
4.16.0-0.nightly-2026-05-14-021554 (changes) - Failed Failed

Upgrades to:

Loading changelog, this may take a while ...

Changes from 4.17.35

Created: 2026-05-14 20:12:36 +0000 UTC

Image Digest: sha256:09a398636aed764ab301bcfc26a2426b245960573b3dcf6df7773688f3b7f229

Components

Kubectl 1.30.5
Kubernetes upgraded from 1.30.12 to 1.30.14
Kubernetes Tests upgraded from 1.30.12 to 1.30.14
Red Hat Enterprise Linux CoreOS upgraded from 417.94.202507021305-0 to 417.94.202605112123-0 (diff)

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
StreamingCollectionEncodingToJSON (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
StreamingCollectionEncodingToProtobuf (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)

Rebuilt images without code change

apiserver-network-proxy git ea660559 sha256:5277e7c9d9d275c624187b28499ec3941785c67562778b3dfd5fde2be738354b
aws-cloud-controller-manager git 144bace6 sha256:181160b0932beba779935a00a23175a22ccc6f0651e28da35c8ecc46fce63014
aws-ebs-csi-driver git 2bb5b316 sha256:1a4d6ddf3f5129886318c200d1a04f12b79795590f1994c321346a799026db82
aws-kms-encryption-provider git 9d401670 sha256:4d3f29e853f08fc1340ce799cda18295a3d78a58c4be2c1b8521695061dacff4
aws-pod-identity-webhook git 80efc4ea sha256:46b27a9e384d0b4b0c977789b4fe6548773d4343ba67f366813936051d5a6e6d
azure-cloud-controller-manager git 626ecd1c sha256:1215d52821f415430302885fb4f6fc4508bd0eae773a4dda152758ae32ac4e0d
azure-cloud-node-manager git 626ecd1c sha256:3408ce3cda4e0fa466606332b6716ac0e23e187c29990567565733910db47447
azure-disk-csi-driver git a544f30b sha256:d47dda972789df4c6b8e5a874eed35a769db7331e0670bea9f35940799bf46b3
azure-file-csi-driver git 9f4c38c2 sha256:c6f3675dc14164d1e72ae6a9e9275bf2e3590f2532e76d1921a752b494e7de2c
azure-kms-encryption-provider git 190a0fab sha256:ff87ede8468d589c40c74be1612c4bdc6671449f67d0966bd7f6daba8189750f
azure-workload-identity-webhook git 6707f899 sha256:aac9d4fe266ba7848e81b23cf9789cdb3d4e8183bb36224ece0d114e83ccf633
baremetal-cluster-api-controllers git 41b34248 sha256:1ad46889633f74bf4e8d4e0e1a55338204ca5192f86a4478959babc8d90cc8c6
cluster-autoscaler-operator git ea4a8878 sha256:5070935c679a74476dab65ea05af19a3cf172cf95d97651426eb60153d66579f
cluster-bootstrap git 95dd9129 sha256:9004bf2bc1a6393f9fe869fc6e45db3bc7c7170df7576d22600a74400062f356
cluster-capi-controllers git 77ef4fc5 sha256:2f68a4ee720b3c0c539a1a37680ce6493832832e534fe3468032cd5afb545cc2
cluster-capi-operator git a2cdab1b sha256:15da3bf8df73f82cfc4027422dace04584e53d4adfc802a4397ddfd0668cf013
cluster-control-plane-machine-set-operator git f7e01c2f sha256:6eb66819333a23774893cbf1b19d01141b17d5f6099eadf3088a82086c4955aa
cluster-csi-snapshot-controller-operator git ffba005b sha256:a893e992fa6a7c3a0129fbfb692ee116addc4655e9733b2a95f4ad3eafe59674
cluster-dns-operator git 81507f04 sha256:dfdc6ea08cbfeb497cb82fc8275d762be0d15ba54b361aeeb24c98dfb7d9e44d
cluster-kube-cluster-api-operator git aed5f6c7 sha256:28e2f2d7928ce5b046a92c6ef61a3ceac15c090698aa70824f17367b4995a848
cluster-machine-approver git acc2380e sha256:a0a3cb7782c81c69ccb93524192795e371c94a046b4342423c8d08669782811e
cluster-olm-operator git e31b7775 sha256:43845c844be41d3d3f3c104f1865395e8ea046437cac80ef7b8b30dafc9e8b64
cluster-openshift-controller-manager-operator git b05a249d sha256:9b39e84939ad86e68870cc96ef39d17a87017ab7f31608cd1ca0b168734fa018
cluster-policy-controller git 7209e90d sha256:2c9b871a17597b35c7d5d2290fb2008db7e51fe0f20ff72e1271eb0af776f374
configmap-reloader git 62d56d6a sha256:fec852aca11830fd68c82b3d369e46d3b70f4acf84f3946681db8776461b8063
csi-driver-manila-operator git efc99a2a sha256:eed9be8feeeb3368503d1891c90914fbf1e07dce92213b947dcc50567215fcd2
csi-driver-shared-resource git 66aee5b0 sha256:46a4b1c94f5990d67a680112ae13bcc185231c57494f856d37ccc300a29d2a02
csi-driver-shared-resource-operator git c095a1f2 sha256:34d8ba5d9c6cb10661ff45bb1e82b9d89344c8c1e4650e6329b2cded1e733cd7
csi-driver-shared-resource-webhook git 66aee5b0 sha256:ef9fd3a377742692f0d18fa1d2999dd6373efb1bd98626e5504d3a178d9e4c77
csi-external-attacher git c3fe8e2e sha256:c053de17e1204089722cc23a1e3a956be732328b8f655fc021e108fe56f9ad7f
csi-external-provisioner git fe460e56 sha256:434be658255c9cfafa7490cc81076b0468feaffcfc5d19b66ccd1c674a8e47ce
csi-livenessprobe git e7d841dc sha256:9f38160f3895ec2ac62290493b84b2a23688e82bfa4e6d48d28158fbd75cd536
driver-toolkit git 859518f6 sha256:6486e6a9e19fcd36b9cc80eefa4efcf6b5bf8211240d7afe3eac9150c962b2ea
egress-router-cni git 3193a756 sha256:bedc147a57bd75f377d2d51912a04e790c9a6c2cb101199301b391f0d1d0cf2e
etcd git 0d9e0a90 sha256:11fc7381f365acfdf862c3a27a950c58ff943ebb904bc2cdad1288fb68eec03f
gcp-cloud-controller-manager git 8ce997d7 sha256:72d4c2f73bc217307679e8b1b9a8139d794a4f5fe0b17acbd526b14d37c38170
gcp-machine-controllers git 86a1d902 sha256:47152072a9e23639811fdf8233200e4c8f52075d5c549aa2d1a53cc133b7681f
gcp-pd-csi-driver-operator git c23b064f sha256:f1171f06c862af6a45fbfd5603cc262244352a09bde61d07cb4b95cf5c079b5c
gcp-workload-identity-federation-webhook git 08579e9f sha256:a10fee08874059b65871c21ada2f2fef0acb64d63f06bc71950ad35c1291e5d2
haproxy-router git 1e29d8cc sha256:98148a6bf8f6cbea062e4bd0704898717bfdac9dd8db28782426852f4095d445
ibm-cloud-controller-manager git ad8f7eb0 sha256:ded0ed52fb7aedf51850cca44199cc5c54bf4fef80fb5e7b54b37820462ed82c
ironic-machine-os-downloader git 9e6596c3 sha256:f09224bc6afff7588cdf041e4872a276da5f349956177489fe8f1fde5a32a17c
ironic-static-ip-manager git bc5b8a2c sha256:0c8c145160906e2089cb904ee016313ca7fb98e094353f53bffe578b895e2172
keepalived-ipfailover git e3879e9e sha256:46aa8b2bbb3f3fc6a0ad17a000a4f069bb10b362f42f55924ee5a5ba5bb2f2ef
kube-rbac-proxy git f708b5ec sha256:0185c66b6ff250fddb837d5bcafcd87f089012e9157254d356f72a2620327eab
kubevirt-csi-driver git 757a8894 sha256:d3869a2ae60fbcffa86865a469a6d5045de627ed6a3b9c34f90ca59b2e262238
machine-os-images git f85666be sha256:969ba438d7eae68e1da5411b9d1e6ddba01b05fe6eae036be0664ffd9d627ddd
multus-networkpolicy git 4d0b1703 sha256:525b84c76d7ac17de43da7a00a06b770ff463a45e271f55f74e46f2265030aff
multus-route-override-cni git 391c1b03 sha256:29da7ed5a73b53e7816c99bcbae141f3fefbdd7392150d1203b5eed90e37c076
network-tools git e59e7b25 sha256:43980ad4a09b09ecf71ca87da45bc0f6b61c2da7e5b163ae6e3286b9764622de
nutanix-cloud-controller-manager git c9f6cd1f sha256:cadbe21e4e79a272f8e019a7977640a00c881a414161e7a8f5c8d7f183e3ab60
nutanix-machine-controllers git a4fadcbc sha256:015e6164b903e2b2b64ba12c973b38478f14e5c0440217ccf83bac5a7b6e2065
olm-catalogd git c740e056 sha256:5999c0f327a721beddb9f601fa4dcc207ba9e70120f4597154f44781a1355fbd
olm-operator-controller git e245e661 sha256:28f9176a0e90c814cbfeabd83005b441647bced5b8872c08239617b9e43eedce
openshift-state-metrics git adf64920 sha256:1706a2a85fe016707701bbedfd0f10a248e2b95f8f00d44027f812be5f7bec4f
openstack-cinder-csi-driver-operator git f89b6dbc sha256:cf50977b01dd9f0e864b89efdb68ebb9186461b526e1379c57ad728f655f6d9f
openstack-cluster-api-controllers git 5593c5f7 sha256:9e9d8847933e69b1da8c8a774c8d174595d5474fb6b6e50e99cab36ec0b953f8
ovirt-csi-driver git 1db726a9 sha256:e1c182b110c42636d9b711ee4110fc0c16023209438b2d21dcb98d0378dbfa83
powervs-cloud-controller-manager git bd3d72e5 sha256:ae48c76fe3a979d4db7ecaf9ce6ffd2bc62a0c5092b94b9723f1561e0535209d
prom-label-proxy git c84c4898 sha256:24b64b3f748f62713d4927aec1af4bafbdd59937bcde472298ec7ffff6f8978c
prometheus-node-exporter git 8f095361 sha256:968944a7b2240650dbaa82a6dbe62ec3a84cbe96298f334a168c7fb676bef42f
rhel-coreos sha256:ac363020d048a66fb5215278a3f443827ee7cede921ba457816d4d156c0d5758
rhel-coreos-extensions sha256:16816e1e8e33a98e76d972d771c7f0209ec1d9bee5717b37ad4dadfd740d0425
route-controller-manager git 02bbf80a sha256:eac2d5b45f67a882433997bdfa773b00b77d86da3a504cbda1d914ea627a9ec3
thanos git 98c99371 sha256:69bf2dd04ddbf6ce730db0ce43e7156c54883dcd7c2ea28c11c2c744a597f15c
vsphere-csi-driver-operator git e1de36a2 sha256:bc2021e42bb66854aab143ba653a27892c0e5ec1f76b8859592b57e9b040bb9c

agent-installer-api-server

MGMT-23439: Pin gotestsum to v1.12.2 for Go 1.20 compatibility #10016
And 3 elided commits (e.g. from squash or rebase merges)
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-58649: Bump glog pkg to 1.2.4 (#1182) #1182
Updating ose-agent-installer-csr-approver-container image to be consistent with ART for 4.17 (#1088) #1088
Full changelog

agent-installer-node-agent

OCPBUGS-58654, OCPBUGS-58659: Bump glog to v1.2.5 in release-4.17 (#1070) #1070
Full changelog

agent-installer-utils

OCPBUGS-68141: bump github.com/sirupsen/logrus to v1.9.3 #238
Full changelog

aws-cluster-api-controllers

OCPBUGS-78175: [release-4.17] update go mod dependency for konflux #590
OCPBUGS-61940: UPSTREAM <carry>: revert: Only tag NetworkInterfaces in RunInstances if IAM Allows It #571
OCPBUGS-58669, OCPBUGS-58674: bump github.com/golang/glog to v1.2.5 #559
Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator

OCPBUGS-80133: Bump google.golang.org/grpc #543
OCPBUGS-64704: Use 127.0.0.1 for healtz http-endpoints #462
OCPBUGS-63557: Add RBAC ClusterRole and Binding for driver node #453
OCPBUGS-62974: Add withCABundleDaemonSetHook() to AWS EFS operator #449
OCPBUGS-60597: Bump library-go to fix assignment to nil map issue #422
OCPBUGS-60470: Backport stale conditions fix #416
Full changelog

aws-machine-controllers

OCPBUGS-73822: Fix reconciler consistency checks in Update and Exists #167
OCPBUGS-63139: client: re-use a single file for building the session instead of randomly named files #145
Full changelog

azure-cluster-api-controllers

OCPBUGS-77983: [release-4.17] update go mod dependency for konflux #363
Full changelog

azure-machine-controllers

OCPBUGS-65954: Set updateDomainCount to one when faultDomainCount is one #176
OCPBUGS-63700: Support datadisks on Stack Hub #168
OCPBUGS-56168: [release-4.17] Update virtualmachines service to armcompute/v5 SDK #146
Full changelog

baremetal-installer, installer, installer-altinfra, installer-artifacts

OCPBUGS-67204: Update the RHCOS 4.17 bootimage metadata #10285
OCPBUGS-77791: [Release 4.17] pkg/asset/manifests/azure: save cidr blocks #10218
OCPBUGS-74677: [release-4.17] GCP: skip AI zones #10276
OCPBUGS-74555: Azure UPI ARM template: use storageAccountId #10264
OCPBUGS-68142: [4.17] uplift logrus #10167
OCPBUGS-53236: Validation for API and Ingress VIPs when using user-managed load balancer #10047
OCPBUGS-62951: Update the RHCOS 4.17 bootimage metadata #10021
OCPBUGS-62054: Make swift containers removal not fatal for UPI. #9952
OCPBUGS-54599: Update the RHCOS 4.17 bootimage metadata #9902
OCPBUGS-58319: vSphere - remove unit tests using nip.io #9821
Full changelog

baremetal-machine-controllers

OCPBUGS-68143: [4.17] uplift logrus #239
Full changelog

baremetal-operator

OCPBUGS-77185: Unblock BMH direct deletion when detached annotation is present #462
Full changelog

baremetal-runtimecfg

OCPBUGS-71209: Bump logrus version #377
OCPBUGS-60112: Re-add ENABLE_NODEIP_DEBUG env var #363
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-64615: Help with must-gather scheduling through suggesting preferance of nodes #2150
OCPBUGS-56734: Adding sos.conf file for default sos config into the tools image #2027
Full changelog

cloud-credential-operator

OCPBUGS-65801: ccoctl azure: retry custom role creation on consistency errors #951
OCPBUGS-65480: ccoctl: use pagination when listing resources in aws #945
OCPBUGS-63549: ccoctl: add public-key-file flag to create-all #939
OCPBUGS-55128: snyk to ignore SNYK-GOLANG-GOLANGORGXNETHTML-9572088 #917
OCPBUGS-60972: ccoctl: aws to use proper issuer url on subsequent runs #908
OCPBUGS-58679: github.com/golang/glog v1.2.5 #892
OCPBUGS-58248: ccoctl: only add owned tag to azure resources on create #883
Full changelog

cloud-network-config-controller

OCPBUGS-66132: [release-4.17] Fix capacity calculation #194
OCPBUGS-65520: Change the capacity struct from int to ptrOfInt #191
Full changelog

cluster-authentication-operator

OCPBUGS-68150: Update library-go to fix CVE-2025-65637 #840
Full changelog

cluster-autoscaler

OCPBUGS-78700: allow clusterapi provider to skip paused resources #414
OCPBUGS-68151: update logrus to version 1.9.3 #398
OCPBUGS-60913: revert openshift replica fix #376
OCPBUGS-60608: fix checkpoint gc of unknown recommenders #371
OCPBUGS-59266: Fix cool down status condition to trigger scale down #362
Full changelog

cluster-baremetal-operator

OCPBUGS-77446: Bump github.com/go-errors/errors to v1.5.1 #561
OCPBUGS-63715: Always have a service for ironic-api port #519
OCPBUGS-63666: Allow provisioningIP when network disabled #518
OCPBUGS-61097: Remove webhookport (9447) as HostPort #505
Full changelog

cluster-cloud-controller-manager-operator

OCPBUGS-63167: ccm: disable unused secure-serving port and webhook #423
OCPBUGS-60211: Update service selector to match deployment label #406
OCPBUGS-60211: Add Service using common resource templating #407
Full changelog

cluster-config-api

CNTRLPLANE-1981: Promote streaming list encoding to Default #2599
OCPBUGS-71184: Add HTTPKeepAliveTimeout to IngressController API #2639
NO-JIRA: Promote streaming list encoding to Default on Hypershift. #2567
CNTRLPLANE-1611: Add feature gates for StreamingCollectionEncoding #2538
Full changelog

cluster-config-operator

OCPBUGS-75998: Update logrus to 1.9.3 to address CVE-2025-65637 #465
Full changelog

cluster-etcd-operator

OCPBUGS-68156: Update logrus to 1.9.3 to address CVE-2025-65637 #1542
OCPBUGS-61337: Vendor latest mixin, including additional and modified alerts for etcdDatabaseQuotaLowSpace #1480
OCPBUGS-60220: add missing ports to svc and pod spec #1461
Full changelog

cluster-image-registry-operator

OCPBUGS-68157: Bump github.com/sirupsen/logrus to 1.9.3 #1284
Full changelog

cluster-ingress-operator

OCPBUGS-71184: Implement HTTPKeepAliveTimeout tuning option #1335
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-68162: CVE-2025-65637 openshift4/ose-cluster-kube-apiserver-rhel9-operator: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload [openshift-4.17] #2055
OCPBUGS-63614: SCC: add hostmount-anyuid-v2 #1954
OCPBUGS-60398: Add missing service ports to apiserver service #1893
Full changelog

cluster-kube-controller-manager-operator

OCPBUGS-68164: CVE-2025-65637 openshift4/ose-cluster-kube-controller-manager-rhel9-operator: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload [openshift-4.17] #908
OCPBUGS-60249: Missing endpoint slices for open ports the operator uses #855
Full changelog

cluster-kube-scheduler-operator

CNTRLPLANE-2843: chore: update OWNERS #623
OCPBUGS-68165: deps: Update library-go and logrus to fix a CVE #613
Full changelog

cluster-kube-storage-version-migrator-operator

OCPBUGS-68167: Bump github.com/sirupsen/logrus to 1.9.1 #140
Full changelog

cluster-monitoring-operator

OCPBUGS-77275: AlertingRule: fix duplicate PrometheusRules after MD5->SHA-224 naming change #2832
OCPBUGS-64580: Fix KSM deny-list typo #2732
OCPBUGS-63489: Add mcd_local_unsupported_packages metric from MCO to telemetry 4.17 #2725
OCPBUGS-63123: test: remove image registry e2e tests #2715
OCPBUGS-61766: chore(jsonnet): use prometheus_remote_storage_queue_highest_timestamp_seconds in PrometheusRemoteWriteBehind #2672
OCPBUGS-60017: operator: increase wait time till degraded to max 4 times 5m #2634
Full changelog

cluster-network-operator

OCPBUGS-84181: fix(hypershift): use net.JoinHostPort for URL construction #2983
OCPBUGS-73799: Tweak iptables-alerter to try to avoid crictl bug #2878
: NO-JIRA: Update CNO reviewers/approvers #2767
OCPBUGS-74348: [release-4.17] fix typo in release annotation for whereabouts-token-watcher deamonset #2888
OCPBUGS-45086: Re-disable metrics server #2579
OCPBUGS-63154: Add drop flows for GARPs #2818
[Release 4.17] OCPBUGS-61765: Update CNO reviewers/approvers #2799
OCPBUGS-58066: [release-4.17]: Manual feature backport of cert rotation for whereabouts #2784
OCPBUGS-57285: Implement IPsec NAT-Traversal encapsulation option #2726
Full changelog

cluster-node-tuning-operator

OCPBUGS-78214: PPC: filter out namespaces dir #1481
OCPBUGS-63504: Do not cause kubelet failed dependency by ocp-tuned-one-shot.service #1418
Full changelog

cluster-openshift-apiserver-operator

OCPBUGS-68170: CVE-2025-65637 - Update library-go to bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.17] #653
Full changelog

cluster-samples-operator

OCPBUGS-63515: references to github.com/sclorg/django-ex.git now also refer to the branch #658
Full changelog

cluster-storage-operator

OCPBUGS-41160: Move metrics to vsphere driver #633
Full changelog

cluster-update-keys

NO-ISSUE: Updating ose-cluster-update-keys-container image to be consistent with ART for 4.17 #79
Full changelog

cluster-version-operator

OCPBUGS-58451: Failing=Unknown upon long CO updating #1212
Full changelog

console

NO-JIRA: enable multi-architecture yarn builds #16419
CONSOLE-5011: migrate to yarn berry #16074
NO-JIRA: Bump builder image to v29 #15994
OCPBUGS-74452: Bump lodash to latest #15966
OCPBUGS-69403: Disallowed Pipelines-plugin Pipelines navigation section #15849
OCPBUGS-65933: Preserve URL in perspective switch + remove dev console folks from reviewers #15762
OCPBUGS-64942: Expose prometheus tenancy label path as a proxy #15710
OCPBUGS-64599: Remove required flag from ‘console.flag/model’ pipelines-plugin extension #15665
OCPBUGS-62631: /auth/error?error=missing_state&error_type=auth is showing blank page #15554
OCPBUGS-63212: switch to dev perspective for /dev-monitoring #15614
OCPBUGS-63397: fix bug where Roles list was displaying invalid data f… #15627
OCPBUGS-62282: Fix desync of console and variable namespace #15545
OCPBUGS-44154: bump dompurify to latest #15590
OCPBUGS-61737: Remove ancient X-XSS-Protection header #15494
OCPBUGS-54241: VolumeSnapshots are not displayed in OpenShift Web Console #15465
OCPBUGS-59747: OpenShift console PVC clone cannot use B as the unit #15324
NO-JIRA: Increase the timeout on the cypress test #15420
OCPBUGS-58365: change ‘/metrics/usage’ endpoint to ‘/api/metrics/usage’ #15271
OCPBUGS-59544: Secret key with binary file changes when edited via Console #15301
OCPBUGS-59784: Update the golang.org/x/crypto/ssh to 0.31.0 in the openshift-console image #15329
OCPBUGS-58337: Tolerate unknown fields in Infrastructur… #15236
OCPBUGS-59492: Cannot read properties of undefined (reading ‘node-role.kubernetes.io/master’) error while accessing node logs from console #15294
OCPBUGS-59879: add data-test attrs to console plugins … #15338
OCPBUGS-59510: Not able to launch terminal window from OCP web console due to console plugin conflicts #15297
OCPBUGS-59265: fix bug where / in console.tab/horizontalNav href brea… #15270
OCPBUGS-58318: Implement sessions in openshift authenticator #15238
OCPBUGS-58224: Add the ability to launch multiple modals with useModal hook #15222
OCPBUGS-58378: Cannot read properties of undefined (reading ‘filter’) error while accessing nodes from console. #15241
OCPBUGS-57835: Add flags in console static plugin for all the components of this epic #15192
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

console-operator

OCPBUGS-77862: update go mod dependency for konflux #1114
OCPBUGS-60298: Update downloads deployment configuration to use master node selector #1033
Full changelog

container-networking-plugins, containernetworking-plugins-microshift

OCPBUGS-68135: Bump logrus to v1.9.1 #224
Full changelog

coredns

OCPBUGS-62825: UPSTREAM: 7083 and 6836: Fix failing TestZoneExternalCNAMELookupWithProxy #155
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-68209: fix CVE-2025-65637 #357
OCPBUGS-58839: CARRY: don’t ignore json files #340
Full changelog

csi-driver-nfs

OCPBUGS-80077: Replace google.golang.org/grpc with github.com/openshift-sustaining/grpc-go v1.71.3-sec.1 to avoid go version bump and fix CVE-2026-33186 #181
Full changelog

csi-external-resizer

OCPBUGS-62466: Requeue PVC over PV creation #175
Full changelog

csi-external-snapshotter, csi-snapshot-controller, csi-snapshot-validation-webhook

OCPBUGS-60449: UPSTREAM: 1238: Snapshot Controller startup should not LIST all volumesnapshots #184
Full changelog

csi-node-driver-registrar

OCPBUGS-63682: update log level verbosity to not clutter logs #90
Full changelog

docker-builder

OCPBUGS-66988: bump buildah to 1.37.7 to fix CVE-2025-52881 #499
OCPBUGS-65816: BuildConfig inline Dockerfile fails with heredoc syntax #488
Full changelog

docker-registry

OCPBUGS-68182: update logrus to v1.9.1 #465
OCPBUGS-60090: bump docker distribution to fix purgeuploads panic #440
Full changelog

gcp-cluster-api-controllers

OCPBUGS-78279: [release-4.17] update go mod dependency for konflux #266
Full changelog

gcp-pd-csi-driver

OCPBUGS-68186: Update logrus to 1.9.3 #90
Full changelog

hyperkube, pod

OCPBUGS-68132, OCPBUGS-68190: CVE-2025-65637 - bump github.com/sirupsen/logrus to v1.9.3 #2573
OCPBUGS-72531: Skip E2e: attach on previously attached volumes should work #2566
OCPBUGS-65695: Fix Concurrentmap Iteration #2520
OCPBUGS-63460: UPSTREAM: <carry>: backporting fix for concurrent map iteration and write #2456 #2496
CNTRLPLANE-1611: Backport StreamingCollectionEncoding for JSON and protobuf #2486
OCPBUGS-61584: UPSTREAM: <carry>: Don’t retry storage calls with side effects. #2458
OCPBUGS-60552: [4.17] podresources: list: use active pods #2426
4.17: OCPBUGS-60998: scheduler: Improve CSILimits plugin accuracy by using VolumeAttachments #2434
OCPBUGS-57888: Bump k8s api to 1.30.14 #2355
Full changelog

hypershift

OCPBUGS-84181: fix(cno): use brackets only for IPv6 in server URL #8347
OCPBUGS-76533: feat(updates): enable CVO metrics access with RHOBS monitoring flag #7703
OCPBUGS-74230, OCPBUGS-74294: [release-4.17] Support proxy authentication when user/pass is included in URL #7568
fix: OCPBUGS-72956: Fix Konflux EC voilation, update deprecated base … #7457
OCPBUGS-69865: test: remove unit tests that depend on network communication [release-4.17] #7411
OCPBUGS-57123: Add support for registry root entry only in the IDMS/ICSP #6230
CNTRLPLANE-1903: Migrate 4.17 pipelines to use common pipeline #7215
OCPBUGS-63639: [release-4.17] fix(konnectivity): resolve circular dependency causing DNS timeouts and excessive retries #7112
OCPBUGS-64604: Update DNS names for ovn-kubernetes cp metrics #7150
OCPBUGS-63370: fix: Make the hypershift CLI binary FIPS-compliant #7094
CNTRLPLANE-1425: feat(konflux): tag MCE HO images with latest #6838
OCPBUGS-57143: [release-4.17] HCP payload doesn’t respect multiple mirrors #6771
OCPBUGS-61290: Update KCM node monitor grace period #6760
OCPBUGS-61208: use common MCE konflux pipeline #6749
OCPBUGS-60149: [release-4.17] Always compress and encode payload in token secret for inplace upgrades #6740
OCPBUGS-61101: Use system trust bundle in CPO IDP https client #6735
OCPBUGS-60921: konflux for hcp-cli #6699
CNTRLPLANE-1204: HO MCE change to hermetic ta build #6653
CNTRLPLANE-1230: Move CPO pipeline to hermetic builds #6598
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-77209: [release-4.17] standardize build paths #123
OCPBUGS-58740: bump github.com/golang/glog to version v1.2.4 #105
OCPBUGS-56062: tech debt: rework vendor patches #90
Full changelog

ibm-vpc-block-csi-driver-operator

OCPBUGS-58435: [IBM VPC] set offlineExpansion to false in e2e test manifest #146
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-67287: [release-4.17] Fix incomplete vendor/ #139
OCPBUGS-51823: CVE-2025-22869 Update golang.org/x/crypto to patched OpenShift fork #121
Full changelog

ibmcloud-machine-controllers

OCPBUGS-81667: bump vpc go sdk #92
NO-JIRA: Modernize test infrastructure to align with other MAPI providers #88
Full changelog

insights-operator

OCPBUGS-68193: OCPBUGS-68194: [vuln] Update logrus library to 1.9.3 #1227
OCPBUGS-67008: Add filtering to add other possible pod status to QEMU gatherer #1196
OCPBUGS-66395: QEMU logs are not gathered if there are pending status virt-launcher pods #1194
OCPBUGS-66394: [bugfix] The archive’s records may include files whose names are out of bounds #1193
OCPBUGS-64629: add permissions to gather clusterrole #1170
OCPBUGS-63500: add missing permissions for replicasets and events #1165
And 4 elided commits (e.g. from squash or rebase merges)
Full changelog

ironic

OCPBUGS-76458: Bump pyasn1 to 0.5.1-4 #827
OCPBUGS-74114: Bump keystonemiddleware version to 10.7.1-0.20260216144200.4c001ba for CVE-2026-22797 fix #796
OCPBUGS-69792: Bump eventlet version to 0.33.1-7 #761
Full changelog

ironic-agent

OCPBUGS-69775: Bump eventlet version to 0.33.1-7 #231
OCPBUGS-62490: netutils: Use ethtool ioctl to get permanent mac address #214
Full changelog

kube-metrics-server

OCPBUGS-80013: Bump google.golang.org/grpc to v1.79.3 #65
Full changelog

kube-proxy

OCPBUGS-68165: deps: Update library-go to fix a CVE #661
Full changelog

kube-state-metrics

OCPBUGS-74874: Deduplicate CRS stores #132
Full changelog

kube-storage-version-migrator

NO-JIRA: Add DOWNSTREAM_OWNERS (release 4-17). #226
Full changelog

kubevirt-cloud-controller-manager

OCPBUGS-34447: Updating ose-kubevirt-cloud-controller-manager-container image to be consistent with ART for 4.17 #44
Full changelog

libvirt-machine-controllers

OCPBUGS-77195: Fix incomplete vendor/ #301
Full changelog

machine-api-operator

OCPBUGS-79373: [release-4.17] Use resource group when generating default Azure image #1481
Full changelog

machine-config-operator

OCPBUGS-74149: enable nodeip-configuration for platform external #5577
OCPBUGS-77979: hermetic 4.17 #5733
OCPBUGS-77889: reduce MCO image size #5746
OCPBUGS-77812: mcd_config_drift not working properly #5741
OCPBUGS-77422: Remove MCD liveness probe #5709
OCPBUGS-77242: After OCL is enabled few phases in MCN are not updating as expected #5575
OCPBUGS-77186: Machine-config controller should not log about non-existent pull-secret changes #5679
OCPBUGS-77090: machine-config-daemon: openshift: Exposure of Sensitive Data in Log Files in the Machine Configuration Daemon. [openshift-4] #5678
OCPBUGS-61190: MCO report “failed to list *v1alpha1.MachineOSConfig” when enable TechPreview after upgrading from 4.16 to 4.17 with one mcp paused #5584
OCPBUGS-60112: Enable debug logging for nodeip-configuration #5219
OCPBUGS-62170: Fix - NetworkManager restart or crash renders br-ex unusable #5355
OCPBUGS-66037: Remove –mount directives #5443
OCPBUGS-63154: [release-4.17] Networking: reset ovn-remote config and allow ovnkube controller to set it #5358
OCPBUGS-63540: Add control-plane label for master nodes on legacy clusters #5375
OCPBUGS-63364: Invalid architecture value found in annotation during 4.19 update #5368
OCPBUGS-63055: Recheck generatedByControllerVersion annotation prior to deleting a degraded MC #5346
OCPBUGS-62741: Add /etc/docker/certs.d to template #5335
OCPBUGS-62683: Add mcd_local_unsupported_packages recording rule #5327
OCPBUGS-60890: Race in configure-ovs.sh affects bonding interface configuration. #5267
OCPBUGS-61859: Override NMState service definition #5289
OCPBUGS-59930, OPNET-681: Support migration to NMState #5206
OCPBUGS-56752: Support NODEIP_HINT in IPI deployments too #5080
OCPBUGS-60704: operator: switch out VAP v1beta1 to v1 #5256
OCPBUGS-57084: scope MCD node listers to current node #5107
OCPBUGS-60239: Add workaround fix for static pod race #5231
OCPBUGS-58292: Do not set cpu system reserve below the default value #5157
OCPBUGS-58063: Update desired config in MCN on OCL update #5139
OCPBUGS-56625: Give keepalived container chroot cap #5072
OCPBUGS-58219: Boot image controller should correctly handle marketplace boot images #5151
Full changelog

machine-image-customization-controller

OCPBUGS-68192: [4.17] Uplift logrus #152
Full changelog

metallb-frr

OCPBUGS-76548: Dockerfile: unpin FRR rpm #124
Full changelog

monitoring-plugin

OU-1260: [release-4.17] feat: use npm instead of yarn #812
OCPBUGS-76809: fix for CVE-2025-69873 #848
OCPBUGS-70290: Manual cherry pick qs vulnerability 4 17 #747
OCPBUGS-64942: Use tenancy access to metric lables #639
OU-1058: Don’t show TP button in non-administrator #637
OCPBUGS-62282: align dev and admin persective tab names #602
OCPBUGS-62282: add missing translation string #587
OCPBUGS-61891: feat: add alerting rules tab to dev console #538
OCPBUGS-59399: Fix “Export as CSV” #468
Full changelog

multus-admission-controller

OCPBUGS-58770: Update the github.com/golang/glog module to v1.2.4 #102
Full changelog

multus-cni, multus-cni-microshift

OCPBUGS-77854: hermetic 4.17 #277
OCPBUGS-43391: Update net-attach-def client library to 1.7.5 for cri-o functionality [backport 4.17] #257
Full changelog

multus-whereabouts-ipam-cni

OCPBUGS-73728: Update tag on ci-operator.yaml file #395
OCPBUGS-70256: Prevent accidental IP deallocation in statefulsets #393
Full changelog

must-gather

OCPBUGS-60607: Separate resources with comma to fix malformed inspect #504
Full changelog

network-interface-bond-cni

OCPBUGS-59620: Bump github.com/containernetworking/plugins from to 1.7.1 #83
NO-JIRA: Add ci-operator file #82
Full changelog

network-metrics-daemon

OCPBUGS-58780: Bump github.com/golang/glog to v1.2.4 (#112) #112
OCPBUGS-60177: Replace e2e test image (#121) #121
Full changelog

networking-console-plugin

OCPBUGS-81602: Fix CVE-2026-CVE-2026-4800 in lodash #402
OCPBUGS-79445: Bump immutable #389
CNV-76277: Fix name generator with unprofessional names #320
OCPBUGS-60180: Fix ingress details #265
OCPBUGS-60128: Fix requiremenets with no value #260
Full changelog

oauth-apiserver

OCPBUGS-66228: UPSTREAM <carry>: bump kubernetes-apiserver to pick up loopback certificate expiration update #157
NO-JIRA: (chore): update OWNERS file #171
OCPBUGS-61584: Bump openshift/kubernetes-apiserver for etcd retry patches. #143
Full changelog

oauth-proxy

OCPBUGS-61445: Update x/crypto to v0.31.0 #334
OCPBUGS-58472: fix e2e tests #327
Full changelog

oauth-server

OCPBUGS-61584: Bump openshift/kubernetes-apiserver for etcd retry patches. #198
Full changelog

oc-mirror

Adding r4f4 and Prashanth684 as approvers and removing contributors who are not working with oc-mirror anymore. (#1269) #1269
Full changelog

openshift-apiserver

OCPBUGS-68208: CVE-2025-65637 - Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.17] #609
OCPBUGS-74143: pkg/image: conditionally parse raw image manifest #596
OCPBUGS-66229: UPSTREAM <carry>: bump kubernetes-apiserver to pick up loopback certificate expiration update #584
OCPBUGS-63392: Wire dry run option to Image API server operations #565
OCPBUGS-61584: Bump openshift/kubernetes-apiserver for etcd retry patches. #554
OCPBUGS-53382: Skip blocked registry check for registries with mirrors #500
OCPBUGS-58821: Fix image reference in TestImageStreamImportQuayIO #515
Full changelog

openshift-controller-manager

OCPBUGS-61199: legacy image pull secret rollback controller #413
OCPBUGS-57950: ignore error failing to find pull/push secrets #400
Full changelog

openstack-machine-api-provider

OCPBUGS-78169: hermetic 4.17 #162
OCPBUGS-76793: Fix make test #160
Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

OCPBUGS-77838: Remove the collect-profiles info from the microshift kustomization file #1250
OCPBUGS-76953: Remove the collect-profiles job #1232
OCPBUGS-67301: Fix TOCTOU race condition in ensureInstallPlan (#3682) #1172
OCPBUGS-57092: [release-4.17] e2e stability fixes #1081
OCPBUGS-60791: Add NetworkPolicy as a supported kind #1058
OCPBUGS-57428: reduce cache expiry frequency [release-4.19] #1021
OCPBUGS-59253: Reduce Frequency of Update Requests for Copied CSVs (#3597) #1036
OCPBUGS-57438: operatorgroup: ensure clusterroleselectors in clusterrole aggregation rules are sorted #1025
Full changelog

operator-marketplace

OCPBUGS-68212, OCPBUGS-68213: [release-4.17] CVE-2025-65637 fixed in logrus v1.9.3+ #710
OCPBUGS-62219: Remove Expect func so that the test case can use the retry logic #670
OCPBUGS-61036: Update memoryTarget on catalog source pods #663
Full changelog

ovirt-csi-driver-operator

OCPBUGS-68230: Bump github.com/sirupsen/logrus to v1.8.3 #151
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-81639: External gateway: Remove routes for external gateway pods in terminating or not ready state #3107
OCPBUGS-78029: Add pperiyasamy to OWNERS for release-4.17 #3046
OCPBUGS-77568: Clear stale conntrack UDP entries for nodePorts #3035
CORENET-6055, OCPBUGS-74492: [release-4.17] Dockerfile: Unpin OVN and consume the latest from FDP #2959
[release:4.17] OCPBUGS-71985: Fix conntrack reconciliation to use service port instead of endpoint port #2936
OCPBUGS-71218: [release-4.17] CVE-2025-65637 Bump github.com/sirupsen/logrus to v1.9.1 through indirect dependency conversion (go-controller module) #2905
OCPBUGS-71198: NetPol & MultiNetPol: Process update only when spec fields and/or related annotation are updated #2923
OCPBUGS-68348: Add ricky-rav to OWNERS for release-4.17 #2898
OCPBUGS-65928: Skip Pending pods in EgressIP status #2871
OCPBUGS-65569: [release-4.17]: kubevirt: fix bad release of IPs of live migratable pods #2857
OCPBUGS-64856: Fix stale EIP assignments during failover and controller restart #2850
OCPBUGS-64674: [release-4.17]: Configure sec nic EIPv6 address with NODAD and maximum lifetime #2843
OCPBUGS-63154: Fix EgressIP stale GARP post reboot + pod restart #2807
OCPBUGS-61749: [release-4.17] Fix dnsnameresolver address set #2796
OCPBUGS-60484: Update OWNERS file: Add Patryk/Martin as approvers #2717
OCPBUGS-59381: [release-4.17] Fix default network -> localnet #2667
OCPBUGS-58160: Unpin OVS patch versions, move to ovs 3.5 #2647
Full changelog

powervs-block-csi-driver

OCPBUGS-80142: Fix CVE-2026-33186 by bumping google.golang.org/grpc to 1.79.3 #131
OCPBUGS-82725: Fix CVE-2026-35469 by bumping github.com/moby/spdystream to v0.5.1 #125
Full changelog

powervs-block-csi-driver-operator

OCPBUGS-80144: Fix CVE-2026-33186 by bumping google.golang.org/grpc to v1.79.3 #112
Full changelog

powervs-machine-controllers

OCPBUGS-61204: Use OS_GIT_VERSION in Makefile when found (for Konflux builds) #126
Full changelog

prometheus

OCPBUGS-61766: chore: compute highestTimestamp at queryManager level #268
Full changelog

prometheus-alertmanager

OCPBUGS-75885: Include go-verify-deps expected files in gitignore #115
Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

OCPBUGS-77452: Validate webhookURL secret for MSTeams receiver in AlertmanagerConfig CRD #369
OCPBUGS-58408: Fix: One Alertmanager Config failing blocks all others. (#6585) #336
Full changelog

service-ca-operator

OCPBUGS-68220: Update logrus to 1.9.3 to address CVE-2025-65637 #316
Fix for OCPBUGS-68221: CVE-2025-65637 bump github.com/sirupsen/logrus to v1.9.3 #309
Full changelog

telemeter

OCPBUGS-81796: [release-4.17] Fix CVE-2026-34986 #597
OCPBUGS-80159: Bump google.golang.org/grpc to v1.79.3 #600
Full changelog

tests

OCPBUGS-65492: Add imagestream update dryrun test #30479
OCPBUGS-64927: update telemtery limit for 4.17 e2e case #30472
OCPBUGS-64641: Migrate OCP-32383 to upstream #30455
OCPBUGS-63392: Backport pr 29834 to release-4.18 #30408
OCPBUGS-61162: images/tests: Remove rteval #30202
NO-JIRA: Update extended/networking OWNERS #30090
OCPBUGS-57324: Fix bearer token exposure in exit condition as well #29910
OCPBUGS-57888: Bump to Kubernetes v1.30.14 #29983
Full changelog

vsphere-cloud-controller-manager

OCPBUGS-78027: hermetic migration 4.17 #106
Full changelog

vsphere-cluster-api-controllers

OCPBUGS-78019: hermetic migration 4.17 #85
OCPBUGS-61652: Fix unit tests #71
Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

OCPBUGS-68224: CVE-2025-65637: Bump github.com/sirupsen/logrus to v1.8.3 #157
Full changelog

vsphere-problem-detector

OCPBUGS-61755: Check for number of FailureDomain-s in GetVCenter() #190
Full changelog

View changelog in Markdown or change previous release:

Source code for this page located on github