4.18.28

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.18.28-x86_64

Team Approvals:

Accepted
- QE

Tests:

Blocking jobs
- upgrade Succeeded release-openshift-origin-installer-e2e-aws-upgrade
- upgrade-minor Succeeded release-openshift-origin-installer-e2e-aws-upgrade
Informing jobs
- aws-ovn-serial Succeeded periodic-ci-openshift-release-master-nightly-4.18-e2e-aws-ovn-serial
- aws-ovn-single-node-upgrade-4.18-micro Succeeded periodic-ci-openshift-release-master-ci-4.18-e2e-aws-upgrade-ovn-single-node
- aws-ovn-techpreview Succeeded (1 retries) periodic-ci-openshift-release-master-ci-4.18-e2e-aws-ovn-techpreview
- aws-ovn-techpreview-serial Succeeded periodic-ci-openshift-release-master-ci-4.18-e2e-aws-ovn-techpreview-serial
- aws-ovn-upgrade-4.18-micro Succeeded (1 retries) periodic-ci-openshift-release-master-ci-4.18-e2e-aws-ovn-upgrade
- azure-ovn-upgrade-4.18-micro Succeeded periodic-ci-openshift-release-master-ci-4.18-e2e-azure-ovn-upgrade
- fips-scan Succeeded periodic-ci-openshift-release-master-nightly-4.18-fips-payload-scan
- gcp-ovn-rt-upgrade-4.18-minor Succeeded periodic-ci-openshift-release-master-ci-4.18-upgrade-from-stable-4.17-e2e-gcp-ovn-rt-upgrade
- hypershift-ovn-conformance-4.18 Succeeded periodic-ci-openshift-hypershift-release-4.18-periodics-e2e-aws-ovn-conformance
- metal-ipi-ovn-bm Succeeded periodic-ci-openshift-release-master-nightly-4.18-e2e-metal-ipi-ovn-bm
- metal-ipi-ovn-ipv6 Succeeded periodic-ci-openshift-release-master-nightly-4.18-e2e-metal-ipi-ovn-ipv6
- microshift-ovn-conformance-parallel Succeeded periodic-ci-openshift-microshift-release-4.18-periodics-e2e-aws-ovn-ocp-conformance
- microshift-ovn-conformance-serial Succeeded periodic-ci-openshift-microshift-release-4.18-periodics-e2e-aws-ovn-ocp-conformance-serial

Upgrades from:

Untested upgrades: 4.17.14, 4.17.15, 4.17.17, 4.17.18, 4.17.20, 4.17.21, 4.17.22, 4.17.23, 4.17.24, 4.17.25, 4.17.26, 4.17.27, 4.17.28, 4.17.29, 4.17.30, 4.17.31, 4.17.32, 4.17.34, 4.17.35, 4.17.36, 4.17.37, 4.17.38, 4.17.39, 4.17.40, 4.18.10, 4.18.12, 4.18.13, 4.18.14, 4.18.15, 4.18.16, 4.18.17, 4.18.18, 4.18.20, 4.18.21, 4.18.22, 4.18.23, 4.18.24, 4.18.4, 4.18.5, 4.18.6, 4.18.8, 4.18.9

Upgrades to:

Loading changelog, this may take a while ...

Changes from 4.18.19

Created: 2025-11-06 15:54:47 +0000 UTC

Image Digest: sha256:98c80d92a2ef8d44ee625b229b77b7bfdb1b06cbfe0d4df9e2ca2cba904467f7

Components

Kubectl 1.31.1
Kubernetes upgraded from 1.31.9 to 1.31.13
Kubernetes Tests upgraded from 1.31.9 to 1.31.12
Red Hat Enterprise Linux CoreOS upgraded from 418.94.202506251005-0 to 418.94.202511041748-0 (diff)

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
OnClusterBuild (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled	Enabled
StreamingCollectionEncodingToJSON (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
StreamingCollectionEncodingToProtobuf (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)

Rebuilt images without code change

agent-installer-utils git 0e41f7d5 sha256:62de813f3c56440536a2b1c89edc66817a5c9460eab8e6913acb775540133fb1
apiserver-network-proxy git 2f62712d sha256:c164f4151b3081c4fca16a7ea6dca8dd71555e9428757a8de0f8ae471846cd22
aws-cloud-controller-manager git c3951906 sha256:e50a270ad04d1e8d864d7cffc3ba3f3ca5d7111ba09ac4b234f4386c3da53576
aws-ebs-csi-driver git b51cd6b8 sha256:7f656ff66f14895a1910ef7d0eb39c6f6f66f009c5cffbd5b3e53aa97090b638
aws-kms-encryption-provider git 088dcaf7 sha256:93444064d1707591de4607207e0d89d8eef417e0981fc6a30c7b7681c3e0b615
aws-pod-identity-webhook git f54f9a19 sha256:e170472776049ecfc4867f6f37fa0a246831043e380dc74d00e3a13a91f2db77
azure-cloud-controller-manager git 9c24d768 sha256:f734c5d3db3668f61428823e244090b59c35b1165269284981607f1e74cd6478
azure-cloud-node-manager git 9c24d768 sha256:22697aa8b9ecc72c7304f90ddba998c8336e60520e6770239a16700f2a00012b
azure-disk-csi-driver git 6cced666 sha256:6526eda46595a77edede1f48a33b046e35dbcc39bc8a362aab9544b9979bf90c
azure-file-csi-driver git 4b34592e sha256:2a934670530316b84ccc8562e91c32df028ab95780142dd706eae750954398b7
azure-kms-encryption-provider git c937080f sha256:31cb2cc8c79a9bbba50da05a41a61c39fab2421ce8735369f81410338e4be0e8
azure-workload-identity-webhook git f60e4029 sha256:99327fbbfc29d31a82ff628e6bbdb75be36509956e43694de191c4a0a30aa1bc
baremetal-machine-controllers git 1ede6c3f sha256:43f2cdef40e40da7407a6e2e0c4b5057ba891fc0518764cce1c4c6850febc119
cloud-network-config-controller git beacfbc2 sha256:2dc42ec15e3ecccc0942415ec68b27c2c10f53f084b6fa23caa1e81fc70f3629
cluster-autoscaler-operator git 474ad65c sha256:2d41c3e944e86b73b4ba0d037ff016562211988f3206b9deb6cc7dccca708248
cluster-bootstrap git d1e01954 sha256:257433a0e789418bfe7d813f52655709a6060076e91999852c49a58b7627182c
cluster-capi-operator git 2f2737e1 sha256:68927631ebab9644417c35986e6cfdd9aea8570530d056f72249cbc485cc05fa
cluster-config-operator git 85cb4072 sha256:d0c6de747539dd00ede882fb4f73cead462bf0a7efda7173fd5d443ef7a00251
cluster-control-plane-machine-set-operator git d17bf3a1 sha256:23aa409d98c18a25b5dd3c14b4c5a88eba2c793d020f2deb3bafd58a2225c328
cluster-csi-snapshot-controller-operator git 6fe70008 sha256:4cb6ecfb89e53653b69ae494ebc940b9fcf7b7db317b156e186435cc541589d9
cluster-dns-operator git 7cafd0c7 sha256:656fe650bac2929182cd0cf7d7e566d089f69e06541b8329c6d40b89346c03ca
cluster-image-registry-operator git 1e3caa4b sha256:8e8903affdf29401b9a86b9f58795c9f445f34194960c7b2734f30601c48cbdf
cluster-ingress-operator git d967a73c sha256:492103a8365ef9a1d5f237b4ba90aff87369167ec91db29ff0251ba5aab2b419
cluster-kube-cluster-api-operator git 33a1141e sha256:bbe8bb4acfac2880787b6a4b73ce2c51b1741160e46f5ba5a291d9cc959d325c
cluster-kube-scheduler-operator git 6182930d sha256:3d835ce07d1bec4a4b13f0bca5ea20ea5c781ea7853d7b42310f4ad8aeba6d7c
cluster-kube-storage-version-migrator-operator git 59ba356f sha256:93145fd0c004dc4fca21435a32c7e55e962f321aff260d702f387cfdebee92a5
cluster-machine-approver git 01d5fbbe sha256:9f4724570795357eb097251a021f20c94c79b3054f3adb3bc0812143ba791dc1
cluster-openshift-apiserver-operator git 0a6f6eb9 sha256:84a52132860e74998981b76c08d38543561197c3da77836c670fa8e394c5ec17
cluster-openshift-controller-manager-operator git f1711cf3 sha256:3051af3343018fecbf3a6edacea69de841fc5211c09e7fb6a2499188dc979395
cluster-policy-controller git 5fd85252 sha256:2e254a7fb8a2643817718cfdb54bc819e86eb84232f6e2456548c55c5efb09d2
cluster-update-keys git 8caab452 sha256:3a1fbe783766a9a47d90265e08cdd962f4feaf1e8e0b111c2347956958cfe61b
configmap-reloader git e2aaf00a sha256:20a45eea23b06400b1b9e99a0f4e09757f94dd6ccfcdc8ab0ef33874e0725c5c
csi-driver-nfs git 32e77590 sha256:2e8e7bdb9db0feed98f96e6542cc2e8bb4cb33dc1dc3d61c1df092cdbde4db06
csi-external-attacher git 39b37c06 sha256:9a045e84becd62c12b1c0ba59ebb9f643ebe3eea869742a60928e96ef55063cb
csi-external-provisioner git 376f0ea0 sha256:680fd6619cdc308cfa11d969dd39f1fcabb5596895c063688512656e23dbf355
csi-livenessprobe git 3a977844 sha256:b66bbf093cd69de010fb9a293701ec313dbe04c9122ee0784e0c27303c9d3dd2
docker-builder git a5cbc2b1 sha256:d00e4a8d28cc3d2d3fb5373755d14d8b28eac162507662675fae2c82047ff869
driver-toolkit git 2e139edc sha256:673cb0c159ef713fa3756a8808533c840370105733d9a47cfe63b201f3e193ba
egress-router-cni git 3193a756 sha256:ceaa4102b35e54be54e23c8ea73bb0dac4978cffb54105ad00b51393f47595da
gcp-cloud-controller-manager git 6ea23561 sha256:c9562b1bb57e930328da4ae9591c4af1f235b77c036f027efd6ab7c713c2e395
gcp-pd-csi-driver git 1b8c94ac sha256:dc737e45c5fb285e5e07a2da206c0361db34abac6715ca6d245bccdd22c6f726
gcp-pd-csi-driver-operator git 7cb8b38c sha256:ca110492e70a629b9a4ec26bc27d967c36ad0b7c642d9bd325bae1dee552fbed
gcp-workload-identity-federation-webhook git f0a670c7 sha256:39df823dbdd0fbefb4cf43ba5de717b97777eda40d2eeebe37d74f7d2d6cd314
haproxy-router git d8058949 sha256:3ed4dc45b0e0d6229620e2ac6a53ecd180cad44a11daf9f0170d94b4acd35ded
ibm-cloud-controller-manager git a33026b1 sha256:da8bd3ec0d2544bfd7e650f3611a4f16885ac0b7b39700ecdaa92792dc7c90b4
insights-runtime-exporter git 7149f2d5 sha256:b7b10c78ffd29bee19d9249a2b5528612a197008dce2ecc146903fab40c9b946
insights-runtime-extractor git 7149f2d5 sha256:a01bde662d749691118d69f00c4bd0d7f5fe075fa3cd25b90b240ab240200cc6
ironic-agent git b79bddef sha256:d4b7877d8d082a2b844ad8b3a7a440976f79820693db91e6392b93b9ee50526c
ironic-machine-os-downloader git 50ca44fd sha256:16633b0c52c5133b692c8b75af2f3f644cf70d678ce8d656647e647c504c1a81
ironic-static-ip-manager git cfbae04f sha256:296462aa08198fa43aa0870287ed30733ebe3e1e9346a1b9a346c15406dcc3c5
keepalived-ipfailover git 716eb0ef sha256:0247eac32c117b5ee2fbd09f694d7ce28e9000b5b9237f33f658ea020d5a8827
kube-metrics-server git 962ccca2 sha256:3cc3977d34490059b692d5fbdb89bb9a676db39c88faa35f5d9b4e98f6b0c4e2
kube-state-metrics git cb5a9296 sha256:b0737727dcbfb50c3c09b69684ba3c07b5a4ab7652bbe4970a46d6a11c4a2bca
kubevirt-cloud-controller-manager git 3f4542ec sha256:076df6451aeb2e945904ce5fb7bb87727bcc578070cc3cb6ccaa48352bb6415b
libvirt-machine-controllers git a336f0b5 sha256:0335711cbdf908bd36d15b90cd2d015a848b7b67d4f85a00863b7f48a34ba28a
machine-image-customization-controller git d9a71247 sha256:a89d97b3f48e9dee1e20c913897b81185cd0af7f09b7dd3b58d18852f4220cbf
machine-os-images git ab432836 sha256:82395dbf9c54f869b1bab1ad4ff27253704dfdb48cbdba5049aba2e6464eb5b9
metallb-frr git 98ccbe64 sha256:4629a2d090ecc0b613a9e6b50601fd2cdb99cb2e511f1fed6d335106f2789baf
multus-cni git 21fb8e05 sha256:98ce2d349f8bc693d76d9a68097b758b987cf17ea3beb66bbd09d12fa78b4d0c
multus-cni-microshift git 21fb8e05 sha256:233ae3955f307cbf463e2d728006d5f9ca89af5dbcf97b1f8384e3178efcf5d0
multus-route-override-cni git 391c1b03 sha256:2f86d9ffe13cbab06ff676496b50a26bbc4819d8b81b98fbacca6aee9b56792f
network-tools git 47b13549 sha256:3abf628c1fc1326f2508f490b6a6f9a4ee3da73dd14ecd8c138ac54e6c31ddd3
nutanix-cloud-controller-manager git d9fe8f38 sha256:7347193795ceafb41bcf6f6471f8e8975c4f8f9e55b15dfe1f3a731077188ff1
nutanix-machine-controllers git afe324bf sha256:9623383df0f01ec565daeefc81932ffcd513dd29f48f7a9c7dd38e79ec5f5b01
openshift-state-metrics git 3cca6fee sha256:e39fd49a8aa33e4b750267b4e773492b85c08cc7830cd7b22e64a92bcb5b6729
openstack-cluster-api-controllers git ce2c2d17 sha256:2795807194ae44710039d798099380157a0b37d678be0c7bf551215d8e1ebfc8
openstack-machine-api-provider git d914e77e sha256:3f45a045dc2269d1f88310b741629e65c832aa7e16cc2c4506ef81c392e86400
ovirt-csi-driver git 1db726a9 sha256:b9f3dfbe2e3362b963e3f8784cac8fd0bda1c23a0fee80784a7e3dedf3a8bf7c
ovirt-csi-driver-operator git 0feae256 sha256:1da5bf06996d2f840c9fb3b80133f9d71646edc799dbcc990ffbefb8c8e950f0
powervs-block-csi-driver git d36aea34 sha256:cba7ad10fb39b7441100637b3a829ede02aa3a1e70b79e16e0b4da49f071f3ea
powervs-block-csi-driver-operator git 01fc505a sha256:4bb7973c609c19a4195a61de54624bc6f436b05a819067353ac1cb219356e636
powervs-cloud-controller-manager git 17ae6fba sha256:673d82432b385aa67a891139b7945a504b7dff8d9a7c933d538fd1b7701e23db
prom-label-proxy git 35c11369 sha256:3ef6fd8a728768571ca93950ec6d7222c9304a98d81b58329eeb7974fa2c8dc8
prometheus-alertmanager git a4320675 sha256:d12d87386ab9c19148c49c1e79d839a6f47f3a2cd7e078d94319d80b6936be13
prometheus-node-exporter git 92e17ff5 sha256:debbfa579e627e291b629851278c9e608e080a1642a6e676d023f218252a3ed0
rhel-coreos sha256:411b8fa606f0f605401f0a4477f7f5a3e640d42bd145fdc09b8a78272f8e6baf
rhel-coreos-extensions sha256:72b0a0c9efb387b7bc098327fb451c359aa613f41cd90a7651d11588dee986a5
route-controller-manager git ce6ffa24 sha256:ebd79294a663cb38370ae81f9cda91cef7fb1370ec5b495b4bdb95e77272e6a8
service-ca-operator git 30efb529 sha256:eefdc67602b8bc3941001b030ab95d82e10432f814634b80eb8ce45bc9ebd3de
telemeter git 490612bd sha256:28b3ba29ff038781d3742df4ab05fac69a92cf2bf058c25487e47a2f4ff02627
thanos git f1599f65 sha256:e955ac7de27deecd1a88d06c08a1b7a43e867cadf4289f20a6ab982fa647e6b7
vsphere-cloud-controller-manager git c414d1f5 sha256:77d6fa15964fce99006d03f74ba49cdb25cece21d9fc35f8bdee8244e702d1c0
vsphere-csi-driver git cfcad01d sha256:21a891e2bef32460f4b97e591644b09d138de811855f8c896d05a9d51dbb6651
vsphere-csi-driver-operator git 2b241410 sha256:ca6cf701f5ccbc6511820a531711bf7ed02ad10a5093ad124b558b336a9543b9
vsphere-csi-driver-syncer git cfcad01d sha256:a5a68ca2de637b37480aea76d2e5637d5ffdb13dd69b9e7a82fd47b0736b22a8

agent-installer-api-server

NO-ISSUE: pin gotestsum to v1.12.3 (#8018) #8018
OCPBUGS-58635, OCPBUGS-58640: Bump glog to v1.2.5 in release-4.18 (#7877) #7877
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-58650: Bump glog pkg to 1.2.4 (#1181) #1181
Full changelog

agent-installer-node-agent

OCPBUGS-58655, OCPBUGS-58660: Bump glog to v1.2.5 in release-4.18 (#1069) #1069
Full changelog

aws-cluster-api-controllers

OCPBUGS-61841: UPSTREAM <carry>: revert: Only tag NetworkInterfaces in RunInstances if IAM Allows It #570
OCPBUGS-58670, OCPBUGS-58675: bump github.com/golang/glog to v1.2.5 #556
OCPBUGS-56434: Update manifests to use v1 admissionregistration group #554
Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator

OCPBUGS-63407: Use 127.0.0.1 for healtz http-endpoints #450
OCPBUGS-62973: Add withCABundleDaemonSetHook() to AWS EFS operator #447
OCPBUGS-55053: Correct ASH driver inject env config #381
OCPBUGS-54453: Enable required driver services #375
OCPBUGS-60596: Bump library-go to fix assignment to nil map issue #421
OCPBUGS-60203: Remove stale conditions #413
Full changelog

aws-machine-controllers

OCPBUGS-63138: client: re-use a single file for building the session instead of randomly named files #146
Full changelog

azure-cluster-api-controllers

OCPBUGS-58861: Update manifests to remove reliance on admission registration v1beta1 #348
Full changelog

azure-machine-controllers

OCPBUGS-63669: Support datadisks on Stack Hub #167
OCPBUGS-56167: [release-4.18] Update virtualmachines service to armcompute/v5 SDK #145
Full changelog

baremetal-cluster-api-controllers

OCPBUGS-58861: Update manifests to remove reliance on admission registration v1beta1 #51
Full changelog

baremetal-installer, installer, installer-altinfra, installer-artifacts

OCPBUGS-53235: Validation for API and Ingress VIPs when using user-managed load balancer #10046
OCPBUGS-62810: Update the RHCOS 4.18 bootimage metadata #10014
OCPBUGS-59490: Make swift containers removal not fatal for UPI. #9839
OCPBUGS-61529: Use less permissive access for /var/lib/etcd for SNO #9937
OCPBUGS-61178: Refine check for supported SNO platforms #9923
OCPBUGS-60592: baremetal: always set external v6 URL on dualstack #9895
OCPBUGS-54598: Update the RHCOS 4.18 bootimage metadata #9900
OCPBUGS-56177, OCPBUGS-59155, OCPBUGS-59158: Migrate AWS SDK to V2 to support MX-Central Region #9709
OCPBUGS-58321: allow to deploy single nodes with UPI #9824
OCPBUGS-54744: Filter out excess CA certs when adding node #9647
OCPBUGS-58264: vSphere - remove unit tests using nip.io #9813
Full changelog

baremetal-operator

OCPBUGS-56766: Make firmware update handle only a subset of Spec.Updates #421
Full changelog

baremetal-runtimecfg

OCPBUGS-60111: Re-add ENABLE_NODEIP_DEBUG env var #364
OCPBUGS-59280: Bump logrus version #354
OCPBUGS-57782: iptables: Switch PREROUTING REDIRECT rule to DNAT instead #351
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-58233: Return error in case of error #2054
Full changelog

cloud-credential-operator

OCPBUGS-55127: snyk to ignore SNYK-GOLANG-GOLANGORGXNETHTML-9572088 #915
OCPBUGS-60971: ccoctl: aws to use proper issuer url on subsequent runs #907
OCPBUGS-60618: ccoctl azure dnszone-resource-group-name now optional #899
OCPBUGS-58680: github.com/golang/glog v1.2.5 #891
OCPBUGS-58247: ccoctl: only add owned tag to azure resources on create #882
Full changelog

cluster-authentication-operator

OCPBUGS-49749: Exclude etcd readiness checks from /readyz to ignore temporary etcd hiccups #754
Full changelog

cluster-autoscaler

OCPBUGS-60908: revert openshift replica fix #375
OCPBUGS-60235: fix checkpoint gc of unknown recommenders #368
OCPBUGS-59260: Fix cool down status condition to trigger scale down #361
Full changelog

cluster-baremetal-operator

OCPBUGS-63439: Always have a service for ironic-api port #514
OCPBUGS-63469: Allow provisioningIP when network disabled #515
OCPBUGS-60586: Remove webhookport (9447) as HostPort #501
OCPBUGS-58315: Bump github.com/go-errors/errors to v1.5.1 #492
Full changelog

cluster-capi-controllers

OCPBUGS-56434: Update manifests to leverage v1 admissionregistration group #241
Full changelog

cluster-cloud-controller-manager-operator

OCPBUGS-63166: ccm: disable unused secure-serving port and webhook #421
OCPBUGS-60015: Add Service using common resource templating #405
OCPBUGS-60015: Update service selector to match deployment label #403
Full changelog

cluster-config-api

CNTRLPLANE-1610: Add feature gates for StreamingCollectionEncoding #2528
OCPBUGS-52347: Add CEL validation for RegistrySources in Image API #2218
OCPBUGS-60904: MachineOSConfig name should match MachineConfigPool #2458
Update crd-schema.json to release 1.33 branch #2459
: add OnClusterBuilds to default config #2365
Full changelog

cluster-etcd-operator

OCPBUGS-61235: Vendor latest mixin, including additional and modified alerts for etcdDatabaseQuotaLowSpace #1478
OCPBUGS-59992: fix ordering on bootstrap IP selection #1458
OCPBUGS-59803: add missing ports to svc and pod spec #1455
OCPBUGS-56834: etcd pod containers do not start when tls min version is 1.3 #1428
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-63119: SCC: add hostmount-anyuid-v2 #1937
OCPBUGS-61039: Set goaway chance to 0.001 #1912
OCPBUGS-60176: Add missing service ports to apiserver service #1888
Full changelog

cluster-kube-controller-manager-operator

OCPBUGS-60131: Missing endpoint slices for open ports the operator uses #852
Full changelog

cluster-monitoring-operator

OCPBUGS-62852: Add mcd_local_unsupported_packages metric from MCO to telemetry 4.18 #2702
OCPBUGS-63410: [release-4.18] allow using remoteWrite[].oauth2.proxyFromEnvironment for cluster-wide proxy #2724
OCPBUGS-63017: test: remove image registry e2e tests #2711
OCPBUGS-61706: chore(jsonnet): use prometheus_remote_storage_queue_highest_timestamp_seconds in PrometheusRemoteWriteBehind #2669
OCPBUGS-59962: operator: increase wait time till degraded to max 4 times 5m #2633
Full changelog

cluster-network-operator

OCPBUGS-62671: Add drop flows for GARP #2810
OCPBUGS-60984: Update CNO reviewers/approvers #2766
OCPBUGS-60795: Add release version annotation to whereabouts-controller/whereabouts-token-watcher #2782
OCPBUGS-47651: Re-disable metrics server #2622
Full changelog

cluster-node-tuning-operator

OCPBUGS-63450: Do not cause kubelet failed dependency by ocp-tuned-one-shot.service #1417
And 3 elided commits (e.g. from squash or rebase merges)
Full changelog

cluster-olm-operator

OCPBUGS-57767: fix olm.maxOpenShiftVersion float parsing #125
Full changelog

cluster-samples-operator

OCPBUGS-63511: references to github.com/sclorg/django-ex.git now also refer to the branch #657
Full changelog

cluster-storage-operator

OCPBUGS-62666: Move metrics to vsphere driver #632
Full changelog

cluster-version-operator

OCPBUGS-62869: disable metrics auth for hypershift clusters #1242
OCPBUGS-58450: Failing=Unknown upon long CO updating #1211
OCPBUGS-60222: CVO protects /metrics with authorization #1223
Full changelog

console

OCPBUGS-63657: Remove required flag from ‘console.flag/model’ pipelines-plugin extension #15654
OCPBUGS-63247: fix bug where Roles list was displaying invalid data f… #15619
OCPBUGS-63041: switch to dev perspective for /dev-monitoring #15601
OCPBUGS-44156: bump dompurify to latest #15589
OCPBUGS-62326: /auth/error?error=missing_state&error_type=auth is showing blank page #15544
OCPBUGS-61569: Update CHANGELOG for 4.18 plugin SDK package publish #15516
OCPBUGS-61569: Fix bug with Console provided PatternFly shared modules #15479
OCPBUGS-61697: Remove ancient X-XSS-Protection header #15493
OCPBUGS-60236: Make sure CSP violations are only reported to telemetry once per day per browser #15453
NO-JIRA: Update CHANGELOG for latest 4.18 plugin SDK package publish #15456
OCPBUGS-50983: Store Topology sidebar alert in the localStorage #15431
OCPBUGS-54660: Added patternfly/react-topology to shared module list of dynamic plugin sdk #15371
OCPBUGS-50570: Fix regression where plugins were not tracking CSP violation status a… #14754
OCPBUGS-60140: Recognize Detached BMH status #15362
OCPBUGS-54660: Add BaseNode in topology folder into Dynamic Plugin SDK #15369
: OCPBUGS-60278: Fix i18n string for event stream #15403
OCPBUGS-54660: Expose OdcBaseNode through the dynamic plugin SDK #15370
OCPBUGS-54660: Expose topology components and utils via plugin SDK internal package #14777
OCPBUGS-58364: change ‘/metrics/usage’ endpoint to ‘/api/metrics/usage’ #15272
OCPBUGS-59778: add data-test attrs to console plugins table #15327
OCPBUGS-59786: Update the golang.org/x/crypto/ssh to 0.31.0 in the openshift-console image #15330
OCPBUGS-59501: Add the Origin header to the HeaderBlacklist in the co… #15295
OCPBUGS-59443: Not able to launch terminal window from OCP web console due to console plugin conflicts #15290
OCPBUGS-59446: Cannot read properties of undefined (reading ‘node-role.kubernetes.io/master’) error while accessing node logs from console #15292
OCPBUGS-58457: fix bug where / in console.tab/horizontalNav href brea… #15250
OCPBUGS-58203: OpenShift console PVC clone cannot use B as the unit #15215
OCPBUGS-58317: Implement sessions in openshift authenticator #15237
OCPBUGS-58088: Cannot read properties of undefined (reading ‘filter’) error while accessing nodes from console. #15202
OCPBUGS-58089: Getting “Oh no something went wrong” error message in web console. #15203
OCPBUGS-57931: Add the ability to launch multiple modals with useModal hook #15196
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

console-operator

NETOBSERV-2023, OCPBUGS-60304: Implement a quickstart for netobserv operator #997
OCPBUGS-60081: Fetch synced CM for the CertificateAuthority issuer + Wire synced OIDC Auth CM to Console #1031
OCPBUGS-59786: Update the golang.org/x/crypto/ssh to 0.31.0 in the openshift-console image #1027
And 2 elided commits (e.g. from squash or rebase merges)
Full changelog

container-networking-plugins, containernetworking-plugins-microshift

OCPBUGS-60871: [release-4.18] host-device: Return interface name in result #208
OCPBUGS-56928: bridge: Add option to enable port isolation #203
Full changelog

coredns

OCPBUGS-60462: UPSTREAM: 7083 and 6836: Fix failing TestZoneExternalCNAMELookupWithProxy #152
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-57800: Rebase release-4.18 onto release-1.31 #322
OCPBUGS-58835: CARRY: don’t ignore json files #339
Full changelog

csi-external-resizer

OCPBUGS-62467: Requeue PVC over PV creation #176
Full changelog

csi-external-snapshotter, csi-snapshot-controller, csi-snapshot-validation-webhook

OCPBUGS-63574: UPSTREAM: 1303: Fix requeueing snapshot content after deletion error #190
Full changelog

csi-node-driver-registrar

OCPBUGS-63324: update log level verbosity to not clutter logs #89
Full changelog

docker-registry

IR-526: remove AWS region check #437
Full changelog

etcd

OCPBUGS-57112: Updating ose-etcd-container image to be consistent with ART for 4.18 #333
Full changelog

gcp-cluster-api-controllers

OCPBUGS-58861: Update manifests to remove reliance on admission registration v1beta1 #247
Full changelog

gcp-machine-controllers

OCPBUGS-59387: Add max-concurrent-reconciles flag to machine actuator #126
Full changelog

hyperkube, kube-proxy, pod

OCPBUGS-61773: UPSTREAM: <carry>: backporting fix for concurrent map iteration and write #2456 #2475
CNTRLPLANE-1610: Backport StreamingCollectionEncoding for JSON and protobuf #2483
OCPBUGS-61557: Rebase v1.31.13 #2465
Revert “UPSTREAM: revert<carry>: Mark admissionregistration.k8s.io/v1beta1 as deprecated.”” #2448
OCPBUGS-60511: Bump to v1.31.12 #2440
OCPBUGS-60524: podresources: list: use active pods #2413
UPSTREAM: revert<carry>: Mark admissionregistration.k8s.io/v1beta1 as deprecated.” #2422
OCPBUGS-57488: UPSTREAM: <carry>: Mark admissionregistration.k8s.io/v1beta1 as deprecated. #2333
OCPBUGS-57499: UPSTREAM:131579: fix(kubelet): acquire imageRecordsLock when removing image #2399
OCPBUGS-44757: Adjust NodeMonitorGracePeriod to 50s #2385
OCPBUGS-59535: Rebase v1.31.11 to 4.18 #2377
OCPBUGS-57887: Update to Kubernetes v1.31.10 #2348
Full changelog

hypershift

OCPBUGS-63034: [release-4.18] Update DNS names for ovn-kubernetes cp metrics #7025
OCPBUGS-63369: Make the hypershift CLI binary FIPS-compliant #7093
OCPBUGS-62808: Fix driver-config ConfigMap content flapping due to random ordering #6944 #6947
CNTRLPLANE-1424: feat(konflux): tag MCE HO images with latest #6837
OCPBUGS-62816: set default goaway-chance to 0.001 #6950
OCPBUGS-61904: resolve MIRRORED_RELEASE_IMAGE flapping #6858
OCPBUGS-61700: Sync RBAC for expansion support in kubevirt CSI driver #6355
OCPBUGS-61568: [release-4.18] fix(proxy): ensure URLs have scheme before proxy resolution #6793
OCPBUGS-61203: ci: konflux multi-arch images #6867
OCPBUGS-61203: Use the common konflux pipeline and update CLI dockerfile #6832
NO-JIRA: chore(deps): update konflux references #6667
OCPBUGS-57142: [release-4.18] HCP payload doesn’t respect multiple mirrors #6672
OCPBUGS-60485: feat(validations): add wildcard support to DNS SAN conflict detection #6649
OCPBUGS-60148: Always compress and encode payload in token secret for inplace upgrades #6721
OCPBUGS-60923: MCE 2.8 konflux for hcp-cli #6700
CNTRLPLANE-1333: New API to support specifying cluster-autoscaler flags #6641
OCPBUGS-60458: Update PSA from v1beta1 to v1 #6644
CNTRLPLANE-1269: chore(deps): update konflux references #6658
CNTRLPLANE-1205: Add missing mce-2.8 pipeline #6656
OCPBUGS-59503: [release-4.18] Support proxy authentication when user/pass is included in URL #6460
CNTRLPLANE-1229: Move CPO pipeline to hermetic builds #6597
OCPBUGS-57818: Reuse hosted cluster release and metadata providers #6301
OCPBUGS-58126: Don’t use /version for haproxy health checks #6323
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-58741: bump github.com/golang/glog to version v1.2.4 #104
Full changelog

ibm-vpc-block-csi-driver-operator

OCPBUGS-55297: [IBM VPC] set offlineExpansion to false in e2e test manifest #144
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-51825: CVE-2025-22869 Update golang.org/x/crypto to patched OpenShift fork #120
OCPBUGS-58861: Update manifests to remove reliance on admission registration v1beta1 #119
Full changelog

ibmcloud-machine-controllers

OCPBUGS-47135: CVE-2024-45338 ose-ibmcloud-machine-controllers-container: Non-linear parsing of case-insensitive content in golang.org/x/net/html [openshift-4.18] #69
Full changelog

insights-operator

OCPBUGS-61972: add missing permissions for replicasets and events #1146
And 5 elided commits (e.g. from squash or rebase merges)
Full changelog

ironic

OCPBUGS-62647: Bump sushy to include etag fix #701
Full changelog

kube-rbac-proxy

OCPBUGS-60930: fix(go.mod): bump golang.org/x/crypto/ssh to 0.31.0 #125
Full changelog

kube-storage-version-migrator

NO-JIRA: Add DOWNSTREAM_OWNERS (release 4-18). #225
Full changelog

kubevirt-csi-driver

OCPBUGS-63670: Add awels as an approver in 4.18 branch #73
OCPBUGS-61700: Implement volume expansion #71
Full changelog

machine-api-operator

OCPBUGS-59387: Enabled 10 concurrent reconciles on GCP #1392
Full changelog

machine-config-operator

OCPBUGS-62294: Make static DNS with DHCP IP work #5311
OCPBUGS-63346: Invalid architecture value found in annotation during 4.19 update #5366
OCPBUGS-60111: Enable debug logging for nodeip-configuration #5220
OCPBUGS-62671: [release-4.18] Networking: reset ovn-remote config and allow ovnkube controller to set it #5325
OCPBUGS-62845: Recheck generatedByControllerVersion annotation prior to deleting a degraded MC #5341
OCPBUGS-62499: Add /etc/docker/certs.d to template #5320
OCPBUGS-62637: Machine-config controller should actively manage cordon while draining #5322
OCPBUGS-62350: Add mcd_local_unsupported_packages recording rule #5315
OCPBUGS-62321: Add control-plane label for master nodes on legacy clusters #5314
OCPBUGS-61840: Override NMState service definition #5288
OCPBUGS-57357: Race in configure-ovs.sh affects bonding interface configuration. #5118
OCPBUGS-59929, OPNET-681: Support migration to NMState #5207
OCPBUGS-60034: Add workaround fix for static pod race #5212
OCPBUGS-56751: Support NODEIP_HINT in IPI deployments too #5081
OCPBUGS-55246: kubelet: readonly mounts for criometricsproxy #4998
OCPBUGS-58067: Ensure the build controller restarts on upgrade #5140
OCPBUGS-57328: Do not set cpu system reserve below the default value #5152
OCPBUGS-56624: Give keepalived container chroot cap #5073
OCPBUGS-58044: Boot image controller should correctly handle marketplace boot images #5138
OCPBUGS-57935: add MachineConfiguration to CO related objects #5134
Full changelog

monitoring-plugin

NO-JIRA: update i18n strings #508
OCPBUGS-60199: feat: add alerting rules tab to dev console #493
OCPBUGS-54314: Fix “Export as CSV” #461
Full changelog

multus-admission-controller

OCPBUGS-58771: Update the github.com/golang/glog module to v1.2.4 #101
Full changelog

multus-networkpolicy

OCPBUGS-54939: [release-4.18]: Support default ports value #68
Full changelog

multus-whereabouts-ipam-cni

OCPBUGS-59697: Prevent accidental IP deallocation in statefulsets #376
OCPBUGS-58360: The node slice controller should only process valid whereabouts confi… #381
OCPBUGS-58360: Add nodeslicecontroller bin to dockerfile #373
Full changelog

must-gather

OCPBUGS-46437: Separate resources with comma to fix malformed inspect #470
Full changelog

network-interface-bond-cni

OCPBUGS-62793: Use netlinksafe instead of netlink to avoid netlink.ErrDumpInterrupted #99
OCPBUGS-58095: Bump github.com/containernetworking/plugins from to 1.7.1 #79
Full changelog

network-metrics-daemon

OCPBUGS-58781: Bump github.com/golang/glog to v1.2.4 (#111) #111
OCPBUGS-60174: Replace e2e test image (#120) #120
Full changelog

networking-console-plugin

OCPBUGS-60178: Fix ingress details #264
OCPBUGS-60124: Fix requiremenets with no value #259
OCPBUGS-57286: Fix pod context #251
Full changelog

oauth-apiserver

OCPBUGS-63050: (bugfix): useroauthaccesstokens: cast delete validation object to correct type for admission #149
Full changelog

oauth-proxy

OCPBUGS-61444: Update x/crypto to v0.31.0 #333
OCPBUGS-57172: 4.18 kube 1.31 #317
OCPBUGS-58312: fix e2e tests #325
Full changelog

oauth-server

OCPBUGS-57300: Updating oauth-server-container image to be consistent with ART for 4.18 #186
Full changelog

oc-mirror

OCPBUGS-62696: v2/cli: show binary version in output #1286
OCPBUGS-62711: generate the archive only after mirroring #1287
OCPBUGS-62432: changes the warning message of 4.21 #1278
And 9 elided commits (e.g. from squash or rebase merges)
Full changelog

olm-catalogd

OCPBUGS-62872: set the SElinux type #139
Full changelog

olm-operator-controller

OCPBUGS-62872: set the SElinux type #509
And 2 elided commits (e.g. from squash or rebase merges)
Full changelog

openshift-apiserver

OCPBUGS-58461: Wire dry run option to Image API server operations #531
OCPBUGS-56609: Fix image reference in TestImageStreamImportQuayIO #514
Full changelog

openshift-controller-manager

OCPBUGS-61002: legacy image pull secret rollback controller #411
OCPBUGS-57949: ignore error failing to find pull/push secrets #399
Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

OCPBUGS-61364: [4.18] e2e stability fixes #1080
OCPBUGS-60644: Add NetworkPolicy as a supported kind #1048
OCPBUGS-59421: 🐛 add catalog-operator control-plane-specific tolerations to unpack jobs #1040
OCPBUGS-58882: Reduce Frequency of Update Requests for Copied CSVs (#3597) #1034
OCPBUGS-57427: reduce cache expiry frequency [release-4.19] #1020
Full changelog

operator-marketplace

OCPBUGS-62218: Remove Expect func so that the test case can use the retry logic #669
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-63459: Branch Sync release-4.19 to release-4.18 [10-22-2025] #2825
OCPBUGS-63716: Skip Pending pods in EgressIP status updates #2836
OCPBUGS-48710: [release-4.18] DownStream Merge Sync from 4.19 [10-16-2025] #2811
OCPBUGS-62671: Fix EgressIP stale GARP post reboot + pod restart #2775
OCPBUGS-59744, OCPBUGS-61455: [4.18] allow default network -> localnet on the same node for any localnet subnet #2785
OCPBUGS-61748: [release-4.18] DownStream Merge Sync from 4.19 [10-02-2025] #2777
OCPBUGS-59680: [release-4.18] DownStream Merge Sync from 4.19 [09-29-2025] #2768
OCPBUGS-48710: Update OWNERS file: Add Patryk/Martin as approvers #2700
OCPBUGS-59371: EIP OVN controller: stop pod config flap #2703
OCPBUGS-59531: EgressIP: fix startup syncer #2690
OCPBUGS-59623: Revert “unpin libreswan version” #2678
OCPBUGS-57318, OCPBUGS-58159: DownStream Merge Sync from 4.19 [06-26-2025] #2646
OCPBUGS-46401, OCPBUGS-48710, OCPBUGS-55263: DownStream Merge Sync from 4.19 [05-28-2025] #2593
Full changelog

powervs-machine-controllers

OCPBUGS-61163: Use OS_GIT_VERSION in Makefile when found (for Konflux builds) #125
Full changelog

prometheus

OCPBUGS-61706: chore: compute highestTimestamp at queryManager level #267
Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

OCPBUGS-58194: Fix: One Alertmanager Config failing blocks all others #335
Full changelog

tests

OCPBUGS-63712: Migrate OCP-32383 to upstream #30443
OCPBUGS-61698: chore(test/extended/prometheus): bump the series limit of total series sent via telemetry from each cluster #30253
OCPBUGS-60511: Bump to latest openshift/kubernetes (v1.31.12) #30230
OCPBUGS-60662: images/tests: Remove rteval #30135
OCPBUGS-60881: Exclude RHEL nodes in verifying that nodes have no unexpected reboots test #30170
OCPBUGS-60881: extended/machines: add –no-pager to journalctl cmds #30180
OCPBUGS-60927: Wait 30s after the upgrade is complete to validate workloads #30179
NO-JIRA: Update extended/networking OWNERS #30089
OCPBUGS-58461: Backport pr 29834 to release-4.18 #29968
OCPBUGS-60066, OCPBUGS-60067: Don’t check for isNoUpgrade #30053
OCPBUGS-60066, OCPBUGS-60067: Tolerate various expected Upgradeable=False conditions #30048
OCPBUGS-57887: Update to Kubernetes v1.31.10 #29941
OCPBUGS-58366: Make EgressIP helper functions more reliable #29950
OCPBUGS-57081: Do not set the MTU when using NetworkAttachementDefinition #29891
OCPBUGS-58044: Boot image controller should correctly handle marketplace boot images #29937
Full changelog

vsphere-cluster-api-controllers

OCPBUGS-61651: Fix unit tests #70
OCPBUGS-58861: [release-4.18] Update manifests to remove reliance on admissionregistration v1beta1 #62
Full changelog

vsphere-problem-detector

OCPBUGS-60784: Check for number of FailureDomain-s in GetVCenter() #189
Full changelog

View changelog in Markdown or change previous release:

Source code for this page located on github