4.21.15

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.21.15-x86_64

Team Approvals:

Tests:

Blocking jobs
- upgrade Succeeded periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
- upgrade-minor Succeeded (1 retry) periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Succeeded
Informing jobs
- aws-ovn-serial-1of2 Succeeded periodic-ci-openshift-release-main-nightly-4.21-e2e-aws-ovn-serial-1of2
- aws-ovn-serial-2of2 Succeeded periodic-ci-openshift-release-main-nightly-4.21-e2e-aws-ovn-serial-2of2
- aws-ovn-single-node-upgrade-4.21-micro Failed (1 retry) periodic-ci-openshift-release-main-ci-4.21-e2e-aws-upgrade-ovn-single-node
  - Attempt 1 Failed
  - Attempt 2 Failed
- aws-ovn-upgrade-4.21-micro-fips Succeeded periodic-ci-openshift-release-main-nightly-4.21-e2e-aws-ovn-upgrade-fips
- aws-ovn-upgrade-4.21-micro-fips-no-nat-instance Succeeded periodic-ci-openshift-release-main-nightly-4.21-e2e-aws-ovn-upgrade-fips-no-nat-instance
- azure-ovn-upgrade-4.21-micro Succeeded periodic-ci-openshift-release-main-ci-4.21-e2e-azure-ovn-upgrade
- driver-toolkit Succeeded periodic-ci-openshift-release-main-nightly-4.21-e2e-aws-driver-toolkit
- fips-scan Succeeded periodic-ci-openshift-release-main-nightly-4.21-fips-payload-scan
- gcp-ovn-rt-upgrade-4.21-minor Succeeded (1 retry) periodic-ci-openshift-release-main-ci-4.21-upgrade-from-stable-4.20-e2e-gcp-ovn-rt-upgrade
  - Attempt 1 Failed
  - Attempt 2 Succeeded
- hypershift-ovn-conformance-4.21 Succeeded (1 retry) periodic-ci-openshift-hypershift-release-4.21-periodics-e2e-aws-ovn-conformance
  - Attempt 1 Failed
  - Attempt 2 Succeeded
- metal-ipi-ovn-bm Failed (1 retry) periodic-ci-openshift-release-main-nightly-4.21-e2e-metal-ipi-ovn-bm
  - Attempt 1 Failed
  - Attempt 2 Failed
- metal-ipi-ovn-ipv6 Succeeded periodic-ci-openshift-release-main-nightly-4.21-e2e-metal-ipi-ovn-ipv6
- microshift-ovn-conformance-parallel Succeeded periodic-ci-openshift-microshift-release-4.21-periodics-e2e-aws-ovn-ocp-conformance
- microshift-ovn-conformance-serial Succeeded periodic-ci-openshift-microshift-release-4.21-periodics-e2e-aws-ovn-ocp-conformance-serial

Upgrades from:

Untested upgrades: 4.21.11, 4.21.3, 4.21.4, 4.21.5, 4.21.7, 4.21.9

4.21.14 (changes) - F F S S S S S
4.21.13 (changes) - Failed
4.21.12 (changes) - Success
4.21.10 (changes) - Success
4.21.8 - Success
4.21.6 (changes) - Success
4.21.2 (changes) - Failed
4.21.1 (changes) - Failed
4.21.0 (changes) - Success
4.20.22 (changes) - Success
4.20.21 (changes) - S F S
4.20.20 (changes) - Failed
4.20.19 (changes) - Failed
4.20.18 (changes) - Success
4.20.17 (changes) - Failed
4.20.16 (changes) - Failed
4.20.15 (changes) - Success
4.20.0-0.nightly-2026-05-11-024741 (changes) - Failed Success

Loading changelog, this may take a while ...

Changes from 4.21.8

Created: 2026-05-12 08:58:22 +0000 UTC

Image Digest: sha256:05e69ed54453e3d306b136f52493073073b207f57d0562fe1c8a555bde61aa49

Components

Kubectl 1.34.1
Kubernetes upgraded from 1.34.5 to 1.34.6
Kubernetes Tests 1.34.1
Red Hat Enterprise Linux CoreOS upgraded from 9.6.20260324-0 to 10.2.20260423-0

The CoreOS links above are for the base CoreOS layer used to build the OpenShift node image and do not contain OpenShift components. This is normally only useful to devs working closely with the CoreOS team. For info about the node image, see the Node Image Info section.

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
EventTTL (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled	Enabled

Removed images

libvirt-machine-controllers

Rebuilt images without code change

agent-installer-node-agent git e5713826 sha256:6fc3b7bf876470f361ca4b05ec22542392032bbacc5811739a7f9b8e544d0a59
apiserver-network-proxy git 35ba137a sha256:0386a7b857cfae9aae24735ba57ee72b66eb84428f0ed7046d190cd1b6fab407
aws-cloud-controller-manager git fdc7f3f1 sha256:71283030d3dad8e3bc6ab6e1e34a99a33f65b5d91a01081cfee2fe0505e8bb1f
aws-cluster-api-controllers git 10ceef5e sha256:29bcb0d5f0f50d80557817e6445dfca7e8c2bb5e0897bff18628f9d71cbc9bd1
aws-ebs-csi-driver git 57eebffc sha256:6706869298676b652e089d05095338088a0c5d0df0a521cd80ef593d79529f29
aws-karpenter-provider-aws git ff9c8d4e sha256:80ba33d79951005f0aef5243ca6448e9f55cc0fc2852a3927754225ee937cc8a
aws-kms-encryption-provider git 19e7b623 sha256:e1f2ab1f349931e3251c44a6915a2828b46fd7024d4723f2ff0dd76981975931
aws-machine-controllers git 938565c9 sha256:1ce30e581100bacf07ead338cac71bcf0c7ff14af5102a35acfc96382c97222a
aws-pod-identity-webhook git 5cd42ed1 sha256:d50961d074897412017844c2e1206de7618f1f446aa4d2696a2db4a944193648
azure-cloud-controller-manager git 83b3f9ec sha256:ca27deb3cc32e7b03aea93543f24c96c1acbc67846c4387d3353f0c953724f2a
azure-cloud-node-manager git 83b3f9ec sha256:ab20de834fc39f948d05e6d1c07233c95a09be3f43ae01b77ea6576f214c2fb3
azure-cluster-api-controllers git 5d6af81d sha256:a2b26a70bf03903de7c91f2787cdbee537c146073bb01f38b840e09efd122990
azure-kms-encryption-provider git fe1d311b sha256:77b21653dc5e1a0291ba787f3247f1a45106fdbe0e03c11d6daee41653a74025
azure-machine-controllers git b8b8cb1c sha256:da2b3de5466fe141fde81e3b953e4b350dc33b68671a26a3dccf1c8df1207f7d
azure-workload-identity-webhook git 3f2a6e0d sha256:a456f329872046b5388fab23203d6ec359fd839e7780737a8c0b0ba6881890ec
baremetal-cluster-api-controllers git 659138fe sha256:b86cabf9693c203c710a74386569802e9804cc223d83a13102d17c2cb7422381
baremetal-machine-controllers git 4e6a729c sha256:c1893779a4afc415dbb66da0e25214936b64ed110d7044b3762bacda96fa58b8
baremetal-operator git 9b3a716e sha256:8985880f6366f3bb256acd40b2b4d7c6ed5e938a1973f6d66a549ab2bd876b84
baremetal-runtimecfg git d7e3fc12 sha256:dd998f20ac7a693f19d976246f728aebfe70d0baf4b9d3c3a3d59e40f9d209bd
cloud-network-config-controller git 57db2d05 sha256:0c22ad32e28cb5c27283c34a1ec7850b3857135e858050986b2628503c1588ef
cluster-autoscaler git 838a5957 sha256:4afc80c22e361acb9ae997ff15ea1008db754ea1176662fda5eedfdc63d52e56
cluster-autoscaler-operator git dec12ba6 sha256:b1d9c5e4911a7c56d801a0e74afa68ce8707454dd87420b5bcfbd7ce9ba023e6
cluster-bootstrap git dc0d4a5c sha256:7e0310e1c571701ccb49553e423a52452b920d49fedf3dca0d03461a6bd871e1
cluster-capi-controllers git a957484a sha256:5ecf9d9abeab8f0fa5d567e5b10faee0a79a9f842ddbc51d9dc18b4842334d07
cluster-capi-operator git 80728a61 sha256:7441c709161dfc614f84fe98efbde5b50775ea6b4ee9f1b3e3d1b5b4832b456c
cluster-cloud-controller-manager-operator git 6148c0cc sha256:0b4e4e3313055f6ef522af0a34f9c7249c717404bc3f9eed98202ff41d03b256
cluster-config-operator git 1eb450a3 sha256:ed89826dc40ecc9382fcc6d18b67db5b53fdc812890e24e8b6196673d24bea90
cluster-control-plane-machine-set-operator git 2dde33fb sha256:c1f44c9e181d4b686512e6695847b8b22d7b57b062931727c5df545d006ccde2
cluster-dns-operator git 41a53fed sha256:c8ac28905a6154f793c2e418177b063b2deb5f070f754bb678f2213dfa2ed7c1
cluster-etcd-operator git 5c38f917 sha256:afc101c1beab508d2dcbddefa6a31259c211d88ae02810aa9accf5ab133ab885
cluster-image-registry-operator git b2dfc3bb sha256:01d26c4448a0a912563fec2d0f627a28abd890c7326a43a236a6469793a7a79b
cluster-kube-controller-manager-operator git 395de967 sha256:de58dffc050e626f0c3c594840d10f4e9093055c7a45d7108563e47224dd54b4
cluster-kube-storage-version-migrator-operator git 8a42beeb sha256:5f25a44bf79d12371fce0ce1fd3128eb66a3225e3d70fdede9aafa89b44e73d3
cluster-machine-approver git d864813c sha256:c1b1d7c0d1627675764fa8e041997d8facb0c43bb5a9962fbb02e82b09221219
cluster-openshift-apiserver-operator git 52fd1773 sha256:2172de57be5d1e4596ea32d557c6851cc3d5207049f0bd852f7883d527476890
cluster-openshift-controller-manager-operator git 2617a201 sha256:08ca04469ed782132b26e24253acf941a985484a8719c09b6893797d1c771a7c
cluster-policy-controller git 8b775487 sha256:fe0a7ce1b26b1c6d8f5a72704560c978ed7b0ac39441c0d8932991ea346a7acf
cluster-samples-operator git 11ed1942 sha256:939581c73948a86af961ff3dc89748daa0cefb4c7f9fdcc3951687a1629a854a
cluster-update-keys git b3cae8f2 sha256:ccf79d4d433c58354c76655aa4d58b87c298a9e46e256617df08bc550c1e1f69
cluster-version-operator git d37e5a05 sha256:79795f53172583f218ba5162a45c4450d36e9e19d67e1feb2677d424f856bda8
configmap-reloader git 16114b8d sha256:4387dcda7cb5654ab680eb98442dc1b30f430d46564efaff573c984a6c089899
container-networking-plugins git 747ad66c sha256:9f195b837108c5f88ce874a3d1960eb2a1a58f621e07a5113c664c0af7acd2b8
containernetworking-plugins-microshift git 747ad66c sha256:694f1f733680b95e48a5cff7d027d32e1cfe012ef8b9371900e2850424650a1e
coredns git 7486e9e4 sha256:8ced13f92744806c8576a3dc9c0b60fa0e3f62a2e52afd626343edffdfbe2526
csi-driver-nfs git 49f2d86f sha256:ae1a786e5ed82a888657ce7ef8dbb4786a90badcb226671a1b74dfcf2ffd7db3
csi-external-attacher git 344669a2 sha256:5a71327f02562172216b7015e1f857951a8b700edef58cba60591bdab68f424f
csi-external-provisioner git f18190fb sha256:cbfb5395935b94530eb41cce5f101905dd643ec52a8063eaefaa41898ac9a1c4
csi-external-resizer git d880a1ec sha256:052cdb541a66e7906ba1ac9ab02e72f37851089e250569933f13edd3b10cf815
csi-external-snapshot-metadata git af250fdb sha256:0f85c1faf91b03aaf6edcc4db02c5e828373d8afda7f54187980bba386896b35
csi-external-snapshotter git 9098db0e sha256:dae7364d9ecbb2bb54273f9885d8b8a710671f33de09acf1f57c2011d5afa969
csi-livenessprobe git 78dacb7c sha256:113020602cd4ea25d8ea86124c5021ecef36b26f5fd02f2c7d67fa65cc523f12
csi-node-driver-registrar git d29f3f7a sha256:6d05923f00d139d7af88170f0ceac49830d0d5f5519cb478f3cff64d95b60abd
csi-snapshot-controller git 9098db0e sha256:ae5ac6686419a78807389311d249773f0ad5440de118b247e79f6dc4a2b83cf8
docker-builder git 48fce231 sha256:249431ccf8e8beb0cdf6efa861565631ca0ab302ca63bbc31605da3b934ed075
docker-registry git 602f51c7 sha256:afdf92dd760966894188d826af2d26123739aa660424541ba7fb13fa16511957
driver-toolkit git f0ae9d12 sha256:82df912bce77d307db924008fff67368716611e69fab89e54eda40e8f5f8fea1
egress-router-cni git 5e0f8d1b sha256:31b0ba3025f4ac681b3132d07795382364d2a8b47ddd882c084a7b9079b9b513
etcd git 806f690e sha256:9eccf507438a7088c3138710e830bb5d606b4ce03ab46ed330e1aaa8a45d1358
gcp-cluster-api-controllers git e2d0c20e sha256:c1e7444fea6520f5a21f25bc8348d0668950e42216206a2932aa911ac32752a7
gcp-machine-controllers git 91f71c9a sha256:02bf76c280377920749be47bd6961fce7e7795ecd6f3d5edff7a66b6f29542db
gcp-pd-csi-driver git 0660d93f sha256:b1fe83e3abfaed8a593e87c6893bac9762c7fd7586547419ca03269792adfd4f
gcp-pd-csi-driver-operator git ddfc0f93 sha256:6627447e7c5076b03a3920fe66b30ee94ea7345cd239c444189405708b2f4db3
gcp-workload-identity-federation-webhook git d481e5cb sha256:b86e859cbbbd4bd954aa35fc7ad4234d9fba95bf1c974616c1cb065888f257c0
haproxy-router git 5949f713 sha256:4c31d04007556770a48a0c2b14c31ef175de41621f999da3022fdbdeb7f7823f
ibm-cloud-controller-manager git c566572b sha256:82c880f252a98dafa87b5da2ef66cab2a94f4973dd8b5c46e62e5880d046c947
ibm-vpc-block-csi-driver git 8fe7dafc sha256:404f129b9dbbc357126744b84eca44bfaf9306a3a08190e2c3090dc0146097b4
ibm-vpc-block-csi-driver-operator git 00bc7407 sha256:25ff006999b67932ed79f1a28f889456c4280d61f0eb3758f084c08f1bbf4003
ibmcloud-cluster-api-controllers git f7e3ec30 sha256:ddf3167a14408cd3772314d419ae98464c5eb4167293ef5ea5c5d96d4fb6636c
ironic git d23a6091 sha256:5f67ec42a51ae35a38b40a44289a872d75b73c9023b652f6dff35b4be46c649c
ironic-agent git ff276c00 sha256:0a3930051bb9fbfdab13599b8b801e36010d43553f710444516a7073e01df694
ironic-machine-os-downloader git 707c2262 sha256:f6d450abc456ddc05066dc7c6a3f88d7ae76dc9c311f73467f78fa9bc4490fba
ironic-static-ip-manager git b95b05fe sha256:e5001ad70573f6512bec4f36571c0b075ea0ed1819e86e2cf96bb1a53037dca1
keepalived-ipfailover git e00f5806 sha256:e2a5a4c26ad3fc44b02b648743f8bf132acfd422744bbe1990212cbf220d10fc
kube-metrics-server git ed76a5e8 sha256:fdda8a9c23bffda50dbe0962254ad37e05871cd37f7fdb5188648cfdb69b1635
kube-rbac-proxy git cd636680 sha256:731316e9d5192651ed8706d614a00dc3cb02dc2c42a208ee2c9ba8426509d329
kube-state-metrics git cb0aa591 sha256:3e16896e17191587358bafc789c2492f07996884a3e5d9d4f22d573b9265ecfe
kube-storage-version-migrator git ce5ff17e sha256:6c0fab8abd53773303e6b70bb5a9a5e6504c2f38ea23068676f81d08b1855a49
kubevirt-cloud-controller-manager git 1e6fdd66 sha256:3743c7393f30937a26abaa80a9e6bd29dc18bce4e819036fc0feec52363b54c4
kubevirt-csi-driver git 4bb70e49 sha256:f8c9cb580bede88b3742c986100c1f16c704de8e4f4245e7c65ebb940919e614
machine-image-customization-controller git 65aeb360 sha256:0b6a33ca04d72fb1d8172e92b65ab7e6b709efce898439f2eefc0b878f80396a
machine-os-images git 9a8e96a6 sha256:2403d3d0b8813c1bd8b94393f9fd9ae4ce7c104a73f1e02d5dcda989a52371f7
metallb-frr git c82bfaad sha256:ef8b3726311bb66d3eba5879ec5d7772a434309b8cd117f8e99d29777ad62931
multus-admission-controller git d95feb67 sha256:6865a35e3752366640146544acaf18171cb96ca7672049bbcbd1d2a6d0946cdb
multus-networkpolicy git e9f2f3c7 sha256:d2b08f933becd9c60b6db0da487ac35c1b5875dd2b74fcad0d1b5e1a91acd80a
multus-route-override-cni git 08af4127 sha256:997817ebde922e4229a31eb0178ac386e6c7eb37e66ae57c9fc17773997d98c4
multus-whereabouts-ipam-cni git d691040e sha256:2a5a1a3c96b15175a0029df3fe1fa586b5ba9d97b814dca7c11c162da18d52d0
must-gather git b4b434c4 sha256:e0150a899cbab0453dba0a22fa8239858db9f572897916f3d57bb2eefcc03efd
network-interface-bond-cni git 297eeb43 sha256:6f0b766d7e0f8d1d86d1ed94fc052da00b14475d60925cc5e59be68c175c6485
network-metrics-daemon git 844fa588 sha256:df88b12305dcc742d7f9c7d3ee3321caf8f9ce2a37508c77506390e794a0ab1b
network-tools git d6717e45 sha256:1d70b68b7ab1cdf468e0b9d8fb688ceef5bea2650df1c4bf98544c1641c82770
nutanix-cloud-controller-manager git 33b7bec6 sha256:b5d73f8f32bc844a2bba2975dfbae582c72825462977ed0876709acbaa786c7b
nutanix-machine-controllers git b15a665c sha256:2dc46fb9c8f7e7275876eb8dd5bc73347b88ff6fda97a3c4485760b83a7c6619
oauth-apiserver git 71c41b2d sha256:4bb5d192d917266afbf48dad2af81212db722a284641341e0259077eff8523e2
oauth-proxy git 7f518c02 sha256:baa393768a6fd88e5c655b1cfdafcc145d0d8465ee301e630d935604da86baa6
oauth-server git 2b818359 sha256:d4e916f6ad6be344a6fa8581bbfdda4ee204f7d6ca1c6caf204b8444b702158d
olm-catalogd git d0f315fc sha256:868c82f97d05ed31830e3f717839007bc64579f81a4d1feb05d5069ef5b1ffad
olm-operator-controller git d0f315fc sha256:61975639be117c63c60f9da50850972c2618112205f9bb755d451ec4c43096d8
openshift-apiserver git 64dea074 sha256:5f2841c5a06f7ed70a0018fea1a5ffd7637d6106ef19730144bd9b82904dd5c0
openshift-controller-manager git 438d52e7 sha256:ddec618075cd449bdac72d86b93d1ffe04531f4c636f4b9368a757923f6ac4c5
openshift-state-metrics git ab605a4b sha256:311760999a05b6c4c1ce8e9fa451e300856504913ce74ea4c8298d2d028ee34d
openstack-cluster-api-controllers git e1c0f2f9 sha256:84e8f5e875b148ab5fc4a9b8e756ae6c7aaca2a76ed46a2550d86319d4ff46b0
openstack-machine-api-provider git b1fdb10f sha256:93b5184566f539c534282ee1355c05efa47928ddd40e9d662bf2cdd226b42fd3
openstack-resource-controller git 70f5ad34 sha256:a5c79981b482ae534ba68398f8a85a01d07507156d3faadbd51bee81d95b81ea
operator-marketplace git efb1a1ea sha256:15fe1cd602ed8eee303e8c0a34c9dde89859bd6ed6c057b496dacf823a7985fc
powervs-cloud-controller-manager git 969a04e9 sha256:c78e4b189e677c387b1432e75e67ed332512975d5de681bc47a07fde0a0676b4
powervs-machine-controllers git 551974ef sha256:9240cd23f65cec60380a9f058b3add60d7e748bc599721700545bd6d43a964e4
prom-label-proxy git 610c11b5 sha256:47b3665645e48f6c747a9a10c365cbf72477c1d3eb012812219407d4b063bb07
prometheus git 59769d91 sha256:14de6df4d382007510d2d393baad1355ddf0aee1292cb1f4a8bd9f54b1dfe9a7
prometheus-alertmanager git 3dbe0b64 sha256:c003a420edd0003626189268a07a3ececa8b914b026ba112929b2ea0c716428c
prometheus-config-reloader git 3de9763f sha256:50435c11e885d11fff418fb0af56ce37fbbe6fdb1fcbad96082dc0a11444507f
prometheus-node-exporter git 39d72873 sha256:f4d6a42d8f53b8447c08deb000d34600ebd1974c66575b08e4f45dc575f8484d
prometheus-operator git 3de9763f sha256:404cf088ea6b02d9f3c3292f8ddf8ee357128ebaf9d70180420b18b27312960e
prometheus-operator-admission-webhook git 3de9763f sha256:fe08cc7f38344d2f9b487f2c0716c3f244168504f4eadc1cbf7f68e112bceb5f
route-controller-manager git 559b7122 sha256:f4ef945a2de564df31f31e2617ee5912949fea900191ed032ae2954b067eafb3
service-ca-operator git e9622ba1 sha256:47cbda63c8be13657b375fc924d53209b424eba96b6f4c9dd84e99df84e2d9a6
telemeter git a54acdfe sha256:a1fc116173bbfc8ab6ca0aa0d36afb21f13b5871c0c0983bdfdff32078ce8b6d
volume-data-source-validator git 8b929332 sha256:61b1d943f1496a6c7a8189e98b992f22886c81e80d87c89944a36b0123cd6aeb
vsphere-cloud-controller-manager git f69584d6 sha256:72b79930b69656ba6e4b65a63b75eb434f71fa16efea434cc51ea0345c7aaf0f
vsphere-cluster-api-controllers git 6626b299 sha256:8906cdbffd2883e901f603241c5e766480a959fd216612c218ce98b53f544897
vsphere-csi-driver-operator git d6a19449 sha256:8b19278aad7b1dc879bd759f3094c33b90869f535cb2931400aea8ad41abfec4
vsphere-problem-detector git a35d685a sha256:74fd45e4935066b0eeff09a62fa8eef1d32c7571ba0cc56442c31e077980d54d

agent-installer-api-server

OCPBUGS-81843: Prefer multipath disk in ABI disk selection #10112
OCPBUGS-79580: Fix multi-document YAML parsing for NMStateConfig #10058
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-81642: fix: allow workers to join TNA cluster when 1 master + arbiter are ready #2066
Full changelog

agent-installer-ui

Update OWNERS file (#3654) #3654
Bump happy-dom from 20.0.2 to 20.8.9 (#3525) #3525
fix operators list in ABI below the sea (#3599) #3599
OCPBUGS-81589: bump react-router-dom-v5-compat to ^6.30.3 to address CVE-2026-22029 (#3581) #3581
OCPBUGS-83303: bump axios to ^1.15.0 for fixing CVE-2026-40175 (#3583) #3583
OCPBUGS-81587: upgrade lodash and lodash-es to 4.17.23 to address CVE-2025-13465 (#3535) #3535
Add support for release branches in PR workflow (#3528) #3528
populate default values in local ui from infraEnv (#3503) #3503
Full changelog

agent-installer-utils

OCPBUGS-83852: Pass environment through to podman #292
OCPBUGS-82588: Update OCP version in Konflux #285
OCPBUGS-82539: Update Konflux references #265
OCPBUGS-81645: Update operator versions #282
Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator

OCPBUGS-80844: Bump google.golang.org/grpc to v1.79.3 #539
Full changelog

azure-disk-csi-driver

UPSTREAM: 3569: OCPBUGS-80741: Bump grpc to v1.79.3 #137
Full changelog

azure-file-csi-driver

UPSTREAM: 3023: OCPBUGS-80744: Bump grpc to v1.79.3 #125
Full changelog

azure-service-operator

OCPBUGS-83864: UPSTREAM: <carry>: add openshift/e2e-tests.sh #24
Full changelog

baremetal-installer, installer, installer-artifacts

OCPBUGS-82439: [release-4.21] Mount pullsecret manifest to UI container #10489
OCPBUGS-79074: [release 4.21] - Allow all instance types in the install config for GCP #10417
OCPBUGS-79378: Use correct Project ID with GCP Shared VPC #10423
Full changelog

cli, cli-artifacts, deployer, tools

MCO-1961: Allow multiple machine-os versions #2244
COS-4005: Allow periods in display name labels for version validation #2243
Full changelog

cloud-credential-operator

OCPBUGS-79367: google.golang.org/grpc v1.79.3 #993
OCPBUGS-78199: Fix infrastructure resource name filtering in watch predicate #988
Full changelog

cluster-authentication-operator

OCPBUGS-81677: Do not return error when an IdP returns 500 during a grant check #868
Full changelog

cluster-baremetal-operator

OCPBUGS-78580: Allow ProvisioningCIDR for unmanaged network #576
Full changelog

cluster-config-api

OCPBUGS-83756: fix(config/v1): define constants for authentication types as typed constants #2815
CNTRLPLANE-2796: promote the event-ttl feature #2809
OCPBUGS-82578: [release-4.21] postpone the removal of the DeploymentConfig API #2801
Full changelog

cluster-csi-snapshot-controller-operator

OCPBUGS-82971: Fix PDB unhealthyPodEvictionPolicy field name #272
Full changelog

cluster-ingress-operator

OCPBUGS-82544: set trustBundleName in Istio global values #1418
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-83855: Allow setting the oauthMetadata when auth type is None #2116
Full changelog

cluster-kube-scheduler-operator

OCPBUGS-83737: add /var/run/kubernetes as emptyDir #641
Full changelog

cluster-monitoring-operator

OCPBUGS-80765: bump 4.21 grpc to v1.79.3 #2875
Full changelog

cluster-network-operator

OCPBUGS-83422: wait for patch port to apply drop garp flows #2946
Full changelog

cluster-node-tuning-operator

OCPBUGS-81122: CNF-21333: [4.21]:perfprof: enable exec-cpu-affinity by default #1484
OCPBUGS-76375: AA: E2E: LLC: Add tests related to odd cpus #1467
OCPBUGS-77464: E2E: Add test case to check Infrastructure pods affinity #1476
Full changelog

cluster-olm-operator

OCPBUGS-76269: add resources to clusterOperator relatedObjects #170
OCPBUGS-81311: Fix golangci-lint timeout in CI #189
Full changelog

cluster-storage-operator

OCPBUGS-79531: volume-data-source-validator should run on master nodes #687
Full changelog

console

OCPBUGS-83494: remove dev to admin links as dev monitoring views are enabled #16164
OCPBUGS-83572: fix Developer Sandbox telemetry #16286
OCPBUGS-83418: Fix resource log dropdown TypeError #16281
OCPBUGS-81517: Follow up on fixing the remaining issues in the multi-group impersonation feature #16236
OCPBUGS-81714: Add missing i18n translations for Pagination component #16255
OCPBUGS-79351: Make folder field optional for vsphere #16189
OCPBUGS-79040: Fix incorrect OLMv1 documentation URL #16186
OCPBUGS-81308: Fix VolumeSnapshot and VolumeSnapshotContent tables sorting #16216
OCPBUGS-79037: Fix useOperatorCatalogCategories hook. #16185
OCPBUGS-81330: Fix entire app suspending to load perspective switcher icon #16226
OCPBUGS-81488: Add robots.txt policy to console #16227
OCPBUGS-80931: Hide filter category selector when only one filter exists #16199
OCPBUGS-77246: AsyncComponent type improvements #16058
OCPBUGS-79035: Fix TypeError in OLS code import to console #16184
OCPBUGS-78799: Fix search component to not pass ALL_NAMESPACES_KEY to… #16170
OCPBUGS-79533: enable keyboard shortcut for DataViewTextFilter #16195
Full changelog

console-operator

OCPBUGS-82037: Redeploy console pods upon cert rotation #1139
OCPBUGS-78929: Remove orphaned console-conversion-webhook deployment and related resource #1128
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

UPSTREAM-SYNC: Sync release-4.21 with upstream release-1.34 #371
Full changelog

gcp-cloud-controller-manager

OCPBUGS-83615: Fix OSD ILB bug #108
Full changelog

hyperkube, kube-proxy, pod

NO-JIRA: UPSTREAM: <carry>: Add jacobsee and jubittajohn to DOWNSTREAM_OWNERS #2636
OCPBUGS-78991: Bump 1.34.6 to release-4.21 #2634
Full changelog

hypershift

OCPBUGS-76447: Add UserAgent telemetry to CPO Azure SDK clients #7685
OCPBUGS-81745: [release-4.21] Honor AWS AMI override in NodePool token generation #8170
OCPBUGS-81836: OCPBUGS-81670: fix(cpo-v2): preserve HCCO modifications to OCM Controllers field #8157
OCPBUGS-81490: fix(cpo): skip router LB services for ARO HCP #8135
OCPBUGS-77966: fix: global-pull-secret-syncer pod ~15-minute delay scheduling on new nodes #8129
OCPBUGS-81287: fix(release): allow multiple machine-os component versions #8103
OCPBUGS-81285: fix(releaseinfo): allow periods in version display name regex #8102
OCPBUGS-78933: fix(cpo): Don’t remove HCP Ingress from routes when CapabilityRoute is disabled #8014
Full changelog

ibmcloud-machine-controllers

OCPBUGS-77445: [release-4.21] bump vpc go sdk #81
NO-JIRA: Modernize test infrastructure to align with other MAPI providers #84
Full changelog

insights-operator

OCPBUGS-81573: kubeletconfig gatherer #1266
OCPBUGS-79534: [release-4.21] Add OpenTelemetry CR Gatherer #1258
Full changelog

insights-runtime-exporter, insights-runtime-extractor

Updating ose-insights-runtime-extractor-container image to be consistent with ART for 4.21 #78
Updating ose-insights-runtime-exporter-container image to be consistent with ART for 4.21 #77
Updating ose-insights-runtime-exporter-container image to be consistent with ART for 4.21 #75
Updating ose-insights-runtime-exporter-container image to be consistent with ART for 4.21 #71
Full changelog

machine-api-operator

OCPBUGS-77943: Remove cluster-api-provider-libvirt references #1473
Full changelog

machine-config-operator

OCPBUGS-83874: Allow enablement of systemd units with existing files #5869
OCPBUGS-83708: Update AMI Whitelist #5857
OCPBUGS-83390: Use HA leader election defaults for MCO on SNO #5838
OCPBUGS-81711: When adding new nodes, MCD executes commands after setting the nodes’ state as Done #5836
OCPBUGS-79482: Skip boot image updates until cluster is stable #5804
OCPBUGS-79426: Update AMI Whitelist #5798
Full changelog

monitoring-plugin

NO-JIRA: release-4.21 e2e-monitoring and e2e-coo working #904
OCPBUGS-83494: [release-4.21] feat: re enable dev console views #856
OCPBUGS-83304: [release-4.21] openshift4/ose-monitoring-plugin-rhel9: Axios: Remote Code Execution via Prototype Pollution escalation #890
OCPBUGS-82302: [release-4.21] fix: re encode params when redirecting from graph to query-browser #871
Full changelog

multus-cni, multus-cni-microshift

OCPBUGS-82064: Bump CNI version to 1.1.0 #284
Full changelog

networking-console-plugin

OCPBUGS-81620: Update lodash to 4.18.1 for CVE-2026-4800 #372
OCPBUGS-83388: Fix CVE-2026-34043 in serialize-javascript #369
OCPBUGS-82161: Migrate to npm #359
OCPBUGS-66283, OCPBUGS-67252, OCPBUGS-70285, OCPBUGS-74473: Fix CVEs via upgrading yarn.lock #346
CNV-59877: Fix permissions request for NADs #353
OCPBUGS-77887: Clean up cruft in /var/cache/dnf #361
Full changelog

oc-mirror

OCPBUGS-82546: Only print catalog rebuild message if there are catalogs to rebuild #1388
OCPBUGS-82543: Fix printing collection messages with 0 collection items #1387
OCPBUGS-81743: Remove status field from CatalogSource, ClusterCatalog… #1383
Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

OCPBUGS-79398: Fix SA restore resourceVersion conflict error #1266
OCPBUGS-79400: Fix nil pointer dereference in sortUnpackJobs when sorting non-failed jobs #1265
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-81634, OCPBUGS-83814: Branch Sync release-4.22 to release-4.21 [04-16-2026] #3145
OCPBUGS-83566: Branch Sync release-4.22 to release-4.21 [03-25-2026] #3087
OCPBUGS-81475: node: fix serviceUpdateNotNeeded nil pointer comparison #3098
OCPBUGS-77257, OCPBUGS-78094: Branch Sync release-4.22 to release-4.21 [03-23-2026] #3080
Full changelog

powervs-block-csi-driver

OCPBUGS-80852: Fix CVE-2026-33186 by bumping google.golang.org/grpc to 1.79.3 #127
OCPBUGS-82924: Fix CVE-2026-35469 by bumping github.com/moby/spdystream to v0.5.1 #121
Full changelog

powervs-block-csi-driver-operator

Updating ose-powervs-block-csi-driver-operator-container image to be consistent with ART for 4.21 #107
OCPBUGS-80853: Fix CVE-2026-33186 by bumping google.golang.org/grpc to v1.79.3 #106
Full changelog

rhel-coreos, rhel-coreos-10, rhel-coreos-10-extensions, rhel-coreos-extensions

OCPBUGS-82523: post-process: Remove workaround for openvswitch additional group #1926
Full changelog

tests

OCPBUGS-81638: Manual cherry-pick node swap feature testcases to 4.21 #30973
OCPBUGS-82064: Assert CNI version greater than equal to 1.0.0 #30977
OCPBUGS-81638: Add openshift/disruptive-longrunning testsuite in release-4.21 branch #30976
OCPBUGS-78780: changed http to https for three places to reduce test false positives and false negatives #30902
Full changelog

thanos

OCPBUGS-84492: Revert “OCPBUGS-80870: CVE-2026-33186 openshift4/ose-thanos-rhel9: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation [openshift-4.21]” #180
OCPBUGS-80870: CVE-2026-33186 openshift4/ose-thanos-rhel9: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation [openshift-4.21] #174
Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

OCPBUGS-80878: Bump google.golang.org/grpc to 1.79.3 #171
Full changelog

Node Image Info

Loading node image info, this may take a while ...

Unable to show node image info: too many concurrent oc adm release info --rpmdb/--rpmdb-diff operations (limit 16)

View changelog in Markdown or change previous release:

Source code for this page located on github