4.21.18

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.21.18-x86_64

Team Approvals:

Tests:

Blocking jobs
- upgrade Succeeded (1 retry) periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Succeeded
- upgrade-minor Succeeded (1 retry) periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Succeeded
Informing jobs
- aws-ovn-serial-1of2 Succeeded periodic-ci-openshift-release-main-nightly-4.21-e2e-aws-ovn-serial-1of2
- aws-ovn-serial-2of2 Succeeded periodic-ci-openshift-release-main-nightly-4.21-e2e-aws-ovn-serial-2of2
- aws-ovn-single-node-upgrade-4.21-micro Succeeded periodic-ci-openshift-release-main-ci-4.21-e2e-aws-upgrade-ovn-single-node
- aws-ovn-upgrade-4.21-micro-fips Succeeded periodic-ci-openshift-release-main-nightly-4.21-e2e-aws-ovn-upgrade-fips
- aws-ovn-upgrade-4.21-micro-fips-no-nat-instance Failed (1 retry) periodic-ci-openshift-release-main-nightly-4.21-e2e-aws-ovn-upgrade-fips-no-nat-instance
  - Attempt 1 Failed
  - Attempt 2 Failed
- azure-ovn-upgrade-4.21-micro Failed (1 retry) periodic-ci-openshift-release-main-ci-4.21-e2e-azure-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Failed
- driver-toolkit Succeeded periodic-ci-openshift-release-main-nightly-4.21-e2e-aws-driver-toolkit
- fips-scan Succeeded periodic-ci-openshift-release-main-nightly-4.21-fips-payload-scan
- gcp-ovn-rt-upgrade-4.21-minor Succeeded periodic-ci-openshift-release-main-ci-4.21-upgrade-from-stable-4.20-e2e-gcp-ovn-rt-upgrade
- hypershift-ovn-conformance-4.21 Succeeded (1 retry) periodic-ci-openshift-hypershift-release-4.21-periodics-e2e-aws-ovn-conformance
  - Attempt 1 Failed
  - Attempt 2 Succeeded
- metal-ipi-ovn-bm Succeeded periodic-ci-openshift-release-main-nightly-4.21-e2e-metal-ipi-ovn-bm
- metal-ipi-ovn-ipv6 Succeeded periodic-ci-openshift-release-main-nightly-4.21-e2e-metal-ipi-ovn-ipv6
- microshift-ovn-conformance-parallel Succeeded periodic-ci-openshift-microshift-release-4.21-periodics-e2e-aws-ovn-ocp-conformance
- microshift-ovn-conformance-serial Succeeded periodic-ci-openshift-microshift-release-4.21-periodics-e2e-aws-ovn-ocp-conformance-serial

Upgrades from:

Untested upgrades: 4.20.18, 4.21.10, 4.21.13, 4.21.14, 4.21.3, 4.21.4, 4.21.5, 4.21.6, 4.21.7, 4.21.9

4.21.17 (changes) - S F F F F S S F S
4.21.16 (changes) - Success
4.21.15 (changes) - Failed
4.21.12 (changes) - Success
4.21.11 (changes) - Success
4.21.8 (changes) - Failed
4.21.2 - Failed
4.21.1 (changes) - Failed
4.21.0 (changes) - Success
4.20.24 (changes) - Failed
4.20.23 (changes) - F S S
4.20.22 (changes) - Success
4.20.21 (changes) - Failed
4.20.20 (changes) - Success
4.20.19 (changes) - Success
4.20.17 (changes) - Failed
4.20.16 (changes) - Failed
4.20.15 (changes) - Success
4.20.0-0.nightly-2026-05-27-183809 (changes) - Success

Upgrades to:

4.22.0-rc.5 (changes) - Failed

Changes from 4.21.2

Created: 2026-05-29 05:27:17 +0000 UTC

Image Digest: sha256:81071b95d587ae2bb8f1d651c0d537d408fc4c86a5d664c7be077edf8ca99603

Components

Kubectl 1.34.1
Kubernetes upgraded from 1.34.2 to 1.34.8
Kubernetes Tests 1.34.1
Red Hat Enterprise Linux CoreOS upgraded from 9.6.20260210-0 to 10.2.20260521-0

The CoreOS links above are for the base CoreOS layer used to build the OpenShift node image and do not contain OpenShift components. This is normally only useful to devs working closely with the CoreOS team. For info about the node image, see the Node Image Info section.

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
EventTTL (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled	Enabled
IngressControllerDynamicConfigurationManager (0 tests)	Disabled	Disabled	Enabled	Enabled	Enabled (Changed)	Enabled (Changed)
KMSEncryptionProvider (0 tests)	Disabled	Disabled	Enabled	Enabled	Disabled (Changed)	Disabled (Changed)
KMSEncryption (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)

Removed images

libvirt-machine-controllers

Rebuilt images without code change

agent-installer-node-agent git e5713826 sha256:b5197bc4896457b44f11db8f60b434c5ba34084bed77e2c4e8eb65ad22a4f310
apiserver-network-proxy git 35ba137a sha256:0f57dc7c0352354b9bcdf327417b90f7081127b9c8eab079f2b446517c0b6b59
aws-cluster-api-controllers git 10ceef5e sha256:28dc2b0080a2a57befb9534ea00a8f7225867b289ef6207b843bd813a9816a8d
aws-karpenter-provider-aws git ff9c8d4e sha256:407fa5b3937d7e1bf3ef83a31de963555b2719ee19a45fe4a30bbf04a9d89330
aws-machine-controllers git 938565c9 sha256:bf36e637c4dbfd41cd26a618644c801f34199d6c3433f789f79d2fd84313f795
aws-pod-identity-webhook git 5cd42ed1 sha256:a281393c3a5b75aae6e128e30a6e8b2e90c6ed3fb2466cb00799eb62c658c9e5
azure-cloud-controller-manager git 83b3f9ec sha256:2cc088637f1d7c809149e8ce8b1b3f455ac5a158be631e9a9790a47521cae4e4
azure-cloud-node-manager git 83b3f9ec sha256:12f4177beaa2511faa9dfb7ca081979744bf57af5a9c08a23e2622e7341aaceb
azure-machine-controllers git b8b8cb1c sha256:4024647f695339c6b513fd857d9725476c2eaf5918bfd035d44e87585d7e08b3
azure-workload-identity-webhook git 3f2a6e0d sha256:2e96f0dbefee936352f2561ea406aec9bb099ef7edc0a2ab5095762060c320f8
baremetal-cluster-api-controllers git 659138fe sha256:dad66ec111258f12519f3c03f712b7cc50e9ee3fcb18fe142428026fecb79454
baremetal-machine-controllers git 4e6a729c sha256:23b8369b7cbfe8e9b2de0ad960644c94c1cb85fd3169c357f7918b8e89ea829a
cluster-autoscaler-operator git dec12ba6 sha256:fe76cdee612727c7c53cc7a1f6be345c76040c00af5ba0f1f8a012a89368c3d4
cluster-bootstrap git dc0d4a5c sha256:24dc599a155c254a29b958cdcc63c300dc2e905c54b55024f4ce188c51051d4a
cluster-cloud-controller-manager-operator git 6148c0cc sha256:039bdf4df8cee7558a767c80a7de3ab74c076052ea99ac8acc1e604d297ac69d
cluster-config-operator git 1eb450a3 sha256:f7fc07f64143122dc13af521afc6fe7e958650cb0a02e25df11a407540c456c5
cluster-control-plane-machine-set-operator git 2dde33fb sha256:5907f76b03b98a480ee0e945cc04bb5159f023285c9d3b211b04fc753e32fec6
cluster-dns-operator git 41a53fed sha256:762e95dd454ffdeb0f486dd6fb0b8a3a2a8f238963ce3f3566025c20a348b29e
cluster-image-registry-operator git b2dfc3bb sha256:be60cd7c8bce7a294942718853832c7e3ec43ac9c79038c6f07c0d8381327c71
cluster-kube-controller-manager-operator git 395de967 sha256:35cab6f128f5f30685e57634e263e884d7c9fb9e1eb242f44603f662026f89e5
cluster-kube-storage-version-migrator-operator git 8a42beeb sha256:fa1b92c640afcd8584534f4a2b9dd540e167f61dd4b3de24a2a71c48ce7146c3
cluster-machine-approver git d864813c sha256:013830c8bd9b835b6d6384faf6fc2d5b466bdb009524490228e54c6a0e78a393
cluster-openshift-controller-manager-operator git 2617a201 sha256:25fdb24053351c02556e310bd741b6f21e370917989fa90fc4bbd319950dcabc
cluster-policy-controller git 8b775487 sha256:c1adea1a9bbe0bb607b36fd996edeeeb33d04badb9c6204ba63bf45a744ea360
cluster-samples-operator git 11ed1942 sha256:1bd07d437f2b397af8afd0c82b3a4a9ccdf7fa44687cb8e532ce407db3ff1a12
cluster-update-keys git b3cae8f2 sha256:113d3d791c1405249d224a921abc10f3547f804e6130953489d5e6611f26e235
configmap-reloader git 16114b8d sha256:255396525941ce1615b061910ffcf327ed518eb72ebe8d2c18b326843c4633ea
container-networking-plugins git 747ad66c sha256:964e46a645317ca7260403d9768e1e9e02f3c228d2e73477dccca7fdeb50724a
containernetworking-plugins-microshift git 747ad66c sha256:27d9c2075a202aa7f2450047b9feb5155324c181a7476f75e1e7b75854b1aef9
coredns git 7486e9e4 sha256:9d189a292563f4173eb3cb534693a4fdc714d0c04255dca0aa7062663e6985ec
csi-external-resizer git d880a1ec sha256:d74620f007a6f6bfa13f18f6d9ee3fea07a4b7de71f63816db7df41cab693fa3
csi-external-snapshot-metadata git af250fdb sha256:ce7d64405af1b538c4c8f6175c05bd925f37e41545707800a031dc1d427d946e
csi-livenessprobe git 78dacb7c sha256:5a600b47f80e86b72bcbc032d5255a0cdc11101d13a4022fdc29077b1f946fb8
csi-node-driver-registrar git d29f3f7a sha256:cdef553ad9d575832bb90464dc0297b0c681a929a0da537ca2393e070ccd3232
docker-registry git 602f51c7 sha256:ff1dbb08130fadba966c3dd9c830ea4721fb59512dee6b89157bee644c27ff69
egress-router-cni git 5e0f8d1b sha256:c7b4c5a2e4c9f89c6f7f317d85691299f2eebaabb022fc75216343959038850a
etcd git 806f690e sha256:c876ef397392a29e2f6b7dd621deb98192e749bd451df92438bdd9e63804ef44
gcp-workload-identity-federation-webhook git d481e5cb sha256:768c702f344142bd7ada39817d4e2b2fc3d1b4374cda36a4634cb9f090514902
ibm-cloud-controller-manager git c566572b sha256:41dc1500b683e4017ce1c51b056de8b8e8025f51db50cf7ee7433f853d1e273a
ibm-vpc-block-csi-driver-operator git 00bc7407 sha256:83a67280999e20bd83a9d0bcd4c6db7113cd2672c6116d83dace45de635edb01
ibmcloud-cluster-api-controllers git f7e3ec30 sha256:c6caca93e0507d5485af9d3f70ecd9397273e3324f957e0fdad8b1436f1cbee0
ironic-agent git ff276c00 sha256:d6cae9f10da892f19585f04d051d875991cec81554331029f9df166f8a1fe42b
ironic-machine-os-downloader git 707c2262 sha256:1b6ec45a5dd54adba84ab12adcb511876b5da7add928f458a4cca8724bb4fb81
ironic-static-ip-manager git b95b05fe sha256:a80a8334f8df8aff6db1a021a6951c655646c39c830390b1dcfe03d4827a8641
kube-rbac-proxy git cd636680 sha256:0299bce77fb9f786465c23efc36aca6557ddea63b9642c2176b17f827addddb2
kube-storage-version-migrator git ce5ff17e sha256:d6d85815fa0e06218630ae5aaefce7820785a7bd91a3f3f36b14b467222391d7
metallb-frr git c82bfaad sha256:d42f86f45961444977e26ca70573a0b277fe16ec3c0dfb6e7d99f34df5046fd5
multus-admission-controller git d95feb67 sha256:17c39d66aa02a88c9b68204baa34b7645c21dc28a5a27d03c578181e48b3a6ca
multus-route-override-cni git 08af4127 sha256:76cc97870f300a96d7216f1706932b5356e4b0164c1e1c057149aed09cef20a2
multus-whereabouts-ipam-cni git d691040e sha256:584ea0a3bee1425e5e18cae02af973ae36d72afdf7abeb1f211ad4971a54ca2f
network-interface-bond-cni git 297eeb43 sha256:913f8d5ba7f363066984113a0b2e971d2599ec4df048e088e1401c1922c33bec
network-metrics-daemon git 844fa588 sha256:f33582ba9aeb6611c1b36a43552386b005bc52a087ae0f75b217e62721692df8
network-tools git d6717e45 sha256:1cbbb3f35e9c50a020bbf1dc2fcea0f8f4ceed6055e4d486a39a9ae8f73fc8b2
nutanix-cloud-controller-manager git 33b7bec6 sha256:408124c49d27fd2e877fe1dc1dffd13afc1c079dfd8b58f6f5212fb3f6e3cbe9
nutanix-machine-controllers git b15a665c sha256:74d0f8310583da1154f3d7fde06556c4e2497773aff6b107dc8b982c8ec70add
oauth-apiserver git 71c41b2d sha256:38a7841001469fb032b704fd0cc60d2d31ad8c812bca324748713a0df2e27ed7
oauth-proxy git 7f518c02 sha256:e5a788eaa921d2d7a1399f1609337cd72a6c34580cddeabdc6517e0c8de071b9
openshift-apiserver git 64dea074 sha256:43df32d00b956e60f840e0ad181397f89cfa2a47058290f4e1b97597376a88cd
openshift-controller-manager git 438d52e7 sha256:7356240f06517499aac45b1e8e6c45babee8e00544b02eb5559ffa4354f7770e
openshift-state-metrics git ab605a4b sha256:f8f77978cb3ae0a47ba22bc25ef8278d4e5e78c738631861ae0cad0f1ba8a8f0
openstack-resource-controller git 70f5ad34 sha256:09261375d7f94c82b928cfae1e1912863f6657e949a9ff27ec4ae70017dce86f
powervs-cloud-controller-manager git 969a04e9 sha256:8e7944ab22f30804aec5aea8bec9f2d7f9d157346f27ee389539ae119a013a4c
powervs-machine-controllers git 551974ef sha256:d133ef9efeb364b228a47b0dda94c7ec969e7e121d6e9efcf7fcbe20b59bbfc9
prom-label-proxy git 610c11b5 sha256:b2c4a8f511caea48b3b311eb78dc56b2b82f6ac811c3ef7707ce6712ae910621
prometheus-alertmanager git 3dbe0b64 sha256:e012bc428fbad0d8b9d9e58c0a6d714c8b8d54874f7d2a87a4157c59c54d0ec2
prometheus-node-exporter git 39d72873 sha256:f6beed81c42773f792daf204cd23f9236be64f88a7e0a0043fe9bd68d3db7c7c
service-ca-operator git e9622ba1 sha256:d8b421878b33313e72a9b21773d8626c17fa8c8acdc89ff4cf7770ac9f5c18ce
volume-data-source-validator git 8b929332 sha256:ed4db23ba805253809fd66a4e4ed68f306979cef20bdd4ce7f73b28adad964b8
vsphere-cloud-controller-manager git f69584d6 sha256:96d8c8caae9e91665d5d199bea165a3528967e7c149a506fcf53877e0b04fa5b
vsphere-problem-detector git a35d685a sha256:949fee78507a9e4f1f7f8bfd448096550f014be4f3fe16359aef8da34282ba27

agent-installer-api-server

OCPBUGS-81843: Mark raw FC/iSCSI multipath members as ineligible #10148
OCPBUGS-81843: Prefer multipath disk in ABI disk selection #10112
OCPBUGS-79580: Fix multi-document YAML parsing for NMStateConfig #10058
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-81642: fix: allow workers to join TNA cluster when 1 master + arbiter are ready #2066
OCPBUGS-77536: Fix root partition before copying IRI registry data #2038
Full changelog

agent-installer-ui

Operators section should not be displayed on review and installation progress pages when no operators are selected (#3751) #3751
Remove Arbiter button (#3749) #3749
OCPBUGS-85541: Bump msw pkg version to 2.13.5 (#3729) #3729
fix monted pull secret parsing (#3727) #3727
OCPBUGS-84235: add pull secret auto populate logic to ABI local UI (#3509) #3509
Allow to install SNO topology (#3722) #3722
OCPBUGS-85261: [release-4.21] OCPBUGS-84147 | [Below the sea UI] Leaky Abstraction: Transient 500 errors exposed during host binding process (#3684) #3684
Remove 2 node arbiter option from the control plane dropdown option (#3680) #3680
OCPBUGS-84608, OCPBUGS-84830, OCPBUGS-84993, OCPBUGS-85009, OCPBUGS-85039: Bump axios to ^1.15.1 (#3690) #3690
MGMT-24152: UI allows editing pull secret in draft cluster (#3674) #3674
Update OWNERS file (#3654) #3654
Bump happy-dom from 20.0.2 to 20.8.9 (#3525) #3525
fix operators list in ABI below the sea (#3599) #3599
OCPBUGS-81589: bump react-router-dom-v5-compat to ^6.30.3 to address CVE-2026-22029 (#3581) #3581
OCPBUGS-83303: bump axios to ^1.15.0 for fixing CVE-2026-40175 (#3583) #3583
OCPBUGS-81587: upgrade lodash and lodash-es to 4.17.23 to address CVE-2025-13465 (#3535) #3535
Add support for release branches in PR workflow (#3528) #3528
populate default values in local ui from infraEnv (#3503) #3503
Full changelog

agent-installer-utils

OCPBUGS-84120: Update OCP version for Konflux #301
OCPBUGS-85526: update konflux references #287
OCPBUGS-83852: Pass environment through to podman #292
OCPBUGS-82588: Update OCP version in Konflux #285
OCPBUGS-82539: Update Konflux references #265
OCPBUGS-81645: Update operator versions #282
OCPBUGS-78393: Update Konflux release version to 4.21.5 #270
OCPBUGS-78188: Add a flag to provide a custom appliance image #273
OCPBUGS-78144: Update to use the 4.21 Catalog #271
OCPBUGS-77538: (Backport) Override prefilled rendezvousIP #263
OCPBUGS-77302: Remove multiple redhat-operator-index catalogs #262
OCPBUGS-77236: Update quay.io/konflux-ci/konflux-vanguard/task-rpms-signature-scan:0.2 Docker digest to 2f3015a #222
OCPBUGS-77220: Update Konflux references #251
OCPBUGS-76590: Update Konflux files to build 4.21.1 #254
Full changelog

aws-cloud-controller-manager

OCPCLOUD-3341: Updates ecr-credential-provider make target #134
Full changelog

aws-ebs-csi-driver

OCPBUGS-80734: Bump google.golang.org/grpc to v1.79.3 #310
Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator

OCPBUGS-85234: Mount writable /tmp in SMB CSI driver #551
OCPBUGS-80844: Bump google.golang.org/grpc to v1.79.3 #539
OCPBUGS-78779: Fix readonly root fs in Azure init containers #528
OCPBUGS-78155: Add only to tags to volume object, if volume is not already tagged #521
Full changelog

aws-kms-encryption-provider

OCPBUGS-80711: Bump google.golang.org/grpc to v1.79.3 #40
Full changelog

azure-cluster-api-controllers

OCPBUGS-80740: Bump google.golang.org/grpc to v1.79.3 #383
Full changelog

azure-disk-csi-driver

OCPBUGS-85285: check for node name in waitForDiskManagedByTobeRemoved #147
UPSTREAM: 3569: OCPBUGS-80741: Bump grpc to v1.79.3 #137
OCPBUGS-78012: 4.21 rebase v1.34.2 #126
Full changelog

azure-file-csi-driver

UPSTREAM: 3023: OCPBUGS-80744: Bump grpc to v1.79.3 #125
Full changelog

azure-kms-encryption-provider

OCPBUGS-80712: Bump google.golang.org/grpc to 1.64.1-sec.1 patch #34
Full changelog

azure-service-operator

OCPBUGS-80713: Bump google.golang.org/grpc to v1.79.3 #28
OCPBUGS-83864: UPSTREAM: <carry>: add openshift/e2e-tests.sh #24
Full changelog

baremetal-installer, installer, installer-artifacts

OCPBUGS-82068: Azure: Sign blob container using user delegated creds #10465
OCPBUGS-84225: ibmcloud: bump vpc-go-sdk and capibm #10514
OCPBUGS-82439: [release-4.21] Mount pullsecret manifest to UI container #10489
OCPBUGS-79074: [release 4.21] - Allow all instance types in the install config for GCP #10417
OCPBUGS-79378: Use correct Project ID with GCP Shared VPC #10423
OCPBUGS-79424: Do not discard NMStateConfig when agent-config is on disk for unconfigured-ignition #10428
OCPBUGS-79421: Fix race condition: wait for agent-register-infraenv before showing UI URL #10425
no-jira: fix SC2328 shellcheck errors #10424
OCPBUGS-77900: Add c8g* to tested_instance_types_aarch64 #10366
OCPBUGS-79375: Don’t auto-calculate RendezvousIP in unconfigured-ignition #10410
OCPBUGS-78696: [release-4.21] : Disable LoadBalancer in cloud config when Octavia is unavailable #10399
OCPBUGS-78241: Increase timeout for waiting control plane #10383
OCPBUGS-77504: fix wavelength zone name regex #10343
OCPBUGS-77551: Increase size of /var/ostreecontainer mount #10346
OCPBUGS-73878: handle SSH rule deletion for Azure private #10225
Full changelog

baremetal-operator

OCPBUGS-82141: Fix PPI for ACM #476
OCPBUGS-65683: OCPBUGS-78835: PR2774 and PR2793 backports [release-4.21] #469
Full changelog

baremetal-runtimecfg

OCPBUGS-77168: Install dbus-tools, needed in pkg/monitor/dnsmasqmonitor.go #383
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-81981: Bump go-jose/go-jose/v4 to v4.1.4 #2271
MCO-1961: Allow multiple machine-os versions #2244
COS-4005: Allow periods in display name labels for version validation #2243
OCPBUGS-77486: Makefile: Strip debugging symbols by default #2211
OCPBUGS-77168: Install subscription-manager in required images #2208
Full changelog

cloud-credential-operator

OCPBUGS-79367: google.golang.org/grpc v1.79.3 #993
OCPBUGS-78199: Fix infrastructure resource name filtering in watch predicate #988
OCPBUGS-71222: test-ext: remove kubernetes module dependency #958
OCPBUGS-74545: Resolve nil pointer exception in hasResourceTags #969
Full changelog

cloud-network-config-controller

OCPBUGS-77154: Refrain from adding Egress IP to public LB backend pool #205
Full changelog

cluster-authentication-operator

OCPBUGS-81677: Do not return error when an IdP returns 500 during a grant check #868
OCPBUGS-74418: Bump library-go to get KMS #847
OCPBUGS-74418: carry test assertion #848
OCPBUGS-74418: Conditionally add the KMS plugin volume mount to the oauth-apiserver container #846
OCPBUGS-74418: Add KMS test scenarios #844
Full changelog

cluster-autoscaler

OCPBUGS-78684: allow clusterapi provider to skip paused resources #410
OCPBUGS-76296: Pick upstream commits to Fix VPA recommender concurrent access panic #404
Full changelog

cluster-baremetal-operator

OCPBUGS-78580: Allow ProvisioningCIDR for unmanaged network #576
OCPBUGS-77418: Fix ironic-proxy service routing for port 6385 #560
OCPBUGS-77035: Update kubebuilder tools to more latest version #558
Full changelog

cluster-capi-controllers

OCPBUGS-80749: Bump google.golang.org/grpc to v1.79.3 #293
Full changelog

cluster-capi-operator

NO-JIRA: Allow sustaining engineering to self serve dependency updates #554
OCPBUGS-80753: Bump google.golang.org/grpc to v1.79.3 #550
Full changelog

cluster-config-api

OCPBUGS-86493: Add labelSelector to MachineSet status for scale subresource #2857
OCPBUGS-83756: fix(config/v1): define constants for authentication types as typed constants #2815
CNTRLPLANE-2796: promote the event-ttl feature #2809
OCPBUGS-82578: [release-4.21] postpone the removal of the DeploymentConfig API #2801
OCPBUGS-74418: Introduce KMSEncryption feature gate #2670
OCPBUGS-76408: Move DynamicConfigurationManager back to TPNU #2703
Full changelog

cluster-csi-snapshot-controller-operator

OCPBUGS-82971: Fix PDB unhealthyPodEvictionPolicy field name #272
Full changelog

cluster-etcd-operator

OCPBUGS-84336: fix(tnf): align Pacemaker kubelet and etcd retry pacing #1604
OCPBUGS-77921: Prefer to remove members where they have another healthy machine in the same failure domain index #1563
OCPBUGS-77097: Wait for revision stability before removing etcd members #1555
Full changelog

cluster-ingress-operator

OCPBUGS-82544: set trustBundleName in Istio global values #1418
OCPBUGS-77432, OCPBUGS-77433: Ensure canary cert matches the default ingress controller’s cert #1367
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-85563: [4.21] operator should not override authentication config serviceAccountIssuer with the default one during the operator initialization #2151
OCPBUGS-85270: fsync static pod cert and manifest writes for crash durability #2144
OCPBUGS-83855: Allow setting the oauthMetadata when auth type is None #2116
OCPBUGS-78548: [release-4.21] : Always set service-account-jwks-uri to LB URL even with custom issuer #2071
OCPBUGS-78784: [4.21] move event-ttl test to its own suite #2073
OCPBUGS-74418: Bump library-go to get KMS #2063
OCPBUGS-77969: Add support for event-ttl cases and go test cases in Kube API Server Operator #2066
OCPBUGS-74418: Carry test assertion #2064
OCPBUGS-74418: Conditionally add the KMS plugin volume mount to the kube-apiserver container #2061
OCPBUGS-74418: Add KMS test scenarios #2054
Full changelog

cluster-kube-scheduler-operator

OCPBUGS-83737: add /var/run/kubernetes as emptyDir #641
CNTRLPLANE-2843: chore: update OWNERS #619
Full changelog

cluster-monitoring-operator

OCPBUGS-80765: bump 4.21 grpc to v1.79.3 #2875
OCPBUGS-74425: Include kube_pod_labels in minimal profile #2797
OCPBUGS-77908: [release-4.21] add app.kubernetes.io/part-of=openshift-monitoring label to thanos-ruler pod #2840
OCPBUGS-76541: Fix NodeRAIDDegraded & NodeRAIDDiskFailure alerts #2815
OCPBUGS-77271: AlertingRule: fix duplicate PrometheusRules after MD5->SHA-224 naming change #2829
Full changelog

cluster-network-operator

OCPBUGS-84169: Handle zero-worker HyperShift clusters in daemonset rollout [4.21 backport] #2972
OCPBUGS-83422: wait for patch port to apply drop garp flows #2946
OCPBUGS-76333: Silence ovnkube-lib.sh to avoid mass of logs to collectors #2900
OCPBUGS-77147: Add config override for openflow-probe #2917
Full changelog

cluster-node-tuning-operator

OCPBUGS-85016: e2e: Add irqbalance StartLimitBurst >= 100 config test #1505
OCPBUGS-81122: CNF-21333: [4.21]:perfprof: enable exec-cpu-affinity by default #1484
OCPBUGS-76375: AA: E2E: LLC: Add tests related to odd cpus #1467
OCPBUGS-77464: E2E: Add test case to check Infrastructure pods affinity #1476
OCPBUGS-78173: workloadhints: use IsVM to skip BM-only tests #1480
Full changelog

cluster-olm-operator

OCPBUGS-80769: Bump google.golang.org/grpc to v1.79.3 #197
OCPBUGS-76269: add resources to clusterOperator relatedObjects #170
OCPBUGS-81311: Fix golangci-lint timeout in CI #189
OCPBUGS-77826: cluster-olm-operator sets Progressing=True during upgrade #177
Full changelog

cluster-openshift-apiserver-operator

OCPBUGS-74418: Bump library-go to get KMS #666
OCPBUGS-74418: Conditionally add the KMS plugin volume mount to the openshift-apiserver container #664
OCPBUGS-74418: Add KMS test scenarios #656
Full changelog

cluster-storage-operator

OCPBUGS-79531: volume-data-source-validator should run on master nodes #687
Full changelog

cluster-version-operator

OCPBUGS-77256: Implement mTLS authentication and authorization for CVO metrics endpoint #1326
Full changelog

console

OCPBUGS-84967: Remove DataViewToolbar wrapper from bottom pagination #16484
OCPBUGS-83287: [release-4.21] CVE-2026-26996 Bump minimatch library #16276
OCPBUGS-85520: Fix create visual connector in Topology #16439
NO-JIRA: enable multi-architecture yarn builds #16420
OCPBUGS-85040: Remove PII from events #16401
OCPBUGS-84967: Add bottom pagination to ConsoleDataView for mobile responsiveness #16396
OCPBUGS-84858: Fix ConsoleDataView filter order: Name and Label shoul… #16386
OCPBUGS-83494: remove dev to admin links as dev monitoring views are enabled #16164
OCPBUGS-83572: fix Developer Sandbox telemetry #16286
OCPBUGS-83418: Fix resource log dropdown TypeError #16281
OCPBUGS-81517: Follow up on fixing the remaining issues in the multi-group impersonation feature #16236
OCPBUGS-81714: Add missing i18n translations for Pagination component #16255
OCPBUGS-79351: Make folder field optional for vsphere #16189
OCPBUGS-79040: Fix incorrect OLMv1 documentation URL #16186
OCPBUGS-81308: Fix VolumeSnapshot and VolumeSnapshotContent tables sorting #16216
OCPBUGS-79037: Fix useOperatorCatalogCategories hook. #16185
OCPBUGS-81330: Fix entire app suspending to load perspective switcher icon #16226
OCPBUGS-81488: Add robots.txt policy to console #16227
OCPBUGS-80931: Hide filter category selector when only one filter exists #16199
OCPBUGS-77246: AsyncComponent type improvements #16058
OCPBUGS-79035: Fix TypeError in OLS code import to console #16184
OCPBUGS-78799: Fix search component to not pass ALL_NAMESPACES_KEY to… #16170
OCPBUGS-79533: enable keyboard shortcut for DataViewTextFilter #16195
OCPBUGS-78927, OCPBUGS-78928: OLM prompts for GCP Workload Identity parameters during Kiali Operato… #16176
OCPBUGS-78308: “Import from Git” should not force HTTPS/443 for Git providers (GitHub/GitLab/Bitbucket) #16050
OCPBUGS-78599: Migrate InstallPlan components table to PatternFly Table #16159
OCPBUGS-78599: Reset pagination page when changing namespace #16158
OCPBUGS-77029: Fixed Metrics page React error #306 by exporting QueryBrowser component #16038
OCPBUGS-77251: Fix editing secrets with mixed text and binary data #16060
OCPBUGS-77561: Fix ConsolePluginStatus icon #16090
OCPBUGS-75000: Clean up old session cookies to prevent accumulation #15985
OCPBUGS-77957: [CI] Fix the VolumeSnapshot CRUD flaky test failures #16118
OCPBUGS-77882: Fix infinite recursion in project access form #16112
OCPBUGS-65948: prep for 4.21 GA SDK publish #16116
OCPBUGS-76385: Workloads - Edit pod count and Edit parallelism : Content is in English #16005
OCPBUGS-76387: DataView Pagination page menus : i18n misses #16007
OCPBUGS-76386: i18n upload/download routine task - 4.21 / 281 (Latest) #16006
OCPBUGS-77430: run and enforce yarn dedupe #16075
CONSOLE-5011: migrate to yarn berry #16059
Full changelog

console-operator

OCPBUGS-86119: Add unit and e2e test coverage for cert rotation redeployment #1162
OCPBUGS-82037: Redeploy console pods upon cert rotation #1139
OCPBUGS-78929: Remove orphaned console-conversion-webhook deployment and related resource #1128
Sync Dockerfile.ocp image #1126
OCPBUGS-72562: Add missing relatedObjects + small refactoring #1090
OCPBUGS-74686: Add rhel8 and rhel9 oc binaries for Linux OS in CLI downloads #1104
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

UPSTREAM-SYNC: Sync release-4.21 with upstream release-1.34 #371
Full changelog

csi-driver-nfs

OCPBUGS-80783: CVE-2026-33186: bump google.golang.org/grpc v1.79.3 #176
Full changelog

csi-external-attacher

OCPBUGS-80784: Bump google.golang.org/grpc to v1.79.3 #102
Full changelog

csi-external-provisioner

OCPBUGS-80785: Bump google.golang.org/grpc to v1.79.3 #132
Full changelog

csi-external-snapshotter, csi-snapshot-controller

OCPBUGS-80788, OCPBUGS-80791: Bump google.golang.org/grpc to v1.79.3 #208
Full changelog

docker-builder

OCPBUGS-70149: bump buildah to 1.39.7 to fix CVE-2025-52881 #495
Full changelog

driver-toolkit

OCPBUGS-78535: Support ubi minimal base image #186
OCPBUGS-77887: Clean up cruft in /var/cache/dnf #183
Full changelog

gcp-cloud-controller-manager

OCPBUGS-83615: Fix OSD ILB bug #108
Full changelog

gcp-cluster-api-controllers

OCPBUGS-80805: Bump google.golang.org/grpc to v1.79.3 #287
Full changelog

gcp-machine-controllers

OCPBUGS-80828: Bump gRPC-Go package for CVE fix #154
Full changelog

gcp-pd-csi-driver

OCPBUGS-80809: Bump google.golang.org/grpc to v1.79.3 in release-4.21 #104
OCPBUGS-77716: Support Downward API node name #101
Full changelog

gcp-pd-csi-driver-operator

OCPBUGS-80808: Bump google.golang.org/grpc to v1.79.3 #184
OCPBUGS-77494: Pass node name to csi-driver container #173
OCPBUGS-77310: Add RBAC permission for node driver to get Node objects #171
Full changelog

haproxy-router

OCPBUGS-80810: Bump google.golang.org/grpc to v1.79.3 #770
OCPBUGS-79374: Lower verbosity for parseIPList empty list logging #752
Full changelog

hyperkube, kube-proxy, pod

OCPBUGS-85500: Bump Kubernetes v1.34.8 to release-4.21 #2665
“OCPBUGS-83608: Bump to k8s v1.34.7” #2647
NO-JIRA: UPSTREAM: <carry>: Add jacobsee and jubittajohn to DOWNSTREAM_OWNERS #2636
OCPBUGS-78991: Bump 1.34.6 to release-4.21 #2634
OCPBUGS-77475: Bump v1.34.5 to release-4.21 #2601
OCPBUGS-76516: Bump v1.34.4 #2590
Full changelog

hypershift

OCPBUGS-86416: set limits for aro.openshift.io/swift-nic in request overrides for ARO swift #8565
OCPBUGS-81671: Ignition generalize image download errors #8158
OCPBUGS-85781: Add AWS ISO domains to konnectivity IsCloudAPI #8531
OCPBUGS-85621: fix CVE-2026-33186 by updating grpc-go #8518
OCPBUGS-83710: fix(kubevirt): filter link-local addresses from EndpointSlice endpoints #8270
OCPBUGS-85538: [release-4.21] Set unhealthyPodEvictionPolicy to AlwaysAllow on all PDBs #8214
OCPBUGS-85538: [release-4.21] CNTRLPLANE-2740: Add KAS liveness readiness sidecar to OAS and OAuth API Server #8213
OCPBUGS-76447: Add UserAgent telemetry to CPO Azure SDK clients #7685
OCPBUGS-81745: [release-4.21] Honor AWS AMI override in NodePool token generation #8170
OCPBUGS-81836: OCPBUGS-81670: fix(cpo-v2): preserve HCCO modifications to OCM Controllers field #8157
OCPBUGS-81490: fix(cpo): skip router LB services for ARO HCP #8135
OCPBUGS-77966: fix: global-pull-secret-syncer pod ~15-minute delay scheduling on new nodes #8129
OCPBUGS-81287: fix(release): allow multiple machine-os component versions #8103
OCPBUGS-81285: fix(releaseinfo): allow periods in version display name regex #8102
OCPBUGS-78933: fix(cpo): Don’t remove HCP Ingress from routes when CapabilityRoute is disabled #8014
CNTRLPLANE-3006: Azure web identity webhook 4.21 #7997
OCPBUGS-78957: fix(hostedcluster): Remove referenced resource annotations regardless of hcp status #7975
OCPBUGS-78473: Fix deadlock when changing release image during initial provisioning #7954
OCPBUGS-78484: fix(catalogs): update catalog image version cap to 4.21 #7956
OCPBUGS-77456: Add dynamic NodePort range validation #7820
OCPBUGS-77647: remove resource limits from Agent CAPI provider #7844
OCPBUGS-78304: Fix context cancel accumulation in getMirrorFromICSPOrIDMS #7891
OCPBUGS-78196: fix(sync-global-pullsecret): compare content ignoring trailing newlines #7914
CNTRLPLANE-2812: feat(aro): Swift support #7826
OCPBUGS-77365: Fix ignition-server pod restarts due to MIRRORED_RELEASE_IMAGE flapping #7834
OCPBUGS-75930: [release-4.21] fix(cpo): Correct route labeling logic for HCP router infrastructure #7641
OCPBUGS-75884: feat(updates): enable CVO metrics access with RHOBS monitoring flag #7632
fix: OCPBUGS-74104: Fix CVE-2025-58183 #7545
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-80815: Bump google.golang.org/grpc to v1.79.3 #146
OCPBUGS-77203: [release-4.21] standardize build paths #121
Full changelog

ibmcloud-machine-controllers

OCPBUGS-77445: [release-4.21] bump vpc go sdk #81
NO-JIRA: Modernize test infrastructure to align with other MAPI providers #84
Full changelog

insights-operator

OCPBUGS-80818: Bump google.golang.org/grpc to v1.79.3 #1285
OCPBUGS-81573: kubeletconfig gatherer #1266
OCPBUGS-79534: [release-4.21] Add OpenTelemetry CR Gatherer #1258
OCPBUGS-76960: Extends the time for the extractor liveness probe #1233
Full changelog

insights-runtime-exporter, insights-runtime-extractor

Updating ose-insights-runtime-extractor-container image to be consistent with ART for 4.21 #78
Updating ose-insights-runtime-exporter-container image to be consistent with ART for 4.21 #77
Updating ose-insights-runtime-exporter-container image to be consistent with ART for 4.21 #75
Updating ose-insights-runtime-exporter-container image to be consistent with ART for 4.21 #71
Updating ose-insights-runtime-extractor-container image to be consistent with ART for 4.21 #72
Revert “Bump Go to 1.25” #73
Bump Go to 1.25 #70
OCPBUGS-77491: remove dnf cache from the container images #64
Fix EAP 8.1 e2e test #65
Full changelog

ironic

OCPBUGS-84853: Bump pyasn to 0.5.1-5 #823
OCPBUGS-82298: Bump sushy hash to include Supermicro ARS-111GL-NHR fix #840
ART-14497: Fix ART builds with -minimal #809
OCPBUGS-76934: Bump keystonemiddleware version to 10.9.0-0.20260216145500.557d173 for CVE-2026-22797 fix #791
OCPBUGS-76474: Update requirements.cachito for 4.21 with heartbeat inspection fix commit #785
Full changelog

keepalived-ipfailover

OCPBUGS-78048: openshift-enterprise-base: remove subscription-manager, dbus, systemd #226
Full changelog

kube-metrics-server

OCPBUGS-80716: Bump google.golang.org/grpc to v1.79.3 #61
Full changelog

kube-state-metrics

OCPBUGS-80823: Bump google.golang.org/grpc to v1.79.3 #138
Full changelog

kubevirt-cloud-controller-manager

OCPBUGS-76994: [release-4.21] Sync Upstream 2026-01-27 #61
Full changelog

kubevirt-csi-driver

OCPBUGS-79038: Add annotation-based fallback for infra VM node ID resolution #83
Full changelog

machine-api-operator

OCPBUGS-86493: Populate status label selector for scale subresource #1501
OCPBUGS-77943: Remove cluster-api-provider-libvirt references #1473
Full changelog

machine-config-operator

OCPBUGS-86216: Fix re-cordon detection #6066
OCPBUGS-86232: Apply password only if changes exist #6068
OCPBUGS-86037: use --delete-if-present for karg removal #6058
OCPBUGS-85645: Add terminationMessagePolicy to build pod containers #6045
OCPBUGS-85386: Fix CVE-2026-34986 #6025
OCPBUGS-85286: Fix Admin Ack message for azure/vsphere clusters upgrading to 4.22 #6017
OCPBUGS-85126: Fix units rollback if update failure #6008
OCPBUGS-84941: Fix ssh and password rollbacks #5987
OCPBUGS-84970: Fix encapsulated IGN version #5996
OCPBUGS-84878: Update AMI Whitelist #5915
OCPBUGS-84253: improve JSON unmarshalling for secret decoding #5877
OCPBUGS-83874: Allow enablement of systemd units with existing files #5869
OCPBUGS-83708: Update AMI Whitelist #5857
OCPBUGS-83390: Use HA leader election defaults for MCO on SNO #5838
OCPBUGS-81711: When adding new nodes, MCD executes commands after setting the nodes’ state as Done #5836
OCPBUGS-79482: Skip boot image updates until cluster is stable #5804
OCPBUGS-79426: Update AMI Whitelist #5798
OCPBUGS-79372: set default-timeout-stop to 200s globally #5793
OCPBUGS-78800: Re-order logger setting to eliminate race condition #5779
OCPBUGS-78528: Fix e2e iri tests #5759
OCPBUGS-78201: kubelet: Less aggressive low memory reservation #5756
OCPBUGS-77833: Update AMI Whitelist #5743
OCPBUGS-77689: Create admin-ack gates for azure/vsphere clusters upgrading to 4.22 #5735
OCPBUGS-77577: Fix failure domain matching during vsphere boot image updates #5727
OCPBUGS-77534: Update AMI Whitelist #5722
OCPBUGS-77354: Clean up vsphere login error logging #5705
OCPBUGS-76555: Remove MCD liveness probe #5651
OCPBUGS-77072: mcd_config_drift not working properly #5675
OCPBUGS-76823: reduce MCO image size #5657
OCPBUGS-76833: Machine-config controller should not log about non-existent pull-secret changes #5659
OCPBUGS-73805: Prevent unnecessary systemd unit disable #5648
Full changelog

machine-image-customization-controller

OCPBUGS-78536: Return error when network data Secret lacks nmstate key #171
OCPBUGS-77031: Add IPA messages for console and SSH login #163
OCPBUGS-77490: Clean up dnf cache to reduce container image size #164
Full changelog

machine-os-images

OCPBUGS-85478: Force rebuild for OCP 4.21 #89
Full changelog

monitoring-plugin

OCPBUGS-79460: immutable bump: fix for CVE-2026-29063 [4.21] #947
OU-1368: reset queries when namespace changes in dev perspective #940
OU-1367: prevent namespace and project desync #937
NO-JIRA: release-4.21 e2e-monitoring and e2e-coo working #904
OCPBUGS-83494: [release-4.21] feat: re enable dev console views #856
OCPBUGS-83304: [release-4.21] openshift4/ose-monitoring-plugin-rhel9: Axios: Remote Code Execution via Prototype Pollution escalation #890
OCPBUGS-82302: [release-4.21] fix: re encode params when redirecting from graph to query-browser #871
OCPBUGS-78358: fix for CVE-2025-69873 #845
NO-JIRA: [release-4.21] e2e-monitoring fixing loop on legacy dashboard #828
OCPBUGS-77227: [openshift-4.21] CVE-2026-25639 openshift4/ose-monitoring-plugin-rhel9:Axios affected by Denial of Service via proto Key in mergeConfig #795
OU-1062: [release-4.21] feat: mark alert menu active for incidents tab #761
NO-JIRA: [release-4.21] simplify frontend build in Dockerfile.art #808
OCPBUGS-74909: fix: update vulnerable dependencies #751
Full changelog

multus-cni, multus-cni-microshift

OCPBUGS-82064: Bump CNI version to 1.1.0 #284
Full changelog

multus-networkpolicy

OCPBUGS-77489: Clean up dnf cache #100
Full changelog

must-gather

OCPBUGS-85050: Collect object size with the object count #542
Full changelog

networking-console-plugin

OCPBUGS-81620: Update lodash to 4.18.1 for CVE-2026-4800 #372
OCPBUGS-83388: Fix CVE-2026-34043 in serialize-javascript #369
OCPBUGS-82161: Migrate to npm #359
OCPBUGS-66283, OCPBUGS-67252, OCPBUGS-70285, OCPBUGS-74473: Fix CVEs via upgrading yarn.lock #346
CNV-59877: Fix permissions request for NADs #353
OCPBUGS-77887: Clean up cruft in /var/cache/dnf #361
OCPBUGS-77225: Fix NAD creation using default namespace instead of selected one #349
Full changelog

oauth-server

OCPBUGS-77454: groupmapper: avoid mutating original group users slice when removing user #213
Full changelog

oc-mirror

OCPBUGS-82546: Only print catalog rebuild message if there are catalogs to rebuild #1388
OCPBUGS-82543: Fix printing collection messages with 0 collection items #1387
OCPBUGS-81743: Remove status field from CatalogSource, ClusterCatalog… #1383
CLID-549, OCPBUGS-78458: Update Dockerfile.tests to run Go integration tests #1371
OCPBUGS-77222: Fix registriesd “unknown userid” failure for arbitrary UIDs #1358
OCPBUGS-76126: Fix reg config detection for explicit false values #1349
OCPBUGS-74981: fix conversion issue for catalog #1346
Full changelog

olm-catalogd, olm-operator-controller

OCPBUGS-81993, OCPBUGS-81994: Bump github.com/go-jose/go-jose/v4 to 4.1.4 #718
OCPBUGS-80839, OCPBUGS-80840: Bump google.golang.org/grpc to v1.79.3 #721
OCPBUGS-79059: update OCP-75441 to support multi-arch[release-4.21] #671
Full changelog

openstack-cluster-api-controllers

UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.13 into release-4.21 #394
Full changelog

openstack-machine-api-provider

OCPBUGS-76789: Fix make test #156
Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

OCPBUGS-81995, OCPBUGS-81996, OCPBUGS-81997: Bump github.com/go-jose/go-jose/v4 to v4.1.4 #1294
OCPBUGS-80847, OCPBUGS-80848, OCPBUGS-80849: Bump google.golang.org/grpc to v1.79.3 for CVE-2026-33186[Release-4.21] #1289
OCPBUGS-79398: Fix SA restore resourceVersion conflict error #1266
OCPBUGS-79400: Fix nil pointer dereference in sortUnpackJobs when sorting non-failed jobs #1265
OCPBUGS-79380: enhance case to make it pass per test bundle change #1263
OCPBUGS-78558: Re-Apply Fix admin context race condition in parallel tests #1261
OCPBUGS-77712: Update NetworkPolicy egress to support HyperShift custom API ports #1246
OCPBUGS-77067: Remove the collect-profiles info from the microshift kustomization file #1234
Full changelog

operator-marketplace

OCPBUGS-77580: Update NetworkPolicy egress to support HyperShift custom API ports #729
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-84923: Branch Sync release-4.22 to release-4.21 [04-27-2026] #3160
OCPBUGS-81634, OCPBUGS-83814: Branch Sync release-4.22 to release-4.21 [04-16-2026] #3145
OCPBUGS-83566: Branch Sync release-4.22 to release-4.21 [03-25-2026] #3087
OCPBUGS-81475: node: fix serviceUpdateNotNeeded nil pointer comparison #3098
OCPBUGS-77257, OCPBUGS-78094: Branch Sync release-4.22 to release-4.21 [03-23-2026] #3080
OCPBUGS-78771: Branch Sync release-4.22 to release-4.21 [03-11-2026] #3050
OCPBUGS-76472: OCPBUGS-72532: Branch Sync release-4.22 to release-4.21 [12-19-2025] #3022
OCPBUGS-77147: Minimize ACLs by combining ipBlocks into single ACL #2995
OCPBUGS-77309: Clear stale conntrack UDP entries for nodePorts #3002
OCPBUGS-77046, OCPBUGS-77086: [release-4.21] combined backport PR for 2 escalations #2984
Full changelog

powervs-block-csi-driver

OCPBUGS-80852: Fix CVE-2026-33186 by bumping google.golang.org/grpc to 1.79.3 #127
OCPBUGS-82924: Fix CVE-2026-35469 by bumping github.com/moby/spdystream to v0.5.1 #121
Full changelog

powervs-block-csi-driver-operator

Updating ose-powervs-block-csi-driver-operator-container image to be consistent with ART for 4.21 #107
OCPBUGS-80853: Fix CVE-2026-33186 by bumping google.golang.org/grpc to v1.79.3 #106
Full changelog

prometheus

OCPBUGS-86250: fix: TLS client cert rotation when no CA is configured #314
OCPBUGS-80855: Bump google.golang.org/grpc to v1.79.3 #309
OCPBUGS-78581: [release-4.21] chore(kubernetes): deduplicate warning logs from the API #298
Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

OCPBUGS-77295: backport upstream fix to reconcile resources with inconsistent status #365
OCPBUGS-74477: Validate webhookURL secret for MSTeams receiver in AlertmanagerConfig CRD #359
Full changelog

rhel-coreos, rhel-coreos-10, rhel-coreos-10-extensions, rhel-coreos-extensions

OCPBUGS-82523: post-process: Remove workaround for openvswitch additional group #1926
- [release-4.21] extensions: Add rhel-9.6-server-ose-4.21 #1914
NO-JIRA: [release-4.21] extensions: Fix repo name to match 4.21 #1913
COS-3946: Backport rhel-10.2 support to release-4.21 branch #1898
NO-JIRA: rhaos-pkgs-match-openshift: exclude known package mismatches #1889
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

route-controller-manager

OCPBUGS-80726: Bump google.golang.org/grpc to v1.79.3 #82
OCPBUGS-76641: filter ingress namespace on UnmanagedRoutes metric #73
Full changelog

telemeter

OCPBUGS-80868: Bump google.golang.org/grpc to v1.79.3 #589
OCPBUGS-81817: [release-1.21] Fix CVE-2026-34986 #593
Full changelog

tests

OCPQE-32041: bump(k8s): move docker types into container package #31169
OCPBUGS-74373: Remove restriction of unmanaged x-k8s.io #30718
OCPBUGS-84655: fix openshift/network/third-party suite selecting zero tests #31091
OCPBUGS-84978: Skip image-registry operator tests for Libvirt platform in upgrade jobs. #31123
OCPBUGS-84947: test: add monitortest to detect pods stuck in Pending state #31117
OCPBUGS-84947: Add [Late] test to collect CRI-O goroutine dumps via SIGUSR1 #31118
OCPBUGS-81638: Manual cherry-pick node swap feature testcases to 4.21 #30973
OCPBUGS-82064: Assert CNI version greater than equal to 1.0.0 #30977
OCPBUGS-81638: Add openshift/disruptive-longrunning testsuite in release-4.21 branch #30976
OCPBUGS-78780: changed http to https for three places to reduce test false positives and false negatives #30902
OCPBUGS-79365: Verify etc pod should start with oom_score_adj as system-node-critical #30916
OCPBUGS-78485: run resource request/limit check early #30879
OCPBUGS-78192: Exclude disruption during NoExecuteTaintManager serial tests #30857
OCPBUGS-78064: Update optimized builds test to use rpm -qa instead of dnf #30856
OCPBUGS-78064: Allow test to tolerate running on minimal images #30852
OCPBUGS-77823: add the missing namespace from managed openshift #30838
OCPBUGS-77826: Remove exception for monitoring OLM Progression condition #30839
OCPBUGS-77097: Add test for CPMS OnDelete strategy with full master replacement #30802
: OCPBUGS-76856:cert tests: mark TLS registry test as informing #30779
OCPBUGS-76529: Fix flakiness in MutableCSINodeAllocatableCount test #30772
OCPBUGS-76955: co/kube-storage-version-migrator reports Available=False in a non-upgrade job #30740
Full changelog

thanos

OCPBUGS-84492: Revert “OCPBUGS-80870: CVE-2026-33186 openshift4/ose-thanos-rhel9: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation [openshift-4.21]” #180
OCPBUGS-80870: CVE-2026-33186 openshift4/ose-thanos-rhel9: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation [openshift-4.21] #174
Full changelog

vsphere-cluster-api-controllers

OCPBUGS-80875: Bump google.golang.org/grpc to v1.79.3 #102
Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

OCPBUGS-80878: Bump google.golang.org/grpc to 1.79.3 #171
Full changelog

vsphere-csi-driver-operator

OCPBUGS-74701: Fix update of stable-generation annotation #330
Full changelog

Node Image Info

Loading node image info, this may take a while ...

Unable to show node image info: too many concurrent oc adm release info --rpmdb/--rpmdb-diff operations (limit 16)

View changelog in Markdown or change previous release:

Source code for this page located on github