4.21.22

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.21.22-x86_64

Team Approvals:

Tests:

Blocking jobs
- upgrade Succeeded (1 retry) periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Succeeded
- upgrade-minor Succeeded periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
Informing jobs
- aws-ovn-serial-1of2 Succeeded periodic-ci-openshift-release-main-nightly-4.21-e2e-aws-ovn-serial-1of2
- aws-ovn-serial-2of2 Succeeded periodic-ci-openshift-release-main-nightly-4.21-e2e-aws-ovn-serial-2of2
- aws-ovn-single-node-upgrade-4.21-micro Succeeded (1 retry) periodic-ci-openshift-release-main-ci-4.21-e2e-aws-upgrade-ovn-single-node
  - Attempt 1 Failed
  - Attempt 2 Succeeded
- aws-ovn-upgrade-4.21-micro-fips Succeeded periodic-ci-openshift-release-main-nightly-4.21-e2e-aws-ovn-upgrade-fips
- aws-ovn-upgrade-4.21-micro-fips-no-nat-instance Succeeded periodic-ci-openshift-release-main-nightly-4.21-e2e-aws-ovn-upgrade-fips-no-nat-instance
- azure-ovn-upgrade-4.21-micro Failed (1 retry) periodic-ci-openshift-release-main-ci-4.21-e2e-azure-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Failed
- driver-toolkit Succeeded periodic-ci-openshift-release-main-nightly-4.21-e2e-aws-driver-toolkit
- fips-scan Succeeded periodic-ci-openshift-release-main-nightly-4.21-fips-payload-scan
- gcp-ovn-rt-upgrade-4.21-minor Succeeded periodic-ci-openshift-release-main-ci-4.21-upgrade-from-stable-4.20-e2e-gcp-ovn-rt-upgrade
- hypershift-ovn-conformance-4.21 Succeeded (1 retry) periodic-ci-openshift-hypershift-release-4.21-periodics-e2e-aws-ovn-conformance
  - Attempt 1 Failed
  - Attempt 2 Succeeded
- metal-ipi-ovn-ipv4 Succeeded periodic-ci-openshift-release-main-nightly-4.21-e2e-metal-ipi-ovn-ipv4
- metal-ipi-ovn-ipv6 Succeeded periodic-ci-openshift-release-main-nightly-4.21-e2e-metal-ipi-ovn-ipv6
- microshift-ovn-conformance-parallel Succeeded periodic-ci-openshift-microshift-release-4.21-periodics-e2e-aws-ovn-ocp-conformance
- microshift-ovn-conformance-serial Succeeded periodic-ci-openshift-microshift-release-4.21-periodics-e2e-aws-ovn-ocp-conformance-serial

Upgrades from:

Untested upgrades: 4.20.18, 4.20.20, 4.20.21, 4.20.24, 4.21.10, 4.21.11, 4.21.13, 4.21.15, 4.21.16, 4.21.17, 4.21.18, 4.21.3, 4.21.5, 4.21.6, 4.21.7, 4.21.8, 4.21.9

4.21.21 (changes) - F S F F S S S F S
4.21.20 (changes) - Success
4.21.19 (changes) - Success
4.21.14 (changes) - Success
4.21.12 (changes) - Success
4.21.4 (changes) - Success
4.21.2 - Success
4.21.1 (changes) - Failed
4.21.0 (changes) - Failed
4.20.27 (changes) - Success
4.20.26 (changes) - Success Success
4.20.25 (changes) - Success
4.20.23 (changes) - Success
4.20.22 (changes) - Success
4.20.19 (changes) - Success
4.20.17 (changes) - Success
4.20.16 (changes) - Success
4.20.15 (changes) - Success
4.20.0-0.nightly-2026-06-25-035306 (changes) - Success

Upgrades to:

4.22.3 (changes) - Success

Loading changelog, this may take a while ...

Changes from 4.21.2

Created: 2026-06-25 11:13:23 +0000 UTC

Image Digest: sha256:52e54316796bcb6f31212edf0c0c4f89d0383232371d5d0a5cfed1513198b94b

Components

Kubectl 1.34.1
Kubernetes upgraded from 1.34.2 to 1.34.8
Kubernetes Tests 1.34.1
Red Hat Enterprise Linux CoreOS upgraded from 9.6.20260210-0 to 10.2.20260521-0

The CoreOS links above are for the base CoreOS layer used to build the OpenShift node image and do not contain OpenShift components. This is normally only useful to devs working closely with the CoreOS team. For info about the node image, see the Node Image Info section.

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
EventTTL (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled	Enabled
GatewayAPIWithoutOLM (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
IngressControllerDynamicConfigurationManager (0 tests)	Disabled	Disabled	Enabled	Enabled	Enabled (Changed)	Enabled (Changed)
KMSEncryptionProvider (0 tests)	Disabled	Disabled	Enabled	Enabled	Disabled (Changed)	Disabled (Changed)
KMSEncryption (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)

Removed images

libvirt-machine-controllers

Rebuilt images without code change

apiserver-network-proxy git 35ba137a sha256:4d3144adecc95f8a392dd2a6099d63b497b75b8759a0e99a57cdd1cb60a4936b
aws-cluster-api-controllers git 10ceef5e sha256:c8a7cfa92637b9a8a70b18b9c931bcfe4bbeb41b987b63f328cdeb0b0179d51a
aws-karpenter-provider-aws git ff9c8d4e sha256:e06aa063849e955f5acfe133545502919e7325921a9b5bd296714f281bf01f50
aws-machine-controllers git 938565c9 sha256:1d205975ca8046583e57d96ac24879ffb85938692fd4d4d3e8226ee02b9a3540
aws-pod-identity-webhook git 5cd42ed1 sha256:594eb99ea44900ab844d68735bd6694161a571bcc116a592b7de0e2c15f56da3
azure-workload-identity-webhook git 3f2a6e0d sha256:c4cb283c8df87755ae2410a9f2e0e1a3056058b9002c936314368dbdd3212566
baremetal-cluster-api-controllers git 659138fe sha256:be181db6c52496fdc46c1d7c56091510b6cf0f698fce5e5075e747fd3be07241
baremetal-machine-controllers git 4e6a729c sha256:363b21909ebbe5d5764826b45e9839a74a23a2533c36821023f98c58ba316c5a
cluster-autoscaler-operator git dec12ba6 sha256:12bd690428547ef255f5c749f02c5533db307ce0e599f3facb3c5d868da835b0
cluster-bootstrap git dc0d4a5c sha256:8b5ae884c9f60aaa853432118a8b27e48e81eefa5101edcfd08b0092e1dedf06
cluster-cloud-controller-manager-operator git 6148c0cc sha256:934f0a444351d1d13e9487acb001fc0f422ae4607f14d1a74868a213214a381b
cluster-config-operator git 1eb450a3 sha256:5504bfbb8846f5a2bf1287f42a94df688d9137bf17294e210c8c8168c36b1987
cluster-control-plane-machine-set-operator git 2dde33fb sha256:8d56fe22a3b5aa0975b849497b31af95cb251a5198959afe03269a1695a8e641
cluster-dns-operator git 41a53fed sha256:c5ab442edd7d809649c507b5017fe1e6195d842ce5b35bd50c78a2c079c26d8e
cluster-image-registry-operator git b2dfc3bb sha256:6e86615e029401ee874fb03bbc9ff095407b32ab465ccec8f8d5904bbfdd7fdb
cluster-kube-controller-manager-operator git 395de967 sha256:b237c684ba07d1a01a5fbd41439e03157bc9d7968990f2e854824c7100b709bc
cluster-kube-storage-version-migrator-operator git 8a42beeb sha256:0ca9f0fcebb2a5375823ed956e42de9d610bd69abc2121fa6fca6b01fee36274
cluster-machine-approver git d864813c sha256:4e725d653ac5bef6d7d2610fc93a49a4aaa2649999c2d05e8796731245354b34
cluster-openshift-controller-manager-operator git 2617a201 sha256:6756398b03a45038c5c69ddd9783e01b0ba803521accd6e490141c102f696a5a
cluster-policy-controller git 8b775487 sha256:e5b407abad3aaee95db0f10a47c3357aa309b649fc55745db2577545f331a267
cluster-samples-operator git 11ed1942 sha256:6a5b626a67dec931cc0f15341632be7cc7c42235a6e8c7afc10a62328c98bc1c
cluster-update-keys git b3cae8f2 sha256:438a4bda999b85a5ea02dea27617ad211d4329401bd87ab7c3bdfdaa64f1abc5
configmap-reloader git 16114b8d sha256:ff21a4d17417ab4be13d2313aecd8db0b83fec544a84fc25a6a22a84d1207e66
container-networking-plugins git 747ad66c sha256:63886ce6798ec9e787850730969bb8fe80b22a11b6d5ac507df13df95e4c7df6
containernetworking-plugins-microshift git 747ad66c sha256:0096b6416167caf423afa3a7a1f0794ea2115adb3bd1ef883cf78fd2cf613923
coredns git 7486e9e4 sha256:7498c553f93fd705fc382dd1b6bf881d2c33e980cbd5bb45569ecf6244b1e3cd
csi-external-resizer git d880a1ec sha256:cd4ba2370cc2afa22ac265f8b753b2ef042db75409f3e0b66babf389f6ec7f91
csi-external-snapshot-metadata git af250fdb sha256:9f33ecd09efdc054d66f410e06b112a402bef68d08428097461cb601f5170a01
csi-livenessprobe git 78dacb7c sha256:9e1f9dba470e8b8be12e06f3a2a85a36b847903d1eda084b08f9f7c7a7e99557
csi-node-driver-registrar git d29f3f7a sha256:58d9bb705a1bc35c151474144a978cd4c5afe01897677437d236d4b93a20aa39
docker-registry git 602f51c7 sha256:0255b6d09d35e8c4912937161e6e0e46191a360d0feedcad858efed4ee514a65
egress-router-cni git 5e0f8d1b sha256:7744e1cc51f83ec935431bf0ca76e2e20c2e61406164292c202e621cae0a4538
etcd git 806f690e sha256:9a12419f41a0f35367802f195c23013c82a17a940d1abf4cabeacf69bd95dc38
gcp-workload-identity-federation-webhook git d481e5cb sha256:18bc6c9cfd494186e972696661d699b3d7d876c4325431e339e2db359273dd92
ibm-cloud-controller-manager git c566572b sha256:a16b39e815c0c224e2166dc0c2e555e6e7ab2350e562ecdc172b09bced710516
ibm-vpc-block-csi-driver-operator git 00bc7407 sha256:8475297f0eaa7b89f83c499e11bc4835f0dc1156332257e7bb99edc13e92a233
ibmcloud-cluster-api-controllers git f7e3ec30 sha256:87f67d82403dbeb9e0bdf04605f4c8b003394fec0e4bdfc5596b7ebae3ae893c
ironic-agent git ff276c00 sha256:4c617e004a9211ca5f7f2e0b86b95e3df76f9cb3fb1a101c4e742d8f583d7569
ironic-machine-os-downloader git 707c2262 sha256:c8721aa922fb099225ba570ee6d00fd5db0f2aaa820f91dc463f023bcaab5b05
ironic-static-ip-manager git b95b05fe sha256:dc1d369b1e7f4e623d5f199aaed1e59f8d99424ed1e30782e443e0a01f0ca46a
kube-rbac-proxy git cd636680 sha256:6c1c4d4bcbfa2b29b8588b68b7ce022ea65f12bec037d32dd461736b67c45d7b
kube-storage-version-migrator git ce5ff17e sha256:0a51736c481d941f4f88013fb255cbc12422b1ce08747815ac46b68008560eff
metallb-frr git c82bfaad sha256:95a247eb9a8baf92a060568a686cac80efcc71bb9601d7d5d7e3b1a117d6ce69
multus-admission-controller git d95feb67 sha256:10a5b87950c4e86ea8bcb406ae5f6286f5e77251393d3e90cc29a354967120c1
multus-route-override-cni git 08af4127 sha256:009ed0ef2ab1780942e6bce301ba9f0e70cbc8d500453ecfdede00f1747b6a88
multus-whereabouts-ipam-cni git d691040e sha256:49d0fa3a36e33713f4d38de6358ff48e0b9d9074959877ae1253b00b8107beb7
network-interface-bond-cni git 297eeb43 sha256:327a9363d0a88f62216ae676ef3aac49fff99c025c0c843ca881258585a2b5c8
network-metrics-daemon git 844fa588 sha256:69dc26936677bf3f7040c532cdd2c1db2c7a80d417cc1704d77f88ff8071247f
network-tools git d6717e45 sha256:e31f4a7c3fd5406bfc76c12e89609f1db85eff0a520d503ae0f5480424b42dcb
nutanix-cloud-controller-manager git 33b7bec6 sha256:cd4cb3192e8eaea60470e5464c86b49195ccd87cc5e8a7d4dae92df92ffb5bcc
nutanix-machine-controllers git b15a665c sha256:c6ba15e0e1e44392b96205e72dabc32abb5dabd66a1425a6679c6321510ae9e9
oauth-apiserver git 71c41b2d sha256:aa80e261b59ac243e056d136cb529204af0d2a5f2f80a56d015bcf01427f21d1
oauth-proxy git 7f518c02 sha256:e8c8cd28578b5f26e60f5903fc27dcbb811f38891b7205bf443d33b4420223d3
openshift-controller-manager git 438d52e7 sha256:95c4650074384de4c059811ef64f7a4d1df9bb8d65c3495b8b14c672bad41ae9
openshift-state-metrics git ab605a4b sha256:faba74e212d2107e1a62cd990e4eb471b505b357566c6dfedeedcc48f4d28689
openstack-resource-controller git 70f5ad34 sha256:2722348ccf7ee2cb84739874ec7934dced97167bf5eaa4c4df8c0152d4d88a11
powervs-machine-controllers git 551974ef sha256:bb1860feb8f06dd8955689b67b2a2cfb69f6c1c606ef1f64ca60598c42a909bc
prom-label-proxy git 610c11b5 sha256:badb2559fd3a1b761e8a718e2155aacaa7a2e1ec13d7df8e5550e914a23d6519
prometheus-alertmanager git 3dbe0b64 sha256:5d7013b6144fb793db1e725a2c3f9b86cf284ec74cbc0f2e185b36ee4c6d01e3
prometheus-node-exporter git 39d72873 sha256:697b39600de58ef8084140caa98007cb0c591417dabbde0efffc745dd2af7179
service-ca-operator git e9622ba1 sha256:08a460420ea708c7b6492a178d37d4c4d0a0b1d14df914e162830acd52e7d026
volume-data-source-validator git 8b929332 sha256:02eba314aec57a76d7447ca93e0058d0d3cd34bd17cf474e3323d185ba1ed31a
vsphere-cloud-controller-manager git f69584d6 sha256:4620b3d1c5be0595de3d3982785052b8a0b08bf0311227933760350b1c475c2b

agent-installer-api-server

OCPBUGS-86856: Fix loki and logging #10425
OCPBUGS-81843: Mark raw FC/iSCSI multipath members as ineligible #10148
OCPBUGS-81843: Prefer multipath disk in ABI disk selection #10112
OCPBUGS-79580: Fix multi-document YAML parsing for NMStateConfig #10058
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-81642: fix: allow workers to join TNA cluster when 1 master + arbiter are ready #2066
OCPBUGS-77536: Fix root partition before copying IRI registry data #2038
Full changelog

agent-installer-node-agent

OCPBUGS-85041: add –copy-network when manual network config is detected #1446
Full changelog

agent-installer-ui

prefill staticip on ove below the sea (#3769) #3769
Custom manifests are broken in local Assisted UI (#3770) #3770
Operators section should not be displayed on review and installation progress pages when no operators are selected (#3751) #3751
Remove Arbiter button (#3749) #3749
OCPBUGS-85541: Bump msw pkg version to 2.13.5 (#3729) #3729
fix monted pull secret parsing (#3727) #3727
OCPBUGS-84235: add pull secret auto populate logic to ABI local UI (#3509) #3509
Allow to install SNO topology (#3722) #3722
OCPBUGS-85261: [release-4.21] OCPBUGS-84147 | [Below the sea UI] Leaky Abstraction: Transient 500 errors exposed during host binding process (#3684) #3684
Remove 2 node arbiter option from the control plane dropdown option (#3680) #3680
OCPBUGS-84608, OCPBUGS-84830, OCPBUGS-84993, OCPBUGS-85009, OCPBUGS-85039: Bump axios to ^1.15.1 (#3690) #3690
MGMT-24152: UI allows editing pull secret in draft cluster (#3674) #3674
Update OWNERS file (#3654) #3654
Bump happy-dom from 20.0.2 to 20.8.9 (#3525) #3525
fix operators list in ABI below the sea (#3599) #3599
OCPBUGS-81589: bump react-router-dom-v5-compat to ^6.30.3 to address CVE-2026-22029 (#3581) #3581
OCPBUGS-83303: bump axios to ^1.15.0 for fixing CVE-2026-40175 (#3583) #3583
OCPBUGS-81587: upgrade lodash and lodash-es to 4.17.23 to address CVE-2025-13465 (#3535) #3535
Add support for release branches in PR workflow (#3528) #3528
populate default values in local ui from infraEnv (#3503) #3503
Full changelog

agent-installer-utils

OCPBUGS-84120: Update OCP version for Konflux #301
OCPBUGS-85526: update konflux references #287
OCPBUGS-83852: Pass environment through to podman #292
OCPBUGS-82588: Update OCP version in Konflux #285
OCPBUGS-82539: Update Konflux references #265
OCPBUGS-81645: Update operator versions #282
OCPBUGS-78393: Update Konflux release version to 4.21.5 #270
OCPBUGS-78188: Add a flag to provide a custom appliance image #273
OCPBUGS-78144: Update to use the 4.21 Catalog #271
OCPBUGS-77538: (Backport) Override prefilled rendezvousIP #263
OCPBUGS-77302: Remove multiple redhat-operator-index catalogs #262
OCPBUGS-77236: Update quay.io/konflux-ci/konflux-vanguard/task-rpms-signature-scan:0.2 Docker digest to 2f3015a #222
OCPBUGS-77220: Update Konflux references #251
OCPBUGS-76590: Update Konflux files to build 4.21.1 #254
Full changelog

aws-cloud-controller-manager

OCPCLOUD-3341: Updates ecr-credential-provider make target #134
Full changelog

aws-ebs-csi-driver

OCPBUGS-80734: Bump google.golang.org/grpc to v1.79.3 #310
Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator

OCPBUGS-85572: Add init container for Manila node daemonset #554
OCPBUGS-85234: Mount writable /tmp in SMB CSI driver #551
OCPBUGS-80844: Bump google.golang.org/grpc to v1.79.3 #539
OCPBUGS-78779: Fix readonly root fs in Azure init containers #528
OCPBUGS-78155: Add only to tags to volume object, if volume is not already tagged #521
Full changelog

aws-kms-encryption-provider

OCPBUGS-80711: Bump google.golang.org/grpc to v1.79.3 #40
Full changelog

azure-cloud-controller-manager, azure-cloud-node-manager

OCPBUGS-80738, OCPBUGS-80739: Bump google.golang.org/grpc to v1.79.3 #178
Full changelog

azure-cluster-api-controllers

OCPBUGS-80740: Bump google.golang.org/grpc to v1.79.3 #383
Full changelog

azure-disk-csi-driver

OCPBUGS-85285: check for node name in waitForDiskManagedByTobeRemoved #147
UPSTREAM: 3569: OCPBUGS-80741: Bump grpc to v1.79.3 #137
OCPBUGS-78012: 4.21 rebase v1.34.2 #126
Full changelog

azure-file-csi-driver

UPSTREAM: 3023: OCPBUGS-80744: Bump grpc to v1.79.3 #125
Full changelog

azure-kms-encryption-provider

OCPBUGS-80712: Bump google.golang.org/grpc to 1.64.1-sec.1 patch #34
Full changelog

azure-machine-controllers

PIXAA-7: Leverage SpotRebalanceRecommendation for instance termination when available #199
Full changelog

azure-service-operator

OCPBUGS-80713: Bump google.golang.org/grpc to v1.79.3 #28
OCPBUGS-83864: UPSTREAM: <carry>: add openshift/e2e-tests.sh #24
Full changelog

baremetal-installer, installer, installer-artifacts

OCPBUGS-81986: Bump go-jose/v4 to 4.1.4 #10598
OCPBUGS-77049: Update RHCOS-release-4.21 bootimage metadata to 9.6.20260520-0 #10579
OCPBUGS-82068: Azure: Sign blob container using user delegated creds #10465
OCPBUGS-84225: ibmcloud: bump vpc-go-sdk and capibm #10514
OCPBUGS-82439: [release-4.21] Mount pullsecret manifest to UI container #10489
OCPBUGS-79074: [release 4.21] - Allow all instance types in the install config for GCP #10417
OCPBUGS-79378: Use correct Project ID with GCP Shared VPC #10423
OCPBUGS-79424: Do not discard NMStateConfig when agent-config is on disk for unconfigured-ignition #10428
OCPBUGS-79421: Fix race condition: wait for agent-register-infraenv before showing UI URL #10425
no-jira: fix SC2328 shellcheck errors #10424
OCPBUGS-77900: Add c8g* to tested_instance_types_aarch64 #10366
OCPBUGS-79375: Don’t auto-calculate RendezvousIP in unconfigured-ignition #10410
OCPBUGS-78696: [release-4.21] : Disable LoadBalancer in cloud config when Octavia is unavailable #10399
OCPBUGS-78241: Increase timeout for waiting control plane #10383
OCPBUGS-77504: fix wavelength zone name regex #10343
OCPBUGS-77551: Increase size of /var/ostreecontainer mount #10346
OCPBUGS-73878: handle SSH rule deletion for Azure private #10225
Full changelog

baremetal-operator

OCPBUGS-82141: Fix PPI for ACM #476
OCPBUGS-65683: OCPBUGS-78835: PR2774 and PR2793 backports [release-4.21] #469
Full changelog

baremetal-runtimecfg

OCPBUGS-77168: Install dbus-tools, needed in pkg/monitor/dnsmasqmonitor.go #383
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-81981: Bump go-jose/go-jose/v4 to v4.1.4 #2271
MCO-1961: Allow multiple machine-os versions #2244
COS-4005: Allow periods in display name labels for version validation #2243
OCPBUGS-77486: Makefile: Strip debugging symbols by default #2211
OCPBUGS-77168: Install subscription-manager in required images #2208
Full changelog

cloud-credential-operator

OCPBUGS-81982: Bump go-jose/go-jose/v4@v4.1.4 #1027
OCPBUGS-79367: google.golang.org/grpc v1.79.3 #993
OCPBUGS-78199: Fix infrastructure resource name filtering in watch predicate #988
OCPBUGS-71222: test-ext: remove kubernetes module dependency #958
OCPBUGS-74545: Resolve nil pointer exception in hasResourceTags #969
Full changelog

cloud-network-config-controller

OCPBUGS-77154: Refrain from adding Egress IP to public LB backend pool #205
Full changelog

cluster-authentication-operator

OCPBUGS-81677: Do not return error when an IdP returns 500 during a grant check #868
OCPBUGS-74418: Bump library-go to get KMS #847
OCPBUGS-74418: carry test assertion #848
OCPBUGS-74418: Conditionally add the KMS plugin volume mount to the oauth-apiserver container #846
OCPBUGS-74418: Add KMS test scenarios #844
Full changelog

cluster-autoscaler

OCPBUGS-78684: allow clusterapi provider to skip paused resources #410
OCPBUGS-76296: Pick upstream commits to Fix VPA recommender concurrent access panic #404
Full changelog

cluster-baremetal-operator

OCPBUGS-78580: Allow ProvisioningCIDR for unmanaged network #576
OCPBUGS-77418: Fix ironic-proxy service routing for port 6385 #560
OCPBUGS-77035: Update kubebuilder tools to more latest version #558
Full changelog

cluster-capi-controllers

OCPBUGS-80749: Bump google.golang.org/grpc to v1.79.3 #293
Full changelog

cluster-capi-operator

NO-JIRA: Allow sustaining engineering to self serve dependency updates #554
OCPBUGS-80753: Bump google.golang.org/grpc to v1.79.3 #550
Full changelog

cluster-config-api

OCPBUGS-78330, OCPBUGS-82146, OCPBUGS-85550, OCPBUGS-88295, OCPBUGS-88297: NE-2480: Promote GatewayAPIWithoutOLM feature gate to Default #2865
OCPBUGS-78330, OCPBUGS-82146, OCPBUGS-85550, OCPBUGS-88295, OCPBUGS-88297: Promote GatewayAPIWithoutOLM feature gate to TechPreview #2873
OCPBUGS-85149: Backport GatewayAPIWithoutOLM feature gate as disabled #2864
OCPBUGS-86493: Add labelSelector to MachineSet status for scale subresource #2857
OCPBUGS-83756: fix(config/v1): define constants for authentication types as typed constants #2815
CNTRLPLANE-2796: promote the event-ttl feature #2809
OCPBUGS-82578: [release-4.21] postpone the removal of the DeploymentConfig API #2801
OCPBUGS-74418: Introduce KMSEncryption feature gate #2670
OCPBUGS-76408: Move DynamicConfigurationManager back to TPNU #2703
Full changelog

cluster-csi-snapshot-controller-operator

OCPBUGS-82971: Fix PDB unhealthyPodEvictionPolicy field name #272
Full changelog

cluster-etcd-operator

OCPBUGS-90543: fix etcd operator deadlock when etcd-endpoints configmap is stale #1637
OCPBUGS-84336: fix(tnf): gate dual-replica setup and keep retrying #1620
OCPBUGS-84336: fix(tnf): align Pacemaker kubelet and etcd retry pacing #1604
OCPBUGS-77921: Prefer to remove members where they have another healthy machine in the same failure domain index #1563
OCPBUGS-77097: Wait for revision stability before removing etcd members #1555
Full changelog

cluster-ingress-operator

OCPBUGS-78330, OCPBUGS-82146, OCPBUGS-85550, OCPBUGS-88295, OCPBUGS-88297: Remove feature-set annotations from Sail Library RBAC Manifests #1462
OCPBUGS-78330, OCPBUGS-82146, OCPBUGS-85550, OCPBUGS-88295, OCPBUGS-88297: Replace OLM-based Istio install with Sail Library #1442
OCPBUGS-86718: Add configuration override for X-SSL strip #1471
OCPBUGS-85149: Fix e2e tests to work on platforms with unmanaged DNS #1437
OCPBUGS-74373: Remove restriction of unmanaged x-k8s.io #1446
OCPBUGS-86027: Fix logging for unmanaged controllers #1448
OCPBUGS-80759: Authorization bypass due to improper HTTP/2 path validation #1441
OCPBUGS-82544: set trustBundleName in Istio global values #1418
OCPBUGS-77432, OCPBUGS-77433: Ensure canary cert matches the default ingress controller’s cert #1367
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-85563: [4.21] operator should not override authentication config serviceAccountIssuer with the default one during the operator initialization #2151
OCPBUGS-85270: fsync static pod cert and manifest writes for crash durability #2144
OCPBUGS-83855: Allow setting the oauthMetadata when auth type is None #2116
OCPBUGS-78548: [release-4.21] : Always set service-account-jwks-uri to LB URL even with custom issuer #2071
OCPBUGS-78784: [4.21] move event-ttl test to its own suite #2073
OCPBUGS-74418: Bump library-go to get KMS #2063
OCPBUGS-77969: Add support for event-ttl cases and go test cases in Kube API Server Operator #2066
OCPBUGS-74418: Carry test assertion #2064
OCPBUGS-74418: Conditionally add the KMS plugin volume mount to the kube-apiserver container #2061
OCPBUGS-74418: Add KMS test scenarios #2054
Full changelog

cluster-kube-scheduler-operator

OCPBUGS-83737: add /var/run/kubernetes as emptyDir #641
CNTRLPLANE-2843: chore: update OWNERS #619
Full changelog

cluster-monitoring-operator

OCPBUGS-86991: increase lookup interval #2946
OCPBUGS-80765: bump 4.21 grpc to v1.79.3 #2875
OCPBUGS-74425: Include kube_pod_labels in minimal profile #2797
OCPBUGS-77908: [release-4.21] add app.kubernetes.io/part-of=openshift-monitoring label to thanos-ruler pod #2840
OCPBUGS-76541: Fix NodeRAIDDegraded & NodeRAIDDiskFailure alerts #2815
OCPBUGS-77271: AlertingRule: fix duplicate PrometheusRules after MD5->SHA-224 naming change #2829
Full changelog

cluster-network-operator

OCPBUGS-84169: Handle zero-worker HyperShift clusters in daemonset rollout [4.21 backport] #2972
OCPBUGS-83422: wait for patch port to apply drop garp flows #2946
OCPBUGS-76333: Silence ovnkube-lib.sh to avoid mass of logs to collectors #2900
OCPBUGS-77147: Add config override for openflow-probe #2917
Full changelog

cluster-node-tuning-operator

OCPBUGS-90529: perf: latency: compute memory resources dynamically #1521
OCPBUGS-82896: Bump github.com/moby/spdystream from v0.5.0 to v0.5.1 #1531
OCPBUGS-86809: Requeue PerformanceStatus update when status write fails #1524
OCPBUGS-85016: e2e: Add irqbalance StartLimitBurst >= 100 config test #1505
OCPBUGS-81122: CNF-21333: [4.21]:perfprof: enable exec-cpu-affinity by default #1484
OCPBUGS-76375: AA: E2E: LLC: Add tests related to odd cpus #1467
OCPBUGS-77464: E2E: Add test case to check Infrastructure pods affinity #1476
OCPBUGS-78173: workloadhints: use IsVM to skip BM-only tests #1480
Full changelog

cluster-olm-operator

OCPBUGS-80769: Bump google.golang.org/grpc to v1.79.3 #197
OCPBUGS-76269: add resources to clusterOperator relatedObjects #170
OCPBUGS-81311: Fix golangci-lint timeout in CI #189
OCPBUGS-77826: cluster-olm-operator sets Progressing=True during upgrade #177
Full changelog

cluster-openshift-apiserver-operator

OCPBUGS-74418: Bump library-go to get KMS #666
OCPBUGS-74418: Conditionally add the KMS plugin volume mount to the openshift-apiserver container #664
OCPBUGS-74418: Add KMS test scenarios #656
Full changelog

cluster-storage-operator

OCPBUGS-79531: volume-data-source-validator should run on master nodes #687
Full changelog

cluster-version-operator

OCPBUGS-77256: Implement mTLS authentication and authorization for CVO metrics endpoint #1326
Full changelog

console

OCPBUGS-86456: [release-4.21] shell-quote: Arbitrary code execution via command injection due to unescaped line terminators #16536
OCPBUGS-88358: Allow VolumeSnapshot restore when parent PVC is deleted #16602
OCPBUGS-86581: Fix macOS Option key in pod terminal #16505
OCPBUGS-85674: Prevent binary secret data corruption when editing #16448
OCPBUGS-79459: CVE-2026-29063 Immutable.js: Improperly Controlled Mod… #16503
OCPBUGS-86427: Fix Shipwright detail pages crashing with React error #310 #16487
OCPBUGS-86314: Show empty state instead of 403 error for users without projects #16478
OCPBUGS-84967: Remove DataViewToolbar wrapper from bottom pagination #16484
OCPBUGS-83287: [release-4.21] CVE-2026-26996 Bump minimatch library #16276
OCPBUGS-85520: Fix create visual connector in Topology #16439
NO-JIRA: enable multi-architecture yarn builds #16420
OCPBUGS-85040: Remove PII from events #16401
OCPBUGS-84967: Add bottom pagination to ConsoleDataView for mobile responsiveness #16396
OCPBUGS-84858: Fix ConsoleDataView filter order: Name and Label shoul… #16386
OCPBUGS-83494: remove dev to admin links as dev monitoring views are enabled #16164
OCPBUGS-83572: fix Developer Sandbox telemetry #16286
OCPBUGS-83418: Fix resource log dropdown TypeError #16281
OCPBUGS-81517: Follow up on fixing the remaining issues in the multi-group impersonation feature #16236
OCPBUGS-81714: Add missing i18n translations for Pagination component #16255
OCPBUGS-79351: Make folder field optional for vsphere #16189
OCPBUGS-79040: Fix incorrect OLMv1 documentation URL #16186
OCPBUGS-81308: Fix VolumeSnapshot and VolumeSnapshotContent tables sorting #16216
OCPBUGS-79037: Fix useOperatorCatalogCategories hook. #16185
OCPBUGS-81330: Fix entire app suspending to load perspective switcher icon #16226
OCPBUGS-81488: Add robots.txt policy to console #16227
OCPBUGS-80931: Hide filter category selector when only one filter exists #16199
OCPBUGS-77246: AsyncComponent type improvements #16058
OCPBUGS-79035: Fix TypeError in OLS code import to console #16184
OCPBUGS-78799: Fix search component to not pass ALL_NAMESPACES_KEY to… #16170
OCPBUGS-79533: enable keyboard shortcut for DataViewTextFilter #16195
OCPBUGS-78927, OCPBUGS-78928: OLM prompts for GCP Workload Identity parameters during Kiali Operato… #16176
OCPBUGS-78308: “Import from Git” should not force HTTPS/443 for Git providers (GitHub/GitLab/Bitbucket) #16050
OCPBUGS-78599: Migrate InstallPlan components table to PatternFly Table #16159
OCPBUGS-78599: Reset pagination page when changing namespace #16158
OCPBUGS-77029: Fixed Metrics page React error #306 by exporting QueryBrowser component #16038
OCPBUGS-77251: Fix editing secrets with mixed text and binary data #16060
OCPBUGS-77561: Fix ConsolePluginStatus icon #16090
OCPBUGS-75000: Clean up old session cookies to prevent accumulation #15985
OCPBUGS-77957: [CI] Fix the VolumeSnapshot CRUD flaky test failures #16118
OCPBUGS-77882: Fix infinite recursion in project access form #16112
OCPBUGS-65948: prep for 4.21 GA SDK publish #16116
OCPBUGS-76385: Workloads - Edit pod count and Edit parallelism : Content is in English #16005
OCPBUGS-76387: DataView Pagination page menus : i18n misses #16007
OCPBUGS-76386: i18n upload/download routine task - 4.21 / 281 (Latest) #16006
OCPBUGS-77430: run and enforce yarn dedupe #16075
CONSOLE-5011: migrate to yarn berry #16059
Full changelog

console-operator

NETOBSERV-2296: add missing annotations on netobserv quickstart #1096
OCPBUGS-86119: Add unit and e2e test coverage for cert rotation redeployment #1162
OCPBUGS-82037: Redeploy console pods upon cert rotation #1139
OCPBUGS-78929: Remove orphaned console-conversion-webhook deployment and related resource #1128
Sync Dockerfile.ocp image #1126
OCPBUGS-72562: Add missing relatedObjects + small refactoring #1090
OCPBUGS-74686: Add rhel8 and rhel9 oc binaries for Linux OS in CLI downloads #1104
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-80845: bump google.golang.org/grpc@v1.79.3 #384
UPSTREAM-SYNC: Sync release-4.21 with upstream release-1.34 #371
Full changelog

csi-driver-nfs

OCPBUGS-80783: CVE-2026-33186: bump google.golang.org/grpc v1.79.3 #176
Full changelog

csi-external-attacher

OCPBUGS-80784: Bump google.golang.org/grpc to v1.79.3 #102
Full changelog

csi-external-provisioner

OCPBUGS-82900: Address CVE-2026-35469 #139
OCPBUGS-80785: Bump google.golang.org/grpc to v1.79.3 #132
Full changelog

csi-external-snapshotter, csi-snapshot-controller

OCPBUGS-80788, OCPBUGS-80791: Bump google.golang.org/grpc to v1.79.3 #208
Full changelog

docker-builder

OCPBUGS-70149: bump buildah to 1.39.7 to fix CVE-2025-52881 #495
Full changelog

driver-toolkit

OCPBUGS-78535: Support ubi minimal base image #186
OCPBUGS-77887: Clean up cruft in /var/cache/dnf #183
Full changelog

gcp-cloud-controller-manager

OCPBUGS-83615: Fix OSD ILB bug #108
Full changelog

gcp-cluster-api-controllers

OCPBUGS-80805: Bump google.golang.org/grpc to v1.79.3 #287
Full changelog

gcp-machine-controllers

OCPBUGS-80828: Bump gRPC-Go package for CVE fix #154
Full changelog

gcp-pd-csi-driver

OCPBUGS-80809: Bump google.golang.org/grpc to v1.79.3 in release-4.21 #104
OCPBUGS-77716: Support Downward API node name #101
Full changelog

gcp-pd-csi-driver-operator

OCPBUGS-80808: Bump google.golang.org/grpc to v1.79.3 #184
OCPBUGS-77494: Pass node name to csi-driver container #173
OCPBUGS-77310: Add RBAC permission for node driver to get Node objects #171
Full changelog

haproxy-router

OCPBUGS-86718: Strip X-SSL-* headers for plain HTTP #795
OCPBUGS-87002: Replace HTTP backend liveness check with admin socket check #786
OCPBUGS-80810: Bump google.golang.org/grpc to v1.79.3 #770
OCPBUGS-79374: Lower verbosity for parseIPList empty list logging #752
Full changelog

hyperkube, kube-proxy, pod

OCPBUGS-87017: fix flake race in VAP e2e case #2677
OCPBUGS-85500: Bump Kubernetes v1.34.8 to release-4.21 #2665
“OCPBUGS-83608: Bump to k8s v1.34.7” #2647
NO-JIRA: UPSTREAM: <carry>: Add jacobsee and jubittajohn to DOWNSTREAM_OWNERS #2636
OCPBUGS-78991: Bump 1.34.6 to release-4.21 #2634
OCPBUGS-77475: Bump v1.34.5 to release-4.21 #2601
OCPBUGS-76516: Bump v1.34.4 #2590
Full changelog

hypershift

OCPBUGS-80813: Bump google.golang.org/grpc to v1.79.3 #8443
OCPBUGS-86040: [release-4.21] Verify cert revocation against all KAS pods #8539
NO-JIRA: fix(tekton): remove path filter from control-plane-operator pipelines #8667
OCPBUGS-86416: add Konflux pipeline definitions for CPO 4.21 #8607
OCPBUGS-86477: [release-4.21] add CP pull-secret watches for in-place propagation #8583
OCPBUGS-86416: set limits for aro.openshift.io/swift-nic in request overrides for ARO swift #8565
OCPBUGS-81671: Ignition generalize image download errors #8158
OCPBUGS-85781: Add AWS ISO domains to konnectivity IsCloudAPI #8531
OCPBUGS-85621: fix CVE-2026-33186 by updating grpc-go #8518
OCPBUGS-83710: fix(kubevirt): filter link-local addresses from EndpointSlice endpoints #8270
OCPBUGS-85538: [release-4.21] Set unhealthyPodEvictionPolicy to AlwaysAllow on all PDBs #8214
OCPBUGS-85538: [release-4.21] CNTRLPLANE-2740: Add KAS liveness readiness sidecar to OAS and OAuth API Server #8213
OCPBUGS-76447: Add UserAgent telemetry to CPO Azure SDK clients #7685
OCPBUGS-81745: [release-4.21] Honor AWS AMI override in NodePool token generation #8170
OCPBUGS-81836: OCPBUGS-81670: fix(cpo-v2): preserve HCCO modifications to OCM Controllers field #8157
OCPBUGS-81490: fix(cpo): skip router LB services for ARO HCP #8135
OCPBUGS-77966: fix: global-pull-secret-syncer pod ~15-minute delay scheduling on new nodes #8129
OCPBUGS-81287: fix(release): allow multiple machine-os component versions #8103
OCPBUGS-81285: fix(releaseinfo): allow periods in version display name regex #8102
OCPBUGS-78933: fix(cpo): Don’t remove HCP Ingress from routes when CapabilityRoute is disabled #8014
CNTRLPLANE-3006: Azure web identity webhook 4.21 #7997
OCPBUGS-78957: fix(hostedcluster): Remove referenced resource annotations regardless of hcp status #7975
OCPBUGS-78473: Fix deadlock when changing release image during initial provisioning #7954
OCPBUGS-78484: fix(catalogs): update catalog image version cap to 4.21 #7956
OCPBUGS-77456: Add dynamic NodePort range validation #7820
OCPBUGS-77647: remove resource limits from Agent CAPI provider #7844
OCPBUGS-78304: Fix context cancel accumulation in getMirrorFromICSPOrIDMS #7891
OCPBUGS-78196: fix(sync-global-pullsecret): compare content ignoring trailing newlines #7914
CNTRLPLANE-2812: feat(aro): Swift support #7826
OCPBUGS-77365: Fix ignition-server pod restarts due to MIRRORED_RELEASE_IMAGE flapping #7834
OCPBUGS-75930: [release-4.21] fix(cpo): Correct route labeling logic for HCP router infrastructure #7641
OCPBUGS-75884: feat(updates): enable CVO metrics access with RHOBS monitoring flag #7632
fix: OCPBUGS-74104: Fix CVE-2025-58183 #7545
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-80815: Bump google.golang.org/grpc to v1.79.3 #146
OCPBUGS-77203: [release-4.21] standardize build paths #121
Full changelog

ibmcloud-machine-controllers

OCPBUGS-77445: [release-4.21] bump vpc go sdk #81
NO-JIRA: Modernize test infrastructure to align with other MAPI providers #84
Full changelog

insights-operator

OCPBUGS-87191: extractro controller #1300
OCPBUGS-86805: add config option to disable runtime extractor #1295
OCPBUGS-80818: Bump google.golang.org/grpc to v1.79.3 #1285
OCPBUGS-81573: kubeletconfig gatherer #1266
OCPBUGS-79534: [release-4.21] Add OpenTelemetry CR Gatherer #1258
OCPBUGS-76960: Extends the time for the extractor liveness probe #1233
Full changelog

insights-runtime-exporter, insights-runtime-extractor

Updating ose-insights-runtime-extractor-container image to be consistent with ART for 4.21 #78
Updating ose-insights-runtime-exporter-container image to be consistent with ART for 4.21 #77
Updating ose-insights-runtime-exporter-container image to be consistent with ART for 4.21 #75
Updating ose-insights-runtime-exporter-container image to be consistent with ART for 4.21 #71
Updating ose-insights-runtime-extractor-container image to be consistent with ART for 4.21 #72
Revert “Bump Go to 1.25” #73
Bump Go to 1.25 #70
OCPBUGS-77491: remove dnf cache from the container images #64
Fix EAP 8.1 e2e test #65
Full changelog

ironic

OCPBUGS-90554: [4.21] Fix parallel power concurrency #856
OCPBUGS-82294, OCPBUGS-84370: Update sushy and Ironic to resolve Cisco vMedia Insert and BIOS Settings update issues. #829
OCPBUGS-84853: Bump pyasn to 0.5.1-5 #823
OCPBUGS-82298: Bump sushy hash to include Supermicro ARS-111GL-NHR fix #840
ART-14497: Fix ART builds with -minimal #809
OCPBUGS-76934: Bump keystonemiddleware version to 10.9.0-0.20260216145500.557d173 for CVE-2026-22797 fix #791
OCPBUGS-76474: Update requirements.cachito for 4.21 with heartbeat inspection fix commit #785
Full changelog

keepalived-ipfailover

OCPBUGS-78048: openshift-enterprise-base: remove subscription-manager, dbus, systemd #226
Full changelog

kube-metrics-server

OCPBUGS-80716: Bump google.golang.org/grpc to v1.79.3 #61
Full changelog

kube-state-metrics

Fix for OCPBUGS-81988: CVE-2026-34986 bump github.com/go-jose/go-jose #143
OCPBUGS-80823: Bump google.golang.org/grpc to v1.79.3 #138
Full changelog

kubevirt-cloud-controller-manager

OCPBUGS-76994: [release-4.21] Sync Upstream 2026-01-27 #61
Full changelog

kubevirt-csi-driver

OCPBUGS-79038: Add annotation-based fallback for infra VM node ID resolution #83
Full changelog

machine-api-operator

OCPBUGS-86493: Populate status label selector for scale subresource #1501
OCPBUGS-77943: Remove cluster-api-provider-libvirt references #1473
Full changelog

machine-config-operator

OCPBUGS-89243: Process rebuild annotation on machine-os-builder restart #6197
OCPBUGS-88709: Update custom containerfile OCB test to work in a disconnected environment #6193
OCPBUGS-88340: vSphere boot image hot loop detection is non-functional due to stable template names #6180
OCPBUGS-89340: Remove skopeo-install script #6202
OCPBUGS-88334: Skip chrony-wait on first node join #6178
OCPBUGS-88335: daemon: don’t pull/extract extensions for all OS updates #6179
OCPBUGS-86998: configure-ovs: copy lldp mode to br-ex port #6134
OCPBUGS-87008: Stabilize ocl 4.21 #6138
OCPBUGS-86979: Update AMI Whitelist #6129
OCPBUGS-86576: Verify extension packages are installed #6090
OCPBUGS-84481: MCS fallback to latest v3 #5883
OCPBUGS-86216: Fix re-cordon detection #6066
OCPBUGS-86232: Apply password only if changes exist #6068
OCPBUGS-86037: use --delete-if-present for karg removal #6058
OCPBUGS-85645: Add terminationMessagePolicy to build pod containers #6045
OCPBUGS-85386: Fix CVE-2026-34986 #6025
OCPBUGS-85286: Fix Admin Ack message for azure/vsphere clusters upgrading to 4.22 #6017
OCPBUGS-85126: Fix units rollback if update failure #6008
OCPBUGS-84941: Fix ssh and password rollbacks #5987
OCPBUGS-84970: Fix encapsulated IGN version #5996
OCPBUGS-84878: Update AMI Whitelist #5915
OCPBUGS-84253: improve JSON unmarshalling for secret decoding #5877
OCPBUGS-83874: Allow enablement of systemd units with existing files #5869
OCPBUGS-83708: Update AMI Whitelist #5857
OCPBUGS-83390: Use HA leader election defaults for MCO on SNO #5838
OCPBUGS-81711: When adding new nodes, MCD executes commands after setting the nodes’ state as Done #5836
OCPBUGS-79482: Skip boot image updates until cluster is stable #5804
OCPBUGS-79426: Update AMI Whitelist #5798
OCPBUGS-79372: set default-timeout-stop to 200s globally #5793
OCPBUGS-78800: Re-order logger setting to eliminate race condition #5779
OCPBUGS-78528: Fix e2e iri tests #5759
OCPBUGS-78201: kubelet: Less aggressive low memory reservation #5756
OCPBUGS-77833: Update AMI Whitelist #5743
OCPBUGS-77689: Create admin-ack gates for azure/vsphere clusters upgrading to 4.22 #5735
OCPBUGS-77577: Fix failure domain matching during vsphere boot image updates #5727
OCPBUGS-77534: Update AMI Whitelist #5722
OCPBUGS-77354: Clean up vsphere login error logging #5705
OCPBUGS-76555: Remove MCD liveness probe #5651
OCPBUGS-77072: mcd_config_drift not working properly #5675
OCPBUGS-76823: reduce MCO image size #5657
OCPBUGS-76833: Machine-config controller should not log about non-existent pull-secret changes #5659
OCPBUGS-73805: Prevent unnecessary systemd unit disable #5648
Full changelog

machine-image-customization-controller

OCPBUGS-78536: Return error when network data Secret lacks nmstate key #171
OCPBUGS-77031: Add IPA messages for console and SSH login #163
OCPBUGS-77490: Clean up dnf cache to reduce container image size #164
Full changelog

machine-os-images

OCPBUGS-87873: Add support for hermetic builds via Cachi2 prefetched CoreOS ISOs #97
OCPBUGS-85478: Force rebuild for OCP 4.21 #93
OCPBUGS-85478: Force rebuild for OCP 4.21 #89
Full changelog

monitoring-plugin

OCPBUGS-87088: [release-4.21] fast-uri: URI authority bypass due to improper delimiter handling #973
OCPBUGS-88396: CVE-2026-44487 bump axios to 1.16.0 #999
OCPBUGS-84290: bump follow-redirects to 1.16.0 #987
OCPBUGS-84828, OCPBUGS-84991, OCPBUGS-85007, OCPBUGS-85037: Update Axios to v1.15.2 #982
OCPBUGS-79460: immutable bump: fix for CVE-2026-29063 [4.21] #947
OU-1368: reset queries when namespace changes in dev perspective #940
OU-1367: prevent namespace and project desync #937
NO-JIRA: release-4.21 e2e-monitoring and e2e-coo working #904
OCPBUGS-83494: [release-4.21] feat: re enable dev console views #856
OCPBUGS-83304: [release-4.21] openshift4/ose-monitoring-plugin-rhel9: Axios: Remote Code Execution via Prototype Pollution escalation #890
OCPBUGS-82302: [release-4.21] fix: re encode params when redirecting from graph to query-browser #871
OCPBUGS-78358: fix for CVE-2025-69873 #845
NO-JIRA: [release-4.21] e2e-monitoring fixing loop on legacy dashboard #828
OCPBUGS-77227: [openshift-4.21] CVE-2026-25639 openshift4/ose-monitoring-plugin-rhel9:Axios affected by Denial of Service via proto Key in mergeConfig #795
OU-1062: [release-4.21] feat: mark alert menu active for incidents tab #761
NO-JIRA: [release-4.21] simplify frontend build in Dockerfile.art #808
OCPBUGS-74909: fix: update vulnerable dependencies #751
Full changelog

multus-cni, multus-cni-microshift

OCPBUGS-82064: Bump CNI version to 1.1.0 #284
Full changelog

multus-networkpolicy

OCPBUGS-77489: Clean up dnf cache #100
Full changelog

must-gather

OCPBUGS-85050: Collect object size with the object count #542
Full changelog

networking-console-plugin

OCPBUGS-88313: Trim subnet input in UDN creation form #430
OCPBUGS-81620: Update lodash to 4.18.1 for CVE-2026-4800 #372
OCPBUGS-83388: Fix CVE-2026-34043 in serialize-javascript #369
OCPBUGS-82161: Migrate to npm #359
OCPBUGS-66283, OCPBUGS-67252, OCPBUGS-70285, OCPBUGS-74473: Fix CVEs via upgrading yarn.lock #346
CNV-59877: Fix permissions request for NADs #353
OCPBUGS-77887: Clean up cruft in /var/cache/dnf #361
OCPBUGS-77225: Fix NAD creation using default namespace instead of selected one #349
Full changelog

oauth-server

OCPBUGS-81816: Bump github.com/go-jose/go-jose/v3 from v3.0.3 to v3.0.5 #234
OCPBUGS-77454: groupmapper: avoid mutating original group users slice when removing user #213
Full changelog

oc-mirror

Fix for OCPBUGS-81971: CVE-2026-34986 github.com/go-jose/go-jose/v4 #1426
OCPBUGS-82546: Only print catalog rebuild message if there are catalogs to rebuild #1388
OCPBUGS-82543: Fix printing collection messages with 0 collection items #1387
OCPBUGS-81743: Remove status field from CatalogSource, ClusterCatalog… #1383
CLID-549, OCPBUGS-78458: Update Dockerfile.tests to run Go integration tests #1371
OCPBUGS-77222: Fix registriesd “unknown userid” failure for arbitrary UIDs #1358
OCPBUGS-76126: Fix reg config detection for explicit false values #1349
OCPBUGS-74981: fix conversion issue for catalog #1346
Full changelog

olm-catalogd, olm-operator-controller

OCPBUGS-86842: [release-4.21] catalogd: clean up orphaned temp dirs in catalog storage #742
OCPBUGS-81993, OCPBUGS-81994: Bump github.com/go-jose/go-jose/v4 to 4.1.4 #718
OCPBUGS-80839, OCPBUGS-80840: Bump google.golang.org/grpc to v1.79.3 #721
OCPBUGS-79059: update OCP-75441 to support multi-arch[release-4.21] #671
Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

OCPBUGS-81995, OCPBUGS-81996, OCPBUGS-81997: Bump github.com/go-jose/go-jose/v4 to v4.1.4 #1294
OCPBUGS-80847, OCPBUGS-80848, OCPBUGS-80849: Bump google.golang.org/grpc to v1.79.3 for CVE-2026-33186[Release-4.21] #1289
OCPBUGS-79398: Fix SA restore resourceVersion conflict error #1266
OCPBUGS-79400: Fix nil pointer dereference in sortUnpackJobs when sorting non-failed jobs #1265
OCPBUGS-79380: enhance case to make it pass per test bundle change #1263
OCPBUGS-78558: Re-Apply Fix admin context race condition in parallel tests #1261
OCPBUGS-77712: Update NetworkPolicy egress to support HyperShift custom API ports #1246
OCPBUGS-77067: Remove the collect-profiles info from the microshift kustomization file #1234
Full changelog

operator-marketplace

OCPBUGS-77580: Update NetworkPolicy egress to support HyperShift custom API ports #729
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-84923: Branch Sync release-4.22 to release-4.21 [04-27-2026] #3160
OCPBUGS-81634, OCPBUGS-83814: Branch Sync release-4.22 to release-4.21 [04-16-2026] #3145
OCPBUGS-83566: Branch Sync release-4.22 to release-4.21 [03-25-2026] #3087
OCPBUGS-81475: node: fix serviceUpdateNotNeeded nil pointer comparison #3098
OCPBUGS-77257, OCPBUGS-78094: Branch Sync release-4.22 to release-4.21 [03-23-2026] #3080
OCPBUGS-78771: Branch Sync release-4.22 to release-4.21 [03-11-2026] #3050
OCPBUGS-76472: OCPBUGS-72532: Branch Sync release-4.22 to release-4.21 [12-19-2025] #3022
OCPBUGS-77147: Minimize ACLs by combining ipBlocks into single ACL #2995
OCPBUGS-77309: Clear stale conntrack UDP entries for nodePorts #3002
OCPBUGS-77046, OCPBUGS-77086: [release-4.21] combined backport PR for 2 escalations #2984
Full changelog

powervs-block-csi-driver

OCPBUGS-80852: Fix CVE-2026-33186 by bumping google.golang.org/grpc to 1.79.3 #127
OCPBUGS-82924: Fix CVE-2026-35469 by bumping github.com/moby/spdystream to v0.5.1 #121
Full changelog

powervs-block-csi-driver-operator

Updating ose-powervs-block-csi-driver-operator-container image to be consistent with ART for 4.21 #107
OCPBUGS-80853: Fix CVE-2026-33186 by bumping google.golang.org/grpc to v1.79.3 #106
Full changelog

powervs-cloud-controller-manager

OCPBUGS-80854: bump google.golang.org/grpc to v1.79.3 to fix CVE-2026-33186 #98
Full changelog

prometheus

OCPBUGS-86250: fix: TLS client cert rotation when no CA is configured #314
OCPBUGS-80855: Bump google.golang.org/grpc to v1.79.3 #309
OCPBUGS-78581: [release-4.21] chore(kubernetes): deduplicate warning logs from the API #298
Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

OCPBUGS-77295: backport upstream fix to reconcile resources with inconsistent status #365
OCPBUGS-74477: Validate webhookURL secret for MSTeams receiver in AlertmanagerConfig CRD #359
Full changelog

rhel-coreos, rhel-coreos-10, rhel-coreos-10-extensions, rhel-coreos-extensions

OCPBUGS-82523: post-process: Remove workaround for openvswitch additional group #1926
- [release-4.21] extensions: Add rhel-9.6-server-ose-4.21 #1914
NO-JIRA: [release-4.21] extensions: Fix repo name to match 4.21 #1913
COS-3946: Backport rhel-10.2 support to release-4.21 branch #1898
NO-JIRA: rhaos-pkgs-match-openshift: exclude known package mismatches #1889
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

route-controller-manager

OCPBUGS-80726: Bump google.golang.org/grpc to v1.79.3 #82
OCPBUGS-76641: filter ingress namespace on UnmanagedRoutes metric #73
Full changelog

telemeter

OCPBUGS-80868: Bump google.golang.org/grpc to v1.79.3 #589
OCPBUGS-81817: [release-1.21] Fix CVE-2026-34986 #593
Full changelog

tests

OCPBUGS-84252: Move imagepolicy test to disruptive long-running suite #31061
OCPBUGS-78330, OCPBUGS-82146, OCPBUGS-85550, OCPBUGS-88295, OCPBUGS-88297, OCPBUGS-88320, OCPBUGS-88322, OCPBUGS-88324: Backport noOLM Gateway API test coverage and upgrade tests #31232
OCPBUGS-88328: Fix Pod.Create() to use –local flag for template proc… #31269
OCPBUGS-85149: Enable Gateway API tests on vSphere and baremetal #31139
OCPQE-32041: bump(k8s): move docker types into container package #31169
OCPBUGS-74373: Remove restriction of unmanaged x-k8s.io #30718
OCPBUGS-84655: fix openshift/network/third-party suite selecting zero tests #31091
OCPBUGS-84978: Skip image-registry operator tests for Libvirt platform in upgrade jobs. #31123
OCPBUGS-84947: test: add monitortest to detect pods stuck in Pending state #31117
OCPBUGS-84947: Add [Late] test to collect CRI-O goroutine dumps via SIGUSR1 #31118
OCPBUGS-81638: Manual cherry-pick node swap feature testcases to 4.21 #30973
OCPBUGS-82064: Assert CNI version greater than equal to 1.0.0 #30977
OCPBUGS-81638: Add openshift/disruptive-longrunning testsuite in release-4.21 branch #30976
OCPBUGS-78780: changed http to https for three places to reduce test false positives and false negatives #30902
OCPBUGS-79365: Verify etc pod should start with oom_score_adj as system-node-critical #30916
OCPBUGS-78485: run resource request/limit check early #30879
OCPBUGS-78192: Exclude disruption during NoExecuteTaintManager serial tests #30857
OCPBUGS-78064: Update optimized builds test to use rpm -qa instead of dnf #30856
OCPBUGS-78064: Allow test to tolerate running on minimal images #30852
OCPBUGS-77823: add the missing namespace from managed openshift #30838
OCPBUGS-77826: Remove exception for monitoring OLM Progression condition #30839
OCPBUGS-77097: Add test for CPMS OnDelete strategy with full master replacement #30802
: OCPBUGS-76856:cert tests: mark TLS registry test as informing #30779
OCPBUGS-76529: Fix flakiness in MutableCSINodeAllocatableCount test #30772
OCPBUGS-76955: co/kube-storage-version-migrator reports Available=False in a non-upgrade job #30740
Full changelog

thanos

OCPBUGS-84492: Revert “OCPBUGS-80870: CVE-2026-33186 openshift4/ose-thanos-rhel9: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation [openshift-4.21]” #180
OCPBUGS-80870: CVE-2026-33186 openshift4/ose-thanos-rhel9: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation [openshift-4.21] #174
Full changelog

vsphere-cluster-api-controllers

OCPBUGS-80875: Bump google.golang.org/grpc to v1.79.3 #102
Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

OCPBUGS-80878: Bump google.golang.org/grpc to 1.79.3 #171
Full changelog

vsphere-csi-driver-operator

OCPBUGS-74701: Fix update of stable-generation annotation #330
Full changelog

vsphere-problem-detector

OCPBUGS-87097: Fixed compute cluster permission logic for single fd with read-only custom resourcepool #222
Full changelog

Node Image Info

Loading node image info, this may take a while ...

Unable to show node image info: too many concurrent oc adm release info --rpmdb/--rpmdb-diff operations (limit 16)

View changelog in Markdown or change previous release:

Source code for this page located on github