4.22.0-rc.4

Download the installer for your operating system or run

oc adm release extract --tools registry.ci.openshift.org/ocp/release:4.22.0-rc.4

Team Approvals:

Accepted
- QE

Tests:

Blocking jobs
- upgrade Succeeded periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
- upgrade-minor Succeeded periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
Informing jobs
- aws-ovn-serial-1of2 Succeeded periodic-ci-openshift-release-main-nightly-4.22-e2e-aws-ovn-serial-1of2
- aws-ovn-serial-2of2 Succeeded periodic-ci-openshift-release-main-nightly-4.22-e2e-aws-ovn-serial-2of2
- aws-ovn-techpreview Succeeded periodic-ci-openshift-release-main-ci-4.22-e2e-aws-ovn-techpreview
- aws-ovn-techpreview-serial-1of3 Succeeded periodic-ci-openshift-release-main-ci-4.22-e2e-aws-ovn-techpreview-serial-1of3
- aws-ovn-techpreview-serial-2of3 Succeeded periodic-ci-openshift-release-main-ci-4.22-e2e-aws-ovn-techpreview-serial-2of3
- aws-ovn-techpreview-serial-3of3 Succeeded periodic-ci-openshift-release-main-ci-4.22-e2e-aws-ovn-techpreview-serial-3of3
- driver-toolkit Succeeded periodic-ci-openshift-release-main-nightly-4.22-e2e-aws-driver-toolkit
- fips-scan Succeeded periodic-ci-openshift-release-main-nightly-4.22-fips-payload-scan
- metal-ipi-ovn-ipv4 Succeeded periodic-ci-openshift-release-main-nightly-4.22-e2e-metal-ipi-ovn-ipv4
- metal-ipi-ovn-ipv6 Succeeded (1 retry) periodic-ci-openshift-release-main-nightly-4.22-e2e-metal-ipi-ovn-ipv6
  - Attempt 1 Failed
  - Attempt 2 Succeeded

Upgrades from:

Untested upgrades: 4.21.10, 4.21.13, 4.22.0-ec.3

Upgrades to:

Loading changelog, this may take a while ...

Changes from 4.22.0-ec.5

Created: 2026-05-18 11:17:21 +0000 UTC

Image Digest: sha256:0b4edeba3be55c65205edc9915b81672bbc53014b2fd5891d0e5714c09dc746d

Components

Kubectl 1.35.2
Kubernetes upgraded from 1.35.3 to 1.35.4
Kubernetes Tests 1.35.1
Red Hat Enterprise Linux CoreOS upgraded from 10.2.20260405-0 to 10.2.20260513-0

The CoreOS links above are for the base CoreOS layer used to build the OpenShift node image and do not contain OpenShift components. This is normally only useful to devs working closely with the CoreOS team. For info about the node image, see the Node Image Info section.

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	OKD Hypershift	OKD SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
DualReplica (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled
EVPN (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled
GatewayAPIWithoutOLM (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled
OpenShiftPodSecurityAdmission (0 tests)	Disabled (Changed)	Disabled (Changed)	Enabled	Enabled	Disabled (Changed)	Disabled (Changed)	Enabled	Enabled

Rebuilt images without code change

apiserver-network-proxy git 5e33c228 sha256:ca2314a03930d2a966b86cac97c21e2fe007953bcccdca9e53612c2081639eb2
aws-cloud-controller-manager git e73d6a38 sha256:49d4ef213400ac24ff7dbd38dd223ebd5d2356e4cd747ed5a9e04da48598eec9
aws-karpenter-provider-aws git f0be9c72 sha256:28ca58901c1c0f9dcf7c70a7245de171dc8a54d6ebb9be6b9afa1bcb46ce4e52
aws-kms-encryption-provider git 19e7b623 sha256:22277f0494d222ec2a41747f0545ea8294562e51b68800c33b9e18707c6051ec
aws-node-termination-handler git 341ed3a0 sha256:eddd45baaba97141d7d324d78b46cb6994cd093e40c031a3997e333dd60c1c0c
aws-pod-identity-webhook git 82088287 sha256:54df9ef9040b065e321493d69938a039622b3a4e3bf06218dd96fab20144bbab
azure-cloud-controller-manager git 4c7a7646 sha256:396a0169aa1fb20ebf918c137c4819ddd7dd443870154a5a0af5bc9f3f83928d
azure-cloud-node-manager git 4c7a7646 sha256:6941c1f60d41b17ff626e287de4d1121f78d894eb2b644c2a4d678f7a463b5c5
azure-kms-encryption-provider git 99b9a3a3 sha256:f83d9c02f460cfc3a3537d81386435d7ed1cb8a4fa60f8851d95b46a62371ed3
azure-machine-controllers git 69d04909 sha256:62b77fb07b8a3b585842b5582cc0994275aafd60d436dd207838cb972b5d9c31
baremetal-cluster-api-controllers git ad4eb8a5 sha256:7d63f9e3ba7584c61f44ec8c16bcaa74ee349787afbf55913a104b2ea1e0dcaa
baremetal-machine-controllers git 8d863b95 sha256:2edf5b91c8e7cf7f069648f0e54027adec6cfc200b428ac999849193e5962e86
baremetal-operator git c5e50489 sha256:c8ed78269b9fbb71e17904451ad937491b2d5f3f20897eb8f4be91439bab3735
baremetal-runtimecfg git dca8cb1b sha256:290ce7a706e1c1c219f5dfbf30ca96c348137895b5f2a8da558b6388b205ed1b
cloud-network-config-controller git 2d69ad95 sha256:85ffda6b4926815d32fc3488ad23248ba0212559b35aada5ad54cf2b67a02b2c
cluster-bootstrap git e6be0fdf sha256:dabc1eba022bfeb1261b3a403e2d57336fdefe6a369a6a3dae22ca904a73caa1
cluster-control-plane-machine-set-operator git b2e26b93 sha256:d83cfc005475800936af77d4e607f80ed67ddd62400dadaeb04e12db3191c527
cluster-dns-operator git 3d214118 sha256:e1bbb4ca16cde09212476326d4228e4583f540652d7343fd90595e068f45bd66
cluster-machine-approver git a9edd695 sha256:8b93d3f1d92d109be2863e24bc0f227854173ba593a4cf6582119a48f51323f9
cluster-policy-controller git 44985a13 sha256:5615a2fae428ce58ea12618c267014f99dbf323f59d020fc740e6feead7742c3
cluster-storage-operator git 8dfdf2ef sha256:ca7737de33805e90adb247c575b24b453b2a025b433a2fe53908f4d7afc7f20f
cluster-update-keys git 3b5c59cc sha256:4f1ae1ced44d0d88537015759bcfc0096c52868da13a948ff4c90a71ec644713
configmap-reloader git 94e41c4c sha256:da9a6b4845c71270b7761b0d30d3b7130087a9f9b00bd3fc444bc69aacac413d
container-networking-plugins git 747ad66c sha256:7141ac0db618d5135044f182fa26f5689211e340cc0b52bcb501914f52a39115
containernetworking-plugins-microshift git 747ad66c sha256:e68c577994350df7d0ff57649f24daaf0e28c8e5b7afadfd5357fe90e8387e39
coredns git 0dded2d2 sha256:25272a0944e00a27ce1d63e2cc1dfba29b896b89890fe191f394f67b6e13ae05
csi-external-resizer git 4e74a4aa sha256:932fcb0a6fa206657d30c72572cf06ef679cae07a013511bbd73f400b4f01e5e
csi-external-snapshot-metadata git 76523185 sha256:3e4a8d77aeca131804684e87a0952f9200d895d1c13e491327dabe1ab9348804
csi-external-snapshotter git d1bc3ffa sha256:adf7b7e0bc45aaff09af2dfdde96edc5d4d85c8b97eb6f2548c89c58834b2f72
csi-livenessprobe git 4d5e959a sha256:b6d4331ae19fa986c860a7659cb56e9ce3d99539f31222b3f7b9c2e82e453c96
csi-node-driver-registrar git cf174b30 sha256:d16c60f741d26dfcc3752681ef411247df0c9cd336181033d6525242a25880c8
csi-snapshot-controller git d1bc3ffa sha256:02bdca6af3c8aa48ecfe1f24259cb24850e28b1614727e0e6abb7a47732d3237
driver-toolkit git 7aa4007a sha256:d7cde855f92b3e0f891d1ee82289c18c3ec0433028ac82cdef8a7f885f26be99
egress-router-cni git 5e0f8d1b sha256:944390ee4e8854ba0dd01378cab9ac41d37a91333557846ca3fd58bad62cd780
etcd git d8d67b8c sha256:efb4a7b5cc545269651a2f8700556702e0e9d600f8b19e251e4fb01f03d42572
gcp-machine-controllers git 0073bd11 sha256:09c43632fea405c442b57c50f0423dd4e271ceaa58c54a20fdf85d27a349da5b
gcp-workload-identity-federation-webhook git d7675f31 sha256:7ed232c669ee0801e995e8d18ab8f260ef8d7e3ff964f1005477a8cef726a5f8
haproxy-router git 89639077 sha256:2f11b7a4f6cc23e213a30566cab93ac01d347a49aa40825feab57ba5010a66f6
ibm-cloud-controller-manager git d9222a1c sha256:c8787145a8ac0a4dfdcd24e8f580fcde891d05c5990c60a73587fd655988fb95
ibm-vpc-block-csi-driver git aa40cd7e sha256:6a42939718fc6cd8a52c2905381f4daac789a41757128501d98ed9878fd2ac47
ibm-vpc-block-csi-driver-operator git f859eac9 sha256:ee511955a3bfec181596ba2c32d4d9fbcb2a55fb6a03b2fad1d3a995f4d3eb3d
ibmcloud-cluster-api-controllers git 03b143d5 sha256:1d6da9c22a3094c2cd95672b5964bd530f66e6def5b0b1f1fe834ad9adbab5d1
ibmcloud-machine-controllers git 46b8c72c sha256:6a7a74882265f8ba6b93ee79c523cd1b023bc32403bf8176c5856e098ea959cf
insights-runtime-exporter git 70256457 sha256:5349681343612a607c59563799a5acf6df55211f6c46d45d14372cf8e73e47e9
insights-runtime-extractor git 70256457 sha256:0b976d9bc86804f034be679a5a3b8410d6e904e912623cb7adf7bb3b271f8749
ironic-agent git 0336e638 sha256:bc591fa39e2470191c904ca32cb8ba3d5320bcb3706650ed67a142eca64d1544
ironic-machine-os-downloader git 9953d2b7 sha256:567d222e29d5ca0af970986d388a32e740c48881de2fe629d24954af1ec55e65
ironic-static-ip-manager git a379d09f sha256:2dcdd91e96fd03712d617ca820805a03b0fd178643caa77eb2497c01d9edcba8
keepalived-ipfailover git edb8b1e6 sha256:180b44f18f77bcd6cf88c07e6b54bc81569483bb75ad291bddd95890afbd581c
kube-metrics-server git 38c16c46 sha256:291383c1613a6bb0218305fba72badb87e3d39773ea8eee75374ca0268f6dbef
kube-rbac-proxy git d12e2746 sha256:28ce4fb536ad0b695620ffcd026ff3284b6aee36821ffce0e291159d7ae78804
kube-state-metrics git 6fa06eac sha256:f32d0c4c735f9fc815578d4d06b68756a1ec26a1c628bb6153488254af7ff10c
kube-storage-version-migrator git 72835e43 sha256:39057679d075d9dc72082c41916c93c3844ea42258baf07c43b152ea9f95baa3
kubevirt-cloud-controller-manager git 76dd5a6f sha256:b83f4f02a97c25e2e92ddf4afa95d99fa7c737613ebf307f3a20dfcd2776032f
kubevirt-csi-driver git 771b562d sha256:26f5a92ff13091b50d6c5a01dc07a68ecff454209d442300129cd06763e77b00
machine-image-customization-controller git a43d9c97 sha256:cb7444b4d531af1eb3fc57b8de20a2be0e6d1b8492048ee72ed1f6fee644a648
machine-os-images git df9a652c sha256:40cf4ae495d1ffa9e610af779bcab929b5fc3ee248b496260f0c4adaf630b9b4
multus-admission-controller git 16ba7ef8 sha256:f3ff13c679280cca8b0755dc749c2ab18be85f1ac6b3baf236ba9cefeb5d42d2
multus-cni git b4ec7d82 sha256:b6d7b9b2821409704fb6ca50ad0083a97345540d3c114713824da6c8c5590e78
multus-cni-microshift git b4ec7d82 sha256:05e3dd857008fb90e2e4ccdeb26dfafd39ddcca397283c6f8563bc13192da4cd
multus-networkpolicy git 834a093f sha256:25ae005ff5d7fa9c38f134d2061f01073ae3cac566c8cb361b13a43ac6c8911c
multus-route-override-cni git 08af4127 sha256:e87ceea6019e09fe1cb18212361c19ea4b918dd23b7dcf5df561b2e812a7429d
multus-whereabouts-ipam-cni git d691040e sha256:550fe49ed0971af234c90712ac40bdeb7d487ed33983c412749ef8fa048908e7
network-interface-bond-cni git 297eeb43 sha256:8033a7c7c9fb4b50f4ffbb7f1ce357be99a3ce8aada0facf8af9be47e0c170d4
network-metrics-daemon git 5b233ea1 sha256:72da8b077c45e4c100b5c2f99c58d1e09e8d045129ab43aac889438190a45502
nutanix-cloud-controller-manager git 8e75679a sha256:41145b0cd726793b5ede5111a5d1b8b1ce85d5e7fec572eebe74641c014021e3
nutanix-machine-controllers git 60559fdd sha256:5288203ab9d0b5e176533b8f1db7123bf361b9fcf21ecf92105a93dfaf616a71
oauth-proxy git 714292f5 sha256:564a397fb6f0b43ffba34af676f5a8176b7a859080986b38df15cf8c6a294319
openshift-controller-manager git 26d20fea sha256:afb46f0b09d3794332864a06b5f3f957bd1575127cb4594aad38c9355acf38f5
openshift-state-metrics git e71e0996 sha256:5d1bbc574747feb2e43b1353a44d8b61f0baa54f94c98f6abb9c6179cd2fe55b
openstack-machine-api-provider git 8a8c354b sha256:6741563b8bce7ed66fe9af1571c49086f9a19fba8aedd697b80a667a92f78327
openstack-resource-controller git cbea7a9c sha256:c7e4dc99998c1f3a3ca5f0e2d1103faacb9dd9618337348746c4d2bf30115aaf
operator-marketplace git 38da2ef7 sha256:f01d1bd96a8767b90f3e517a0c6cd9b9c73904b4eeae59b8add114bcf91393e8
powervs-machine-controllers git e88cf81d sha256:531fe7fc155fe961dbe2384c2d135e9060aac735622b63029d621e8536c53d6d
prom-label-proxy git c4c99a30 sha256:5a8b1dd661674ba98dabf1aea6a57adcb364eac5a2182911ecd62e5238fe3b1f
prometheus-alertmanager git 02dc3e9e sha256:3131bad8578f6e0f136cc349c4c4601a1b2bc18a9860dc906676fff2acf925a7
prometheus-config-reloader git 70e38466 sha256:68513cfffcab7a734124f169d9ad5f28ecb5bf14a503f80be8310ef43a662d3c
prometheus-node-exporter git 6c4fc012 sha256:f968a40810c997a9d3e60c942a3fbe465b41043f1a73904f20b183b5c9038cf5
prometheus-operator git 70e38466 sha256:85248dddab4abe78ddf638e0b87f06d94690b8d6bc94d0d210b72ca34765b0bd
prometheus-operator-admission-webhook git 70e38466 sha256:918f49010f2d2c7dd20c66e94bc3aa2a8611d62d239d19d526574f5238d75fc0
route-controller-manager git 624742d9 sha256:7313fc6641f323dc34bc0852dee81d9fea553c5ae82ca7d8c77d6ddae3ec1c07
thanos git 5d9d0f38 sha256:a13fc29f30ad52029e5a449b67d227262a5b47f98f8729fd010632cfbd722ef1
volume-data-source-validator git 8e176cec sha256:8d5c7fce63d884c0bb695d99d00ff9cb369307c950a75d7b78c617f16058ae5a
vsphere-csi-driver-operator git d3668c9a sha256:75222f64c27c265418cc4986e6e8024d2d2ebae3da563e57205477c8ae7dd417
vsphere-problem-detector git 842aed3d sha256:1ef6614006dd529ff6cae1a7153077efabcfdc044b07f73265dab3397e5749da

agent-installer-api-server

OCPBUGS-83542: Mark raw FC/iSCSI multipath members as ineligible #10150
OCPBUGS-83511: Fix IRI patcher feature check #10147
MGMT-23548: Ensure tests w/ gomock controllers call Finish() #10024
MGMT-22849: Remove the nmconnection that the openshift-installer writes for the bootstrap. #10086
NO-ISSUE: Detect missing PostgreSQL client in development #10119
NO-ISSUE: Add assisted-service-writing-unit-tests agent skill #10123
MGMT-23451: Lower SNO vCPU min to 4 instead of 8 for assisted for OCP 4.22 and above #10040
MGMT-23141: Cluster creation returns SQL error rather than API error #10113
NO-ISSUE: [master] Bump OCP versions: 4.20, 4.18, 4.21, 4.14, 4.17, 4.19, 4.16 #10120
MGMT-23340: upgrade assisted-service postgresql from 13 to 15 #10096
NO-ISSUE: Replace github.com/golang/mock with go.uber.org/mock #10082
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

NO-ISSUE: Refresh RPM lockfiles #2069
MGMT-23545: Mount pull secret token as a file #2053
Full changelog

agent-installer-node-agent

OCPBUGS-84129: add –copy-network when manual network config is detected #1416
Full changelog

agent-installer-ui

OCPBUGS-85230: Ensure follow-redirects pkg resolves to ^1.16.0 (#3705) #3705
OCPBUGS-85265: [release-4.22] OCPBUGS-84038 | [Below the sea UI] Lack of visual feedback (spinner) on disabled “Next” button during background validation (#3703) #3703
OCPBUGS-84318: fix operators list in ABI below the sea (#3645) #3645
Hide internally generated custom manifests on the Cluster Review page (#3700) #3700
OCPBUGS-85199: [release-4.22] OCPBUGS-84147 | [Below the sea UI] Leaky Abstraction: Transient 500 errors exposed during host binding process (#3683) #3683
Remove 2 node arbiter option from the control plane dropdown option (#3702) #3702
OCPBUGS-85220, OCPBUGS-85222, OCPBUGS-85224, OCPBUGS-85226, OCPBUGS-85228: Bump axios to ^1.15.1 (#3693) #3693
OCPBUGS-84272: bump axios to ^1.15.0 for fixing CVE-2026-40175 (#3638) #3638
Update OWNERS file (#3660) #3660
NO-ISSUE: Update translation files to match new i18next format (#3658) #3658
chore(deps): update dependency rimraf to v6 (#3564) #3564
chore(deps): update konflux references (#3562) #3562
chore(deps): update konflux references (#3561) #3561
chore(deps): update module golang.org/x/sys to v0.43.0 (#3492) #3492
chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.25.8-1775724628 (#3560) #3560
chore(deps): update dependency qs to v6.15.1 (#3559) #3559
chore(deps): update dependency @redhat-cloud-services/eslint-config-redhat-cloud-services to v3 (#3539) #3539
chore(deps): update dependency msw to v2 (#3557) #3557
chore(deps): update dependency concurrently to v9 (#3554) #3554
chore(deps): update dependency @openapitools/openapi-generator-cli to v2.31.1 (#3534) #3534
chore(deps): update dependency typescript to v5.9.3 (#3489) #3489
chore(deps): update dependency @types/node to v24 (#3543) #3543
chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.25.8-1775651161 (#3548) #3548
chore(deps): update dependency i18next-parser to v9 (#3556) #3556
Bump basic-ftp from 5.2.0 to 5.2.1 (#3552) #3552
chore(deps): update dependency axios to v1.15.0 (#3551) #3551
chore(deps): update dependency @redhat-cloud-services/frontend-components to v7.3.0 (#3550) #3550
MGMT-23313: long text breaks table layout (#3545) #3545
Bump vite from 5.4.21 to 6.4.2 (#3547) #3547
chore(deps): update dependency eslint-plugin-import to v2.32.0 (#3475) #3475
fix(deps): update dependency monaco-editor to v0.55.1 (#3505) #3505
fix(deps): update dependency cypress to v13.17.0 (#3500) #3500
fix(deps): update dependency react-monaco-editor to v0.59.0 (#3537) #3537
chore(deps): update dependency dpdm to v3.15.1 (#3473) #3473
chore(deps): update dependency @redhat-cloud-services/frontend-components-config to v6.8.3 (#3471) #3471
chore(deps): update dependency axios to v1.14.0 (#3536) #3536
chore(deps): update dependency @types/eslint to v9 (#3541) #3541
Full changelog

agent-installer-utils

OCPBUGS-84141: Update 4.22 Konflux files #295
OCPBUGS-83734: Red Hat Konflux kflux-prd-rh02 update ove-ui-iso-4-22 #291
OCPBUGS-82537: update konflux references #274
Full changelog

aws-cluster-api-controllers

OCPBUGS-83899,UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-aws:v2.10.3 into release-4.22 #603
Full changelog

aws-ebs-csi-driver

OCPBUGS-83900: UPSTREAM: 2911: bump google.golang.org/grpc v1.80.0 to fix CVE-2026-33186 #316
Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator

OCPBUGS-85116: Mount writable /tmp in SMB CSI driver #550
OCPBUGS-84243: [release-4.22] Add VolumeAttributesClass e2e test manifests for Azure disk #544
Full changelog

aws-machine-controllers

OCPBUGS-85125: Fixed broken test and simplified some logic #184
Full changelog

azure-cluster-api-controllers

OCPBUGS-83906: Merge https://github.com/kubernetes-sigs/cluster-api-provider-azure:v1.23.1 (dbeb413) into release-4.22 #381
Full changelog

azure-disk-csi-driver

OCPBUGS-85193: check for node name in waitForDiskManagedByTobeRemoved #146
UPSTREAM: 3569: OCPBUGS-83425: Bump grpc to v1.79.3 #136
Full changelog

azure-file-csi-driver

UPSTREAM: 3023: OCPBUGS-83329: Bump grpc to v1.79.3 #126
Full changelog

azure-service-operator

OCPBUGS-83879: Bump grpc package for CVE fix in 4.22 #27
OCPBUGS-84333: Updating ose-azure-service-operator-container image to be consistent with ART for 4.22 #25
OCPBUGS-83835: UPSTREAM: <carry>: add openshift/e2e-tests.sh #23
Full changelog

azure-workload-identity-webhook

OCPBUGS-84394: github.com/go-jose/go-jose/v4 v4.1.4 #47
Full changelog

baremetal-installer, installer, installer-artifacts

OCPBUGS-84701: vSphere - Missing unit tests to cover polarion workitems #10526
OCPBUGS-84663: add unit tests for Nutanix to replace polarion workitems #10525
OCPBUGS-84643: Update RHCOS-release-4.22 bootimage metadata to 10.2.20260423-0 / 9.8.20260428-0 #10523
OCPBUGS-83611: PowerVS: update release 4.22 CAPI to v0.12.2 #10509
MULTIARCH-5854: implements retry-after logic to limit failures #10421
OCPBUGS-78151: Add provisioningNetworkGateway field to install-config #10387
OCPBUGS-77965: Update RHCOS-release-4.22 bootimage metadata to 10.2.20260405-0 / 9.8.20260403-0 #10482
OCPBUGS-77917: PowerVS: Use short regions and provide a default resource group in survey #10369
CORS-3900: Add IPv6 frontend IP configurations for dual-stack #10328
MCO-2135: Label Machines, MachineSets, and ControlPaneMachineSets with OSStream labels #10426
OCPBUGS-81509: fix ASO CRD duplication #10451
OCPBUGS-76468: PowerVS:: SSH key must be RSA #10289
no-jira: PowerVS: add mjturek and hamzy to approvers list #10483
OCPEDGE-2072: bump(ocp/api): pull in latest for DualReplica promotion #10471
OCPBUGS-77830: skip redirect when validating endpoint accessibility #10360
OCPBUGS-81622: Collect bootstrap service records in agent-gather #10457
AGENT-1448: Add IRI registry authentication support #10389
Full changelog

cli, cli-artifacts, deployer, tools

NO-JIRA: claude: Split tester agent away from code-reviewer #2250
OCPBUGS-77845: Fix extraction of gated manifests using –install-config #2249
Full changelog

cloud-credential-operator

OCPBUGS-84398: github.com/go-jose/go-jose/v4 v4.1.4 #1020
OCPBUGS-83625: test-ext: hypershift skip CCO metrics endpoint validation #1013
CCO-738, CCO-739, CCO-740: Overhaul status logic to correctly match spec #1008
CCO-787: use apiserver tls config #965
CCO-824: feat(gcp): add key-storage-method flag for workload identity providers #1004
CCO-779: e2e for removing kube-rbac-proxy container (CCO-779) #991
Full changelog

cluster-authentication-operator

OCPBUGS-85105: Fix OAuth page showing OKD branding instead of OpenShift #888
OCPBUGS-84954: Fix terminationMessagePolicy on network policy e2e test pods #884
CNTRLPLANE-2625: Add Auth network policy e2e cases #831
Full changelog

cluster-autoscaler

OCPBUGS-84131: [release-4.22] UPSTREAM: 9458: fix(clusterapi): use kind-aware version discovery for infra references #419
Full changelog

cluster-autoscaler-operator

OCPBUGS-65578: report Progressing=True on version upgrade #366
Full changelog

cluster-baremetal-operator

OCPBUGS-84936: Fix webhook server not starting due to missing WithValidator #598
OCPBUGS-84924: Bind the plain HTTP 8080 metrics port to localhost #596
OCPBUGS-78151: Add provisioningNetworkGateway field to CBO #575
Full changelog

cluster-capi-controllers

OCPBUGS-83913,UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api:v1.12.7 (b5fa593) into release-4.22 #285
OCPBUGS-83759, OCPCLOUD-3419: Adopt IPAM CRDs on upgrade #280
Full changelog

cluster-capi-operator

OCPBUGS-84942: fix: remove retired Microsoft.ClassicStorage permission #548
OCPBUGS-83917: Bump grpc package for CVE fix in 4.22 #539
OCPBUGS-84365: Fix e2e flake when workers are in us-west-2b #530
NO-JIRA: Optimize envtest CRD loading by specifying necessary files explicitly #520
OCPCLOUD-3319: Remove capiinstaller controller #507
OCPCLOUD-3419: Add adopt-existing annotation #514
Full changelog

cluster-cloud-controller-manager-operator

NO-JIRA: fix: report all degraded controller conditions instead of first only#444 #444
OCPCLOUD-3348: Honor TLSAdherence #440
Full changelog

cluster-config-api

Promote EVPN Feature Gate to GA #2826
OCPBUGS-85102: Add labelSelector to MachineSet status for scale subresource #2831
OCPBUGS-83846: Add component names, manifestSubstitutions, and observedGeneration to CAPI revisions #2819
OCPBUGS-83768: extend supported values for MCN IRI image status field #2817
OCPBUGS-83755: fix(config/v1): define constants for authentication types as typed constants #2816
OCPBUGS-68358: Disable PSA for 4.22 #2802
MON-4035: Add ThanosQuerierConfig to ClusterMonitoring API #2769
NE-2520: Promote GatewayAPIWithoutOLM to GA #2772
OCPEDGE-2197: Promote TNF (Dual Replica) to default #2723
OCPBUGS-81627: Load ClusterResourceQuota CRD before CVO manifests #2796
OCPEDGE-2492: feat: promote pacemaker to v1 in prep for tnf #2792
Update verify-feature-promotion HTML output to sort entries and fix overflow #2793
Full changelog

cluster-config-operator

OCPEDGE-2071: bump(ocp/api): pull in latest for DualReplica promotion #480
Full changelog

cluster-csi-snapshot-controller-operator

OCPBUGS-82535: Fix PDB unhealthyPodEvictionPolicy field name #271
Full changelog

cluster-etcd-operator

NO-JIRA: Apply go fix changes #1589
NO-JIRA: Remove unused lib/resourcemerge package #1590
OCPEDGE-2495: upkeep: bump ocp/api ocp/client-go #1591
OCPBUGS-81340: pacemaker CronJob: tune history limit and Job TTL #1581
OCPEDGE-2495: feat: update pacemaker in preparation for DualReplica promotion #1587
Full changelog

cluster-image-registry-operator

OCPBUGS-83692: Allow longer window before going Degraded #1323
OCPBUGS-83650: CNTRLPLANE-2660:e2e testing automation: Image Registry network policy #1322
OCPBUGS-83265: ImageConfigController: add inertia before ImageConfigControllerDegraded #1321
CNTRLPLANE-3184: Create network policies for image-registry components #1301
OCPBUGS-81750: Use deterministic S3 bucket naming to prevent orphaned buckets #1317
Full changelog

cluster-ingress-operator

OCPBUGS-85024: TestUnsupportedConfigOverride: Ignore featuregate and defaults #1432
OCPBUGS-85064: Allow host network connections to the ingress canary #1433
OCPBUGS-84841: isFIPSEnabled: Check FIPS_ENABLED env. var. first #1429
OCPBUGS-81550: AWS, Azure and GCP ClusterHostedDNS: Add Ingress LB IPs to Infra CR after masters up #1411
OCPBUGS-76609: Do not take over OSSM subscription #1398
NE-2332: Implement ROUTER_CURVES environment variable #1409
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-85260: operator should not override authentication config serviceAccountIssuer with the default one during the operator initialization #2142
OCPBUGS-84536: Bump library-go #2131
OCPBUGS-83770: Allow setting the oauthMetadata when auth type is None #2112
OCPBUGS-68365: revert dev cert rotation #2017
CNTRLPLANE-2698: add network policies for apiserver operator and operands #2029
OCPBUGS-23366: bindata/bootkube: Remove configmap-csr-controller-ca.yaml #2076
Full changelog

cluster-kube-controller-manager-operator

OCPBUGS-84560: CNTRLPLANE-3107: e2e testing automation Create network network policy test cases #931
CNTRLPLANE-3211: enable configurable PKI for managed certificate rotation #925
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

cluster-kube-scheduler-operator

OCPBUGS-83736: add /var/run/kubernetes as emptyDir #640
CNTRLPLANE-3219: vendor: bump library-go, api, client-go for configurable PKI #636
CNTRLPLANE-2756: Add operator and operand network policies #629
Full changelog

cluster-kube-storage-version-migrator-operator

OCPBUGS-84312: schedule migrator pods on control-plane nodes #162
CNTRLPLANE-3055: Migrate go standard casee to ote #156
Full changelog

cluster-monitoring-operator

MON-4543, OPNET-765: Add kubernetes-nmstate telemetry metrics to allowlist #2855
OCPBUGS-74645: delay alert dispatch in Alertmanager #2848
Full changelog

cluster-network-operator

OCPBUGS-83637: only report Progressing for active network rollouts #2962
CORENET-6543: Align VTEP CRD additionalPrinterColumns with upstream #2957
CNF-21001: multus: MultiNetworkPolicy nftables #2883
CORENET-6816: Add NetworkPolicies for CNO and its operands #2892
Full changelog

cluster-node-tuning-operator

OCPBUGS-85020: e2e: Add irqbalance StartLimitBurst >= 100 config test #1506
NO-JIRA: Bump ghw dependency #1492
Full changelog

cluster-olm-operator

OPRUN-4521: handle OCP 4.²³⁄₅.0 upgrade boundary #184
OCPBUGS-77899: Fix wait logic to handle NewOLM enabled on Default Feature #193
NO-ISSUE: remove no-op os.Remove call in TestRenderHelmTemplate #192
Full changelog

cluster-openshift-apiserver-operator

OCPBUGS-85097: e2e network policy tests #687
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

cluster-openshift-controller-manager-operator

OCPBUGS-81472: Prevent possibility of running controllers against empty informer caches #426
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

cluster-samples-operator

CNTRLPLANE-3176: implements operator tls config compliance #688
Full changelog

cluster-version-operator

OTA-1933: pkg/risk: Refactor alerts into a generic update-risk interface #1367
NO-JIRA: All CVO manifests in payload should be included #1337
Full changelog

console

OCPBUGS-85505: Add Suspense boundary to LazyRoutePage for plugin routes #16438
OCPBUGS-85494: Prevent binary secret data corruption when editing #16435
NO-JIRA: enable multi-architecture yarn builds #16415
OCPBUGS-85196: Remove @console imports from SDK dist #16407
OCPBUGS-84843: i18n upload/download routine task - version 4.22 #16382
OCPBUGS-85114: Fix SDK publish workflow for Yarn Berry #16403
OCPBUGS-84963: Add bottom pagination to ConsoleDataView for mobile responsiveness #16394
OCPBUGS-84556: re-enable helm-release.feature #16358
OCPBUGS-84916: Remove PII from events #16393
OCPBUGS-84811: fix Helm list page redirect after upgrade/rollback #16380
OCPBUGS-84848: Fix ConsoleDataView filter order: Name and Label should appear first #16383
OCPBUGS-84807: Fix race conditions in create-namespace Cypress tests #16379
OCPBUGS-84681: Fix crash when switching language to English #16373
OCPBUGS-84216: Fix create visual connector in Topology #16314
OCPBUGS-84345: Update resolveDynamicModuleMaps to skip unavailable packages #16342
OCPBUGS-83546: Fix Cypress test timeouts by using correct timeout option #16292
OCPBUGS-84246: prepare for 4.22-prerelease.3 sdk publish #16337
OCPBUGS-84246: 4.22 SDK fixes #16321
OCPBUGS-83543: Add empty state visibility check to CRD test #16309
OCPBUGS-83543: Fix race condition in CRD Cypress test #16290
CONSOLE-4809: Extend RTL Test Coverage for Components Migrated from Enzyme #16249
CONSOLE-4512, OCPBUGS-82473: Switch from legacy render to createRoot #16202
OCPBUGS-77113: remove dev to admin links as dev monitoring views are enabled #16163
NO-JIRA: Update Dockerfile.dev to use latest base images #16264
CONSOLE-5065: Refactor dynamic module import transform code #16224
OCPBUGS-76556: fix Developer Sandbox telemetry #16020
NO-JIRA: Add stefanonardo to frontend reviewers#16267 #16267
OCPBUGS-78904: Mark notification drawer title for translation #16229
CONSOLE-3955: Migrate LogSnippet to PatternFly component #16190
OCPBUGS-81654: Filter out isActionCell prop to fix React warning #16247
CONSOLE-5152: bump cypress to latest #16244
OCPBUGS-81744: Convert cluster update status integration test to unit test #16260
Full changelog

console-operator

OCPBUGS-79068: Fix HelmChartRepository YAML format #1129
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

UPSTREAM-SYNC: Sync release-4.22 with upstream release-1.35 #381
OCPBUGS-85241: Updating ose-openstack-cloud-controller-manager-container image to be consistent with ART for 4.22 #392
OCPBUGS-85239: Updating ose-openstack-cinder-csi-driver-container image to be consistent with ART for 4.22 #390
OCPBUGS-85240: Updating csi-driver-manila-container image to be consistent with ART for 4.22 #391
Full changelog

csi-driver-nfs

OCPBUGS-83946: CVE-2026-33186: bump google.golang.org/grpc to v1.79.3 #174
Full changelog

csi-external-attacher

OCPBUGS-83947: Bump google.golang.org/grpc to v1.79.3 #107
Full changelog

csi-external-provisioner

OCPBUGS-82033: Bump google.golang.org/grpc to 1.79.3 #133
Full changelog

docker-builder

OKD-322: Update Dockerfile to work on CentOS/RHEL 10 #500
Full changelog

docker-registry

OCPBUGS-84738: pin cloud.google.com/go/storage to v1.30.1 to fix blob deletion #470
Full changelog

gcp-cloud-controller-manager

OCPBUGS-78471: Fix OSD ILB bug #103
OCPCLOUD-3274: Merge https://github.com/kubernetes/cloud-provider-gcp:master (378730f) into main #99
Full changelog

gcp-cluster-api-controllers

OCPBUGS-83966: Merge https://github.com/kubernetes-sigs/cluster-api-provider-gcp:v1.11.2 (14609a0) into release-4.22 #293
OCPBUGS-84862: Updating ose-gcp-cluster-api-controllers-container image to be consistent with ART for 4.22 #286
Full changelog

gcp-pd-csi-driver

OCPBUGS-81649: Bump google.golang.org/grpc to v1.79.3 in release 4.22 #108
Full changelog

gcp-pd-csi-driver-operator

OCPBUGS-85023: Add test e2e manifest for images volumeSnapshotClass CSI tests #180
Full changelog

hyperkube, kube-proxy, pod

OCPBUGS-85415: [release-4.22] Improve WatchList test robustness #2663
OCPBUGS-84640: devicemanager: constrain topology hints to device NUMA nodes #2656
OCPBUGS-83607: Bump to k8s v1.35.4 #2646
OCPBUGS-84055: Update the csi-driver-host-path version to 1.17.1 #2650
Full changelog

hypershift

ACM-33601: use the latest ubi9 nginx image #8465
OCPBUGS-78988: bump go builder and ubi images #8457
CNTRLPLANE-2939: Coordinate CRD lifecycle with Cluster CAPI Operator #8442
OCPBUGS-85104: fix, cno, skip cloud-network-config-controller check on non-cloud platforms #8438
NO-JIRA: fix(ci): use PR base SHA for api-lint diff in GHA #8430
OCPBUGS-84841: fix(ingress): set FIPS_ENABLED env var on ingress operator #8388
OCPBUGS-83709: fix(kubevirt): filter link-local addresses from EndpointSlice endpoints #8272
OCPBUGS-78988: chore(deps): weekly dependabot consolidation #8383
OCPBUGS-84632: fix(azure): detect and replace stale role assignments on cluster re-creation #8359
OCPBUGS-83576: fix(metrics-proxy): resolve ports from pods instead of deployments #8260
NO-JIRA: revert: remove .git/ from .dockerignore #8234
OCPBUGS-83285: revert 5.0 supported version from release-4.22 #8216
CNTRLPLANE-3233: ci(gha): add release-4.22 branch to GitHub Actions workflows #8218
CNTRLPLANE-3197: update latest supported version from 4.22 to 4.23 #8193
CNTRLPLANE-3174: Add unit tests for CPO controller packages #8184
CNTRLPLANE-3215: fix envtest GHA workflow path filters for CRD test suites #8200
CNTRLPLANE-2078: add unit tests for AWS Route53 and IAM #8079
OCPBUGS-82301: fix(catalogs): use semver comparison for catalog version cap to handle OCP 5.0 #8195
NO-JIRA: control-plane-pki-operator: fix Event emission logic, format #8190
OCPBUGS-82192: fix(webhookcerts): handle upgrade from service-ca managed certs #8189
OCPBUGS-82159: fix(ignition-server): use major+minor version comparison for OCP 5.0 payloads #8182
CNTRLPLANE-2511: refactor(cpo): move OAuth internal LB annotation into ReconcileService #8185
CNTRLPLANE-2511: Support OAuth LoadBalancer with Azure Private Link Service #8149
OCPBUGS-81644: fix(cli): fix Azure destroy cluster leaving vnet/nsg resource groups for private topology #8151
OCPBUGS-33097: Remove deprecated OVNSbDb service type from default strategy mappings #8164
CNTRLPLANE-3174: test: Add unit tests for product-cli, token-minter, and sync-fg-configmap #8178
CNTRLPLANE-3050: feat(ci): use Konflux-built image for GitHub Actions runners #8092
CNTRLPLANE-2841: test(e2e): add metrics-forwarder e2e test verifying data-plane scraping #8147
CNTRLPLANE-3037: Create separate assets package specifically for CRD management #8150
GCP-462: Add GCP hosted cluster documentation #8027
NO-JIRA: docs(ci): add sync-community-fork token rotation guide #8173
CNTRLPLANE-2841: feat(HCCO): reintroduce guest cluster metrics forwarder for control plane metrics #8146
NO-JIRA: fix(e2e): handle rate limiter context deadline error during cleanup #8137
NO-JIRA: fix(ci): remove catch-all pattern from codecov ignore list #8171
CNTRLPLANE-2511: Allow LoadBalancer publishing strategy for OAuthServer on self-managed Azure #8148
NO-JIRA: chore(ci): add client/ to codecov ignore list #8167
NO-JIRA: feat(e2e): add Azure platform support for backup/restore tests #8144
And 5 elided commits (e.g. from squash or rebase merges)
Full changelog

insights-operator

OCPBUGS-83976: Bump google.golang.org/grpc to v1.79.3 #1287
Full changelog

ironic

OKD-362: Add watchdog to python-requirements.okd #844
OCPBUGS-84651: Bump sushy #843
OCPBUGS-82540: Bump pyasn1 to 0.5.1-5 #822
Full changelog

machine-api-operator

OCPCLOUD-3346: tls: use centralized TLS #1456
Full changelog

machine-config-operator

OCPBUGS-85481: Add fix for ossImagestream status #6026
OCPBUGS-84813: Include RootCA in the temporal CC #5904
OCPBUGS-84406: Fix CVE-2026-34986 #5986
OCPBUGS-85156: Bootloader update attempt should be conditional #6011
OCPBUGS-84693: prom rules: add alert for nodes using runc #5998
OCPBUGS-84667: Fix encapsulated IGN version #5895
OCPBUGS-84480: Fix units rollback if update failure #5882
OCPBUGS-84949: Fix OCL test to handle temporarily empty current-machine-os-build annotation #5989
OCPBUGS-84840: Fix ssh and password rollbacks #5906
OCPBUGS-84865: MachineOSConfig “build was not found” error #5912
OCPBUGS-83779: Auto-append :ref suffix to additionalLayerStores in storage.conf #5903
OCPBUGS-84861: Update AMI Whitelist #5911
OCPBUGS-84850: Custom pool booting must handle matchExpressions in nodeSelector #5909
OCPBUGS-84849: Support bootloader update #5908
OCPBUGS-84719: deploy-from-self when skopeo < 1.22.2 #5901
OCPBUGS-84700: Bump image build timeout for status reporting test #5900
OCPBUGS-83818: ClusterHostedDNS on AWS/Azure/GCP: Modify Corefile template to better handle empty record types #5862
OCPBUGS-83771: Make IRI registry read-only via environment variable #5859
OCPBUGS-83577: Allow enablement of systemd units with existing files #5855
OCPBUGS-83559: Update AMI Whitelist #5853
OCPBUGS-83540: order corosync after OVS configuration on TNF clusters] #5852
Revert “OCPBUGS-69936: ovs: increase CPU priority for Open vSwitch Forwarding Unit” #5850
MCO-2135: Add test for OSStream labeling of Machines, MachineSets, and ControlPaneMachineSets #5814
AGENT-1307: add MCD IRI manager #5807
MCO-2202: separate duplicate PinnedImageSet validation into OCP-88562 #5839
MCO-2163: adds machine-config-osimagestream installer helper #5770
OCPBUGS-69936: ovs: increase CPU priority for Open vSwitch Forwarding Unit #5797
MCO-1972: Removes OSImageURLConfig from the build controller #5424
Reapply “MCO-2120: Rework OS Image Stream label classification” #5767
Full changelog

metallb-frr

OCPBUGS-84960: [release-4.22]: Bump to frr10 #130
Full changelog

monitoring-plugin

OCPBUGS-85088: Sync Main to 4.22 #916
OU-1307: [release-4.22] don’t fight console to setActiveNamespace #881
NO-JIRA: re-enable get CSRF token #876
OU-1264: mcpToolUI basic implementation for OpenShift Lightpseed + obs-mcp + Perses #797
NO-JIRA: breaking changes follow up #875
OU-1175: OCP 4.22 Breaking Changes #863
OCPBUGS-81567: fix: re encode params when redirecting from graph to query-browser #869
OU-1184: lint enabled against cypress files and changes post coo #862
Full changelog

must-gather

MG-241: Adding support for skipping rotated logs #536
Full changelog

network-tools

NO-JIRA: Image slimming #154
Full changelog

networking-console-plugin

CNV-74110: new translations #407
OCPBUGS-84204: CVE dependency remediation #381
Bump lodash from 4.17.23 to 4.18.1 #366
OCPBUGS-70285: Upgrade cypress to v15 to fix CVEs #345
Full changelog

oauth-apiserver

OCPBUGS-82579: [release-4.22]: chore: sync with openshift repositories #191
Full changelog

oauth-server

OCPBUGS-82579: [release-4.22]: chore: sync with openshift repositories #222
Full changelog

oc-mirror

CLID-532: Separate Image struct into AdditionalImage, BlockedImage, SampleImage #1372
OCPBUGS-62603: Fix printing collection messages with 0 collection items #1385
OCPBUGS-61136: Only print catalog rebuild message if there are catalo… #1386
CLID-524: additionalImages collector error handling #1343
CLID-535: api: use OCI definitions from opencontainers spec #1341
Full changelog

olm-catalogd, olm-operator-controller

OCPBUGS-85059: fix(test): drop blocking namespace-deletion wait between both-watch-modes scenarios #714
OPRUN-4546: Fix boxcutter finalizer ResourceNames in preflight test #695
NO-ISSUE: Synchronize From Upstream Repositories #694
Full changelog

openshift-apiserver

OCPBUGS-82579: [release-4.22] CNTRLPLANE-3226: Sync with openshift apiserver 4.22 kubernetes 1.34.1 #631
Full changelog

openstack-cluster-api-controllers

UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.14 into release-4.22 #409
OCPBUGS-84994: Updating openstack-cluster-api-controllers-container image to be consistent with ART for 4.22 #410
Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

OCPBUGS-84411, OCPBUGS-84412: Update github.com/go-jose/go-jose/v4 to v4.1.4 [release-4.22] #1292
OCPBUGS-77984: test(olm): skip ppc64le/s390x for tests using single-arch images #1276
NO-ISSUE: Synchronize From Upstream Repositories #1278
NO-ISSUE: Synchronize From Upstream Repositories #1277
NO-ISSUE: retry transient registry errors in opm QE #1272
NO-ISSUE: Synchronize From Upstream Repositories #1275
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-84384: CORENET-6537: OTE: Add external container support to infra provider #3147
OCPBUGS-83535: CARRY: skip ote tests 4.22 #3139
NO-JIRA: DownStream Merge [2026-04-09] #3126
NO-JIRA: DownStream Merge [04-02-2026] #3114
NO-JIRA: Disable informing tests for the time being #3118
Full changelog

powervs-block-csi-driver

OCPBUGS-84007: Mitigate CVE-2026-33186 by bumping grpc-go to v1.79.3 #132
Full changelog

powervs-block-csi-driver-operator

OCPBUGS-84008: Mitigate CVE-2026-33186 by bumping grpc-go to v1.79.3 #113
Full changelog

powervs-cloud-controller-manager

OCPBUGS-83398: Merge https://github.com/IBM-Cloud/cloud-provider-ibm:release-1.35 (e48649f) into release-4.22 #95
Full changelog

prometheus

OCPBUGS-84010: bump google.golang.org/grpc to v1.79.3 [release-4.22] #310
Full changelog

rhel-coreos, rhel-coreos-10, rhel-coreos-10-extensions, rhel-coreos-extensions

NO-JIRA: Revert “OCPBUGS-77244: 9.8: override runc package to pull in newer fixes” #1925
OCPBUGS-64841: post-process: Remove workaround for openvswitch additional group #1918
OCPBUGS-77244: 9.8: override runc package to pull in newer fixes #1923
Full changelog

service-ca-operator

OCPBUGS-84953: e2e network policy tests #353
OCPBUGS-82110: fix service-ca-controller CrashLoop on MicroShift #344
CNTRLPLANE-2845: add service-ca operator and workload network policies #324
CNTRLPLANE-2947: Enable configurable PKI for signing CA and serving certificates #327
Full changelog

telemeter

OCPBUGS-84021: update google.golang.org/grpc #605
OCPBUGS-84937: fix(deps): bump go-jose/v3 to v3.0.5 for JWE unwrap DoS #598
Full changelog

tests

OCPBUGS-85339: Add e2e tests for KubeletEnsureSecretPulledImages feature gate #31148
OCPBUGS-85089: Allow OVN-Kubernetes CIDROverlap pathological events #31141
OCPBUGS-85122: Add ArtifactVolume tests and register artifact image #31108
OCPBUGS-84944: Fix timeout in PinnedImages GC test #31115
OCPBUGS-84946: skip on BM which has insufficient host #31116
OCPBUGS-84958: Optimize NetworkPolicy reconciliation test to reduce timeout #31119
OCPBUGS-84382: Add [Late] test to collect CRI-O goroutine dumps via SIGUSR1 #31074
OCPBUGS-84382: test: add monitortest to detect pods stuck in Pending state #31073
OCPBUGS-84888: Disable particular CSI tests if CSI driver is removed #31111
OCPBUGS-84654: fix openshift/network/third-party suite selecting zero tests #31090
SREP-4676: skipping namespaces are using default sa #31101
OCPBUGS-84362, OCPBUGS-84363: fix: skip unused tests for two node #31069
OCPBUGS-84706: Skip dev fuse test on runc runtime #31099
OCPBUGS-84628: Fix project name error during wait #31085
OCPBUGS-84674: retry transient kubeconfig read failures in GetClientConfig #31096
OCPBUGS-84676: Add sleep to give cvo time to reconcile #31097
OCPBUGS-84231: Skip image-registry operator tests for Libvirt platform in upgrade jobs. #31060
OCPBUGS-84322: Fix Gateway cleanup in parallel e2e test workers #31068
OCPBUGS-84049: [CNTRLPLANE-2751]:Adding e2e network policy cases for config-operator #31076
“OCPBUGS-84206: [release-4.22] STOR-2807: Add e2e test to verify CSI driver operators use service CA signed certificates” #31048
OCPBUGS-84210: skip serial and disruptive cases from suite #31057
OCPBUGS-84319: cache kube client instance #31067
OCPBUGS-84298: Skip test case updateLifecycle if the worker pool is paused #31065
OCPBUGS-84222: OVNK BGP: Improve VRF-Lite test stability #31058
OCPBUGS-83803: Move imagepolicy test to disruptive long-running suite #31056
OCPBUGS-83783: Add test to verify for backup container exists when etcd crashes #31035
OCPBUGS-83778: Verify etc pod should start with oom_score_adj as system-node-critical #31034
OCPBUGS-83712: Use upgrades.Skippable for Gateway API upgrade test skip logic #31030
OCPBUGS-83787: OCPSTRAT-3082:TLS propagation test #31038
OCPBUGS-78997: Revert “NO-ISSUE: test/e2e/upgrade: Raise default update-ack timeout to 10m” #30919
OCPBUGS-82557: DCM tests need to be backward compatible #30999
OCPBUGS-77948, OCPBUGS-77949, OCPBUGS-78298, OCPEDGE-2443: TNF node replacement test updates #30846
NO-JIRA: Update OWNERS #30996
OCPBUGS-82046: Revert “remove some duplicate ovnk test cases” #30975
OCPBUGS-78090: Avoid copy of the oc binary, to support heterogeneous environments #30992
OCPBUGS-81340: fix pacemaker CronJob duplicate-event namespace #30985
OCPEDGE-2491: Log pcs status and etcd member list after every recovery #30949
NE-2561: Add Gateway API OLM to NO-OLM migration upgrade test #30897
OCPBUGS-81716: Add retry logic for transient network errors in restartKubeletOnNode #30966
CORENET-6168: Add ovn tests extension #30560
OCPBUGS-81640: test/ccm: upgrade ccm healthz test to use aws sdk v2 #30954
TRT-2084: terminationmessagepolicy: relax for 5.0 #30979
OCPBUGS-81340: openshift-tests: allow duplicate pacemaker status collector CronJob events #30953
OCPBUGS-81737: Dynamically find worker-generated-kubelet MC name to support different platforms #30967
OCPBUGS-81742: Add exception for the newly added kas-bootstrap-container #30963
OCPNODE-4224: Migrating test case OCP-70987 from OTP to origin #30948
OCPBUGS-82039: Fix DCM ingress tests to support IPv6-only clusters #30972
OCPBUGS-81685: OVNK BGP: fix curl arguments not properly tokenized #30961
OCPBUGS-81751: Fix GatewayClass update conflict in markTestDone #30964
NO-JIRA: Ignore extra fields #30939
NO-JIRA: fix CUDN status condition tests for new TransportAccepted condition #30958
Full changelog

vsphere-cloud-controller-manager

NO-JIRA: Merge https://github.com/kubernetes/cloud-provider-vsphere:release-1.35 (93af0f7) into main #113
Full changelog

vsphere-cluster-api-controllers

OCPBUGS-84028: Merge https://github.com/kubernetes-sigs/cluster-api-provider-vsphere:v1.15.3 (e917f8e) into release-4.22 #108
Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

OCPBUGS-81525: Bump google.golang.org/grpc to 1.79.3 #170
Full changelog

Node Image Info

Loading node image info, this may take a while ...