# 4.16.22

Created: 2024-11-14 11:44:29 +0000 UTC

Image Digest: `sha256:c41d3db47d19c363dd13fea11df892ee6784ec7e2baea498ac8999455319df84`


## Changes from 4.16.0

### Components

* Kubectl upgraded from 1.29.1 to 1.29.7
* Kubernetes upgraded from 1.29.5 to 1.29.9
* Kubernetes Tests 1.29.0
* Red Hat Enterprise Linux CoreOS upgraded from 416.94.202406172220-0 to 416.94.202411111409-0



### FeatureGate Changes
| FeatureGate | Default<br/>Hypershift | Default<br/>SelfManagedHA | DevPreviewNoUpgrade<br/>Hypershift | DevPreviewNoUpgrade<br/>SelfManagedHA | TechPreviewNoUpgrade<br/>Hypershift | TechPreviewNoUpgrade<br/>SelfManagedHA  |
| :------ | :---: | :---: | :---: | :---: | :---: | :---:  |
| ExternalRouteCertificate <br/> (0 tests)| Unconditional<br/>(Changed)| Unconditional<br/>(Changed)| Unconditional<br/>(Changed)| Unconditional<br/>(Changed)| Unconditional<br/>(Changed)| Unconditional<br/>(Changed) |


### New images

* [operator-framework-tools](https://github.com/openshift/operator-framework-olm) git [c50e9ce2](https://github.com/openshift/operator-framework-olm/commit/c50e9ce2b292a188e99e72fc6dc59d1fb5e9e0cb) `sha256:50a1c11a1745fd337587ecb1510382ddd923dbf72bcd16f4270633e590f2eebd`


### Rebuilt images without code change

* [agent-installer-utils](https://github.com/openshift/agent-installer-utils) git [6e6bb40d](https://github.com/openshift/agent-installer-utils/commit/6e6bb40d95bd966eb6b152e66c5b91794806c4bc) `sha256:521fb26c14e00a16524469ac5ff9e15fcc163854229a3d13a335c8c7e5a299c1`
* [alibaba-cloud-controller-manager](https://github.com/openshift/cloud-provider-alibaba-cloud) git [97e8335e](https://github.com/openshift/cloud-provider-alibaba-cloud/commit/97e8335e2f0bc9ee48fe04f2c19820b557035d37) `sha256:c406784c4b15bcfac966b051c49a0bf94cad7b2e5aef6fcd5c0195b79fb37cef`
* [alibaba-machine-controllers](https://github.com/openshift/cluster-api-provider-alibaba) git [064d4624](https://github.com/openshift/cluster-api-provider-alibaba/commit/064d4624c74d417dd31cf1c173c00c3fa98ffade) `sha256:85d72e68f3aa7f76220c1af1dec3d099072a623a70fefadb8bb7b2bb955b09c3`
* [aws-cloud-controller-manager](https://github.com/openshift/cloud-provider-aws) git [a53e9def](https://github.com/openshift/cloud-provider-aws/commit/a53e9def2e60eecd390575b59c85d54c5412ecd3) `sha256:7c198d37b54f089ff37ac83915c7d374387149e847b8746ee84f8a627904845f`
* [aws-ebs-csi-driver](https://github.com/openshift/aws-ebs-csi-driver) git [1d29a74a](https://github.com/openshift/aws-ebs-csi-driver/commit/1d29a74ab7cde7424cac99261b90f23dc7a2fc21) `sha256:cc6472e614b4216271e7f0a116472e1ec16aa1a73684446db7fc16e3783613c8`
* [aws-ebs-csi-driver-operator](https://github.com/openshift/csi-operator) git [ff69cd03](https://github.com/openshift/csi-operator/commit/ff69cd0336ab92035d3d57af0ec71ff7b52f0f17) `sha256:adc5e6c42b0239cf0bae5a820c950cfb66eee7af3ddb4c9d464b00394ef38111`
* [aws-machine-controllers](https://github.com/openshift/machine-api-provider-aws) git [61d60f6c](https://github.com/openshift/machine-api-provider-aws/commit/61d60f6ca20443df434456c2f3eeba859634e6a2) `sha256:4f4992a78b8658120e71718025c49cd65883833531b8d3491dfde346f73e08f0`
* [aws-pod-identity-webhook](https://github.com/openshift/aws-pod-identity-webhook) git [746491a6](https://github.com/openshift/aws-pod-identity-webhook/commit/746491a64a4efc04132ceb641cee52c2ead3facd) `sha256:e63625df136486bb02d8abff42f8ee0711f7354fde3949f4a612f951fac16772`
* [azure-cloud-controller-manager](https://github.com/openshift/cloud-provider-azure) git [0e955329](https://github.com/openshift/cloud-provider-azure/commit/0e9553295ecd02d6ef0aff19dfc1dfe680993112) `sha256:d5755ced29bfb1c767454d4e53061720b46b5923cf1e8f7cda3e53a0e783e744`
* [azure-cloud-node-manager](https://github.com/openshift/cloud-provider-azure) git [0e955329](https://github.com/openshift/cloud-provider-azure/commit/0e9553295ecd02d6ef0aff19dfc1dfe680993112) `sha256:70b5737b5ae469c5254c1a540fd5e69d7bff5229fbaff00d23f25c49210437b9`
* [azure-disk-csi-driver](https://github.com/openshift/azure-disk-csi-driver) git [6b55f6fb](https://github.com/openshift/azure-disk-csi-driver/commit/6b55f6fb004454f743aa0f2e1d96010396be4c45) `sha256:01541aa3bf506b70169ed44f6e0c79d6e151ef23cd9369839bc3312c87b72717`
* [azure-disk-csi-driver-operator](https://github.com/openshift/csi-operator) git [ff69cd03](https://github.com/openshift/csi-operator/commit/ff69cd0336ab92035d3d57af0ec71ff7b52f0f17) `sha256:5d575425b73eaddac2ffdb352beff51ff25867e39195bb7ee63f6f6bce9cf945`
* [azure-file-csi-driver-operator](https://github.com/openshift/csi-operator) git [ff69cd03](https://github.com/openshift/csi-operator/commit/ff69cd0336ab92035d3d57af0ec71ff7b52f0f17) `sha256:b8f1ebf4b91b8bf90f325e6c23a7c582c7a4a4583138f935f11f49e34faa9525`
* [azure-workload-identity-webhook](https://github.com/openshift/azure-workload-identity) git [4aca092a](https://github.com/openshift/azure-workload-identity/commit/4aca092a13f62e48c700a910e8f3f0f228a7d822) `sha256:91c8ab14b2963a5f6c6ef5953c65cd2df6a15abc9f87cea5121b25c4d7cd64c7`
* [baremetal-machine-controllers](https://github.com/openshift/cluster-api-provider-baremetal) git [11ba601f](https://github.com/openshift/cluster-api-provider-baremetal/commit/11ba601fbca58557176fcc67ffe8d7d64b697a4a) `sha256:b02ea1a69831b8c38d15b9c0b68d4d688a7fb6c0949418dc10893287661336d2`
* [cloud-network-config-controller](https://github.com/openshift/cloud-network-config-controller) git [8ceee788](https://github.com/openshift/cloud-network-config-controller/commit/8ceee78810756afaa2efb75f60bef0358502834f) `sha256:d0c3fbabaf9f39715715cad424d209e3b654301e9d02caa53c7127b3f88a5920`
* [cluster-autoscaler](https://github.com/openshift/kubernetes-autoscaler) git [eecb123a](https://github.com/openshift/kubernetes-autoscaler/commit/eecb123a3b02358046a2c2ce52adfc548a5caa17) `sha256:7f1df31add1512a69529ed11c7296d4d873e44f3b957dacbc7dd6596ac8c399c`
* [cluster-autoscaler-operator](https://github.com/openshift/cluster-autoscaler-operator) git [40cadf8a](https://github.com/openshift/cluster-autoscaler-operator/commit/40cadf8a4729ca808a3413e9b8593ab7aab0bed7) `sha256:dedf2d2b7b09fd5399e400dde52ec74465177a1212ccc671fd0737fadc955427`
* [cluster-bootstrap](https://github.com/openshift/cluster-bootstrap) git [27bfb59f](https://github.com/openshift/cluster-bootstrap/commit/27bfb59fd0ff399224ee673869b8875ef10f1962) `sha256:a925e3e0df4ea327e7d5a257ba735e00bf75f5172d9a5deaa716105ce33211f0`
* [cluster-capi-controllers](https://github.com/openshift/cluster-api) git [5830a10a](https://github.com/openshift/cluster-api/commit/5830a10a2f545dc25ff4ca4c4efd9005088676aa) `sha256:42643e8e85525e0e34ce883c2127f257895c90db86bc78cde116c49ab3e5a76f`
* [cluster-config-operator](https://github.com/openshift/cluster-config-operator) git [441d29c9](https://github.com/openshift/cluster-config-operator/commit/441d29c92b1759d1780a525112e764280b78b0d6) `sha256:a677c2b7665ed2a69fe3eb791c974fec3143e3fa245bb816c9568f03d93f53b5`
* [cluster-csi-snapshot-controller-operator](https://github.com/openshift/cluster-csi-snapshot-controller-operator) git [439826e1](https://github.com/openshift/cluster-csi-snapshot-controller-operator/commit/439826e1a723c094717877db0f2ca1848d0fb10a) `sha256:42ccb7180c1707753293b95c4f756e835dd5489c6f43c6aa4a186069f1e277c4`
* [cluster-kube-cluster-api-operator](https://github.com/openshift/cluster-api-operator) git [95ceaa9e](https://github.com/openshift/cluster-api-operator/commit/95ceaa9e2e1fea94e82e078a77633c8cd105a3c7) `sha256:3edd94c14ea2c0692ce29d2b5a2f73043ecea7df27224e4b7c3e337bb93b4dbc`
* [cluster-kube-controller-manager-operator](https://github.com/openshift/cluster-kube-controller-manager-operator) git [0338b3be](https://github.com/openshift/cluster-kube-controller-manager-operator/commit/0338b3be6912024d03def2c26f0fa10218fc2c25) `sha256:999db63f0cdcd3865b0ff684e6a06b783e72fcfd6ee89e5924224d042bfe68d3`
* [cluster-kube-scheduler-operator](https://github.com/openshift/cluster-kube-scheduler-operator) git [630f63bc](https://github.com/openshift/cluster-kube-scheduler-operator/commit/630f63bc7a30d2662bbb5115233144079de6eef6) `sha256:662c032441827ce83f6c8e314ea93ddc89782c87024b32acb364bf680246bf5d`
* [cluster-machine-approver](https://github.com/openshift/cluster-machine-approver) git [3eba7eed](https://github.com/openshift/cluster-machine-approver/commit/3eba7eeda244ea48c520d5384547659e9257cb58) `sha256:20541e20f93b98729ea6006e42c272ba5048d91d7def30447cf0cb12963b640a`
* [cluster-olm-operator](https://github.com/openshift/cluster-olm-operator) git [27bf70dd](https://github.com/openshift/cluster-olm-operator/commit/27bf70ddf9421637e1da18b249785b2cca177272) `sha256:3d5397d64ef31b301022168d5bcbf8203d5ffebfd685e8f264ba602d79e34ebc`
* [cluster-openshift-apiserver-operator](https://github.com/openshift/cluster-openshift-apiserver-operator) git [d26f3002](https://github.com/openshift/cluster-openshift-apiserver-operator/commit/d26f3002e10be6f206f69a829d1511130e8188d9) `sha256:b692033c27bd775f0ec06cb2d54781ca1a26c3547d5597d9ec018ebcfe1e2955`
* [cluster-policy-controller](https://github.com/openshift/cluster-policy-controller) git [eaea543f](https://github.com/openshift/cluster-policy-controller/commit/eaea543f4c845a7b65705f12e162cc121bb12f88) `sha256:5f205997b18408d5b61f036babaf601e5d10dc55e06bcf737ff71518934bcad3`
* [configmap-reloader](https://github.com/openshift/configmap-reload) git [dc91ddc4](https://github.com/openshift/configmap-reload/commit/dc91ddc4ad8139c9c0bccaba22b65b0bf364d81e) `sha256:85289316569f64dffebd052d2d59201a9febcd10e459d87f1f904de60c7a8818`
* [csi-driver-nfs](https://github.com/openshift/csi-driver-nfs) git [406cec72](https://github.com/openshift/csi-driver-nfs/commit/406cec72a10684a7545a976a8c31e60712bcc5b2) `sha256:0450691306a6b589801723684ebc8521290c6d7718144a1a1fbfe535c1ddd3b7`
* [csi-driver-shared-resource](https://github.com/openshift/csi-driver-shared-resource) git [bc125def](https://github.com/openshift/csi-driver-shared-resource/commit/bc125def6a15a71b2ef8c59e9c1284e471e7d905) `sha256:a88a3f11d562365c6a92159243941eac76a213e8951ce0cc2055b81e92fc35cb`
* [csi-driver-shared-resource-operator](https://github.com/openshift/csi-driver-shared-resource-operator) git [1e1194bc](https://github.com/openshift/csi-driver-shared-resource-operator/commit/1e1194bc659a5c8cfbbfeedd9d9c15540ecda0d7) `sha256:54192f934589799b81c710d6410faa9696a7c8a56a176dc72e4196da10ced2c9`
* [csi-driver-shared-resource-webhook](https://github.com/openshift/csi-driver-shared-resource) git [bc125def](https://github.com/openshift/csi-driver-shared-resource/commit/bc125def6a15a71b2ef8c59e9c1284e471e7d905) `sha256:28b1269121cd53a65ab75da41a6ebe47238f3cebb63d25917a0095b02f483102`
* [csi-external-attacher](https://github.com/openshift/csi-external-attacher) git [7da80aab](https://github.com/openshift/csi-external-attacher/commit/7da80aab15cabd182ee35742443c0b836de4e180) `sha256:5bc7bfb014fccf6a29753574553c1da2addaf0994d026f95990aa062fed7f6a6`
* [csi-external-provisioner](https://github.com/openshift/csi-external-provisioner) git [9e8af011](https://github.com/openshift/csi-external-provisioner/commit/9e8af011e0a0aea96066821b57c42bdaccf24a42) `sha256:9e1fe527e4c089f137e6780699ae7aff8a0391f9f787e3d0019dd2f022bcfe1d`
* [csi-external-resizer](https://github.com/openshift/csi-external-resizer) git [bdf5bfb4](https://github.com/openshift/csi-external-resizer/commit/bdf5bfb4da07be6a85ae5253218f29fb8af51adf) `sha256:b48d8766b64e28e5765869edcea7edf4ef7355b5c69dc8e96af033e9fbc349f9`
* [csi-external-snapshotter](https://github.com/openshift/csi-external-snapshotter) git [5315d37a](https://github.com/openshift/csi-external-snapshotter/commit/5315d37a1e5415e8b6870f23e50238681979cc28) `sha256:f784ee0bb36cfa7a47985cbd507efd034c7c204f859a5bd7c6d18be99793cff4`
* [csi-livenessprobe](https://github.com/openshift/csi-livenessprobe) git [f5e3ff55](https://github.com/openshift/csi-livenessprobe/commit/f5e3ff5532d58af34b5b407be2cac6934c1ff223) `sha256:b6900242fd456c8320273186ec38a971e478ed545180547df9c75502d2b902f0`
* [csi-node-driver-registrar](https://github.com/openshift/csi-node-driver-registrar) git [8930c368](https://github.com/openshift/csi-node-driver-registrar/commit/8930c368500a5d1f15c3e1a5906397e206879de0) `sha256:3edd19b26087eedba087fd01d31fb5d9eaa591ad1114212b8c8104328cd8e658`
* [csi-snapshot-controller](https://github.com/openshift/csi-external-snapshotter) git [5315d37a](https://github.com/openshift/csi-external-snapshotter/commit/5315d37a1e5415e8b6870f23e50238681979cc28) `sha256:e0af3d1b7b1352b79bbd963e58c4e0d5289168d2f6faaf08edc2e764f1a1b9da`
* [csi-snapshot-validation-webhook](https://github.com/openshift/csi-external-snapshotter) git [5315d37a](https://github.com/openshift/csi-external-snapshotter/commit/5315d37a1e5415e8b6870f23e50238681979cc28) `sha256:41418dafa4fc53ff3a75edafbdbad7fb4d9905eb2d89ef6a0dfac12e9527869c`
* [driver-toolkit](https://github.com/openshift/driver-toolkit) git [1d5732f0](https://github.com/openshift/driver-toolkit/commit/1d5732f0209bb7d98661a53c66c5ac265272dce6) `sha256:56d46f312253d113bb362792c491697a13063fc2cc57fa143ceba6c79739f326`
* [gcp-cloud-controller-manager](https://github.com/openshift/cloud-provider-gcp) git [26b43dfc](https://github.com/openshift/cloud-provider-gcp/commit/26b43dfc7ddce718014b8991db10cbff30b7b117) `sha256:5db90564d6f79157b216bfa6c42345cf7e139cf44c930537735c1b0c296563fd`
* [gcp-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-gcp) git [02432df8](https://github.com/openshift/cluster-api-provider-gcp/commit/02432df87df9a731c8d630311854fbd515602e91) `sha256:faa9fbf761b7caeabbeb9767d95bb53f6e8fa06662b63dbf01b15a89ec0d43f6`
* [gcp-machine-controllers](https://github.com/openshift/machine-api-provider-gcp) git [e72657c0](https://github.com/openshift/machine-api-provider-gcp/commit/e72657c0d2713842f701f1d43c777d6ec6880cb9) `sha256:fff20daffc9647d4bd4fd71cecf422c779e8dab4352b0c7846f14f15b0df83e2`
* [gcp-pd-csi-driver](https://github.com/openshift/gcp-pd-csi-driver) git [5ed71c64](https://github.com/openshift/gcp-pd-csi-driver/commit/5ed71c64ce9c1879f0d2a17976387f1b0292796d) `sha256:b447089f42f352b121d39103cc2a6b4c76d3f236e7647d75b056aed406df64ac`
* [gcp-pd-csi-driver-operator](https://github.com/openshift/gcp-pd-csi-driver-operator) git [799327f7](https://github.com/openshift/gcp-pd-csi-driver-operator/commit/799327f7c45b362beadc39e85b9e773cab3654c5) `sha256:c18e5cf3bcc11557d530306e55453e8477723d7f8e8a9694e8f87d2f8ca90f6a`
* [haproxy-router](https://github.com/openshift/router) git [4d9b8c4a](https://github.com/openshift/router/commit/4d9b8c4afa6cd89b41f4bd5e7c09ccddd8679bc6) `sha256:a10db45170704ab93913db34a7f3f8ee40b05aba2e66b0649ed1c3531070b6a6`
* [ibm-cloud-controller-manager](https://github.com/openshift/cloud-provider-ibm) git [f961f16d](https://github.com/openshift/cloud-provider-ibm/commit/f961f16d17dcd6f7e43fd7fed967ce3b06ec9494) `sha256:15aa01188898153721b0650fe3610faade87e51631402da0ffd4ce63b3bb82d7`
* [ironic-machine-os-downloader](https://github.com/openshift/ironic-rhcos-downloader) git [93b8b5fa](https://github.com/openshift/ironic-rhcos-downloader/commit/93b8b5fa33950cadd2310278b7c762ebe0057418) `sha256:9352f0a3c96e80b36c1a49035434973e4fd7da35cf18dc064a6166a6ab8bd49e`
* [ironic-static-ip-manager](https://github.com/openshift/ironic-static-ip-manager) git [e78e4c3e](https://github.com/openshift/ironic-static-ip-manager/commit/e78e4c3e6db1805816308197eb9002dfbca27560) `sha256:baaabfbe2a3e86588682d1992eb71c239d4f0fdcc394e677ee1d86834d074078`
* [k8s-prometheus-adapter](https://github.com/openshift/k8s-prometheus-adapter) git [e4f859be](https://github.com/openshift/k8s-prometheus-adapter/commit/e4f859be4f56d1fc65138f99f5331baf17c15885) `sha256:60cdf1718a999af97cc29cab0d9ce903cddd0905fca8b0c85100a738e580f3ed`
* [kube-state-metrics](https://github.com/openshift/kube-state-metrics) git [9b67b8d1](https://github.com/openshift/kube-state-metrics/commit/9b67b8d1adbd63e27b622b3d050e0673766a6f2d) `sha256:714d2252a5ab6e7fee4e396329345872dbf6f2854b219dc8208273a9b82f00db`
* [kube-storage-version-migrator](https://github.com/openshift/kubernetes-kube-storage-version-migrator) git [969a60e9](https://github.com/openshift/kubernetes-kube-storage-version-migrator/commit/969a60e9e2466c44f5b3ffd43fe3ecab11bf1e51) `sha256:a7a798a99f114aaa997f950259e87e6953e3f1a3a90ffd2826f45d5e2ec61023`
* [kubevirt-cloud-controller-manager](https://github.com/openshift/cloud-provider-kubevirt) git [3db76104](https://github.com/openshift/cloud-provider-kubevirt/commit/3db76104a38bd9160ca24e2ed4a33649843f210a) `sha256:05edc21c8a327df0763f71b47e316e79d85cad20cb1b0bf7dda25ac476631265`
* [kubevirt-csi-driver](https://github.com/openshift/kubevirt-csi-driver) git [0693093f](https://github.com/openshift/kubevirt-csi-driver/commit/0693093f773c5046e231f174e7930315feabd996) `sha256:18265e1ada8a32fb4a4ff386f5c052427f949368b2afdf9436238e355a1bd325`
* [libvirt-machine-controllers](https://github.com/openshift/cluster-api-provider-libvirt) git [a336f0b5](https://github.com/openshift/cluster-api-provider-libvirt/commit/a336f0b5f7ee99c418aaab3d511707bd0064bd56) `sha256:b27afd988f453c2e3664899a82a22035dfa0ccd417b7369b1dd376d8583b5dcd`
* [machine-image-customization-controller](https://github.com/openshift/image-customization-controller) git [39480963](https://github.com/openshift/image-customization-controller/commit/394809633b6b2e33ea1af444f7237f066bf0abb1) `sha256:0d18fed32abc347963d8a593876659fffeba2b4b187881b7647a56d47a1ed3f6`
* [machine-os-images](https://github.com/openshift/machine-os-images) git [3cc97098](https://github.com/openshift/machine-os-images/commit/3cc97098ecb9870dcb571f1ed1e26e2f70ce9f8c) `sha256:3c3c670b81807ed2e33d2965889af90bc33c3532fa6df7c8c36c98c6ca8a3dd2`
* [multus-cni](https://github.com/openshift/multus-cni) git [c4aa21b9](https://github.com/openshift/multus-cni/commit/c4aa21b9bfed4ebafc2e67ca1474e245b67b5f9f) `sha256:66a46c4c4a266f1745f1ff556a892636457d1f4128ba6fe1daaa7795d5460638`
* [multus-cni-microshift](https://github.com/openshift/multus-cni) git [c4aa21b9](https://github.com/openshift/multus-cni/commit/c4aa21b9bfed4ebafc2e67ca1474e245b67b5f9f) `sha256:667fe07e934e04aabb774a74983b1f24ee02c4b86e4a4ae8d6c2da26f7538bb2`
* [network-interface-bond-cni](https://github.com/openshift/bond-cni) git [bb911451](https://github.com/openshift/bond-cni/commit/bb911451158fc06f193917863778434944e88ae1) `sha256:eccd5c8e9223d5befb2791c1cdbfe4704632487ea726efec71cafa6101f781f8`
* [network-tools](https://github.com/openshift/network-tools) git [39eca100](https://github.com/openshift/network-tools/commit/39eca100c0978fb59234e21bf549b130914616ac) `sha256:6577ffa4cfbbf8b15b8d29a8e2e370d8e25aa58b5b359da3a501eeef3f7c7d09`
* [nutanix-cloud-controller-manager](https://github.com/openshift/cloud-provider-nutanix) git [c9bbc44c](https://github.com/openshift/cloud-provider-nutanix/commit/c9bbc44c0200c8061506c465d0eb3c97fe94e197) `sha256:03fc08d083c65cc60000ea16de80d729f161a579c5ab011945982690c237f5b2`
* [nutanix-machine-controllers](https://github.com/openshift/machine-api-provider-nutanix) git [f053e5a0](https://github.com/openshift/machine-api-provider-nutanix/commit/f053e5a0ee58d20066efff8db01578785ea83dad) `sha256:35a4755835f834233cbb014e2aee2b11c13b2ec79b994cc23581400084254537`
* [oauth-apiserver](https://github.com/openshift/oauth-apiserver) git [fa1f097c](https://github.com/openshift/oauth-apiserver/commit/fa1f097c2800b06b3b56537651294d023762a4eb) `sha256:55952992000b46d66e08566ac9f498fda8e995eb0e21990175bae8a98a02cd02`
* [oauth-proxy](https://github.com/openshift/oauth-proxy) git [30f80124](https://github.com/openshift/oauth-proxy/commit/30f8012482023689655252dc2af2f17fe6a09253) `sha256:0241730a986af7738001571df8efdd4da43f52bb1f29b66fcc4e28fe45132e12`
* [oauth-server](https://github.com/openshift/oauth-server) git [3739138c](https://github.com/openshift/oauth-server/commit/3739138c8ebbeb73f6e89f61591dd16a3ece32e3) `sha256:8517207c3977f5c1864b7afe313c167e1b16b39ff7e6609bf8e0b789a854aa89`
* [olm-catalogd](https://github.com/openshift/operator-framework-catalogd) git [79975a51](https://github.com/openshift/operator-framework-catalogd/commit/79975a511e1d31a09ef9b3b9e01262c8c69ff633) `sha256:d15c8fe45eb2961f68a5f23efd37d4ad915c681315f377b5525df977562987d0`
* [olm-operator-controller](https://github.com/openshift/operator-framework-operator-controller) git [80b8649c](https://github.com/openshift/operator-framework-operator-controller/commit/80b8649cf7a57098d03eff0d155531cf63728f41) `sha256:fbc3f7fa637d61a894ea7c2177d7c040affa7f86d1966135570f6dad54b8226a`
* [olm-rukpak](https://github.com/openshift/operator-framework-rukpak) git [282cc84c](https://github.com/openshift/operator-framework-rukpak/commit/282cc84cf92dc963f5fd719e103c91b6cc0e6dc6) `sha256:61bf9db4e85c0fd0f36a6de1df1865327631c10f3b3fcf7ed3c0dacba35e3a7c`
* [openshift-state-metrics](https://github.com/openshift/openshift-state-metrics) git [59b8a0ff](https://github.com/openshift/openshift-state-metrics/commit/59b8a0ffc0a472e819e0c30911201c34c85a4684) `sha256:d6f2825b3007c6a80ff704fa19c07039064a07a554eeebe4ebcc73f78b3a2706`
* [operator-marketplace](https://github.com/operator-framework/operator-marketplace) git [7db179fb](https://github.com/operator-framework/operator-marketplace/commit/7db179fb05ea5bd33c9ea0a55e13adeeaf0529a2) `sha256:d7052571473ed0dca5555647698b0d2a6e79b1e5af953bb6c699119bccd4a512`
* [ovirt-csi-driver](https://github.com/openshift/ovirt-csi-driver) git [1db726a9](https://github.com/openshift/ovirt-csi-driver/commit/1db726a940d5ec150fd185a215f1368990653082) `sha256:2844fa15da567828cfb8c850e26319fa56514f4add1805c7e7de1f030ff55bf2`
* [ovirt-csi-driver-operator](https://github.com/openshift/ovirt-csi-driver-operator) git [ac852f3e](https://github.com/openshift/ovirt-csi-driver-operator/commit/ac852f3eb077c877e998fee0359534349d07c604) `sha256:ec896f6f6439f1994c481c27aa887df6dc602a82e3a6e5946f790e6cd6ea5ea6`
* [ovirt-machine-controllers](https://github.com/openshift/cluster-api-provider-ovirt) git [abb91c84](https://github.com/openshift/cluster-api-provider-ovirt/commit/abb91c84083dd139780921673da64fa5cd13bccb) `sha256:2ecbe537e1c03355a2dde26a17a412581588cc3387b66d00cd4e0f2e9f9569e1`
* [powervs-block-csi-driver-operator](https://github.com/openshift/ibm-powervs-block-csi-driver-operator) git [9c5dd8d1](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/commit/9c5dd8d17f57b1c7ffd5464a191c6ee5a7646525) `sha256:5142eae63d8a22219a055dca6a9307553a58a51ad42223b95fb0332c328ae8e0`
* [prom-label-proxy](https://github.com/openshift/prom-label-proxy) git [5e14722e](https://github.com/openshift/prom-label-proxy/commit/5e14722ecfb3323ce2eb9c75a6bd9c5274b06040) `sha256:185b1dd05de4b40ffa731eb6653257cb8ad21daeacbb7db4299a5d3b7e343444`
* [prometheus-alertmanager](https://github.com/openshift/prometheus-alertmanager) git [e9aea929](https://github.com/openshift/prometheus-alertmanager/commit/e9aea929f309f412678fdf1064e1f74db3ba08b4) `sha256:e33560c649c233d23590288a856ba59a545ff9555dbb32810ae0bb1a15f8c77f`
* [prometheus-node-exporter](https://github.com/openshift/node_exporter) git [29ba26d1](https://github.com/openshift/node_exporter/commit/29ba26d1bc31e5ff6b398f20dbdd72b4ca3ba897) `sha256:1b166125a553d358fae3dfd78dd2f7f34d1383ff71d1dc47a46f4d68e445a1e8`
* rhel-coreos `sha256:a237251d5d004eb0d021037b4f9fd912f9a998a5d561c2139f579306f7428177`
* rhel-coreos-extensions `sha256:4982b3bc1020949e0d3f5f36ca28d0bae957b2a524995e1687b2b8dda3e776b5`
* [route-controller-manager](https://github.com/openshift/route-controller-manager) git [3112b458](https://github.com/openshift/route-controller-manager/commit/3112b458983c6fca6f77d5a945fb0026186dace6) `sha256:537e7d51e90be64555d993300ea8ed7cc663c4104545f7504019d74406bf182c`
* [service-ca-operator](https://github.com/openshift/service-ca-operator) git [538c7b98](https://github.com/openshift/service-ca-operator/commit/538c7b98a689e573b61e1abb1cb649da470c5fac) `sha256:0ecac1bdbb696c99703c2182dc9063f6d9b15047d349e4701c0dbcb0d61d7c3c`
* [thanos](https://github.com/openshift/thanos) git [85eee25c](https://github.com/openshift/thanos/commit/85eee25c36702ec14b86dc3157856d2aa2634642) `sha256:95effccc5c64952aed4c1449fe919ba3dc280daf125df7d934dfbe209b9b42b9`
* [vsphere-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-vsphere) git [be22f10a](https://github.com/openshift/cluster-api-provider-vsphere/commit/be22f10a56a18cd94406eea442e0113d866618ea) `sha256:0e04e0300e484ffda50ff6d486b8e50e73e18bbbbf471d8760533d5048970e53`
* [vsphere-csi-driver-operator](https://github.com/openshift/vmware-vsphere-csi-driver-operator) git [483de9c5](https://github.com/openshift/vmware-vsphere-csi-driver-operator/commit/483de9c59f1646f239c7039bcc0fa5fa0e44e7b4) `sha256:d23b3be55ca1e812adf9f0123a23bbfde6bf96a8833551bfa607c94be176f016`


### [agent-installer-api-server](https://github.com/openshift/assisted-service/tree/7ae324d5a15d0bc1abd0cae5a577db6adf38218a)

* [OCPBUGS-43021](https://issues.redhat.com/browse/OCPBUGS-43021): Update go-jose to v2.6.3 to mitigate CVE-2024-28180 (#6893) [#6893](https://github.com/openshift/assisted-service/pull/6893)
* [OCPBUGS-42570](https://issues.redhat.com/browse/OCPBUGS-42570): Libraries bump to mitigate CVE-2024-27289 (#6833) [#6833](https://github.com/openshift/assisted-service/pull/6833)
* [OCPBUGS-36577](https://issues.redhat.com/browse/OCPBUGS-36577): Switch to github.com/docker/distribution/reference to Mitigate CVE-2024-3727 (#6752) [#6752](https://github.com/openshift/assisted-service/pull/6752)
* [Full changelog](https://github.com/openshift/assisted-service/compare/6b26a25e2ae7c4eae4a0f3ee0cedbd16c29bab8a...7ae324d5a15d0bc1abd0cae5a577db6adf38218a)


### [agent-installer-csr-approver, agent-installer-orchestrator](https://github.com/openshift/assisted-installer/tree/0c46e5179d0bb5a1818df3dcff160059dc8060bd)

* [OCPBUGS-38466](https://issues.redhat.com/browse/OCPBUGS-38466): Allow controller to continue when assisted-service (#914) [#914](https://github.com/openshift/assisted-installer/pull/914)
* [OCPBUGS-43025](https://issues.redhat.com/browse/OCPBUGS-43025): Pick up latest CVE changes by bumping service (#920) [#920](https://github.com/openshift/assisted-installer/pull/920)
* [OCPBUGS-36577](https://issues.redhat.com/browse/OCPBUGS-36577): Switch to github.com/docker/distribution/reference to Mitigate CVE-2024-3727 (#906) [#906](https://github.com/openshift/assisted-installer/pull/906)
* [OCPBUGS-36779](https://issues.redhat.com/browse/OCPBUGS-36779): Reload host inventory on conflict (#881) [#881](https://github.com/openshift/assisted-installer/pull/881)
* [Full changelog](https://github.com/openshift/assisted-installer/compare/373c87ad8f0d88816031b5c39764c80d900228d9...0c46e5179d0bb5a1818df3dcff160059dc8060bd)


### [agent-installer-node-agent](https://github.com/openshift/assisted-installer-agent/tree/b121e87848721deee183a0d7bcc04bd5010eca38)

* [OCPBUGS-43028](https://issues.redhat.com/browse/OCPBUGS-43028): Pick up latest CVE changes by bumping service (#804) [#804](https://github.com/openshift/assisted-installer-agent/pull/804)
* [OCPBUGS-42300](https://issues.redhat.com/browse/OCPBUGS-42300): Switch to github.com/docker/distribution/reference to Mitigate CVE-2024-3727 (#785) [#785](https://github.com/openshift/assisted-installer-agent/pull/785)
* [Full changelog](https://github.com/openshift/assisted-installer-agent/compare/9ca7b58d937c413f670a26c02435829b1fb3a196...b121e87848721deee183a0d7bcc04bd5010eca38)


### [apiserver-network-proxy](https://github.com/openshift/apiserver-network-proxy/tree/ca81b6a32aff6ccb327f6889ec89c01afedd8efd)

* [OCPBUGS-38062](https://issues.redhat.com/browse/OCPBUGS-38062): Revert "Agent: Respect HTTPS_PROXY env vars for proxied connections" [#59](https://github.com/openshift/apiserver-network-proxy/pull/59)
* [Full changelog](https://github.com/openshift/apiserver-network-proxy/compare/9a6028c48ae73bd8227f014635ce744452e70348...ca81b6a32aff6ccb327f6889ec89c01afedd8efd)


### [aws-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-aws/tree/60d797bea7418e10ec26ae1ccef4e42249705b6c)

* [OCPBUGS-44234](https://issues.redhat.com/browse/OCPBUGS-44234): [release-4.16] OSD-25934: Only tag NetworkInterfaces in RunInstances if IAM Allows It [#531](https://github.com/openshift/cluster-api-provider-aws/pull/531)
* [Full changelog](https://github.com/openshift/cluster-api-provider-aws/compare/aaaf00b18daf45c9eea93bc2924a6a7e22d27766...60d797bea7418e10ec26ae1ccef4e42249705b6c)


### [aws-kms-encryption-provider](https://github.com/openshift/aws-encryption-provider/tree/c66065de639016b770f512e7cfcfcee9519fb89f)

* [OCPBUGS-33693](https://issues.redhat.com/browse/OCPBUGS-33693): Updating aws-kms-encryption-provider-container image to be consistent with ART for 4.16 [#18](https://github.com/openshift/aws-encryption-provider/pull/18)
* hack: display diff on verify-mod-tidy failure [#26](https://github.com/openshift/aws-encryption-provider/pull/26)
* [Full changelog](https://github.com/openshift/aws-encryption-provider/compare/da90fb7cb0d9108fb1f365e98f31ce6ab16fd7e0...c66065de639016b770f512e7cfcfcee9519fb89f)


### [azure-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-azure/tree/a81e3b31948468d76ac744bbbb74b0c423fc969e)

* [OCPBUGS-36025](https://issues.redhat.com/browse/OCPBUGS-36025): Update go-retryablehttp to v0.7.7 [#310](https://github.com/openshift/cluster-api-provider-azure/pull/310)
* [Full changelog](https://github.com/openshift/cluster-api-provider-azure/compare/face7da9972351de9a8d230b2a72af9dfe7facf7...a81e3b31948468d76ac744bbbb74b0c423fc969e)


### [azure-file-csi-driver](https://github.com/openshift/azure-file-csi-driver/tree/7a36778add73d12eb08ff6be357d8d351af651a7)

* [OCPBUGS-39145](https://issues.redhat.com/browse/OCPBUGS-39145): bump mount-utils to treat ENODEV error as corrupted mount [#76](https://github.com/openshift/azure-file-csi-driver/pull/76)
* [Full changelog](https://github.com/openshift/azure-file-csi-driver/compare/5ceb190a24730e4a3f951fa3e186e3cde9d86889...7a36778add73d12eb08ff6be357d8d351af651a7)


### [azure-kms-encryption-provider](https://github.com/openshift/azure-kubernetes-kms/tree/47d243b5a993fd0817eecf89a6d7896a3c911ecb)

* [OCPBUGS-33692](https://issues.redhat.com/browse/OCPBUGS-33692): Updating azure-kms-encryption-provider-container image to be consistent with ART for 4.16 [#4](https://github.com/openshift/azure-kubernetes-kms/pull/4)
* [Full changelog](https://github.com/openshift/azure-kubernetes-kms/compare/bc92347bcd3863db05ce6c79f0b71145a3185e12...47d243b5a993fd0817eecf89a6d7896a3c911ecb)


### [azure-machine-controllers](https://github.com/openshift/machine-api-provider-azure/tree/e4e11505b645e2af8eb28c5dc353c41a6740db00)

* [CFE-1050](https://issues.redhat.com/browse/CFE-1050): Added support of capacity reservation group [#111](https://github.com/openshift/machine-api-provider-azure/pull/111)
* [Full changelog](https://github.com/openshift/machine-api-provider-azure/compare/d6be293a11bf0dfdc6b80912fcdc3e90e8071ffe...e4e11505b645e2af8eb28c5dc353c41a6740db00)


### [baremetal-installer, installer, installer-altinfra, installer-artifacts](https://github.com/openshift/installer/tree/dc63e8f7a7d8bdd9816c20c484a0af8ed28473a0)

* [OCPBUGS-44348](https://issues.redhat.com/browse/OCPBUGS-44348): Cherrypick oci ccm fix to 4.16 [#9188](https://github.com/openshift/installer/pull/9188)
* [OCPBUGS-43967](https://issues.redhat.com/browse/OCPBUGS-43967): Revendor assisted service external platform oci [#9150](https://github.com/openshift/installer/pull/9150)
* [OCPBUGS-38930](https://issues.redhat.com/browse/OCPBUGS-38930): import failure when esxi config is not the same in the cluster [#8898](https://github.com/openshift/installer/pull/8898)
* [OCPBUGS-36290](https://issues.redhat.com/browse/OCPBUGS-36290): IBMCloud: Ignore failed VPC regions [#8674](https://github.com/openshift/installer/pull/8674)
* [OCPBUGS-41885](https://issues.redhat.com/browse/OCPBUGS-41885): vSphere - If template is defined skip downloading [#8999](https://github.com/openshift/installer/pull/8999)
* [OCPBUGS-41490](https://issues.redhat.com/browse/OCPBUGS-41490): Update RHCOS 4.16 bootimage metadata to 416.94.202410211619-0 [#9158](https://github.com/openshift/installer/pull/9158)
* [OCPBUGS-43476](https://issues.redhat.com/browse/OCPBUGS-43476): IBMCloud: Handle pagination for subnets [#9102](https://github.com/openshift/installer/pull/9102)
* [OCPBUGS-41490](https://issues.redhat.com/browse/OCPBUGS-41490): Update RHCOS 4.16 bootimage metadata to 416.94.202410172137-0 [#9132](https://github.com/openshift/installer/pull/9132)
* [OCPBUGS-42014](https://issues.redhat.com/browse/OCPBUGS-42014): Update terraform provider for google [#9077](https://github.com/openshift/installer/pull/9077)
* [OCPBUGS-38732](https://issues.redhat.com/browse/OCPBUGS-38732): vsphere, if secureboot is enabled, disable it in the template [#8904](https://github.com/openshift/installer/pull/8904)
* [OCPBUGS-39415](https://issues.redhat.com/browse/OCPBUGS-39415): OpenStack: Install CI dependencies from rpm [#8995](https://github.com/openshift/installer/pull/8995)
* [OCPBUGS-41334](https://issues.redhat.com/browse/OCPBUGS-41334): Fix IPv6 security group rule for schedulable master [#8971](https://github.com/openshift/installer/pull/8971)
* [OCPBUGS-38687](https://issues.redhat.com/browse/OCPBUGS-38687): only allow a single network in failure domain topology [#8875](https://github.com/openshift/installer/pull/8875)
* [OCPBUGS-42062](https://issues.redhat.com/browse/OCPBUGS-42062): OCPBUGS-41865: [release-4.16] vault version updated to 1.13.10 [#9036](https://github.com/openshift/installer/pull/9036)
* [OCPBUGS-42012](https://issues.redhat.com/browse/OCPBUGS-42012): Systemd Fails to Parse Multiline EC Keys [#9037](https://github.com/openshift/installer/pull/9037)
* [OCPBUGS-41845](https://issues.redhat.com/browse/OCPBUGS-41845): Bump extract-machine-os timout to 20m [#8997](https://github.com/openshift/installer/pull/8997)
* [OCPBUGS-38964](https://issues.redhat.com/browse/OCPBUGS-38964): IngressController subnet selection in AWS [#8910](https://github.com/openshift/installer/pull/8910)
* [OCPBUGS-42138](https://issues.redhat.com/browse/OCPBUGS-42138): add tested instance type for IBMCloud [#9031](https://github.com/openshift/installer/pull/9031)
* [OCPBUGS-39287](https://issues.redhat.com/browse/OCPBUGS-39287): Fix var_files syntax to work on older version of ansible [#8936](https://github.com/openshift/installer/pull/8936)
* [OCPBUGS-41929](https://issues.redhat.com/browse/OCPBUGS-41929): Add AWS c7g,m7g,r8g to tested instance types [#9009](https://github.com/openshift/installer/pull/9009)
* [OCPBUGS-36855](https://issues.redhat.com/browse/OCPBUGS-36855): Openstack UPI - Reintroduce unique resource names. [#8724](https://github.com/openshift/installer/pull/8724)
* [OCPBUGS-39082](https://issues.redhat.com/browse/OCPBUGS-39082): incorrect folder gen, workaround govmomi vm folder path bug [#8912](https://github.com/openshift/installer/pull/8912)
* [OCPBUGS-39496](https://issues.redhat.com/browse/OCPBUGS-39496): capi/aws/byo-vpc/multi-cidr: fix group rules [#8953](https://github.com/openshift/installer/pull/8953)
* [OCPBUGS-36861](https://issues.redhat.com/browse/OCPBUGS-36861): Updates GCP terraform worker role [#8939](https://github.com/openshift/installer/pull/8939)
* [OCPBUGS-38956](https://issues.redhat.com/browse/OCPBUGS-38956): failed to install Nutanix OCP 4.16 cluster with DHCP [#8905](https://github.com/openshift/installer/pull/8905)
* [OCPBUGS-38822](https://issues.redhat.com/browse/OCPBUGS-38822): upstream capv bug causes session timeout [#8891](https://github.com/openshift/installer/pull/8891)
* [OCPBUGS-39468](https://issues.redhat.com/browse/OCPBUGS-39468): Enable TLS for virtual media in initial ironic deployment [#8955](https://github.com/openshift/installer/pull/8955)
* [OCPBUGS-37606](https://issues.redhat.com/browse/OCPBUGS-37606): vSphere validation fails if dc is in a folder [#8777](https://github.com/openshift/installer/pull/8777)
* [OCPBUGS-39206](https://issues.redhat.com/browse/OCPBUGS-39206): Update GCP Disk Types 4.16 [#8920](https://github.com/openshift/installer/pull/8920)
* [OCPBUGS-39087](https://issues.redhat.com/browse/OCPBUGS-39087): aws: validate public-only subnets configs [#8913](https://github.com/openshift/installer/pull/8913)
* [OCPBUGS-38821](https://issues.redhat.com/browse/OCPBUGS-38821): [release-4.16] Azure: Disable shared key access when using a managed identity [#8855](https://github.com/openshift/installer/pull/8855)
* [OCPBUGS-38302](https://issues.redhat.com/browse/OCPBUGS-38302): upi/aws: update lambda runtime python version [#8897](https://github.com/openshift/installer/pull/8897)
* [OCPBUGS-38826](https://issues.redhat.com/browse/OCPBUGS-38826): aws: add support for clusters with public-only subnets [#8892](https://github.com/openshift/installer/pull/8892)
* [OCPBUGS-38517](https://issues.redhat.com/browse/OCPBUGS-38517): [release-4.16] capi/aws: bump provider for instance register fix [#8848](https://github.com/openshift/installer/pull/8848)
* [OCPBUGS-38196](https://issues.redhat.com/browse/OCPBUGS-38196): Remove timed context for gcp client [#8818](https://github.com/openshift/installer/pull/8818)
* [OCPBUGS-38502](https://issues.redhat.com/browse/OCPBUGS-38502): PowerVS: Fix mad system pool [#8846](https://github.com/openshift/installer/pull/8846)
* [OCPBUGS-37838](https://issues.redhat.com/browse/OCPBUGS-37838): fix bogus analyze message when gather fails [#8794](https://github.com/openshift/installer/pull/8794)
* [OCPBUGS-37492](https://issues.redhat.com/browse/OCPBUGS-37492): openstack: Fix security group tagging [#8767](https://github.com/openshift/installer/pull/8767)
* [OCPBUGS-37607](https://issues.redhat.com/browse/OCPBUGS-37607): bootstrap gather fails in vsphere, only ipv6 address used [#8778](https://github.com/openshift/installer/pull/8778)
* [OCPBUGS-37494](https://issues.redhat.com/browse/OCPBUGS-37494): aws: do not require create permissions when BYO IAM role [#8768](https://github.com/openshift/installer/pull/8768)
* [OCPBUGS-37510](https://issues.redhat.com/browse/OCPBUGS-37510): [release-4.16] aws: bump CAPA for subnet tagging fix [#8772](https://github.com/openshift/installer/pull/8772)
* [OCPBUGS-37180](https://issues.redhat.com/browse/OCPBUGS-37180): ic: fix typo in warning message [#8769](https://github.com/openshift/installer/pull/8769)
* [OCPBUGS-36968](https://issues.redhat.com/browse/OCPBUGS-36968): [release-4.16]: capi/aws: bump provider for ingress rules fix [#8734](https://github.com/openshift/installer/pull/8734)
* [OCPBUGS-36965](https://issues.redhat.com/browse/OCPBUGS-36965): destroy/gcp: set value for DiscardLocalSsd [#8733](https://github.com/openshift/installer/pull/8733)
* [OCPBUGS-36720](https://issues.redhat.com/browse/OCPBUGS-36720): CORS-3582: capi: remove unused feature gates [#8716](https://github.com/openshift/installer/pull/8716)
* [OCPBUGS-36890](https://issues.redhat.com/browse/OCPBUGS-36890): [release-4.16] capi: start controllers after WaitGroup is created [#8726](https://github.com/openshift/installer/pull/8726)
* [OCPBUGS-36091](https://issues.redhat.com/browse/OCPBUGS-36091): [release-4.16] bump go-retryablehttp for CVE fix [#8654](https://github.com/openshift/installer/pull/8654)
* [OCPBUGS-36777](https://issues.redhat.com/browse/OCPBUGS-36777): Cleanup capi artifacts [#8719](https://github.com/openshift/installer/pull/8719)
* [OCPBUGS-36607](https://issues.redhat.com/browse/OCPBUGS-36607): aws: remove terraform configs [#8705](https://github.com/openshift/installer/pull/8705)
* [OCPBUGS-36324](https://issues.redhat.com/browse/OCPBUGS-36324): update RHCOS 4.16 bootimage metadata to 416.94.202406282145-0 [#8692](https://github.com/openshift/installer/pull/8692)
* [OCPBUGS-36447](https://issues.redhat.com/browse/OCPBUGS-36447): capi/aws: disable EKS controller in CAPA [#8694](https://github.com/openshift/installer/pull/8694)
* [OCPBUGS-36351](https://issues.redhat.com/browse/OCPBUGS-36351): vSphere - If the folder pre-exists do not tag [#8683](https://github.com/openshift/installer/pull/8683)
* [OCPBUGS-36286](https://issues.redhat.com/browse/OCPBUGS-36286): PowerVS: Add ibmcloud plugins [#8672](https://github.com/openshift/installer/pull/8672)
* [OCPBUGS-35818](https://issues.redhat.com/browse/OCPBUGS-35818): baremetal: bootstrap: bind icc to localhost [#8632](https://github.com/openshift/installer/pull/8632)
* [OCPBUGS-34457](https://issues.redhat.com/browse/OCPBUGS-34457): [release-4.16] bump envtest binaries version [#8470](https://github.com/openshift/installer/pull/8470)
* [OCPBUGS-35718](https://issues.redhat.com/browse/OCPBUGS-35718): Fix ethertype for masters service router SG creation [#8623](https://github.com/openshift/installer/pull/8623)
* [OCPBUGS-36156](https://issues.redhat.com/browse/OCPBUGS-36156): Configured logger for controller-runtime [#8657](https://github.com/openshift/installer/pull/8657)
* [OCPBUGS-36249](https://issues.redhat.com/browse/OCPBUGS-36249): capi: shutdown local controlplane as the last step [#8670](https://github.com/openshift/installer/pull/8670)
* [OCPBUGS-35470](https://issues.redhat.com/browse/OCPBUGS-35470): add machine series 'A3' and 'C3D' to 'Tested instance types for GCP' [#8614](https://github.com/openshift/installer/pull/8614)
* [OCPBUGS-35722](https://issues.redhat.com/browse/OCPBUGS-35722): Support CAPI provider custom timeouts [#8624](https://github.com/openshift/installer/pull/8624)
* [OCPBUGS-35733](https://issues.redhat.com/browse/OCPBUGS-35733): [release-4.16] remove terraform libvirt from the installer [#8626](https://github.com/openshift/installer/pull/8626)
* [OCPBUGS-35531](https://issues.redhat.com/browse/OCPBUGS-35531): For GCP, only configure kmsKeyServiceAccount if set [#8613](https://github.com/openshift/installer/pull/8613)
* [OCPBUGS-35529](https://issues.redhat.com/browse/OCPBUGS-35529): capi aws: append random string in caller ref [#8612](https://github.com/openshift/installer/pull/8612)
* [Full changelog](https://github.com/openshift/installer/compare/0dc3033888f4cae22e5e5897921422f7180c4033...dc63e8f7a7d8bdd9816c20c484a0af8ed28473a0)


### [baremetal-operator](https://github.com/openshift/baremetal-operator/tree/ae55a7053373827ad4b1aff6dceae5f077ce90e5)

* [OCPBUGS-39490](https://issues.redhat.com/browse/OCPBUGS-39490): Disallow fetching secrets from namespaces different from the host's one [#378](https://github.com/openshift/baremetal-operator/pull/378)
* [OCPBUGS-38938](https://issues.redhat.com/browse/OCPBUGS-38938): [OCP] Ability to disable agent power off after deployment [#372](https://github.com/openshift/baremetal-operator/pull/372)
* [OCPBUGS-37765](https://issues.redhat.com/browse/OCPBUGS-37765): HostFirmwareComponents doesn't show the new firmware information in Status Components [#355](https://github.com/openshift/baremetal-operator/pull/355)
* [OCPBUGS-37262](https://issues.redhat.com/browse/OCPBUGS-37262): fix(redfish): set correct idrac-redfish management interface [#366](https://github.com/openshift/baremetal-operator/pull/366)
* [OCPBUGS-36673](https://issues.redhat.com/browse/OCPBUGS-36673): [4.16] Firmware Update causes BMH to get stuck in Preparing [#363](https://github.com/openshift/baremetal-operator/pull/363)
* [Full changelog](https://github.com/openshift/baremetal-operator/compare/7673d14fc567c3621e8d5fdca69ff03bd99504ef...ae55a7053373827ad4b1aff6dceae5f077ce90e5)


### [baremetal-runtimecfg](https://github.com/openshift/baremetal-runtimecfg/tree/f55a330f8139ef660b3f60b735ef77538f7b9cbe)

* [OCPBUGS-35891](https://issues.redhat.com/browse/OCPBUGS-35891): Change mechanism of debug flag [#323](https://github.com/openshift/baremetal-runtimecfg/pull/323)
* [OCPBUGS-35743](https://issues.redhat.com/browse/OCPBUGS-35743): Fix handling of ELB Node IP detection [#320](https://github.com/openshift/baremetal-runtimecfg/pull/320)
* [OCPBUGS-35486](https://issues.redhat.com/browse/OCPBUGS-35486): Add support for OVN HostCidrs annotation [#318](https://github.com/openshift/baremetal-runtimecfg/pull/318)
* [Full changelog](https://github.com/openshift/baremetal-runtimecfg/compare/91e3cb724f9d14cf40f66d059cdac1578193cac0...f55a330f8139ef660b3f60b735ef77538f7b9cbe)


### [cli, cli-artifacts, deployer, tools](https://github.com/openshift/oc/tree/cf533b548154f7f2e828a44864477bbbb881692d)

* [OCPBUGS-42720](https://issues.redhat.com/browse/OCPBUGS-42720): Check cast result in adm prune deployments to prevent panic [#1891](https://github.com/openshift/oc/pull/1891)
* [OCPBUGS-39341](https://issues.redhat.com/browse/OCPBUGS-39341): Ignore pruning when deployment points to replicationcontroller [#1862](https://github.com/openshift/oc/pull/1862)
* [OCPBUGS-37853](https://issues.redhat.com/browse/OCPBUGS-37853): Revert "OCPBUGS-35994: pkg/cli/admin/upgrade/rollback: Drop this command" [#1839](https://github.com/openshift/oc/pull/1839)
* [OCPBUGS-31639](https://issues.redhat.com/browse/OCPBUGS-31639): Bump k8s dependencies to 1.29.7 [#1824](https://github.com/openshift/oc/pull/1824)
* [OCPBUGS-36764](https://issues.redhat.com/browse/OCPBUGS-36764): pkg/cli/admin/upgrade/rollback: Drop this command [#1820](https://github.com/openshift/oc/pull/1820)
* [OCPBUGS-36328](https://issues.redhat.com/browse/OCPBUGS-36328): Set required-scc annotation to privileged for node debug pods [#1816](https://github.com/openshift/oc/pull/1816)
* [OCPBUGS-36379](https://issues.redhat.com/browse/OCPBUGS-36379): bump(k8s)=1.29.6 [#1810](https://github.com/openshift/oc/pull/1810)
* [OCPBUGS-35924](https://issues.redhat.com/browse/OCPBUGS-35924): `upgrade status`: control plane completion estimate [#1804](https://github.com/openshift/oc/pull/1804)
* [Full changelog](https://github.com/openshift/oc/compare/a2450418f7b12a71e8f3562a4e9aa8a976bbf85b...cf533b548154f7f2e828a44864477bbbb881692d)


### [cloud-credential-operator](https://github.com/openshift/cloud-credential-operator/tree/4672a9ad086ebcd75ee1ab0fb20af922e26f7029)

* [OCPBUGS-43645](https://issues.redhat.com/browse/OCPBUGS-43645): Only attempt timed token credentials on supported platforms. [#772](https://github.com/openshift/cloud-credential-operator/pull/772)
* [OCPBUGS-43337](https://issues.redhat.com/browse/OCPBUGS-43337): Update github.com/sirupsen/logrus v1.9.3 [#767](https://github.com/openshift/cloud-credential-operator/pull/767)
* [OCPBUGS-41234](https://issues.redhat.com/browse/OCPBUGS-41234): List secrets in batches to avoid api timeout [#757](https://github.com/openshift/cloud-credential-operator/pull/757)
* [OCPBUGS-38376](https://issues.redhat.com/browse/OCPBUGS-38376): Update google.golang.org/grpc v1.65.0 [#748](https://github.com/openshift/cloud-credential-operator/pull/748)
* [OCPBUGS-37418](https://issues.redhat.com/browse/OCPBUGS-37418): SNYK ignore go-client misreporting [#735](https://github.com/openshift/cloud-credential-operator/pull/735)
* [OCPBUGS-36834](https://issues.redhat.com/browse/OCPBUGS-36834): GCP passthrough permissions check to ignore problematic permissions. [#714](https://github.com/openshift/cloud-credential-operator/pull/714)
* [OCPBUGS-36954](https://issues.redhat.com/browse/OCPBUGS-36954): Update to azidentity v1.7.0 [#727](https://github.com/openshift/cloud-credential-operator/pull/727)
* [OCPBUGS-36031](https://issues.redhat.com/browse/OCPBUGS-36031): IBM/go-sdk-core update to v5.6.3 [#718](https://github.com/openshift/cloud-credential-operator/pull/718)
* [OCPBUGS-34117](https://issues.redhat.com/browse/OCPBUGS-34117): AWS STS should not error when a credentailsRequest does not have awsSTSIAMRoleARN [#704](https://github.com/openshift/cloud-credential-operator/pull/704)
* [Full changelog](https://github.com/openshift/cloud-credential-operator/compare/48b287d41e71b23c55b00cbcbfb38ac1eedfb9f4...4672a9ad086ebcd75ee1ab0fb20af922e26f7029)


### [cluster-authentication-operator](https://github.com/openshift/cluster-authentication-operator/tree/4782c451e1aab859b7db09aee01af10c1ebf428c)

* [OCPBUGS-43367](https://issues.redhat.com/browse/OCPBUGS-43367): manifests should not use APIs that are removed in upcoming releases [#717](https://github.com/openshift/cluster-authentication-operator/pull/717)
* [OCPBUGS-34790](https://issues.redhat.com/browse/OCPBUGS-34790): update OpenShift favicon to new brand standard [#676](https://github.com/openshift/cluster-authentication-operator/pull/676)
* NO-JIRA: Fixes for Keycloack IDP test and unit tests [#683](https://github.com/openshift/cluster-authentication-operator/pull/683)
* [Full changelog](https://github.com/openshift/cluster-authentication-operator/compare/b415439ebab2829c8da1ea17c05f2ac75fe5dbe8...4782c451e1aab859b7db09aee01af10c1ebf428c)


### [cluster-baremetal-operator](https://github.com/openshift/cluster-baremetal-operator/tree/03738f2d941b836800926fc701202b8d4b9d0605)

* [OCPBUGS-43556](https://issues.redhat.com/browse/OCPBUGS-43556): SCC-pinning for metal3-baremetal-operator [#453](https://github.com/openshift/cluster-baremetal-operator/pull/453)
* [OCPBUGS-31961](https://issues.redhat.com/browse/OCPBUGS-31961): bump x/net to 0.23.0 [#431](https://github.com/openshift/cluster-baremetal-operator/pull/431)
* [OCPBUGS-36415](https://issues.redhat.com/browse/OCPBUGS-36415): set required-scc for openshift workloads [#433](https://github.com/openshift/cluster-baremetal-operator/pull/433)
* [OCPBUGS-36285](https://issues.redhat.com/browse/OCPBUGS-36285): Move pull secret from env var to VolumeMount in metal3-image-customization container [#436](https://github.com/openshift/cluster-baremetal-operator/pull/436)
* [OCPBUGS-36285](https://issues.redhat.com/browse/OCPBUGS-36285): Mount htpasswds as volumeMounts in metal3-httpd container [#434](https://github.com/openshift/cluster-baremetal-operator/pull/434)
* [OCPBUGS-35381](https://issues.redhat.com/browse/OCPBUGS-35381): provisioning: add ownership for tls secret [#425](https://github.com/openshift/cluster-baremetal-operator/pull/425)
* [Full changelog](https://github.com/openshift/cluster-baremetal-operator/compare/9fd641850220391b72a86416867f5d2d902a4769...03738f2d941b836800926fc701202b8d4b9d0605)


### [cluster-capi-operator](https://github.com/openshift/cluster-capi-operator/tree/3a2f98fba9180a470d224aa662bb7df5ee5127bf)

* [OCPBUGS-37441](https://issues.redhat.com/browse/OCPBUGS-37441): fix: sort CredentialsRequest manifests after namespace [#190](https://github.com/openshift/cluster-capi-operator/pull/190)
* [OCPBUGS-37795](https://issues.redhat.com/browse/OCPBUGS-37795): fix: align openstack e2e branch [#192](https://github.com/openshift/cluster-capi-operator/pull/192)
* [Full changelog](https://github.com/openshift/cluster-capi-operator/compare/a24f1aeb106bd4ad353615dacde6d4e884f5face...3a2f98fba9180a470d224aa662bb7df5ee5127bf)


### [cluster-cloud-controller-manager-operator](https://github.com/openshift/cluster-cloud-controller-manager-operator/tree/1c26756f0b4ff5537e32db18d5fb16555f5bd58f)

* [OCPBUGS-42125](https://issues.redhat.com/browse/OCPBUGS-42125): IBMCloud: Modify liveness probe for IBM Cloud CCM to use loopback address [#366](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/366)
* [OCPBUGS-43473](https://issues.redhat.com/browse/OCPBUGS-43473): update goimports targets [#372](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/372)
* [OCPBUGS-36317](https://issues.redhat.com/browse/OCPBUGS-36317): PowerVS: Remove bind address [#358](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/358)
* [Full changelog](https://github.com/openshift/cluster-cloud-controller-manager-operator/compare/bbb13b9ad6e49e7dcd8d0b1a84f59ca8ff073599...1c26756f0b4ff5537e32db18d5fb16555f5bd58f)


### [cluster-config-api](https://github.com/openshift/api/tree/b7d0481c9094172326bc9462c4f85b8f3ff0d761)

* [OCPBUGS-38773](https://issues.redhat.com/browse/OCPBUGS-38773): remove duplicate featuregate 'ExternalRouteCertificate' [#2007](https://github.com/openshift/api/pull/2007)
* [OCPBUGS-37857](https://issues.redhat.com/browse/OCPBUGS-37857): [release-4.16] OCPBUGS-37852: a rule to check if the featureSet is one of the known set of features [#1985](https://github.com/openshift/api/pull/1985)
* [OCPBUGS-33788](https://issues.redhat.com/browse/OCPBUGS-33788): add console and download URLs to console operator config [#1915](https://github.com/openshift/api/pull/1915)
* [CFE-1047](https://issues.redhat.com/browse/CFE-1047): Add the field "CapacityReservationGroupID" to "AzureMachineProviderSpec" in openshift/api [#1923](https://github.com/openshift/api/pull/1923)
* [OCPBUGS-35742](https://issues.redhat.com/browse/OCPBUGS-35742): prevent removing featureSet entirely [#1933](https://github.com/openshift/api/pull/1933)
* [Full changelog](https://github.com/openshift/api/compare/636e2c17106f5a0d9c266535f262267384fede1f...b7d0481c9094172326bc9462c4f85b8f3ff0d761)


### [cluster-control-plane-machine-set-operator](https://github.com/openshift/cluster-control-plane-machine-set-operator/tree/14571e8a2c4e9bf52d7cc94da87959a56dc2a44c)

* [OCPBUGS-44179](https://issues.redhat.com/browse/OCPBUGS-44179): relax validation on delete and if failureDomains not configured [#331](https://github.com/openshift/cluster-control-plane-machine-set-operator/pull/331)
* [CFE-1087](https://issues.redhat.com/browse/CFE-1087): API Bump for capacity Reservation [#314](https://github.com/openshift/cluster-control-plane-machine-set-operator/pull/314)
* [OCPBUGS-35476](https://issues.redhat.com/browse/OCPBUGS-35476): Wait for ControlPlaneMachineSet to be created when waiting for it to be updated [#307](https://github.com/openshift/cluster-control-plane-machine-set-operator/pull/307)
* [Full changelog](https://github.com/openshift/cluster-control-plane-machine-set-operator/compare/1a0064052f0f83792f9c668d93746dbfb7f7a5d8...14571e8a2c4e9bf52d7cc94da87959a56dc2a44c)


### [cluster-dns-operator](https://github.com/openshift/cluster-dns-operator/tree/8ddf28f959955e2b1b319856c0d47ae6729bcc31)

* [OCPBUGS-37078](https://issues.redhat.com/browse/OCPBUGS-37078): Bump version of DNSNameResolver controller [#419](https://github.com/openshift/cluster-dns-operator/pull/419)
* [Full changelog](https://github.com/openshift/cluster-dns-operator/compare/a14431f277364605ede8e95530453c5fb7267e33...8ddf28f959955e2b1b319856c0d47ae6729bcc31)


### [cluster-etcd-operator](https://github.com/openshift/cluster-etcd-operator/tree/3f2ce4889c255391323d8bdf07dece99e87dbccd)

* [OCPBUGS-33673](https://issues.redhat.com/browse/OCPBUGS-33673): rename flowschema to avoid log noise in CVO [#1348](https://github.com/openshift/cluster-etcd-operator/pull/1348)
* [OCPBUGS-37820](https://issues.redhat.com/browse/OCPBUGS-37820): ensure ordering in member health checks [#1311](https://github.com/openshift/cluster-etcd-operator/pull/1311)
* [OCPBUGS-36489](https://issues.redhat.com/browse/OCPBUGS-36489): parallelize member health checks [#1290](https://github.com/openshift/cluster-etcd-operator/pull/1290)
* [OCPBUGS-35500](https://issues.redhat.com/browse/OCPBUGS-35500): Update etcd-tls-assets.md [#1276](https://github.com/openshift/cluster-etcd-operator/pull/1276)
* [Full changelog](https://github.com/openshift/cluster-etcd-operator/compare/dc4f4e858ba8395dce6883242c7d12009685d145...3f2ce4889c255391323d8bdf07dece99e87dbccd)


### [cluster-image-registry-operator](https://github.com/openshift/cluster-image-registry-operator/tree/00111bc2e57dfd2c3c1d1da39a2a5ed36de9d068)

* [OCPBUGS-43797](https://issues.redhat.com/browse/OCPBUGS-43797): fix proxy config and leader election test flakes [#1148](https://github.com/openshift/cluster-image-registry-operator/pull/1148)
* [OCPBUGS-43555](https://issues.redhat.com/browse/OCPBUGS-43555): pkg/storage/azure: also check for auth failure error code on deletion [#1143](https://github.com/openshift/cluster-image-registry-operator/pull/1143)
* [OCPBUGS-42933](https://issues.redhat.com/browse/OCPBUGS-42933): azureclient: stop validating credentials when creating the client [#1134](https://github.com/openshift/cluster-image-registry-operator/pull/1134)
* [OCPBUGS-42420](https://issues.redhat.com/browse/OCPBUGS-42420): Continuous pull-secret updates / slow initialization on build01 (test platform infrastructure) [#1126](https://github.com/openshift/cluster-image-registry-operator/pull/1126)
* Revert "[release-4.16]  OCPBUGS-41903: pkg/operator/azurepathfixcontroller: do not sync on non-azure storage" [#1119](https://github.com/openshift/cluster-image-registry-operator/pull/1119)
* [OCPBUGS-41903](https://issues.redhat.com/browse/OCPBUGS-41903): pkg/operator/azurepathfixcontroller: do not sync on non-azure storage [#1115](https://github.com/openshift/cluster-image-registry-operator/pull/1115)
* [OCPBUGS-39098](https://issues.redhat.com/browse/OCPBUGS-39098): Avoid Shared Access Key usage for Azure Storage Account when using Managed Identity based auth [#1104](https://github.com/openshift/cluster-image-registry-operator/pull/1104)
* [OCPBUGS-38894](https://issues.redhat.com/browse/OCPBUGS-38894): pkg/resource/azurepathfixjob: invoke update-ca-trust extract with --output [#1102](https://github.com/openshift/cluster-image-registry-operator/pull/1102)
* [OCPBUGS-38894](https://issues.redhat.com/browse/OCPBUGS-38894): pkg/resource: invoke update-ca-trust extract with --output [#1098](https://github.com/openshift/cluster-image-registry-operator/pull/1098)
* [OCPBUGS-36037](https://issues.redhat.com/browse/OCPBUGS-36037): go.*,vendor: bump go-retryablehttp #1064 [#1064](https://github.com/openshift/cluster-image-registry-operator/pull/1064)
* [Full changelog](https://github.com/openshift/cluster-image-registry-operator/compare/0fc07edf2cd988e119961d07e67c36c7717ce6f2...00111bc2e57dfd2c3c1d1da39a2a5ed36de9d068)


### [cluster-ingress-operator](https://github.com/openshift/cluster-ingress-operator/tree/57f9674e75908ca11b24792fb9f077233cd7bcf1)

* [OCPBUGS-39324](https://issues.redhat.com/browse/OCPBUGS-39324): Refine logging for accurate infra CR status updates [#1139](https://github.com/openshift/cluster-ingress-operator/pull/1139)
* [OCPBUGS-39323](https://issues.redhat.com/browse/OCPBUGS-39323): Ingress operator status not degraded when canary route fails [#1138](https://github.com/openshift/cluster-ingress-operator/pull/1138)
* [OCPBUGS-32887](https://issues.redhat.com/browse/OCPBUGS-32887): Delete and recreate canary route to clear spec.host [#1099](https://github.com/openshift/cluster-ingress-operator/pull/1099)
* [OCPBUGS-36184](https://issues.redhat.com/browse/OCPBUGS-36184): Add e2e test for connect timeout [#1094](https://github.com/openshift/cluster-ingress-operator/pull/1094)
* [OCPBUGS-35883](https://issues.redhat.com/browse/OCPBUGS-35883): Add Regexp Anchor to TestAll [#1093](https://github.com/openshift/cluster-ingress-operator/pull/1093)
* [Full changelog](https://github.com/openshift/cluster-ingress-operator/compare/28c943937d7bc6718e10af50da82097ce8fc6877...57f9674e75908ca11b24792fb9f077233cd7bcf1)


### [cluster-kube-apiserver-operator](https://github.com/openshift/cluster-kube-apiserver-operator/tree/de2f2ac2fc9a811bd2b1db4f912c5a0092bfc3d0)

* [OCPBUGS-37563](https://issues.redhat.com/browse/OCPBUGS-37563): add disabled syncer as reason to CFE for PSA [#1714](https://github.com/openshift/cluster-kube-apiserver-operator/pull/1714)
* [OCPBUGS-35303](https://issues.redhat.com/browse/OCPBUGS-35303): manifests: add ownership annotation for kubelet-bootstrap-kubeconfig [#1701](https://github.com/openshift/cluster-kube-apiserver-operator/pull/1701)
* [OCPBUGS-35831](https://issues.redhat.com/browse/OCPBUGS-35831): add SNO control plane high cpu usage alert [#1705](https://github.com/openshift/cluster-kube-apiserver-operator/pull/1705)
* [Full changelog](https://github.com/openshift/cluster-kube-apiserver-operator/compare/d790493cfc43fd33450ca27633cbe37aa17427d2...de2f2ac2fc9a811bd2b1db4f912c5a0092bfc3d0)


### [cluster-kube-storage-version-migrator-operator](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/tree/e825811333c05b705c35d2e9a9a62e55e9ab0935)

* [OCPBUGS-38269](https://issues.redhat.com/browse/OCPBUGS-38269): bump protobuf [#115](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/pull/115)
* [Full changelog](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/compare/bf6afbb820531b4adc3a52f78a90f317c5580bad...e825811333c05b705c35d2e9a9a62e55e9ab0935)


### [cluster-monitoring-operator](https://github.com/openshift/cluster-monitoring-operator/tree/1c2403d23e57b4d559f145e0997f554e7284e917)

* [OCPBUGS-43826](https://issues.redhat.com/browse/OCPBUGS-43826): Add runbook url for TelemeterClientFailures [#2508](https://github.com/openshift/cluster-monitoring-operator/pull/2508)
* [OCPBUGS-41967](https://issues.redhat.com/browse/OCPBUGS-41967): disable user-defined monitoring per object [#2474](https://github.com/openshift/cluster-monitoring-operator/pull/2474)
* [OCPBUGS-42067](https://issues.redhat.com/browse/OCPBUGS-42067): Reapply "chore: poll immediately in the e2e tests" [#2476](https://github.com/openshift/cluster-monitoring-operator/pull/2476)
* [OCPBUGS-41717](https://issues.redhat.com/browse/OCPBUGS-41717): Configure graceful shutdown for metrics-server (4.16 backport) [#2467](https://github.com/openshift/cluster-monitoring-operator/pull/2467)
* [OCPBUGS-41910](https://issues.redhat.com/browse/OCPBUGS-41910): filter alerts sent to Telemeter [#2471](https://github.com/openshift/cluster-monitoring-operator/pull/2471)
* [OCPBUGS-39170](https://issues.redhat.com/browse/OCPBUGS-39170): Backport #2441 for 4.16 [#2447](https://github.com/openshift/cluster-monitoring-operator/pull/2447)
* [OCPBUGS-36907](https://issues.redhat.com/browse/OCPBUGS-36907): Add deprecated config runbook [#2411](https://github.com/openshift/cluster-monitoring-operator/pull/2411)
* [OCPBUGS-36717](https://issues.redhat.com/browse/OCPBUGS-36717): Exclude windows nodes from kubelet servicemonitor [#2408](https://github.com/openshift/cluster-monitoring-operator/pull/2408)
* [OCPBUGS-36482](https://issues.redhat.com/browse/OCPBUGS-36482): add runbook_url annotations [#2404](https://github.com/openshift/cluster-monitoring-operator/pull/2404)
* [OCPBUGS-36206](https://issues.redhat.com/browse/OCPBUGS-36206): Add deprecation for prometheus adapter [#2396](https://github.com/openshift/cluster-monitoring-operator/pull/2396)
* [OCPBUGS-34530](https://issues.redhat.com/browse/OCPBUGS-34530): inject trusted CA bundle into UWM Alertmanager [#2373](https://github.com/openshift/cluster-monitoring-operator/pull/2373)
* [OCPBUGS-35904](https://issues.redhat.com/browse/OCPBUGS-35904): opt-out of multi-cluster Prometheus dashboard [#2391](https://github.com/openshift/cluster-monitoring-operator/pull/2391)
* [OCPBUGS-34383](https://issues.redhat.com/browse/OCPBUGS-34383): remove deprecated logtostderr argument [#2370](https://github.com/openshift/cluster-monitoring-operator/pull/2370)
* [OCPBUGS-35884](https://issues.redhat.com/browse/OCPBUGS-35884): attach runbook to the PrometheusDuplicateTimestamps alert [#2389](https://github.com/openshift/cluster-monitoring-operator/pull/2389)
* [MON-3795](https://issues.redhat.com/browse/MON-3795), [OCPBUGS-35061](https://issues.redhat.com/browse/OCPBUGS-35061): Backport anp telemetry [#2379](https://github.com/openshift/cluster-monitoring-operator/pull/2379)
* [Full changelog](https://github.com/openshift/cluster-monitoring-operator/compare/e0083986a4eb9fceb07c696b4d1cf64c6aabf386...1c2403d23e57b4d559f145e0997f554e7284e917)


### [cluster-network-operator](https://github.com/openshift/cluster-network-operator/tree/179c38004739adde111d2fabf08bc94b0c663d9b)

* [OCPBUGS-43604](https://issues.redhat.com/browse/OCPBUGS-43604): OCPBUGS-42244: Exporting environment varialbe NODE_CNI for live migration [#2538](https://github.com/openshift/cluster-network-operator/pull/2538)
* [OCPBUGS-36210](https://issues.redhat.com/browse/OCPBUGS-36210): Set global IP forwarding sysctl parameters while starting ovnkube-node [#2422](https://github.com/openshift/cluster-network-operator/pull/2422)
* [OCPBUGS-43544](https://issues.redhat.com/browse/OCPBUGS-43544): Use CNIConfDir for mounting directory to ovn-ipsec-host pod [#2537](https://github.com/openshift/cluster-network-operator/pull/2537)
* [OCPBUGS-43035](https://issues.redhat.com/browse/OCPBUGS-43035): Configure narrowing=yes for IPsec connections [#2528](https://github.com/openshift/cluster-network-operator/pull/2528)
* [OCPBUGS-36594](https://issues.redhat.com/browse/OCPBUGS-36594): Set mount propagation to HostToContainer for /var/lib/kubelet [#2430](https://github.com/openshift/cluster-network-operator/pull/2430)
* [OCPBUGS-41840](https://issues.redhat.com/browse/OCPBUGS-41840): Add configurable subnets while running hybrid-overlay-node binary [#2502](https://github.com/openshift/cluster-network-operator/pull/2502)
* [OCPBUGS-37763](https://issues.redhat.com/browse/OCPBUGS-37763): Handle random crictl errors in iptables-alerter [#2452](https://github.com/openshift/cluster-network-operator/pull/2452)
* [OCPBUGS-41555](https://issues.redhat.com/browse/OCPBUGS-41555): HyperShift: do not use antiaffinity on single replica control planes [#2494](https://github.com/openshift/cluster-network-operator/pull/2494)
* [OCPBUGS-37937](https://issues.redhat.com/browse/OCPBUGS-37937): Add proxy env vars to onvkube-node [#2457](https://github.com/openshift/cluster-network-operator/pull/2457)
* [OCPBUGS-41607](https://issues.redhat.com/browse/OCPBUGS-41607): set required-scc for openshift workloads [#2496](https://github.com/openshift/cluster-network-operator/pull/2496)
* [OCPBUGS-35407](https://issues.redhat.com/browse/OCPBUGS-35407): Use applyconfigurations for updating network.oprerator status [#2413](https://github.com/openshift/cluster-network-operator/pull/2413)
* [OCPBUGS-37362](https://issues.redhat.com/browse/OCPBUGS-37362): Fix IC distributed control plane alerts [#2445](https://github.com/openshift/cluster-network-operator/pull/2445)
* [OCPBUGS-35836](https://issues.redhat.com/browse/OCPBUGS-35836): Propogate hypershift control plane priority class override to multus and preserve container resource requests [#2417](https://github.com/openshift/cluster-network-operator/pull/2417)
* [OCPBUGS-35829](https://issues.redhat.com/browse/OCPBUGS-35829): Create the configmap mtu if not found [#2416](https://github.com/openshift/cluster-network-operator/pull/2416)
* [OCPBUGS-35923](https://issues.redhat.com/browse/OCPBUGS-35923): update whereabouts crd [#2419](https://github.com/openshift/cluster-network-operator/pull/2419)
* [Full changelog](https://github.com/openshift/cluster-network-operator/compare/84f9a080d03777c95a1c5a0d13ca16e5aa342d98...179c38004739adde111d2fabf08bc94b0c663d9b)


### [cluster-node-tuning-operator](https://github.com/openshift/cluster-node-tuning-operator/tree/e739b63c155856b93d072e6077bb73a995ba0f28)

* Fixing empty tuned submodule when using Dockerfile (#1212) [#1212](https://github.com/openshift/cluster-node-tuning-operator/pull/1212)
* [OCPBUGS-38900](https://issues.redhat.com/browse/OCPBUGS-38900): Drop sched_migration_cost_ns setting (#1203) [#1203](https://github.com/openshift/cluster-node-tuning-operator/pull/1203)
* Make ocp-tuned-one-shot.service restart on-failure (#1202) [#1202](https://github.com/openshift/cluster-node-tuning-operator/pull/1202)
* Unblock 4.16 CI (#1204) [#1204](https://github.com/openshift/cluster-node-tuning-operator/pull/1204)
* e2e: performance: verify tuned one-shot service vs kubelet (#1192) [#1192](https://github.com/openshift/cluster-node-tuning-operator/pull/1192)
* E2E: Add test to verify cpuset.cpus.exclusive is writeable (#1153) [#1153](https://github.com/openshift/cluster-node-tuning-operator/pull/1153)
* [OCPBUGS-39005](https://issues.redhat.com/browse/OCPBUGS-39005): Add cluster-wide proxy env file (#1166) [#1166](https://github.com/openshift/cluster-node-tuning-operator/pull/1166)
* OCPBUGS-36431 Fix generated cpu mask for 512+ cpus (#1152) [#1152](https://github.com/openshift/cluster-node-tuning-operator/pull/1152)
* E2E: Remove checking of reserved cpus in irqbalance file (#1156) [#1156](https://github.com/openshift/cluster-node-tuning-operator/pull/1156)
* Fix the destination of asset's copy (#1134) [#1134](https://github.com/openshift/cluster-node-tuning-operator/pull/1134)
* [Full changelog](https://github.com/openshift/cluster-node-tuning-operator/compare/2bd8891ead93e161b9a871ac2eaa947bfc17309f...e739b63c155856b93d072e6077bb73a995ba0f28)


### [cluster-openshift-controller-manager-operator](https://github.com/openshift/cluster-openshift-controller-manager-operator/tree/2280f54414cf403aed0a02b3fdb86ee6bf672410)

* [OCPBUGS-38269](https://issues.redhat.com/browse/OCPBUGS-38269): CVE-2024-24786 infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON [#363](https://github.com/openshift/cluster-openshift-controller-manager-operator/pull/363)
* [OCPBUGS-34213](https://issues.redhat.com/browse/OCPBUGS-34213): lots of churn during image registry managed/removed transition [#348](https://github.com/openshift/cluster-openshift-controller-manager-operator/pull/348)
* [OCPBUGS-35822](https://issues.redhat.com/browse/OCPBUGS-35822): nil pointer reference in ocm-operator [#356](https://github.com/openshift/cluster-openshift-controller-manager-operator/pull/356)
* [Full changelog](https://github.com/openshift/cluster-openshift-controller-manager-operator/compare/899699681f8bb984d0f249dec171e630440c461b...2280f54414cf403aed0a02b3fdb86ee6bf672410)


### [cluster-samples-operator](https://github.com/openshift/cluster-samples-operator/tree/6541dd7e1fdb3d40896956a56f1dc800fae5d8b8)

* [OKD-225](https://issues.redhat.com/browse/OKD-225): remove only the EOL CentOS 7 images [#576](https://github.com/openshift/cluster-samples-operator/pull/576)
* [OCPBUGS-38159](https://issues.redhat.com/browse/OCPBUGS-38159): add owners [#555](https://github.com/openshift/cluster-samples-operator/pull/555)
* [Full changelog](https://github.com/openshift/cluster-samples-operator/compare/d4dd84396472c5e974f0562046a6ad068b6f20f8...6541dd7e1fdb3d40896956a56f1dc800fae5d8b8)


### [cluster-storage-operator](https://github.com/openshift/cluster-storage-operator/tree/761b62fa95c15dd7fcae6df1dda5876e50a10f2d)

* [OCPBUGS-43315](https://issues.redhat.com/browse/OCPBUGS-43315): assets: shared-resource: hypershift: add pull-secret to operator SA [#521](https://github.com/openshift/cluster-storage-operator/pull/521)
* NO-JIRA: release-4.16: Run make update [#512](https://github.com/openshift/cluster-storage-operator/pull/512)
* [OCPBUGS-36969](https://issues.redhat.com/browse/OCPBUGS-36969): STOR-1839: VSphereDriverConfiguration feature Accessible-by-default [#491](https://github.com/openshift/cluster-storage-operator/pull/491)
* [OCPBUGS-35298](https://issues.redhat.com/browse/OCPBUGS-35298): revert vsphere problem detector controller name change [#481](https://github.com/openshift/cluster-storage-operator/pull/481)
* [Full changelog](https://github.com/openshift/cluster-storage-operator/compare/7cb826784c64b234d9ce1c99b2f8fd6082670c36...761b62fa95c15dd7fcae6df1dda5876e50a10f2d)


### [cluster-update-keys](https://github.com/openshift/cluster-update-keys/tree/e8478585cca88314094112aa5933e5281f4707ea)

* [OCPBUGS-43467](https://issues.redhat.com/browse/OCPBUGS-43467): keys: Update Red Hat keys to use SHA256 signatures [#64](https://github.com/openshift/cluster-update-keys/pull/64)
* [Full changelog](https://github.com/openshift/cluster-update-keys/compare/c0641e083d1bbe7d6f78e7e0c98c6d56a8b89d24...e8478585cca88314094112aa5933e5281f4707ea)


### [cluster-version-operator](https://github.com/openshift/cluster-version-operator/tree/15c87e7e6d56f89fcc2453012e09283e965e71af)

* [OCPBUGS-43964](https://issues.redhat.com/browse/OCPBUGS-43964): Fix desired before sync_worker's work is initialized [#1097](https://github.com/openshift/cluster-version-operator/pull/1097)
* [OCPBUGS-37853](https://issues.redhat.com/browse/OCPBUGS-37853): Revert "OCPBUGS-35994: Revert "OCPBUGS-24535: pkg/payload/precondition/clusterversion/rollback: Allow previous version within z-stream"" [#1077](https://github.com/openshift/cluster-version-operator/pull/1077)
* [OCPBUGS-36898](https://issues.redhat.com/browse/OCPBUGS-36898): vendor: Update openshift/api to pick up zz_generated.crd-manifests [#1069](https://github.com/openshift/cluster-version-operator/pull/1069)
* [OCPBUGS-36764](https://issues.redhat.com/browse/OCPBUGS-36764): Revert "OCPBUGS-24535: pkg/payload/precondition/clusterversion/rollback: Allow previous version within z-stream" [#1065](https://github.com/openshift/cluster-version-operator/pull/1065)
* [Full changelog](https://github.com/openshift/cluster-version-operator/compare/6f553e98877e87d08a5c5fa9b13758a12cdcef8c...15c87e7e6d56f89fcc2453012e09283e965e71af)


### [console](https://github.com/openshift/console/tree/95cf5fd7d840b19805d1665b6ffc064e51f35bef)

* [OCPBUGS-43834](https://issues.redhat.com/browse/OCPBUGS-43834): Enabling topology e2e tests on CI [#14438](https://github.com/openshift/console/pull/14438)
* [OCPBUGS-35204](https://issues.redhat.com/browse/OCPBUGS-35204): replace global refresh sync lock in OIDC provider with per-refresh-token one [#13950](https://github.com/openshift/console/pull/13950)
* [OCPBUGS-36556](https://issues.redhat.com/browse/OCPBUGS-36556): Increase login flow state paramater length/entropy [#14354](https://github.com/openshift/console/pull/14354)
* [OCPBUGS-42369](https://issues.redhat.com/browse/OCPBUGS-42369): Console crashes when ssh is selected in add secret for starting a pipeline run [#14320](https://github.com/openshift/console/pull/14320)
* [OCPBUGS-41904](https://issues.redhat.com/browse/OCPBUGS-41904): fix annotation for ovn localnet [#14366](https://github.com/openshift/console/pull/14366)
* [OCPBUGS-37615](https://issues.redhat.com/browse/OCPBUGS-37615): Include PatternFly-4 chart styles so they are available for dynamic plugins that still use PF4 react-charts [#14091](https://github.com/openshift/console/pull/14091)
* [OCPBUGS-37689](https://issues.redhat.com/browse/OCPBUGS-37689): Switch to use annotations as labels from PipelineRuns created through Pipelines as Code is deprecated [#14094](https://github.com/openshift/console/pull/14094)
* [OCPBUGS-42015](https://issues.redhat.com/browse/OCPBUGS-42015): Topology screen crashes when completed pod is selected [#14298](https://github.com/openshift/console/pull/14298)
* [OCPBUGS-35850](https://issues.redhat.com/browse/OCPBUGS-35850): Fix: Quick Start "next" button requires double click to move to next step [#13989](https://github.com/openshift/console/pull/13989)
* [OCPBUGS-42382](https://issues.redhat.com/browse/OCPBUGS-42382): Allow operators to enable monitoring by default [#14317](https://github.com/openshift/console/pull/14317)
* [OCPBUGS-41905](https://issues.redhat.com/browse/OCPBUGS-41905): List of default Camel K event sources disappears when adding a custom event source [#14290](https://github.com/openshift/console/pull/14290)
* [OCPBUGS-41709](https://issues.redhat.com/browse/OCPBUGS-41709): Need to allow blank for Project/namespace when setting SA Subject in 'Project access tab' [#14278](https://github.com/openshift/console/pull/14278)
* [OCPBUGS-42069](https://issues.redhat.com/browse/OCPBUGS-42069): add Create button to Console plugins tab [#14302](https://github.com/openshift/console/pull/14302)
* [OCPBUGS-41996](https://issues.redhat.com/browse/OCPBUGS-41996): Fix updating the "Until" field on the Silence &gt; Edit page [#14296](https://github.com/openshift/console/pull/14296)
* [OCPBUGS-38112](https://issues.redhat.com/browse/OCPBUGS-38112): do not directly mutate links in useMemo [#14117](https://github.com/openshift/console/pull/14117)
* [OCPBUGS-34518](https://issues.redhat.com/browse/OCPBUGS-34518): Restore user toggle when authentification is disabled [#13902](https://github.com/openshift/console/pull/13902)
* [OCPBUGS-41619](https://issues.redhat.com/browse/OCPBUGS-41619): Use vCenterCluster value from CM as primary resource [#14268](https://github.com/openshift/console/pull/14268)
* [OCPBUGS-37046](https://issues.redhat.com/browse/OCPBUGS-37046): Fix TypeError: Cannot read properties of null (reading 'metadata') in Topology view [#14059](https://github.com/openshift/console/pull/14059)
* [OCPBUGS-38911](https://issues.redhat.com/browse/OCPBUGS-38911): Values entered into the Instantiate Template form are automatically cleared [#14187](https://github.com/openshift/console/pull/14187)
* [OCPBUGS-38914](https://issues.redhat.com/browse/OCPBUGS-38914): Unrelated readme opened when opening CodeReady workspaces from Quarkus using s2i quickstart [#14188](https://github.com/openshift/console/pull/14188)
* [OCPBUGS-38968](https://issues.redhat.com/browse/OCPBUGS-38968): A value submitted in From view is wrapped with single quotation after switching to Yaml view. [#14193](https://github.com/openshift/console/pull/14193)
* [OCPBUGS-38424](https://issues.redhat.com/browse/OCPBUGS-38424): fix bug where cluster version text appears black in da… [#14144](https://github.com/openshift/console/pull/14144)
* [OCPBUGS-38464](https://issues.redhat.com/browse/OCPBUGS-38464): correct casing in "Lightspeed" [#14148](https://github.com/openshift/console/pull/14148)
* [OCPBUGS-37430](https://issues.redhat.com/browse/OCPBUGS-37430): Fix utilization card limits/total display [#14082](https://github.com/openshift/console/pull/14082)
* [OCPBUGS-36510](https://issues.redhat.com/browse/OCPBUGS-36510): DeploymentConfigs deprecation info alert should not present on the Edit deployment page [#14031](https://github.com/openshift/console/pull/14031)
* [OCPBUGS-37954](https://issues.redhat.com/browse/OCPBUGS-37954): No access to list pipelines.tekton.dev prevents from using Delete application form [#14107](https://github.com/openshift/console/pull/14107)
* [OCPBUGS-36601](https://issues.redhat.com/browse/OCPBUGS-36601): Tooltip on Pipeline when expression is not shows [#14033](https://github.com/openshift/console/pull/14033)
* [OCPBUGS-38803](https://issues.redhat.com/browse/OCPBUGS-38803): CONSOLE-4108 [4.16 backport] Show deprecated operators in OperatorHub [#14095](https://github.com/openshift/console/pull/14095)
* [OCPBUGS-37048](https://issues.redhat.com/browse/OCPBUGS-37048): Fix "Auto deploy when new image is available" becomes unchecked when editing a deployment from web console [#14060](https://github.com/openshift/console/pull/14060)
* [OCPBUGS-35839](https://issues.redhat.com/browse/OCPBUGS-35839): Fix placement of icons on WebKit [#13988](https://github.com/openshift/console/pull/13988)
* [OCPBUGS-35271](https://issues.redhat.com/browse/OCPBUGS-35271): Fix password set to Secret created through Start Pipeline form [#13954](https://github.com/openshift/console/pull/13954)
* [OCPBUGS-38093](https://issues.redhat.com/browse/OCPBUGS-38093): correct link for Lightspeed operator [#14112](https://github.com/openshift/console/pull/14112)
* [OCPBUGS-36484](https://issues.redhat.com/browse/OCPBUGS-36484): Revert - terminal: use username if uid is not present [#14027](https://github.com/openshift/console/pull/14027)
* [OCPBUGS-37097](https://issues.redhat.com/browse/OCPBUGS-37097): Add useQuickStartContext hook and expose it via dynamic plugin API [#14070](https://github.com/openshift/console/pull/14070)
* [OCPBUGS-36864](https://issues.redhat.com/browse/OCPBUGS-36864): maintain session across tabs [#14051](https://github.com/openshift/console/pull/14051)
* [OCPBUGS-36620](https://issues.redhat.com/browse/OCPBUGS-36620): Redirects to new PipelineRun logs URL from old PipelineRun logs URL [#14035](https://github.com/openshift/console/pull/14035)
* [OCPBUGS-36759](https://issues.redhat.com/browse/OCPBUGS-36759): RWOP accessMode is not available on OpenShift console UI [#14040](https://github.com/openshift/console/pull/14040)
* [OCPBUGS-37063](https://issues.redhat.com/browse/OCPBUGS-37063): hide 'View all steps in documentation' for ROSA and OSD [#14069](https://github.com/openshift/console/pull/14069)
* [OCPBUGS-36411](https://issues.redhat.com/browse/OCPBUGS-36411): fix BMH restart annotation [#14022](https://github.com/openshift/console/pull/14022)
* [OCPBUGS-36841](https://issues.redhat.com/browse/OCPBUGS-36841): ensure correct API version for OperandDetails [#14049](https://github.com/openshift/console/pull/14049)
* [OCPBUGS-36186](https://issues.redhat.com/browse/OCPBUGS-36186): Add default sorting column for VirtualizedTable component of dynamic plugin sdk [#14008](https://github.com/openshift/console/pull/14008)
* [OCPBUGS-36002](https://issues.redhat.com/browse/OCPBUGS-36002): fix flaking crd-extension tests [#14003](https://github.com/openshift/console/pull/14003)
* [OCPBUGS-35565](https://issues.redhat.com/browse/OCPBUGS-35565): remove duplicate OAuth config [#13982](https://github.com/openshift/console/pull/13982)
* [OCPBUGS-35571](https://issues.redhat.com/browse/OCPBUGS-35571): Update Go prereq in README.md [#13981](https://github.com/openshift/console/pull/13981)
* [OCPBUGS-35465](https://issues.redhat.com/browse/OCPBUGS-35465): ManagedField in YAML editor is not collapsed by default which is incorrect [#13974](https://github.com/openshift/console/pull/13974)
* [OCPBUGS-35408](https://issues.redhat.com/browse/OCPBUGS-35408): fix pseudolocalization [#13972](https://github.com/openshift/console/pull/13972)
* [OCPBUGS-35280](https://issues.redhat.com/browse/OCPBUGS-35280): Ensure requiredVersion is set for Console provided shared modules [#13956](https://github.com/openshift/console/pull/13956)
* [OCPBUGS-34011](https://issues.redhat.com/browse/OCPBUGS-34011): Use bridge instead of cnv-bridge [#13875](https://github.com/openshift/console/pull/13875)
* [OCPBUGS-35946](https://issues.redhat.com/browse/OCPBUGS-35946): Fix invalid node filesystem query [#13999](https://github.com/openshift/console/pull/13999)
* [OCPBUGS-34717](https://issues.redhat.com/browse/OCPBUGS-34717): The s2i build strategy is not assumed for Serverless Functions [#13915](https://github.com/openshift/console/pull/13915)
* [OCPBUGS-34968](https://issues.redhat.com/browse/OCPBUGS-34968): Update plugin docs regarding Console 4.16 shared module changes [#13933](https://github.com/openshift/console/pull/13933)
* [OCPBUGS-35281](https://issues.redhat.com/browse/OCPBUGS-35281): Display of "Auth Token GCP" filter in OperatorHub should be conditioned [#13955](https://github.com/openshift/console/pull/13955)
* [OCPBUGS-35472](https://issues.redhat.com/browse/OCPBUGS-35472): bump helm to 3.14 [#13971](https://github.com/openshift/console/pull/13971)
* [OCPBUGS-35481](https://issues.redhat.com/browse/OCPBUGS-35481): fix crash if helm chart metadata is nil [#13975](https://github.com/openshift/console/pull/13975)
* [Full changelog](https://github.com/openshift/console/compare/cb7b0786c142a10610fa50cddc25cd1de8a62653...95cf5fd7d840b19805d1665b6ffc064e51f35bef)


### [console-operator](https://github.com/openshift/console-operator/tree/92447df597eeca8a92bb9019e854619e19736638)

* [OCPBUGS-34783](https://issues.redhat.com/browse/OCPBUGS-34783): set required-scc for openshift workloads [#908](https://github.com/openshift/console-operator/pull/908)
* [OCPBUGS-34012](https://issues.redhat.com/browse/OCPBUGS-34012): Cache organization ID [#916](https://github.com/openshift/console-operator/pull/916)
* [OCPBUGS-33788](https://issues.redhat.com/browse/OCPBUGS-33788): Tolerate the absence of ingress capability on HyperShift clusters [#910](https://github.com/openshift/console-operator/pull/910)
* [Full changelog](https://github.com/openshift/console-operator/compare/efe782291fe88877add25db7d575934d926963c4...92447df597eeca8a92bb9019e854619e19736638)


### [container-networking-plugins, containernetworking-plugins-microshift](https://github.com/openshift/containernetworking-plugins/tree/73b4123cc75abd22af8dc3b429836be2bea45fd5)

* [OCPBUGS-37725](https://issues.redhat.com/browse/OCPBUGS-37725): Update owners [#166](https://github.com/openshift/containernetworking-plugins/pull/166)
* [Full changelog](https://github.com/openshift/containernetworking-plugins/compare/f503997690a236f322ae062ab2ebcf720b0457bf...73b4123cc75abd22af8dc3b429836be2bea45fd5)


### [coredns](https://github.com/openshift/coredns/tree/1e417656c1c72d3410b31ee08caf25bcdf8836e3)

* [OCPBUGS-37078](https://issues.redhat.com/browse/OCPBUGS-37078): UPSTREAM: &lt;carry&gt;: openshift: Bump the version of ocp_dnsnameresolver external plugin [#127](https://github.com/openshift/coredns/pull/127)
* [Full changelog](https://github.com/openshift/coredns/compare/04d84f7f2e17ff464fad3f2841e7b29a43c8382f...1e417656c1c72d3410b31ee08caf25bcdf8836e3)


### [csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager](https://github.com/openshift/cloud-provider-openstack/tree/b7e9010d795f78f39bf12433599658bbbdd9560e)

* [OCPBUGS-38167](https://issues.redhat.com/browse/OCPBUGS-38167): rebase CPO on 4.16 [#291](https://github.com/openshift/cloud-provider-openstack/pull/291)
* [Full changelog](https://github.com/openshift/cloud-provider-openstack/compare/5340eaab09d8057a705b7a7124e05231cfd37978...b7e9010d795f78f39bf12433599658bbbdd9560e)


### [csi-driver-manila-operator](https://github.com/openshift/csi-driver-manila-operator/tree/c25d1ff2677a882504b18220dcbbe153781f3883)

* [OCPBUGS-38458](https://issues.redhat.com/browse/OCPBUGS-38458): Add missing healthchecks [#241](https://github.com/openshift/csi-driver-manila-operator/pull/241)
* [OCPBUGS-30438](https://issues.redhat.com/browse/OCPBUGS-30438): Bump protobuf dependency [#237](https://github.com/openshift/csi-driver-manila-operator/pull/237)
* [OCPBUGS-38013](https://issues.redhat.com/browse/OCPBUGS-38013): Set required-scc for openshift workloads [#235](https://github.com/openshift/csi-driver-manila-operator/pull/235)
* [Full changelog](https://github.com/openshift/csi-driver-manila-operator/compare/6de0dc79d67fdf817ac0bed7a6d7b1d1131a5751...c25d1ff2677a882504b18220dcbbe153781f3883)


### [docker-builder](https://github.com/openshift/builder/tree/5e57cc83b011f98b9cd10b9f97e9d5ae6e5ee6be)

* [OCPBUGS-30455](https://issues.redhat.com/browse/OCPBUGS-30455): bump google.golang.org/protobuf to 1.33.0 [#402](https://github.com/openshift/builder/pull/402)
* [OCPBUGS-35283](https://issues.redhat.com/browse/OCPBUGS-35283): Bumps openshift/api & related dependencies [#397](https://github.com/openshift/builder/pull/397)
* [Full changelog](https://github.com/openshift/builder/compare/ca2b36ac7f38efc76bedc87cc81f9464f52bf332...5e57cc83b011f98b9cd10b9f97e9d5ae6e5ee6be)


### [docker-registry](https://github.com/openshift/image-registry/tree/e4d56625da1bde6f51fb84f05efe02df92b6f120)

* [OCPBUGS-39412](https://issues.redhat.com/browse/OCPBUGS-39412): pull upstream distribution changes to use a consistent multipart chunk size [#410](https://github.com/openshift/image-registry/pull/410)
* [OCPBUGS-35567](https://issues.redhat.com/browse/OCPBUGS-35567): use SelfSubjectReview to obtain user info [#405](https://github.com/openshift/image-registry/pull/405)
* [Full changelog](https://github.com/openshift/image-registry/compare/58a613b36ac03c264f06e429d6260f34396668db...e4d56625da1bde6f51fb84f05efe02df92b6f120)


### [egress-router-cni](https://github.com/openshift/egress-router-cni/tree/7089efe6100c1f52f28adccf1dccc722b8dcacdc)

* [OCPBUGS-35525](https://issues.redhat.com/browse/OCPBUGS-35525): update to go 1.21 and k8s.io mods to v0.29.2 [#85](https://github.com/openshift/egress-router-cni/pull/85)
* [Full changelog](https://github.com/openshift/egress-router-cni/compare/7534ab906e5f9d38defbbbc6b169e5d829463bb5...7089efe6100c1f52f28adccf1dccc722b8dcacdc)


### [etcd](https://github.com/openshift/etcd/tree/16202ec4ecea353650b3681979ba73c5d8664d8c)

* [OCPBUGS-34690](https://issues.redhat.com/browse/OCPBUGS-34690): Rebase etcd 3.5.14 openshift 4.16 [#274](https://github.com/openshift/etcd/pull/274)
* [Full changelog](https://github.com/openshift/etcd/compare/bc2fec27ff5b086436d438157c24396f280e0305...16202ec4ecea353650b3681979ba73c5d8664d8c)


### [hyperkube, pod](https://github.com/openshift/kubernetes/tree/7423cac0f833e38f8453886514a8910f62fd02d1)

* [OCPBUGS-42555](https://issues.redhat.com/browse/OCPBUGS-42555): Allow pod to be scheduled if node's name and hostname mismatch [#2099](https://github.com/openshift/kubernetes/pull/2099)
* [OCPBUGS-42168](https://issues.redhat.com/browse/OCPBUGS-42168): Bump k8s api to 1.29.9 [#2090](https://github.com/openshift/kubernetes/pull/2090)
* release-4.16] OCPBUGS-42057: UPSTREAM: &lt;drop&gt;: bump(github.com/openshift/apiserver-library-go) [#2096](https://github.com/openshift/kubernetes/pull/2096)
* [OCPBUGS-39015](https://issues.redhat.com/browse/OCPBUGS-39015): Bump k8s api to 1.29.8 [#2066](https://github.com/openshift/kubernetes/pull/2066)
* [OCPBUGS-36773](https://issues.redhat.com/browse/OCPBUGS-36773): UPSTREAM: &lt;carry&gt;: Disable vSphere tests with pre-provisioned volumes [#2021](https://github.com/openshift/kubernetes/pull/2021)
* NO-JIRA: update downstream owners [#2049](https://github.com/openshift/kubernetes/pull/2049)
* [OCPBUGS-37621](https://issues.redhat.com/browse/OCPBUGS-37621): Bump k8s api to 1.29.7 [#2039](https://github.com/openshift/kubernetes/pull/2039)
* [OCPBUGS-19802](https://issues.redhat.com/browse/OCPBUGS-19802): Bump 4.16 runc [#2032](https://github.com/openshift/kubernetes/pull/2032)
* [OCPBUGS-35551](https://issues.redhat.com/browse/OCPBUGS-35551): Bump k8s 1.29.6 [#1990](https://github.com/openshift/kubernetes/pull/1990)
* [OCPBUGS-34545](https://issues.redhat.com/browse/OCPBUGS-34545): UPSTREAM: &lt;carry&gt;: Disable PersistentVolumeLabel by default [#1993](https://github.com/openshift/kubernetes/pull/1993)
* [Full changelog](https://github.com/openshift/kubernetes/compare/29c95f359e591fae386ce64516812d8b65d285be...7423cac0f833e38f8453886514a8910f62fd02d1)


### [hypershift](https://github.com/openshift/hypershift/tree/da6b6e6c44c34a66a0ee9a2844422457714cd323)

* NO-JIRA: Update Konflux references (release-4.16) [#5099](https://github.com/openshift/hypershift/pull/5099)
* chore(deps): update konflux references (release-4.16) [#5078](https://github.com/openshift/hypershift/pull/5078)
* NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.44 (release-4.16) [#5059](https://github.com/openshift/hypershift/pull/5059)
* NO-JIRA: chore(deps): update konflux references (release-4.16) [#5058](https://github.com/openshift/hypershift/pull/5058)
* NO-JIRA: Update Konflux references (release-4.16) [#5042](https://github.com/openshift/hypershift/pull/5042)
* chore(deps): update konflux references (release-4.16) [#5024](https://github.com/openshift/hypershift/pull/5024)
* chore(deps): update konflux references (release-4.16) [#5019](https://github.com/openshift/hypershift/pull/5019)
* NO-JIRA: Update squidfunk/mkdocs-material Docker tag to v9.5.43 (release-4.16) [#5017](https://github.com/openshift/hypershift/pull/5017)
* NO-JIRA: Update Konflux references (release-4.16) [#5012](https://github.com/openshift/hypershift/pull/5012)
* [OCPBUGS-43840](https://issues.redhat.com/browse/OCPBUGS-43840): add ValidIDPConfiguration condition to report IDP config issues [#4985](https://github.com/openshift/hypershift/pull/4985)
* NO-JIRA: chore(deps): update konflux references (release-4.16) [#4971](https://github.com/openshift/hypershift/pull/4971)
* [OCPBUGS-43046](https://issues.redhat.com/browse/OCPBUGS-43046): Do not send traffic to local audit-webhook through konnectivity [#4883](https://github.com/openshift/hypershift/pull/4883)
* NO-JIRA: chore(deps): update konflux references (release-4.16) [#4954](https://github.com/openshift/hypershift/pull/4954)
* NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.42 (release-4.16) [#4947](https://github.com/openshift/hypershift/pull/4947)
* NO-JIRA: chore(deps): update konflux references (release-4.16) [#4933](https://github.com/openshift/hypershift/pull/4933)
* [OCPBUGS-43104](https://issues.redhat.com/browse/OCPBUGS-43104): label routes only when HCP router used [#4899](https://github.com/openshift/hypershift/pull/4899)
* [OCPBUGS-43308](https://issues.redhat.com/browse/OCPBUGS-43308): Use guest DNS resolution in Konnectivity HTTPS proxy by default [#4905](https://github.com/openshift/hypershift/pull/4905)
* NO-JIRA: chore(deps): update konflux references (release-4.16) [#4923](https://github.com/openshift/hypershift/pull/4923)
* NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.41 (release-4.16) [#4919](https://github.com/openshift/hypershift/pull/4919)
* NO-JIRA: chore(deps): update konflux references to 674e70f (release-4.16) [#4908](https://github.com/openshift/hypershift/pull/4908)
* NO-JIRA: chore(deps): update konflux references (release-4.16) [#4896](https://github.com/openshift/hypershift/pull/4896)
* NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.40 (release-4.16) [#4880](https://github.com/openshift/hypershift/pull/4880)
* [OCPBUGS-42432](https://issues.redhat.com/browse/OCPBUGS-42432): Use KubeClientCABundle for HostedClusterConfigOperator cluster-signer-ca [#4799](https://github.com/openshift/hypershift/pull/4799)
* [OCPBUGS-42342](https://issues.redhat.com/browse/OCPBUGS-42342): Let payload generation pick the release for the NodePool [#4787](https://github.com/openshift/hypershift/pull/4787)
* [OCPBUGS-42431](https://issues.redhat.com/browse/OCPBUGS-42431): Conditionally manage kubeconfig secrets for DNS and Ingress operators [#4798](https://github.com/openshift/hypershift/pull/4798)
* NO-JIRA: [chore(deps): update konflux references (release-4.16)](https://github.com/openshift/hypershift/pull/4853#top) [#4853](https://github.com/openshift/hypershift/pull/4853)
* [OCPBUGS-42608](https://issues.redhat.com/browse/OCPBUGS-42608): Add Annotation to skip deleting hcp namespace [#4830](https://github.com/openshift/hypershift/pull/4830)
* NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.39 (release-4.16) [#4827](https://github.com/openshift/hypershift/pull/4827)
* chore(deps): update konflux references (release-4.16) [#4816](https://github.com/openshift/hypershift/pull/4816)
* NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.38 (release-4.16) [#4806](https://github.com/openshift/hypershift/pull/4806)
* NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.37 (release-4.16) [#4796](https://github.com/openshift/hypershift/pull/4796)
* chore(deps): update konflux references (release-4.16) [#4781](https://github.com/openshift/hypershift/pull/4781)
* NO-JIRA: chore(deps): update konflux references (release-4.16) [#4760](https://github.com/openshift/hypershift/pull/4760)
* NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.36 (release-4.16) [#4759](https://github.com/openshift/hypershift/pull/4759)
* NO-JIRA: Security fixes for openshift-ci-security job [#4750](https://github.com/openshift/hypershift/pull/4750)
* [OCPBUGS-41372](https://issues.redhat.com/browse/OCPBUGS-41372): CPO oauth idp converter: resolve names before dialing [#4689](https://github.com/openshift/hypershift/pull/4689)
* NO-JIRA: chore(deps): update golang docker tag to v1.23 (release-4.16) [#4729](https://github.com/openshift/hypershift/pull/4729)
* NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.34 (release-4.16) [#4728](https://github.com/openshift/hypershift/pull/4728)
* NO-JIRA: chore(deps): update konflux references (release-4.16) [#4727](https://github.com/openshift/hypershift/pull/4727)
* [OCPBUGS-38058](https://issues.redhat.com/browse/OCPBUGS-38058): Add HTTP konnectivity proxy to OAuth server [#4496](https://github.com/openshift/hypershift/pull/4496)
* [HOSTEDCP-1955](https://issues.redhat.com/browse/HOSTEDCP-1955): bump CCO version [#4696](https://github.com/openshift/hypershift/pull/4696)
* [OCPBUGS-34803](https://issues.redhat.com/browse/OCPBUGS-34803): cmd: report server version, supported OCP [#4141](https://github.com/openshift/hypershift/pull/4141)
* [OCPBUGS-39293](https://issues.redhat.com/browse/OCPBUGS-39293): copy image-registry AdditionalTrustedCA configmap into HC openshift-config [#4647](https://github.com/openshift/hypershift/pull/4647)
* chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.21.11-9 (release-4.16) [#4685](https://github.com/openshift/hypershift/pull/4685)
* [OCPBUGS-38062](https://issues.redhat.com/browse/OCPBUGS-38062): [release-4.16] Use HTTP proxy for ingress controller [#4688](https://github.com/openshift/hypershift/pull/4688)
* NO-JIRA: chore(deps): update konflux references (release-4.16) [#4684](https://github.com/openshift/hypershift/pull/4684)
* [OCPBUGS-39447](https://issues.redhat.com/browse/OCPBUGS-39447): handle version skewed NodePools that do not have rhel9 binaries [#4664](https://github.com/openshift/hypershift/pull/4664)
* [HOSTEDCP-1895](https://issues.redhat.com/browse/HOSTEDCP-1895): [release-4.16] Allow setting Kube APIServer maximum requests in flight [#4551](https://github.com/openshift/hypershift/pull/4551)
* chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.21.11-7.1724661022 (release-4.16) [#4600](https://github.com/openshift/hypershift/pull/4600)
* chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.33 (release-4.16) [#4602](https://github.com/openshift/hypershift/pull/4602)
* chore(deps): update konflux references (release-4.16) [#4599](https://github.com/openshift/hypershift/pull/4599)
* [OCPBUGS-38942](https://issues.redhat.com/browse/OCPBUGS-38942): copy oapi ca-trust recursively when building trust anchor [#4615](https://github.com/openshift/hypershift/pull/4615)
* NO-JIRA: Flaky cert validation test [#4622](https://github.com/openshift/hypershift/pull/4622)
* [OCPBUGS-38259](https://issues.redhat.com/browse/OCPBUGS-38259): Set KCM node monitor grace period [#4520](https://github.com/openshift/hypershift/pull/4520)
* [OCPBUGS-38726](https://issues.redhat.com/browse/OCPBUGS-38726): fix: bump github.com/IBM/go-sdk-core/v5 [#4611](https://github.com/openshift/hypershift/pull/4611)
* [HOSTEDCP-1764](https://issues.redhat.com/browse/HOSTEDCP-1764): retrieve registryOverrides when ImageStream is not ava… [#4541](https://github.com/openshift/hypershift/pull/4541)
* chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.21.11-7 (release-4.16) [#4525](https://github.com/openshift/hypershift/pull/4525)
* [OCPBUGS-36781](https://issues.redhat.com/browse/OCPBUGS-36781): Set Azure VM identity if user assigned identity set [#4341](https://github.com/openshift/hypershift/pull/4341)
* [OCPBUGS-37936](https://issues.redhat.com/browse/OCPBUGS-37936): set proxy envvars on aws and azure CCMs [#4476](https://github.com/openshift/hypershift/pull/4476)
* [OCPBUGS-38486](https://issues.redhat.com/browse/OCPBUGS-38486): hcco: reconcile apiserver config into hosted cluster [#4559](https://github.com/openshift/hypershift/pull/4559)
* NO-JIRA: fix(KONFLUX-3663): format PipelineRun files and upload SAST results [#4534](https://github.com/openshift/hypershift/pull/4534)
* [OCPBUGS-38131](https://issues.redhat.com/browse/OCPBUGS-38131): Let the CPO oidc check resolve through data plane [#4505](https://github.com/openshift/hypershift/pull/4505)
* NO-JIRA: test: relax mgmt KAS egress check [#4561](https://github.com/openshift/hypershift/pull/4561)
* chore(deps): update quay.io/openshift/origin-base docker tag to v4.16 (release-4.16) [#4528](https://github.com/openshift/hypershift/pull/4528)
* chore(deps): update golang docker tag to v1.22 (release-4.16) [#4527](https://github.com/openshift/hypershift/pull/4527)
* NO-JIRA: Update Konflux references (release-4.16) [#4524](https://github.com/openshift/hypershift/pull/4524)
* [OCPBUGS-34801](https://issues.redhat.com/browse/OCPBUGS-34801): remove weak ciphers from security profile [#4518](https://github.com/openshift/hypershift/pull/4518)
* [OCPBUGS-37060](https://issues.redhat.com/browse/OCPBUGS-37060): OCPBUGS-35905: E2E test to verify openshift-apiserver TLS certificates [#4366](https://github.com/openshift/hypershift/pull/4366)
* NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9 (release-4.16) [#4482](https://github.com/openshift/hypershift/pull/4482)
* NO-JIRA: chore(deps): update konflux references (release-4.16) [#4481](https://github.com/openshift/hypershift/pull/4481)
* [OCPBUGS-37065](https://issues.redhat.com/browse/OCPBUGS-37065): OCPBUGS-35899: Doubled machineHealthCheck timeout on Agent and None [#4367](https://github.com/openshift/hypershift/pull/4367)
* [OCPBUGS-30282](https://issues.redhat.com/browse/OCPBUGS-30282): Multiple MachineConfigs in one CM [#4398](https://github.com/openshift/hypershift/pull/4398)
* [OCPBUGS-36937](https://issues.redhat.com/browse/OCPBUGS-36937): [release-4.16] Add HTTP(s) konnectivity proxy and use it with OpenShift APIServer [#4357](https://github.com/openshift/hypershift/pull/4357)
* [OCPBUGS-36766](https://issues.redhat.com/browse/OCPBUGS-36766): Delete IDMS in dataplane once HCP ICS field is removed [#4434](https://github.com/openshift/hypershift/pull/4434)
* NO-JIRA: Konflux migration for release-4.16 [#4436](https://github.com/openshift/hypershift/pull/4436)
* NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v8.5.11 (release-4.16) [#4430](https://github.com/openshift/hypershift/pull/4430)
* [HOSTEDCP-1569](https://issues.redhat.com/browse/HOSTEDCP-1569): test: e2e: skip unknown conditions instead of erroring [#4440](https://github.com/openshift/hypershift/pull/4440)
* [OCPBUGS-37645](https://issues.redhat.com/browse/OCPBUGS-37645): Set right endpointSlice port [#4431](https://github.com/openshift/hypershift/pull/4431)
* [OCPBUGS-37214](https://issues.redhat.com/browse/OCPBUGS-37214): Separate ibmcloud kms encryption configuration types [#4380](https://github.com/openshift/hypershift/pull/4380)
* [OCPBUGS-37302](https://issues.redhat.com/browse/OCPBUGS-37302): fix(api): Nodepool CEL validation fix [#4395](https://github.com/openshift/hypershift/pull/4395)
* NO-JIRA: Red Hat Konflux update hypershift-release-mce-26 [#4392](https://github.com/openshift/hypershift/pull/4392)
* [OCPBUGS-37241](https://issues.redhat.com/browse/OCPBUGS-37241): extract rhel9 MCO binaries for rhel8 based MCO images [#4383](https://github.com/openshift/hypershift/pull/4383)
* NO-JIRA: [release-4.16] test/e2e: remove api budget checks [#4368](https://github.com/openshift/hypershift/pull/4368)
* [HOSTEDCP-1795](https://issues.redhat.com/browse/HOSTEDCP-1795), [HOSTEDCP-1796](https://issues.redhat.com/browse/HOSTEDCP-1796): Customize the self-generated cert validity and rotation [#4371](https://github.com/openshift/hypershift/pull/4371)
* NO-JIRA: chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.21.11-2 (release-4.16) - abandoned [#4364](https://github.com/openshift/hypershift/pull/4364)
* NO-JIRA: trivial typo fixes to configuring-storage.md [#4353](https://github.com/openshift/hypershift/pull/4353)
* [OCPBUGS-36849](https://issues.redhat.com/browse/OCPBUGS-36849): Add newline after TLS certs referenced by image.config [#4352](https://github.com/openshift/hypershift/pull/4352)
* [OCPBUGS-36589](https://issues.redhat.com/browse/OCPBUGS-36589): Fix Hypershift dump for non-OpenShift Management Clusters [#4317](https://github.com/openshift/hypershift/pull/4317)
* NO-JIRA: chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.21.10-1.1719562237 (release-4.16) - abandoned [#4328](https://github.com/openshift/hypershift/pull/4328)
* [OCPBUGS-36358](https://issues.redhat.com/browse/OCPBUGS-36358): enable audit log for oauth-openshift [#4302](https://github.com/openshift/hypershift/pull/4302)
* [OCPBUGS-35522](https://issues.redhat.com/browse/OCPBUGS-35522): Copy infra-volumesnapshot-class-mapping to core binding [#4291](https://github.com/openshift/hypershift/pull/4291)
* NO-JIRA: chore(deps): update konflux references (release-4.16) [#4299](https://github.com/openshift/hypershift/pull/4299)
* [OCPBUGS-36227](https://issues.redhat.com/browse/OCPBUGS-36227): kubevirt-csi-driver: Pass infra kubeconfig in case of external infra [#4276](https://github.com/openshift/hypershift/pull/4276)
* [OCPBUGS-35341](https://issues.redhat.com/browse/OCPBUGS-35341): [release-4.16] Fixed ValidReleaseInfo condition [#4204](https://github.com/openshift/hypershift/pull/4204)
* [OCPBUGS-36220](https://issues.redhat.com/browse/OCPBUGS-36220): Make guest cluster components use the correct KAS port [#4275](https://github.com/openshift/hypershift/pull/4275)
* [OCPBUGS-35934](https://issues.redhat.com/browse/OCPBUGS-35934): check mgmt cluster for route capability before DeleteIfNeeded for ovn sbdb route [#4264](https://github.com/openshift/hypershift/pull/4264)
* NO-JIRA: chore(deps): update konflux references (release-4.16) [#4260](https://github.com/openshift/hypershift/pull/4260)
* [OCPBUGS-34545](https://issues.redhat.com/browse/OCPBUGS-34545): Disable PersistentVolumeLabel admission plugin [#4241](https://github.com/openshift/hypershift/pull/4241)
* [OCPBUGS-35838](https://issues.redhat.com/browse/OCPBUGS-35838): Remove KMS V1 provider support for IBM Cloud [#4250](https://github.com/openshift/hypershift/pull/4250)
* NO-JIRA: chore(deps): update konflux references (release-4.16) [#4251](https://github.com/openshift/hypershift/pull/4251)
* [OCPBUGS-35369](https://issues.redhat.com/browse/OCPBUGS-35369): OCPBUGS-35252: Enforce Privileged Instead of Restricted PSA in 4.16 [#4193](https://github.com/openshift/hypershift/pull/4193)
* NO-JIRA: chore(deps): update konflux references (release-4.16) [#4245](https://github.com/openshift/hypershift/pull/4245)
* [OCPBUGS-35557](https://issues.redhat.com/browse/OCPBUGS-35557): Complete KAS migration to none endpoint reconciler type [#4227](https://github.com/openshift/hypershift/pull/4227)
* NO-JIRA: chore(deps): update konflux references (release-4.16) [#4238](https://github.com/openshift/hypershift/pull/4238)
* NO-JIRA: feat(olm): Set packageserver replicas to 2 for IBMCloudPlatform [#4230](https://github.com/openshift/hypershift/pull/4230)
* [OCPBUGS-35268](https://issues.redhat.com/browse/OCPBUGS-35268): Add hypershift-cluster-version-operator image to release providers [#4185](https://github.com/openshift/hypershift/pull/4185)
* NO-JIRA: chore(deps): update konflux references (release-4.16) [#4235](https://github.com/openshift/hypershift/pull/4235)
* NO-JIRA: Red Hat Konflux update hypershift-release-mce-26 [#4233](https://github.com/openshift/hypershift/pull/4233)
* [OCPBUGS-35056](https://issues.redhat.com/browse/OCPBUGS-35056): Generate default worker security group rules based on machineCIDR [#4174](https://github.com/openshift/hypershift/pull/4174)
* [Full changelog](https://github.com/openshift/hypershift/compare/6946c3cc4654833ffc3db6299d5859b58b2f20a7...da6b6e6c44c34a66a0ee9a2844422457714cd323)


### [ibm-vpc-block-csi-driver](https://github.com/openshift/ibm-vpc-block-csi-driver/tree/957197389ec49234c3883bbb730bb630b459e24f)

* [OCPBUGS-36067](https://issues.redhat.com/browse/OCPBUGS-36067): CVE-2024-6104: bump github.com/hashicorp/go-retryablehttp to v0.7.7 [#71](https://github.com/openshift/ibm-vpc-block-csi-driver/pull/71)
* [Full changelog](https://github.com/openshift/ibm-vpc-block-csi-driver/compare/32b4c00517de0f54bf738380064a12d58b031eec...957197389ec49234c3883bbb730bb630b459e24f)


### [ibm-vpc-block-csi-driver-operator](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/tree/5d5d8010a59916cc264d0ab14962be85a35b7228)

* [OCPBUGS-42286](https://issues.redhat.com/browse/OCPBUGS-42286): Reorder static resources to create RBAC first [#129](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/pull/129)
* [OCPBUGS-36073](https://issues.redhat.com/browse/OCPBUGS-36073): CVE-2024-6104: bump github.com/hashicorp/go-retryablehttp to v0.7.7 [#120](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/pull/120)
* [Full changelog](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/compare/34fc9a4d3a4ae00d75bbfc01ac4c6385f9e94130...5d5d8010a59916cc264d0ab14962be85a35b7228)


### [ibmcloud-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-ibmcloud/tree/7d4f93efe65a7c070ded6b889b61ae3d51e259fb)

* [OCPBUGS-43686](https://issues.redhat.com/browse/OCPBUGS-43686): UPSTREAM: &lt;carry&gt;: Fix go-retryablehttp CVE - 4.16 [#89](https://github.com/openshift/cluster-api-provider-ibmcloud/pull/89)
* [Full changelog](https://github.com/openshift/cluster-api-provider-ibmcloud/compare/60b7ca98f5121f7e772437823b258a9fd0aa1d99...7d4f93efe65a7c070ded6b889b61ae3d51e259fb)


### [ibmcloud-machine-controllers](https://github.com/openshift/machine-api-provider-ibmcloud/tree/46c3c741fd44c1160a1f17d360723dc734d64648)

* [OCPBUGS-36698](https://issues.redhat.com/browse/OCPBUGS-36698): IBMCloud: Handle pagination for subnets [#42](https://github.com/openshift/machine-api-provider-ibmcloud/pull/42)
* [Full changelog](https://github.com/openshift/machine-api-provider-ibmcloud/compare/1a3a3030afcbbc0a26e794050d300b818069ba16...46c3c741fd44c1160a1f17d360723dc734d64648)


### [insights-operator](https://github.com/openshift/insights-operator/tree/faf70d79e50b62a3e5014c2081ee5203957c0d20)

* gather selected clusterroles (#1023) [#1023](https://github.com/openshift/insights-operator/pull/1023)
* [OCPBUGS-39564](https://issues.redhat.com/browse/OCPBUGS-39564): Not able to enable repositories during entitled build in OCP Cluster on IBM-Z (#1013) [#1013](https://github.com/openshift/insights-operator/pull/1013)
* [OCPBUGS-39394](https://issues.redhat.com/browse/OCPBUGS-39394): collect some nmstate customresources (#986) (#989) (#995) [#986](https://github.com/openshift/insights-operator/pull/986)
* [OCPBUGS-38021](https://issues.redhat.com/browse/OCPBUGS-38021): Integration of the OpenStack CRs into the insights-operator (#974) [#974](https://github.com/openshift/insights-operator/pull/974)
* Add haproxy metric (#977) [#977](https://github.com/openshift/insights-operator/pull/977)
* [OCPBUGS-37671](https://issues.redhat.com/browse/OCPBUGS-37671): Ingress controller related certificates' validate dates gathering (#970) [#970](https://github.com/openshift/insights-operator/pull/970)
* fix the configmapobserver notifications (#969) [#969](https://github.com/openshift/insights-operator/pull/969)
* [OCPBUGS-35882](https://issues.redhat.com/browse/OCPBUGS-35882): properly encode the URL for the advisor links (#957) [#957](https://github.com/openshift/insights-operator/pull/957)
* [Full changelog](https://github.com/openshift/insights-operator/compare/3c7446c68efe41e66efa1edca41aac89ba38f7fc...faf70d79e50b62a3e5014c2081ee5203957c0d20)


### [ironic](https://github.com/openshift/ironic-image/tree/d56a7dc8465a36357ba4ede63eabc9897a06a657)

* [OCPBUGS-43950](https://issues.redhat.com/browse/OCPBUGS-43950), [OCPBUGS-43958](https://issues.redhat.com/browse/OCPBUGS-43958): Bump python-waitress [4.16] [#604](https://github.com/openshift/ironic-image/pull/604)
* [OCPBUGS-43438](https://issues.redhat.com/browse/OCPBUGS-43438): Include fixes for CVE-2024-5569 [#599](https://github.com/openshift/ironic-image/pull/599)
* [OCPBUGS-42511](https://issues.redhat.com/browse/OCPBUGS-42511): Include fix for CVE-2024-47211 [#594](https://github.com/openshift/ironic-image/pull/594)
* [OCPBUGS-39017](https://issues.redhat.com/browse/OCPBUGS-39017): Bump ironic-lib to fix utf8 decoding issue [#569](https://github.com/openshift/ironic-image/pull/569)
* [OCPBUGS-38797](https://issues.redhat.com/browse/OCPBUGS-38797): redfish-virtualmedia fails on XFusion nodes [#564](https://github.com/openshift/ironic-image/pull/564)
* [OCPBUGS-42113](https://issues.redhat.com/browse/OCPBUGS-42113): Update ironic-inspector to fix the memory leak [#587](https://github.com/openshift/ironic-image/pull/587)
* [OCPBUGS-37758](https://issues.redhat.com/browse/OCPBUGS-37758), [OCPBUGS-39383](https://issues.redhat.com/browse/OCPBUGS-39383): Include fixes for CVE-2024-44082 [#579](https://github.com/openshift/ironic-image/pull/579)
* [OCPBUGS-38510](https://issues.redhat.com/browse/OCPBUGS-38510): set min version for python3-webob [#553](https://github.com/openshift/ironic-image/pull/553)
* [OCPBUGS-33376](https://issues.redhat.com/browse/OCPBUGS-33376): bump werkzeug [#534](https://github.com/openshift/ironic-image/pull/534)
* [OCPBUGS-36838](https://issues.redhat.com/browse/OCPBUGS-36838): Update Jinja2 [#521](https://github.com/openshift/ironic-image/pull/521)
* [OCPBUGS-36285](https://issues.redhat.com/browse/OCPBUGS-36285): Read ironic and inspector htpasswds from files [#517](https://github.com/openshift/ironic-image/pull/517)
* [Full changelog](https://github.com/openshift/ironic-image/compare/9d49fd688bcd13f28ed89f4641429f0b0797b339...d56a7dc8465a36357ba4ede63eabc9897a06a657)


### [ironic-agent](https://github.com/openshift/ironic-agent-image/tree/3c5298e05497b59a876c73c51359f49f3cc2cb99)

* [OCPBUGS-39017](https://issues.redhat.com/browse/OCPBUGS-39017): Bump ironic-lib to fix utf8 decoding issue [#156](https://github.com/openshift/ironic-agent-image/pull/156)
* [OCPBUGS-39383](https://issues.redhat.com/browse/OCPBUGS-39383): Include fixes for CVE-2024-44082 [#161](https://github.com/openshift/ironic-agent-image/pull/161)
* [OCPBUGS-38510](https://issues.redhat.com/browse/OCPBUGS-38510): set webob and bump werkzeug [#149](https://github.com/openshift/ironic-agent-image/pull/149)
* [Full changelog](https://github.com/openshift/ironic-agent-image/compare/63681a469fdba2f223373ff36350bf2462b997a3...3c5298e05497b59a876c73c51359f49f3cc2cb99)


### [keepalived-ipfailover](https://github.com/openshift/images/tree/b58673a314f0e8253fabadada2ee1a9e5b11c5cf)

* [OKD-219](https://issues.redhat.com/browse/OKD-219): add util-linux to base image [#188](https://github.com/openshift/images/pull/188)
* [Full changelog](https://github.com/openshift/images/compare/661d4f2ac6466565889ad11acb19d49d6e11333a...b58673a314f0e8253fabadada2ee1a9e5b11c5cf)


### [kube-metrics-server](https://github.com/openshift/kubernetes-metrics-server/tree/8c2920c24c3705e43cefd6c6e65409b7da341ddc)

* [OCPBUGS-41717](https://issues.redhat.com/browse/OCPBUGS-41717): Wire server run options to flags. ([release-4.16]  backport) [#37](https://github.com/openshift/kubernetes-metrics-server/pull/37)
* [Full changelog](https://github.com/openshift/kubernetes-metrics-server/compare/7938f253e74f2259951cc882f2879a9860a38481...8c2920c24c3705e43cefd6c6e65409b7da341ddc)


### [kube-proxy, sdn](https://github.com/openshift/sdn/tree/c4dd04f7cece66d0a237f06cac9253d4e70103a7)

* [OCPBUGS-44301](https://issues.redhat.com/browse/OCPBUGS-44301): Use copy() to duplicate a net.IP [#641](https://github.com/openshift/sdn/pull/641)
* [OCPBUGS-43344](https://issues.redhat.com/browse/OCPBUGS-43344): OCPBUGS-42244: Implement namespaceSelectors on ingress with all pods IPs [#635](https://github.com/openshift/sdn/pull/635)
* [OCPBUGS-42203](https://issues.redhat.com/browse/OCPBUGS-42203): fix UDP conntrack cleanup [#636](https://github.com/openshift/sdn/pull/636)
* [OCPBUGS-42159](https://issues.redhat.com/browse/OCPBUGS-42159): fix redundant router-default iptables rule [#633](https://github.com/openshift/sdn/pull/633)
* [Full changelog](https://github.com/openshift/sdn/compare/5b658c433786797d0ac1b870db08346584794514...c4dd04f7cece66d0a237f06cac9253d4e70103a7)


### [kube-rbac-proxy](https://github.com/openshift/kube-rbac-proxy/tree/c38f4734c6b6931c75d46674122fb4b838b6e64b)

* [OCPBUGS-30447](https://issues.redhat.com/browse/OCPBUGS-30447): protobuf bump [4.16] [#111](https://github.com/openshift/kube-rbac-proxy/pull/111)
* [Full changelog](https://github.com/openshift/kube-rbac-proxy/compare/8ea2c994df4296ec161023d8ff85f9ea0e383216...c38f4734c6b6931c75d46674122fb4b838b6e64b)


### [machine-api-operator](https://github.com/openshift/machine-api-operator/tree/0967219612b43f35342c162f5b92733f946bd9be)

* [OCPBUGS-39028](https://issues.redhat.com/browse/OCPBUGS-39028): Updates message verbs to use %q where appropriate [#1282](https://github.com/openshift/machine-api-operator/pull/1282)
* [OCPBUGS-43433](https://issues.redhat.com/browse/OCPBUGS-43433): Vsphere: Handle cloned instance with lost taskID [#1298](https://github.com/openshift/machine-api-operator/pull/1298)
* [CORS-3648](https://issues.redhat.com/browse/CORS-3648): Add the hyperdisk-balanced disk type [#1279](https://github.com/openshift/machine-api-operator/pull/1279)
* [CFE-1051](https://issues.redhat.com/browse/CFE-1051): Adding web-hook validation for capacityReservationGroupID [#1263](https://github.com/openshift/machine-api-operator/pull/1263)
* [Full changelog](https://github.com/openshift/machine-api-operator/compare/49a82ff09217fcef6c3c51d0a0e34582b5355c98...0967219612b43f35342c162f5b92733f946bd9be)


### [machine-config-operator](https://github.com/openshift/machine-config-operator/tree/4bb3364914c4dbcdfcc08b0914f402cdd38f014f)

* [OCPBUGS-44337](https://issues.redhat.com/browse/OCPBUGS-44337): Removal of additionalTrustBundle CA does not remove certificate from node backport [#4688](https://github.com/openshift/machine-config-operator/pull/4688)
* [MCO-1342](https://issues.redhat.com/browse/MCO-1342): Backport Telemetry to 4.16 [#4649](https://github.com/openshift/machine-config-operator/pull/4649)
* [OCPBUGS-44043](https://issues.redhat.com/browse/OCPBUGS-44043): Disable ESP offload for OVS attached interfaces [#4676](https://github.com/openshift/machine-config-operator/pull/4676)
* [OCPBUGS-42109](https://issues.redhat.com/browse/OCPBUGS-42109): Do not use 'restart' for 'oneshot' service [#4616](https://github.com/openshift/machine-config-operator/pull/4616)
* [OCPBUGS-42744](https://issues.redhat.com/browse/OCPBUGS-42744): Check for kernel arg diff in updateOnClusterBuild [#4628](https://github.com/openshift/machine-config-operator/pull/4628)
* [OCPBUGS-42722](https://issues.redhat.com/browse/OCPBUGS-42722): Panic seen in CI job for MCC pod [#4626](https://github.com/openshift/machine-config-operator/pull/4626)
* [OCPBUGS-42719](https://issues.redhat.com/browse/OCPBUGS-42719): MCPs report wrong number of nodes when we move nodes from one custom MCP to another custom MCP [#4625](https://github.com/openshift/machine-config-operator/pull/4625)
* [OCPBUGS-41293](https://issues.redhat.com/browse/OCPBUGS-41293): Enable the use of Linux Bridge as the ovs default port connection [#4563](https://github.com/openshift/machine-config-operator/pull/4563)
* [OCPBUGS-41256](https://issues.redhat.com/browse/OCPBUGS-41256): Set ESP offloads off in bonds if slaves don't support them [#4627](https://github.com/openshift/machine-config-operator/pull/4627)
* [OCPBUGS-41806](https://issues.redhat.com/browse/OCPBUGS-41806): When newly built images rolled out, the update progress is not displaying correctly (went 0 --&gt; 3) [#4584](https://github.com/openshift/machine-config-operator/pull/4584)
* [OCPBUGS-41518](https://issues.redhat.com/browse/OCPBUGS-41518): CVE-2024-3727 ose-machine-config-operator-container: containers/image: digest type does not guarantee valid type [#4569](https://github.com/openshift/machine-config-operator/pull/4569)
* [OCPBUGS-38997](https://issues.redhat.com/browse/OCPBUGS-38997): Machine-config daemon ListPools panic during tech-preview CI runs [#4550](https://github.com/openshift/machine-config-operator/pull/4550)
* [OCPBUGS-38711](https://issues.redhat.com/browse/OCPBUGS-38711): SCC-pinning for openshift workloads [#4539](https://github.com/openshift/machine-config-operator/pull/4539)
* [OCPBUGS-36850](https://issues.redhat.com/browse/OCPBUGS-36850): Port number 22623 exposing weak ciphers to external client from master node IP [#4556](https://github.com/openshift/machine-config-operator/pull/4556)
* [OCPBUGS-38373](https://issues.redhat.com/browse/OCPBUGS-38373): Revert "MCD-pull: run after network-online.target in Azure" [#4528](https://github.com/openshift/machine-config-operator/pull/4528)
* [OCPBUGS-36171](https://issues.redhat.com/browse/OCPBUGS-36171), [OCPBUGS-36172](https://issues.redhat.com/browse/OCPBUGS-36172): fix secret canonicalization [#4432](https://github.com/openshift/machine-config-operator/pull/4432)
* [OCPBUGS-37759](https://issues.redhat.com/browse/OCPBUGS-37759): Guard MachineOSBuild & MachineOSConfig informers with feature gates [#4505](https://github.com/openshift/machine-config-operator/pull/4505)
* [OCPBUGS-37550](https://issues.redhat.com/browse/OCPBUGS-37550): On-Prem resolv prepender to watch for NM changes [#4498](https://github.com/openshift/machine-config-operator/pull/4498)
* [OCPBUGS-37485](https://issues.redhat.com/browse/OCPBUGS-37485): kubelet: boot without PSI for performance concerns [#4486](https://github.com/openshift/machine-config-operator/pull/4486)
* [OCPBUGS-37840](https://issues.redhat.com/browse/OCPBUGS-37840): [release-4.16] Introduce versioning for Auto Node Sizing feature [#4382](https://github.com/openshift/machine-config-operator/pull/4382)
* [OCPBUGS-35891](https://issues.redhat.com/browse/OCPBUGS-35891): Make logging configurable for on-prem components [#4418](https://github.com/openshift/machine-config-operator/pull/4418)
* [OCPBUGS-37470](https://issues.redhat.com/browse/OCPBUGS-37470): Nodes are drained twice when an OCB image is applied [#4484](https://github.com/openshift/machine-config-operator/pull/4484)
* [OCPBUGS-37460](https://issues.redhat.com/browse/OCPBUGS-37460): Openshift uncordoned compute-node that was intentionally cordoned [#4483](https://github.com/openshift/machine-config-operator/pull/4483)
* [OCPBUGS-37428](https://issues.redhat.com/browse/OCPBUGS-37428): Machine-config operator should not hot loop generating ValidatingAdmissionPolicyUpdated events [#4482](https://github.com/openshift/machine-config-operator/pull/4482)
* [OCPBUGS-36775](https://issues.redhat.com/browse/OCPBUGS-36775): templates: run disable-mglru conditionally [#4462](https://github.com/openshift/machine-config-operator/pull/4462)
* [OCPBUGS-36330](https://issues.redhat.com/browse/OCPBUGS-36330): daemon: Handle correctly OS Version for 4.1 and 4.2 bootimages [#4445](https://github.com/openshift/machine-config-operator/pull/4445)
* [OCPBUGS-36536](https://issues.redhat.com/browse/OCPBUGS-36536): MCD-pull: run after network-online.target in Azure [#4453](https://github.com/openshift/machine-config-operator/pull/4453)
* [OCPBUGS-35929](https://issues.redhat.com/browse/OCPBUGS-35929): The MCD can override a restart crio action with a reload crio action [#4420](https://github.com/openshift/machine-config-operator/pull/4420)
* [OCPBUGS-36165](https://issues.redhat.com/browse/OCPBUGS-36165), [OCPBUGS-36166](https://issues.redhat.com/browse/OCPBUGS-36166): CurrentImagePullSecret should be consumed by the MCD [#4430](https://github.com/openshift/machine-config-operator/pull/4430)
* [OCPBUGS-35753](https://issues.redhat.com/browse/OCPBUGS-35753): Fix reference to $host_file [#4413](https://github.com/openshift/machine-config-operator/pull/4413)
* [OCPBUGS-36198](https://issues.redhat.com/browse/OCPBUGS-36198): daemon/update: disable systemd unit before overwriting [#4436](https://github.com/openshift/machine-config-operator/pull/4436)
* [OCPBUGS-35806](https://issues.redhat.com/browse/OCPBUGS-35806): Revert "Azure: add Azure specific dnsmasq ordering" [#4414](https://github.com/openshift/machine-config-operator/pull/4414)
* [Full changelog](https://github.com/openshift/machine-config-operator/compare/9e4a1f5f4c7ef58082021ca40556c67f99062d0a...4bb3364914c4dbcdfcc08b0914f402cdd38f014f)


### [monitoring-plugin](https://github.com/openshift/monitoring-plugin/tree/442ccd10ad05a04f510932082cd5a791d66a997e)

* [OCPBUGS-43239](https://issues.redhat.com/browse/OCPBUGS-43239): upgrade dynamic plugin sdk to remove vulnerable dependencies 4.16 [#217](https://github.com/openshift/monitoring-plugin/pull/217)
* [OCPBUGS-42424](https://issues.redhat.com/browse/OCPBUGS-42424): fix path-to-regexp dependency [#197](https://github.com/openshift/monitoring-plugin/pull/197)
* NO-JIRA: Use rhel9 base image in Dockerfile [#122](https://github.com/openshift/monitoring-plugin/pull/122)
* [Full changelog](https://github.com/openshift/monitoring-plugin/compare/f1fc4315bffa538d0a18e581866093a004db460b...442ccd10ad05a04f510932082cd5a791d66a997e)


### [multus-admission-controller](https://github.com/openshift/multus-admission-controller/tree/88c596ed782cf6c3f94efa286b3568d12acde436)

* [OCPBUGS-36341](https://issues.redhat.com/browse/OCPBUGS-36341): Update owners [#87](https://github.com/openshift/multus-admission-controller/pull/87)
* [Full changelog](https://github.com/openshift/multus-admission-controller/compare/2591682f2d409eea29cced23bf355ca8f27fcec8...88c596ed782cf6c3f94efa286b3568d12acde436)


### [multus-networkpolicy](https://github.com/openshift/multus-networkpolicy/tree/f988f894ded7e6645a1b3cc0d6090601809d4e7c)

* Update owners (#57) [#57](https://github.com/openshift/multus-networkpolicy/pull/57)
* [Full changelog](https://github.com/openshift/multus-networkpolicy/compare/c9a6ba24e92dad55e00fc17815a3e9988ee14d2d...f988f894ded7e6645a1b3cc0d6090601809d4e7c)


### [multus-route-override-cni](https://github.com/openshift/route-override-cni/tree/73594f7759e76600c95601138ab5be4969978f63)

* [OCPBUGS-37726](https://issues.redhat.com/browse/OCPBUGS-37726): Update owners [#58](https://github.com/openshift/route-override-cni/pull/58)
* [Full changelog](https://github.com/openshift/route-override-cni/compare/6a04feea1b1ab85914d9793a3bb8502c54bef172...73594f7759e76600c95601138ab5be4969978f63)


### [multus-whereabouts-ipam-cni](https://github.com/openshift/whereabouts-cni/tree/dab1dd29b18521916c18a278faa734f038eccdf1)

* [OCPBUGS-37707](https://issues.redhat.com/browse/OCPBUGS-37707), [OCPBUGS-37708](https://issues.redhat.com/browse/OCPBUGS-37708): [release-4.16] align api calls timeout and skip pods marked for deletion [#304](https://github.com/openshift/whereabouts-cni/pull/304)
* [OCPBUGS-37723](https://issues.redhat.com/browse/OCPBUGS-37723): Update owners [#294](https://github.com/openshift/whereabouts-cni/pull/294)
* [OCPBUGS-35923](https://issues.redhat.com/browse/OCPBUGS-35923): [release-4.16] Return previous IP allocation for add cmd [#293](https://github.com/openshift/whereabouts-cni/pull/293)
* [Full changelog](https://github.com/openshift/whereabouts-cni/compare/c2d65d1fc7b414bf8c823b2b9f90d6cb3371d975...dab1dd29b18521916c18a278faa734f038eccdf1)


### [must-gather](https://github.com/openshift/must-gather/tree/a30f939e9fec211253eaf1c91d4b5c7401f300a4)

* [OCPBUGS-43056](https://issues.redhat.com/browse/OCPBUGS-43056): Open [Release-4.16] Multus is now a Pod and will be captured by normal [#449](https://github.com/openshift/must-gather/pull/449)
* [OCPBUGS-35357](https://issues.redhat.com/browse/OCPBUGS-35357): Run ppc node collection in parallel [#426](https://github.com/openshift/must-gather/pull/426)
* [Full changelog](https://github.com/openshift/must-gather/compare/7d5f789407c53600f6bd4013ab35727ae09e719e...a30f939e9fec211253eaf1c91d4b5c7401f300a4)


### [network-metrics-daemon](https://github.com/openshift/network-metrics-daemon/tree/48059263880572c52fb8b21f1441370100dc167a)

* Correct 4.16 owners file (#98) [#98](https://github.com/openshift/network-metrics-daemon/pull/98)
* [Full changelog](https://github.com/openshift/network-metrics-daemon/compare/710bd872934572584eff4987eb638764afd04cdb...48059263880572c52fb8b21f1441370100dc167a)


### [oc-mirror](https://github.com/openshift/oc-mirror/tree/819f0115e4be3f55ed7d4edae1c38035811771ae)

* [OCPBUGS-38035](https://issues.redhat.com/browse/OCPBUGS-38035): Rebuild catalogs -- without cache generation (#905) [#905](https://github.com/openshift/oc-mirror/pull/905)
* [OCPBUGS-36410](https://issues.redhat.com/browse/OCPBUGS-36410): fix: creates tags for release images (#901) [#901](https://github.com/openshift/oc-mirror/pull/901)
* [OCPBUGS-37055](https://issues.redhat.com/browse/OCPBUGS-37055): Use proxy for HTTP request release signatures (#893) [#893](https://github.com/openshift/oc-mirror/pull/893)
* [OCPBUGS-37040](https://issues.redhat.com/browse/OCPBUGS-37040): use current working-dir for fetching release content for disk to mirror (#892) [#892](https://github.com/openshift/oc-mirror/pull/892)
* [OCPBUGS-36498](https://issues.redhat.com/browse/OCPBUGS-36498): Fix to ensure invalid catalogs are skipped (#889) [#889](https://github.com/openshift/oc-mirror/pull/889)
* [OCPBUGS-362214](https://issues.redhat.com/browse/OCPBUGS-362214): Fix V2 DiskToMirror should not require internet access (#884) [#884](https://github.com/openshift/oc-mirror/pull/884)
* [OCPBUGS-35279](https://issues.redhat.com/browse/OCPBUGS-35279): Fix spelling error in delete console message (#881) [#881](https://github.com/openshift/oc-mirror/pull/881)
* [OCPBUGS-35409](https://issues.redhat.com/browse/OCPBUGS-35409): Implement fail safe / fail fast in workers (#879) [#879](https://github.com/openshift/oc-mirror/pull/879)
* [Full changelog](https://github.com/openshift/oc-mirror/compare/7c0889f4bd343ccaaba5f33b7b861db29b1e5e49...819f0115e4be3f55ed7d4edae1c38035811771ae)


### [openshift-apiserver](https://github.com/openshift/openshift-apiserver/tree/f09402cfac07d6e5040ac8b6f068703eba3c700f)

* [OCPBUGS-42724](https://issues.redhat.com/browse/OCPBUGS-42724): fail image import when both image and error are nil [#455](https://github.com/openshift/openshift-apiserver/pull/455)
* [Full changelog](https://github.com/openshift/openshift-apiserver/compare/6b5184128103eaad64d7b00f0d1de9b7c3597112...f09402cfac07d6e5040ac8b6f068703eba3c700f)


### [openshift-controller-manager](https://github.com/openshift/openshift-controller-manager/tree/05ca43957983cd8ea5a5890c5271d7cb228ecdd0)

* NO-JIRA: cleanup root and app OWNERS [#347](https://github.com/openshift/openshift-controller-manager/pull/347)
* [OCPBUGS-42420](https://issues.redhat.com/browse/OCPBUGS-42420): Continuous pull-secret updates / slow initialization on build01 (test platform infrastructure) [#343](https://github.com/openshift/openshift-controller-manager/pull/343)
* [OCPBUGS-39191](https://issues.redhat.com/browse/OCPBUGS-39191): replaces deprecated square/go-jose wtih go-jose/go-jose [#329](https://github.com/openshift/openshift-controller-manager/pull/329)
* [OCPBUGS-37526](https://issues.redhat.com/browse/OCPBUGS-37526): Race condition when deleting ServiceAccount [#324](https://github.com/openshift/openshift-controller-manager/pull/324)
* [OCPBUGS-36862](https://issues.redhat.com/browse/OCPBUGS-36862): 4.16 "Bad" reconciliation loops can cause unbounded dockercfg secret creation [#323](https://github.com/openshift/openshift-controller-manager/pull/323)
* [Full changelog](https://github.com/openshift/openshift-controller-manager/compare/1432fe0aa630ce83c0c3fd18c86e1fb9a47ae4cc...05ca43957983cd8ea5a5890c5271d7cb228ecdd0)


### [openstack-cinder-csi-driver-operator](https://github.com/openshift/openstack-cinder-csi-driver-operator/tree/85b52097dda6b8a5f64ceb662d477a9ae28c4ca7)

* [OCPBUGS-35730](https://issues.redhat.com/browse/OCPBUGS-35730): Add config map hooks [#174](https://github.com/openshift/openstack-cinder-csi-driver-operator/pull/174)
* [Full changelog](https://github.com/openshift/openstack-cinder-csi-driver-operator/compare/6eb4b8220a63a6f9fef9b3779aaf015247697713...85b52097dda6b8a5f64ceb662d477a9ae28c4ca7)


### [openstack-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-openstack/tree/10aa50e3b19a233c77f18fe6aa616e03874fa511)

* [OCPBUGS-34931](https://issues.redhat.com/browse/OCPBUGS-34931): rebase on release-0.10 (to fix trunks deletion) [#321](https://github.com/openshift/cluster-api-provider-openstack/pull/321)
* [OCPBUGS-37967](https://issues.redhat.com/browse/OCPBUGS-37967): rebase CAPO for 4.16 [#319](https://github.com/openshift/cluster-api-provider-openstack/pull/319)
* [Full changelog](https://github.com/openshift/cluster-api-provider-openstack/compare/be72b7545228d631178c49677b01905e92846441...10aa50e3b19a233c77f18fe6aa616e03874fa511)


### [openstack-machine-api-provider](https://github.com/openshift/machine-api-provider-openstack/tree/5ada1cbab3a9354488b1e74e85c36285302c3382)

* [OCPBUGS-34931](https://issues.redhat.com/browse/OCPBUGS-34931): bump CAPO to v0.9.2 [#124](https://github.com/openshift/machine-api-provider-openstack/pull/124)
* [Full changelog](https://github.com/openshift/machine-api-provider-openstack/compare/fb930638853b159a2e428e6200bd67a64a37295b...5ada1cbab3a9354488b1e74e85c36285302c3382)


### [operator-lifecycle-manager, operator-registry](https://github.com/openshift/operator-framework-olm/tree/c50e9ce2b292a188e99e72fc6dc59d1fb5e9e0cb)

* [OCPBUGS-41540](https://issues.redhat.com/browse/OCPBUGS-41540): [4.16] add optional schema migrations; default to olm.bundle.object instead of olm.csv.metadata (#1384) [#859](https://github.com/openshift/operator-framework-olm/pull/859)
* [OCPBUGS-41677](https://issues.redhat.com/browse/OCPBUGS-41677): [4.17] adds paginating lister for evaluating CRs' upgrade fitness versus new CRDs. [#863](https://github.com/openshift/operator-framework-olm/pull/863)
* [OCPBUGS-41557](https://issues.redhat.com/browse/OCPBUGS-41557): Fix e2e flake: upgrade CRD with deprecated version [#861](https://github.com/openshift/operator-framework-olm/pull/861)
* [OCPBUGS-41217](https://issues.redhat.com/browse/OCPBUGS-41217): (fix) registry pods do not come up again after node failure (#3366) [#854](https://github.com/openshift/operator-framework-olm/pull/854)
* [OCPBUGS-38290](https://issues.redhat.com/browse/OCPBUGS-38290): [release-4.16] (fix) Resolver: list CatSrc using client, instead of referring to registry-server cache [#838](https://github.com/openshift/operator-framework-olm/pull/838)
* [OCPBUGS-38129](https://issues.redhat.com/browse/OCPBUGS-38129): [release-4.16]  Update junit report file name to show spec results on Test Grid [#833](https://github.com/openshift/operator-framework-olm/pull/833)
* [OCPBUGS-37456](https://issues.redhat.com/browse/OCPBUGS-37456): Updating ose-operator-framework-tools-container image to be consistent with ART for 4.16 [#826](https://github.com/openshift/operator-framework-olm/pull/826)
* [OCPBUGS-37559](https://issues.redhat.com/browse/OCPBUGS-37559): [release-4.16] Update e2e config and backport list of flakes [#814](https://github.com/openshift/operator-framework-olm/pull/814)
* [OCPBUGS-37018](https://issues.redhat.com/browse/OCPBUGS-37018): Bump github.com/containers/image/v5 [#822](https://github.com/openshift/operator-framework-olm/pull/822)
* [OCPBUGS-36450](https://issues.redhat.com/browse/OCPBUGS-36450): Can't install operator on 4.15 after uninstalling it on a prior version [#809](https://github.com/openshift/operator-framework-olm/pull/809)
* [OCPBUGS-25019](https://issues.redhat.com/browse/OCPBUGS-25019): fix xplat compile for of-tools image; hide utest files from git; use rhel8 art builder image [#793](https://github.com/openshift/operator-framework-olm/pull/793)
* [OCPBUGS-36137](https://issues.redhat.com/browse/OCPBUGS-36137): fix sorting unpack jobs [#799](https://github.com/openshift/operator-framework-olm/pull/799)
* [OCPBUGS-34979](https://issues.redhat.com/browse/OCPBUGS-34979): Updates default security context behavior for catalog source pods [#788](https://github.com/openshift/operator-framework-olm/pull/788)
* [OCPBUGS-36138](https://issues.redhat.com/browse/OCPBUGS-36138): perform operator apiService certificate validity checks directly [#798](https://github.com/openshift/operator-framework-olm/pull/798)
* [OCPBUGS-35373](https://issues.redhat.com/browse/OCPBUGS-35373): [release-4.16] Warn and allow CRD upgrade if validation fails but webhook is specified [#781](https://github.com/openshift/operator-framework-olm/pull/781)
* [Full changelog](https://github.com/openshift/operator-framework-olm/compare/1aacee6a78ceac7acd5aa03647933e550d66a12c...c50e9ce2b292a188e99e72fc6dc59d1fb5e9e0cb)


### [ovn-kubernetes, ovn-kubernetes-microshift](https://github.com/openshift/ovn-kubernetes/tree/e88e6ab3e890917c718e570894cd6899d94debdf)

* [OCPBUGS-43344](https://issues.redhat.com/browse/OCPBUGS-43344): Add SDN node subnet gateway IP to host-network address_set [#2328](https://github.com/openshift/ovn-kubernetes/pull/2328)
* [OCPBUGS-42942](https://issues.redhat.com/browse/OCPBUGS-42942): Fix egress gateway pod cleanup for remote zone pods. [#2341](https://github.com/openshift/ovn-kubernetes/pull/2341)
* [OCPBUGS-36210](https://issues.redhat.com/browse/OCPBUGS-36210): Implementation required to enable Forwarding if it is already disabled [#2212](https://github.com/openshift/ovn-kubernetes/pull/2212)
* [OCPBUGS-41551](https://issues.redhat.com/browse/OCPBUGS-41551): Add subnet overlap check for transit switch subnet [#2306](https://github.com/openshift/ovn-kubernetes/pull/2306)
* [OCPBUGS-38697](https://issues.redhat.com/browse/OCPBUGS-38697): Use more exact name match when deleting static routes to HO nodes. [#2282](https://github.com/openshift/ovn-kubernetes/pull/2282)
* [OCPBUGS-24386](https://issues.redhat.com/browse/OCPBUGS-24386): [release-4.16] EgressService: Fix ETP=Local ingress reply for LGW [#2278](https://github.com/openshift/ovn-kubernetes/pull/2278)
* [OCPBUGS-38705](https://issues.redhat.com/browse/OCPBUGS-38705): Delete EgressIP LRP stale nexthops when node is not found [#2271](https://github.com/openshift/ovn-kubernetes/pull/2271)
* [OCPBUGS-38054](https://issues.redhat.com/browse/OCPBUGS-38054): Fix per-pod MCS/metadata blocking [#2248](https://github.com/openshift/ovn-kubernetes/pull/2248)
* [OCPBUGS-38699](https://issues.redhat.com/browse/OCPBUGS-38699), [OCPBUGS-38704](https://issues.redhat.com/browse/OCPBUGS-38704): EgressIP VRF support & ignore localnet patch ports when bootstrapping [#2267](https://github.com/openshift/ovn-kubernetes/pull/2267)
* [OCPBUGS-37939](https://issues.redhat.com/browse/OCPBUGS-37939): [release-4.16] Bump OVSDBTimeout and make it configurable. [#2244](https://github.com/openshift/ovn-kubernetes/pull/2244)
* [OCPBUGS-37362](https://issues.redhat.com/browse/OCPBUGS-37362): Fix registering northd metrics on appropriate nodes [#2232](https://github.com/openshift/ovn-kubernetes/pull/2232)
* [OCPBUGS-36608](https://issues.redhat.com/browse/OCPBUGS-36608): [release-4.16] ovspinning: Set affinity of each thread [#2220](https://github.com/openshift/ovn-kubernetes/pull/2220)
* [OCPBUGS-36486](https://issues.redhat.com/browse/OCPBUGS-36486): Fix race condition when creating/deleting namespace address set [#2218](https://github.com/openshift/ovn-kubernetes/pull/2218)
* [OCPBUGS-35061](https://issues.redhat.com/browse/OCPBUGS-35061): Allow ANPs at same priority [#2205](https://github.com/openshift/ovn-kubernetes/pull/2205)
* [Full changelog](https://github.com/openshift/ovn-kubernetes/compare/8a9743708ae117595226a52b4856f8c032fed2ab...e88e6ab3e890917c718e570894cd6899d94debdf)


### [powervs-block-csi-driver](https://github.com/openshift/ibm-powervs-block-csi-driver/tree/26162badb8422f36d9b52fac8467d48bf6078f5a)

* [OCPBUGS-36097](https://issues.redhat.com/browse/OCPBUGS-36097): Fix CVE-2024-6104 by updating http-retryable to 0.7.7 [#88](https://github.com/openshift/ibm-powervs-block-csi-driver/pull/88)
* [Full changelog](https://github.com/openshift/ibm-powervs-block-csi-driver/compare/730a473cf60d5de4d4543ea71ff5f3c6c1010980...26162badb8422f36d9b52fac8467d48bf6078f5a)


### [powervs-cloud-controller-manager](https://github.com/openshift/cloud-provider-powervs/tree/20e6dc70d665e5d085df17d757a07e17c0e18fe0)

* [OCPBUGS-36107](https://issues.redhat.com/browse/OCPBUGS-36107): UPSTREAM: &lt;carry&gt;: Fix go-retryablehttp CVE 4.16 [#73](https://github.com/openshift/cloud-provider-powervs/pull/73)
* [Full changelog](https://github.com/openshift/cloud-provider-powervs/compare/87386cd444b4b9fe745d0198ab959ccedb5e318a...20e6dc70d665e5d085df17d757a07e17c0e18fe0)


### [powervs-machine-controllers](https://github.com/openshift/machine-api-provider-powervs/tree/60ebedf061fe1bb5279650fd637108b13b92d95f)

* [OCPBUGS-41976](https://issues.redhat.com/browse/OCPBUGS-41976): Update go.mod to fix CVE - 4.16 [#84](https://github.com/openshift/machine-api-provider-powervs/pull/84)
* [Full changelog](https://github.com/openshift/machine-api-provider-powervs/compare/6b57e6c1bf0ee22bd0d51fde1249209c53da07d1...60ebedf061fe1bb5279650fd637108b13b92d95f)


### [prometheus](https://github.com/openshift/prometheus/tree/c5c08df947236f3917abf14de481eb2f99fb07de)

* [OCPBUGS-39179](https://issues.redhat.com/browse/OCPBUGS-39179): Restore Prometheus functionality to accept samples with different timestamps from the same series in a single scrape. [#224](https://github.com/openshift/prometheus/pull/224)
* [OCPBUGS-36918](https://issues.redhat.com/browse/OCPBUGS-36918): cherry-pick upstream fix to make PrometheusRemoteWriteBehind fire when remote endpoint is never reached. [#214](https://github.com/openshift/prometheus/pull/214)
* [OCPBUGS-37446](https://issues.redhat.com/browse/OCPBUGS-37446): backport of upstream fix [#217](https://github.com/openshift/prometheus/pull/217)
* [OCPBUGS-36854](https://issues.redhat.com/browse/OCPBUGS-36854): cherry-pick upstream remote-write fix [#212](https://github.com/openshift/prometheus/pull/212)
* [Full changelog](https://github.com/openshift/prometheus/compare/69e2ed89ac1e73cfa36ce792d8b045b2e7f3c649...c5c08df947236f3917abf14de481eb2f99fb07de)


### [prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook](https://github.com/openshift/prometheus-operator/tree/c7262a43c0ddf2adc6be3863ac9a5056cb89c177)

* [OCPBUGS-38399](https://issues.redhat.com/browse/OCPBUGS-38399): feat: sync proxy settings in Alertmanager configuration [#299](https://github.com/openshift/prometheus-operator/pull/299)
* [Full changelog](https://github.com/openshift/prometheus-operator/compare/8bf4750af765730dc423213516245c7b0679e352...c7262a43c0ddf2adc6be3863ac9a5056cb89c177)


### [telemeter](https://github.com/openshift/telemeter/tree/c1ecd1050c8f4ddb3380cf1bfb7230ae2e35052a)

* [OCPBUGS-31552](https://issues.redhat.com/browse/OCPBUGS-31552): fix issuer check during JWT authentication 4.16 [#537](https://github.com/openshift/telemeter/pull/537)
* [Full changelog](https://github.com/openshift/telemeter/compare/6ab43e488013b2383d594b3a8837e3800ce01c04...c1ecd1050c8f4ddb3380cf1bfb7230ae2e35052a)


### [tests](https://github.com/openshift/origin/tree/c740dbdf225dfeef7fa9470ae61da2507302116c)

* [OCPBUGS-44105](https://issues.redhat.com/browse/OCPBUGS-44105): Adjust createDNSPod() to support hypershift dual-stack test [#29258](https://github.com/openshift/origin/pull/29258)
* [OCPBUGS-39135](https://issues.redhat.com/browse/OCPBUGS-39135): Bump timeout for the pod-network-service endpoints check [#29052](https://github.com/openshift/origin/pull/29052)
* [OCPBUGS-41611](https://issues.redhat.com/browse/OCPBUGS-41611): Disable:Broken for [sig-builds][Feature:Builds][Slow] can use private repositories as build input build using an HTTP token should be able to clone source code via an HTTP token [apigroup:build.openshift.io] [#29079](https://github.com/openshift/origin/pull/29079)
* [OCPBUGS-38707](https://issues.redhat.com/browse/OCPBUGS-38707): run vsphere driver config test on non techpreview clusters [#28992](https://github.com/openshift/origin/pull/28992)
* [OCPBUGS-38788](https://issues.redhat.com/browse/OCPBUGS-38788): [4.16] egressfirewall: skip ping tests in case of hypershift kubevirt on Azure infra [#28938](https://github.com/openshift/origin/pull/28938)
* [OCPBUGS-38015](https://issues.redhat.com/browse/OCPBUGS-38015): vertical scaling test should not rely on CPMS replicas [#28981](https://github.com/openshift/origin/pull/28981)
* [OCPBUGS-37771](https://issues.redhat.com/browse/OCPBUGS-37771): fix pod not returning success on 'Managed cluster should verify that nodes have no unexpected reboots [#28959](https://github.com/openshift/origin/pull/28959)
* [OCPBUGS-36744](https://issues.redhat.com/browse/OCPBUGS-36744): Expand allowance for kubelet metrics api endpoint outages during node upgrades [#28928](https://github.com/openshift/origin/pull/28928)
* [OCPBUGS-36182](https://issues.redhat.com/browse/OCPBUGS-36182): Removes dependency on samples operator images [#28904](https://github.com/openshift/origin/pull/28904)
* [OCPBUGS-36241](https://issues.redhat.com/browse/OCPBUGS-36241): remove unused in-cluster monitoring code [#28909](https://github.com/openshift/origin/pull/28909)
* [OCPBUGS-35842](https://issues.redhat.com/browse/OCPBUGS-35842): add Proxy config [#28894](https://github.com/openshift/origin/pull/28894)
* [TRT-1721](https://issues.redhat.com/browse/TRT-1721): Add new intervals for kubelet metrics endpoints down [#28901](https://github.com/openshift/origin/pull/28901)
* [TRT-1720](https://issues.redhat.com/browse/TRT-1720): Filter must-gather and truncate system node users [#28883](https://github.com/openshift/origin/pull/28883)
* [ETCD-578](https://issues.redhat.com/browse/ETCD-578): remove Tech Preview check from etcd profiles e2e test [#28819](https://github.com/openshift/origin/pull/28819)
* [OCPBUGS-35755](https://issues.redhat.com/browse/OCPBUGS-35755): Fix etcd profiles e2e test to check returned status for updated values [#28885](https://github.com/openshift/origin/pull/28885)
* bump 4.16 to latest o/k 4.16 release branch [#28888](https://github.com/openshift/origin/pull/28888)
* [Full changelog](https://github.com/openshift/origin/compare/3bb691e0fe54cd503f884a80e9211e318a7d8090...c740dbdf225dfeef7fa9470ae61da2507302116c)


### [vsphere-cloud-controller-manager](https://github.com/openshift/cloud-provider-vsphere/tree/44ea2b5825a5e200e12cb36f901393e97cbbf243)

* [OCPBUGS-37660](https://issues.redhat.com/browse/OCPBUGS-37660): Bump otelgrpc to v0.53.0 [#72](https://github.com/openshift/cloud-provider-vsphere/pull/72)
* [Full changelog](https://github.com/openshift/cloud-provider-vsphere/compare/8777b9a5ec4b34cefab7708987731a1fd224a739...44ea2b5825a5e200e12cb36f901393e97cbbf243)


### [vsphere-csi-driver, vsphere-csi-driver-syncer](https://github.com/openshift/vmware-vsphere-csi-driver/tree/03b7e8ebf2c6347b40a340d892e1a66d47806300)

* [OCPBUGS-43881](https://issues.redhat.com/browse/OCPBUGS-43881): redact sensitive information when logging VCenter config [#134](https://github.com/openshift/vmware-vsphere-csi-driver/pull/134)
* [OCPBUGS-42878](https://issues.redhat.com/browse/OCPBUGS-42878): Add compute resource entity to consider a standalone cluster for volu… [#131](https://github.com/openshift/vmware-vsphere-csi-driver/pull/131)
* [Full changelog](https://github.com/openshift/vmware-vsphere-csi-driver/compare/3cd689f3f1ff59467885ee8ef42997eef5f81972...03b7e8ebf2c6347b40a340d892e1a66d47806300)


### [vsphere-problem-detector](https://github.com/openshift/vsphere-problem-detector/tree/3683c120278fb79a30340f66d22948aaddf3c16a)

* [OCPBUGS-37735](https://issues.redhat.com/browse/OCPBUGS-37735): Drop event when CheckDefaultDatastore fails [#168](https://github.com/openshift/vsphere-problem-detector/pull/168)
* [OCPBUGS-35446](https://issues.redhat.com/browse/OCPBUGS-35446): Fix missing failure-domains [#160](https://github.com/openshift/vsphere-problem-detector/pull/160)
* [Full changelog](https://github.com/openshift/vsphere-problem-detector/compare/d674e6d8b4b814b1544e7d2fc9177e5e0f90484b...3683c120278fb79a30340f66d22948aaddf3c16a)