4.16.36

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.16.36-x86_64

Team Approvals:

Tests:

Blocking jobs
- upgrade Failed release-openshift-origin-installer-e2e-aws-upgrade
- upgrade-minor Succeeded release-openshift-origin-installer-e2e-aws-upgrade
Informing jobs
- aws-ovn-serial Succeeded periodic-ci-openshift-release-master-nightly-4.16-e2e-aws-ovn-serial
- aws-ovn-upgrade-micro Succeeded periodic-ci-openshift-release-master-ci-4.16-e2e-aws-ovn-upgrade
- aws-sdn-upgrade-4.16-micro Succeeded periodic-ci-openshift-release-master-nightly-4.16-e2e-aws-sdn-upgrade
- azure-ovn-upgrade-4.16-micro Succeeded (1 retries) periodic-ci-openshift-release-master-ci-4.16-e2e-azure-ovn-upgrade
- fips-scan Succeeded periodic-ci-openshift-release-master-nightly-4.16-fips-payload-scan
- gcp-ovn-rt-upgrade-4.16-minor Succeeded (1 retries) periodic-ci-openshift-release-master-ci-4.16-upgrade-from-stable-4.15-e2e-gcp-ovn-rt-upgrade
- hypershift-ovn-conformance-4.16 Succeeded periodic-ci-openshift-hypershift-release-4.16-periodics-e2e-aws-ovn-conformance
- metal-ipi-ovn-bm Succeeded periodic-ci-openshift-release-master-nightly-4.16-e2e-metal-ipi-ovn-bm
- metal-ipi-ovn-ipv6 Succeeded periodic-ci-openshift-release-master-nightly-4.16-e2e-metal-ipi-ovn-ipv6

Upgrades from:

Untested upgrades: 4.15.21, 4.15.22, 4.15.23, 4.15.24, 4.15.25, 4.15.26, 4.15.27, 4.15.28, 4.15.29, 4.15.31, 4.15.32, 4.15.33, 4.15.34, 4.15.35, 4.15.36, 4.15.37, 4.15.38, 4.15.39, 4.15.42, 4.15.43, 4.16.10, 4.16.11, 4.16.12, 4.16.13, 4.16.14, 4.16.15, 4.16.16, 4.16.17, 4.16.18, 4.16.19, 4.16.20, 4.16.21, 4.16.23, 4.16.24, 4.16.25, 4.16.26, 4.16.28, 4.16.29, 4.16.3, 4.16.30, 4.16.32, 4.16.4, 4.16.6, 4.16.8, 4.16.9

4.16.35 (changes) - S F S S F F
4.16.34 (changes) - Success
4.16.33 (changes) - Failed
4.16.27 (changes) - Success
4.16.7 - Failed
4.16.5 (changes) - Failed
4.16.2 (changes) - Failed
4.16.1 (changes) - Success
4.16.0 (changes) - Success
4.15.46 (changes) - Failed
4.15.45 (changes) - Success Success
4.15.44 (changes) - Success
4.15.41 (changes) - Failed
4.15.40 (changes) - Success
4.15.30 (changes) - Success
4.15.20 (changes) - Failed
4.15.19 (changes) - Success
4.15.18 (changes) - Success
4.15.0-0.nightly-2025-02-20-001209 (changes) - Failed Success

Upgrades to:

4.17.18 (changes) - Success

Loading changelog, this may take a while ...

Changes from 4.16.7

Created: 2025-02-20 09:24:57 +0000 UTC

Image Digest: sha256:efab0026a48c418ff01754238aea813e24097f65ff75962147cef78d785f06f4

Components

Kubectl 1.29.7
Kubernetes upgraded from 1.29.7 to 1.29.11
Kubernetes Tests 1.29.0
Red Hat Enterprise Linux CoreOS upgraded from 416.94.202408062045-0 to 416.94.202502180249-0 (diff)

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
ExternalRouteCertificate (0 tests)	Unconditional (Changed)	Unconditional (Changed)	Unconditional (Changed)	Unconditional (Changed)	Unconditional (Changed)	Unconditional (Changed)

Rebuilt images without code change

agent-installer-utils git 6e6bb40d sha256:4ed7449c7c0a7017a30f2a0f40598b82700193c74dcac237aea34b99f9d9692c
alibaba-cloud-controller-manager git 97e8335e sha256:a041df8f10d682c7fb322e67ed6ed7f0d188231539f7879da0372b345a60a385
aws-cloud-controller-manager git a53e9def sha256:3c48f5f420347d1168ca5cdce200a3189f0a292151e4d80188d00fe485053211
aws-ebs-csi-driver git 1d29a74a sha256:0752d700acd38ef0a00b10475b71eee02283de3260192f0a27faa2420e669a77
aws-ebs-csi-driver-operator git ff69cd03 sha256:85098f666e1704bb044ab7cde3978fbd710f83aac066c1f219899e65cb304b4d
aws-pod-identity-webhook git 746491a6 sha256:006d246c5397f1f27924231f7587e03d1d5152328676527a493cede1478e81dc
azure-cluster-api-controllers git a81e3b31 sha256:0bb5f600886cf608a7e236b7431082562684b6865ad248f7c059f8576204d164
azure-disk-csi-driver git 6b55f6fb sha256:c56028b597a9b3d4dbf5a311e3775d75d55275b4af5db48bc544292547db53ec
azure-disk-csi-driver-operator git ff69cd03 sha256:df4a01ff005bf5228629dc48821dcb85e8e340f616dc46600660bf84b60b3fc8
azure-file-csi-driver-operator git ff69cd03 sha256:9f2df3fb2f520efc4ccf0ae7c6b382b2a3e44c02faebb4447dde8bd6328361c4
azure-machine-controllers git e4e11505 sha256:a550d220e7729bb8f095f0cab0045ee25acd2132940c8a5d26a749e6ff782207
azure-workload-identity-webhook git 4aca092a sha256:26f9a9aed5970fc684e12379c6bfc6abc3a20c070685daf10894ab461bec609d
baremetal-runtimecfg git f55a330f sha256:17cd9a100abe1cb91a73faff10efefbd72b3cdd15320435b67cc8c205c4005fa
cloud-network-config-controller git 8ceee788 sha256:c28d2e85d25b573ded0fa673ead1cac984a540d8ff3f628bfd892191489ec5d6
cluster-autoscaler-operator git 40cadf8a sha256:92fdf728f34993cc295b540ba5867b00933576d9024ea5d51e3a6806a1dcbe2b
cluster-bootstrap git 27bfb59f sha256:7a2f03d1b0802d1b62071f5867e49b70badb15b073f367d4db5f9091e91f587a
cluster-capi-controllers git 5830a10a sha256:95a4bcf3f40498c9e09488e7afe437ccd23d9eea5dd1c01a68df5fcb50748407
cluster-config-operator git 441d29c9 sha256:cc961fc2d5c85b8364b9058c09dddce7c785cfa4ebcef880e2e374042f896447
cluster-csi-snapshot-controller-operator git 439826e1 sha256:50747e0b555e36ebdedd783af5c415ccc96e37f8f3e311b0506e6ac93d7949e6
cluster-dns-operator git 8ddf28f9 sha256:13340a54e726674f1e7a030b9cba81f651245cb57f46b62777ae2f6a75aea0b8
cluster-kube-cluster-api-operator git 95ceaa9e sha256:fb5d4416426644416d6d7b51619ba00ce7f726abdcb4a18d02faa34937175777
cluster-kube-controller-manager-operator git 0338b3be sha256:82a621248a99722b0ec8f463685b1432e82260abeadaecbd4d4a3b39a7bd6472
cluster-kube-scheduler-operator git 630f63bc sha256:f463fedf73e74262feb8863a42817203f3c94ad512bd414d1729369a4050f620
cluster-olm-operator git 27bf70dd sha256:5d6986b21c44d6c02d1b37166eafd4f0262ec9d20ee2a2ca965a957e355399de
cluster-openshift-apiserver-operator git d26f3002 sha256:55db5b5dc926b7a498e55fd0d7ae7fa9f77937e7727d93887bbda218a1da35b6
cluster-policy-controller git eaea543f sha256:34412c7e9562cf70d58021ac4d4a1b2bd11f12a7235dee3e6c3464714acfcd46
configmap-reloader git dc91ddc4 sha256:d3f6c0947c495f8857e0bf09aea353a969404637e8108811773a3c2a2d12009d
container-networking-plugins git 73b4123c sha256:cde7125fdbf99d1141fe759ff239698845d08bdc2b7def7c06b8d11fdad99b46
containernetworking-plugins-microshift git 73b4123c sha256:dc35be075f6242f4b9fe6d59562ec155c721e6243bf7f92b67817d815161d6bf
coredns git 1e417656 sha256:8efd0d130e90b1e1b4129fef0a31ea041db64a0d069f0871bd13b61fdf954d6f
csi-driver-nfs git 406cec72 sha256:7cc86af5b24dc9ec2d21179a09f7071b2ab2a8ca7ab8180ec94f5c972c892f13
csi-driver-shared-resource git bc125def sha256:2051f12d187a5b4092a142f996776ce54a990e0c4b47ee137ea5fd7246253f05
csi-driver-shared-resource-operator git 1e1194bc sha256:3c7d06a483fa3662dc4f3c2556cd67ddf814319568ade03ea5bd4dd81dcffb10
csi-driver-shared-resource-webhook git bc125def sha256:2af201e379a78b25893bb5ed0dc1eb082d4139b82d0fa6a15ff6cc5d0c13e90a
csi-external-attacher git 7da80aab sha256:402bac8ceea313afe919ad891d76ecc22913a1ba0479691f44f96e42304bd8a1
csi-external-provisioner git 9e8af011 sha256:b2540942d68ea56bf091b34507954e3d48052187f1087ddaa7a02f76ab7f07de
csi-external-resizer git bdf5bfb4 sha256:835ae8fb6d7394a305f420cf7f2d7a5583a175dfabbcb55bafb373d1a8c469dd
csi-external-snapshotter git 5315d37a sha256:8ecc039b81c3fece88fb1d807a4e65318caf7537282ff2a04c6d06c5549f900f
csi-livenessprobe git f5e3ff55 sha256:38602f093767e92e2aca7a6ffc112d0e83b4d8568ffdfe96492d50d1b9ea27ce
csi-node-driver-registrar git 8930c368 sha256:ad50ee8b80dcefe779631e2e75bb7ee12cd4fdcab2671de382841d09e5494264
csi-snapshot-controller git 5315d37a sha256:cd05b698ace037f655e5de776007bf7f08f4e5a11d8235a8e661366910e9f9fa
csi-snapshot-validation-webhook git 5315d37a sha256:e2a12364333193c11a7d570f4369a42983280d8fcaabb8b595681137362c050e
driver-toolkit git 1d5732f0 sha256:68d999a23cf53b37bb241892163d2a66b54794ad5ae62f069048f7e0b98c0d29
egress-router-cni git 7089efe6 sha256:dd700e6ceb5f505130eb71cb36de0c2044b36e454ae119c61bc8bfec266ab42c
gcp-cloud-controller-manager git 26b43dfc sha256:7eb54b1a0bc5c139b465afd93c0f227b59d065b714791afe7d5ba82be418fa06
gcp-cluster-api-controllers git 02432df8 sha256:6f9e38b99d21794932337885e5ef11d4eb097419a1dfa50c115f9e83bd982fa3
gcp-pd-csi-driver git 5ed71c64 sha256:5f7bcd41c4358c9d43caa83952ff3bb359ae3cb81b8e882863cb494fa8fce82a
gcp-pd-csi-driver-operator git 799327f7 sha256:52925271daa941a6ac525ecfb65cbb2732a0eb902fcdae9e72c978235d4a4ee8
haproxy-router git 4d9b8c4a sha256:c8974ce7f78a364ad317bdc291821a12647aa4469103c8f0baacc149d8a9143a
ibm-cloud-controller-manager git f961f16d sha256:e19c200e65f170a566de0bf87d50c5d1cfb5892cc8001d9b0147a6c8117b5d43
ibm-vpc-block-csi-driver git 95719738 sha256:588268910845dd729e3c1e01a0506370f1086656dac54e0abb0e0118642ae352
ironic-machine-os-downloader git 93b8b5fa sha256:32e606592e58ab08b8f88b9f9de83de9dbc1f489029fde3f10d631d1e00f3391
k8s-prometheus-adapter git e4f859be sha256:6cf879098c6d768c88f1cbeb6eb418b0bb5c25a15d415e30f5c3da1051466b9c
keepalived-ipfailover git b58673a3 sha256:54d481f826bb4efc0e4ae05dc9a36ab69187e11ce9166a5c95a39f28dbaac1d3
kube-state-metrics git 9b67b8d1 sha256:5e6299149ec1ad517e53ab221be3bc0ecf9b016b3e757fdac64821264630dd2d
kube-storage-version-migrator git 969a60e9 sha256:d8c326ad0d07ccc0a466d04026c12dfd058067880518df745d27c3d517af09e8
kubevirt-cloud-controller-manager git 3db76104 sha256:df83fb34b148caae9755a0aaf82b18aae0d34fd9be13020a9712e050119dae3b
kubevirt-csi-driver git 0693093f sha256:60e3184fa80e2a3159ac23698a61befe2a4a89431b3945b9596345323e07f2c7
libvirt-machine-controllers git a336f0b5 sha256:84ca218eb6973bb2535ef59a031a9c98bf73fa907d5459aed003e591766e83f6
machine-image-customization-controller git 39480963 sha256:ffba4e390245bc7f0618d3e21f5245ddf50352f649bcc2a5943edc58bec795b4
machine-os-images git 3cc97098 sha256:51a4397f8eef64c52e7c488fd2ce62570f8e5f8e71c272fbba14ac5bb95ea40c
multus-admission-controller git 88c596ed sha256:30cbf8eda5c3471562280e72c181c2baeed1f7c2ec04e69acacf01c0f2d415bf
multus-cni git c4aa21b9 sha256:88fc190e4d13ca2f68724c8f6174f6061c298d3eb272b82dc8e5f3cbf1f72852
multus-cni-microshift git c4aa21b9 sha256:7f4f2aa390ce79add0685d692ad8cad427df170a7a9368f9cf269e2782f340cf
multus-networkpolicy git f988f894 sha256:b04883e4e7d5983f097579cae205d2a4329fa3b9ec0c6697c5770ec5255c8838
multus-route-override-cni git 73594f77 sha256:32b8042a81c58017480f68f2bb81c823082ebf8895608de30d49528c5e52647d
multus-whereabouts-ipam-cni git dab1dd29 sha256:1a0d890240cc09ecdd6aa3001a7ee11150ad5423a0266ff66e5c400d84402367
network-interface-bond-cni git bb911451 sha256:e62f6ff40b42f2e04f1fa8802068febff525d167e4d86b856985ccf25f41bb91
network-metrics-daemon git 48059263 sha256:d6e738c1af173e44e00a5eb5c5fcd6cd224b29a1f972c748cb1750ade30bb545
network-tools git 39eca100 sha256:b00689cc0254e1c69f1c6b99e2cfb9289f568d16512308a8fa1a2a7dd78a83c5
nutanix-machine-controllers git f053e5a0 sha256:ffe36265fdbc3ccccb9528849ea801705766968a2b08bed9fe35ed6265ae6a8f
oauth-proxy git 30f80124 sha256:4e1a9affce52904c5d34c29928c2131e6c0391328ed072dbe44396278cc38993
oauth-server git 3739138c sha256:7c2cbd91675bdaec218009af8d2524c23067812ee95fec2f0b41a609e5395808
olm-catalogd git 79975a51 sha256:cd79aacd4d70415d24ed956d4b4be61485984e12e1a883a4c7ccbf3dbbcd0a98
olm-operator-controller git 80b8649c sha256:a6677e3d99812013eec7165a42324884c264bad658b53cd1e55f037e2f63b97a
olm-rukpak git 282cc84c sha256:830ca5dd0fb9926e081137750103aae2225ad4ef70d724dc0dd709622f0c9c7c
openshift-state-metrics git 59b8a0ff sha256:c20dfd15d3c8683fedcf17f1b65e06e08363d98108563e9f5a10b0c183b8ec81
openstack-cinder-csi-driver-operator git 85b52097 sha256:7336b54dcb320f2c0364248aa392bbcc81e8b90fd01d89696bc70a041810b93a
ovirt-csi-driver git 1db726a9 sha256:eb64c7fb1414ed914877c447b96ccc1696246fa838ac9597c44865f85d2d8dae
ovirt-csi-driver-operator git ac852f3e sha256:5768d44043020cd7413008af299152516812dabc1d627feb2f0e4ba549efbd4a
ovirt-machine-controllers git abb91c84 sha256:86583a3373d5dd04a3dbf5ca8349622119054f6385ab5ff2f2563fb212c6fec0
powervs-block-csi-driver git 26162bad sha256:cce91181ba4032b74d24c2207405bd47b8f23fba9bf6707e34f5c498ac264597
powervs-block-csi-driver-operator git 9c5dd8d1 sha256:ba293146a0c88b0eb44129c45a2fd15eca5f8a904cec85848c2b4aef89e8c7ca
powervs-cloud-controller-manager git 20e6dc70 sha256:dc4104bb09a0033c2018e97e39bc3dc3de194316cd3d3400e4289869cf7d99ff
prom-label-proxy git 5e14722e sha256:ce45da13cd9913bc07866124d24121376c0266bd7bc0134c5be1afcc90307410
prometheus-alertmanager git e9aea929 sha256:46a81961e78f3581759930b6fe7597571ec050a64f9c0408431425cf6c865aa6
prometheus-node-exporter git 29ba26d1 sha256:df5b0b9757b62be908c0a34828f04d0fd771ef41b2be749dfea6132532b08a96
rhel-coreos sha256:273974ced3174c23c9af13bd7f7ed7a155053aa9eed67e79b994f78cdc51f7f3
rhel-coreos-extensions sha256:b1b4c31822edf06412e5af7f17d92adaaa052db316913d82df0631c86149e9f1
route-controller-manager git 3112b458 sha256:a82c248b9690e3f0b76c30c6b79cf109d9cbe45dcb3db08b2961f7f3ce016330
service-ca-operator git 538c7b98 sha256:3fd02bd1c484051adf96b039379b86ee895c9131338bce04d1e61d27424eb9ea
telemeter git c1ecd105 sha256:67efca9af9246582488c0cc6e3b45d76c6e24c50c908aa249844cf5aebf1d8b2
thanos git 85eee25c sha256:f66d315729aaed57fa49aafc7268ef4d24dba6176a73fdfaf33d72043bf4dc88
vsphere-cluster-api-controllers git be22f10a sha256:150095977a813de0e6f59bec9da987e9ae5400c22194bcb8d75d5f9d1e8f5cb8
vsphere-problem-detector git 3683c120 sha256:c0fd983c4e7bd9e9496f9839c81410e3735d714cd9cf2f6125753ce7bed8d6f5

agent-installer-api-server

MGMT-19537: Bump golang.org/x/net to 0.33.0 (#7130) #7130
OCPBUGS-43021: Update go-jose to v2.6.3 to mitigate CVE-2024-28180 (#6893) #6893
OCPBUGS-42570: Libraries bump to mitigate CVE-2024-27289 (#6833) #6833
OCPBUGS-36577: Switch to github.com/docker/distribution/reference to Mitigate CVE-2024-3727 (#6752) #6752
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-47494: MGMT-19537: Bump golang.org/x/net to 0.33.0 (#990) #990
OCPBUGS-38466: Allow controller to continue when assisted-service (#914) #914
OCPBUGS-43025: Pick up latest CVE changes by bumping service (#920) #920
OCPBUGS-36577: Switch to github.com/docker/distribution/reference to Mitigate CVE-2024-3727 (#906) #906
Full changelog

agent-installer-node-agent

MGMT-19537: Bump golang.org/x/net to 0.33.0 (#874) #874
OCPBUGS-43028: Pick up latest CVE changes by bumping service (#804) #804
OCPBUGS-42300: Switch to github.com/docker/distribution/reference to Mitigate CVE-2024-3727 (#785) #785
Full changelog

alibaba-machine-controllers

OCPBUGS-44242: change the VERSION makefile variable to use OS_GIT_VERSION #58
Full changelog

apiserver-network-proxy

OCPBUGS-38062: Revert “Agent: Respect HTTPS_PROXY env vars for proxied connections” #59
Full changelog

aws-cluster-api-controllers

OCPBUGS-44234: [release-4.16] OSD-25934: Only tag NetworkInterfaces in RunInstances if IAM Allows It #531
Full changelog

aws-kms-encryption-provider

OCPBUGS-33693: Updating aws-kms-encryption-provider-container image to be consistent with ART for 4.16 #18
hack: display diff on verify-mod-tidy failure #26
Full changelog

aws-machine-controllers

OCPBUGS-46508: fix Associate*IpAddress flag on launch EC2 #121
Full changelog

azure-cloud-controller-manager, azure-cloud-node-manager

OCPBUGS-47645: Prevent panic when informer receives cache.DeletedFinalStateUnknown #133
Full changelog

azure-file-csi-driver

OCPBUGS-39145: bump mount-utils to treat ENODEV error as corrupted mount #76
Full changelog

azure-kms-encryption-provider

OCPBUGS-33692: Updating azure-kms-encryption-provider-container image to be consistent with ART for 4.16 #4
Full changelog

baremetal-installer, installer, installer-altinfra, installer-artifacts

OCPBUGS-48762: Update RHCOS-release-4.16 bootimage metadata to 416.94.202501270445-0 #9478
OCPBUGS-43469: pkg/asset/installconfig/azure: send full certifcate chain #9467
OCPBUGS-49416: [Nutanix] Installation failed with timeout when uploading images to PC #9412
OCPBUGS-47663: [release-4.16] Power VS: Create region-zone-sysType hierarchy #9338
OCPBUGS-48442: Ensure rendezvousIP is checked against host IP #9369
OCPBUGS-45999: Always set cross_tenant_replication_enabled parameter to false #9321
OCPBUGS-45669: aws: fix Node Port Service rule removal #9312
OCPBUGS-45669: [release-4.16] capi/aws: remove allow-all Node Port Service #9281
OCPBUGS-39434: dropping this warning as the move from terraform is transparent to the end user #8951
OCPBUGS-45852: Update upi references to api-internal #9290
OCPBUGS-41813: Validate MTU for custom network #9104
ARO-12457: Include bootstrap docker config file in go module #9259
OCPBUGS-45181: add chrony.conf file when additional NTP sources are configured #9247
CORS-3753: Allow mocking of the Azure client everywhere #9220
OCPBUGS-44348: Cherrypick oci ccm fix to 4.16 #9188
OCPBUGS-43967: Revendor assisted service external platform oci #9150
OCPBUGS-38930: import failure when esxi config is not the same in the cluster #8898
OCPBUGS-36290: IBMCloud: Ignore failed VPC regions #8674
OCPBUGS-41885: vSphere - If template is defined skip downloading #8999
OCPBUGS-41490: Update RHCOS 4.16 bootimage metadata to 416.94.202410211619-0 #9158
OCPBUGS-43476: IBMCloud: Handle pagination for subnets #9102
OCPBUGS-41490: Update RHCOS 4.16 bootimage metadata to 416.94.202410172137-0 #9132
OCPBUGS-42014: Update terraform provider for google #9077
OCPBUGS-38732: vsphere, if secureboot is enabled, disable it in the template #8904
OCPBUGS-39415: OpenStack: Install CI dependencies from rpm #8995
OCPBUGS-41334: Fix IPv6 security group rule for schedulable master #8971
OCPBUGS-38687: only allow a single network in failure domain topology #8875
OCPBUGS-42062: OCPBUGS-41865: [release-4.16] vault version updated to 1.13.10 #9036
OCPBUGS-42012: Systemd Fails to Parse Multiline EC Keys #9037
OCPBUGS-41845: Bump extract-machine-os timout to 20m #8997
OCPBUGS-38964: IngressController subnet selection in AWS #8910
OCPBUGS-42138: add tested instance type for IBMCloud #9031
OCPBUGS-39287: Fix var_files syntax to work on older version of ansible #8936
OCPBUGS-41929: Add AWS c7g,m7g,r8g to tested instance types #9009
OCPBUGS-36855: Openstack UPI - Reintroduce unique resource names. #8724
OCPBUGS-39082: incorrect folder gen, workaround govmomi vm folder path bug #8912
OCPBUGS-39496: capi/aws/byo-vpc/multi-cidr: fix group rules #8953
OCPBUGS-36861: Updates GCP terraform worker role #8939
OCPBUGS-38956: failed to install Nutanix OCP 4.16 cluster with DHCP #8905
OCPBUGS-38822: upstream capv bug causes session timeout #8891
OCPBUGS-39468: Enable TLS for virtual media in initial ironic deployment #8955
OCPBUGS-37606: vSphere validation fails if dc is in a folder #8777
OCPBUGS-39206: Update GCP Disk Types 4.16 #8920
OCPBUGS-39087: aws: validate public-only subnets configs #8913
OCPBUGS-38821: [release-4.16] Azure: Disable shared key access when using a managed identity #8855
OCPBUGS-38302: upi/aws: update lambda runtime python version #8897
OCPBUGS-38826: aws: add support for clusters with public-only subnets #8892
OCPBUGS-38517: [release-4.16] capi/aws: bump provider for instance register fix #8848
OCPBUGS-38196: Remove timed context for gcp client #8818
OCPBUGS-38502: PowerVS: Fix mad system pool #8846
Full changelog

baremetal-machine-controllers

OCPBUGS-46645: Bump x/net to 0.33.0 #226
Full changelog

baremetal-operator

OCPBUGS-49703: Handle HFC for non-redfish HW #396
OCPBUGS-39490: Disallow fetching secrets from namespaces different from the host’s one #378
OCPBUGS-38938: [OCP] Ability to disable agent power off after deployment #372
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-42720: Check cast result in adm prune deployments to prevent panic #1891
OCPBUGS-39341: Ignore pruning when deployment points to replicationcontroller #1862
Full changelog

cloud-credential-operator

OCPBUGS-47070: golang.org/x/net v0.33.0 #805
OCPBUGS-45939: Add AWS region to aws-pod-identity-webhook #800
OCPBUGS-45007: Add retry to ccoctl gcp create functions #794
OCPBUGS-45002: github.com/golang-jwt/jwt/v4 v4.5.1 #788
OCPBUGS-43645: Only attempt timed token credentials on supported platforms. #772
OCPBUGS-43337: Update github.com/sirupsen/logrus v1.9.3 #767
OCPBUGS-41234: List secrets in batches to avoid api timeout #757
OCPBUGS-38376: Update google.golang.org/grpc v1.65.0 #748
Full changelog

cluster-authentication-operator

OCPBUGS-43367: manifests should not use APIs that are removed in upcoming releases #717
Full changelog

cluster-autoscaler

OCPBUGS-48732: UPSTREAM: <carry>: 🐛(metrics) Initialize metrics for autoscaler errors, scale events, and pod evictions #339
OCPBUGS-45148: [release-4.16] VPA: Update OWNERS file #325
Full changelog

cluster-baremetal-operator

OCPBUGS-43556: SCC-pinning for metal3-baremetal-operator #453
OCPBUGS-31961: bump x/net to 0.23.0 #431
OCPBUGS-36415: set required-scc for openshift workloads #433
Full changelog

cluster-capi-operator

OCPBUGS-49603: fix: always update clusteroperator status versions when differing #253
Full changelog

cluster-cloud-controller-manager-operator

OCPBUGS-42125: IBMCloud: Modify liveness probe for IBM Cloud CCM to use loopback address #366
OCPBUGS-43473: update goimports targets #372
Full changelog

cluster-config-api

OCPBUGS-38773: remove duplicate featuregate ‘ExternalRouteCertificate’ #2007
OCPBUGS-37857: [release-4.16] OCPBUGS-37852: a rule to check if the featureSet is one of the known set of features #1985
Full changelog

cluster-control-plane-machine-set-operator

OCPBUGS-44179: relax validation on delete and if failureDomains not configured #331
Full changelog

cluster-etcd-operator

OCPBUGS-33673: rename flowschema to avoid log noise in CVO #1348
OCPBUGS-37820: ensure ordering in member health checks #1311
Full changelog

cluster-image-registry-operator

OCPBUGS-43797: fix proxy config and leader election test flakes #1148
OCPBUGS-43555: pkg/storage/azure: also check for auth failure error code on deletion #1143
OCPBUGS-42933: azureclient: stop validating credentials when creating the client #1134
OCPBUGS-42420: Continuous pull-secret updates / slow initialization on build01 (test platform infrastructure) #1126
Revert “[release-4.16] OCPBUGS-41903: pkg/operator/azurepathfixcontroller: do not sync on non-azure storage” #1119
OCPBUGS-41903: pkg/operator/azurepathfixcontroller: do not sync on non-azure storage #1115
OCPBUGS-39098: Avoid Shared Access Key usage for Azure Storage Account when using Managed Identity based auth #1104
OCPBUGS-38894: pkg/resource/azurepathfixjob: invoke update-ca-trust extract with –output #1102
OCPBUGS-38894: pkg/resource: invoke update-ca-trust extract with –output #1098
Full changelog

cluster-ingress-operator

OCPBUGS-39324: Refine logging for accurate infra CR status updates #1139
OCPBUGS-39323: Ingress operator status not degraded when canary route fails #1138
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-50575: Increase waitForFallbackDegradedConditionTimeout #1805
Full changelog

cluster-kube-storage-version-migrator-operator

OCPBUGS-38269: bump protobuf #115
Full changelog

cluster-machine-approver

OCPBUGS-48258: Fix race condition in CO status controller test #267
OCPBUGS-47704: Filter CSRs by signerName #263
OCPBUGS-45974: Ensure trailing dots on DNS names do not block serving cert auth #257
OCPBUGS-45974: Client internal DNS checks should ignore trailing dot #251
OCPBUGS-44629: Client internal DNS checks should be case insensitive #244
Full changelog

cluster-monitoring-operator

OCPBUGS-46066: Add new metrics for OpenShift logging telemetry #2537
OCPBUGS-44005: fix(monitoring-plugin): disable emitting nginx version on error pages #2521
OCPBUGS-43826: Add runbook url for TelemeterClientFailures #2508
OCPBUGS-41967: disable user-defined monitoring per object #2474
OCPBUGS-42067: Reapply “chore: poll immediately in the e2e tests” #2476
OCPBUGS-41717: Configure graceful shutdown for metrics-server (4.16 backport) #2467
OCPBUGS-41910: filter alerts sent to Telemeter #2471
OCPBUGS-39170: Backport #2441 for 4.16 #2447
Full changelog

cluster-network-operator

OCPBUGS-43803: Start feature migration when the cluster CNI is changed to the target type #2552
OCPBUGS-43715: Skip including default crypto policies to avoid authby issue #2598
OCPBUGS-44338: Prevent live migration process from flapping between step-2 and step-3 #2565
OCPBUGS-46148: Remove ip xfrm state when IPsec is disabled #2595
OCPBUGS-45593: Pass transit_switch_subnet options in ovnkube-node pod #2584
OCPBUGS-44846, SDN-5436: Provide support for user owned IPsec machine configs #2571
OCPBUGS-42727: Live migration: report network overlap via live_migration_blocked metric #2519
OCPBUGS-43604: OCPBUGS-42244: Exporting environment varialbe NODE_CNI for live migration #2538
OCPBUGS-36210: Set global IP forwarding sysctl parameters while starting ovnkube-node #2422
OCPBUGS-43544: Use CNIConfDir for mounting directory to ovn-ipsec-host pod #2537
OCPBUGS-43035: Configure narrowing=yes for IPsec connections #2528
OCPBUGS-36594: Set mount propagation to HostToContainer for /var/lib/kubelet #2430
OCPBUGS-41840: Add configurable subnets while running hybrid-overlay-node binary #2502
OCPBUGS-37763: Handle random crictl errors in iptables-alerter #2452
OCPBUGS-41555: HyperShift: do not use antiaffinity on single replica control planes #2494
OCPBUGS-37937: Add proxy env vars to onvkube-node #2457
OCPBUGS-41607: set required-scc for openshift workloads #2496
OCPBUGS-35407: Use applyconfigurations for updating network.oprerator status #2413
Full changelog

cluster-node-tuning-operator

use ROLE_WORKER_CNF environment variable to determine mcp name (#1292) #1292
e2e: tuned degraded test fix (#1282) #1282
Adjust Workload Hints test cases based on Intel or AMD (#1277) (#1281) #1277
e2e:performance: decode to valid kubeletconfig object (#1273) #1273
cmd: PPC: support tolerating heterogeneous core IDs (#1252) (#1268) #1252
e2e: add irdma to module_blacklist kernel args (#1267) #1267
OCPBUGS-47678: performanceprofile cpuset input validation (#1264) #1264
Fix context deadlines in ExecCommandOnPod() (#1263) #1263
OCPBUGS-46496: [release-4.16] Add vendor and architecture specific tuning options (#1254) #1254
OCPBUGS-45264: Normalize cpu sets when rendering to Tuned profiles (#1238) (#1251) #1238
E2E: fix modify node selector to use lowercase (#1209) #1209
Fixing empty tuned submodule when using Dockerfile (#1212) #1212
OCPBUGS-38900: Drop sched_migration_cost_ns setting (#1203) #1203
Make ocp-tuned-one-shot.service restart on-failure (#1202) #1202
Unblock 4.16 CI (#1204) #1204
e2e: performance: verify tuned one-shot service vs kubelet (#1192) #1192
E2E: Add test to verify cpuset.cpus.exclusive is writeable (#1153) #1153
OCPBUGS-39005: Add cluster-wide proxy env file (#1166) #1166
OCPBUGS-36431 Fix generated cpu mask for 512+ cpus (#1152) #1152
E2E: Remove checking of reserved cpus in irqbalance file (#1156) #1156
Fix the destination of asset’s copy (#1134) #1134
Full changelog

cluster-openshift-controller-manager-operator

OCPBUGS-48657: Add new team members to owners file #378
OCPBUGS-38269: CVE-2024-24786 infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON #363
Full changelog

cluster-samples-operator

OCPBUGS-48848: add shannon and aroyoredhat as owners #596
OKD-225: remove only the EOL CentOS 7 images #576
OCPBUGS-38159: add owners #555
Full changelog

cluster-storage-operator

OCPBUGS-46077: Fix PodStartupStorageOperationsFailing alert #548
OCPBUGS-43315: assets: shared-resource: hypershift: add pull-secret to operator SA #521
NO-JIRA: release-4.16: Run make update #512
Full changelog

cluster-update-keys

OCPBUGS-43467: keys: Update Red Hat keys to use SHA256 signatures #64
Full changelog

cluster-version-operator

OCPBUGS-46408: Filter out shallowly UpdateEffectNone errors from a MultipleErrors message in the Failing condition #1128
OCPBUGS-45329: deps: bump golang.org/x/net to 0.31.0 #1118
OCPBUGS-43964: Fix desired before sync_worker’s work is initialized #1097
Full changelog

console

OCPBUGS-35394: sessions: fix sessions pruning #13969
OCPBUGS-46602: ReRun of Resolver based PipelineRuns fails from UI #14641
OCPBUGS-46567: ImagePullSecret getting duplicated when editing DeploymentConfig in Form View #14636
OCPBUGS-48162: OCP web console show pod status as Init:0/1 after using Native sidecars #14668
OCPBUGS-43672: Disable GQL introspection #14638
OCPBUGS-45334: fix table combination #14576
OCPBUGS-41342: fix namespace for networkpolicy #14244
OCPBUGS-46022: Plugins that use very old PF4 dropdown or menu components with grouped items have bullets and padding that needs to be removed. #14612
OCPBUGS-45229: Unable to remove finally tasks in pipeline builder mode #14558
OCPBUGS-45245: use TaskRuns results.tekton.dev/record annotation to get the logs #14563
OCPBUGS-41523: i18n upload/download routine task - Sprint 254 #14258
OCPBUGS-45015: Remove ClusterTask dependency in console from Pipelines 1.17 #14537
OCPBUGS-44792: Collapse/Expand Feature Added, Removal Option Removed in Version 4.16 #14519
OCPBUGS-44875: Start last run do not work in buildConfig details page #14529
OCPBUGS-44874: Telemetry userPreference results in empty nodes output to the DOM #14528
OCPBUGS-45124: Add multiline support to template instantiation #14545
OCPBUGS-44885: include external labels so silenced alerts not displayed in notifications #14530
OCPBUGS-44932: Add IBM Block Storage CSI driver support for RWX #14533
OCPBUGS-43447: Ensure envs are initted upon first load #14405
OCPBUGS-44806: Don’t request user settings configmap if no user has been loaded. #14522
OCPBUGS-44207: Create RoleBinding will trigger Admission Webhook Warning #14465
OCPBUGS-44219: Add flag to hide the pipelines-plugin pipeline builder extensions #14466
OCPBUGS-41673: Update vendor imports to include all PatternFly components #14273
OCPBUGS-43834: Enabling topology e2e tests on CI #14438
OCPBUGS-35204: replace global refresh sync lock in OIDC provider with per-refresh-token one #13950
OCPBUGS-36556: Increase login flow state paramater length/entropy #14354
OCPBUGS-42369: Console crashes when ssh is selected in add secret for starting a pipeline run #14320
OCPBUGS-41904: fix annotation for ovn localnet #14366
OCPBUGS-37615: Include PatternFly-4 chart styles so they are available for dynamic plugins that still use PF4 react-charts #14091
OCPBUGS-37689: Switch to use annotations as labels from PipelineRuns created through Pipelines as Code is deprecated #14094
OCPBUGS-42015: Topology screen crashes when completed pod is selected #14298
OCPBUGS-35850: Fix: Quick Start “next” button requires double click to move to next step #13989
OCPBUGS-42382: Allow operators to enable monitoring by default #14317
OCPBUGS-41905: List of default Camel K event sources disappears when adding a custom event source #14290
OCPBUGS-41709: Need to allow blank for Project/namespace when setting SA Subject in ‘Project access tab’ #14278
OCPBUGS-42069: add Create button to Console plugins tab #14302
OCPBUGS-41996: Fix updating the “Until” field on the Silence > Edit page #14296
OCPBUGS-38112: do not directly mutate links in useMemo #14117
OCPBUGS-34518: Restore user toggle when authentification is disabled #13902
OCPBUGS-41619: Use vCenterCluster value from CM as primary resource #14268
OCPBUGS-37046: Fix TypeError: Cannot read properties of null (reading ‘metadata’) in Topology view #14059
OCPBUGS-38911: Values entered into the Instantiate Template form are automatically cleared #14187
OCPBUGS-38914: Unrelated readme opened when opening CodeReady workspaces from Quarkus using s2i quickstart #14188
OCPBUGS-38968: A value submitted in From view is wrapped with single quotation after switching to Yaml view. #14193
OCPBUGS-38424: fix bug where cluster version text appears black in da… #14144
OCPBUGS-38464: correct casing in “Lightspeed” #14148
OCPBUGS-37430: Fix utilization card limits/total display #14082
OCPBUGS-36510: DeploymentConfigs deprecation info alert should not present on the Edit deployment page #14031
OCPBUGS-37954: No access to list pipelines.tekton.dev prevents from using Delete application form #14107
OCPBUGS-36601: Tooltip on Pipeline when expression is not shows #14033
OCPBUGS-38803: CONSOLE-4108 [4.16 backport] Show deprecated operators in OperatorHub #14095
OCPBUGS-37048: Fix “Auto deploy when new image is available” becomes unchecked when editing a deployment from web console #14060
OCPBUGS-35839: Fix placement of icons on WebKit #13988
OCPBUGS-35271: Fix password set to Secret created through Start Pipeline form #13954
OCPBUGS-38093: correct link for Lightspeed operator #14112
OCPBUGS-36484: Revert - terminal: use username if uid is not present #14027
Full changelog

console-operator

OCPBUGS-46481: Dont disable console when authConfig type is set to None #952
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-43426: Merge https://github.com/kubernetes/cloud-provider-openstack:release-1.29 into release-4.16 #303
OCPBUGS-38167: rebase CPO on 4.16 #291
Full changelog

csi-driver-manila-operator

OCPBUGS-38458: Add missing healthchecks #241
OCPBUGS-30438: Bump protobuf dependency #237
OCPBUGS-38013: Set required-scc for openshift workloads #235
Full changelog

docker-builder

OCPBUGS-43186: runc library bump to 1.1.12 #420
OCPBUGS-47775: skipping some unit tests to avoid failures as they are duplicate #424
OCPBUGS-48159: Add team members to the OWNERS file #426
OCPBUGS-30455: bump google.golang.org/protobuf to 1.33.0 #402
Full changelog

docker-registry

OCPBUGS-49696: bump docker distribution #423
OCPBUGS-39412: pull upstream distribution changes to use a consistent multipart chunk size #410
Full changelog

etcd

NO-ISSUE: Add support for cachi2 based deps #298
OCPBUGS-34690: Rebase etcd 3.5.14 openshift 4.16 #274
Full changelog

gcp-machine-controllers

OCPBUGS-48484: Refactor exists() to handle gcp API change #106
Full changelog

hyperkube, pod

OCPBUGS-45931: UPSTREAM: <carry>: kubelet/cm: fix bug where kubelet restarts from missing cpuset cgroup #2158 #2200
OCPBUGS-46003: Bump k8s api to 1.29.11 #2161
OCPBUGS-44513: Bump k8s api to 1.29.10 #2133
OCPBUGS-42555: Allow pod to be scheduled if node’s name and hostname mismatch #2099
OCPBUGS-42168: Bump k8s api to 1.29.9 #2090
release-4.16] OCPBUGS-42057: UPSTREAM: <drop>: bump(github.com/openshift/apiserver-library-go) #2096
OCPBUGS-39015: Bump k8s api to 1.29.8 #2066
OCPBUGS-36773: UPSTREAM: <carry>: Disable vSphere tests with pre-provisioned volumes #2021
NO-JIRA: update downstream owners #2049
Full changelog

hypershift

NO-JIRA: chore(deps): update dependency mkdocs-material to v9 #5635
OCPBUGS-50557: Prevent IgnitionServer from flooding the API server with patch requests #5599
NO-JIRA: chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v9.5-1739267472 #5597
NO-JIRA: chore(deps): update dependency mkdocs-material to v8.5.11 #5591
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.6.3 #5587
NO-JIRA: chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v9.5-1738746453 #5574
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.6.2 #5575
NO-JIRA: chore(deps): update dependency mkdocs to v1.6.1 #5531
NO-JIRA: chore(deps): update dependency mkdocs-glightbox to v0.4.0 #5532
OCPBUGS-49640: fix overwriting PKI operator HCP conditions #5506
NO-JIRA: chore(deps): chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v9.5-1737480393 - abandoned #5484
NO-JIRA: chore(deps): update konflux references (release-4.16) #5477
NO-JIRA: Update squidfunk/mkdocs-material Docker tag to v9.5.50 (release-4.16) #5437
NO-JIRA: Update Konflux references (release-4.16) #5431
NO-JIRA: chore(deps): update konflux references (release-4.16) #5384
NO-JIRA: Update registry.access.redhat.com/ubi9/go-toolset Docker tag to v9 (release-4.16) #5298
NO-JIRA: [release-4.16] Bump golang.org/x/crypto and golang.org/x/net #5370
NO-JIRA: Update Konflux references (release-4.16) #5328
NO-JIRA: Red Hat Konflux update control-plane-operator-4-16 #5337
OCPBUGS-47539: Separate CPO containerfiles #5333
chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.22.7-1733160835 (release-4.16) #5295
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.49 (release-4.16) #5297
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.48 (release-4.16) #5294
NO-JIRA: Update Konflux References and Perform Migration for Release-4.16 #5261
OCPBUGS-39372: Fixed NodePool version validation #5219
NO-JIRA: Update squidfunk/mkdocs-material Docker tag to v9.5.47 (release-4.16) #5209
NO-JIRA: chore(deps): update konflux references (release-4.16) #5207
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.46 (release-4.16) #5189
OCPBUGS-43930: Return the right tagReference on Catalogs ImageStream #5133
NO-JIRA: chore(deps): update konflux references (release-4.16) #5161
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.45 (release-4.16) #5163
chore(deps): update konflux references (release-4.16) #5135
OCPBUGS-44277: Configure OAuth https proxy to dial cloud endpoints directly #5069
chore(deps): update konflux references (release-4.16) #5119
OCPBUGS-43973: Add network policies for konnectivity server and ignition server proxy #4998
NO-JIRA: Update Konflux references (release-4.16) #5112
NO-JIRA: Update Konflux references (release-4.16) #5099
chore(deps): update konflux references (release-4.16) #5078
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.44 (release-4.16) #5059
NO-JIRA: chore(deps): update konflux references (release-4.16) #5058
NO-JIRA: Update Konflux references (release-4.16) #5042
chore(deps): update konflux references (release-4.16) #5024
chore(deps): update konflux references (release-4.16) #5019
NO-JIRA: Update squidfunk/mkdocs-material Docker tag to v9.5.43 (release-4.16) #5017
NO-JIRA: Update Konflux references (release-4.16) #5012
OCPBUGS-43840: add ValidIDPConfiguration condition to report IDP config issues #4985
NO-JIRA: chore(deps): update konflux references (release-4.16) #4971
OCPBUGS-43046: Do not send traffic to local audit-webhook through konnectivity #4883
NO-JIRA: chore(deps): update konflux references (release-4.16) #4954
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.42 (release-4.16) #4947
NO-JIRA: chore(deps): update konflux references (release-4.16) #4933
OCPBUGS-43104: label routes only when HCP router used #4899
OCPBUGS-43308: Use guest DNS resolution in Konnectivity HTTPS proxy by default #4905
NO-JIRA: chore(deps): update konflux references (release-4.16) #4923
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.41 (release-4.16) #4919
NO-JIRA: chore(deps): update konflux references to 674e70f (release-4.16) #4908
NO-JIRA: chore(deps): update konflux references (release-4.16) #4896
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.40 (release-4.16) #4880
OCPBUGS-42432: Use KubeClientCABundle for HostedClusterConfigOperator cluster-signer-ca #4799
OCPBUGS-42342: Let payload generation pick the release for the NodePool #4787
OCPBUGS-42431: Conditionally manage kubeconfig secrets for DNS and Ingress operators #4798
NO-JIRA: chore(deps): update konflux references (release-4.16) #4853
OCPBUGS-42608: Add Annotation to skip deleting hcp namespace #4830
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.39 (release-4.16) #4827
chore(deps): update konflux references (release-4.16) #4816
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.38 (release-4.16) #4806
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.37 (release-4.16) #4796
chore(deps): update konflux references (release-4.16) #4781
NO-JIRA: chore(deps): update konflux references (release-4.16) #4760
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.36 (release-4.16) #4759
NO-JIRA: Security fixes for openshift-ci-security job #4750
OCPBUGS-41372: CPO oauth idp converter: resolve names before dialing #4689
NO-JIRA: chore(deps): update golang docker tag to v1.23 (release-4.16) #4729
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.34 (release-4.16) #4728
NO-JIRA: chore(deps): update konflux references (release-4.16) #4727
OCPBUGS-38058: Add HTTP konnectivity proxy to OAuth server #4496
HOSTEDCP-1955: bump CCO version #4696
OCPBUGS-34803: cmd: report server version, supported OCP #4141
OCPBUGS-39293: copy image-registry AdditionalTrustedCA configmap into HC openshift-config #4647
chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.21.11-9 (release-4.16) #4685
OCPBUGS-38062: [release-4.16] Use HTTP proxy for ingress controller #4688
NO-JIRA: chore(deps): update konflux references (release-4.16) #4684
OCPBUGS-39447: handle version skewed NodePools that do not have rhel9 binaries #4664
HOSTEDCP-1895: [release-4.16] Allow setting Kube APIServer maximum requests in flight #4551
chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.21.11-7.1724661022 (release-4.16) #4600
chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.33 (release-4.16) #4602
chore(deps): update konflux references (release-4.16) #4599
OCPBUGS-38942: copy oapi ca-trust recursively when building trust anchor #4615
NO-JIRA: Flaky cert validation test #4622
OCPBUGS-38259: Set KCM node monitor grace period #4520
OCPBUGS-38726: fix: bump github.com/IBM/go-sdk-core/v5 #4611
HOSTEDCP-1764: retrieve registryOverrides when ImageStream is not ava… #4541
chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.21.11-7 (release-4.16) #4525
OCPBUGS-36781: Set Azure VM identity if user assigned identity set #4341
OCPBUGS-37936: set proxy envvars on aws and azure CCMs #4476
OCPBUGS-38486: hcco: reconcile apiserver config into hosted cluster #4559
NO-JIRA: fix(KONFLUX-3663): format PipelineRun files and upload SAST results #4534
OCPBUGS-38131: Let the CPO oidc check resolve through data plane #4505
NO-JIRA: test: relax mgmt KAS egress check #4561
chore(deps): update quay.io/openshift/origin-base docker tag to v4.16 (release-4.16) #4528
chore(deps): update golang docker tag to v1.22 (release-4.16) #4527
NO-JIRA: Update Konflux references (release-4.16) #4524
OCPBUGS-34801: remove weak ciphers from security profile #4518
OCPBUGS-37060: OCPBUGS-35905: E2E test to verify openshift-apiserver TLS certificates #4366
Full changelog

ibm-vpc-block-csi-driver-operator

OCPBUGS-42286: Reorder static resources to create RBAC first #129
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-43686: UPSTREAM: <carry>: Fix go-retryablehttp CVE - 4.16 #89
Full changelog

ibmcloud-machine-controllers

OCPBUGS-44870: Bump dependency for CVE #53
OCPBUGS-36698: IBMCloud: Handle pagination for subnets #42
Full changelog

insights-operator

Ignore previous status when disabling alerts (#1061) #1061
OCPBUGS-45203: LokiStack gatherer (#1051) #1051
OCPBUGS-45044: insightsoperator.operator.openshift.io resource is create-only (#1054) #1054
gather selected clusterroles (#1023) #1023
OCPBUGS-39564: Not able to enable repositories during entitled build in OCP Cluster on IBM-Z (#1013) #1013
OCPBUGS-39394: collect some nmstate customresources (#986) (#989) (#995) #986
OCPBUGS-38021: Integration of the OpenStack CRs into the insights-operator (#974) #974
Add haproxy metric (#977) #977
Full changelog

ironic

OCPBUGS-49895: Drop quiet option of grep to avoid race condition with pipefail #634
OCPBUGS-48151, OCPBUGS-48598: Bump jinja2 to 3.0.1-6.el9.2 #623
OCPBUGS-44895: Bump Ironic #610
OCPBUGS-43950, OCPBUGS-43958: Bump python-waitress [4.16] #604
OCPBUGS-43438: Include fixes for CVE-2024-5569 #599
OCPBUGS-42511: Include fix for CVE-2024-47211 #594
OCPBUGS-39017: Bump ironic-lib to fix utf8 decoding issue #569
OCPBUGS-38797: redfish-virtualmedia fails on XFusion nodes #564
OCPBUGS-42113: Update ironic-inspector to fix the memory leak #587
OCPBUGS-37758, OCPBUGS-39383: Include fixes for CVE-2024-44082 #579
OCPBUGS-38510: set min version for python3-webob #553
Full changelog

ironic-agent

OCPBUGS-39017: Bump ironic-lib to fix utf8 decoding issue #156
OCPBUGS-39383: Include fixes for CVE-2024-44082 #161
OCPBUGS-38510: set webob and bump werkzeug #149
Full changelog

ironic-static-ip-manager

OCPBUGS-49595: Fix subnet validation #48
Full changelog

kube-metrics-server

: OCPBUGS-46663: Disable HTTP2 #41
OCPBUGS-41717: Wire server run options to flags. ([release-4.16] backport) #37
Full changelog

kube-proxy, sdn

OCPBUGS-46493: Raise the minSyncPeriod for NetworkPolicies to 10s during migration #649
OCPBUGS-46048: clean up containernetworking/plugins vendoring in sdn #645
OCPBUGS-45806: Stop checking ruleVersion [4.16] #643
OCPBUGS-44301: Use copy() to duplicate a net.IP #641
OCPBUGS-43344: OCPBUGS-42244: Implement namespaceSelectors on ingress with all pods IPs #635
OCPBUGS-42203: fix UDP conntrack cleanup #636
OCPBUGS-42159: fix redundant router-default iptables rule #633
Full changelog

kube-rbac-proxy

OCPBUGS-30447: protobuf bump [4.16] #111
Full changelog

machine-api-operator

OCPBUGS-45947: vSphere klog initialization preventing verbose log messages #1312
OCPBUGS-45998: Ensure deletion annotation takes priority and oldestPolicy can distinguish longer ages #1313
OCPBUGS-39028: Updates message verbs to use %q where appropriate #1282
OCPBUGS-43433: Vsphere: Handle cloned instance with lost taskID #1298
CORS-3648: Add the hyperdisk-balanced disk type #1279
Full changelog

machine-config-operator

OCPBUGS-50862: Auto-recover from MC with invalid extension #4853
OCPBUGS-43680: Regenerate the rendered MC in use when deleted #4655
OCPBUGS-49976: Add clarification to invalid maxUnavailable alert #4837
OCPBUGS-39224: Do not enable on-prem-resolv-prepender.path for UPI #4573
OCPBUGS-48290: Pausing Master MCP results in Alerts #4786
OCPBUGS-43765: openstack: fix non-old systemd compatible unit #4660
OCPBUGS-43741: Soften haproxy timeout for kubeapi probe #4662
OCPBUGS-48116: OCPBUGS-47801: trying to wait for sub-controllers #4777
OCPBUGS-45974: Remove trailing periods from AWS provided hostnames #4744
OCPBUGS-44337: Removal of additionalTrustBundle CA does not remove certificate from node backport #4688
MCO-1342: Backport Telemetry to 4.16 #4649
OCPBUGS-44043: Disable ESP offload for OVS attached interfaces #4676
OCPBUGS-42109: Do not use ‘restart’ for ‘oneshot’ service #4616
OCPBUGS-42744: Check for kernel arg diff in updateOnClusterBuild #4628
OCPBUGS-42722: Panic seen in CI job for MCC pod #4626
OCPBUGS-42719: MCPs report wrong number of nodes when we move nodes from one custom MCP to another custom MCP #4625
OCPBUGS-41293: Enable the use of Linux Bridge as the ovs default port connection #4563
OCPBUGS-41256: Set ESP offloads off in bonds if slaves don’t support them #4627
OCPBUGS-41806: When newly built images rolled out, the update progress is not displaying correctly (went 0 –> 3) #4584
OCPBUGS-41518: CVE-2024-3727 ose-machine-config-operator-container: containers/image: digest type does not guarantee valid type #4569
OCPBUGS-38997: Machine-config daemon ListPools panic during tech-preview CI runs #4550
OCPBUGS-38711: SCC-pinning for openshift workloads #4539
OCPBUGS-36850: Port number 22623 exposing weak ciphers to external client from master node IP #4556
OCPBUGS-38373: Revert “MCD-pull: run after network-online.target in Azure” #4528
OCPBUGS-36171, OCPBUGS-36172: fix secret canonicalization #4432
Full changelog

monitoring-plugin

OU-559: fix log based alerts namespace for dev console #320
OCPBUGS-44395: remove unused package and upgrade vulnerable dependency #272
OCPBUGS-43239: upgrade dynamic plugin sdk to remove vulnerable dependencies 4.16 #217
OCPBUGS-42424: fix path-to-regexp dependency #197
Full changelog

must-gather

OCPBUGS-48082: Update owners #473
OCPBUGS-46407: Support gathering IPsec data #469
OCPBUGS-42969: Collect etcd object count #454
OCPBUGS-43056: Open [Release-4.16] Multus is now a Pod and will be captured by normal #449
Full changelog

nutanix-cloud-controller-manager

OCPBUGS-30524: bump google.golang.org/protobuf to v1.33.0 #38
Full changelog

oauth-apiserver

OCPBUGS-30525: Update dependencies to address CVE-2024-24786 #124
Full changelog

oc-mirror

changes the owners file (#1015) #1015
OCPBUGS-48513: e2e: use same version of crane as in go.mod (#1021) #1021
OCPBUGS-38035: Rebuild catalogs – without cache generation (#905) #905
Full changelog

openshift-apiserver

OCPBUGS-49656: prevent panic when no image and error are set #494
OCPBUGS-49656: validate image property isn’t nil before using #493
OCPBUGS-49656: move on to the next digest/tag during failures #492
OCPBUGS-45010: Pass expected type to deploymentconfig/scale object validation. #461
OCPBUGS-42724: fail image import when both image and error are nil #455
Full changelog

openshift-controller-manager

OCPBUGS-44186: user system:serviceaccount:openshift-infra:serviceaccount-pull-secrets-controller in ns/openshift-infra must not produce too many applies #351
OCPBUGS-48202: Add team members to the OWNERS file #358
NO-JIRA: cleanup root and app OWNERS #347
OCPBUGS-42420: Continuous pull-secret updates / slow initialization on build01 (test platform infrastructure) #343
OCPBUGS-39191: replaces deprecated square/go-jose wtih go-jose/go-jose #329
OCPBUGS-37526: Race condition when deleting ServiceAccount #324
Full changelog

openstack-cluster-api-controllers

OCPBUGS-44456: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.10 into release-4.16 #328
OCPBUGS-44990: Makefile changes for merge-bot #341
OCPBUGS-34931: rebase on release-0.10 (to fix trunks deletion) #321
Full changelog

openstack-machine-api-provider

OCPBUGS-34931: bump CAPO to v0.9.2 #124
Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

OCPBUGS-48696: Fix excessive catalog source snapshots cause severe performance regression #957
OCPBUGS-48661: Fix concurrent namespace resolution #947
OCPBUGS-46928, OCPBUGS-46935, OCPBUGS-47315: x/net bump to v0.34.0 [release-4.16] #939
OCPBUGS-47738: catalog-operator: Delete Pods that were evicted (#3459) #925
OCPBUGS-46434: CRD upgrade existing CR validation fix #916
OCPBUGS-44802: fix: call TokenRequest API when service account token secret is missing #900
OCPBUGS-41540: [4.16] add optional schema migrations; default to olm.bundle.object instead of olm.csv.metadata (#1384) #859
OCPBUGS-41677: [4.17] adds paginating lister for evaluating CRs’ upgrade fitness versus new CRDs. #863
OCPBUGS-41557: Fix e2e flake: upgrade CRD with deprecated version #861
OCPBUGS-41217: (fix) registry pods do not come up again after node failure (#3366) #854
OCPBUGS-38290: release-4.16 Resolver: list CatSrc using client, instead of referring to registry-server cache #838
OCPBUGS-38129: [release-4.16] Update junit report file name to show spec results on Test Grid #833
Full changelog

operator-marketplace

OCPBUGS-49429: Upgrade golang.org/x/net [release-4.16] #587
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-47634: Let OVN-northd bind remote ports #2406
OCPBUGS-45958: bump OVS to 3.3.0-62.el9fdp for OCP 4.16 #2388
OCPBUGS-44457: Add static route to the hairpin masquerade IPs to pod #2346
OCPBUGS-45942: pin libreswan to 4.6-3.el9_0.3 #2386
OCPBUGS-45343: Dockerfile: Update OVN to the 24.03.2-32.el9fdp minor release. #2377
OCPBUGS-42244: Add hybird overlay pod IPs to the namespace address_set #2352
OCPBUGS-43344: Add SDN node subnet gateway IP to host-network address_set #2328
OCPBUGS-42942: Fix egress gateway pod cleanup for remote zone pods. #2341
OCPBUGS-36210: Implementation required to enable Forwarding if it is already disabled #2212
OCPBUGS-41551: Add subnet overlap check for transit switch subnet #2306
OCPBUGS-38697: Use more exact name match when deleting static routes to HO nodes. #2282
OCPBUGS-24386: [release-4.16] EgressService: Fix ETP=Local ingress reply for LGW #2278
OCPBUGS-38705: Delete EgressIP LRP stale nexthops when node is not found #2271
OCPBUGS-38054: Fix per-pod MCS/metadata blocking #2248
OCPBUGS-38699, OCPBUGS-38704: EgressIP VRF support & ignore localnet patch ports when bootstrapping #2267
OCPBUGS-37939: [release-4.16] Bump OVSDBTimeout and make it configurable. #2244
Full changelog

powervs-machine-controllers

OCPBUGS-41976: Update go.mod to fix CVE - 4.16 #84
Full changelog

prometheus

OCPBUGS-43668: fix(discovery): Handle cache.DeletedFinalStateUnknown in node informers’ DeleteFunc #231
OCPBUGS-39179: Restore Prometheus functionality to accept samples with different timestamps from the same series in a single scrape. #224
OCPBUGS-36918: cherry-pick upstream fix to make PrometheusRemoteWriteBehind fire when remote endpoint is never reached. #214
Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

OCPBUGS-38399: feat: sync proxy settings in Alertmanager configuration #299
Full changelog

tests

OCPBUGS-44119: Ignore infra nodes on tap cni tests #29261
OCPBUGS-48448: Add team members to the OWNERS file for PR approvals #29443
OCPBUGS-48348: Fixing build s2i ruby test data inline with latest ruby version(>=3.0) #29431
OCPBUGS-44105: Adjust createDNSPod() to support hypershift dual-stack test #29258
OCPBUGS-39135: Bump timeout for the pod-network-service endpoints check #29052
OCPBUGS-41611: Disable:Broken for [sig-builds][Feature:Builds][Slow] can use private repositories as build input build using an HTTP token should be able to clone source code via an HTTP token [apigroup:build.openshift.io] #29079
OCPBUGS-38707: run vsphere driver config test on non techpreview clusters #28992
OCPBUGS-38788: [4.16] egressfirewall: skip ping tests in case of hypershift kubevirt on Azure infra #28938
OCPBUGS-38015: vertical scaling test should not rely on CPMS replicas #28981
Full changelog

vsphere-cloud-controller-manager

OCPBUGS-46341: update check-fmt goimports command #83
OCPBUGS-37660: Bump otelgrpc to v0.53.0 #72
Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

OCPBUGS-43881: redact sensitive information when logging VCenter config #134
OCPBUGS-42878: Add compute resource entity to consider a standalone cluster for volu… #131
Full changelog

vsphere-csi-driver-operator

OCPBUGS-49862: List only linux nodes #289
Full changelog

View changelog in Markdown or change previous release:

Source code for this page located on github