4.16.49

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.16.49-x86_64

Team Approvals:

Accepted
- QE

Tests:

Blocking jobs
- upgrade Succeeded release-openshift-origin-installer-e2e-aws-upgrade
- upgrade-minor Succeeded release-openshift-origin-installer-e2e-aws-upgrade
Informing jobs
- aws-ovn-serial Succeeded (2 retries) periodic-ci-openshift-release-master-nightly-4.16-e2e-aws-ovn-serial
- aws-ovn-upgrade-micro Succeeded (1 retries) periodic-ci-openshift-release-master-ci-4.16-e2e-aws-ovn-upgrade
- aws-sdn-upgrade-4.16-micro Succeeded (2 retries) periodic-ci-openshift-release-master-nightly-4.16-e2e-aws-sdn-upgrade
- azure-ovn-upgrade-4.16-micro Succeeded (3 retries) periodic-ci-openshift-release-master-ci-4.16-e2e-azure-ovn-upgrade
- fips-scan Succeeded (1 retries) periodic-ci-openshift-release-master-nightly-4.16-fips-payload-scan
- gcp-ovn-rt-upgrade-4.16-minor Succeeded periodic-ci-openshift-release-master-ci-4.16-upgrade-from-stable-4.15-e2e-gcp-ovn-rt-upgrade
- hypershift-ovn-conformance-4.16 Succeeded periodic-ci-openshift-hypershift-release-4.16-periodics-e2e-aws-ovn-conformance
- metal-ipi-ovn-bm Succeeded periodic-ci-openshift-release-master-nightly-4.16-e2e-metal-ipi-ovn-bm
- metal-ipi-ovn-ipv6 Succeeded (1 retries) periodic-ci-openshift-release-master-nightly-4.16-e2e-metal-ipi-ovn-ipv6

Upgrades from:

Untested upgrades: 4.15.21, 4.15.22, 4.15.23, 4.15.24, 4.15.25, 4.15.26, 4.15.27, 4.15.28, 4.15.29, 4.15.31, 4.15.33, 4.15.34, 4.15.35, 4.15.36, 4.15.37, 4.15.38, 4.15.39, 4.15.40, 4.15.41, 4.15.42, 4.15.43, 4.15.44, 4.15.45, 4.15.46, 4.15.47, 4.15.49, 4.15.50, 4.15.51, 4.15.52, 4.15.53, 4.15.54, 4.15.55, 4.16.11, 4.16.12, 4.16.13, 4.16.14, 4.16.15, 4.16.16, 4.16.17, 4.16.18, 4.16.19, 4.16.20, 4.16.21, 4.16.23, 4.16.24, 4.16.25, 4.16.26, 4.16.27, 4.16.28, 4.16.29, 4.16.3, 4.16.30, 4.16.32, 4.16.33, 4.16.34, 4.16.36, 4.16.38, 4.16.39, 4.16.4, 4.16.40, 4.16.41, 4.16.42, 4.16.43, 4.16.44, 4.16.45, 4.16.5, 4.16.6, 4.16.7, 4.16.8, 4.16.9

4.16.48 (changes) - F S F F F S F F S S S
4.16.47 (changes) - Failed
4.16.46 (changes) - Failed
4.16.37 (changes) - Failed
4.16.35 - Failed
4.16.10 (changes) - Success
4.16.2 (changes) - Success
4.16.1 (changes) - Success
4.16.0 (changes) - Failed
4.15.58 (changes) - Failed Success
4.15.57 (changes) - Failed
4.15.56 (changes) - Failed
4.15.48 (changes) - Failed
4.15.32 (changes) - Failed
4.15.30 (changes) - Failed
4.15.20 (changes) - Success
4.15.19 (changes) - Failed
4.15.18 (changes) - Failed
4.15.0-0.nightly-2025-09-18-135647 (changes) - Success

Upgrades to:

Loading changelog, this may take a while ...

Changes from 4.16.35

Created: 2025-09-25 16:25:02 +0000 UTC

Image Digest: sha256:9806a2d5ad4b2ae562002cd7934e96e0178eec405186a73b71e4e1400c423ac1

Components

Kubectl 1.29.7
Kubernetes upgraded from 1.29.11 to 1.29.14
Kubernetes Tests 1.29.0
Red Hat Enterprise Linux CoreOS upgraded from 416.94.202502111330-0 to 416.94.202509241740-0 (diff)

Removed images

ovirt-machine-controllers

Rebuilt images without code change

agent-installer-utils git 6e6bb40d sha256:2258e4e8f12edfe1e7db87d9a1496ff2f89fff734c4570ad0eb602ff8a83a6fc
alibaba-cloud-controller-manager git 97e8335e sha256:4924df4ff09c18405c5994fc0f3648154ffbc6754dab27d90ac64e34426ba9dd
alibaba-machine-controllers git 248372a4 sha256:6e377c23bed1048555de65c49b10ed2511ebff495373a261dee565576e4add10
apiserver-network-proxy git ca81b6a3 sha256:97d41c79ff5b2b96e6d8ca966e0ce7635cc6ed5a6c7c958eb12a74e08bcd7253
aws-cloud-controller-manager git a53e9def sha256:05fad8d4a3f383a30fa29430c4993cba741a064af20bb06b89240bbca8d54337
aws-ebs-csi-driver git 1d29a74a sha256:b5d82f47d0ce310cd94fa742adea52f0e36815f965cc502b016fcbf174c98922
aws-kms-encryption-provider git c66065de sha256:f91a3fc9bdb6ebed830e98989aaa6d0491debed649b1a1d3a6e28379808f6b6f
aws-machine-controllers git 0c819861 sha256:e34abfda9c403661ed89282c1359ec67b8842fc7a2f87c04e4dcc6c9d882e9b2
azure-cloud-controller-manager git e5bac334 sha256:7de179c7a9b5a416bf201c5e7f46fd66c537513401d53ce787656d44f29148c0
azure-cloud-node-manager git e5bac334 sha256:5920ec1904376b0e33426d0c61fc8329a8b72fb4a9542b043081bf24163e5784
azure-cluster-api-controllers git a81e3b31 sha256:e93a4419887506fb45c42e61b69285d72433cf557baa1745d1f1ddb22bbb0499
azure-disk-csi-driver git 6b55f6fb sha256:903b9b77e871b7c8e17bb50349d0dcbe4d4460919b8af4193485eca32a9d0c44
azure-file-csi-driver git 7a36778a sha256:8646fb1746e54ed5a37626238ffcfe1b7e798e87d5cbdd0ddc121c1aec7e7754
baremetal-machine-controllers git 2b396e06 sha256:1c5c53a903b80b1824ecd50cdb3cfa67702f5b309a0a079e9a53f664a5f8a5cc
baremetal-runtimecfg git f55a330f sha256:6dc5858af282a6f792cf5e5cf4d06b4a43ed23585ce50c8bbbc33b3a1ae0316f
cluster-bootstrap git 27bfb59f sha256:e453387b021452d4745ee899bbb234f9ec26bf7139a5965ade84e5989684f03e
cluster-capi-controllers git 5830a10a sha256:56453300d19aa2f6875b6d75203bde841b010e240a4c56701ad001ff7d337d56
cluster-capi-operator git c699f6cf sha256:59430db54192cd0f41f46d080cc0c2d6fddaaae9d22149cb504ac5a92c81fba0
cluster-config-operator git 441d29c9 sha256:c6fb0e2fdd3b201bf24a3d2e2fc2f7df310af6b6cc2ea5da3d59fdc75743e95d
cluster-control-plane-machine-set-operator git 14571e8a sha256:d24509fe5923939662bd56d8bc8468cbc2ab9ca8ac092f578456b50078d43041
cluster-csi-snapshot-controller-operator git 439826e1 sha256:16c0173abd55e29c3f9bb592f7352eb3f5890e7ec6726319098f92c398915260
cluster-kube-cluster-api-operator git 95ceaa9e sha256:45fe0fbdbd08f185e042c81145c4e33827071018d2e481badbc4896e6190cce4
cluster-kube-scheduler-operator git 630f63bc sha256:1ac6ac13a9ce7c8051aa1fd183e31e463fdd77dcfa964779e90dcc45f47fa662
cluster-kube-storage-version-migrator-operator git e8258113 sha256:f82ae9afb8074dbbbe0d3363d5a372f66220aca67765cf270f570874dfb048d8
cluster-machine-approver git 7685374f sha256:57435fab1f5e2ff5d36af26cbe78b266f5e094704d3f76063e6460b4d09df1a8
cluster-monitoring-operator git 09963a50 sha256:d26250d5c5a60fd069496dd271e0deef9c4c4340b457f99f9db0e3ca144e1583
cluster-node-tuning-operator git eacd6ee9 sha256:5b421b6bcd93dbd793a6f824a84d07f532a487bc125c2e36870c39d412f0c524
cluster-olm-operator git 27bf70dd sha256:81a608dc91f4c48d604a7122f94ae613f6cd70a3db6ba2e4f56b60339a860e1e
cluster-openshift-apiserver-operator git d26f3002 sha256:d8c769dc6f81b83b0293db0c1e406d26ec7ca98546b1875c997d0aa9407094b1
cluster-openshift-controller-manager-operator git 2ed3cf99 sha256:fc6a05995a2e1263ff31790b8f0262368c5227cd2426dd402e2d6257b2c277ff
cluster-policy-controller git eaea543f sha256:1876280036599f6737f6aac737951c422213d15570f9dce274217c884484bff5
cluster-update-keys git e8478585 sha256:161c6728fbfc647401e87123dbb89ebb8af87d13e0f3ded726b76ee8ac7f3601
configmap-reloader git dc91ddc4 sha256:5d4d421a22254c14cc1bf073efc9949590159851410c25ea81abaf67c48eabf5
coredns git 1e417656 sha256:0378655147ea0e7a80bc684e73b5a7271c1f4f62dde665a21d7f80754be0c1d4
csi-driver-manila-operator git c25d1ff2 sha256:841d737de7a1919350db17a3b8be794025057a47092ece772a9480813fc56cb0
csi-driver-nfs git 406cec72 sha256:4002d326d77fd11942c4ee85a688ca37eca43a88c7e1bf80100099e405b917e9
csi-driver-shared-resource git bc125def sha256:d0d9a7e444921ea197c76c7e35ec0bdd75d6e731ecdcbd48311a098d14fa6d41
csi-driver-shared-resource-operator git 1e1194bc sha256:a985de93b213330e0836522136440c158522cb3e7e2ad648071cb974d0af82b6
csi-driver-shared-resource-webhook git bc125def sha256:a5ef872fa6766c89c5d40b071415e42eb0b8f74f7fa47c82663324d02695619b
csi-external-attacher git 7da80aab sha256:99d936c384b7f04d590b798b748e12078064636ab0ad316874a102bad7e2e8c4
csi-external-provisioner git 9e8af011 sha256:1d0773c6bfa6b196684b0195d1a0b01753e31c3ff0829f9a2322c4f7605ffcdf
csi-external-resizer git bdf5bfb4 sha256:2fb44e66e254aaacf9ab25fcb6ddb9f86563a3fc73ab233a47c1e43a048ab478
csi-livenessprobe git f5e3ff55 sha256:f55204c3e9e8fc63a10293a635c9c117ffc3d316ffe207618d47e81e4a0b58b4
csi-node-driver-registrar git 8930c368 sha256:94a0286bf295454f2dc7f1999dd051061b9abefb390ab03696700481daa95154
driver-toolkit git 1d5732f0 sha256:fb05d75b0bb9d684351e856bff3ae644db7f7853377c15cbc513e2d2c8bb74fa
egress-router-cni git 7089efe6 sha256:5c971d508c8bd8c52a8f01de4bc466373a2bdf0870f5c378272bae459c4f7acd
etcd git e7911c0d sha256:6a27143b606c9ac78f39375981199beaabd48b72c544714b2b33a51ff947c3cf
gcp-cloud-controller-manager git 26b43dfc sha256:1f63e08598834b07cc874bdeea2d9166dad409cb87ae53410defdf0838c14697
gcp-cluster-api-controllers git 02432df8 sha256:d04167a82339119ca471025edb35c1e73716ec64b1909a9837840e6751ea024e
gcp-pd-csi-driver git 5ed71c64 sha256:6645e444d12bf32c04ce2d94674e4644a20aece66180aefb5b9b93ee08663b8b
gcp-pd-csi-driver-operator git 799327f7 sha256:e15c1553ee4d8b37b0b807fdf2cecf3b28e8d0a59a496f19d2768db3a514a7c3
ibm-cloud-controller-manager git f961f16d sha256:a27849e0b89593ca74e0d0d69e30578f6193ff5ba5d8c86f25d827f1f7ac4287
ibmcloud-machine-controllers git d29506e7 sha256:3fbc3327ac626b692e57a5df7ac9e28e7bd25e05c4b3b19df2565b0c41b20b52
ironic-machine-os-downloader git 93b8b5fa sha256:44bb491e51baaa0340e8e55ebaa837d4ad5cc846c4e09d207e8a6329597fcd10
ironic-static-ip-manager git f44e8a08 sha256:a0c7c6ebe88f8ce73de453f62ced5445525318c8d2b53916b5c3d4ce65c40425
k8s-prometheus-adapter git e4f859be sha256:fe8bfa0453e268ec8c8e910f963e529fec1ea3603be27df0b2aca5be4a80a028
keepalived-ipfailover git b58673a3 sha256:9d2f0fa829300d82f8c6aedcb7cbc2a3bdd9b930ed0facb1bf6a5595c7f863ff
kube-metrics-server git 9116b918 sha256:3a81aba2b50e1fa68f8a0a1c1a1663341f1117ae770a9db2463aadcab306d444
kube-rbac-proxy git c38f4734 sha256:937bf589f3cd8a0432199769defb235afa547c94483604a20cf708f5110b7315
kube-state-metrics git 9b67b8d1 sha256:9e4af2b80f87079fb19d675a1b5b774736b078aed3a7ed1bc4849dd4b58dc8cf
kubevirt-cloud-controller-manager git 3db76104 sha256:15e9e41cecb866b221987abda1590b19b221cb4406c2d2b757927d30408b4901
machine-image-customization-controller git 39480963 sha256:ccae066e34cca9a9a788871eead02efc417ee58d1f003455ac239c8878d4ba56
multus-networkpolicy git f988f894 sha256:f1734dc12210b36bc15ee39ee52ac7f4ce8da8ac42bb41f8ce2f059c47e84d0b
multus-route-override-cni git 73594f77 sha256:9d93a0a366ee9c64d7ee693bfecd5b927713188bb35770172e2b757ab26263a6
nutanix-cloud-controller-manager git 28bf5963 sha256:3683c14d69a4a06771c0ba646a11fdac26b7761d892fd1670bd95f0d03d9d9b3
oauth-apiserver git f09a9be3 sha256:a55444d9e5efbd241088fb26e6939d6c294e2288345f26298ccad66d2017c8e7
oauth-proxy git 30f80124 sha256:e13c6a145fbe017e7fa2da840fecc41ef30855b4f39085fa4c52d76e0718fd88
oauth-server git 3739138c sha256:e64e642cb32f6cd6ee8482005481efaae86b3d4d06d6cc4fbcb89e3f3640d802
oc-mirror git b137a53a sha256:e80c55a88d865a53b545d8ed8d3c795d98ecf8d959e59094cce170c78f1dc51f
olm-catalogd git 79975a51 sha256:14e792e56862f9690e21bbfeda88f5c67dc19c32e59d815ccce7f465495d1579
olm-operator-controller git 80b8649c sha256:9352112d31c24cca3adb9611e9d00cef7561149143343b24a3cd9b44a4276b0c
olm-rukpak git 282cc84c sha256:14d9617d7279902de832b6c11c34c52d601562982af3dd9a81473db116cdb7ad
openshift-state-metrics git 59b8a0ff sha256:6b26ff97bc5f594d259e303f2e74ed1d68467c11b6c74e3d33e73d9a6b86fb2c
openstack-cinder-csi-driver-operator git 85b52097 sha256:d12e17d2fec1d8a7e674f43309d9499c33d7d4869a70c88bab7288b9a3433c10
openstack-machine-api-provider git 5ada1cba sha256:9d857598f3ed604828faee66d1ecd281247993f8cdcd0531cf3083eed2aa72b3
ovirt-csi-driver git 1db726a9 sha256:7fb7fa8bd68e232b5f616b73c2a7cd70c5e4a7af5cbd3c9567957fa23286ed8f
ovirt-csi-driver-operator git ac852f3e sha256:4f9c9cd13239b4165036d15ca797cb47f88c6b4805d09f3c696cb7656c83910b
powervs-block-csi-driver git 26162bad sha256:9412299259b13172fce48bd4ffe2b3e2769fd4c30875951e013d01d41bfc2a33
powervs-block-csi-driver-operator git 9c5dd8d1 sha256:4cc6e33d01458b74dbfefcdce7fbd5e5cb6ac0be8e094223ab00ff328f2fa935
powervs-cloud-controller-manager git 20e6dc70 sha256:222ba6a63c7c840df00eea8d2a24c333b4e99a48b7cbfff5ac4bb5d7e71eeeed
prom-label-proxy git 5e14722e sha256:dda89466730115563fefe18c080806c7571cd28384fbdb453ecdb8a5b6fd211b
prometheus-alertmanager git e9aea929 sha256:1802e0b6b9d7d1865971fec1197bd475e51d0c6bdc8d212723ecc7930e6b6420
prometheus-config-reloader git c7262a43 sha256:708f9b17b8e261dcae35f12934d7e60da0c34fbc778db84d45345c92453f7565
prometheus-node-exporter git 29ba26d1 sha256:835579c5af5310003538ad402e717da027506adce10d964f09e393c0b133a075
prometheus-operator git c7262a43 sha256:7a7ac2a4e86662027be177150c405e630b9145a0fd006b76fddd8467cc4a6e9f
prometheus-operator-admission-webhook git c7262a43 sha256:d8c4e8a98ef0dde9fe4aec4bb16e7b61c4b9d91f43d3d6f56c56154bbea70f2a
rhel-coreos sha256:8ef693c2d1a5709061805e09ad2cbe6b244213ed0fc563a969955bf08b384485
rhel-coreos-extensions sha256:37707fb6e8f326821ec0212e9ab90e5bf5ddf60e166e786643fef4682f4e1234
service-ca-operator git 538c7b98 sha256:ece8d87864edfba4f93b4026dd4b74c23c597fea85a8c040f883b83e0aafc25b
telemeter git c1ecd105 sha256:7d3320299192714b7a5a45d518855bf135e79fec77cac2e94f329a462da5860c
thanos git 85eee25c sha256:bb2c849e5ccb6ee6256595dccf9202c45a4db0ba496ac392ac66fe60586af94d
vsphere-cloud-controller-manager git 023a3655 sha256:206496e24bd5d8058543f431e4d5f20376dc0eb665dc1eb594299ea4d9f10e39
vsphere-csi-driver git 03b7e8eb sha256:93e654b7cbd13fd8714872d2fc1daff52babdc4c4c7f57fe13ab2d1e311236cb
vsphere-csi-driver-syncer git 03b7e8eb sha256:daf5f0526c7687e8f14a43ab17736e82d887025944281c750c6cb84e6026512a
vsphere-problem-detector git 3683c120 sha256:977308e61e4594b99a2c0b5b156311fe7a6ab66d03440b1c4e2cb4334b728b87

agent-installer-api-server

OCPBUGS-58631, OCPBUGS-58636: Bump glog to v1.2.5 in release-4.16 (#7901) #7901
OCPBUGS-47627: dnsmasq service on OCP SNO fails to read /etc/resolv.conf file during system startup (#7857) #7857
OCPBUGS-54402: Bump go-jwt to 4.5.2 to fix CVE-30204 (#7486) #7486
OCPBUGS-45244: Bump moby from v26.0.0 to v27.2.1 (#7189) #7189
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-53718: Bump jwt to 4.5.2 in release-4.16 (#1091) #1091
abi: let the bootstrap waiting for workers before rebooting (#1047) #1047
Full changelog

agent-installer-node-agent

run go mod tidy / vendor #1019
And 4 elided commits (e.g. from squash or rebase merges)
Full changelog

aws-cluster-api-controllers

OCPBUGS-61942: UPSTREAM <carry>: revert: Only tag NetworkInterfaces in RunInstances if IAM Allows It #572
OCPBUGS-58666, OCPBUGS-58671: bump github.com/golang/glog to v1.2.5 #560
OCPBUGS-53726: Update golang-jwt to v4.5.2 #547
Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator

OCPBUGS-61253: add ability to control kube rbac proxy container image… #426
OCPBUGS-60598: Bump library-go #423
OCPBUGS-59606: Backport stale conditions fix #407
OCPBUGS-60248: add tag matching to Azure File storage class #414
Full changelog

aws-pod-identity-webhook

OCPBUGS-52513: github.com/go-jose/go-jose/v4 v4.0.5 #203
Full changelog

azure-kms-encryption-provider

OCPBUGS-53494: bump golang-jwt v4 #13
Full changelog

azure-machine-controllers

OCPBUGS-52476: Remove unused vnet package #131
OCPBUGS-56169: [release-4.16] Update virtualmachines service to armcompute/v5 SDK #147
OCPBUGS-56656: Fix failure when attempting to modify immutable availabilitySet #151
OCPBUGS-56092: Update eviction policy for Spot VMs from Deallocate to Delete #142
OCPBUGS-54990: Re-reconcile machine on NIC provisioning failure #137
OCPBUGS-50966: dynamically setting the amount of fault domains #129
Full changelog

azure-workload-identity-webhook

OCPBUGS-53798: github.com/golang-jwt/jwt/v4 v4.5.2 #33
OCPBUGS-52510: github.com/go-jose/go-jose/v4 v4.0.5 #29
Full changelog

baremetal-installer, installer, installer-altinfra, installer-artifacts

OCPBUGS-58290: sort zone slices extracted from map of byo subnets #9819
OCPBUGS-55807: update resolv.conf every time on bootstrap node #9694
OCPBUGS-57460: vsphere - check if host is powered down or on standby before uploading template #9786
OCPBUGS-36677: Power VS: Enable incoming traffic on port 5000 during installation in a restricted network #8711
OCPBUGS-57498: ensure ctrplane nodes can access bootstrap MCS #9788
OCPBUGS-54240: Update timeout for GCP WaitFor operation #9715
OCPBUGS-35040: Power VS: Add ports needed for private clusters to security group #8546
OCPBUGS-54327: Remove error logging when determining image arch #9610
OCPBUGS-54345: Remove tmp directory used for agent pxe files #9611
OCPBUGS-54263: IBMCloud: Move to IBM TF openshift fork #9604
OCPBUGS-50547: aws/edge/byovpc: tag edge subnets with shared value #9482
OCPBUGS-52191: [release-4.16] capi/aws: bump provider for LB DNS lookup fix #9547
OCPBUGS-51207: Log correct hostname for validation status #9511
OCPBUGS-51111: PowerVS: destroy dhcp hack #9502
OCPBUGS-48762: Update RHCOS-release-4.16 bootimage metadata to 416.94.202501270445-0 #9478
OCPBUGS-43469: pkg/asset/installconfig/azure: send full certifcate chain #9467
Full changelog

baremetal-operator

OCPBUGS-53322: BMO can expose any secret via BMCEventSubscription CRD #407
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-59938: Adding sos.conf file for default sos config into the tools image #2064
OCPBUGS-60675: Use fedora image in unit tests instead of centos #2079
OCPBUGS-51043: Add HOST env var in oc debug for sos report collects more #1977
Full changelog

cloud-credential-operator

OCPBUGS-55129: snyk to ignore SNYK-GOLANG-GOLANGORGXNETHTML-9572088 #918
OCPBUGS-60973: ccoctl: aws to use proper issuer url on subsequent runs #909
OCPBUGS-60861: ccoctl: only add owned tag to azure resources on create #902
OCPBUGS-58676: github.com/golang/glog v1.2.5 #893
OCPBUGS-56981: Azure: resolve nil pointer exception when role assignment exists #867
OCPBUGS-53416: github.com/golang/glog v1.2.4 #843
OCPBUGS-53822: update github.com/golang-jwt/jwt #839
OCPBUGS-51544: Ignore SNYK-GOLANG-GOLANGORGXOAUTH2JWS-8749594 due to not being affected #829
OCPBUGS-52512: github.com/go-jose/go-jose/v4 v4.0.5 #826
Full changelog

cloud-network-config-controller

OCPBUGS-56359: Increase API call timeout to 30 second #172
Full changelog

cluster-authentication-operator

OCPBUGS-54655: Avoid duplicate OAuth client creation #766
Full changelog

cluster-autoscaler

OCPBUGS-60915: revert openshift replica fix #377
OCPBUGS-59267: Fix cool down status condition to trigger scale down #363
OCPBUGS-60609: fix checkpoint gc of unknown recommenders #372
OCPBUGS-54326: improve replica counting and decrease target size behavior #353
Full changelog

cluster-autoscaler-operator

OCPBUGS-52329: set max soft bulk taint count to zero #341
Full changelog

cluster-baremetal-operator

OCPBUGS-54546: Add missing relatedObjects #470
Full changelog

cluster-cloud-controller-manager-operator

OCPBUGS-60387: Add Service using common resource templating #411
OCPBUGS-60387: Update service selector to match deployment label #410
Full changelog

cluster-config-api

OCPBUGS-58392: Add IPsec API for NAT-T UDP encapsulation support #2393
OCPBUGS-56424: Add IdleConnectionTerminationPolicy field to IngressControllerSpec #2330
Full changelog

cluster-dns-operator

OCPBUGS-52498: [release-4.16] Add runbook_url for CoreDNSErrorsHigh #431
Full changelog

cluster-etcd-operator

OCPBUGS-61505: Vendor latest mixin, including additional and modified alerts for etcdDatabaseQuotaLowSpace #1482
OCPBUGS-60836: add missing ports to svc and pod spec #1473
OCPBUGS-53510: fix CVE-2025-30204 #1403
Full changelog

cluster-image-registry-operator

OCPBUGS-53870: bump github.com/golang-jwt/jwt #1219
OCPBUGS-51600: bump golang.org/x/oauth2 #1210
OCPBUGS-51167: ensure that storage names don’t end in dashes #1181
Full changelog

cluster-ingress-operator

OCPBUGS-56424: Add e2e tests for IdleConnectionTerminationPolicy #1235
OCPBUGS-56424: Add support for IdleConnectionTerminationPolicy #1234
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-60467: Add missing service ports to apiserver service #1895
OCPBUGS-50575: Increase waitForFallbackDegradedConditionTimeout #1805
Full changelog

cluster-kube-controller-manager-operator

OCPBUGS-60834: Missing endpoint slices for open ports the operator uses #864
Full changelog

cluster-network-operator

OCPBUGS-44443: Add controlplane cli image envar for use with hypershift #2791
OCPBUGS-58392: Add IPsec API for NAT-T UDP encapsulation support #2736
OCPBUGS-56992: iptables-alerter streamlining #2717
OCPBUGS-56195: Fix live migration with feature migration configured explicitly #2710
OCPBUGS-53317: Fix feature migration for EgressIP #2673
OCPBUGS-52952: Unexpected Behavior During Cluster Upgrade for the ovn-ipsec-host pods #2663
[Release 4.16] OCPBUGS-50712: Not update status.migration of the network.config CR to empty #2651
OCPBUGS-51074: Update egressfirewall CRD to be consistent with ovn-kubernetes repo #2650
Full changelog

cluster-samples-operator

OCPBUGS-55457: Adding mutex to func createSamples on handler.go #633
OCPBUGS-54420: add rhdmalone to owners #620
Full changelog

cluster-storage-operator

OCPBUGS-61252: add ability to control kube rbac proxy container image on controlplane #614
OCPBUGS-52353: fix Vsphere cluster Storage operator in Unavailable state #563
Full changelog

cluster-version-operator

OCPBUGS-58452: Failing=Unknown upon long CO updating #1213
OCPBUGS-55156: Fix a panic caused by a data race #1178
OCPBUGS-50590: Set openshift.io/required-scc: privileged annotation in version pods #1153
Full changelog

console

OCPBUGS-62123: Remove ancient X-XSS-Protection header #15528
OCPBUGS-61057: OpenShift console PVC clone cannot use B as the unit #15450
OCPBUGS-60175: Tolerate unknown fields in Infrastructur… #15368
OCPBUGS-60641: Secret key with binary file changes when edited via Console #15417
OCPBUGS-59869: Not able to launch terminal window from OCP web console due to console plugin conflicts #15334
OCPBUGS-57677: Update the golang.org/x/crypto/ssh to 0.31.0 in the openshift-console image #15328
OCPBUGS-60115: Cannot read properties of undefined (reading ‘node-role.kubernetes.io/master’) error while accessing node logs from console #15358
OCPBUGS-59358: fix bug where / in console.tab/horizontalNav href brea… #15286
OCPBUGS-37603: Manual backport of several incremental fixes for unauthenticated endpoints #15312
OCPBUGS-59274: Add the ability to launch multiple modals with useModal hook #15276
OCPBUGS-59445: Cannot read properties of undefined (reading ‘filter’) error while accessing nodes from console. #15291
OCPBUGS-58407: Add flags in console static plugin for all the components of this epic #15243
OCPBUGS-56838: Fetching taskRuns in PLR details page using PLR UID also #15099
OCPBUGS-58188: Fix TypeError Cannot read properties of null (reading ‘metadata’) #15214
OCPBUGS-57326: Remove logoutOpenShift method call #15172
OCPBUGS-57270: Debug pod logs are not accessible when debugging a node via OpenShift Console #15165
OCPBUGS-57096: Add all files to vendor regardless of gitignore #15133
OCPBUGS-57089: Sample segment sessions #15130
OCPBUGS-56858: remove 60 day alert from cluster update modal #15102
OCPBUGS-56715: update the Deployment pod on change in imageStream #15091
OCPBUGS-56472: Remove the devconsole backend common internet proxy and replace it with dedicated ones #15072
OCPBUGS-55378: Do not load CSRs if user does not have permissions #15000
OCPBUGS-55644: fix bug where operator appears twice #15016
OCPBUGS-45142: Add missing pipelines plugin name to known plugins #14550
OCPBUGS-48628: Added token to proxy header #14693
OCPBUGS-54174: Update the monitoring topic used by the console team #14900
OCPBUGS-52450: fix run time error when no completed version exists #14840
OCPBUGS-52851: Show Observe section without PROMETHEUS and MONITORING flags #14849
OCPBUGS-52288: While upgrading the cluster from UI observed Warning alert:Admission Webhook Warning #14821
OCPBUGS-49409: ERROR in search tool: Cannot read properties of undefined (reading ‘state’) #14703
OCPBUGS-52418: While accessing the node terminal from UI observed ‘Warning alert:Admission Webhook Warning` #14837
OCPBUGS-49979: Set default build option as BUILDS for Builder Image sample #14730
OCPBUGS-49800: Fix Function Import: An error occurred Cannot read properties of undefined (reading ‘filter’) #14715
OCPBUGS-49801: use default StorageClass for ServerlessFunction pipelineVolumeClaimTemplate #14716
OCPBUGS-46388: fix alert rule link #14808
OCPBUGS-52252: Fix alert rule link to alert in dev perspective #14817
OCPBUGS-46441: Do not pass CSV name to operand list page when an exen… #14627
OCPBUGS-36963: Manually create an API token for a ServiceAccount #14057
OCPBUGS-35394: sessions: fix sessions pruning #13969
Full changelog

console-operator

OCPBUGS-60794: Update downloads deployment configuration to use master node selector #1036
Full changelog

container-networking-plugins, containernetworking-plugins-microshift

OCPBUGS-55648: Check error returned by ipv6 SettleAddresses #188
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-58884: CARRY: don’t ignore json files #341
Full changelog

csi-external-snapshotter, csi-snapshot-controller, csi-snapshot-validation-webhook

OCPBUGS-60450: UPSTREAM: 1238: Snapshot Controller startup should not LIST all volumesnapshots #186
Full changelog

docker-builder

OCPBUGS-58074: S2I build cpu limits observed by assemble are limited to 1 cpu #475
OCPBUGS-53076: Upgraded Kubernetes dependency from 1.28.2 to 1.29.0 #468
OCPBUGS-42893, OCPBUGS-42914: buildah dependency bump to fix - Buildah allows arbitrary directory mount and symlink traversal vulnerability in the containers/storage library #450
Full changelog

docker-registry

OCPBUGS-60183: bump openshift/docker-distribution #441
OCPBUGS-53654: bump jwt and oauth dependencies #432
OCPBUGS-49696: bump docker distribution #423
Full changelog

gcp-machine-controllers

OCPBUGS-55249: Disable shielded VMs for non-UEFI disks #116
Full changelog

haproxy-router

OCPBUGS-56424: Add support for IdleCloseTerminationPolicy #655
OCPBUGS-49391: Reject All CA-Signed Certs Using SHA1 #651
Full changelog

hyperkube, pod

OCPBUGS-60553: [4.16]: podresources: list: use active pods #2454
4.16: OCPBUGS-60872: UPSTREAM: 127757: scheduler: Improve CSILimits plugin accuracy by using VolumeAttachments #2435
OCPBUGS-60272: Bump nfs server provisioner #2402
OCPBUGS-58054: UPSTREAM: 130047: adjusting loopback certificate validity in kube-apiserver #2342
OCPBUGS-58054: UPSTREAM: <carry>: disable some legacy cloud provider Azure tests #2352
OCPBUGS-57290: UPSTREAM: <carry>: Bump cadvisor version to fix kubelet #2325
OCPBUGS-49906: Bump k8s api to 1.29.14 #2211
Full changelog

hypershift

OCPBUGS-61860: Use the common MCE konflux pipeline #6844
OCPBUGS-60150: Always compress and encode payload in token secret for inplace upgrades #6750
OCPBUGS-60951: MCE 2.6 konflux hcp cli #6701
CNTRLPLANE-1203: HO MCE change to hermetic ta build #6654
CNTRLPLANE-1231: Move CPO pipeline to hermetic builds #6599
OCPBUGS-58505: [release-4.16] Add missing service network DNS entries to KAS cert #6393
OCPBUGS-57494: Add proxy variables for the MCD Pod #6286
OCPBUGS-55697: Add validation to avoid conflicts between KubeAPIServer and NamedCertificates SANs #6114
CNTRLPLANE-919: Konflux build pipeline service account migration #6087
CNTRLPLANE-919: Konflux build pipeline service account migration #6082
OCPBUGS-51804: Fix golang crypto dependency go.mod replacement #5994
OCPBUGS-54914: Add konnectivity-proxy sidecar to openshift-oauth-apiserver #6026
OCPBUGS-54632: Sync RBAC for attaching volumes on VM level #5998
OCPBUGS-49914: Reconcile proxy CA bundle into hosted cluster #5983
OCPBUGS-53902: bump golang-jwt v4 and v5 #5907
Red Hat Konflux update control-plane-operator-4-16 #5957
ART-11792: update go mod dependency for konflux #5922
OCPBUGS-51733, OCPBUGS-51804: Bump dependencies to OCP fork in backports #5901
OCPBUGS-53308: fix(deps): bump go-jose #5866
OCPBUGS-52506: refactor aws identity health check into new controller #5781
OCPBUGS-52857: Make managed-trust-bundle optional #5809
OCPBUGS-52426: change plaform to platform #5773
OCPBUGS-50993: Honor proxy vars in the util insecure http client #5662
OCPBUGS-46466: Consistently look up and dial cloud API hostnames #5301
OCPBUGS-50698: add region to AWS creds passed to operators managed by CPO #5670
OCPBUGS-51296: 4.17 Add HostedCluster additional trustbundles to konnectivity-https-proxy #5707
NO-JIRA: chore(deps): update dependency mkdocs-material to v9.6.5 #5686
OCPBUGS-50694: OCPBUGS-50692: Fix IsIPv4 function identifying also addresses instead of CIDRs #5620
NO-JIRA: chore(deps): update dependency mkdocs-material to v9 #5635
OCPBUGS-50557: Prevent IgnitionServer from flooding the API server with patch requests #5599
NO-JIRA: chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v9.5-1739267472 #5597
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-58737: bump github.com/golang/glog to version v1.2.4 #106
OCPBUGS-56063: tech debt: rework vendor patches #91
OCPBUGS-53910: bump github.com/golang-jwt/jwt/v4 to v4.5.2 #84
Full changelog

ibm-vpc-block-csi-driver-operator

OCPBUGS-59727: [IBM VPC] set offlineExpansion to false in e2e test manifest #149
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-51818: CVE-2025-22869 Update golang.org/x/crypto to patched OpenShift fork #109
Full changelog

insights-operator

OCPBUGS-61656: virt launcher logs gatherer (#1135) (#1138) (#1147) #1135
avoid possible Go panic when searching existing conditions (#1142) #1142
fix: incorrect anonymization of domains (#1119) #1119
feat: copy proxy envs from IO pod to gathering pods (#1108) #1108
OCPBUGS-60448: [release-4.16] Adding missing back-port changes from OCPBUGS issue (#1117) #1117
Full changelog

ironic

METAL-1306: Do not use openstack packages #648
Full changelog

ironic-agent

METAL-1306: Do not use openstack packages #180
Full changelog

kube-proxy, sdn

OCPBUGS-54457: Drop SYNACK as well in MCS side #658
OCPBUGS-44674: Handle openshift-host-network namespace as special when it modifies #648
OCPBUGS-46493: Raise the minSyncPeriod for NetworkPolicies to 10s during migration #649
Full changelog

kube-storage-version-migrator

NO-JIRA: Add DOWNSTREAM_OWNERS (release 4-16). #227
Full changelog

kubevirt-csi-driver

OCPBUGS-54632: Ensure volume stays attached through reboots #57
OCPBUGS-44622: During detach don’t return error if VM is not found #49
Full changelog

libvirt-machine-controllers

OCPBUGS-26525: Updating ose-libvirt-machine-controllers-container image to be consistent with ART for 4.16 #283
Full changelog

machine-api-operator

OCPBUGS-57210: Updates GCP CredentialsRequest #1378
OCPBUGS-55248, OCPBUGS-55249: Updates GCP credentials request #1355
OCPBUGS-53045: add image/read permissions #1348
OCPBUGS-52342: Drop oVirt support #1336
Full changelog

machine-config-operator

OCPBUGS-60621: Add workaround fix for static pod race #5252
OCPBUGS-56558: Log CRC MC deletion #5178
OCPBUGS-58270: Do not set cpu system reserve below the default value #5163
add missing vendors #4952
OCPBUGS-48283: Do not run resolv-prepender from NM dispatcher #4784
OCPBUGS-56868: daemon: fix ostree-finalize-staged race workaround for package mode RHEL workers #5090
OCPBUGS-56626: error from generateAndValidateRenderedMachineConfig function can be misleading #5075
OCPBUGS-54831: Make mtu-migration run after wait-for-primary-ip #4990
OCPBUGS-55684: MSBIC should not update windows machinesets #5028
OCPBUGS-35921: userCA and cloudCA certfiicates are not removed from nodes and ignition config #4419
OCPBUGS-53248: Enforce VIPs to be collocated at the same host #4923
OCPBUGS-53043: Enable nmstate-configuration on all platforms #4910
OCPBUGS-52952: Add ipsec connect wait service #4931
OCPBUGS-54163: Fixing typos for MachineConfigNode #4942
OCPBUGS-53434: Update ObservedGeneration in KubeletConfig #4935
OCPBUGS-53313: daemon: ensure ostree-finalize-staged is started before rebooting #4928
OCPBUGS-52421: Update format verbs for alert logs #4901
OCPBUGS-51347: Update the storage.conf configuration file template #4881
OCPBUGS-52593: Update cluster-reader ClusterRole permissions #4905
OCPBUGS-52404: create /run/nodeip-configuration before use #4897
OCPBUGS-52310: configure-ovs workaround for ovs-if-br-ex bug #4892
OCPBUGS-50862: Auto-recover from MC with invalid extension #4853
OCPBUGS-43680: Regenerate the rendered MC in use when deleted #4655
Full changelog

machine-os-images

OCPBUGS-54169: Change rhcos release browser url #57
Full changelog

monitoring-plugin

OCPBUGS-54316: Fix “Export as CSV” #469
Full changelog

multus-admission-controller

OCPBUGS-58767: Update the github.com/golang/glog module to v1.2.4 #103
Full changelog

multus-cni, multus-cni-microshift

OCPBUGS-47472: adds getcontext (backport 4.16) #261
Full changelog

multus-whereabouts-ipam-cni

OCPBUGS-55618: Fixes leftover podref issue #365
OCPBUGS-50005: [Release-4.17]Kubeconfig loop #340
Full changelog

must-gather

OCPBUGS-42960: Gather OSUS data #455
OCPBUGS-48082: Update owners #473
Full changelog

network-interface-bond-cni

OCPBUGS-61348: Bump github.com/containernetworking/plugins from to 1.7.1 #95
NO-JIRA: Updating ose-network-interface-bond-cni-container image to be consistent with ART for 4.16 #91
NO-JIRA: Add ci-operator.yaml file on release-4.16 #84
Full changelog

network-metrics-daemon

OCPBUGS-58777: Bump github.com/golang/glog to v1.2.4 (#113) #113
OCPBUGS-60186: Replace e2e test image (#122) #122
swtich golint install method (#123) #123
Full changelog

network-tools

add missing go vendors #140
Full changelog

nutanix-machine-controllers

OCPBUGS-51854: CVE-2025-22868 #110
OCPBUGS-47266: fixing CVE-2024-45338 #93
Full changelog

openshift-apiserver

OCPBUGS-61474: Skip blocked registry check for registries with mirrors #552
OCPBUGS-56612: Fix image reference in TestImageStreamImportQuayIO #516
Full changelog

openshift-controller-manager

OCPBUGS-60233: ignore error failing to find pull/push secrets #409
OCPBUGS-57513: Set node-pullsecrets volume to read-only to protect image pull credentials #394
OCPBUGS-56354: Empty proxy variables are causing issues during the build #382
Full changelog

openstack-cluster-api-controllers

OCPBUGS-58028: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.10 into release-4.16 #346
Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

OCPBUGS-58881: operatorgroup: ensure clusterroleselectors in clusterrole aggregation rules are sorted #1102
OCPBUGS-59647: Reduce Frequency of Update Requests for Copied CSVs (#3597) #1042
OCPBUGS-60847: Add NetworkPolicy as a supported kind #1050
OCPBUGS-61388: [4.16] e2e stability fixes #1083
OCPBUGS-57429: reduce cache expiry frequency [release-4.19] #1022
OCPBUGS-56358: fix(olm): improve error logging for missing olm.managed label (#3558) #1006
OCPBUGS-53395: Ensure that PSA label is latest instead of pinning versions #987
Full changelog

operator-marketplace

OCPBUGS-61920: Update memoryTarget on catalog source pods #664
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-60494: Update OWNERS file: Add Patryk/Martin as approvers #2718
OCPBUGS-58161: Unpin OVS patch versions #2648
OCPBUGS-57396: Fix predicate for cluster subnet route to gateway router #2645
OCPBUGS-55282: Fix hybrid overlay node subnets collision with cluster subnets #2621
OCPBUGS-48121: Increase InformerSyncTimeout to 60s #2624
OCPBUGS-56242: Handles unspecified protocol in network policy port #2571
OCPBUGS-56812: egressfirewall: avoid nil dereference on node delete #2591
OCPBUGS-52503: Fixes unexpected mp0 route removal during start up #2479
OCPBUGS-54204: Update OVN to FDP25.A.1 24.03.5-40. #2497
OCPBUGS-50595: kubevirt, localnet: Reduce live migration downtime #2469
OCPBUGS-50594: fixes overzealous deletion of SNAT in egressIP #2456
Full changelog

powervs-machine-controllers

OCPBUGS-61511: Use OS_GIT_VERSION in Makefile when found (for Konflux builds) #127
OCPBUGS-54752: Fix for CVE-2024-51744 in github.com/golang-jwt/jwt/v4 in release-4.16 #114
Full changelog

prometheus

OCPBUGS-61856: chore: compute highestTimestamp at queryManager level #270
OCPBUGS-56739: BACKPORT: fix promtool analyze block shows metric name with 0 cardinality #255
OCPBUGS-54942: Scraping: Bump cache iteration after error to avoid false duplicate detection. #250
Full changelog

route-controller-manager

OCPBUGS-56152: Added error event for failed ingress to route conversion #61
OCPBUGS-55201: ingress: Reset metrics when ingress is deleted #58
Full changelog

tests

OCPBUGS-61170: images/tests: Remove rteval #30203
NO-JIRA: Update extended/networking OWNERS #30091
OCPBUGS-60272: Bump kubernetes version to fix NFS ganesha version #30086
OCPBUGS-57311: Replace RunHostCmd with Exec function to censor bearer token being exposed #29908
OCPBUGS-57203: fix: remove un-needed test #29849
OCPBUGS-34163: Fix regex parser for censoring private key #29805
OCPBUGS-56704: aws/edge: prevent test using unschedulable nodes #29847
OCPBUGS-55476: support provider type external #29738
OCPBUGS-55636: [build] Ensure Git Clone Does Not Run Privileged #29746
OCPBUGS-54768: Fix egress firewall tests by updating the URL from docs.openshift.com to redhat.com #29663
OCPBUGS-52581: Use payload pullspec for image info test #29589
OCPBUGS-52343: Try also user CA for getting openshift-tests image #29578
Full changelog

vsphere-cluster-api-controllers

OCPBUGS-61653: Fix unit tests #72
Full changelog

vsphere-csi-driver-operator

OCPBUGS-51206: Set reconcile-sync to 10 minute for ListVolume #294
Full changelog

View changelog in Markdown or change previous release:

Source code for this page located on github