4.16.62

Manual Override Applied

This release was manually Accepted.

Reason: Manually accepted by ART

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.16.62-x86_64

Team Approvals:

Accepted
- QE

Tests:

Blocking jobs
- upgrade Succeeded (2 retries) periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
- upgrade-minor Failed (2 retries) periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
Informing jobs
- aws-ovn-serial Succeeded periodic-ci-openshift-release-main-nightly-4.16-e2e-aws-ovn-serial
- aws-ovn-upgrade-micro Succeeded periodic-ci-openshift-release-main-ci-4.16-e2e-aws-ovn-upgrade
- aws-sdn-upgrade-4.16-micro Succeeded periodic-ci-openshift-release-main-nightly-4.16-e2e-aws-sdn-upgrade
- azure-ovn-upgrade-4.16-micro Succeeded periodic-ci-openshift-release-main-ci-4.16-e2e-azure-ovn-upgrade
- driver-toolkit Succeeded periodic-ci-openshift-release-main-nightly-4.16-e2e-aws-driver-toolkit
- fips-scan Succeeded periodic-ci-openshift-release-main-nightly-4.16-fips-payload-scan
- gcp-ovn-rt-upgrade-4.16-minor Succeeded periodic-ci-openshift-release-main-ci-4.16-upgrade-from-stable-4.15-e2e-gcp-ovn-rt-upgrade
- hypershift-ovn-conformance-4.16 Failed (1 retry) periodic-ci-openshift-hypershift-release-4.16-periodics-e2e-aws-ovn-conformance
  - Attempt 1 Failed
  - Attempt 2 Failed
- metal-ipi-ovn-bm Succeeded periodic-ci-openshift-release-main-nightly-4.16-e2e-metal-ipi-ovn-bm
- metal-ipi-ovn-ipv6 Succeeded periodic-ci-openshift-release-main-nightly-4.16-e2e-metal-ipi-ovn-ipv6

Upgrades from:

Untested upgrades: 4.15.21, 4.15.22, 4.15.23, 4.15.24, 4.15.25, 4.15.26, 4.15.28, 4.15.29, 4.15.30, 4.15.31, 4.15.32, 4.15.33, 4.15.34, 4.15.35, 4.15.36, 4.15.37, 4.15.38, 4.15.39, 4.15.40, 4.15.41, 4.15.42, 4.15.44, 4.15.45, 4.15.46, 4.15.47, 4.15.48, 4.15.50, 4.15.51, 4.15.52, 4.15.53, 4.15.54, 4.15.55, 4.15.56, 4.15.57, 4.15.58, 4.15.59, 4.15.60, 4.15.61, 4.16.10, 4.16.11, 4.16.12, 4.16.13, 4.16.14, 4.16.15, 4.16.16, 4.16.17, 4.16.19, 4.16.20, 4.16.21, 4.16.23, 4.16.24, 4.16.25, 4.16.26, 4.16.28, 4.16.29, 4.16.3, 4.16.30, 4.16.32, 4.16.33, 4.16.34, 4.16.35, 4.16.36, 4.16.37, 4.16.38, 4.16.39, 4.16.4, 4.16.41, 4.16.42, 4.16.43, 4.16.44, 4.16.45, 4.16.46, 4.16.47, 4.16.48, 4.16.49, 4.16.5, 4.16.50, 4.16.51, 4.16.52, 4.16.53, 4.16.54, 4.16.55, 4.16.56, 4.16.57, 4.16.58, 4.16.6, 4.16.7, 4.16.8, 4.16.9

4.16.61 (changes) - S S S S F F S
4.16.60 (changes) - Failed
4.16.59 (changes) - Success
4.16.40 - Success
4.16.27 (changes) - Failed
4.16.18 (changes) - Success
4.16.2 (changes) - Success
4.16.1 (changes) - Failed
4.16.0 (changes) - Success
4.15.64 (changes) - F F F F
4.15.63 (changes) - Failed
4.15.62 (changes) - Success
4.15.49 (changes) - Failed
4.15.43 (changes) - Success
4.15.27 (changes) - Success
4.15.20 (changes) - Success
4.15.19 (changes) - Failed
4.15.18 (changes) - Success
4.15.0-0.nightly-2026-05-06-215654 (changes) - Success

Upgrades to:

4.17.54 (changes) - F F F F F S F
4.16.63 (changes) - S F F F F S S

Loading changelog, this may take a while ...

Changes from 4.16.40

Created: 2026-05-12 13:47:14 +0000 UTC

Image Digest: sha256:0fbc87f982298bacdf795058473d639d5766ebff83abc79268993f64223d55b0

Components

Kubectl 1.29.7
Kubernetes 1.29.14
Kubernetes Tests 1.29.0
Red Hat Enterprise Linux CoreOS upgraded from 416.94.202505051351-0 to 416.94.202605101426-0 (diff)

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
StreamingCollectionEncodingToJSON (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
StreamingCollectionEncodingToProtobuf (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)

Rebuilt images without code change

alibaba-cloud-controller-manager git 97e8335e sha256:af23fb7e17814c850ad382b5944904505aca845cf525cdb4a0b85f2a0f24014a
alibaba-machine-controllers git 248372a4 sha256:15612303bb0c9f0364b7ea3fc286b38b7255c081851fd0bb583e1e200612417d
apiserver-network-proxy git ca81b6a3 sha256:50fc0acdcdbb2bce1fd014e3e10a6077e08b693146226bc5ac820663597a6567
aws-cloud-controller-manager git a53e9def sha256:dabe90e4beb42aaaaded4b5b6766cafbd8f46ee2186143e5ed094d7d862d0587
aws-ebs-csi-driver git 1d29a74a sha256:9c94253b31416733f4a76e526a518748572eec163c906a69f46209fae9f82286
aws-kms-encryption-provider git c66065de sha256:4b0358e16d845b50b56a29ddbdc0ef6f1ba6861f14f49976a8dd4306e003195b
aws-pod-identity-webhook git 459c5314 sha256:b646d33aaf8fd67a8f1e048789466ce9e2905ff17553dba992ceff78fc8b26e8
azure-cloud-controller-manager git e5bac334 sha256:ee9e2e96d9c43418001d4b9ec3c71cc4d0fdb7c482fdf0d45cb73623edeff0a5
azure-cloud-node-manager git e5bac334 sha256:e6400430eb3401a1634532c95f629315f495a3d1aec08fb7fc773fee8f758ce0
azure-disk-csi-driver git 6b55f6fb sha256:3a181eb27673cd4af21d65eefcf892eb38d58e68b20c4e19eb345609fba91c7d
azure-file-csi-driver git 7a36778a sha256:f6f2f7cbb965ad93a0b20f1dbf3245a85d8a8c83a33d00fed304daef9480a48c
azure-kms-encryption-provider git af633e05 sha256:b774ddc29d0a1f10d76dd2231b8db55d9bbdbaebe35224da220e2f44009d80b3
azure-workload-identity-webhook git 5b8d171e sha256:487deb27e7aadd2d52e1ec6c09f0570a2fd486e712a9e09bf858e4e6dc5aa8dc
cluster-authentication-operator git 0e39ace5 sha256:cb4a8157b1571965dcdbc95020bd72e6fa202a05cfa0d03fe5b13378d0733fd7
cluster-autoscaler-operator git 70164fc6 sha256:90bc2412a47dbf9f36608ce2dde4aaf94c21995dd121df38eb4035f1bc68c48c
cluster-bootstrap git 27bfb59f sha256:5e341b8bff42a8893c9761443314bf4a8c3137b6a4370ccfc069e8e4fbb879b3
cluster-capi-controllers git 5830a10a sha256:715a969a24169a9f6ba3a9cff52277d0cd2641b4036dc5b40028efd3f1237eca
cluster-capi-operator git c699f6cf sha256:6ae6af21b9f4fed299b13801fdbd14a162e41ee5572dc869a6816e5d09034ba3
cluster-config-operator git 441d29c9 sha256:6b2fa9cac5bbfd4dbe5fa252b50ae119a5b56788a0fdce7a37a38f6178985a45
cluster-control-plane-machine-set-operator git 14571e8a sha256:d7c9a6f9dbfe6cb833597ccdd4a420612329702783461b6bf56ec7044fcfc7b4
cluster-csi-snapshot-controller-operator git 439826e1 sha256:93318234277fd99b04e7fdf247267411491b767082613535dc8c49a85319bbb2
cluster-dns-operator git a4b1cfb4 sha256:c69f820e116aacf27bb36997f3df011d0e50d4496542415f5fdfc26e5f9270d2
cluster-kube-cluster-api-operator git 95ceaa9e sha256:52fb3ef8a2b0e9d388182b62ce644027e05609eb1583e3d7cdf850c2d7ff5782
cluster-machine-approver git 7685374f sha256:637c84da0420da976ffe69236a0c1b2783702bc32869415d5ea8bfb394434585
cluster-olm-operator git 27bf70dd sha256:5d78f104e3261f4abbb1d8b944face9986ad0230cced858656dca0f1b214b94b
cluster-openshift-controller-manager-operator git 2ed3cf99 sha256:c96433f7cef823aec98589e8ebb54cc07bbae645a8ed60ee21a81d04199ab751
cluster-policy-controller git eaea543f sha256:814eab238f0b1edd080dcf6ffb7867917a44c471454db7de3cc7c8d38a24a3cd
cluster-update-keys git e8478585 sha256:1d015b226422555f2a495b5c3f415dfc412850b2df2da37029c2e0229cc55083
configmap-reloader git dc91ddc4 sha256:a154742ab1912e82ed00eb75e31146963edb0758da0488be70ec2a5a3573a86c
csi-driver-manila-operator git c25d1ff2 sha256:16bdd915575979401f6d3d9f80bb0fb2f5f26e3136fa0ac0d30f99063d3c53de
csi-driver-nfs git 406cec72 sha256:e6805bfa216a458cde43d6ac472265b8335facc84d72cd624fd975c61ff98410
csi-driver-shared-resource git bc125def sha256:8e7e29bb6adf2fe2319a1efa1feb26209fb2719e1e786f1853fa50ca8219bd95
csi-driver-shared-resource-operator git 1e1194bc sha256:ee0d8880be24112ea81d7f599880eec9ba74f32bbd48fe8ead03c1e8a849c9a8
csi-driver-shared-resource-webhook git bc125def sha256:5dab4ffeda9a12f427d01c57f760f17efa285a51879895d3433b56e629d43ba1
csi-external-attacher git 7da80aab sha256:cd76d1c4002c17bc27eb0a654a258dd58d26becc09cad5e0d0b164d4f64d54ca
csi-external-provisioner git 9e8af011 sha256:3ef70e4958d12eb48e24a3a808ce65842d0089b613e1c58126300985ce53cc44
csi-livenessprobe git f5e3ff55 sha256:8cafd0a0840d5aaed8d3b80f7d00b2c56d4381729fdd45a9e5769a9cfe9cd62a
driver-toolkit git 1d5732f0 sha256:0a2b4d380cc796378a01249a8234ba1000f6d882b6e9476b976fb311e8bccc50
egress-router-cni git 7089efe6 sha256:fedf04db6bea594305e0319bcc05734f4af1f3eee14855b86e4c5b82fcdb0216
etcd git e7911c0d sha256:869bc49240c5a85c20671e4ea4c3a24de3eac7991e1202574134cc4ce33ceccd
gcp-cloud-controller-manager git 26b43dfc sha256:8a03d52f67d2625310ee257ea0a371d3f70046057254f6cc5208dbc380fe91e8
gcp-machine-controllers git 8851888a sha256:a8f5eecc6550049daf5d72e8aaa0651da743ca3c3177dce05ed22483decb5e89
gcp-pd-csi-driver-operator git 799327f7 sha256:3aaf708d990b2ffe3b1dcecb7fde6eeade76ed268a0825016cdc1b57dfab3b02
ibm-cloud-controller-manager git f961f16d sha256:eb8c6faa7b109106c46e768e6dec85c46580e935424def7390c1fcfec256ebb4
ibmcloud-machine-controllers git d29506e7 sha256:e20bf05006e08597fd91fcfaa29d70632d8479b647071109a8b47fad854ed76b
ironic-machine-os-downloader git 93b8b5fa sha256:0aa9f5962671a9c0276fa07f3066156f65cde83c5f0b3147763e313cf130c432
ironic-static-ip-manager git f44e8a08 sha256:24b42241b2c91b0d8a174b1fe4abefee32ed98def4f59bea1d042f3b5551418a
k8s-prometheus-adapter git e4f859be sha256:6b9e0a0e538e9681818e0e3ca237f0290efebade48b446a68c5a9c4d388772b4
keepalived-ipfailover git b58673a3 sha256:bc556ff16d874b48165c1f666b0dbd7d8849ab5075466a7ecdca4e1610950d47
kube-metrics-server git 9116b918 sha256:ed37d969a33abb64a3c02a6936ac8ea1168c7bd55618f4926b9f94a1b7b97f93
kube-rbac-proxy git c38f4734 sha256:25c2203942368645f58ef832c4a91ac18bfd0b2c4453058fe4d1732d8ae832e9
kubevirt-cloud-controller-manager git 3db76104 sha256:ab7c563f68b9ab5f8aa090c561d0bb280540dd1d23557dcfbe2ef7e58ce379b1
kubevirt-csi-driver git d474c42e sha256:a82be0b25bfd303b3f83d85dc3de515729a459e88937518c9ec304799993eb5f
machine-os-images git a99847b4 sha256:5b69952888f74646ab9f5b3073ab5f20141cb28c3d1e16f188c82cb3ee1c7498
multus-networkpolicy git f988f894 sha256:0dea6a147e017b54440b66d254d85ab18aac7f70f32c6f0d267e3589b0538181
multus-route-override-cni git 73594f77 sha256:f2dda535722e09b6fbd11cf54ea22af92ee053641d6467bd6a9ebad23f3ef9c6
network-tools git 234ed43e sha256:53db2f46533d63be16c7185abd332c7ef1dd290429c1a070ceff11ba661132bb
nutanix-cloud-controller-manager git 28bf5963 sha256:8697516d27df1ddd94b219c9a8e7221a20f59bab8ec03d8a8dbd439e3e4db578
oauth-server git 3739138c sha256:29adc976cecdd4523006fb2d783577f2f476df725af06f3e480c267f2bde3889
oc-mirror git b137a53a sha256:ffb1f3cc7d21907a34fd897cb81870cc12f55a2ddf017bcb9f9a0e7726139f49
olm-catalogd git 79975a51 sha256:2853d2df3459be835aa068732b74d3fb7c07e3ebc4f0bf78da9f4f75eced69ad
olm-operator-controller git 80b8649c sha256:f9fd1a216c031146f4b42031b6ce6827fa3a292637f9e43cee5123d08f835821
olm-rukpak git 282cc84c sha256:c6076ae8b41f39468b1a0fb582b1ff0493120be860240b693c9a210dada8b7da
openshift-state-metrics git 59b8a0ff sha256:fe02214cb9b08e8585484c2639c0fa12b94a81826fbb83e2b91c6c846b49017a
openstack-cinder-csi-driver-operator git 85b52097 sha256:0ff1efd5e27727bec1243581ba9bdf8347900dbab8d7840c3371a647b93ede50
ovirt-csi-driver git 1db726a9 sha256:687f3046fc194c473c6a43267cad2d3a70d4d6895c9e67da77124b1d5d5e8cfa
powervs-block-csi-driver git 26162bad sha256:723b70e12c81f5547baff17c79e21f55940b45f56de4c23836e0251c4a589ba6
powervs-block-csi-driver-operator git 9c5dd8d1 sha256:f4b5d7d6690ad95f5aababffbba48481811bde9877eda44a7f5274fc0d846dbb
powervs-cloud-controller-manager git 20e6dc70 sha256:c85b61fa2ef44e6602bac114f24338fd64d32f14412d07f32b703cde472a82ef
prom-label-proxy git 5e14722e sha256:891a8d949e70a885f1229edda841abc2b46587b0ae43fa8aea5744dada70068e
prometheus-config-reloader git c7262a43 sha256:4e3847e320c34579d033224e1b6bb0ca13d009dcfcf14a48052a7c5d0dc8d403
prometheus-node-exporter git 29ba26d1 sha256:05f6ea8da767cd4f16b5da151f7c25741f2778c7c7f95f17af7156c37550f8c1
prometheus-operator git c7262a43 sha256:b74cefcb20c675ba37a70ec91e83b415a3845161ca61a2dc4ef3c28ef6147b13
prometheus-operator-admission-webhook git c7262a43 sha256:a6c81b92a91622c230c3fe8304c34a428caef0c95ce9098bf25e5eb996872a9c
rhel-coreos sha256:2006b687d868a3e406d302d31a2032fa950480fa3ff4b6a5102d161c02aca82c
rhel-coreos-extensions sha256:68efeb029f2c242eeed719e556f1c6c46075d2f296a06091792f94d619eb3293
service-ca-operator git 538c7b98 sha256:f4a56dbdfb7d1dac97123cee5f8690b19c2ff488223f30b79e5c66e76dd44224
telemeter git c1ecd105 sha256:52313a21fbbc61281ab873b19c3c330ca9c6c93784036dd17af4159abbfb9d39
thanos git 85eee25c sha256:8b44ec30ce60df51e6bdade6f0f4e1d202bb38cd0f950b9e1f9e3a8306fee4db
vsphere-csi-driver-operator git 7940ea16 sha256:d51a50847348f9fdac8dcbf728bad2c73d5bb3d8b2a9eb65f122dbb49c99c012
vsphere-problem-detector git 3683c120 sha256:663e9a8106c3b7c4daa1438bf90818cc295e53544394dca93026ccab945a372c

agent-installer-api-server

OCPBUGS-58631, OCPBUGS-58636: Bump glog to v1.2.5 in release-4.16 (#7901) #7901
OCPBUGS-47627: dnsmasq service on OCP SNO fails to read /etc/resolv.conf file during system startup (#7857) #7857
Full changelog

agent-installer-node-agent

run go mod tidy / vendor #1019
And 2 elided commits (e.g. from squash or rebase merges)
Full changelog

agent-installer-utils

OCPBUGS-68046: bump github.com/sirupsen/logrus to v1.9.3 #239
Full changelog

aws-cluster-api-controllers

OCPBUGS-78227: [release-4.16] update go mod dependency for konflux #591
OCPBUGS-61942: UPSTREAM <carry>: revert: Only tag NetworkInterfaces in RunInstances if IAM Allows It #572
OCPBUGS-58666, OCPBUGS-58671: bump github.com/golang/glog to v1.2.5 #560
Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator

OCPBUGS-64831: Use 127.0.0.1 for healtz http-endpoints #467
OCPBUGS-64768: Add RBAC ClusterRole and Binding for driver node #465
OCPBUGS-61253: add ability to control kube rbac proxy container image… #426
OCPBUGS-60598: Bump library-go #423
OCPBUGS-59606: Backport stale conditions fix #407
OCPBUGS-60248: add tag matching to Azure File storage class #414
Full changelog

aws-machine-controllers

OCPBUGS-73903: Fix reconciler consistency checks in Update and Exists #168
OCPBUGS-63140: client: re-use a single file for building the session instead of randomly named files #144
Full changelog

azure-cluster-api-controllers

OCPBUGS-78176: [release-4.16] update go mod dependency for konflux #364
Full changelog

azure-machine-controllers

OCPBUGS-66044: Set updateDomainCount to one when faultDomainCount is one #177
OCPBUGS-52476: Remove unused vnet package #131
OCPBUGS-56169: [release-4.16] Update virtualmachines service to armcompute/v5 SDK #147
OCPBUGS-56656: Fix failure when attempting to modify immutable availabilitySet #151
OCPBUGS-56092: Update eviction policy for Spot VMs from Deallocate to Delete #142
Full changelog

baremetal-installer, installer, installer-altinfra, installer-artifacts

OCPBUGS-74885: Azure UPI ARM template: use storageAccountId #10282
OCPBUGS-76586: terraform/provider/google: Fixing GCP inconsistencies present with the service account creation #10298
OCPBUGS-73879: data/manifests/bootkube/cvo-overrides: Default to eus-4.16 #10226
OCPBUGS-54165: aws: fix NLB creation in secret regions #10031
OCPBUGS-53237: Validation for API and Ingress VIPs when using user-managed load balancer #10048
OCPBUGS-62952: Update the RHCOS 4.16 bootimage metadata #10022
OCPBUGS-62653: Release 4.16 bump terraform provider azurerm #9993
OCPBUGS-59162: vSphere - remove unit tests using nip.io #9835
OCPBUGS-62235: Make swift containers removal not fatal for UPI. #9961
OCPBUGS-58290: sort zone slices extracted from map of byo subnets #9819
OCPBUGS-55807: update resolv.conf every time on bootstrap node #9694
OCPBUGS-57460: vsphere - check if host is powered down or on standby before uploading template #9786
OCPBUGS-36677: Power VS: Enable incoming traffic on port 5000 during installation in a restricted network #8711
OCPBUGS-57498: ensure ctrplane nodes can access bootstrap MCS #9788
OCPBUGS-54240: Update timeout for GCP WaitFor operation #9715
Full changelog

baremetal-machine-controllers

OCPBUGS-78099: [release-4.16] fix vendor/ for hermetic migration 4.16 #243
Full changelog

baremetal-operator

OCPBUGS-77278: Unblock BMH direct deletion when detached annotation is present #463
Full changelog

baremetal-runtimecfg

OCPBUGS-60113: Re-add ENABLE_NODEIP_DEBUG env var #362
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-64616: Help with must-gather scheduling through suggesting preferance of nodes #2151
OCPBUGS-64561: Update go-jose, x/crypto, x/net #2144
OCPBUGS-59938: Adding sos.conf file for default sos config into the tools image #2064
OCPBUGS-60675: Use fedora image in unit tests instead of centos #2079
Full changelog

cloud-credential-operator

OCPBUGS-65802: ccoctl azure: retry custom role creation on consistency errors #952
OCPBUGS-63550: ccoctl: add public-key-file flag to create-all #940
OCPBUGS-55129: snyk to ignore SNYK-GOLANG-GOLANGORGXNETHTML-9572088 #918
OCPBUGS-60973: ccoctl: aws to use proper issuer url on subsequent runs #909
OCPBUGS-60861: ccoctl: only add owned tag to azure resources on create #902
OCPBUGS-58676: github.com/golang/glog v1.2.5 #893
OCPBUGS-56981: Azure: resolve nil pointer exception when role assignment exists #867
Full changelog

cloud-network-config-controller

OCPBUGS-66346: [release-4.16] Fix capacity calculation #195
OCPBUGS-65567: [release-4.16] Change the capacity struct from int to ptrOfInt #192
OCPBUGS-56359: Increase API call timeout to 30 second #172
Full changelog

cluster-autoscaler

OCPBUGS-78702: allow clusterapi provider to skip paused resources #415
OCPBUGS-60915: revert openshift replica fix #377
OCPBUGS-59267: Fix cool down status condition to trigger scale down #363
OCPBUGS-60609: fix checkpoint gc of unknown recommenders #372
Full changelog

cluster-baremetal-operator

OCPBUGS-77447: Bump github.com/go-errors/errors to v1.5.1 #562
OCPBUGS-64741: Always have a service for ironic-api port #524
OCPBUGS-63417: Fix ironic inspector container privileges #513
OCPBUGS-61504: Remove webhookport (9447) as HostPort #506
Full changelog

cluster-cloud-controller-manager-operator

OCPBUGS-63168: ccm: disable unused secure-serving port and webhook #422
OCPBUGS-60387: Add Service using common resource templating #411
OCPBUGS-60387: Update service selector to match deployment label #410
Full changelog

cluster-config-api

CNTRLPLANE-1982: Promote streaming list encoding to Default #2600
OCPBUGS-71202: Add HTTPKeepAliveTimeout to IngressController API #2640
NO-JIRA: Promote streaming list encoding to Default on Hypershift. #2568
CNTRLPLANE-1611: Add feature gates for StreamingCollectionEncoding #2542
OCPBUGS-58392: Add IPsec API for NAT-T UDP encapsulation support #2393
OCPBUGS-56424: Add IdleConnectionTerminationPolicy field to IngressControllerSpec #2330
Full changelog

cluster-etcd-operator

OCPBUGS-68058: Update logrus to 1.9.3 to address CVE-2025-65637 #1546
OCPBUGS-61505: Vendor latest mixin, including additional and modified alerts for etcdDatabaseQuotaLowSpace #1482
OCPBUGS-60836: add missing ports to svc and pod spec #1473
Full changelog

cluster-image-registry-operator

OCPBUGS-68059: : Bump github.com/sirupsen/logrus to v1.9.1 #1285
OCPBUGS-53870: bump github.com/golang-jwt/jwt #1219
OCPBUGS-51600: bump golang.org/x/oauth2 #1210
Full changelog

cluster-ingress-operator

OCPBUGS-71202: Implement HTTPKeepAliveTimeout tuning option #1337
OCPBUGS-56424: Add e2e tests for IdleConnectionTerminationPolicy #1235
OCPBUGS-56424: Add support for IdleConnectionTerminationPolicy #1234
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-68064: CVE-2025-65637 openshift4/ose-cluster-kube-apiserver-rhel9-operator: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload [openshift-4.16.z] #2043
OCPBUGS-60467: Add missing service ports to apiserver service #1895
Full changelog

cluster-kube-controller-manager-operator

OCPBUGS-60834: Missing endpoint slices for open ports the operator uses #864
Full changelog

cluster-kube-scheduler-operator

CNTRLPLANE-2843: chore: update OWNERS #624
Full changelog

cluster-kube-storage-version-migrator-operator

OCPBUGS-68069: Bump github.com/sirupsen/logrus to v1.9.1 #144
Full changelog

cluster-monitoring-operator

OCPBUGS-77276: AlertingRule: fix duplicate PrometheusRules after MD5->SHA-224 naming change #2831
OCPBUGS-64581: Fix KSM deny-list typo #2733
OCPBUGS-64637: Add mcd_local_unsupported_packages metric from MCO to telemetry 4.16 #2735
OCPBUGS-62765: port metric acm_managed_cluster_worker_cores:max to OCP 4.16 #2719
OCPBUGS-63235: test: remove image registry e2e tests #2727
OCPBUGS-61856: chore(jsonnet): use prometheus_remote_storage_queue_highest_timestamp_seconds in PrometheusRemoteWriteBehind #2676
Full changelog

cluster-network-operator

OCPBUGS-75890: Tweak iptables-alerter to try to avoid crictl bug #2898
: NO-JIRA: Update CNO reviewers/approvers #2768
OCPBUGS-63155: Add drop flows for GARPs #2819
OCPBUGS-57354: block upgrade if a CNI migration is in progress #2760
OCPBUGS-62055: Update CNO reviewers/approvers #2803
OCPBUGS-44443: Add controlplane cli image envar for use with hypershift #2791
OCPBUGS-58392: Add IPsec API for NAT-T UDP encapsulation support #2736
OCPBUGS-56992: iptables-alerter streamlining #2717
OCPBUGS-56195: Fix live migration with feature migration configured explicitly #2710
Full changelog

cluster-node-tuning-operator

OCPBUGS-78766: [4.16] PPC: filter out namespaces dir #1466
Full changelog

cluster-openshift-apiserver-operator

OCPBUGS-68072: CVE-2025-65637 - Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.16] #654
Full changelog

cluster-samples-operator

OCPBUGS-63516: references to github.com/sclorg/django-ex.git now also refer to the branch #659
Full changelog

cluster-storage-operator

OCPBUGS-78769: Add patch permission to provisioner role #685
OCPBUGS-61252: add ability to control kube rbac proxy container image on controlplane #614
Full changelog

cluster-version-operator

OCPBUGS-58452: Failing=Unknown upon long CO updating #1213
Full changelog

console

OCPBUGS-83299: [release-4.16] openshift4/ose-console-rhel9: Axios: Remote Code Execution via Prototype Pollution escalation #16298
OCPBUGS-78673: Namespace is not persisting when switching to developer view from the topology page of admin page #16161
CONSOLE-5011: migrate to yarn berry #16078
OCPBUGS-76578: Bump axios #16032
NO-JIRA: Bump builder image to v29 #15993
OCPBUGS-74447: Bump lodash to latest #15967
OCPBUGS-69678: Disallowed Pipelines-plugin Pipelines navigation section #15857
OCPBUGS-64884: Remove required flag from ‘console.flag/model’ pipelines-plugin extension #15707
OCPBUGS-64649: /auth/error?error=missing_state&error_type=auth is showing blank page #15675
OCPBUGS-44157: bump dompurify to latest #15591
OCPBUGS-62123: Remove ancient X-XSS-Protection header #15528
OCPBUGS-61057: OpenShift console PVC clone cannot use B as the unit #15450
OCPBUGS-60175: Tolerate unknown fields in Infrastructur… #15368
OCPBUGS-60641: Secret key with binary file changes when edited via Console #15417
OCPBUGS-59869: Not able to launch terminal window from OCP web console due to console plugin conflicts #15334
OCPBUGS-57677: Update the golang.org/x/crypto/ssh to 0.31.0 in the openshift-console image #15328
OCPBUGS-60115: Cannot read properties of undefined (reading ‘node-role.kubernetes.io/master’) error while accessing node logs from console #15358
OCPBUGS-59358: fix bug where / in console.tab/horizontalNav href brea… #15286
OCPBUGS-37603: Manual backport of several incremental fixes for unauthenticated endpoints #15312
OCPBUGS-59274: Add the ability to launch multiple modals with useModal hook #15276
OCPBUGS-59445: Cannot read properties of undefined (reading ‘filter’) error while accessing nodes from console. #15291
OCPBUGS-58407: Add flags in console static plugin for all the components of this epic #15243
OCPBUGS-56838: Fetching taskRuns in PLR details page using PLR UID also #15099
OCPBUGS-58188: Fix TypeError Cannot read properties of null (reading ‘metadata’) #15214
OCPBUGS-57326: Remove logoutOpenShift method call #15172
OCPBUGS-57270: Debug pod logs are not accessible when debugging a node via OpenShift Console #15165
OCPBUGS-57096: Add all files to vendor regardless of gitignore #15133
OCPBUGS-57089: Sample segment sessions #15130
OCPBUGS-56858: remove 60 day alert from cluster update modal #15102
OCPBUGS-56715: update the Deployment pod on change in imageStream #15091
OCPBUGS-56472: Remove the devconsole backend common internet proxy and replace it with dedicated ones #15072
Full changelog

console-operator

OCPBUGS-77992: update go mod dependency for konflux #1115
OCPBUGS-60794: Update downloads deployment configuration to use master node selector #1036
Full changelog

container-networking-plugins, containernetworking-plugins-microshift

OCPBUGS-55648: Check error returned by ipv6 SettleAddresses #188
Full changelog

coredns

OCPBUGS-77463: Modify .gitignore to not exclude vendor build folders #168
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-68080: fix CVE-2025-65637 #361
OCPBUGS-58884: CARRY: don’t ignore json files #341
Full changelog

csi-external-resizer

OCPBUGS-62465: Requeue PVC over PV creation #174
Full changelog

csi-external-snapshotter, csi-snapshot-controller, csi-snapshot-validation-webhook

OCPBUGS-60450: UPSTREAM: 1238: Snapshot Controller startup should not LIST all volumesnapshots #186
Full changelog

csi-node-driver-registrar

OCPBUGS-64632: update log level verbosity to not clutter logs #91
Full changelog

docker-builder

OCPBUGS-65907: BuildConfig inline Dockerfile fails with heredoc syntax #489
OCPBUGS-58074: S2I build cpu limits observed by assemble are limited to 1 cpu #475
Full changelog

docker-registry

OCPBUGS-60183: bump openshift/docker-distribution #441
OCPBUGS-53654: bump jwt and oauth dependencies #432
Full changelog

gcp-cluster-api-controllers

OCPBUGS-78280: [release-4.16] update go mod dependency for konflux #267
Full changelog

gcp-pd-csi-driver

OCPBUGS-68087: Update logrus to 1.9.3 #92
Full changelog

haproxy-router

OCPBUGS-56424: Add support for IdleCloseTerminationPolicy #655
OCPBUGS-49391: Reject All CA-Signed Certs Using SHA1 #651
Full changelog

hyperkube, pod

OCPBUGS-68041, OCPBUGS-68091: CVE-2025-65637 - bump github.com/sirupsen/logrus to v1.9.3 [4.16] #2582
OCPBUGS-74299: Skip E2e: attach on previously attached volumes should work #2568
OCPBUGS-65694: Fix Concurrentmap Iteration #2519
CNTRLPLANE-1612: Backport StreamingCollectionEncoding for JSON and protobuf #2485
OCPBUGS-61908: UPSTREAM: <carry>: Don’t retry storage calls with side effects. #2470
OCPBUGS-60553: [4.16]: podresources: list: use active pods #2454
4.16: OCPBUGS-60872: UPSTREAM: 127757: scheduler: Improve CSILimits plugin accuracy by using VolumeAttachments #2435
OCPBUGS-60272: Bump nfs server provisioner #2402
OCPBUGS-58054: UPSTREAM: 130047: adjusting loopback certificate validity in kube-apiserver #2342
OCPBUGS-58054: UPSTREAM: <carry>: disable some legacy cloud provider Azure tests #2352
OCPBUGS-57290: UPSTREAM: <carry>: Bump cadvisor version to fix kubelet #2325
Full changelog

hypershift

OCPBUGS-76534: feat(updates): enable CVO metrics access with RHOBS monitoring flag #7704
OCPBUGS-74375, OCPBUGS-74376: Support proxy authentication when user/pass is included in URL #7578
OCPBUGS-73118: Fix Konflux EC voilation, update deprecated base … #7459
OCPBUGS-63640: [release-4.16] fix(konnectivity): resolve circular dependency causing DNS timeouts and excessive retries #7113
OCPBUGS-64680: Update DNS names for ovn-kubernetes cp metrics #7158
CNTRLPLANE-1904: Migrate 4.16 pipelines to common pipeline template #7212
CNTRLPLANE-1426: feat(konflux): tag MCE HO images with latest #6839
OCPBUGS-61252: dont use registryOverrides on kube rbac proxy image be… #6756
OCPBUGS-61582: Update KCM node monitor grace period #6797
OCPBUGS-61860: Use the common MCE konflux pipeline #6844
OCPBUGS-60150: Always compress and encode payload in token secret for inplace upgrades #6750
OCPBUGS-60951: MCE 2.6 konflux hcp cli #6701
CNTRLPLANE-1203: HO MCE change to hermetic ta build #6654
CNTRLPLANE-1231: Move CPO pipeline to hermetic builds #6599
OCPBUGS-58505: [release-4.16] Add missing service network DNS entries to KAS cert #6393
OCPBUGS-57494: Add proxy variables for the MCD Pod #6286
OCPBUGS-55697: Add validation to avoid conflicts between KubeAPIServer and NamedCertificates SANs #6114
CNTRLPLANE-919: Konflux build pipeline service account migration #6087
CNTRLPLANE-919: Konflux build pipeline service account migration #6082
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-77210: [release-4.16] standardize build paths #124
OCPBUGS-58737: bump github.com/golang/glog to version v1.2.4 #106
OCPBUGS-56063: tech debt: rework vendor patches #91
Full changelog

ibm-vpc-block-csi-driver-operator

OCPBUGS-59727: [IBM VPC] set offlineExpansion to false in e2e test manifest #149
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-67288: [release-4.16] Fix incomplete vendor/ #138
OCPBUGS-51818: CVE-2025-22869 Update golang.org/x/crypto to patched OpenShift fork #109
Full changelog

insights-operator

OCPBUGS-68370: Add filtering to add other possible pod status to QEMU gatherer #1200
OCPBUGS-67009: QEMU logs are not gathered if there are pending status virt-launcher pods #1197
And 5 elided commits (e.g. from squash or rebase merges)
Full changelog

ironic

OCPBUGS-69789: Bump eventlet version to 0.33.1-7 #763
Full changelog

ironic-agent

OCPBUGS-61165: netutils: Use ethtool ioctl to get permanent mac address #215
OCPBUGS-69781: Bump eventlet version to 0.33.1-7 #232
Full changelog

kube-proxy, sdn

OCPBUGS-54457: Drop SYNACK as well in MCS side #658
Full changelog

kube-state-metrics

OCPBUGS-74875: Deduplicate CRS stores #133
Full changelog

kube-storage-version-migrator

NO-JIRA: Add DOWNSTREAM_OWNERS (release 4-16). #227
Full changelog

libvirt-machine-controllers

OCPBUGS-77196: Fix incomplete vendor/ #302
OCPBUGS-26525: Updating ose-libvirt-machine-controllers-container image to be consistent with ART for 4.16 #283
Full changelog

machine-api-operator

OCPBUGS-76849: bumped logrus to v1.9.3 #1463
OCPBUGS-57210: Updates GCP CredentialsRequest #1378
Full changelog

machine-config-operator

OCPBUGS-77253: Machine-config controller should not log about non-existent pull-secret changes #5694
OCPBUGS-77184: machine-config-daemon: openshift: Exposure of Sensitive Data in Log Files in the Machine Configuration Daemon. [openshift-4] #5685
OCPBUGS-63155: [release-4.16] Networking: reset ovn-remote config and allow ovnkube controller to set it #5359
OCPBUGS-60773: scope MCD node listers to current node #5260
OCPBUGS-63553: Add control-plane label for master nodes on legacy clusters #5376
OCPBUGS-57423: pkg/operator/status: Drop PoolUpdating as an Upgradeable=False condition #5119
OCPBUGS-63332: Recheck generatedByControllerVersion annotation prior to deleting a degraded MC #5364
OCPBUGS-56753: Support NODEIP_HINT in IPI deployments too #5079
OCPBUGS-62689: Add mcd_local_unsupported_packages recording rule #5328
OCPBUGS-59931, OPNET-681: Support migration to NMState #5205
OCPBUGS-61869: Override NMState service definition #5290
OCPBUGS-60621: Add workaround fix for static pod race #5252
OCPBUGS-56558: Log CRC MC deletion #5178
OCPBUGS-58270: Do not set cpu system reserve below the default value #5163
add missing vendors #4952
OCPBUGS-48283: Do not run resolv-prepender from NM dispatcher #4784
OCPBUGS-56868: daemon: fix ostree-finalize-staged race workaround for package mode RHEL workers #5090
OCPBUGS-56626: error from generateAndValidateRenderedMachineConfig function can be misleading #5075
Full changelog

machine-image-customization-controller

OCPBUGS-68093: [4.16] uplift logrus #153
Full changelog

monitoring-plugin

OU-1260: [release-4.16] feat: use npm instead of yarn #813
OCPBUGS-76807: fix for CVE-2025-69873 #849
OCPBUGS-54316: Fix “Export as CSV” #469
Full changelog

multus-admission-controller

OCPBUGS-58767: Update the github.com/golang/glog module to v1.2.4 #103
Full changelog

multus-cni, multus-cni-microshift

OCPBUGS-47472: adds getcontext (backport 4.16) #261
Full changelog

multus-whereabouts-ipam-cni

OCPBUGS-70215: Prevent accidental IP deallocation in statefulsets #396
OCPBUGS-55618: Fixes leftover podref issue #365
Full changelog

must-gather

OCPBUGS-66106: Separate resources with comma to fix malformed inspect #515
Full changelog

network-interface-bond-cni

OCPBUGS-61348: Bump github.com/containernetworking/plugins from to 1.7.1 #95
NO-JIRA: Updating ose-network-interface-bond-cni-container image to be consistent with ART for 4.16 #91
NO-JIRA: Add ci-operator.yaml file on release-4.16 #84
Full changelog

network-metrics-daemon

OCPBUGS-58777: Bump github.com/golang/glog to v1.2.4 (#113) #113
OCPBUGS-60186: Replace e2e test image (#122) #122
swtich golint install method (#123) #123
Full changelog

nutanix-machine-controllers

OCPBUGS-51854: CVE-2025-22868 #110
OCPBUGS-47266: fixing CVE-2024-45338 #93
Full changelog

oauth-apiserver

OCPBUGS-74112: UPSTREAM: <carry>: bump kubernetes-apiserver to pick up loopback cert expiration update #166
NO-JIRA: (chore): update OWNERS file #172
Full changelog

oauth-proxy

OCPBUGS-61446: Update x/crypto to v0.31.0 #335
OCPBUGS-62707: Fix oauth-proxy e2e-component tests #338
Full changelog

openshift-apiserver

OCPBUGS-68104: CVE-2025-65637 - Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.16] #610
OCPBUGS-74113: UPSTREAM: <carry>: bump kubernetes-apiserver to pick up loopback cert expiration update #595
OCPBUGS-63394: Wire dry run option to Image API server operations #566
OCPBUGS-61474: Skip blocked registry check for registries with mirrors #552
OCPBUGS-56612: Fix image reference in TestImageStreamImportQuayIO #516
Full changelog

openshift-controller-manager

OCPBUGS-61707: legacy image pull secret rollback controller #416
OCPBUGS-60233: ignore error failing to find pull/push secrets #409
OCPBUGS-57513: Set node-pullsecrets volume to read-only to protect image pull credentials #394
OCPBUGS-56354: Empty proxy variables are causing issues during the build #382
Full changelog

openstack-cluster-api-controllers

OCPBUGS-58028: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.10 into release-4.16 #346
Full changelog

openstack-machine-api-provider

OCPBUGS-78170: hermetic 4.16 #163
OCPBUGS-76794: Fix make test #155
Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

OCPBUGS-77959: Remove the collect-profiles info from the microshift kustomization file #1251
OCPBUGS-77169: Remove the collect-profiles job #1235
OCPBUGS-58881: operatorgroup: ensure clusterroleselectors in clusterrole aggregation rules are sorted #1102
OCPBUGS-59647: Reduce Frequency of Update Requests for Copied CSVs (#3597) #1042
OCPBUGS-60847: Add NetworkPolicy as a supported kind #1050
OCPBUGS-61388: [4.16] e2e stability fixes #1083
OCPBUGS-57429: reduce cache expiry frequency [release-4.19] #1022
OCPBUGS-56358: fix(olm): improve error logging for missing olm.managed label (#3558) #1006
Full changelog

operator-marketplace

OCPBUGS-68108, OCPBUGS-68109: CVE-2025-65637 fixed in logrus v1.9.3+ #722
OCPBUGS-62220: Remove Expect func so that the test case can use the retry logic #671
OCPBUGS-61920: Update memoryTarget on catalog source pods #664
Full changelog

ovirt-csi-driver-operator

OCPBUGS-68125: Bump github.com/sirupsen/logrus to v1.8.3 #152
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-83497: External gateway: Remove routes for external gateway pods in terminating or not ready state #3140
OCPBUGS-78033: Add pperiyasamy to OWNERS for release-4.16 #3047
OCPBUGS-77685: Clear stale conntrack UDP entries for nodePorts #3038
OCPBUGS-77187: Fix conntrack reconciliation to use service port instead of endpoint port #2998
CORENET-6055, OCPBUGS-76277: [release-4.16] Dockerfile: Unpin OVN and consume the latest from FDP #2972
OCPBUGS-71219: [release-4.16] CVE-2025-65637 Bump github.com/sirupsen/logrus to v1.9.1 through indirect dependency conversion (go-controller module) #2906
OCPBUGS-72541: NetPol & MultiNetPol: Process update only when spec fields and/or related annotation are updated #2933
OCPBUGS-68349: Add ricky-rav to OWNERS for release-4.16 #2899
OCPBUGS-66155: Skip Pending pods in EgressIP status updates #2880
OCPBUGS-64944: [release-4.16]: Configure sec nic EIPv6 address with NODAD and maximum lifetime #2853
OCPBUGS-64858: Fix stale EIP assignments during failover and controller restart #2851
OCPBUGS-63155: Fix EgressIP stale GARP post reboot + pod restart #2809
OCPBUGS-63230: Fix dnsnameresolver address set #2812
OCPBUGS-60079: Always enable global IPv6 forwarding #2743
OCPBUGS-60494: Update OWNERS file: Add Patryk/Martin as approvers #2718
OCPBUGS-58161: Unpin OVS patch versions #2648
OCPBUGS-57396: Fix predicate for cluster subnet route to gateway router #2645
OCPBUGS-55282: Fix hybrid overlay node subnets collision with cluster subnets #2621
OCPBUGS-48121: Increase InformerSyncTimeout to 60s #2624
OCPBUGS-56242: Handles unspecified protocol in network policy port #2571
OCPBUGS-56812: egressfirewall: avoid nil dereference on node delete #2591
OCPBUGS-52503: Fixes unexpected mp0 route removal during start up #2479
Full changelog

powervs-machine-controllers

OCPBUGS-61511: Use OS_GIT_VERSION in Makefile when found (for Konflux builds) #127
OCPBUGS-54752: Fix for CVE-2024-51744 in github.com/golang-jwt/jwt/v4 in release-4.16 #114
Full changelog

prometheus

OCPBUGS-61856: chore: compute highestTimestamp at queryManager level #270
OCPBUGS-56739: BACKPORT: fix promtool analyze block shows metric name with 0 cardinality #255
Full changelog

prometheus-alertmanager

OCPBUGS-76536: Include go-verify-deps expected files in gitignore #116
Full changelog

route-controller-manager

OCPBUGS-56152: Added error event for failed ingress to route conversion #61
Full changelog

tests

OCPBUGS-74299: Update to latest openshift/kubernetes #30825
OCPBUGS-63395: Backport pr 29834 to release-4.18 #30409
OCPBUGS-62934: Fix bearer token exposure in exit condition as well #30365
OCPBUGS-61170: images/tests: Remove rteval #30203
NO-JIRA: Update extended/networking OWNERS #30091
OCPBUGS-60272: Bump kubernetes version to fix NFS ganesha version #30086
OCPBUGS-57311: Replace RunHostCmd with Exec function to censor bearer token being exposed #29908
OCPBUGS-57203: fix: remove un-needed test #29849
OCPBUGS-34163: Fix regex parser for censoring private key #29805
OCPBUGS-56704: aws/edge: prevent test using unschedulable nodes #29847
OCPBUGS-55476: support provider type external #29738
Full changelog

vsphere-cloud-controller-manager

OCPBUGS-78028: hermetic migration 4.16 #107
Full changelog

vsphere-cluster-api-controllers

OCPBUGS-78020: hermetic migration 4.16 #86
OCPBUGS-61653: Fix unit tests #72
Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

OCPBUGS-68119: CVE-2025-65637: Bump github.com/sirupsen/logrus to v1.8.3 #158
Full changelog

Node Image Info

Loading node image info, this may take a while ...

Unable to show node image info: too many concurrent oc adm release info --rpmdb/--rpmdb-diff operations (limit 16)

View changelog in Markdown or change previous release:

Source code for this page located on github