4.22.0-0.ci-2026-11-03-090846

Download the installer for your operating system or run

oc adm release extract --tools quay-proxy.ci.openshift.org/openshift/ci:rc_payload__4.22.0-0.ci-2026-11-03-090846

Qualifiers (status api): None

Tests:

Blocking jobs
- aws-ovn-upgrade-4.22-minor Succeeded periodic-ci-openshift-release-main-ci-4.22-upgrade-from-stable-4.21-e2e-aws-ovn-upgrade
- azure-ovn-upgrade-4.22-minor Pending (1 retry) periodic-ci-openshift-release-main-ci-4.22-upgrade-from-stable-4.21-e2e-azure-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Pending
- gcp-ovn-upgrade-4.22-micro Succeeded (1 retry) periodic-ci-openshift-release-main-ci-4.22-e2e-gcp-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Succeeded
- hypershift-e2e-aks Failed (1 retry) periodic-ci-openshift-hypershift-release-4.22-periodics-e2e-aks
  - Attempt 1 Failed
  - Attempt 2 Failed
- hypershift-e2e-aws Failed (1 retry) periodic-ci-openshift-hypershift-release-4.22-periodics-e2e-aws-ovn
  - Attempt 1 Failed
  - Attempt 2 Failed
Async jobs
- claude-payload-agent Pending periodic-ci-openshift-release-main-claude-payload-agent-no-slack

Upgrades from:

4.22.0-0.ci-2026-10-30-090839 (changes) - F F F F F S
4.21.0-0.ci-2026-11-03-021934 - S F P

Loading changelog, this may take a while ...

Changes from 4.21.0-0.ci-2026-11-03-021934

Created: 2026-11-03 09:08:49 +0000 UTC

Image Digest: sha256:091e5599fbcd8119d7e77201229d36550e7565345f326d24aac4bb1d55472421

Components

Kubectl upgraded from 1.34.1 to 1.35.2
Kubernetes upgraded from 1.34.9 to 1.35.9
Kubernetes Tests upgraded from 1.34.1 to 1.35.1
Red Hat Enterprise Linux CoreOS upgraded from 10.2.20260521-0 to 10.2.20261102-1

The CoreOS links above are for the base CoreOS layer used to build the OpenShift node image and do not contain OpenShift components. This is normally only useful to devs working closely with the CoreOS team. For info about the node image, see the Node Image Info section.

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	OKD Hypershift	OKD SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
AdditionalRoutingCapabilities (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
AdminNetworkPolicy (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
AlibabaPlatform (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
CPMSMachineNamePrefix (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
GCPClusterHostedDNS (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
GCPClusterHostedDNSInstall (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
GatewayAPI (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
GatewayAPIController (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
HighlyAvailableArbiter (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ImageVolume (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
MachineConfigNodes (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ManagedBootImages (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ManagedBootImagesAWS (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ManagedBootImagesAzure (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ManagedBootImagesvSphere (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
NetworkDiagnosticsConfig (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
NetworkLiveMigration (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
NetworkSegmentation (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
PinnedImages (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
PreconfiguredUDNAddresses (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ProcMountType (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
RouteAdvertisements (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
TranslateStreamCloseWebsocketRequests (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
VolumeAttributesClass (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
AzureClusterHostedDNSInstall (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled (New)	Enabled (New)	Enabled	Enabled
BootImageSkewEnforcement (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled (New)	Enabled (New)	Enabled	Enabled
DualReplica (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled (New)	Enabled (New)	Enabled	Enabled
IngressControllerDynamicConfigurationManager (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled (New)	Enabled (New)	Enabled	Enabled
InsightsConfig (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled (New)	Enabled (New)	Enabled	Enabled
InsightsOnDemandDataGather (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled (New)	Enabled (New)	Enabled	Enabled
ManagedBootImagesCPMS (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled (New)	Enabled (New)	Enabled	Enabled
MutableCSINodeAllocatableCount (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled (New)	Enabled (New)	Enabled	Enabled
VSphereHostVMGroupZonal (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled (New)	Enabled (New)	Enabled	Enabled
VSphereMixedNodeEnv (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled (New)	Enabled (New)	Enabled	Enabled
AWSServiceLBNetworkSecurityGroup (0 tests)	Disabled	Enabled (Changed)	Enabled	Enabled		Enabled (New)	Enabled	Enabled
NoRegistryClusterInstall (0 tests)	Disabled	Enabled (Changed)	Disabled	Enabled		Enabled (New)	Disabled	Enabled
EVPN (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
GCPSovereignCloudInstall (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
ClusterAPIMachineManagementVSphere (0 tests)	Disabled	Disabled	Enabled	Enabled			Enabled (Changed)	Enabled (Changed)
NewOLMBoxCutterRuntime (0 tests)	Disabled	Disabled	Disabled	Enabled (Changed)			Disabled	Enabled (Changed)
AWSEuropeanSovereignCloudInstall (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
AdditionalStorageConfig (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
CRIOCredentialProviderConfig (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
ClusterAPIComputeInstall (0 tests)			Enabled (New)	Enabled (New)
ClusterAPIControlPlaneInstall (0 tests)			Enabled (New)	Enabled (New)
ClusterAPIMachineManagementAWS (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
ClusterAPIMachineManagementAzure (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
ClusterAPIMachineManagementBareMetal (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
ClusterAPIMachineManagementGCP (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
ClusterAPIMachineManagementOpenStack (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
ClusterAPIMachineManagementPowerVS (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
ClusterUpdateAcceptRisks (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
ClusterUpdatePreflight (0 tests)			Enabled (New)	Enabled (New)
ConfidentialCluster (0 tests)			Enabled (New)	Enabled (New)
ConfigurablePKI (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
DRAPartitionableDevices (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
ExternalOIDCExternalClaimsSourcing (0 tests)			Enabled (New)	Enabled (New)
ExternalOIDCWithUpstreamParity (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
MachineAPIMigrationAWS (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
MachineAPIMigrationOpenStack (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
MachineAPIMigrationVSphere (0 tests)			Enabled (New)	Enabled (New)
NetworkConnect (0 tests)			Enabled (New)	Enabled (New)
NewOLMConfigAPI (0 tests)				Enabled (New)				Enabled (New)
NoOverlayMode (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
TLSAdherence (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)

New images

aws-node-termination-handler git 5fa3b00a sha256:9c0bd52f298ec2e8e62d3131e223adb8601044378114c5c9e92e018d94463bb6

Rebuilt images without code change

contour git 45e9b621 sha256:54a22654a3de733fa5dd3cecabecbfd094b2b8dbc8300046a42955baf87eaffd
contour-operator git e07f7060 sha256:6c2be8ce354944894533592a0376f05855ac8c98a762b2b6f4667ca87f77270f
local-storage-static-provisioner git 2529b85a sha256:70165400b65e42728b165dcbf47c9da6a85d1a497d4b1b858eb0b8f14a05c64b

agent-installer-api-server

OCPBUGS-123142: Bump Go builder to 1.26 and protobuf to v1.36.12 #11107
OCPBUGS-130620: Add ovnKubernetesConfig to install-config definition- #11116 #11203
OCPBUGS-127124: Allow agent-installer invoker to have a suffix #10986
OCPBUGS-69811: Updating ose-agent-installer-api-server-container image to be consistent with ART for 4.22 #8601
OCPBUGS-121355: Fix NUMAResourcesOperator CR name so it can be applied #10934
OCPBUGS-120755: added missing subscription name for lvms-operator #10918
OCPBUGS-105805: golang.org/x/crypto bump to v0.52.0 #10796
OCPBUGS-104521: manifest_generator add a label to LUKS root #10755
AGENT-1559: Remove LSO and LVMS as CNV operator dependencies #10666
OCPBUGS-98693: PATCH /v2/clusters/{id} does not return updated operator_bundles #10608
OCPBUGS-93786: Simplify IRI api dependency #10539
OCPBUGS-92056: Stop setting DevPreviewNoUpgrade for TNF clusters #10516
OCPBUGS-90638: Add sourcedir /run/chrony-dhcp to generated chrony.conf #10488
OCPBUGS-83542: Mark raw FC/iSCSI multipath members as ineligible #10150
OCPBUGS-83511: Fix IRI patcher feature check #10147
MGMT-23548: Ensure tests w/ gomock controllers call Finish() #10024
MGMT-22849: Remove the nmconnection that the openshift-installer writes for the bootstrap. #10086
NO-ISSUE: Detect missing PostgreSQL client in development #10119
NO-ISSUE: Add assisted-service-writing-unit-tests agent skill #10123
MGMT-23451: Lower SNO vCPU min to 4 instead of 8 for assisted for OCP 4.22 and above #10040
MGMT-23141: Cluster creation returns SQL error rather than API error #10113
NO-ISSUE: [master] Bump OCP versions: 4.20, 4.18, 4.21, 4.14, 4.17, 4.19, 4.16 #10120
MGMT-23340: upgrade assisted-service postgresql from 13 to 15 #10096
NO-ISSUE: Replace github.com/golang/mock with go.uber.org/mock #10082
OCPBUGS-79576: Prefer multipath disk in ABI disk selection #10091
NO-ISSUE: BMAC: replace per-step Update calls with deferred Patch #10095
MGMT-22517: Change amd gpu operator namespace to openshift-amd-gpu #10007
MGMT-23228: Update NFD config for AMD Instinct GPU detection #9918
MGMT-23599: implement cluster and host validations for Kube API mode #10044
MGMT-23253: Reconcile stuck day2 agent status by checking spoke cluster #10087
NO-ISSUE: clarify error when interface in bond missing #10022
MGMT-23060: Make InfraEnv CpuArchitecture immutable after creation #9999
MGMT-23625: Remove pinned image version for nfd operator #10045
MGMT-23231: Replace AcceleratorProfile with HardwareProfile #9919
MGMT-23674: Remove controller-runtime dependency from api module #10071
MGMT-23650: Disable image policy in assisted service operator deployment #10070
MGMT-23300: Add missing permission for host reclaim pod #9934
MGMT-22939: Fix cache key to get mustgather image #9940
OCPBUGS-79470: Fix multi-document YAML parsing for NMStateConfig #10053
NO-ISSUE: [master] Bump OCP versions: 4.16, 4.17, 4.19, 4.21, 4.22 #10054
AGENT-1426: Add localhost mirror only when missing in IRI patcher #10028
MGMT-23446: TNA none platform on 4.19 (block for 4.21 and lower) #10013
MGMT-23045: toggle metal3 integration #9933
OCPBUGS-78989: Gate customDeploy on PreprovisioningImage having correct ISO #10032
MGMT-23339: Add url to release image comparison for Kube API versions #10030
MGMT-23550: Add feature usage for new CNI types #10027
NO-ISSUE: add skipper skill #10014
MGMT-23432: add third parties CNI support to KUBE API mode #10015
NO-ISSUE: [master] Bump OCP versions: 4.21 #10023
NO-ISSUE: Add Go workspace files to .gitignore #10000
NO-ISSUE: [master] Bump OCP versions: 4.18, 4.20 #10002
MGMT-22967: read MCS CA from machine-config-server-ca instead of kube-system/root-ca #9990
NO-ISSUE: [master] Bump OCP versions: 4.21 #9997
MGMT-22782: Add state root cleanup script to day-2 worker ignition #9942
NO-ISSUE: Add bluesort to OWNERS_ALIASES #9979
OCPBUGS-77767: OVE Above/Below-the-sea integration - Network configuration not persisted #9978
MGMT-23339: Use release image URL from ClusterImageSet for KubeAPI clusters #9957
NO-ISSUE: [master] Bump OCP versions: 4.19, 4.13 #9988
MGMT-22518: Adding RHOAI application endpoint to the list of known hosts for SNO #9936
OCPBUGS-77552: fix: min supported arbiter disk size should be 50GB #9977
NO-ISSUE: Update InfraEnv CR description #9938
MGMT-22905: Update LSO override for operator deployment #8824
NO-ISSUE: [master] Bump OCP versions: 4.17 #9975
NO-ISSUE: [master] Bump OCP versions: 4.22, 4.14, 4.21 #9968
NO-ISSUE: Refresh RPM lockfiles #9945
NO-ISSUE: Fix loki and logging #9939
NO-ISSUE: [master] Bump OCP versions: 4.18, 4.20 #9941
MGMT-23205: Reject empty MAC address in NMState static network config #9937
NO-ISSUE: [master] Bump OCP versions: 4.21 #9935
MGMT-21783: bundle cluster and host ignition endpoint CA certificates for day-2 hosts #8826
ACM-29247: Infrastructure Operator - Set up Renovate configuration to automatically create Hive API Synchronization PRs #9917
NO-ISSUE: Refresh RPM lockfiles #9915
ACM-29247: (Revert) infrastructure operator set up renovate configuration to automatically create hive api synchronization p rs #9865
NO-ISSUE: [master] Bump OCP versions: 4.17, 4.16, 4.19, 4.22, 4.21 #9752
MGMT-22907: Prepare 4.21 stable and 4.22 candidate versions assisted-service upstream #8831
NO-ISSUE: Use renovate to update rpms.lock.yaml #9619
ACM-29247: (FIX) infrastructure operator set up renovate configuration to automatically create hive api synchronization p rs #9505
NO-ISSUE: Update module github.com/go-logr/logr to v1.4.3 #9357
NO-ISSUE: [master] Bump OCP versions: 4.21, 4.20, 4.18, 4.19, 4.17 #8912
ACM-29247: infrastructure operator set up renovate configuration to automatically create hive api synchronization p rs #8870
MGMT-22942: Temporarily mirror CAPI image and OCP 4.20 release for disconnected CAPI CI #8819
MGMT-23047: Ensure cluster is installed when adding an osImageVersion… #8818
MGMT-22998: Add documentation to add node to an upgraded cluster #8810
MGMT-23164: Bug: Assisted Installer fails for OCP < 4.16 due to missing libvirt dependency #8869
MGMT-22406: Include primary_ip_stack in cluster event notifications #8846
MGMT-22385: Skip ip= kernel args for Day2 iSCSI/multipath with unknown network #8837
NO-ISSUE: Update setup-envtest version to release-0.22 #8856
MGMT-22885: Implement third-party CNI backend support #8797
NO-ISSUE: Modify Konflux YAMLs to ocm-2.17 #8850
NO-ISSUE: Update operator bundle channel to ocm-2.17 #8847
MGMT-23115: add FIPS feature usage tracking #8845
MGMT-23077: Revert “MGMT-21038: Prevent from inventory set host RequestedHostname directly” #8840
OCPEDGE-2367: Add support for platform none and external on TNA clusters topology #8830
MGMT-22731: Add To Renovate Tool - Update UBI-minimal Version Automatically #8802
MGMT-22523: Bump AMD DeviceConfig driver version to 6.4.3 #8823
MGMT-23000: Fix when a BMH is paused in non-converged flow #8812
MGMT-22287: Remove OCP 4.12 support from assisted-service #8794
MGMT-21038: Prevent from inventory set host RequestedHostname directly #7962
NO-ISSUE: [master] Bump OCP versions: 4.16, 4.14, 4.21 #8816
ACM-29153: Upgrade hive to e33d70 #8807
MGMT-21756: enable FIPS 140-3 crypto module in Go builds #8755
NO-ISSUE: [master] Bump OCP versions: 4.20 #8801
MGMT-22583: Implement Swagger Definitions for 3rd Party CNI / No CNI #8717
NO-ISSUE: [master] Bump OCP versions: 4.17, 4.20, 4.19, 4.13 #8795
NO-ISSUE: Clarify release images needed for ironic agent image #8778
NO-ISSUE: upgrade to 1.25 #8769
NO-ISSUE: [master] Bump OCP versions: 4.12, 4.18, 4.21, 4.16, 4.20 #8767
NO-ISSUE: Add parameter for pod disruption budget in openshift template #8765
MGMT-20701: host re-registration improvement #8737
MGMT-22189: Fix primary_ip_stack migration #8760
MGMT-22584: Create Enhancement Document for 3rd Party CNI / No CNI Support in Assisted Installer #8594
MGMT-22131: transitioning red hat operator base image to ubi minimal #8711
MGMT-22553: Partial cluster updates fail with false validation errors on dual-stack clusters #8704
MGMT-22297: fallback path for add-ntp-sources.sh #8742
NO-ISSUE: Update CONTRIBUTING.md #8745
MGMT-22189: Order dual-stack networks when fetching from DB #8488
MGMT-22656: Remove serviceMesh & kserve from DataScienceCluster spec #8741
NO-ISSUE: Add cpe label #8739
NO-ISSUE: bumping go version on branch master to v1.25 to solve CVE-2025-58183 #8708
AGENT-1407: add support for InternalReleaseImage related resources #8600
NO-ISSUE: [master] Bump OCP versions: 4.21 #8733
MGMT-16090: upgrade assisted-service postgresql from 12 to 13 #8602
MGMT-20499: Always generate iSCSI NIC reapply manifest for day2 host support #8705
NO-ISSUE: [master] Bump OCP versions: 4.17 #8725
MGMT-22278: Skip deleting spoke resources for an uninstalled agent #8608
MGMT-22186: Add kata runtime class to Assisted installer #8140
ACM-27859: Allow PreprovisioningImage finalizer to be removed once BMH finishes deprovisioning #8604
MGMT-20323: Prefer bootable disks for installation #8701
NO-ISSUE: add to owners_aliases #8703
MGMT-22545: Fix YAML marshaling for Kubernetes types in disconnected ignition #8619
OCPBUGS-68355: Fix Day-2 CSR approval race condition #8622
MGMT-22423: Fix race condition in ensureOwnerRef causing spec.installed to remain false #8621
ACM-27290: Fix policy.json not generated for InfraEnv mirror registry config #8609
ACM-27906: Fix container-image-availability check to use mirrored registries in disconnected environments #8611
NO-ISSUE: [master] Bump OCP versions: 4.21, 4.20 #8612
MGMT-22458: CVE-2025-65637 Bump github.com/go-openapi/loads, github.com/go-openapi/analysis, github.com/go-openapi/validate to fix CVE-2025-65637 through introducers update (models module) #8596
NO-ISSUE: Fix golangci-lint branch #8572
MGMT-22159: Add NFD operator to the list of OSC operator dependencies #8292
MGMT-22320: Expose GPU data in Agent CR inventory #8495
NO-ISSUE: Fix list bundle validation to check for feature incompatibilities #8571
MGMT-22273: reduce log amount #8565
MGMT-22396: CVE-2024-25621 Bump github.com/containerd/containerd to v1.7.29 through indirect dependency conversion #8555
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-133481: Preserve firstboot network config across OS image replacement #2501
OCPBUGS-123142: Bump Go builder to 1.26 and protobuf to v1.36.12 #2430
OCPBUGS-127124: Allow agent-installer invoker to have a suffix #2350
OCPBUGS-69893: Updating ose-agent-installer-orchestrator-container image to be consistent with ART for 4.22 #1405
OCPBUGS-96592: Bump golang.org/x/net to v0.55.0 #2250
OCPBUGS-104498: Wait for all nodes to join before exiting for ABI #2245
OCPBUGS-69953: Updating ose-agent-installer-csr-approver-container image to be consistent with ART for 4.22 #1406
NO-ISSUE: Refresh RPM lockfiles #2069
MGMT-23545: Mount pull secret token as a file #2053
MGMT-23191: Ensure MCO configs are present before rebooting the bootstrap node #2039
MGMT-23664: CVE-2026-33186 Bump google.golang.org/grpc to v1.79.3 through indirect dependency conversion #2058
OCPBUGS-70213: fix: allow workers to join TNA cluster when 1 master + arbiter are ready #2056
NO-ISSUE: Refresh RPM lockfiles [SECURITY] #2040
OCPBUGS-76382: Fix root partition before copying IRI registry data #2034
ACM-29247: Infrastructure Operator - Set up Renovate configuration to automatically create Hive API Synchronization PRs #2037
NO-ISSUE: Refresh RPM lockfiles [SECURITY] #2035
NO-ISSUE: Refresh RPM lockfiles #2027
ACM-29247: (Revert) infrastructure operator set up renovate configuration to automatically create hive api synchronization p rs #1998
NO-ISSUE: Update module github.com/jackc/pgtype to v1.14.4 #1664
NO-ISSUE: Use renovate to update rpms.lock.yaml #1515
NO-ISSUE: Update github.com/alecthomas/units digest to 0f3dac3 #1524
ACM-29247: infrastructure operator set up renovate configuration to automatically create hive api synchronization p rs #1511
MGMT-22731: Add To Renovate Tool - Update UBI-minimal Version Automatically #1487
NO-ISSUE: Modify Konflux YAMLs to ocm-2.17 #1498
Revert “NO-ISSUE: test for FF ACM 2.17” #1496
NO-ISSUE: test for FF ACM 2.17 #1495
ACM-29166: Upgrade hive to e33d70 #1491
MGMT-22499: CVE-2025-66506 Bump github.com/sigstore/fulcio to v1.8.3 using replace directive #1484
MGMT-22532: CVE-2025-52881 Bump github.com/opencontainers/selinux to v1.13.0 using replace directive #1483
MGMT-22393: CVE-2024-25621 Bump github.com/containerd/containerd to v1.7.29 using replace directive #1474
NO-ISSUE: upgrade go to 1.25 #1466
MGMT-22653: bump the required minimal go version to 1.24 #1459
NO-ISSUE: Add cpe label #1457
MGMT-22131: transitioning red hat operator base image to ubi minimal #1444
ACM-25812: bumping go version on branch master #1446
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

agent-installer-node-agent

OCPBUGS-123142: Bump Go builder to 1.26 and protobuf to v1.36.12 #1695
OCPBUGS-69939: Updating ose-agent-installer-node-agent-container image to be consistent with ART for 4.22 #1227
OCPBUGS-101855: Bump golang.org/x/net from v0.47.0 to v0.53.0 #1595
OCPBUGS-84392: Bump go-jose in v4.22 #1488
OCPBUGS-84129: add –copy-network when manual network config is detected #1416
MGMT-23517: Bump go modules #1373
NO-ISSUE: Refresh RPM lockfiles #1355
NO-ISSUE: Refresh RPM lockfiles [SECURITY] #1351
NO-ISSUE: Use renovate to update rpms.lock.yaml #1343
MGMT-23123: fix bootkube.logs missing from bootstrap logs on success #1320
MGMT-22731: Add To Renovate Tool - Update UBI-minimal Version Automatically #1309
NO-ISSUE: Modify Konflux YAMLs to ocm-2.17 #1318
ACM-29167: Upgrade hive to e33d70 #1311
MGMT-22131: transitioning red hat operator base image to ubi minimal #1288
MGMT-22395: CVE-2024-25621 Bump github.com/containerd/containerd to v1.7.29 through indirect dependency conversion #1302
NO-ISSUE: Bump mockery to a go 1.25 compatible version #1295
NO-ISSUE: upgrade go to 1.25 #1289
NO-ISSUE: Add cpe label #1278
MGMT-21739: Skip log collection for non-existent services #1230
NO-ISSUE: add to owners_aliases #1268
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

agent-installer-ui

OCPBUGS-133440: OVE Below the sea level UI: Technology Preview in the Header #4137
OCPBUGS-123183: Do not show IRI custom manifests in the disconnected UI #4052
And 213 elided commits (e.g. from squash or rebase merges)
Full changelog

agent-installer-utils

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #358
OCPBUGS-131856: Add OVE 4.22 tekton file to agent-installer-utils #357
OCPBUGS-127041: Refresh rendezvous IP selection list #352
OCPBUGS-127009: Fix agent TUI timeout #351
OCPBUGS-105451: Update Konflux references #337
OCPBUGS-101760: Update Konflux references #329
OCPBUGS-100105: Use Operator catalog in 4.22 for OVE #325
AGENT-1568: Add lvms-operator to config #324
OCPBUGS-99906: Update Konflux references #302
OCPBUGS-99556: Use agent-preinstall-image-builder from quay-proxy #321
OCPBUGS-98743: Update cluster-logging and loki operator versions #316
OCPBUGS-89320: bump mtv-operator to release-v2.12 #310
OCPBUGS-86042: Filter out link-local IPv6 addresses #306
OCPBUGS-85525: update konflux references #296
OCPBUGS-84141: Update 4.22 Konflux files #295
OCPBUGS-83734: Red Hat Konflux kflux-prd-rh02 update ove-ui-iso-4-22 #291
OCPBUGS-82537: update konflux references #274
NO-JIRA: enable xtrace in build-ove-image.sh for debugging #281
OCPBUGS-81585: Update operator versions #280
NO-JIRA: Pass environment through to podman #279
AGENT-1429: Pass OPENSHIFT_INSTALL_EXPERIMENTAL_DISABLE_IMAGE_POLICY #278
OCPBUGS-78042: Update Konflux references #266
OCPBUGS-77956: Update to use the 4.21 Operator Catalog #268
OCPBUGS-77611: Updating ose-agent-installer-utils-container image to be consistent with ART for 4.22 #267
AGENT-1453: Add a flag to provide a custom appliance image #264
AGENT-1447: Override prefilled rendezvousIP #256
OCPBUGS-77270: Remove multiple redhat-operator-index catalogs #261
OCPBUGS-77235: Use mtv-operator from 4.20 catalog #259
OCPBUGS-77233: Update Konflux references #250
OCPBUGS-77235: Update mtv-operator version #257
NO-ISSUE: Fix linting issues #255
OCPBUGS-76367: Include additional operators in OVE config #252
OCPBUGS-76343: Add lso operator to appliance config #249
OCPBUGS-74933: Update quay.io/konflux-ci/konflux-vanguard/task-rpms-signature-scan:0.2 Docker digest to 2f3015a #221
OCPBUGS-74932: Update Konflux references #219
OCPBUGS-74242: Increase Konflux build pipeline memory #242
AGENT-1313: enable MCO IRI registry #232
OCPBUGS-71231: bump github.com/sirupsen/logrus to v1.9.3 #233
OCPBUGS-72420: Increase capabilities passed via buildah #229
NO-ISSUE: Add 4.22 isobuilder configs #213
AGENT-1334: Examples of golden snapshot and release for OVE ISO image #202
NO-ISSUE:Updating ose-agent-installer-utils-container image to be consistent with ART for 4.22 #216
OCPBUGS-69438: Remove operator manifests; now applied by assisted-installer #211
OCPBUGS-69406: Update quay.io/konflux-ci/konflux-vanguard/task-rpms-signature-scan:0.2 Docker digest to 20eb21c #210
OCPBUGS-69405: Update Konflux references #209
Full changelog

apiserver-network-proxy

OCPBUGS-123142: Bump Go builder to 1.26 and protobuf to v1.36.12 #121
OCPBUGS-77615: Updating ose-apiserver-network-proxy-container image to be consistent with ART for 4.22 #90
OCPBUGS-73992: Updating ose-apiserver-network-proxy-container image to be consistent with ART for 4.22 #89
OCPBUGS-69889: Updating ose-apiserver-network-proxy-container image to be consistent with ART for 4.22 #88
Full changelog

aws-cloud-controller-manager

OCPBUGS-102049: Bump golang.org/x/net to v0.53.0 for CVE-2026-33814 #171
OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #194
OCPBUGS-83898: UPSTREAM: <drop>: bump google.golang.org/grpc to v1.79.3 #155
OCPCLOUD-3215: Add support for dual networking stack services #135
OCPBUGS-69888, OCPBUGS-76344, OCPCLOUD-3276: Merge https://github.com/kubernetes/cloud-provider-aws:master (ea961d6) into main #131
OCPBUGS-76344, OCPCLOUD-3276: Merge https://github.com/kubernetes/cloud-provider-aws:master (dc94f58) into main #120
OCPCLOUD-3341: Updates ecr-credential-provider make target #130
SPLAT-2220: tests/ote: extend tests for gate AWSServiceLBNetworkSecurityGroup #129
SPLAT-2220: tests/ote: introduce openshift-only e2e to validate feature by feature gate #126
TRT-2536: UPSTREAM: <carry>: Fix OTE list tests when SingleReplica #125
Full changelog

aws-cluster-api-controllers

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #662
OCPBUGS-101854: replace golang.org/x/net with openshift-sustaining/net v0.50.0-sec.4 for CVE-2026-33814 #648
🌱 [release-4.22] OCPBUGS-119954: UPSTREAM: <carry>: Remove upstream .github files unused in OpenShift CI #633
🐛 [release-4.22] OCPBUGS-112305: UPSTREAM: 6132: Persist ProviderID immediately after instance creation #626
OCPBUGS-84393: Bump github.com/go-jose/go-jose/v4 to 4.1.4 #606
OCPBUGS-83899,UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-aws:v2.10.3 into release-4.22 #603
OCPBUGS-77748: Updating ose-aws-cluster-api-controllers-container image to be consistent with ART for 4.22 #597
NO-JIRA: Merge https://github.com/kubernetes-sigs/cluster-api-provider-aws:v2.10.2 (999ac9a) into main #588
NO-JIRA: Remove dead RELEASE_DIR ref #596
OCPCLOUD-3326: Update to use new manifests-gen #584
NO-JIRA: UPSTREAM: <carry>: Add manifests verify target #586
OCPBUGS-70053: Updating ose-aws-cluster-api-controllers-container image to be consistent with ART for 4.22 #585
Full changelog

aws-ebs-csi-driver

OCPBUGS-101864: Bump golang.org/x/net to v0.53.0 #356
OCPBUGS-123142: Bump Go builder to 1.26 and protobuf to v1.36.12 #349
OCPBUGS-83900: UPSTREAM: 2911: bump google.golang.org/grpc v1.80.0 to fix CVE-2026-33186 #316
TRT-2576: Revert #301 “STOR-2766: Rebase to upstream v1.55.0 for OCP 4.22” #303
STOR-2766: Rebase to upstream v1.55.0 for OCP 4.22 #301
OCPBUGS-77628: Updating ose-aws-ebs-csi-driver-container image to be consistent with ART for 4.22 #302
OCPBUGS-74521: UPSTREAM: 2806, 2816: Remove VolumeAttributesClass FeatureGate #300
OCPBUGS-69918: Updating ose-aws-ebs-csi-driver-container image to be consistent with ART for 4.22 #296
OCPBUGS-69918: UPSTREAM: <carry>: do not require license in OCP files (follow-up) #298
OCPBUGS-69918: UPSTREAM: <carry>: do not require license in OCP files #297
Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #648
OCPBUGS-119697: Add proxy hook for HyperShift CSI driver controller deployments #619
OCPBUGS-101882, OCPBUGS-101889, OCPBUGS-101890, OCPBUGS-102000: Bump golang.org/x/net to v0.53.0 #602
OCPBUGS-109635: csi-driver-smb: DeleteVolume call fails to mkdir under /tmp #597
OCPBUGS-91947: maxOpenShiftVersion should be bumped to 5.0 #572
OCPBUGS-85532: Add init container for Manila node daemonset #555
OCPBUGS-85116: Mount writable /tmp in SMB CSI driver #550
OCPBUGS-84243: [release-4.22] Add VolumeAttributesClass e2e test manifests for Azure disk #544
OCPBUGS-78291: Allow azure-disk sidecars to read VolumeAttributeClasses #525
STOR-2762: Bump all deps for 4.22 #526
OCPBUGS-77674: Updating ose-openstack-cinder-csi-driver-operator-container image to be consistent with ART for 4.22 #516
OCPBUGS-77553: Updating csi-driver-manila-operator-container image to be consistent with ART for 4.22 #513
OCPBUGS-77612: Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART for 4.22 #514
STOR-2884: Add service to generate a TLS cert for EFS operator #522
STOR-2884: Add service to generate a TLS cert for SMB operator #520
NO-JIRA: Inherit any OpenShift global CodeRabbit setting #519
OCPBUGS-77623: Updating ose-azure-file-csi-driver-operator-container image to be consistent with ART for 4.22 #515
OCPBUGS-77571: Add only to tags to volume object, if volume is not already tagged #518
OCPBUGS-77497: Fix readonly root fs in Azure init containers #512
NO-JIRA: Add coderabbit, including instructions #509
STOR-2752: Early chore: update OCP version in OLM metadata #505
Updating ose-azure-disk-csi-driver-operator-container image to be consistent with ART for 4.22 #517
OCPBUGS-77378: Updating ose-aws-efs-csi-driver-operator-container image to be consistent with ART for 4.22 #510
OCPBUGS-77405: Updating ose-smb-csi-driver-operator-container image to be consistent with ART for 4.22 #511
OCPBUGS-76298: missing readOnlyRootFilesystem in AWS init containers #506
OCPBUGS-74971: Fix azure-disk secret namespace/name args #502
OCPBUGS-74521: Remove VolumeAttributesClass FeatureGate #503
STOR-2523: hypershift: Add desired-version annotation to controller Deployments and use DeploymentVersionController in csi driver operators #457
OCPBUGS-70304: Fix azure-file secret namespace/name #500
OCPBUGS-66113: Some containers do not have readOnlyRootFilesystem #476
OCPBUGS-70085: Updating ose-openstack-cinder-csi-driver-operator-container image to be consistent with ART for 4.22 #483
OCPBUGS-70339: deploy prometheus role and binding on hypershift guest #488
OCPBUGS-63698: fix(azure): add token-minter for self-managed hosted clusters #461
OCPBUGS-69739: Updating csi-driver-manila-operator-container image to be consistent with ART for 4.22 #480
OCPBUGS-69907: Updating ose-azure-file-csi-driver-operator-container image to be consistent with ART for 4.22 #482
OCPBUGS-69710: Updating ose-smb-csi-driver-operator-container image to be consistent with ART for 4.22 #479
NO-JIRA: Add /sniff-test claude command #486
OCPBUGS-69883: Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART for 4.22 #481
OCPBUGS-69982: Updating ose-azure-disk-csi-driver-operator-container image to be consistent with ART for 4.22 #484
OCPBUGS-69695: Updating ose-aws-efs-csi-driver-operator-container image to be consistent with ART for 4.22 #478
STOR-2543: add VAC manifest for tests in AWS EBS #475
STOR-1945: STOR-2056: Add SupportedSizeRange for azurefile-nfs #477
Full changelog

aws-karpenter-provider-aws

OCPBUGS-128795: Align simulated with actual allocatable resources #49
OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #54
OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #51
OCPBUGS-118884: default max-pods to 250 for Custom AMI family #43
OCPBUGS-101842: Fix CVE-2026-33814 #35
AUTOSCALE-485: rebase to 1.9.0 #26
AUTOSCALE-485: rebase to 1.8.6 #25
AUTOSCALE-293: partially ignore drift on ec2nodeclass userdata field #21
Full changelog

aws-kms-encryption-provider

OCPBUGS-83877: Bump google.golang.org/grpc to v1.79.3 #54
OCPBUGS-70017: Updating aws-kms-encryption-provider-container image to be consistent with ART for 4.22 #33
Full changelog

aws-machine-controllers

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #229
OCPBUGS-101975: fix CVE-2026-33814 by bumping golang.org/x/net to v0.53.0 #198
OCPBUGS-126916: Add opt-in pprof endpoint to machine-controller-manager #218
OCPBUGS-126916: Cache region validation response and close AWS sessions #219
OCPBUGS-85277: Changed timeout for node ready logic in OTE #187
OCPBUGS-85125: Fixed broken test and simplified some logic #184
SPLAT-2627: Created OTE Tests for dedicated hosts #174
SPLAT-2700: Added shared tags for BYO DH #181
OCPCLOUD-3283: K8s 1.35 bump #179
CORS-4166: enable IPv6 IMDS endpoint and private DNS configuration for dualstack #177
CORS-4315: enable primary IPv6 when infrastructure ipFamily is DualStackIPv6Primary #171
SPLAT-2617: Added dynamic dedicated host support #172
SPLAT-2558: Add AWS Dedicated Host support #160
OCPBUGS-72390: Fix reconciler consistency checks in Update and Exists #162
OCPBUGS-69950: Updating ose-machine-api-provider-aws-container image to be consistent with ART for 4.22 #161
Full changelog

aws-pod-identity-webhook

OCPBUGS-123142: Bump Go builder to 1.26 and protobuf to v1.36.12 #232
OCPBUGS-101873: Bump golang.org/x/net to v0.55.0 #221
CCO-784: update to pick up tls-min-version and tls-cipher-suites #207
OCPBUGS-74165: Fix GOTOOLCHAIN env var #211
CCO-728: merge upstream changes v0.6.11 #209
OCPBUGS-69825: Updating ose-aws-pod-identity-webhook-container image to be consistent with ART for 4.22 #208
Full changelog

azure-cloud-controller-manager, azure-cloud-node-manager

OCPBUGS-123142: Bump Go builder to 1.26 and protobuf to v1.36.12 #223
OCPBUGS-88485: Bump golang.org/x/net from v0.49.0 to v0.55.0 #193
OCPBUGS-85706, OCPBUGS-85707: UPSTREAM: <drop>: bump google.golang.org/grpc to v1.79.3 #185
OCPCLOUD-3281: Merge https://github.com/kubernetes-sigs/cloud-provider-azure:master (314ccf1) into main #155
OCPBUGS-65654: Merge https://github.com/kubernetes-sigs/cloud-provider-azure:master (765f435) into main #152
Full changelog

azure-cluster-api-controllers

OCPBUGS-133098: Carry VM Reapply recovery #421
: OCPBUGS-123142: Bump Go builder to 1.26 and protobuf to v1.36.12 #415
OCPBUGS-105465: Address CVE-2026-39829 #396
OCPBUGS-83906: Merge https://github.com/kubernetes-sigs/cluster-api-provider-azure:v1.23.1 (dbeb413) into release-4.22 #381
OCPCLOUD-3294: Merge https://github.com/kubernetes-sigs/cluster-api-provider-azure:v1.23.0 (ac446a1) into main #371
OCPCLOUD-3294: Merge https://github.com/kubernetes-sigs/cluster-api-provider-azure:main (bc68ad9) into main #370
OCPBUGS-77637: Updating ose-azure-cluster-api-controllers-container image to be consistent with ART for 4.22 #369
OCPCLOUD-3324: Update to new manifests-gen #357
OCPBUGS-53004: Remove references to master branch #336
OCPCLOUD-3101: Merge https://github.com/kubernetes-sigs/cluster-api-provider-azure:v1.22.0 (4523016) into master #350
NO-JIRA: UPSTREAM: <carry>: Add manifests verify target #358
OCPBUGS-69934: Updating ose-azure-cluster-api-controllers-container image to be consistent with ART for 4.22 #356
Full changelog

azure-disk-csi-driver

OCPBUGS-123142: Bump Go builder to 1.26 and protobuf to v1.36.12 #184
OCPBUGS-111870: Bump golang.org/x/crypto to v0.52.0 #164
UPSTREAM: 3635: OCPBUGS-96598: Bump golang.org/x/net to v0.55.0 #165
OCPBUGS-106152: UPSTREAM: 3756: fix: optionally skip reading the config from the API server #163
OCPBUGS-83633: Bump spdystream to v0.5.1 #150
OCPBUGS-85193: check for node name in waitForDiskManagedByTobeRemoved #146
UPSTREAM: 3569: OCPBUGS-83425: Bump grpc to v1.79.3 #136
OCPBUGS-77248: Rebase to v1.34.2 for OCP 4.22 #124
OCPBUGS-77575: Updating ose-azure-disk-csi-driver-container image to be consistent with ART for 4.22 #123
STOR-2768: Rebase v1.34.1 #120
OCPBUGS-69754: Updating ose-azure-disk-csi-driver-container image to be consistent with ART for 4.22 #119
OCPBUGS-69390: fix ASH static provision segmentation fault #117
OCPBUGS-67186: fix: disk creation failure in AzureStack env #114
Full changelog

azure-file-csi-driver

OCPBUGS-123142: Bump Go builder to 1.26 and protobuf to v1.36.12 #174
OCPBUGS-101874: Bump golang.org/x/net to v0.53.0 #154
OCPBUGS-95536: Bump golang.org/x/crypto to v0.48.0-sec.1 #144
UPSTREAM: 3023: OCPBUGS-83329: Bump grpc to v1.79.3 #126
STOR-2761: Rebase to upstream v1.35.0 for OCP 4.22 #116
OCPBUGS-77798: Updating ose-azure-file-csi-driver-container image to be consistent with ART for 4.22 #117
OCPBUGS-70304: UPSTREAM: 2940: fix: optionally skip reading the config from the API #114
OCPBUGS-70060: Updating ose-azure-file-csi-driver-container image to be consistent with ART for 4.22 #111
OCPBUGS-70060: fix failing unit tests in azure-file-csi-driver #112
Full changelog

azure-kms-encryption-provider

OCPBUGS-123142: Bump Go builder to 1.26 and protobuf to v1.36.12 #67
OCPBUGS-74021: Updating azure-kms-encryption-provider-container image to be consistent with ART for 4.22 #27
CNTRLPLANE-4024: support sovereign Managed HSM endpoints- #56 #56
OCPBUGS-101846: [release-4.22] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #57
CNTRLPLANE-4024: [release-4.22]: Correct Managed HSM endpoints #53
OCPBUGS-69961: Updating azure-kms-encryption-provider-container image to be consistent with ART for 4.22 #26
Full changelog

azure-machine-controllers

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #223
OCPBUGS-98074: Bump golang.org/x/crypto from v0.47.0 to v0.54.0 #205
OCPBUGS-86996: Don’t permanently fail Machines after provisioning #195
PIXAA-7: Leverage SpotRebalanceRecommendation for instance termination when available #198
OCPCLOUD-3280: Bump k8s 1.35 #189
OCPBUGS-74076: Fix: Enable boot diagnostics for Azure Stack Hub VMs #182
OCPBUGS-74573: Add validation for AzureManaged boot diagnostics on Azure Stack Hub #183
OCPBUGS-77607: Updating ose-machine-api-provider-azure-container image to be consistent with ART for 4.22 #186
OCPCLOUD-3252: Add AGENTS configuration #181
OCPBUGS-69864: Updating ose-machine-api-provider-azure-container image to be consistent with ART for 4.22 #179
Full changelog

azure-service-operator

OCPBUGS-123142: Bump Go builder to 1.26 and protobuf to v1.36.12 #50
OCPBUGS-83879: Bump grpc package for CVE fix in 4.22 #27
OCPBUGS-84333: Updating ose-azure-service-operator-container image to be consistent with ART for 4.22 #25
OCPBUGS-83835: UPSTREAM: <carry>: add openshift/e2e-tests.sh #23
Full changelog

azure-workload-identity-webhook

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #72
OCPBUGS-101877: Bump golang.org/x/net to v0.53.0 to address CVE-2026-33814 #59
OCPBUGS-84394: github.com/go-jose/go-jose/v4 v4.1.4 #47
CCO-785: add flag to configure TLS cipher suites #44
OCPBUGS-73994: Updating ose-azure-workload-identity-webhook-container image to be consistent with ART for 4.22 #43
CCO-729: merge upstream changes #42
OCPBUGS-69895: Updating ose-azure-workload-identity-webhook-container image to be consistent with ART for 4.22 #41
Full changelog

baremetal-cluster-api-controllers

OCPBUGS-123142: Bump Go builder to 1.26 and protobuf to v1.36.12 #111
OCPBUGS-86688: Adopt existing Metal3 Remediation CRDs on upgrade #83
OCPBUGS-74161: fix: pin metal3remediations CRDs storage version to v1beta1, deploy separate manifests in Default #68
Updating ose-baremetal-cluster-api-controllers-container image to be consistent with ART for 4.22 #67
OCPBUGS-74161: manifests-gen: include IPAM CRDs #65
Merge upstream #63
OCPBUGS-73951: Updating ose-baremetal-cluster-api-controllers-container image to be consistent with ART for 4.22 #58
Update to new manifests-gen #64
Revert “NO-JIRA: Add manifests verify target” #60
NO-JIRA: UPSTREAM: <carry>: Do not ignore files in vendor #59
NO-JIRA: Add manifests verify target #57
OCPBUGS-69724: Updating ose-baremetal-cluster-api-controllers-container image to be consistent with ART for 4.22 #56
METAL-1703: Add AGENTS and “merge-upstream” slash command #55
Full changelog

baremetal-installer, installer, installer-artifacts

OCPBUGS-129524: Update RHCOS-release-4.22 bootimage metadata to 10.2.20261026-0 / 9.8.20261026-0 #11029
OCPBUGS-131019: Removed PowerVS InstallConfig debug log statement exposing sensitive information #10982
OCPBUGS-128657: gcp: restrict global KMS location check to defaultMachinePlatform #10932
OCPBUGS-132571: unconfigured-ignition must include nmstateconfig.yaml when present #11013
OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #10983
OCPBUGS-132164: support InfraEnv AdditionalNTPSources in unconfigured-ignition #11003
OCPBUGS-105364: Azure: delete bootstrap ignition storage during bootstrap destroy #10778
OCPBUGS-130602: Add internalJoinSubnet to installConfigOverrides #10971
OCPBUGS-130359: Warn about ignored install-config fields in ABI #10964
OCPBUGS-128831: gcp: skip quota checks on transient errors #10935
OCPBUGS-126568: [release-4.22] Bump Azure Marketplace Images to be up-to-date #10884
OCPBUGS-127124: use different INSTALL_INVOKER for unconfigured ignition #10903
SPLAT-2865: Add vSphere multi vCenter Day 2 support #10740
OCPBUGS-122251: [release-4.22]: Promote GCD to GA #10871
OCPBUGS-126806: Inject the pull-secret as podman secret in the agent-installer-ui container #10897
OCPBUGS-122133: gcp: skip disk type check when the permission is denied #10862
OCPBUGS-119240: gcp: allow GCD load balancer health-check firewall ranges #10853
OCPBUGS-100061: openstack: Reserve addresses for load balancer #10725
OCPBUGS-114639: OCPBUGS-112550, OCPBUGS-112549: Release 4.22 GCD and KMS support #10783
AGENT-1583: post-feature promotion (NoRegistryClusterInstall) openshift/api dependencies bump #10817
OCPBUGS-112471: Update timeout in GetMarketplaceImage to 5 minutes #10784
OCPBUGS-111885: pin argcomplete for yq on Python 3.9 (release-4.22) #10766
Bug OCPBUGS-99399: baremetal: fix provisioning ISO kernel arguments #10703
AGENT-1546: Backport NoRegistryClusterInstall feature to release-4.22 #10683
OCPBUGS-87814: [release-4.22] Add omitempty to vSphere and Nutanix MachinePool slice fields #10606
OCPBUGS-95555, OCPBUGS-99017: bump golang.org/x/crypto to 0.52.0 #10695
OCPBUGS-98982: Update RHCOS-release-4.22 bootimage metadata to 9.8.20260715-1 / 10.2.20260715-0 #10692
OCPBUGS-98701: cluster-api: disable diagnostics endpoint for local CAPI controllers #10685
OCPBUGS-87812: [release-4.22] fix: reset associatedVCenter in failure domain validation loop #10604
OCPBUGS-97964: destroy/aws: delete vpc endpoints earlier #10674
no-jira: images: bump UPI image dependencies to 4.22 #10582
OCPBUGS-84402: Bump go-jose/v4 to 4.1.4 #10597
OCPBUGS-84643: Update RHCOS-release-4.22 bootimage metadata to 10.2.20260521-0 / 9.8.20260520-0 #10572
OCPBUGS-85407: PowerVS: Add port 80 security group rule #10548
OCPBUGS-85503: PowerVS: Fix supported system types retrieval #10521
OCPBUGS-84701: vSphere - Missing unit tests to cover polarion workitems #10526
OCPBUGS-84663: add unit tests for Nutanix to replace polarion workitems #10525
OCPBUGS-84643: Update RHCOS-release-4.22 bootimage metadata to 10.2.20260423-0 / 9.8.20260428-0 #10523
OCPBUGS-83611: PowerVS: update release 4.22 CAPI to v0.12.2 #10509
MULTIARCH-5854: implements retry-after logic to limit failures #10421
OCPBUGS-78151: Add provisioningNetworkGateway field to install-config #10387
OCPBUGS-77965: Update RHCOS-release-4.22 bootimage metadata to 10.2.20260405-0 / 9.8.20260403-0 #10482
OCPBUGS-77917: PowerVS: Use short regions and provide a default resource group in survey #10369
CORS-3900: Add IPv6 frontend IP configurations for dual-stack #10328
MCO-2135: Label Machines, MachineSets, and ControlPaneMachineSets with OSStream labels #10426
OCPBUGS-81509: fix ASO CRD duplication #10451
OCPBUGS-76468: PowerVS:: SSH key must be RSA #10289
no-jira: PowerVS: add mjturek and hamzy to approvers list #10483
OCPEDGE-2072: bump(ocp/api): pull in latest for DualReplica promotion #10471
OCPBUGS-77830: skip redirect when validating endpoint accessibility #10360
OCPBUGS-81622: Collect bootstrap service records in agent-gather #10457
AGENT-1448: Add IRI registry authentication support #10389
OCPBUGS-81635: AWS: Increase cluster bootstrap timeout with userProvisioned DNS #10459
CORS-4373: Remove checks for AzureClusterHostedDNSInstall featuregate #10455
CORS-4316: Update the Installer GCP UPI documentation. #10235
OCPBUGS-81309: Fix vSphere with static IPs on TPNU #10442
OCPBUGS-79542: Mount pullsecret manifest to UI container #10411
OCPBUGS-81470: Restart sshd after applying node-image to bootstrap #10452
OCPBUGS-37587: Sign blob container using user delegated creds #9851
SPLAT-2622: Bump govmomi to v0.53.0 #10431
OCPBUGS-78935: Fix bootstrap VM on non-x86 platforms #10419
CORS-4352: aws: validations to ensure install-config is valid for dualstack install #10380
OCPBUGS-74528: upkeep: remove tna feature gate #10403
NO-JIRA: Add Ella, Daniel to openstack-reviewers #10434
CORS-4324: Update default release image to 4.22 #10429
OCPBUGS-78589: baremetal: add serial console logging for bootstrap VM #10400
CORS-4359: feature gate install into EU Sovereign Cloud #10412
OCPBUGS-59514: redacted install config for baremetal #9972
AGENT-1461: Do not discard NMStateConfig when agent-config is on disk for unconfigured-ignition #10393
AGENT-1471: Fix race condition: wait for agent-register-infraenv before showing UI URL #10422
MCO-2116: Generate OSImageStream manifest #10357
AGENT-1136, AGENT-1229: Add auth to unconfigured-ignition #10381
SPLAT-2172: AWS dedicate host support #10079
MCO-2133: Select bootimages based on OSImageStream #10321
CORS-4336: Support for AWS European Sovereign Cloud #10303
OCPBUGS-74390: Allow all instance types in the install config for GCP #10271
no-jira: fix SC2328 shellcheck errors #10413
AGENT-1458: Don’t auto-calculate RendezvousIP in unconfigured-ignition #10405
CORS-4358: aws: add ICMPv6 ingress rule for dual-stack clusters #10408
CORS-4235: Machine Management API Field & Feature Gate #10402
no-jira: bump golangci-lint to v2.10.1 for Go 1.25 support #10397
OCPBUGS-57603: Disallow cross subscription encryption sets #10335
OCPBUGS-64842: Disable LoadBalancer in cloud config when Octavia is unavailable #10326
CORS-4288: docs(azure): Restructure tested VM families with Series-based organization #10314
CORS-4072: dualstack support for AWS #10353
CORS-4355: define required permissions for dualstack install #10371
CORS-3897: Dual stack support for cluster manifest & VNet #10319
CORS-4078: aws: standardize AWS client setup in the destroy code #10340
OCPBUGS-75250: Use correct Project ID with GCP Shared VPC #10297
METAL-1668: simplify BMC CA assets #10243
METAL-1750: baremetal: use q35 machine type with EFI firmware for bootstrap VM #10349
OCPEDGE-2383: feat: update sno minimum to 4vcpu #10283
CNTRLPLANE-2847: bump Go 1.25, openshift/api, and k8s.io dependencies #10376
OCPBUGS-77717: Updating ose-installer-container image to be consistent with ART for 4.22 #10351
OCPBUGS-78190: Pass image policy env setting to assisted #10379
OCPBUGS-77261: Increase timeout for waiting control plane #10370
OCPBUGS-77742: Updating ose-installer-artifacts-container image to be consistent with ART for 4.22 #10354
NO-JIRA: aws: validate instance type and AMI compatibility for SEV-SNP #10126
CORS-4345: aws: config must be created with install region #10374
OCPBUGS-77722: Updating ose-baremetal-installer-container image to be consistent with ART for 4.22 #10352
no-jira: Golangci config #10372
METAL-156: Use Live ISO for baremetal bootstrap VM #9814
no-jira: Bump openshift api #10347
no-jira: OCPBUGS-77255: wait for node-image-overly to restart sshd #10363
OCPBUGS-77683: Add c8g* to tested_instance_types_aarch64 #10356
OCPBUGS-77440: Image in worker machineset is auto-updated when user specifies the osImage #10341
OCPBUGS-66941: aws: throughput/iops validation for machine pools #10222
no-jira: [OCPBUGS-77255]: kludge: restart sshd server #10345
OCPBUGS-70168: Increase size of /var/ostreecontainer mount #10304
no-jira: ibmcloud: fix region survey default value #10336
OCPBUGS-77355: fix wavelength zone name regex #10338
CORS-4345: remove AWS SDK v1 unused code and go deps #10339
CORS-4244: adjust validations to allow dual-stack CIDRs on AWS #10241
CORS-3954: Enable strict unmarshaling for user invocations #10287
CORS-4076: bump capa version to support dualstack network infrastructure #10337
OTA-1861: data/bootstrap/files/usr/local/bin/bootkube: Pass CVO render –cluster-version-manifest-path #10295
OCPBUGS-77182: PowerVC: Add default LB #10333
OKD-259: Add Validatation for the OKD Featureset to Prevent it From Being Enabled on OCP Clusters #10260
OCPBUGS-54298: Installer should validate mirror registry pull secret #10239
OCPBUGS-56846: validate azure user-assigned identity existence #10220
CORS-4055: migrate CCO permission check to AWS SDK v2 #10262
OCPBUGS-63065: Expand Azure userTags to support Azure Government Cloud #10015
OCPBUGS-55407: set DNS zone for Azure Stack Hub private clusters #10233
CORS-4302: Add N4A instance types to accepted in Installer #10292
CORS-4142: ensure lbType is NLB when dual-stack is configured #10256
MCO-2031: OS Image Stream to install-config schema #10192
CORS-4055: migrate EC2 API calls to AWS SDK v2 #10244
OCPBUGS-60162: reject byo vpc/subnets with CAPI owned cluster tag #9913
OCPBUGS-41570: Ensure correct mask for bootstrap external IP #8987
OCPEDGE-2276: Add support for platform None and External in TNA clusters #10286
OCPEDGE-2276: Add support for platform None in TNA (Two-Node Arbiter) clusters #10236
CORS-4055: migrate credential provider check to AWS SDK v2 #10261
CORS-4328: configure AWS CCM NodeIPFamilies for dual-stack support #10257
CORS-4055, CORS-4078: migrate ELB/ELBv2 API calls to AWS SDK v2 #10258
OCPBUGS-74631: Add validation to reject userProvisionedDNS on Azure Stack Hub #10279
CORS-4055: migrate default region check to AWS SDK v2 #10267
OCPBUGS-74625: gcp: skip AI zones #10269
CORS-4055: migrate IAM API calls to AWS SDK v2 #10245
CORS-4055: migrate S3 API calls to AWS SDK v2 #10242
OCPBUGS-63305: Make SimulatePrincipalPolicy optional #10081
OCPBUGS-67816: Revert storage account API version for client #10224
OCPBUGS-74078: add support for NVIDIA H100 and H200 enabled machine series #10234
CORS-4299, CORS-4300: Allow N4A Instance Types in the installer #10211
no-jira: add trace-config Claude command for installconfig field usage analysis #10190
AGENT-1309: Increase disk size requirements for master and SNO #10254
OSDOCS-17769: Add AWS m7 instance types #10246
CORS-4073: validate instance type support IPv6 in dual-stack #10238
OCPBUGS-74363: Remove region option for the GCP Private Service Connect Endpoint #10249
NO-JIRA: use v2 config for go-lint #10240
AGENT-1425: Fix stale dependency in agent-register-infraenv #10237
AGENT-1309: Modify NoRegistryClusterInstall storage requirements #10176
OCPBUGS-56770: Honor user-specified bootDiagnostics on Azure Stack Hub #10223
OCPBUGS-63028: filtering only PEs from cluster list #10193
CORS-4075, CORS-4113: Install-config and Infra manifest updates for DualStack for AWS and Azure #10207
OCPBUGS-72525: add newly detected instance types for Azure during 4.21 regression test #10202
OCPBUGS-69735: handle SSH rule deletion for Azure private #10213
OCPBUGS-69734: Fix destroy bootstrap command for Azure #10212
NO-JIRA: add user Rolv-Apneseth to coreos-maintainers and coreos-reviewers #10206
OCPBUGS-69923: ensure deterministic zone ordering for control plane machines #10188
NO-JIRA: Add angelcerveraroldan to coreos approvers and reviewers #10209
OCPBUGS-72577: bump default channel to stable-4.22 for main(4.22) branch #10205
OCPBUGS-71232: Fix nil pointer exception in azure mapiImage #10200
OCPBUGS-70013: Updating ose-installer-container image to be consistent with ART for 4.22 #10182
no-jira: Platform Experts Claude Command #10186
no-jira: Add barbacbd for gcp owners #10189
OCPBUGS-70021: Updating ose-baremetal-installer-container image to be consistent with ART for 4.22 #10183
OCPBUGS-70047: Updating ose-installer-artifacts-container image to be consistent with ART for 4.22 #10184
no-jira: Fix linting issues for golangci-lint v2 #10138
NO-JIRA: remove pod-infra-container-image flag from kubelet #10145
OCPBUGS-69870: rename “var-ostree\x2dcontainer.mount” to something more computer-friendly #10171
OCPBUGS-69840: PowerVC: fix PostProvision #10175
OCPBUGS-69434, SPLAT-2584: Added ability to install different IPAM version when in TP. #10169
OCPBUGS-65859: Fix set-hostname dependency for interactive console services #10118
OCPBUGS-17667: Validate vCenter datacenters in failure domain topology #10086
OCPBUGS-61344: skip deleting snapshots managed by AWS Backup service #9964
OCPBUGS-62870: installing into GCP Shared VPC with minimal permissions #10157
OCPBUGS-64775: use CAPZ to provision ssh rule #10162
OCPBUGS-66295: Fix ignition warning about agent-extract-tui.service #10146
AGENT-1357: remove AgentWorkflowTypeInstallInteractiveDisconnected workflow #10020
And 5 elided commits (e.g. from squash or rebase merges)
Full changelog

baremetal-machine-controllers

: OCPBUGS-123142: Bump Go builder to 1.26 and protobuf to v1.36.12 #284
OCPBUGS-101871: Bump golang.org/x/net to v0.58.0 to address CVE-2026-33814 #264
OCPCLOUD-3346: Bump deps + Add centralized TLS configuration to Metal3Remediation webhook server #248
OCPBUGS-77619: Updating baremetal-machine-controller-container image to be consistent with ART for 4.22 #250
OCPBUGS-74161: manifests: remove metal3remediation, now deployed from o/cluster-api-provider-metal3 #249
NO-ISSUE: Update fetch_ext_bins.sh to use setup-envtest for kubebuilder binaries #251
OCPBUGS-73995: Updating baremetal-machine-controller-container image to be consistent with ART for 4.22 #242
NO-ISSUE: Synchronize OWNERS with CAPM3 #241
OCPBUGS-69896: Updating baremetal-machine-controller-container image to be consistent with ART for 4.22 #240
Full changelog

baremetal-operator

OCPBUGS-90570: Reject non-empty checksum for OCI images #501
OCPBUGS-99420: Create ports if they are already inspected and machine is re-registering #518
OCPBUGS-83866: Include image URL and checksum in provisioning error message #500
OCPBUGS-94109: cherry-pick reconciler optimizations #503
OCPBUGS-97940: Add BMH finalizer on PreprovisioningImage #505
OCPBUGS-87963: Fix preprovisioning network Secret lifecycle during BMH deletion #491
OCPBUGS-66071: Fix PPI for ACM #456
OCPBUGS-64617: Merge upstream #473
METAL-1720: Merge upstream #467
METAL-1708: Merge upstream 2026-03-09 #466
NO-ISSUE: Merge upstream #465
Updating ose-baremetal-operator-container image to be consistent with ART for 4.22 #464
NO-ISSUE: Merge upstream #455
Bug OCPBUGS-75006: BMO fails to start servicing despite updates to HFC spec #457
OCPBUGS-65571: Fix deletion hang when aborting inspection during power-off #447
NO-ISSUE: Fix invalidDNSNameinvalidipv6 test for Go 1.24+ #448
OCPBUGS-70265: Fix errors.As usage for NoDataInSecretError #444
NO-ISSUE: Merge upstream #442
OCPBUGS-70018: Updating ose-baremetal-operator-container image to be consistent with ART for 4.22 #441
METAL-1693: Add “merge-upstream” slash command #437
OCPBUGS-65571: Abort inspection/cleaning before powering off during deletion #438
Full changelog

baremetal-runtimecfg

OCPBUGS-123142: Bump Go builder to 1.26 and protobuf to v1.36.12 #418
OCPBUGS-101879: Fix CVE-2026-33814 by adding patch for golang.org/x/net package #404
OCPBUGS-112618: Cloud Platforms: Filter out node’s own IP from Upstreams #401
OPNET-709: Migrate from iptables to nftables #387
OCPBUGS-77301: Remove VIP leasing feature #385
Updating ose-baremetal-runtimecfg-container image to be consistent with ART for 4.22 #386
OCPBUGS-76394: Install dbus-tools, needed in pkg/monitor/dnsmasqmonitor.go #380
OCPBUGS-42805: Add node caching with Kubernetes watch API to reduce API load #374
NO-ISSUE: Add agents.md and slash command for reviewing #375
MGMT-22546: Fix TNA and TNF dummy ip for ipv6 #369
NO-ISSUE: Migrate away from deprecated ioutil #373
OCPBUGS-69812: Updating ose-baremetal-runtimecfg-container image to be consistent with ART for 4.22 #376
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #2439
OCPBUGS-114426: Fix go vet warning in process.go #2408
OCPBUGS-114426: Update build-machinery-go vendor dependency #2399
OCPBUGS-114734: Fix windows builds of oc rpm #2383
OCPBUGS-98547: bump x/crypto to the latest version #2309
OCPBUGS-85066: Add required-scc annotation to node-joiner pod #2266
NO-JIRA: claude: Split tester agent away from code-reviewer #2250
OCPBUGS-77845: Fix extraction of gated manifests using –install-config #2249
NO-ISSUE: recover the context in upgrade #2248
NO-JIRA: claude: Turn pr-review skill into code-reviewer agent #2245
OCPBUGS-59311: must-gather: Handle signals properly #2237
OTA-1548: set up accepted risks #2170
MCO-1961: Allow multiple machine-os versions #2157
Revert “TRT-2587: Revert #2219 “CNTRLPLANE-2769: Bump k8s dependencies to 1.35”” #2241
TRT-2587: Revert #2219 “CNTRLPLANE-2769: Bump k8s dependencies to 1.35” #2236
TRT-2585: pkg/cli/admin/release/extract: Support zero-output extraction #2233
OCPBUGS-78701: adm policy add-role-to-user: Fix –dry-run=server #2231
OCPBUGS-77845: Update release extract inclusion to support feature gates and major version #2222
NO-ISSUE: pkg/cli/admin/release/extract: Read manifests into memory #2232
NO-JIRA: Add .coderabbit.yaml and AGENTS.md configurations #2229
CNTRLPLANE-2769: Bump k8s dependencies to 1.35 #2219
NO-JIRA:Fixing manifest ci failure #2228
OCPBUGS-64840: image extract: Use Explicit strategy for ICSP/IDMS #2202
NO-JIRA: fix: reduce the amount of resources for debug pod #2225
NO-JIRA: oc fips ci fix #2224
OTA-1856: pkg/cli/admin/release/mirror: Deprecate in favor of oc-mirror #2195
OTA-1864: Extend update recommend precheck alerts #2210
COS-4005: Allow periods in display name labels for version validation #2215
NO-ISSUE: images/tools/Dockerfile: Install iotop, if that fails fall back to iotop-c #2216
OCPBUGS-76318: pkg/helpers: Print the right error object #2197
OKD-322: Update OC-tools Dockerfile to work on CentOS/RHEL 10 #2205
CNTRLPLANE-2656: fixing oc cli failures #2199
OCPBUGS-76319: Makefile: Strip debugging symbols by default #2196
OCPBUGS-76958: inspect: Allow resource group to be specified in the namespace resources list #2204
OCPBUGS-76394: Ignore group ownership on rpm -V #2206
OCPBUGS-76394: Install subscription-manager in cli image #2200
Revert “CNTRLPLANE-2656: Fixing oc client cases for microshift and metal ipv6 profiles” #2198
CNTRLPLANE-2656: Fixing oc client cases for microshift and metal ipv6 profiles #2192
OCPBUGS-74543: expose: Fix labels not being added to route #2189
Revert “CNTRLPLANE-2656:Migrating oc cli tests to ote” #2191
CNTRLPLANE-2656: Migrating oc cli tests to ote #2181
OSDOCS-18071: Updating CLI docs templates to include a required abstract/short description #2190
OCPBUGS-73893: Fix unit test failure by updating ruby version to 3.3 #2184
NO-ISSUE: add SecurityContext to node image creation and monitor containers #2139
CNTRLPLANE-2167: Adding oc ote sanity test #2180
CNTRLPLANE-2167: Integrate OpenShift Test Extension (OTE) into oc #2177
CNTRLPLANE-2167: Integrate OpenShift Test Extension (OTE) into oc #2176
OCPBUGS-64619: oc login: Respect insecure flag from kubeconfig #2134
NO-JIRA: Bump library-go to update selinux and x/crypto #2169
OCPBUGS-70063: Updating ose-cli-artifacts-container image to be consistent with ART for 4.22 #2168
OCPBUGS-70061: Updating openshift-enterprise-deployer-container image to be consistent with ART for 4.22 #2167
OCPBUGS-69894: Updating ose-tools-container image to be consistent with ART for 4.22 #2166
OCPBUGS-69835: Updating openshift-enterprise-cli-container image to be consistent with ART for 4.22 #2164
NO-JIRA: Bump docker/docker to 28.5.2 to drop containerd/containerd dependency #2162
And 2 elided commits (e.g. from squash or rebase merges)
Full changelog

cloud-credential-operator

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #1113
OCPBUGS-123142: Bump Go builder to 1.26 and protobuf to v1.36.12 #1110
OCPBUGS-101875: Bump golang.org/x/net to v0.56.0 to address CVE-2026-33814 #1096
OCPBUGS-114669: [release-4.22] GCP Alternate Universe Domain Support for WIF #1092
OCPBUGS-114669: Enable GCP custom universe domain support for CCO #1083
NO-JIRA: Revert “OCPBUGS-87828: Scope minted AWS IAM policies to cluster-owned resources” #1059
OCPBUGS-87828: Scope minted AWS IAM policies to cluster-owned resources #1045
OCPBUGS-84398: github.com/go-jose/go-jose/v4 v4.1.4 #1020
OCPBUGS-83625: test-ext: hypershift skip CCO metrics endpoint validation #1013
CCO-738, CCO-739, CCO-740: Overhaul status logic to correctly match spec #1008
CCO-787: use apiserver tls config #965
CCO-824: feat(gcp): add key-storage-method flag for workload identity providers #1004
CCO-779: e2e for removing kube-rbac-proxy container (CCO-779) #991
OCPBUGS-81584: Skip CCO health check test for PowerVS platform #1006
OCPBUGS-81328: tests-ext: Fix MicroShift gating in CCO tests #1005
Revert #978: CCO-738, CCO-739: Set operator condition to Progressing when pod identity webhook pod are updating #1007
CORS-4361: aws: add aws-eusc partition support for OIDC S3 buckets #995
CCO-738, CCO-739: Set operator condition to Progressing when pod identity webhook pod are updating #978
OCPBUGS-79360: google.golang.org/grpc v1.79.3 #992
CCO-788: Remove kube-rbac-proxy container from metrics #983
OCPBUGS-74627: Fix infrastructure resource name filtering in watch predicate #985
CCO-688: test-ext: enable test-extension cases for CI #984
CCO-788: test-ext: Update extend tests to adapt to CCO-788 #981
MON-4475: chore: add permissions on endpointslice to Prometheus Role and use serviceDiscoveryRole: EndpointSlice in ServiceMonitors #964
TRT-2568: Revert “CCO-788: Remove kube-rbac-proxy container from metrics” #982
CCO-788: Remove kube-rbac-proxy container from metrics #976
OCPBUGS-77550: cloud-credential-tests-ext to support multiple architectures #979
CCO-726: Update go modules #974
CCO-767: test-ext: Migrate openshift-tests-private E2E cases #961
CCO-813: Update kubernetes v1.35 and golang v1.25 #967
OCPBUGS-74384: Resolve nil pointer exception in hasResourceTags #966
CCO-805: Ability to use featureGates #962
OCPBUGS-71221: test-ext: remove kubernetes module dependency #957
OCPBUGS-70033: Updating ose-cloud-credential-operator-container image to be consistent with ART for 4.22 #956
CCO-789: Add Agentic AI helper files #953
Full changelog

cloud-network-config-controller

OCPBUGS-123142: Bump Go builder to 1.26 and protobuf to v1.36.12 #277
: [release-4.22] OCPBUGS-115316: GCP: Set Universe Domain #264
OCPBUGS-74496: Add UserAgent to Azure SDK client telemetry options #208
GCP-429: feat: Add GCP Workload Identity Federation (WIF) credential support #206
CORENET-6562: CNCC rebase k8s to 1.35.0 #202
OCPBUGS-77711: Updating ose-cloud-network-config-controller-container image to be consistent with ART for 4.22 #207
CORENET-6500: fix lint job and linting failures #201
OCPBUGS-69998: Updating ose-cloud-network-config-controller-container image to be consistent with ART for 4.22 #196
OCPBUGS-45056, OCPBUGS-57447: Refrain from adding Egress IP to public LB backend pool #180
Full changelog

cluster-authentication-operator

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #1021
OCPBUGS-114426: Update build-machinery-go vendor dependency #1000
OCPBUGS-101881: Bump golang.org/x/net from v0.47.0 to v0.53.0 #979
OCPBUGS-85105: Fix OAuth page showing OKD branding instead of OpenShift #888
OCPBUGS-84954: Fix terminationMessagePolicy on network policy e2e test pods #884
CNTRLPLANE-2625: Add Auth network policy e2e cases #831
OCPBUGS-78403: Do not return error when an IdP returns 500 during a grant check #856
Revert “CNTRLPLANE-2589: Migrate test/e2e-encryption to Ginkgo v2 framework” #857
CNTRLPLANE-2589: Migrate test/e2e-encryption to Ginkgo v2 framework #839
NO-JIRA: OWNERS: add everettraven as reviewer/approver add ibihim as approver #842
CNTRLPLANE-2610: Create network policies for AUTH components #825
CNTRLPLANE-2990: Update CAO to no longer write to the Authentication.spec.webhookTokenAuthenticator field #854
CNTRLPLANE-2996: dependencies: k8s 1.35 rebase #853
CNTRLPLANE-2552: Add support for CEL expression claim mappings for username and groups #850
MON-4473: Migrate Prometheus targets discovering from Endpoints to EndpointsSlices #823
OCPBUGS-74039: Updating ose-cluster-authentication-operator-container image to be consistent with ART for 4.22 #851
CNTRLPLANE-312: Add generation logic for new API fields in the Authentication CR #810
CNTRLPLANE-2589: update cases to execute as serial/parallel #833
CNTRLPLANE-2241: Update library-go to get KMS encryption #837
CNTRLPLANE-2247: Add Test encryption provider migration #838
CNTRLPLANE-2247: Adding KMS TestKMSEncryptionOnOff test for AUTH #834
CNTRLPLANE-2241: Conditionally add the KMS plugin volume mount to the oauth-apiserver container #827
CNTRLPLANE-2589: Migrate serial e2e tests to Ginkgo framework #828
CNTRLPLANE-2247: Add KMS encryption test target #829
CNTRLPLANE-2589: Migrate RouterCerts e2e test to Ginkgo framework #826
CNTRLPLANE-2589: OTE infrastructure #822
API-1835: test/oauth-server-payloadConfigController: adds a test to show which input resources are required to run the operator and the payloadConfigController #786
OCPBUGS-70005: Updating ose-cluster-authentication-operator-container image to be consistent with ART for 4.22 #819
API-1835: adds an integration test for the oauth-server deployment controller #784
CNTRLPLANE-2196: set up openshift-tests-extension for cluster-authentication-operator #816
NO-JIRA: Add agents.md file #818
Full changelog

cluster-autoscaler

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #456
OCPBUGS-102038: [4.22] Fix OCPBUGS-102038 #434
OCPBUGS-99551: [release-4.22] UPSTREAM: 10001: chore(clusterapi): add machine phase check for failed machines #431
OCPBUGS-84131: [release-4.22] UPSTREAM: 9458: fix(clusterapi): use kind-aware version discovery for infra references #419
NO-JIRA: ignore tool and hack files in .snyk scans #416
OCPBUGS-78152: allow clusterapi provider to skip paused resources #409
OCPBUGS-77631: Updating ose-vertical-pod-autoscaler-container image to be consistent with ART for 4.22 #408
AUTOSCALE-482: VPA E2Es: switch from docker.io ubuntu to k8s-hosted image #406
OCPBUGS-66405: Pick upstream commits to Fix VPA recommender concurrent access panic #403
AUTOSCALE-482, AUTOSCALE-483: 1.35.0 Upstream rebase #401
OCPBUGS-74005: Updating ose-vertical-pod-autoscaler-container image to be consistent with ART for 4.22 #399
OCPBUGS-70023: Updating atomic-openshift-cluster-autoscaler-container image to be consistent with ART for 4.22 #397
OCPBUGS-69928: Updating ose-vertical-pod-autoscaler-container image to be consistent with ART for 4.22 #396
Full changelog

cluster-autoscaler-operator

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #405
OCPBUGS-101883: Bump x/net package in release-4.22 #387
OCPBUGS-65578: report Progressing=True on version upgrade #366
AUTOSCALE-560: Add support for using centralized cluster TLS profile for webhook service #367
OCPBUGS-78797: update rbac to include DRA-related resources #365
MON-4498: Migrate Prometheus targets discovering from Endpoints to EndpointSlices #363
OCPBUGS-65471: Add rbac related objects to clusteroperator #364
AUTOSCALE-172: add kube api content type flag to autoscaler #362
AUTOSCALE-483: Prepare for 4.22 #361
OCPBUGS-69828: Updating ose-cluster-autoscaler-operator-container image to be consistent with ART for 4.22 #358
Full changelog

cluster-baremetal-operator

OCPBUGS-101893: Bump golang.org/x/net to v0.53.0 #677
OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #682
OCPBUGS-122244: Make HostPath VolumeMounts ReadOnly for image customization container #660
OCPBUGS-99390: Make CBO progress in non-baremetal platforms #646
OCPBUGS-99390: Cluster Operator baremetal did not report Progressing=True during a cluster update #634
OCPBUGS-99501: Apply cluster TLS profile to ironic-proxy container #635
OCPBUGS-87212: Add watcher for both TLS Adherence policy and profile changes #610
OCPBUGS-86226: Fix empty IRONIC_BASE_URL #606
OCPBUGS-85640: Fix webhook to validate the actual admission request object #602
OCPBUGS-84936: Fix webhook server not starting due to missing WithValidator #598
OCPBUGS-84924: Bind the plain HTTP 8080 metrics port to localhost #596
OCPBUGS-78151: Add provisioningNetworkGateway field to CBO #575
METAL-1715: Enforce 1-year validity and 30-day auto-rotation for Ironic TLS certs #570
METAL-1780: Gate TLS profile enforcement on APIServer tlsAdherence field #582
METAL-1720: Add IRONIC_ROOTFS_URL env var for multi-arch rootfs override #583
METAL-1716: Handle IPv6/dual-stack addresses in certificate SANs #573
NO-ISSUE: Update envtest version #580
METAL-1720: Add DEPLOY_KERNEL env var for image-customization-controller #581
METAL-1734: Add support for centralized tls #572
METAL-1714: Populate complete SANs in Ironic TLS certificate #569
OCPBUGS-69399: Allow ProvisioningCIDR for unmanaged network #553
Updating ose-cluster-baremetal-operator-container image to be consistent with ART for 4.22 #568
OCPBUGS-65472: Add ClusterRole to baremetal ClusterOperator relatedObjects #544
OCPBUGS-73970: Updating ose-cluster-baremetal-operator-container image to be consistent with ART for 4.22 #545
OCPBUGS-77027: Update kubebuilder tools to more latest version #556
OCPBUGS-72548: Fix ironic-proxy service routing for port 6385 #546
OCPBUGS-71233: Fix libguestfs /tmp access in machine-os-downloader init container #549
OCPBUGS-70157: Add sharedVolumeMount to machine-os-downloader init container #540
OCPBUGS-67216: Remove the writable ironic CA cert volume mount at /certs/ca/ironic path, ironic will use the writable /conf mount if needed #535
NO-ISSUE: Add AGENTS.md #538
OCPBUGS-69769: Updating ose-cluster-baremetal-operator-container image to be consistent with ART for 4.22 #537
Full changelog

cluster-bootstrap

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #152
OCPBUGS-123142: Update build-machinery-go vendor dependency #148
OCPBUGS-69694: Updating ose-cluster-bootstrap-container image to be consistent with ART for 4.22 #124
Full changelog

cluster-capi-controllers

OCPBUGS-123142: Bump Go builder to 1.26 and protobuf to v1.36.12 #317
OCPBUGS-83913,UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api:v1.12.7 (b5fa593) into release-4.22 #285
OCPBUGS-83759, OCPCLOUD-3419: Adopt IPAM CRDs on upgrade #280
NO-JIRA: IPAM CRDs: Use negated feature-gate: -ClusterAPIMachineManagement instead of feature-set: Default #273
OCPCLOUD-3291: Merge https://github.com/kubernetes-sigs/cluster-api:v1.12.4 (8c01d2f5) into master #255
OCPCLOUD-3320: Fix continuous reconciliation of cluster-api manifests #269
OCPBUGS-73976: Updating ose-cluster-api-container image to be consistent with ART for 4.22 #262
OCPCLOUD-3320: Use new manifests-gen #259
OCPBUGS-74426: CAPI IPAM CRDs override storage version to v1beta1 #263
NO-JIRA: UPSTREAM: <carry>: Add manifests verify target #261
OCPBUGS-69810: Updating ose-cluster-api-container image to be consistent with ART for 4.22 #258
OCPBUGS-69434: openshift: CAPI IPAM TechPreviewNoUpgrade: set webhooks failurepolicy: Ignore #256
Full changelog

cluster-capi-operator

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #687
OCPBUGS-96609: Bump golang.org/x/net to v0.56.0 to fix CVE-2026-27136 #624
OCPBUGS-86353: fix: scope webhook to capi namespace, remove unused webhook endpoints #568
NO-JIRA: Allow sustaining engineering to self serve dependency updates #555
OCPBUGS-84942: fix: remove retired Microsoft.ClassicStorage permission #548
OCPBUGS-83917: Bump grpc package for CVE fix in 4.22 #539
OCPBUGS-84365: Fix e2e flake when workers are in us-west-2b #530
NO-JIRA: Optimize envtest CRD loading by specifying necessary files explicitly #520
OCPCLOUD-3319: Remove capiinstaller controller #507
OCPCLOUD-3419: Add adopt-existing annotation #514
NO-JIRA: Fix flake in object pruning envtests #516
OCPBUGS-80922: Add CVO proxy injection annotation to capi-operator Deployment #518
OCPBUGS-81683: fix: remove Microsoft.Resourcehealth/healthevent permission #515
NO-JIRA: Add ClusterAPI singleton to related objects #508
OCPCLOUD-3365, OCPCLOUD-3384: Implement admission action Warn and ensure validations not active when not configured #492
OCPCLOUD-3321, OSASINFRA-3980: Add openstack-resource-controller image to images.json #506
OCPCLOUD-3319: Create installer controller #494
NO-JIRA: Fix 2 failures in ci jobs #485
SPLAT-2167: Added dedicated host support for AWS #374
OCPCLOUD-3319: Convert ReconcileResult to use a builder pattern #501
OCPCLOUD-3319: Simplify RelatedObjects on the cluster-api ClusterOperator #497
NO-JIRA: Common provider manifest fixtures #498
NO-JIRA: Drop unused replace manifests-gen #504
OCPBUGS-77188: Fix CRD Requirement deployment on SNO #502
NO-JIRA: Move ProviderMetadata into manifests-gen #503
NO-JIRA: Fix malformed VAP #499
NO-JIRA: Instruct agents more forcefully to run tests with make unit #496
OCPCLOUD-3319: Bump controller-runtime to v0.23 #495
OCPCLOUD-3290: Dependency bumps for release 4.22 #491
OCPCLOUD-3184: Implement object schema pruning for compatibility requirements #464
OCPCLOUD-3350: Revision controller #469
NO-JIRA: Add CodeRabbit inheritance for org-wide rules #489
OCPCLOUD-3005, OCPCLOUD-3186, OCPCLOUD-3367: Implement validation webhook for custom resource admission #461
NO-JIRA: Remove duplicated vnet delete permission #252
NO-JIRA: improve unit test performance and CI flakiness #487
OCPCLOUD-3369: Implement RequiredVersions functionality for CompatibilitySchema #471
OSASINFRA-3980: Re-add openstack credentials request #478
NO-JIRA: e2e: improve failure diagnostics #484
OCPCLOUD-3386: Implement feature-gate support in capi-operator endpoint #475
OCPCLOUD-3364: Implement ExcludedPaths functionality for CRD validation webhook #467
NO-JIRA: Add missing CVO annotations to RBAC #480
NO-JIRA: Set admission failure policy to Ignore #479
OCPCLOUD-3329: Manifests gen all the VAPs #470
NO-JIRA: Update HaveCondition to version from revision controller branch #481
OCPBUGS-77363: manifests-gen: fix nil deref for non-webhook CRDs #482
NO-JIRA: e2es improvements #473
NO-JIRA: coderabbit: Tell it not to warn about old Go #474
NO-JIRA: Add timeout to all eventually entries with contexts #472
OCPCLOUD-3005: Add CRD admission time validation implementation #459
OCPCLOUD-3262: MAPI & CAPI MachineSet VAP #440
OCPCLOUD-3005: Add MWC/VWC to compatibility requirements RBAC #466
NO-JIRA: Adds test-standards skill for claude #468
OCPCLOUD-3005: Initial implementation of CompatibilityRequirement reconciler and webhook #458
OCPBUGS-77036, OCPCLOUD-3342: provider images disconnected support #463
OCPCLOUD-3005: Bootstrap compatibility requirements deployment #457
OCPCLOUD-3327: Rewrite manifests-gen to support upgrade safety #434
NO-JIRA: Fix NetworkPolicy for openshift-capi-operator namespace #453
OCPCLOUD-3327: Fix up related objects #452
OCPBUGS-74295: Move installer controller to independent manager #447
NO-JIRA: fix: e2e: workaround for flakes caused by OCPBUGS-74571, until it is fixed #449
OCPBUGS-61949: Remove references to cluster-api-operator image #384
OCPCLOUD-3315: Add AWS CPUOptions to conversion #438
OCPCLOUD-3017: add SHARD_ARGS #442
OCPCLOUD-2566: tests with VAP msgs #386
NO-JIRA: Fix AWS fuzz tests by constraining Volume throughput to int32 range #441
OCPCLOUD-3263: CAPI MachineSet creation validation #437
OCPBUGS-69737: Updating ose-cluster-capi-operator-container image to be consistent with ART for 4.22 #436
NO-JIRA: Update openshift/api #439
OCPCLOUD-3172: machinesetsync: refactor to a generalized differ which can work independent of types #382
OCPCLOUD-2640: CAPI Machine creation validation #412
NO-JIRA: Write provider version to openshift/provider-version.mk #424
OCPCLOUD-3105: make use of sigs.k8s.io/cluster-api’s v1beta2 #428
OCPBUGS-63524: fix: e2e: CAPI creation issue/scale-down wait issue/machine nodeRef comparison issue #429
Full changelog

cluster-cloud-controller-manager-operator

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #525
SPLAT-2865: Added support to manage kube-cloud-config for vSphere in openshift-config-managed #498
OCPBUGS-101897: Bump golang.org/x/net to v0.53.0 to address CVE-2026-33814 #509
OCPBUGS-114394: [release-4.22] GCP Alternate Universe Domain Support #508
OCPBUGS-112665: Moved node sync job creation from manifest to operator controller #507
OCPBUGS-105883: Created new job to update vSphere nodes to have vsphere label #501
OCPBUGS-94184: OCPBUGS-65582: [release-4.22] OCPBUGS-65582: manifests: Shift operator Deployment and ClusterOperator after CredentialsRequests #484
SPLAT-2794: Create OTE Binary and add vSphere hybrid e2e tests #471
OCPBUGS-92656: e2e/ccm-aws-ote: support to dual-stack IPv6 primary #480
NO-JIRA: fix: report all degraded controller conditions instead of first only#444 #444
OCPCLOUD-3348: Honor TLSAdherence #440
SPLAT-2672: e2e/ote/ccm-aws: moving OTE binary from CCM-AWS #437
OCPBUGS-78118: Add delete permission for Azure load balancers in credentials request #438
OCPCLOUD-3287: Update to k8s 1.35.1 dependencies #439
OCPBUGS-73979: Updating ose-cluster-cloud-controller-manager-operator-container image to be consistent with ART for 4.22 #432
CORS-4209: ensure NodeIPFamilies field is kept as-is after transforming #426
OCPBUGS-62176, OCPCLOUD-3348: tls: use centralized TLS profile #433
OCPBUGS-16728: Add admission policy to deny changing an AWS LB type on an existing service #362
OCPBUGS-69820: Updating ose-cluster-cloud-controller-manager-operator-container image to be consistent with ART for 4.22 #430
Full changelog

cluster-config-api

OCPBUGS-123142: Bump Go builder to 1.26 and protobuf to v1.36.12 #3081
OCPBUGS-130606: Add protocol to AWS NLB parameters #3071
OCPBUGS-128542: Promote Dynamic Configuration Manager to Default #3068
OCPBUGS-122251: Promote GCD to GA in 4.22 #3034
SPLAT-2865: Add vSphere multi vCenter Day 2 #2969
OCPBUGS-116848: Add Sovereign cloud feature gate and UniverseDomain field to GCPPlatformStatus #3022
OCPBUGS-113639: move empty CRIOCredentialProviderConfig CR to run-level 0000_10 #3010
SPLAT-2718: Promote FeatureGateVSphereMixedNodeEnv to GA #2949
OCPBUGS-113600: [release-4.22] OCPBUGS-112479: Handle Sippy date-only format in featuregate-test-analyzer #3008
OCPBUGS-105168: Add haproxyVersion in IngressController API #2971
AGENT-1578: Promote NoRegistryClusterInstall feature to default #2979
AGENT-1544: Backport NoRegistryClusterInstall feature to release-4.22 #2930
OCPBUGS-98222: add new serviceAccountToken fs type #2922
Promote EVPN Feature Gate to GA #2826
OCPBUGS-85102: Add labelSelector to MachineSet status for scale subresource #2831
OCPBUGS-83846: Add component names, manifestSubstitutions, and observedGeneration to CAPI revisions #2819
OCPBUGS-83768: extend supported values for MCN IRI image status field #2817
OCPBUGS-83755: fix(config/v1): define constants for authentication types as typed constants #2816
OCPBUGS-68358: Disable PSA for 4.22 #2802
MON-4035: Add ThanosQuerierConfig to ClusterMonitoring API #2769
NE-2520: Promote GatewayAPIWithoutOLM to GA #2772
OCPEDGE-2197: Promote TNF (Dual Replica) to default #2723
OCPBUGS-81627: Load ClusterResourceQuota CRD before CVO manifests #2796
OCPEDGE-2492: feat: promote pacemaker to v1 in prep for tnf #2792
Update verify-feature-promotion HTML output to sort entries and fix overflow #2793
Include candidate tier in default sippy queries for feature promotion #2789
CNTRLPLANE-2796: promote the event-ttl feature #2722
OCPBUGS-74533: Remove GCPClusterHostedDNSInstall featuregate #2776
NO-ISSUE: Fixes KubeletConfig API doc, adds tests and kubebuilder validation #2651
CORS-4365: Promote AzureClusterHostedDNSInstall to default #2774
Add ConfidentialCluster feature gate #2779
SPLAT-2664: Added new feature gate VSphereMultiVCenterDay2 #2783
CNTRLPLANE-3115: Add envtest releases for 4.15 and 4.16 #2785
CNTRLPLANE-2777: add TypeMeta to GenericControllerConfig #2780
tools: codegen: increase sippy request timeout for feature promotion verification #2782
MON-4036: Add TelemeterClientConfig to ClusterMonitoring API #2755
Allow JobTier=candidate in featuregate-test-analyzer with warning #2781
SPLAT-2320: vsphere vm-host zonal ga #2731
NE-2512: operator/ingress: Add configurationManagement option #2757
CORS-4337: allow AWS Europe Sovereign Cloud partition #2708
AGENT-1473: add InternalReleaseImageDegraded state type for MachineConfigNodeStatus Conditions field #2777
CNTRLPLANE-3010: Add API-side validation to enforce prefixPolicy is not set when username expression is used #2771
OCPBUGS-74528: upkeep: HighlyAvailableArbiter has been GA for 2 releases #2759
Improve feature-gated CEL validation merge semantics #2770
OPRUN-4513: Move OLMv1 Single/Own Namespace support back to TP #2766
CORENET-6390: API changes and feature gate for OVN-Kubernetes no-overlay mode #2537
OPRUN-4466: Add NewOLMConfigAPI feature gate #2756
Add TLS adherence feature gate #2680
TRT-2518: Add variant OS and JobTier to promotion check #2763
MCO-2142: Avoid OSImageStream defaultStream unset #2764
OCPBUGS-74513: OCPBUGS-74519: OCPBUGS-78487: Remove MachineConfigNodes and PinnedImages feature gates and v1alpha1 references #2715
CORS-4348: feature gate for EU Sovereign Cloud support #2740
NO-ISSUE: config/v1alpha1: Drop (Cluster)ImagePolicy since the hard cut to v1 #2760
Add prometheusConfig API #2653
OCPBUGS-74531: Remove ImageVolume #2689
MCO-1985: Move boot image skew enforcement to Default #2758
SPLAT-2637: Promoting gate AWSServiceLBNetworkSecurityGroup to GA #2717
MON-4033: Add OpenShiftMetricsConfig #2726
envtest-releases: add v1.35.1 to index #2748
Fix MachineConfiguration BootImage Enum for MachineSets/ControlPlaneMachineSets #2750
OCPBUGS-74514: OCPBUGS-74515: OCPBUGS-74516: OCPBUGS-74517: remove bootimage update feature gates #2733
OTA-253: Add cluster update preflight mode API #2684
OCPBUGS-74508: Remove GatewayAPI featuregates #2742
NO-ISSUE: Update dev go image #2735
Add CodeRabbit inheritance for org-wide rules #2746
CNTRLPLANE-2522: features: add ExternalOIDCExternalClaimsSourcing feature gate #2743
MCO-2142: OSImageStream.spec.defaultStream validation #2736
CNTRLPLANE-2550: Add support for CEL expression claim mappings for username and groups #2719
NO-JIRA: Add MachineAPIMigrationVSphere feature gate for DevPreview #2739
CNTRLPLANE-1752: Add PKI API to config.openshift.io/v1alpha1 #2645
NO-JIRA: LabelSelector should have omitzero #2741
OCPNODE-4060: Add additional storage configuration fields to ContainerRuntimeConfig #2681
AI: Adds a new /generate-tests Claude command that automates the generation of integration tests #2706
OCPSTRAT-2728: Rebase 1.35 #2578
OCPCLOUD-3386: Add platform-specific feature gates for CAPI Operator features #2730
ClusterAPI revision components can be empty #2728
NO-JIRA: feat: add link to sippy for tests #2732
SPLAT-2410: Promote ClusterAPIMachineManagementVSphere to TechPreview #2724
Require APIExcludedFields Versions to be set #2727
OCPBUGS-32275: Add ingress.spec.domain immutability validation #2695
MON-4032: Add PrometheusOperatorAdmissionWebhookConfig to ClusterMonitoringSpec #2716
refactor: use deepcopy-gen style in DeepCopyInto functions #2721
OCPNODE-3880: Add empty CRIOCredentialProviderConfig resource #2711
NO-JIRA: feat: update the html for feature promotion #2714
Ensure unique paths for excluded fields in compatibility requirement #2720
OCPBUGS-76919: add listtype atomic #2713
CNTRLPLANE-2586: postpone the removal of the DeploymentConfig API #2646
CCXDEV-15605: Promote InsightsOnDemandDataGather and InsightConfig feature gate to default #2473
OCPSTRAT-2876: Enable major version segmentation of enabled feature gates #2637
MCO-2126: Add defaultStream field to OSImageStream spec #2709
Prefer feature-gate manifest inclusion for merged CRDs #2712
CORS-4096: Add DNS Record Type for IPv6 Domain mapping #2361
OCPBUGS-74512: Remove CPMSMachineNamePrefix featuregate #2677
OCPCLOUD-3214: Add ClusterAPI config #2564
SPLAT-2615: Added support for dynamic AWS dedicated hosts #2650
config/v1: TLSSecurityProfile: align with Mozilla v5.7 guidelines for Go by removing unsupported go ciphers #2697
NE-2480: Add featuregate for Gateway API without OLM #2691
Feature gate CVO application of CompatibilityRequirement CRD #2701
Update integration test timeout and make parallel where possible #2702
STOR-2878: Graduate MutableCSINodeAllocatableCount to GA #2673
OCPBUGS-67232: Move DynamicConfigurationManager back to TPNU #2621
OCPNODE-4078: Add DRAPartitionableDevices to TechPreviewNoUpgrade #2694
OCPBUGS-74521: Remove VolumeAttributesClass FeatureGate #2675
MON-4031: Add prometheusOperatorConfig API #2481
Remove graduated SDN feature gates #2672
OCPNODE-3863: Add CRIOCredentialProviderConfig API #2557
add Insights capability to Insights CRDs #2682
CodeRabbit should not be looking at openapi generated content #2688
MCO-1931: Promote ManagedBootImagesCPMS feature gate to the Default featureset #2679
OCPBUGS-74527: Remove ProcMountType #2676
OCPBUGS-55654: Remove AlibabaPlatform FeatureGate #2671
Re-enable NewOLMBoxcutterRuntime featuregate in TPNU #2659
OCPBUGS-68343: Introduce KMSEncryption feature gate #2669
Fix payload CRD/FetaureGate ordering #2667
OCPEDGE-2084: Add PacemakerStatus CRD for two-node fencing #2544
OCPBUGS-56851: make multiline comments for oidc one line for better crd gen and better oc explain description format #2655
no-jira: Validate AWS resource tag keys with aws: prefix #2183
NO-JIRA: Fix Infrastructure PlatformType comment #2660
OCPEDGE-2084: chore(tools): bump controller-tools with XValidation ordering fix #2658
Update KAL to latest and configure new linters #2662
OCPCLOUD-2998: Add synchronizedAPI to Machine and MachineSet status #2642
CORENET-6609: Add EVPN featuregate #2649
OCPBUGS-73855: Permit other machine managers when skew enforcement is in Automatic mode #2648
CONSOLE-4986: Add Guided Tour capability flag to Console API and vendor it into console-operator #2644
OCPCLOUD-3166: machine-api: disallow unsetting authoritativeAPI #2091
Add insights v1 to payload #2632
CNTRLPLANE-1750: Add FeatureGate: ConfigurablePKI #2545
NO-JIRA: update TLS security profile documentation for clarity and consistency #2595
OPRUN-4226: [OLMv1]: Promote NewOLMOwnSingleNamespace to GA #2527 #2527
SPLAT-2603: Added support for legacy AWS dedicated hosts #2643
Extend ClusterVersion for accepted risks #2360
CNTRLPLANE-311: adding auth config missing fields to API #2487
NO-JIRA: Rename ImagePolicy nested types to prevent PKI collision #2626
Reapply “Merge pull request #2448 from opokornyy/CCXDEV-15259-io-v1” #2631
OCPBUGS-70025: Updating ose-cluster-config-api-container image to be consistent with ART for 4.22 #2634
Add configuration for coderabbit #2635
DevPreview: NetworkConnect feature gate #2629
OCPCLOUD-3164: Add CompatibilityRequirement #2479
Disable the statusoptional linter #2633
Migrate away from deprecated ioutil #2603
OKD-259: Support an “OKD” featureset to be enabled by default on OKD clusters #2451
NO-JIRA: remove beta enabled TranslateStreamCloseWebsocketRequests feature from gates #2613
And 2 elided commits (e.g. from squash or rebase merges)
Full changelog

cluster-config-operator

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #523
SPLAT-2865: Migrate vSphere sync of kube-cloud-config to 3CMO #498
OCPBUGS-114426: Update build-machinery-go vendor dependency #503
OCPBUGS-77604: Updating ose-cluster-config-operator-container image to be consistent with ART for 4.22 #473
OCPEDGE-2071: bump(ocp/api): pull in latest for DualReplica promotion #480
OCPBUGS-74528: bump: ocp/api ocp/libray-go #475
API-1646: Add config-operator workload and namespaces network policies #463
OCPSTRAT-2876: Teach config operator to filter feature gate manifests by major version inclusion #459
NO-JIRA: OWNERS: remove engineer who has left Red Hat #466
OCPBUGS-73988: Updating ose-cluster-config-operator-container image to be consistent with ART for 4.22 #460
CORS-4340: add NodeIPFamilies configuration field #472
NO-JIRA: bump: pull in latest ocp/api #471
OKD-320: Migrate to OKD featureset for OKD clusters #462
OKD-259: Allow the OKD feature set to upgrade #461
CNTRLPLANE-2272: Refactor tests-ext initialization to improve error handling #457
OCPBUGS-69859: Updating ose-cluster-config-operator-container image to be consistent with ART for 4.22 #456
CNTRLPLANE-1311: Simplified test infrastructure to single-module architecture #452
Full changelog

cluster-control-plane-machine-set-operator

OCPBUGS-101895: Bump golang.org/x/net from v0.49.0 to v0.55.0 #422
OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #425
OCPBUGS-121958: Guard against empty workspace field on vsphere #420
OCPBUGS-87968: Fixed issue where nameserver is not set when recreating cpms #409
OCPCLOUD-3349: Honor TLS adherence, allow TLS overrides via flags #398
OCPCLOUD-3284: Bump to k8s 1.35 and associated deps. #397
OCPBUGS-77596: Updating ose-cluster-control-plane-machine-set-operator-container image to be consistent with ART for 4.22 #396
OCPBUGS-77259: e2e: improve formatting of cluster operators stabilization timeouts, bump suite timeout #394
OCPCLOUD-3349: tls: use centralized TLS profile #381
TRT-2542: Revert Fix framework initialization #391
OCPBUGS-74343: Fix framework initialization #384
OCPBUGS-74512: Remove CPMSMachineNamePrefix feature gate #387
NO-JIRA: mockgen deprecated: use uber-go/mock instead #374
OCPBUGS-74478: Bump openshift/api to get latest AWSMachineProviderConfig type #385
OCPBUGS-67230: Fix Makefile to use vendor mode #377
Full changelog

cluster-csi-snapshot-controller-operator

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #301
OCPBUGS-101892: Bump golang.org/x/net from v0.52.0 to v0.53.0 #286
OCPBUGS-88472: Fix group snapshots on HyperShift #280
OCPBUGS-82535: Fix PDB unhealthyPodEvictionPolicy field name #271
STOR-2762: Bump all deps for 4.22 #270
OCPBUGS-77601: Updating ose-cluster-csi-snapshot-controller-operator-container image to be consistent with ART for 4.22 #269
STOR-2523: Add desired-version annotation to controller Deployment and use DeploymentVersionController in csi-snapshot-controller-operator #251
OCPBUGS-73791: Re-add serving cert volume mount to hypershift guest cluster manifest #264
OCPBUGS-66390: Set client throttling parameters #261
OCPBUGS-69854: Updating ose-cluster-csi-snapshot-controller-operator-container image to be consistent with ART for 4.22 #262
Full changelog

cluster-dns-operator

OCPBUGS-101899: Bump golang.org/x/net to v0.53.0 #499
OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #502
OCPBUGS-78085: Fix dual-stack service update by preserving IP families #467
NE-2500: Added network policies for DNS #468
OCPBUGS-62178: Dynamically set kube-rbac-proxy TLS args #466
OCPBUGS-14346: Fix when DNS operator reports Degraded #373
NE-2469: Migrate away from deprecated ioutil #454
NE-2482: bump k8s libraries to v0.35.0 and cr to v0.23.1 #459
CNTRLPLANE-1544: manifests: Enable user namespaces #451
OCPBUGS-69912: Updating ose-cluster-dns-operator-container image to be consistent with ART for 4.22 #463
OCPBUGS-65498: Add openshift-dns-operator ClusterRole to ClusterOpera… #455
NO-JIRA: Add NI&D team members to OWNERS #465
NE-2414: Use trafficDistribution: PreferSameNode for openshift-dns Service #457
Full changelog

cluster-etcd-operator

OCPBUGS-133467: force installer revision when external-etcd-pod ConfigMap is created #1739
OCPBUGS-133496: Add TNF ownership for docs/tnf #1741
OCPBUGS-84695: TNF lifecycle refactor backports #1729
OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #1730
OCPBUGS-94058: remove version check from guard precheck #1644
OCPBUGS-89322: cluster-restore.sh: move extra /var/lib/etcd files to backup #1632
OCPBUGS-101904: Bump golang.org/x/net to v0.53.0 address CVE-2026-33814 #1691
OCPBUGS-114426: Update build-machinery-go vendor dependency #1704
OCPBUGS-100120: Revert ‘OCPBUGS-88490: fix etcd operator deadlock when etcd-endpoints configmap is stale’ #1661
OCPBUGS-90542: fix etcd operator deadlock when etcd-endpoints configmap is stale #1636
OCPBUGS-86960: validate snapshot before destructive operations in cluster-restore-tnf.sh #1627
NO-JIRA: Apply go fix changes #1589
NO-JIRA: Remove unused lib/resourcemerge package #1590
OCPEDGE-2495: upkeep: bump ocp/api ocp/client-go #1591
OCPBUGS-81340: pacemaker CronJob: tune history limit and Job TTL #1581
OCPEDGE-2495: feat: update pacemaker in preparation for DualReplica promotion #1587
OCPBUGS-81341: fix: add correct annotations to stop update events #1580
CNTRLPLANE-2621: Restart operator when TLS config changes #1556
OCPBUGS-80959: fix(tnf): align Pacemaker kubelet and etcd retry pacing #1578
CNTRLPLANE-2668: Migrating go standard etcd cases to ote #1575
NO-JIRA: add Lance as a reviewer #1576
OCPBUGS-78956: Disable member cache for quorum checker in TNF #1568
OCPBUGS-65626: upgrade library-go to latest changes #1566
OCPBUGS-78930: add tnf jobs to network policy exceptions #1574
ETCD-557: Add e2e Network policy test cases #1543
Revert “OCPBUGS-77947: fix(tnf): do not block on stable revision after external etcd transition” #1572
OCPBUGS-74679: fix: tweaking kubelet resource config to allow automatic fencing recovery #1561
OCPBUGS-70050: Updating cluster-etcd-operator-container image to be consistent with ART for 4.22 #1569
MON-4484: chore: add permissions on endpointslice to Prometheus Role and use serviceDiscoveryRole: EndpointSlice in ServiceMonitors #1536
OCPBUGS-77947: fix(tnf): do not block on stable revision after external etcd transition #1562
OCPBUGS-76538: Removed unneeded ETCDCTL_API environment variable #1560
OCPBUGS-76331: fix: truncate job names to respect k8s 63-char limit #1554
NO-JIRA: fix unit-test flake in revision tests #1558
NO-JIRA: update cert injection annotations to beta #1551
NO-JIRA: Clean up stale Pacemaker attributes before TNF cluster restore #1553
OCPBUGS-74151: Wait for revision stability before removing etcd members #1540
NO-JIRA: fix: add missing priority class from status checker #1552
OCPEDGE-2097: Add pacemaker health check for ExternalEtcd clusters #1487
OCPEDGE-2231: [TNF] feat: Allow podman-etcd and kubelet resource-agent to restart on start failure #1513
NO-JIRA: [TNF] disable etcd member management after etcd handover #1534
OCPBUGS-66152: split grpc requests slow into read/write alerts #1532
OCPBUGS-73857: Prefer to remove members where they have another healthy machine in the same failure domain index #1528
OCPBUGS-68371: fix bootstrap race condition #1524
OCPBUGS-38659: bump inertia from 5-10 minutes #1531
OCPBUGS-38659: configure inertia for all controllers #1527
OCPBUGS-60588: [TNF] support restore for pacemaker-managed etcd #1521
OCPBUGS-62422: deps: Update library-go to update pruner #1526
And 5 elided commits (e.g. from squash or rebase merges)
Full changelog

cluster-image-registry-operator

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #1385
OCPBUGS-88489: Fix image registry deployment failure on aws-ovn-edge-zones #1366
[release 4.22] OCPBUGS-114413: GCP Universe Domain Support #1364
OCPBUGS-112349: Improve GCS KMS encryption error handling and documentation #1362
OCPBUGS-96612: Bump golang.org/x/net from v0.47.0 to v0.55.0 #1355
OCPBUGS-85342: Fix stale config cache causing incorrect deployment #1342
OCPBUGS-83692: Allow longer window before going Degraded #1323
OCPBUGS-83650: CNTRLPLANE-2660:e2e testing automation: Image Registry network policy #1322
OCPBUGS-83265: ImageConfigController: add inertia before ImageConfigControllerDegraded #1321
CNTRLPLANE-3184: Create network policies for image-registry components #1301
OCPBUGS-81750: Use deterministic S3 bucket naming to prevent orphaned buckets #1317
OCPBUGS-66225: ImageConfigController: wait for ClusterVersion informe… #1316
OCPBUGS-66225: fix degraded blip on stale config caches #1304
OCPBUGS-66225: migrate to go 1.25 #1305
IR-350: make metrics server tls configuration file-based #1297
OCPBUGS-74495: Fix Azure Stack Hub compatibility with dual SDK approach #1287
OCPBUGS-62626: only report Progressing=True when progressing towards new configuration #1293
OCPBUGS-66225: bump deployment ProgressDeadlineSeconds to 120s #1298
CNTRLPLANE-2651: Fix OTE suite qualifiers to use proper CEL expressions #1300
CNTRLPLANE-2651: OTE infrastructure #1283
IR-350: keeps registry tls config in sync with cluster #1278
OCPBUGS-62626: only report Progressing=True when progressing towards new configuration #1286
NO-JIRA: fix TestImageRegistryRemovedWithImages flake #1288
OCPBUGS-74495: Migrate Azure storage management to new ARM SDK #1281
IR-350: bump library-go to the latest version #1276
OCPBUGS-69751: Updating ose-cluster-image-registry-operator-container image to be consistent with ART for 4.22 #1275
OCPBUGS-66203: clear affinities on an individual API call #1273
Full changelog

cluster-ingress-operator

OCPBUGS-132773: [OSSM 26-19] Bump to OSSM 3.3.8 and Istio 1.28.10 for inferencePool fix #1640
OCPBUGS-126740: [OSSM Wave 04] Bump to OSSM 3.3.7 and Istio v1.28.10 #1605
OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #1615
OCPBUGS-130606: Support NLB protocol to configure proxy protocol and client IP preservation #1621
OCPBUGS-128542: Promote Dynamic Configuration Manager to Default #1611
OCPBUGS-112634: Support Alternate Universe Domain #1564
OCPBUGS-105168: Bump openshift/api which adds HAProxy version API #1545
OCPBUGS-98728: Add missing include annotations to IBM Cloud and PowerVS ingress CredentialsRequests #1506
OCPBUGS-97563: Detect orphaned OSSM subscription after noOLM migration #1495
OCPBUGS-91967: Guard OLM watches with capability check in gatewayclass controller #1481
OCPBUGS-87164: Add referencegrants and backendtlspolicies to Gateway API RBAC #1461
OCPBUGS-87167: Add configuration override for X-SSL strip #1468
OCPBUGS-86074: Update grpc-go and x/net #1449
OCPBUGS-85024: TestUnsupportedConfigOverride: Ignore featuregate and defaults #1432
OCPBUGS-85064: Allow host network connections to the ingress canary #1433
OCPBUGS-84841: isFIPSEnabled: Check FIPS_ENABLED env. var. first #1429
OCPBUGS-81550: AWS, Azure and GCP ClusterHostedDNS: Add Ingress LB IPs to Infra CR after masters up #1411
OCPBUGS-76609: Do not take over OSSM subscription #1398
NE-2332: Implement ROUTER_CURVES environment variable #1409
OCPBUGS-3917: filter non-FIPS TLS 1.3 ciphers from ROUTER_CIPHERSUITES on FIPS clusters #1401
NE-2501: Add network policies for ingress resources #1392
OCPBUGS-79376: Bump to OSSM 3.3.1 and Istio v1.28.5 #1406
OCPBUGS-78541: Move TestIngressControllerCustomEndpoints to run last #1388
OCPBUGS-79467: Change default log level from DEBUG to INFO #1402
NE-2519: Move Sail Library to official release branch #1404
NE-2523: Implement configurationManagement API #1385
OCPBUGS-79667: Use feature-gate annotation for Sail Library RBAC #1393
NE-2396: gatewayclass: Enable Horizontal Pod Autoscaling #1326
CORS-4335: Add support for AWS European Sovereign Cloud #1360
NE-2421: Support dual-stack IngressController on AWS #1376
OCPBUGS-62237: Apply APIServer TLS security profile to canary daemonset #1386
OCPBUGS-78523: gatewayapi_controller: Replace sync.Once with retry for GatewayClass field indexer setup #1382
OCPBUGS-62627: cluster operator ingress reported Progressing=True wit… #1299
OCPBUGS-62238: configure tls profile for router metrics #1378
NE-2285: Bump to OSSM 3.3.0 and Istio v1.28.4 #1396
OCPBUGS-77457: Respect proxy configuration on gwapi provisioning #1383
NE-2471: Replace OLM-based Istio install with Sail Library #1354
NE-2501: Add RBAC to allow operator to manage network policies #1389
OCPBUGS-78555: Increase Gateway E2E timeout to 5 minutes #1390
NE-2131: tests-extension: Append suite names to OTE test specs to preserve original test names #1387
NE-2418: Add e2e test for haproxy_max_connections metric #1361
NE-2183: Implement GatewayAPI status controller #1294
NE-2131: tests-extension: restore test names and remove metadata tracking #1379
OCPBUGS-77493: e2e: Increase GatewayClass acceptance timeout to 5m #1372
OCPBUGS-77704: Update annotations in gatewayclass to use the istio version #1375
NE-2131: Add OpenShift Tests Extension scaffolding with GatewayAPI CRD tests #1371
OCPBUGS-74508: Remove the GatewayAPI feature gate #1366
NO-JIRA: enable inheritance on coderabbit #1373
OCPBUGS-74511: remove RouteExternalCertificate feature gate #1355
OCPBUGS-65629: ensure canary daemon set uses its own service account. #1310
OCPBUGS-77305: Bump to OSSM 3.2.2 and Istio 1.27.5 #1350
NO-JIRA: Add coderabbit to CIO #1348
OCPBUGS-58145: reload serving cert on rotation #1285
NE-2481: bump k8s libraries to v0.35.0 #1356
NE-2434: E2E test for internal LoadBalancer Annotations #1353
OCPBUGS-64565, OCPBUGS-9037: Ensure canary cert matches the default ingress controller’s cert #1334
NE-2395: Fix e2e tests to work on platforms with unmanaged DNS #1342
NE-2374: Add e2e test for Gateway API infrastructure annotations #1331
NE-2435: Bump Gateway API CRDs to v1.4.1 #1343
OCPBUGS-16728: Require Service Deletion for LB Type Updates #1142
NO-JIRA: add jcmoraisjr to owners #1346
OKD-259: Bump openshift/api and add support for OKD featureset specific CRDs #1324
OCPBUGS-65482: Add e2e test for secure redirect port stripping #1316
NE-1743: Add documentation for pre-release script for OSSM testing #1315
OCPBUGS-70212: testGatewayAPIDNS: Fix nil gateway in cleanup #1330
OCPBUGS-70211: Fix logging for unmanaged controllers #1329
OCPBUGS-69954: Updating ose-cluster-ingress-operator-container image to be consistent with ART for 4.22 #1328
OCPBUGS-65939: Update command to get Konflux index image #1325
OSSM-10865: set trustBundleName in Istio global values #1288
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #2340
OCPBUGS-101906: Bump golang.org/x/net to v0.53.0 to address CVE-2026-33814 #2295
OCPBUGS-114426: Update build-machinery-go vendor dependency #2312
OCPBUGS-86944: Updating ose-cluster-kube-apiserver-operator-container image to be consistent with ART for 4.22 #2072
OCPBUGS-120318: [release-4.22] Backport 10-minute degraded inertia #2294
OCPBUGS-87844: Fix kube-apiserver-to-kubelet-signer refresh interval #2187
OCPBUGS-85269: fsync static pod cert and manifest writes for crash durability #2143
OCPBUGS-85260: operator should not override authentication config serviceAccountIssuer with the default one during the operator initialization #2142
OCPBUGS-84536: Bump library-go #2131
OCPBUGS-83770: Allow setting the oauthMetadata when auth type is None #2112
OCPBUGS-68365: revert dev cert rotation #2017
CNTRLPLANE-2698: add network policies for apiserver operator and operands #2029
OCPBUGS-23366: bindata/bootkube: Remove configmap-csr-controller-ca.yaml #2076
OCPBUGS-76952: scc: fix uid{Min,Max}Range for nested-container #2053
NO-JIRA:Fix TestBoundTokenOperatorSecretDeletion stability and monitor failures #2080
CNTRLPLANE-2622: Restart operator when TLS config changes #2059
CORS-4363: set bindAddress/bindNetwork for dual-stack clusters #2079
CNTRLPLANE-2992: Update CKASO to use a default webhook authenticator secret when authentication type is not None #2074
OCPBUGS-65626: update library-go to latest #2026
CNTRLPLANE-2223: Migrate TestBoundTokenSignerController to ginkgo #2067
CNTRLPLANE-2622: config tls on check-endpoints container #2058
OCPBUGS-46086: Always set service-account-jwks-uri to LB URL even with custom issuer #1919
OCPBUGS-78146: move event-ttl test to its own suite #2069
OCPBUGS-78117: Update the deprecated usage alerts for 1.35 #2068
OCPBUGS-77509: Add support for event-ttl cases and go test cases in Kube API Server Operator #2060
OCPSTRAT-2728: Rebase 1.35 #2003
CNTRLPLANE-2223: Test bound token signer controller fix #2050
TRT-2561: Revert #2032 “CNTRLPLANE-2622: config tls on check-endpoints container” #2057
CNTRLPLANE-2622: config tls on check-endpoints container #2032
CNTRLPLANE-2241: Update library-go to get KMS encryption #2033
NO-JIRA: Test encryption provider migration #2028
OCPBUGS-70298: remove kube-apiserver user from crb #2012
CNTRLPLANE-2247: Adding KMS TestKMSEncryptionOnOff test #2027
CNTRLPLANE-2241: Conditionally add the KMS plugin volume mount to the kube-apiserver container #2015
CNTRLPLANE-2563: update wording for major upgrades #2010
CNTRLPLANE-2648: Migrating user_cors_test to OTE #2011
CNTRLPLANE-2247: Add empty KMS encryption test case for CI job validation #2014
CNTRLPLANE-2585: Migrating user_client_ca_test to ginkgo #2008
OCPBUGS-65807: SCC: allow image volume type for all SCCs #1968
CNTRLPLANE-2492: Migrating user_certs_test to ote #2005
NO-JIRA:Refactor serviceaccountissuer ginkgo test #2002
NO-JIRA: clean up the OWNER files #2001
NO-JIRA: Add API server stabilization wait to serviceaccountissuer tests #1997
OCPBUGS-62422: deps: Update library-go to update pruner #1994
NO-JIRA: ote: a small cleanup #1995
CNTRLPLANE-2286: Migrating serviceaccountissuer test to ote #1992
CNTRLPLANE-2280: Migrating deprecated_api_test to ote #1990
CNTRLPLANE-2281: Migrating operator_test to ote #1991
OCPBUGS-70323: bump library-go #1986
OCPBUGS-69758: CNTRLPLANE-2222:Migrate go test cert-rotation-tests.go to OTE #1983
CNTRLPLANE-2158: Migrating TestTokenRequestAndReview to ginkgo #1978
NO-JIRA: increases termination timeouts for GCP #1982
Full changelog

cluster-kube-controller-manager-operator

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #976
OCPBUGS-101900: Fix CVE-2026-33814 by adding patch for golang.org/x/net package #965
OCPBUGS-114426: Update build-machinery-go vendor dependency #969
OCPBUGS-77677: Updating ose-cluster-kube-controller-manager-operator-container image to be consistent with ART for 4.22 #916
OCPBUGS-116225: [release-4.22] Add 10-minute degraded inertia #966
OCPBUGS-84560: CNTRLPLANE-3107: e2e testing automation Create network network policy test cases #931
CNTRLPLANE-3211: enable configurable PKI for managed certificate rotation #925
OCPBUGS-23366: bindata: Import configmap-csr-controller-ca.yaml from KAS-O #918
CNTRLPLANE-2623: Restart operator when TLS config changes #915
OCPBUGS-65626: update library-go to latest #905
MON-4503: Migrate Prometheus targets discovering from Endpoints to EndpointSlices #907
OCPSTRAT-2728: Rebase 1.35 #902
OCPBUGS-74023: Updating ose-cluster-kube-controller-manager-operator-container image to be consistent with ART for 4.22 #903
CORS-4220: pass dualstack cluster cidrs as an comma-separated list argument #889
OCPBUGS-69964: Updating ose-cluster-kube-controller-manager-operator-container image to be consistent with ART for 4.22 #901
OCPBUGS-62422: dep: Update library-go to update pruner #895
OCPBUGS-60568: Use BoundServceAccountTokenVolume dy default #858
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

cluster-kube-scheduler-operator

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #680
OCPBUGS-101905: [release-4.22] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #665
OCPBUGS-114426: Update build-machinery-go vendor dependency #678
OCPBUGS-120133: [release-4.22] Backport 10-minute degraded inertia #664
OCPBUGS-83736: add /var/run/kubernetes as emptyDir #640
CNTRLPLANE-3219: vendor: bump library-go, api, client-go for configurable PKI #636
CNTRLPLANE-2756: Add operator and operand network policies #629
CNTRLPLANE-2810: Restart operator when TLS config changes #617
OCPBUGS-65626: update library go to latest #610
MON-4504: Migrate Prometheus targets discovering from Endpoints to EndpointSlices #614
OCPBUGS-70046: Updating ose-cluster-kube-scheduler-operator-container image to be consistent with ART for 4.22 #592
OCPSTRAT-2728: Rebase 1.35 #602
CNTRLPLANE-2843: chore: update OWNERS #618
CNTRLPLANE-2649: Add 30-minute timeout to preferred host e2e test #616
CNTRLPLANE-2649: Migrate to Ginkgo-based e2e serial and parallel test suite #611
CNTRLPLANE-2649: OTE infrastructure #608
OCPBUGS-65941: Add OPERATOR_IMAGE_VERSION to recovery container #600
NO-JIRA: pkg/operator: Remove staleConditions controller #597
NO-JIRA: pkg/operator: Fix wrong ClusterOperator name #596
no-jira: test(TargetConfigController): exercise –tls-cipher-suites and –tls-min-version injection #595
OCPBUGS-62422: deps: Update library-go to update pruner #593
no-jira: refactor(pkg/operator/targetconfigcontroller): code deduplication and improvements #594
Full changelog

cluster-kube-storage-version-migrator-operator

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #185
OCPBUGS-85570: add PodDisruptionBudget for migrator deployment #174
OCPBUGS-84312: schedule migrator pods on control-plane nodes #162
CNTRLPLANE-3055: Migrate go standard casee to ote #156
CNTRLPLANE-2706: add network policy e2e tests for operator and operand #151
OCPBUGS-65984: Revert TRT-2577: Revert #139 “OCPBUGS-65984: scale migrator deployment” #149
OCPBUGS-74038: Updating ose-cluster-kube-storage-version-migrator-operator-container image to be consistent with ART for 4.22 #137
TRT-2577: Revert #139 “OCPBUGS-65984: scale migrator deployment” #148
OCPBUGS-65984: scale migrator deployment #139
NO-JIRA: OWNERS: remove engineers who have left Red Hat #147
OCPBUGS-65984: Prevent AvailableReplicas from dropping to 0 during deployment rollout #138
OCPBUGS-70004: Updating ose-cluster-kube-storage-version-migrator-operator-container image to be consistent with ART for 4.22 #136
OCPBUGS-65984: Prevent AvailableReplicas from dropping to 0 during deployment rollout #135
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

cluster-machine-approver

OCPBUGS-101903: Bump golang.org/x/net to v0.53.0 for CVE-2026-33814 #323
OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #343
OCPBUGS-128496: Revert EgressIP validation backport #337
OCPBUGS-120752, OCPBUGS-127108: Always validate EgressIPs #317
OCPBUGS-86773: fix: use feature-gate annotation for CAPI manifests #305
OCPCLOUD-3286: Bump k8s v1.35, go 1.25 #295
Revert “OCPCLOUD-3347: tls: use centralized TLS profile” #291
OCPCLOUD-3347: tls: use centralized TLS profile #286
OCPBUGS-69815: Updating ose-cluster-machine-approver-container image to be consistent with ART for 4.22 #289
MON-4476: chore: add permissions on endpointslice to Prometheus Role and use serviceDiscoveryRole: EndpointSlice in ServiceMonitors #288
NO-JIRA: Fix expired test certificate in csr_check_test.go #287
Full changelog

cluster-monitoring-operator

OCPBUGS-130772: amcfg: remove client-side TLS enforcement for additional alertmanager configs #3156
OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #3150
OCPBUGS-129136: don’t delete admin-owned Alertmanager secrets on destroy #3138
NO-ISSUE: synchronize OWNERS from main branch [release-4.22] #3112
OCPBUGS-127466: fix(e2e): use Job with backoffLimit for TestDocExamples #3103
OCPBUGS-126959: restore node-exporter textfile metrics with read-only rootfs #3095
OCPBUGS-111059: chore: backport support for ogx api adoption metrics #3058
OCPBUGS-105469: enable read-only rootfs for all containers #3047
OCPBUGS-112572: [release-4.22] Makefile: version-stamp golangci-lint binary to prevent stale linter #3064
OCPBUGS-105304: [release-4.22] wrap library-go resourceCache with mutex for thread safety #3045
OCPBUGS-104852: [release-4.22] e2e: scale down CVO and MCO to prevent node reboots during proxy config watch test #3052
OCPBUGS-104536: Backport e2e stabilization 4.22 #3026
OCPBUGS-100367: [release-4.22] fix: watch cluster wide proxy changes and apply changes accordingly #3020
OCPBUGS-99748: fall back to kube-system/global-pull-secret for telemeter-client token #3001
OCPBUGS-93722: [release-4.22] Prometheus: Information disclosure of Azure OAuth client secret via config API #2976
OCPBUGS-92193: set Prometheus shards value explicitly #2974
OCPBUGS-88321: fix(TestDocExamples) flake: use internal registry for test pods #2965
OCPBUGS-86807: jsonnet: exclude ReplicationController from catch-all … #2940
OCPBUGS-86990: increase lookup interval #2945
OCPBUGS-86034: fix: use numeric ports in NetworkPolicies and add enforcement e2e test #2929
MON-4543, OPNET-765: Add kubernetes-nmstate telemetry metrics to allowlist #2855
OCPBUGS-74645: delay alert dispatch in Alertmanager #2848
OCPBUGS-81554: CVE-2026-33186 - bump google.golang.org/grpc to v1.79.3 #2872
NO-ISSUE: exclude hack/tools/vendor from shellcheck #2873
NO-JIRA: [bot] Synchronize versions of the downstream components #2865
OCPBUGS-81159: reject invalid collection profile in webhook #2860
NO-ISSUE: [bot] Update jsonnet dependencies #2861
MON-4481, MON-4482: set minimum TLS version for Thanos sidecars #2859
NO-JIRA: update jsonnet dependencies #2858
OCPBUGS-78976: configure repair policy to ‘evict’ #2856
MON-4542: update Prometheus operator CRDS to v0.90.0 #2854
NO-JIRA: update github.com/openshift/library-go #2852
NO-JIRA: change ClusterRolefailed to ClusterRole failed #2853
NO-JIRA: [bot] Synchronize versions of the downstream components #2857
NO-JIRA: [bot] Synchronize versions of the downstream components #2851
NO-JIRA: add unit tests for admission webhook’s TLS configuration #2850
MON-4479: use TLS profile to configure CMO server #2841
NO-JIRA: [bot] Synchronize versions of the downstream components #2849
MON-4535: Add .coderabbit.yaml to reduce review noise #2845
NO-JIRA: [bot] Synchronize versions of the downstream components #2847
OCPBUGS-48578: chore(metrics-server): prefer control-plane nodes and tolerate their taints #2801
OCPBUGS-78221: fix return value format #2846
NO-JIRA: fix wrong string formatter in tests #2839
NO-ISSUE: fix typo #2837
OCPBUGS-77543: Updating cluster-monitoring-operator-container image to be consistent with ART for 4.22 #2836
NO-JIRA: [bot] Synchronize versions of the downstream components #2830
MON-4533: Bump prometheus-operator to v0.89.0 #2822
OCPBUGS-74524: Remove MetricsCollectionProfiles feature-gate #2812
MON-4494: add kubernetes-mcp-server metrics to allowed list #2818
MON-4491: Implement Logic for User Defined #2807
OCPBUGS-61262: AlertingRule: fix duplicate PrometheusRules after MD5->SHA-224 naming change #2820
NO-JIRA: [bot] Synchronize versions of the downstream components #2800
OCPBUGS-73957: Updating cluster-monitoring-operator-container image to be consistent with ART for 4.22 #2790
NO-ISSUE: test/e2e: add Func suffix to assertion helpers for consistency #2803
OCPBUGS-74673: Fix NodeRAIDDegraded & NodeRAIDDiskFailure alerts #2799
OCPBUGS-69397: Move console control plane health queries to their own… #2778
OCPBUGS-74347: config: add bond device to default node-exporter ignore list #2806
NO-ISSUE: merge case 67008,68958 to node-exporter e2e test #2788
NO-ISSUE: test: TestUserWorkloadWithAlertmanager|TestNetworkPolicy: fix a no-op check #2802
OCPBUGS-67162: update expr for AlertmanagerClusterFailedToSendAlerts to exclude value 0 #2796
NO-JIRA: Upgrade golangci-lint from v1 to v2 #2789
OCPBUGS-66069: Include kube_pod_labels in minimal profile #2777
MON-4470: ship collector:node_scrape_collector_success:avg to Telemetry #2794
NO-JIRA: [bot] Synchronize versions of the downstream components #2791
OCPBUGS-66180: create networkpolicy settings for user workload monitoring #2765
NO-ISSUE: move endpointslice RBAC to Role #2786
MON-4466: enable ethtool collector #2779
NO-ISSUE: add app.kubernetes.io/part-of=openshift-monitoring label to thanos-ruler pod #2787
MON-4343: Reapply “MON-4343: Cleanup deprecate pa config” #2782
NO-ISSUE: remove test case 74734 #2785
OCPBUGS-61088: revert PR #2766 #2769
OCPBUGS-69733: Updating cluster-monitoring-operator-container image to be consistent with ART for 4.22 #2781
MON-4406: watch ClusterMonitoring config resource #2770
NO-JIRA: [bot] Synchronize versions of the downstream components #2780
NO-JIRA: [bot] Synchronize versions of the downstream components #2776
Full changelog

cluster-network-operator

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #3187
OCPBUGS-130582: Added global overrides for OVN-Kubernetes #3190
OCPBUGS-127181: Adds rendering of enable-multi-network-policy in ovnkube-node #3172
OCPBUGS-101929: [release-4.22] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #3155
OCPBUGS-113532: ovn-kubernetes: Move MNP from ConfigMap to CLI flags #3136
OCPBUGS-119956: Allow per-node OVN encap IP override via env-overrides #3148
OCPBUGS-99048: Restart pods when rendering egressIP settings #3061
OCPBUGS-105556: [4.22] frr-k8s: use Recreate strategy for statuscleaner deployment #3130
OCPBUGS-105512: Remove version-specific CNI binary copy logic #3114
OCPBUGS-99744: Bump frr-k8s MAX_FDS from 1024 to 65536 #3090
OCPBUGS-97939: bump containernetworking/cni v0.8.0 -> v1.3.0 #3044
OCPBUGS-86033: Revert “[release-4.22] OCPBUGS-90721: NVIDIA-596: Enable dpu healthcheck” #3042
OCPBUGS-84739: Use dedicated service accounts for multus pods #2985
OCPBUGS-90721: NVIDIA-596: Enable dpu healthcheck #3009
OCPBUGS-89244: NVIDIA-554: DPU-host mode: use ConfigMap for OVN feature enablement instead of per-node script gating #3029
OCPBUGS-88307: Remove –enable-interconnect flag from OVN-K manifests #3028
OCPBUGS-83637: only report Progressing for active network rollouts #2962
CORENET-6543: Align VTEP CRD additionalPrinterColumns with upstream #2957
CNF-21001: multus: MultiNetworkPolicy nftables #2883
CORENET-6816: Add NetworkPolicies for CNO and its operands #2892
CORENET-6933: Update VTEPs/CUDN APIs #2952
OCPBUGS-78974: Fix ManagementState being reset on operator restart #2942
CORENET-6613: ClusterNetworkConnect DevPreview FG #2880
no-jira: Update OWNERS_ALIASES to include myself + “taanyas” and “marty-power” #2908
CORENET-6813: Add config override for allow-icmp-network-policy #2920
CORENET-6100: Add support for no-overlay mode #2844
CORENET-6561: CNO Rebase k8s to 1.35.0 #2887
OCPBUGS-78731: Revert “NVIDIA-554: DPU-host mode: use ConfigMap for OVN feature enablement instead of per-node script gating” #2938
OCPBUGS-77015: wait for patch port to apply drop garp flows #2910
OCPBUGS-70016: Updating cluster-network-operator-container image to be consistent with ART for 4.22 #2863
OCPBUGS-65633: add network-check-target + networking-console-plugin service accounts #2868
CORENET-6871: Handle zero-worker HyperShift clusters in daemonset rollout #2897
NVIDIA-554: DPU-host mode: use ConfigMap for OVN feature enablement instead of per-node script gating #2907
OCPBUGS-76500: Add config override for openflow-probe #2916
OCPBUGS-60670: Add ValidatingAdmissionPolicy for EgressIP #2837
CORENET-6605: fix more transient error condtions caused Degraded #2896
CORENET-6417: Drop remaining openshift-sdn code #2882
CORENET-6610: Add EVPN APIs #2881
OCPBUGS-60077: Silence ovnkube-lib.sh to avoid mass of logs to collectors #2761
CNF-20883: Align templates frrk8s #2874
OCPBUGS-74401: Remove duplicated openssl parameter #2889
NO-JIRA: Remove references to AdminNetworkPolicy, NetworkSegmentation, RouteAdvertisements and PreconfiguredUDNAddresses featuregates #2891
CORENET-6561: Update the golangci-lint configuration for v2 compatibility and fix all resulting lint issues. #2893
CORENET-6605: avoid flapping Degraded on transient failures #2862
CORENET-6416: drop networkType migration support #2456
CNF-21001: mnp: Set hostname using downward API #2840
CORS-4180: Allow AWS and Azure as platforms that support dual-stack on Day-0 #2804
NO-JIRA: set ovnkube-cluster-manager as default container #2798
OCPBUGS-72411: fix(hypershift): use net.JoinHostPort for URL construction #2871
OCPBUGS-66417: Add kubevirt platform to dual-stack supported platforms #2849
OCPBUGS-49662: Prevent resetting masquerade subnet #2641
Full changelog

cluster-node-tuning-operator

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #1660
OCPBUGS-130423: E2E: Fix no-op Get() assertions in mixedcpus #1662
OCPBUGS-129100: E2E: PPC: replace no-op log-on-match with actual assertions (4 sites) #1650
OCPBUGS-129099: E2E: add missing matcher to offlined CPU Expect() calls #1649
OCPBUGS-101927: Bump golang.org/x/net from v0.49.0 to v0.58.0 #1634
OCPBUGS-113579: Update PPC help description #1613
OCPBUGS-112554: Use Add() instead of AddRateLimited() for routine Profile enqueues #1601
OCPBUGS-104615: E2E: LLC: Restore uncore cache annotation to true #1577
OCPBUGS-105873: BUG-FIX Latency Test #1583
OCPBUGS-105535: Add missing annotations to NetworkPolicy manifests #1580
OCPBUGS-99265: E2E: LLC: Pass fresh ctx variable to DeferCleanup functions #1567
OCPBUGS-92011: e2e: fix: clear hugepages before switching kernelPageSize to 4k #1554
OCPBUGS-99290: e2e: fix broken checks and rework netqueue tests to avoid ARM ethtool blackout flakes #1568
OCPBUGS-98400: E2E: Add functional test cases checking GOMAXPROCS #1561
OCPBUGS-98062: E2E: Fix tuned active profile check for wrapped performance profiles #1559
OCPBUGS-87153: E2E: Refactor OVS affinity tests into shared helpers and add new workload-partitioning and control-plane reboot test cases. #1537
OCPBUGS-93924: Let cri-o manage the GOMAXPROC for burstable pods #1555
OCPBUGS-86071: perf: latency: compute memory resources dynamically #1520
OCPBUGS-87891: Enable timer migrations for all use-cases #1542
OCPBUGS-87158: e2e: Remove unnecessary len(numa) < 2 skip gates #1538
OCPBUGS-84431: Bump github.com/moby/spdystream from v0.5.0 to v0.5.1 #1529
OCPBUGS-86247: Revert stalld backend to sched_debug #1523
OCPBUGS-86024: Requeue PerformanceStatus update when status write fails #1518
OCPBUGS-85020: e2e: Add irqbalance StartLimitBurst >= 100 config test #1506
NO-JIRA: Bump ghw dependency #1492
NO-JIRA: E2E: move dra resource test to reboot tests directory #1486
PSAP-2185: Support centralized TLS security profile configuration #1483
CNF-18941: e2e: PP: cover ExecCPUAffinity support in tests #1432
CNF-20404: DRA: disable Kubelet resources and topology managers #1445
OCPBUGS-78470: e2e: fixed flaky test_id:32646 CPU load balancing on cgroupv1 #1457
PSAP-2229: Prevent multiple reboots via MachineConfig creation/update sync #1474
NO-JIRA: workloadhints: use IsVM to skip BM-only tests #1478
OCPBUGS-77200: Remove hardcoded nf_conntrack_hashsize from performance profile tuned configuration #1477
OCPBUGS-62702: AA: latency-e2e: skip tests on HT-disabled systems #1386
OCPBUGS-77377: E2E: Add test case to check Infrastructure pods affinity #1470
NO-JIRA: Eliminate expensive and unnecessary MachineConfig updates #1473
NO-JIRA: Bump Kubernetes, OpenShift and other dependencies #1475
OCPBUGS-74027: AA: E2E: LLC: Add tests related to odd cpus #1458
CNF-20755: e2e: Add housekeeping IRQ load balancing tests #1456
CNF-18941: perfprof: enable exec-cpu-affinity by default (annotation) #1426
NO-JIRA: Make changes for migrating to OTE in Dockerfile #1453
OCPBUGS-62632: Do not report Progressing=True during cluster scaleup or node reboot #1447
NO-JIRA: Bump upstream containerfile to 4.22 #1452
OCPBUGS-62496: hypershift:e2e:status: check for duplicated configmap status #1413
OCPBUGS-69802: Updating cluster-node-tuning-operator-container image to be consistent with ART for 4.22 #1450
OCPBUGS-69391: E2E: Granular IRQ functional test cases #1441
Full changelog

cluster-olm-operator

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #254
OCPBUGS-101911: Bump golang.org/x/net to v0.56.0 #241
OCPBUGS-94187: Scale to replicas=2 and enable PDB on HighlyAvailable topology [release-4.22] #215
OPRUN-4521: handle OCP 4.²³⁄₅.0 upgrade boundary #184
OCPBUGS-77899: Fix wait logic to handle NewOLM enabled on Default Feature #193
NO-ISSUE: remove no-op os.Remove call in TestRenderHelmTemplate #192
OCPBUGS-77899: Wait for operator-controller resources before verifyig #181
OPRUN-4518: Rename ClusterExtensionRevision to ClusterObjectSet #191
NO-ISSUE: Add fgiudici as reviewer #190
NO-ISSUE: return semver conversion errors #183
OCPBUGS-81188: Update grpc and other dependencies #182
OPRUN-4502: Use FratureGateNewOLMConfigAPI from openshift/api #180
OPRUN-4502: Add feature-gate for DeploymentConfig #176
NO-ISSUE: Update to go 1.25.7 #175
OCPBUGS-65623: cluster-olm-operator sets Progressing=True during upgrade #173
OPRUN-4230, OPRUN-4440: Enable Boxcutter in TPNU #163
NO-ISSUE: Bump golangci to v2 #174
NO-ISSUE: Add pedjak as reviewer and approver #171
OCPBUGS-65505: add resources to clusterOperator relatedObjects #166
OPRUN-4408: Update upgrade message to mention both 4.23 and 5.0 upgrade paths #164
OCPBUGS-69807: Update image locations to be consistent with ART for 4.22 #158
OPRUN-4360: Remove references to operator-framework/catalogd #155
OPRUN-4352: Update to golang 1.25/ocp 4.22 #156
Full changelog

cluster-openshift-apiserver-operator

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #800
OCPBUGS-101919: Fix CVE-2026-33814 - update golang.org/x/net to v0.53.0 #779
OCPBUGS-114426: Update build-machinery-go vendor dependency #772
OCPBUGS-100168: Allow Prometheus to scrape check-endpoints metrics on port 17698 #743
OCPBUGS-105443: Add HostToContainer mountPropagation to node-pullsecrets volume mount #748
OCPBUGS-85097: e2e network policy tests #687
CNTRLPLANE-2619: Restart operator when TLS config changes #662
CNTRLPLANE-2450: bump(k8s.io): 1.35.2 #669
CNTRLPLANE-2619: make checkendpoints use apiserver config #657
NO-JIRA: OWNERS: remove engineers who have left Red Hat #646
NO-JIRA: Disable WatchList feature gate due to the missing support of Project watch #667
CNTRLPLANE-2241: Update library-go to get KMS encryption #647
NO-JIRA: Create test namespace for KMS migration scenario #650
CNTRLPLANE-2247: Adding KMS TestKMSEncryptionOnOff test for OAS #649
CNTRLPLANE-2247: Adding KMS TestKMSEncryptionOnOff test for Routes #644
CNTRLPLANE-2241: Conditionally add the KMS plugin volume mount to the openshift-apiserver container #641
CNTRLPLANE-2247: Add KMS encryption test target #642
NO-JIRA: update to Kubernetes v1.34.1 #640
OCPBUGS-70035: Updating ose-cluster-openshift-apiserver-operator-container image to be consistent with ART for 4.22 #635
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

cluster-openshift-controller-manager-operator

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #450
OCPBUGS-101532: Address CVE-2026-42502 #443
OCPBUGS-86054: e2e network policy tests #436
OCPBUGS-81472: Prevent possibility of running controllers against empty informer caches #426
CNTRLPLANE-2620: Restart operator when TLS config changes #412
CNTRLPLANE-2769: bump kubernetes dependencies to v1.35 #415
no-jira: Migrate away from deprecated ioutil #401
no-jira: refactor: use the configured clock source during startup #411
CNTRLPLANE-2620: propagate global tls config to operand #407
OCPBUGS-70032: Updating ose-cluster-openshift-controller-manager-operator-container image to be consistent with ART for 4.22 #404
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

cluster-policy-controller

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #210
OCPBUGS-101925: Bump golang.org/x/net to v0.55.0 #198
OCPBUGS-98222: add serviceAccountToken volume type to psalabelsyncer #192
CNTRLPLANE-2769: bump k8s 1.35 #174
Full changelog

cluster-samples-operator

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #732
OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #724
OCPBUGS-129482: Restrict samples operator access to the global pull-secret #727
OKD-379: Fix missing namespace in database template image triggers #701
CNTRLPLANE-3176: implements operator tls config compliance #688
OCPBUGS-77919: Periodic sync of OKD samples #666
MON-4508: Migrate Prometheus targets discovering from Endpoints to EndpointSlices #673
OCPBUGS-77918: Periodic sync of supported OCP samples #667
OCPBUGS-77879: update kubernetes api to v0.35.2 #676
OCPBUGS-77678: Updating ose-cluster-samples-operator-container image to be consistent with ART for 4.22 #675
OCPBUGS-74024: Updating ose-cluster-samples-operator-container image to be consistent with ART for 4.22 #672
OCPBUGS-69966: Updating ose-cluster-samples-operator-container image to be consistent with ART for 4.22 #671
Full changelog

cluster-storage-operator

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #754
OCPBUGS-112334: Pass management cluster proxy env vars to CSI driver operator deployments #740
OCPBUGS-96622: Bump golang.org/x/net to v0.55.0 #722
NO-JIRA: Add initial Agent Guide #682
STOR-2770: Mount metrics certs of azure-disk and azure-file CSI driver operator for Hypershift #686
STOR-2762: Bump all deps for 4.22 #684
OCPBUGS-74232: volume-data-source-validator should run on master nodes #659
OCPBUGS-78291: Allow azure-disk operator to read VolumeAttributeClasses #683
MON-4509: Migrate Prometheus targets discovering from Endpoints to EndpointSlices #665
MON-4496: metrics: migrate Prometheus SD from Endpoints to EndpointSlices #668
NO-JIRA: Add a comment to sync AWS EBS IAM role into HyperShift #676
STOR-2758: Update rbac from provisioner rebase #674
OCPBUGS-77686: Updating ose-cluster-storage-operator-container image to be consistent with ART for 4.22 #671
TRT-2542: Revert #661 “OCPBUGS-74530: Remove featuregate StoragePerformantSecurityPolicy” #664
OCPBUGS-74530: Remove featuregate StoragePerformantSecurityPolicy #661
OCPBUGS-66212: Remove VSS permissions #649
STOR-2523: hypershift: Add desired-version annotation to operand Deployments and use DeploymentVersionController in CSO #638
OCPBUGS-60159: add vsphere permissions for checking if users is authorized to see metrics #642
OCPBUGS-69978: Updating ose-cluster-storage-operator-container image to be consistent with ART for 4.22 #651
OCPBUGS-63698: feat(azure): add HYPERSHIFT_IMAGE env var for token-minter #643
OCPBUGS-62634: Fix deployment controller Progressing=true on node drain #648
OCPBUGS-67012: volume-data-source-validator must use IfNotPresent image pull policy #650
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

cluster-update-keys

OCPNODE-3978: Third run at expanding the default ClusterImagePolicy for openshift component images #97
revert ‘OCPNODE-3978: Second run at expanding the default ClusterImagePolicy for openshift component images #96
OCPNODE-3978: Second run at expanding the default ClusterImagePolicy for openshift component images #95
TRT-2537: Revert “OCPNODE-3978: Extend the default ClusterImagePolicy for openshift component images” #94
OCPNODE-3978: Extend the default ClusterImagePolicy for openshift component images #75
OCPBUGS-70020: Updating ose-cluster-update-keys-container image to be consistent with ART for 4.22 #91
Full changelog

cluster-version-operator

OCPBUGS-130968: Cancel payload retrieval pod on upgrade clear #1491
OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #1489
OCPBUGS-101917: Bump golang.org/x/net to v0.55.0 #1455
OCPBUGS-104545: pkg/cvo/egress: Disable Proxy respect on HyperShift #1438
OCPBUGS-98572: Tolerate unknown template fields during payload loading #1421
OCPBUGS-77681: Updating cluster-version-operator-container image to be consistent with ART for 4.22 #1331
OTA-1933: pkg/risk: Refactor alerts into a generic update-risk interface #1367
NO-JIRA: All CVO manifests in payload should be included #1337
OTA-1813: Drop a local label on alert-risk e2e #1363
NO-ISSUE: Add CodeRabbit config with review rules from PR analysis #1360
NO-JIRA: use scrape class which is more succinct #1365
CNTRLPLANE-2777: feat(resource builder): allow to inject tls configuration into annotated config maps #1322
OTA-1813: Populate risks from alerts #1329
OCPBUGS-78997: Do not discard ListOptions in waitForPodCompletion. #1361
OCPBUGS-65621: add dedicated service account to crb, cvo and version pod #1266
NO-JIRA: Add test migration guide for openshift-tests-private to CVO #1336
NO-JIRA: Try not to block by informing #1356
OCPSTRAT-2876: Allow inclusion/exclusion of manifests based on the OCP major version #1282
TRT-2581: Revert “NO-ISSUE: OTA-1605 Automate OCP-42543” #1353
NO-ISSUE: OTA-1605 Automate OCP-42543 #1309
CNTRLPLANE-2777: refactor(lib/resourcebuilder): generate interface for client instead of their specific types #1344
OTA-1546: Evaluate conditional updates if accept risks change #1348
OTA-1546: Skip an accept-risk case on network-restricted environment #1332
NO-ISSUE: Update fake clientsets to NewClientset #1340
TRT-2569: (fix) hypershift-e2e-aks and hypershift-e2e-aws failing with CVO bootstrap deadlock in ci amd64 payload #1342
OCPBUGS-78061: Fix invalid ClusterVersion.Spec.DesiredUpdate #1345
OTA-1860: Stop blocking patch updates when cluster version overrides are set #1314
TRT-2569: Revert “OTA-1546: Add a metric and an alert for conditional risk conditions” #1339
OTA-1546: Add a metric and an alert for conditional risk conditions #1318
OCPBUGS-77762: Add an e2e to check the default network polocy #1334
OTA-1546: Generate riskConditions in a better way #1324
NO-JIRA: Allow for risks only desired update #1335
OCPBUGS-77762: install/0000_00_cluster-version-operator_02_networkpolicy: Add inclusion annotations #1333
NO-JIRA: Use github.com/daixiang0/gci to sort imports #1330
NO-JIRA: Sort and verify imports #1328
Revert “TRT-2549: Revert “Add a serial e2e for accept-risks”” #1323
NO-JIRA: Mention the fauxinnati in the developer documentation #1308
OCPBUGS-66898: Implement mTLS authentication and authorization for CVO metrics endpoint #1271
OTA-1861: cmd/cluster-version-operator/render: Add –cluster-version-manifest-path option #1315
TRT-2549: Revert “Add a serial e2e for accept-risks” #1319
OTA-1546: Add a serial e2e for accept-risks #1310
NO-JIRA: Add docs about places running e2e tests #1312
OCPBUGS-74028: Updating cluster-version-operator-container image to be consistent with ART for 4.22 #1296
OCPSTRAT-2485: Introduce feature gate based inclusion/exclusion of manifests #1273
NO-JIRA: More flexible timeout option for oc-cli #1311
OTA-1546: Reconcile cv.spec.desiredUpdate.acceptRisks #1284
NO-JIRA: Add a serial e2e test #1306
TRT-2511: Reapply “OTA-1604: migrate ocp-46922 from otp to cvo repo” #1301
NO-JIRA: Fix linter issues on dot-imports #1304
OTA-1546, OTA-1833: Add OKD feature set filtering logic, Bump openshift/api #1302
NO-JIRA: Fix some lint issues #1299
Revert “OTA-1604: migrate ocp-46922 from otp to cvo repo” #1297
OTA-1787: pkg: Update Upgradeable condition to explicitly mention major version updates #1276
NO-JIRA: hack/build-image.sh: Update Dockerfile reference #1272
OCPBUGS-73929: lib/resourcemerge/core: Reconcile ConfigMap binaryData too #1294
NO-JIRA: Bump to builder:rhel-9-golang-1.25-openshift-4.22 #1293
OTA-1604: migrate ocp-46922 from otp to cvo repo #1279
NO-JIRA: Introduce oc-cli for e2e tests #1267
OTA-1786: pkg/payload/precondition/clusterversion/gianthop: Allow updates to 5.0 #1275
NO-ISSUE: .claude/commands/update-godocs: New command for Go doc updates #1278
NO-ISSUE: OTA-1605 Adding descriptions for building the binary and running the tests #1263
NO-JIRA: Create AGENTS.md file #1268
OCPBUGS-17007: vendor: Update openshift/library-go to get new default TLS configuration #1270
Full changelog

configmap-reloader

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #87
NO-JIRA: disable automatic coderabbit reviews #79
OCPBUGS-77734: Updating configmap-reload-container image to be consistent with ART for 4.22 #78
OCPBUGS-70038: Updating configmap-reload-container image to be consistent with ART for 4.22 #76
Full changelog

console

OCPBUGS-135263: Remove the redundant detailsPage wrapper #17452
OCPBUGS-134589: Preserve revealed Secret values across page rerenders #17443
OCPBUGS-113737: Bump nanoid to fix CVE-2026-67214 #17330
OCPBUGS-132726: Restore ConfigMap and BuildConfig form view edit actions #17410
OCPBUGS-130937: Fix xterm ResizeObserver crash on uninitialized dimensions #17387
OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #17415
OCPBUGS-115833: Show CPU/Memory metrics for non-admin users on Projects page - #17132 #17132
OCPBUGS-129621: Cap rendered alerts in notification drawer and dashboards #17378
OCPBUGS-130325: Guard against null/missing urls in Helm charts #17375
OCPBUGS-123201: Fix Namespace column hidden on Node Pods tab with active namespace #17174
OCPBUGS-122042: Strip existing OCI tag before appending new version + fix CSP violation crash #17345
OCPBUGS-115003: Validate chart URL in /api/helm/verify to prevent SSRF #17118
OCPBUGS-114725: display operators in catalog when Tech Preview enabled #17114
OCPBUGS-111417: make cloud provider fields optional during operator install #17014
OCPBUGS-109521: Remove unscoped CSV watch from ClusterNotUpgradeableAlert #17013
OCPBUGS-100519, OCPBUGS-101795: Fix CVE-2026-69153 and CVE-2026-45623 - Bump postcss #17054
OCPBUGS-112271: Fix flaky TestAsyncCache backend test #17045
OCPBUGS-105478: [release-4.22] OCPBUGS-83799: Fix Workloads sidebar ordering when DeploymentConfig is unavailable #16928
Fix OCPBUGS-99414: CVE-2026-59877 #16834
OCPBUGS-95402: Fix orphaned shell processes in pod terminal on WebSocket disconnect #16694
Fix for OCPBUGS-101812: CVE-2026-69152 #16930
Fix for OCPBUGS-105894: CVE-2026-73086 #16965
OCPBUGS-87832: Use stable username hash for user-settings ConfigMap names #16565
OCPBUGS-105611: [release-4.22] Fix leading whitespace in Quick Start execute code snippets #16951
OCPBUGS-89705: Fix CVE-2026-12143 form-data CRLF injection #16644
OCPBUGS-100059: quickstart page i18n misses (Fix Quick Starts i18n bundle lookup for zh-CN) #16869
OCPBUGS-100317: Fix pod terminal not rendering until resize #16892
OCPBUGS-100307: Re-enable Knative Cypress e2e tests #16889
Fix OCPBUGS-98791: CVE-2026-48801 #16852
OCPBUGS-99545: ‘0 B’ is shown on details page when create pvc with ‘EiB’ unit #16807
OCPBUGS-99548: Incorrect translations for ‘CatalogSources’ and ‘OperatorGroups’ in l… #16809
OCPBUGS-99259: Disable Knative e2e Cypress tests in CI #16784
OCPBUGS-98437: CVE-2026-59869 bump js-yaml #16768
OCPBUGS-97600: Fix devfile sample import by adding fallback for parent resolution failures #16706
OCPBUGS-88028: Bump follow-redirects from 1.15.3 to 1.16.0 to fix CVE-2026-40895 #16665
OCPBUGS-95580: Fix unnecessary error on Node Terminal tab #16696
OCPBUGS-88748: [release-4.22] webpack-dev-server: Information disclosure and denial of service via improper proxy configuration #16656
OCPBUGS-89337: Use fixed artifacts directory to prevent stale temp dir accumulation #16638
OCPBUGS-90636: Fix RoleBindings tab error for non-cluster-admin users #16662
OCPBUGS-90495: Projects cannot be filtered by display name #16652
OCPBUGS-90110: Fix ColumnManagementModal not showing NamespaceColumnHelpText #16643
Fix for OCPBUGS-84470: CVE-2026-4800 #16573
OCPBUGS-87933, OCPBUGS-87985: Bump protobufjs and shell-quote #16619
OCPBUGS-87997: Bump fast-uri to 3.1.2 to fix CVE-2026-6322 #16605
OCPBUGS-88304: Allow VolumeSnapshot restore when parent PVC is deleted #16592
OCPBUGS-87096: fixing severity not showing number of issues #16575
OCPBUGS-86580: Fix macOS Option key in pod terminal #16504
OCPBUGS-77804: Update Console 4.22 plugin SDK CHANGELOG #16521
OCPBUGS-86700: Fix and re-enable operator e2e tests disabled for createRoot #16518
OCPBUGS-77804: prep for 4.22 GA SDK publish #16508
OCPBUGS-86410: Fix Shipwright detail pages crashing with React error #310 #16485
OCPBUGS-86239: Adapt dashboard Prometheus polling interval based on query response time #16469
OCPBUGS-84963: Remove DataViewToolbar wrapper from bottom pagination #16483
OCPBUGS-86227: Show empty state instead of 403 error for users without projects #16467
OCPBUGS-86222: Use ETag conditional requests for OpenAPI v2 fetching #16466
OCPBUGS-86228: Re-enable add-flow-ci.feature e2e tests disabled for createRoot adoption #16468
OCPBUGS-86064: Enable Topology e2e tests #16458
OCPBUGS-83940: bump gRPC-Go to v1.79.3 #16443
OCPBUGS-83416: [release-4.22] CVE-2026-26996 Bump minimatch library #16278
OCPBUGS-85505: Add Suspense boundary to LazyRoutePage for plugin routes #16438
OCPBUGS-85494: Prevent binary secret data corruption when editing #16435
NO-JIRA: enable multi-architecture yarn builds #16415
OCPBUGS-85196: Remove @console imports from SDK dist #16407
OCPBUGS-84843: i18n upload/download routine task - version 4.22 #16382
OCPBUGS-85114: Fix SDK publish workflow for Yarn Berry #16403
OCPBUGS-84963: Add bottom pagination to ConsoleDataView for mobile responsiveness #16394
OCPBUGS-84556: re-enable helm-release.feature #16358
OCPBUGS-84916: Remove PII from events #16393
OCPBUGS-84811: fix Helm list page redirect after upgrade/rollback #16380
OCPBUGS-84848: Fix ConsoleDataView filter order: Name and Label should appear first #16383
OCPBUGS-84807: Fix race conditions in create-namespace Cypress tests #16379
OCPBUGS-84681: Fix crash when switching language to English #16373
OCPBUGS-84216: Fix create visual connector in Topology #16314
OCPBUGS-84345: Update resolveDynamicModuleMaps to skip unavailable packages #16342
OCPBUGS-83546: Fix Cypress test timeouts by using correct timeout option #16292
OCPBUGS-84246: prepare for 4.22-prerelease.3 sdk publish #16337
OCPBUGS-84246: 4.22 SDK fixes #16321
OCPBUGS-83543: Add empty state visibility check to CRD test #16309
OCPBUGS-83543: Fix race condition in CRD Cypress test #16290
CONSOLE-4809: Extend RTL Test Coverage for Components Migrated from Enzyme #16249
CONSOLE-4512, OCPBUGS-82473: Switch from legacy render to createRoot #16202
OCPBUGS-77113: remove dev to admin links as dev monitoring views are enabled #16163
NO-JIRA: Update Dockerfile.dev to use latest base images #16264
CONSOLE-5065: Refactor dynamic module import transform code #16224
OCPBUGS-76556: fix Developer Sandbox telemetry #16020
NO-JIRA: Add stefanonardo to frontend reviewers#16267 #16267
OCPBUGS-78904: Mark notification drawer title for translation #16229
CONSOLE-3955: Migrate LogSnippet to PatternFly component #16190
OCPBUGS-81654: Filter out isActionCell prop to fix React warning #16247
CONSOLE-5152: bump cypress to latest #16244
OCPBUGS-81744: Convert cluster update status integration test to unit test #16260
OCPBUGS-81506: Add missing i18n translations for Pagination component #16233
CNV-62016: add description to ResourceQuota page title #16086
OCPBUGS-80989: Skip to fetch resource if model not found and load the other resources in list-page #16230
CONSOLE-5110: Assorted fixes and improvements #16250
OCPBUGS-79355: Fix and enable OLM Package E2E tests disabled during the public/ directory useK8sWatchResource refactoring #16220
OCPBUGS-74156: Prevent pod log search from shifting page layout #16223
Revert “OCPBUGS-74156: Prevent pod log viewer from shifting page layout when searching” #16218
OCPBUGS-74506: Remove ConsolePluginSecurityPolicy featuregate #16013
CONSOLE-5151: Replace showdown with marked #16239
CONSOLE-5094: cypress test improvements #16046
OCPBUGS-81331: Storage > VolumeSnapshots and VAC throws error #16219
CONSOLE-4447: Additional modals switched to use ModalFooterWithAlerts for consistency #16171
OCPBUGS-80939: Add robots.txt policy to console #16205
OCPBUGS-79315: fix analyze.sh/react-icons treeshake #16188
CONSOLE-5015: Remove drag-and-drop from TextColumnField #16204
CONSOLE-5065: Update list of PatternFly packages that support dynamic modules #16182
NO-ISSUE: frontend/packages/console-dynamic-plugin-sdk/README: 4.22 doesn’t support PatternFly 5 #16206
OCPBUGS-62700: Fix VolumeSnapshot table sorting #16200
OCPBUGS-79581: Fix Deprecated Operator Warnings E2E tests Skipped in the Firehose Public Folder PR #16197
OCPBUGS-74156: Prevent pod log viewer from shifting page layout when searching #16193
OCPBUGS-79678: Align the search input so that its next to the select menu toggle #16198
OCPBUGS-78584: Preserve query params in CatalogRedirect #16165
OCPBUGS-79525: Fix null reference error in subscription action menu #16196
OCPBUGS-72526: Impersonating user loads extra pages that user not authorized to view #16088
OCPBUGS-79000: Fix perspective switcher icon suspending the whole app #16183
CONSOLE-5015: Refactor pinned nav to react-drag-drop #16146
CONSOLE-5031: Remove Firehose Component and Fix and Cleanup Impacted Types #16096
CONSOLE-4983: Add Groups to node details #15981
NO-JIRA: prep for 4.22.0-prerelease.2 SDK publish #16201
OCPBUGS-74140: Prevent Chinese characters from rendering as unicode escape sequences in alert messages #16156
OCPBUGS-77814: Add E2E tests for VolumeAttributesClass UI #16085
CONSOLE-5073: Update redux-related packages to latest #16087
OCPBUGS-78543: Hide filter category selector when only one filter exists #16153
CONSOLE-5015: Replace react-dnd with PF MultipleFileUpload in topology #16179
CONSOLE-5134: Update to Go 1.25, K8s 1.35, and Helm 3.20 #16147
CONSOLE-5135: add deprecation warning for react-router-dom #16178
OCPBUGS-79462: Skip flaky Data Grid operator E2E tests #16191
CONSOLE-5027: Refactor public/ Directory Components to useK8sWatchResource(s) #15954
OCPBUGS-63391: Replace DataViewTextFilter with existing custom TextFilter #16151
OCPBUGS-73803: Fix incorrect OLMv1 documentation URL #16052
OCPBUGS-74346: Fix useOperatorCatalogCategories hook. #16093
OCPBUGS-78534: Make E2E test create helper idempotent and improve test cleanup #16148
OCPBUGS-66147: Make folder field optional for vsphere #16142
OCPBUGS-77912: Fix TypeError in OLS code import to console #16119
OCPBUGS-44612: Remove useUserPreferenceCompatibility and withUserPreferenceCompatibility #16076
CONSOLE-5073: Bump i18next to latest #16150
CONSOLE-4447: Update SecretFormWrapper modal to use ModalFooterWithAlerts #16167
RFE-7965: add basic auth support for helm repositories #15624
CONSOLE-5094: Add pesudo CSP violation detection to Cypress #16048
NO-JIRA: Update demo plugin README #16166
CONSOLE-5093: Remove support for deprecated extensions #16043
CONSOLE-4447: Remove deprecated modal components and CSS #16126
CONSOLE-5018: Refactor UNSAFE_ class components to FC #16062
CONSOLE-5129: Theme context cleanup #16155
OCPBUGS-78390: Reset pagination page when changing namespace #16138
OCPBUGS-78253: Fix InstallPlan > Components layout issue #16127
CONSOLE-4447: Migrate @console/shared modals to PatternFly v6 Modal components #16079
NO-JIRA: Remove cursor context #16106
CONSOLE-5087: Refactor console-shared-package from Firehose to useK8sWatchResource #16077
CONSOLE-4447: Migrate modal hooks from useModal to useOverlay #16061
CONSOLE-5114: Clean up React Router imports and dependencies #16139
OCPBUGS-78499: Fix curly quote in operator-hub-community-provider-modal #16145
NO-JIRA: Update PageHeading types #16095
NO-JIRA: Add a progress bar when building #16099
CONSOLE-4447: Migrate knative-plugin modals to PatternFly 6 #16065
OCPBUGS-78404: Fix flaky secret integration tests #16140
CONSOLE-4447: Migrate core modals to PatternFly 6 Modal components (part 2) #16123
CONSOLE-4439: Upgrade to React Router 7 #14957
OCPBUGS-78361: Fix flaky popover-status-button integration test #16135
CONSOLE-4447: Migrate core modals to PatternFly v6 modal components (part 1) #16100
CONSOLE-4447: Migrate console-app modals to modern PatternFly Modal components #16037
OCPBUGS-69853: Updating openshift-enterprise-console-container image to be consistent with ART for 4.22 #15865
CONSOLE-4447: Migrate legacy PatternFly Modals to PatternFly v6 #16054
HELM-609: Fix upgrade failure for URL-installed charts #16049
CONSOLE-5068: Remove createModalLauncher from modal factory #16066
CONSOLE-4990: History object migration for #15961 / unit test fixes #16120
OCPBUGS-77867: Fix perspective switcher E2E test flake that causes 6-hour CI timeout #16114
HELM-609: Frontend for Installation of Helm Charts via URL #15961
NO-JIRA: Enforce no yarn.lock changes at build time #16107
OCPBUGS-77658: Azure Provisioning Fields are not mandatory #16092
CONSOLE-5049: Migrate DeleteResourceModal to useOverlay pattern #16022
CONSOLE-4827: make software catalog work with all projects #15804
OCPBUGS-77848: [CI] Fix the VolumeSnapshot CRUD flaky test failures #16110
CONSOLE-4447: Migrate modals to modern PatternFly Modal components #16015
OCPBUGS-77804: prep for 4.21 GA SDK publish #16109
CONSOLE-4990: Replace history object navigation with useNavigate hook #15959
CONSOLE-5030: Refactor remaining firehose impacted components #16039
CONSOLE-4945: Add Disk, Network, CPU and VM counts to node overview #16000
OCPBUGS-77415: Fix infinite recursion in project access form #16069
CONSOLE-5019: Consistently use FC and memo type param #16098
OCPBUGS-77423: Fix extra space in PageHeading when no actions present #16072
OCPBUGS-77044: Fix topology node labels disappearing when moving cursor to kebab menu #16042
NO-JIRA: Context improvements #16068
OCPBUGS-44612: Deprecate useUserSettings and expose useUserPreference #16057
CONSOLE-5100: Remove support for PatternFly 5 #16056
CONSOLE-5094: Delete Dockerfile.product.nodejs #16047
OCPBUGS-77016: fix type as K8sResourceKind assertion in createKnatifyPage #16044
CONSOLE-5063: Remove AppInitSDK #16019
OCPBUGS-76945: Add Azure Resource Group in OCP console for ODF STS installation #16030
OCPBUGS-76378: fix display of Lightspeed button #16012
OCPBUGS-77000, OCPBUGS-77013: OLM prompts for GCP Workload Identity parameters during Kiali Operato… #16051
NO-JIRA: /microcopy-review improvements #16026
CONSOLE-4991: Reenable all unit tests #16025
CONSOLE-5021: Enable consistent-type-imports #16031
HELM-598: Add new server endpoint for installing OCI charts without Helm repository #15863
CONSOLE-5011: migrate to yarn berry #15986
OCPBUGS-76554: Ban CJS imports of PF react-icons #16023
OCPBUGS-76283: Show modal when downloading pod logs #16014
NO-JIRA: New microcopy-review skill and context simplification #16009
CONSOLE-5055: AsyncComponent type improvements #16002
OCPBUGS-76553: i18n miss in CustomIconModal #16021
CONSOLE-5012: Create shared error modal launcher using React Context #15946
CONSOLE-4991, ODC-6264: Jest 30 followup #16010
CONSOLE-5064: Properly mock PluginStore in unit tests #16017
CONSOLE-5012: Migrate remaining modals to useOverlay pattern #15990
CONSOLE-4976: Add ClusterExtension creation form and unit tests #15955
CONSOLE-3769: Phase 2 of using OpenShift Dynamic Plugin SDK #15904
CONSOLE-4990: Migrate from history object to React Router v6/v7 hooks #15956
OCPBUGS-73871: i18n upload/download routine task - 4.21 / 281 (Latest) #15976
OCPBUGS-74974: Use Actions button instead of kebab menu on Subscription details page #15983
CONSOLE-5043: Remove defaultProps from operator-hub-item-details #16003
OCPBUGS-74538: User without access on causes NamespaceBar to reset to All projects when used via dynamic plugin #15996
CONSOLE-5044: TypeScript port of events.jsx #15944
CONSOLE-4987: Conditionally render Guided Tour based on capability and disable it for Console E2E tests #15926
OCPBUGS-74639: Number links for failed pods/nodes on ‘Cluster inventory’ card are not linked to filtered table list #15979
NO-JIRA: Convert useTechPreviewFlagProvider to static function #15960
CONSOLE-5015: Refactor file-input to use PF #15952
OCPBUGS-74137: DataView Pagination page menus : i18n misses #15982
OCPBUGS-74349: Worklodas - Edit pod count and Edit parallelism : Content is in English #15980
CONSOLE-5029: Refactor withDashboardResources in with-dashboard-resources.tsx into … #15927
CONSOLE-5012: Additional modal migrations to overlay pattern #15940
NO-JIRA: Add guidance for avoiding deprecated components #15969
OCPBUGS-74647: Fix referenceFor parameter in SubscriptionDetailsPage #15957
OCPBUGS-65967: Clean up old session cookies to prevent accumulation #15837
CONSOLE-5012: Migrate modals to overlay pattern #15939
OCPBUGS-65828: Reduce log noise from transient async cache failures #15821
OCPBUGS-70329: Auto-linkify URLs in status card alert messages #15880
CONSOLE-5039: Remove useSafetyFirst #15937
CONSOLE-4943: Add Machine Set, MachineConfigPool, and VMs columns to Nodes list view #15909
OCPBUGS-74241: Add null checks to CRB subject #15943
OCPBUGS-72585: Do not resolve disabled catalog type extensions #15908
CONSOLE-5012: Migrate delete modals and PVC modals to overlay pattern #15932
OCPBUGS-74369: Bump lodash to latest #15947
NO-JIRA: Suppress ResizeObserver-related windowError #15958
OCPBUGS-72260: ‘0 of pods’ are shown in Status column on DaemonSets list page. #15928
NO-JIRA: Suppress ResizeObserver-related e2e errors #15950
CONSOLE-5041: Replace testHook with renderHook from RTL #15936
NO-JIRA: SDK post-publish tasks #15942
OCPBUGS-74178: Direct AI agents to AGENTS.md documentation hub #15938
NO-JIRA: Moving the oc and kubectl delete,apply,create commands from deny to ask permissions #15941
NO-JIRA: Prepare for 4.22-prerelease.1 release #15933
CONSOLE-5050: Make shared modules peerDeps in SDK #15934
CONSOLE-3769: Refactor weird getResourceSidebarSamples #15915
CONSOLE-5042: Remove React.FCC #15929
OCPBUGS-70340: Ensure OpenAPI in monaco stays fresh #15890
CONSOLE-4402, CONSOLE-4510: React 18 upgrade - phase 1 #14869
NO-JIRA: Add /pre-push review command for comprehensive local code analysis #15800
OCPBUGS-65891: Follow up on fixing the remaining issues in the multi-group impersonation feature #15916
CONSOLE-4630: @types/react 18 prep work #15893
OCPBUGS-73766: Configure coderabbit.yaml for only major reviews and disable multiple summaries #15919
CONSOLE-5035: cache lazy route components to prevent navigation freeze #15924
CONSOLE-4865: Remove @openshift-console/plugin-shared #15921
NO-JIRA: Update dynamic demo plugin OWNERS and lock files #15920
NO-JIRA: Refactor - consolidate K8s client creation into new function #15897
OCPBUGS-70011: i18n upload/download routine task - 4.21 / 281 #15905
OCPBUGS-69377: Update the perspective name in dev-console guided tour #15852
OCPBUGS-69380: Fixed loaded page no roles error upon render #15878
OCPBUGS-72571: remove “OperatorHub” from OLM integration tests where … #15911
OCPBUGS-69387: update operator details when changing channels #15853
OCPBUGS-70344: change OperatorHub strings to Software Catalog #15891
CONSOLE-4844: merge secret scenarios #15684
CONSOLE-4912: update machine config tests #15759
OCPBUGS-63120: Home -> Overview page returns error during upgrade process #15831
OCPBUGS-62611: Fix editing secrets with mixed text and binary data #15820
OCPBUGS-65946: Fix search component to not pass ALL_NAMESPACES_KEY to… #15789
OCPBUGS-65831: Fix catalog service swapping description and markdownDescription fields #15750
OCPBUGS-68332: Improve VAC field on PVC details page #15843
OCPBUGS-70330: remove support for Windows 8 Live Tiles and IE “standards mode” #15886
OCPBUGS-70324: Revert the console-shared.json to console-shared directory #15885
CONSOLE-4989: bump to react-redux 8 #15854
CONSOLE-3769: Update OpenShift Dynamic Plugin SDK + webpack-related deps #15892
CONSOLE-4969: Configure a coderabbit.yaml file for console repo #15818
NO-JIRA: Fix incorrect syntax for claude settings #15899
CONSOLE-4971: Add AGENTS.md and structured AI documentation #15896
OCPBUGS-66247: make cloudCredentials optional so operators load when … #15803
CONSOLE-3769: Even more openshift/dynamic-plugin-sdk prep work #15778
OCPBUGS-63389: Remove asterisk from Routing label field in alertManager receiver form #15825
CONSOLE-4631, CONSOLE-5005: Manually rewrite remaining namespace/default imports #15884
CONSOLE-4631: Run react/update-react-imports #15872
OCPBUGS-68376: fix routing issues on packageserver PackageManifest de… #15844
CONSOLE-4916: add auto scenario about yaml sidebar #15790
OCPBUGS-65678, OCPBUGS-65765: apiVersion is empty on YAML creation page - Runtime error occurs when create MachineConfig with default yaml from… #15763
OCPBUGS-63159: Prevent the display of events from projects other than the currently selected project #15836
OCPBUGS-63237: There should be no role ARN field as token-auth-aws/azure/gcp=false in csv annotations #15813
OCPBUGS-60426: Fix edit application via Deploy image internal registry doesn’t select correct image stream #15795
NO-JIRA: Add /gen-rtl-tests Claude code slash command for generating React Testing Library tests for React components #15668
CONSOLE-4970: Upgrade Jest from 22 to 30 #15817
CONSOLE-4979: Speed up check-patternfly-modules + add dedupe step to CI #15835
OCPBUGS-67002: fix bug where Installed badge is not fully visible #15828
OCPBUGS-63390: show DASH to routing labels column when receiver doesn’t have routing labels #15824
CONSOLE-4630: Fix 67 react 18 type errors #15779
CONSOLE-4106: Add ClusterExtension creation page #15741
OCPBUGS-62713: Prevent application filter in Topology view from resetting to all applications unexpectedly #15812
NO-JIRA: disable guided tour when cypress is running #15841
And 42 elided commits (e.g. from squash or rebase merges)
Full changelog

console-operator

OCPBUGS-113612: Handle disabled Ingress capability in HyperShift #1214
OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #1242
OCPBUGS-101926: Fix CVE-2026-33814 #1219
OCPBUGS-81121: clone bump documentation base url #1154
OCPBUGS-100387: Sort plugin list to make them deterministic #1165
OCPBUGS-97828, OCPBUGS-97829: Stabilize telemetry config to prevent continuous console pod rollouts #1183
OCPBUGS-94186: Add retry for transient API errors to prevent Degraded blips #1181
OCPBUGS-94188: use ObservedGeneration to determine Progressing status #1180
OCPBUGS-92829: Clean up old temp directories in downloads pod #1177
OCPBUGS-86118: Add unit and e2e test coverage for cert rotation redeployment #1161
OCPBUGS-83941: bump gRPC-Go package #1157
NETOBSERV-2296: add missing annotations on netobserv quickstart #1097
OCPBUGS-85507: feat: use 2 replicas for console on tnf #1155
OCPBUGS-79068: Fix HelmChartRepository YAML format #1129
CONSOLE-5138: Enable readOnlyRootFilesystem for console and download pod #1123
OCPBUGS-78477: Bump API to support ExternalOIDCWithUpstreamParity new API fields #1125
OCPBUGS-63502: Redeploy console pods upon cert rotation #1093
OCPBUGS-65622: add controller for downloads service account deletion logic #1111
Sync Dockerfile.ocp image #1127
NO-JIRA: Add linked repository for cross-repo CodeRabbit reviews #1120
OCPBUGS-74506: Remove ConsolePluginSecurityPolicy featuregate #1108
OCPBUGS-77741: Updating openshift-enterprise-console-operator-container image to be consistent with ART for 4.22 #1121
OCPBUGS-65622: add service account to downloads deployment #1087
OCPBUGS-62307: Remove orphaned console-conversion-webhook deployment and related resource #1053
OCPBUGS-57468: Add rhel8 and rhel9 oc binaries for Linux OS in CLI downloads #1102
OCPBUGS-72387: Update the downloads manifest #1101
OCPBUGS-72387: Fix PDB blocking node drains during cluster upgrades #1099
CONSOLE-4986: Vendor API changes for GuidedTourFeature capability #1091
NETOBSERV-2296: add missing annotations on netobserv quickstart #1080
OCPBUGS-65496: Add missing relatedObjects + small refactoring #1075
NO-JIRA: Fix claude syntax #1088
OCPBUGS-68367: Add missing console annotation to the quickstart #1082
OCPBUGS-70045: Updating openshift-enterprise-console-operator-container image to be consistent with ART for 4.22 #1086
CONSOLE-4871: Add AI context documentation files #1077
CM-821, ESO-277, SSCSI-235: Add quickstart guides for secrets management operators #1073
Full changelog

container-networking-plugins, containernetworking-plugins-microshift

OCPBUGS-120707: Remove rhel8 build stage #249
OCPBUGS-83942: Bump grpc to 1.79.3 to address CVE-2026-33186 #243
OCPBUGS-87165: CI build root image tag sync with ART 4.22 #240
Full changelog

coredns

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #219
OCPBUGS-86189: [release-4.22] OCPBUGS-83943: Bump gRPC to v1.79.3 to resolve CVE-2026-33186 #185
OCPBUGS-77600: Updating coredns-container image to be consistent with ART for 4.22 #170
OCPBUGS-69852: Updating coredns-container image to be consistent with ART for 4.22 #159
NO-JIRA: Add team members to the OWNERS file #162
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-123142: Bump Go builder to 1.26 and protobuf to v1.36.12 #445
OCPBUGS-96666: Bump golang.org/x/net to v0.55.0 #416
OCPBUGS-83552: Bump google.golang.org/grpc to 1.79.3 #395
UPSTREAM-SYNC: Sync release-4.22 with upstream release-1.35 #381
OCPBUGS-85241: Updating ose-openstack-cloud-controller-manager-container image to be consistent with ART for 4.22 #392
OCPBUGS-85239: Updating ose-openstack-cinder-csi-driver-container image to be consistent with ART for 4.22 #390
OCPBUGS-85240: Updating csi-driver-manila-container image to be consistent with ART for 4.22 #391
NO-JIRA: Update DOWNSTREAM_OWNERS #373
OCPBUGS-69813: Updating csi-driver-manila-container image to be consistent with ART for 4.22 #369
OCPBUGS-70057: Updating ose-openstack-cloud-controller-manager-container image to be consistent with ART for 4.22 #360
OCPBUGS-70072: Updating ose-openstack-cinder-csi-driver-container image to be consistent with ART for 4.22 #358
Full changelog

csi-driver-nfs

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #212
OCPBUGS-84434: Bump github.com/moby/spdystream@v0.5.1 #190
OCPBUGS-83946: CVE-2026-33186: bump google.golang.org/grpc to v1.79.3 #174
OCPBUGS-77740: Updating csi-driver-nfs-container image to be consistent with ART for 4.22 #169
NO-JIRA: Merge https://github.com/kubernetes-csi/csi-driver-nfs:master into main #167
OCPBUGS-70043: Updating csi-driver-nfs-container image to be consistent with ART for 4.22 #168
Full changelog

csi-external-attacher

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #124
UPSTREAM: 110: OCPBUGS-101913: Bump golang.org/x/net to v0.57.0 #111
OCPBUGS-83947: Bump google.golang.org/grpc to v1.79.3 #107
OCPBUGS-77562, STOR-2758: Rebase to upstream v4.11.0 for OCP 4.22 #94
OCPBUGS-69744: Updating csi-attacher-container image to be consistent with ART for 4.22 #91
Full changelog

csi-external-provisioner

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #166
OCPBUGS-96626: Bump golang.org/x/net to v0.57.0 #148
OCPBUGS-84435: Bump github.com/moby/spdystream to v0.5.1 in 4.22 #136
OCPBUGS-82033: Bump google.golang.org/grpc to 1.79.3 #133
STOR-2758: Rebase to upstream v6.2.0 for OCP 4.22 #121
OCPBUGS-77752: Updating csi-provisioner-container image to be consistent with ART for 4.22 #120
OCPBUGS-70054: Updating csi-provisioner-container image to be consistent with ART for 4.22 #118
Full changelog

csi-external-resizer

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #218
OCPBUGS-101944: Bump golang.org/x/net to v0.53.0 #209
OCPBUGS-82031: Bump google.golang.org/grpc to v1.79.3 #199
STOR-2758: Rebase to upstream v2.1.0 for OCP 4.22 #183
OCPBUGS-77735: Updating ose-csi-external-resizer-container image to be consistent with ART for 4.22 #182
OCPBUGS-70039: Updating ose-csi-external-resizer-container image to be consistent with ART for 4.22 #180
Full changelog

csi-external-snapshot-metadata

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #36
OCPBUGS-101935: Bump golang.org/x/net to v0.53.0 #30
OCPBUGS-83948: Bump google.golang.org/grpc to v1.79.3 #19
OCPBUGS-77411: Updating csi-external-snapshot-metadata-container image to be consistent with ART for 4.22 #10
OCPBUGS-69720: Updating csi-external-snapshot-metadata-container image to be consistent with ART for 4.22 #8
Full changelog

csi-external-snapshotter, csi-snapshot-controller

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #259
OCPBUGS-101938: UPSTREAM: 1452: Bump golang.org/x/net v0.53.0 to mitigate CVE-2026-33814 #234
OCPBUGS-88723: UPSTREAM: 1392: Fix VolumeSnapshotContent deletion #222
OCPBUGS-83949, OCPBUGS-83952: Bump google.golang.org/grpc to v1.79.3 #216
STOR-2758: Rebase to upstream v8.5.0 for OCP 4.22 #202
OCPBUGS-77687: Updating ose-csi-snapshot-controller-container image to be consistent with ART for 4.22 #201
OCPBUGS-69935: UPSTREAM: <drop>: restore log level of the group snapshot reconciler #200
OCPBUGS-77413: Updating ose-csi-external-snapshotter-container image to be consistent with ART for 4.22 #199
OCPBUGS-66967: UPSTREAM: 1354: UPSTREAM: 1359: Fix for cases where the resource is already present on the cluster #193
OCPBUGS-69979: Updating ose-csi-snapshot-controller-container image to be consistent with ART for 4.22 #195
OCPBUGS-66967: UPSTREAM: <drop>: bump log level of the group snapshot reconciler #192
OCPBUGS-69721: Updating ose-csi-external-snapshotter-container image to be consistent with ART for 4.22 #194
Full changelog

csi-livenessprobe

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #106
OCPBUGS-101948, OCPBUGS-104212: Bump golang.org/x/net to v0.53.0 to address CVE-2026-33814 #107
OCPBUGS-77672, STOR-2758: Rebase to upstream v2.18.0 for OCP 4.22 #81
OCPBUGS-69958: Updating csi-livenessprobe-container image to be consistent with ART for 4.22 #78
Full changelog

csi-node-driver-registrar

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #111
OCPBUGS-84436: Bump github.com/moby/spdystream to v0.5.1 #105
OCPBUGS-77738, STOR-2758: Rebase to upstream v2.16.0 for OCP 4.22 #95
OCPBUGS-70041: Updating csi-node-driver-registrar-container image to be consistent with ART for 4.22 #92
Full changelog

docker-builder

OCPBUGS-123142: Bump Go builder to 1.26 and protobuf to v1.36.12 #572
OCPBUGS-95539: Bump golang.org/x/crypto to fix CVE-2025-22869,CVE-2025-47913,CVE-2026-46597,CVE-2026-39829,CVE-2026-39832 #551
OCPBUGS-86910: Updating openshift-enterprise-builder-container image to be consistent with ART for 4.22 #538
OKD-322: Update Dockerfile to work on CentOS/RHEL 10 #500
OCPBUGS-70150: bump buildah to 1.39.7 to fix CVE-2025-52881 #494
OCPBUGS-69871: Updating openshift-enterprise-builder-container image to be consistent with ART for 4.22 #493
Full changelog

docker-registry

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #491
[release 4.22] OCPBUGS-114405: GCP: Support Alternate Universe Domain #476
OCPBUGS-84738: pin cloud.google.com/go/storage to v1.30.1 to fix blob deletion #470
CNTRLPLANE-3073: bump kubernetes to v1.35 #467
IR-350: bump library-go to the latest version #460
IR-350: fix cipher suite configuration conflict with docker distribution #459
OCPBUGS-69762: Updating openshift-enterprise-registry-container image to be consistent with ART for 4.22 #457
Full changelog

driver-toolkit

OCPBUGS-77868: Clean up cruft in /var/cache/dnf #182
NO-ISSUE: Add autoconf, automake and libtool packages #181
NO-ISSUE: Support ubi minimal base image #179
OCPBUGS-69699: Updating driver-toolkit-container image to be consistent with ART for 4.22 #178
Full changelog

egress-router-cni

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #116
OCPBUGS-120707: Update Dockerfiles #114
OCPBUGS-97939: bump containernetworking/cni to v1.3.0 #103
Full changelog

etcd, installer-etcd-artifacts

OCPBUGS-130714: Increase snapshot test new member wait timeout #421
OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #425
OCPBUGS-82497: Rebase v3.6.13 for openshift-4.22 #393
OCPBUGS-74168: Remove unused ART dockerfiles #356
OCPBUGS-69868: Updating ose-etcd-container image to be consistent with ART for 4.22 #353
Full changelog

gcp-cloud-controller-manager

OCPBUGS-123142: Bump Go builder to 1.26 and protobuf to v1.36.12 #172
OCPBUGS-128462: Bump golang.org/x/net to v0.55.0 for CVE-2026-39821 #171
OCPBUGS-101949, OCPBUGS-102055: Bump golang.org/x/net to v0.53.0 for CVE-2026-33814 #134
NO-JIRA: Update OWNERS #160
OCPBUGS-112265: UPSTREAM: 1250: Support Universe Domain client options (#1250) #141
OCPBUGS-99228: Fix node.kubernetes.io/exclude-from-external-load-balancers on masters #130
OCPBUGS-83965, OCPBUGS-84447: Update grpc and spdy dependencies #117
OCPBUGS-78471: Fix OSD ILB bug #103
OCPCLOUD-3274: Merge https://github.com/kubernetes/cloud-provider-gcp:master (378730f) into main #99
OCPBUGS-77570: Updating ose-gcp-cloud-controller-manager-container image to be consistent with ART for 4.22 #98
Full changelog

gcp-cluster-api-controllers

OCPBUGS-101936: Bump golang.org/x/net to github.com/openshift-sustaining/net v0.50.0-sec.4 CVE-2026-33814 [release-4.22] #316
OCPBUGS-123142: Bump Go builder to 1.26 and protobuf to v1.36.12 #321
UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-gcp:v1.12.0 (b9b055d) into release-4.22 #294
OCPBUGS-83966: Merge https://github.com/kubernetes-sigs/cluster-api-provider-gcp:v1.11.2 (14609a0) into release-4.22 #293
OCPBUGS-84862: Updating ose-gcp-cluster-api-controllers-container image to be consistent with ART for 4.22 #286
NO-JIRA: Remove dead RELEASE_DIR ref #263
NO-JIRA: Remove old manifest-gen assets #264
OCPCLOUD-3325: Update to new manifests-gen #258
OCPBUGS-74913: Merge https://github.com/kubernetes-sigs/cluster-api-provider-gcp:v1.11.0 (1cb204d) into master #261
NO-JIRA: UPSTREAM: <carry>: Add manifests verify target #259
Updating ose-gcp-cluster-api-controllers-container image to be consistent with ART for 4.22 #257
Full changelog

gcp-machine-controllers

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #205
OCPBUGS-114401: gcd support #193
OCPBUGS-81576: Bump gRPC-Go package for CVE fix #155
OCPCLOUD-3279: Rebase to Kube 1.35 for Machine API Provider GCP #145
OCPNODE-4168: Empty disk should be ignored for gcp additional disk #141
OCPBUGS-77746: Updating ose-machine-api-provider-gcp-container image to be consistent with ART for 4.22 #144
CORS-4296: Add the N4A machine type #138
OCPBUGS-70052: Updating ose-machine-api-provider-gcp-container image to be consistent with ART for 4.22 #137
OCPCLOUD-3255: Add AGENTS configuration #136
Full changelog

gcp-pd-csi-driver

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #150
OCPBUGS-101954: CVE-2026-33814: bump golang.org/x/net to v0.53.0 #148
OCPBUGS-114412: Add Universe Domain Support #129
OCPBUGS-81649: Bump google.golang.org/grpc to v1.79.3 in release 4.22 #108
STOR-2751: Rebase to upstream v1.24.1 for OCP 4.22 #98
OCPBUGS-77632: Updating ose-gcp-pd-csi-driver-container image to be consistent with ART for 4.22 #100
OCPBUGS-77602: Support Downward API node name override #99
OCPBUGS-74521: UPSTREAM: 2175: Move VAC storage API to v1 from v1beta1 #97
OCPBUGS-69930: Updating ose-gcp-pd-csi-driver-container image to be consistent with ART for 4.22 #87
Full changelog

gcp-pd-csi-driver-operator

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #224
OCPBUGS-101954: Bump golang.org/x/net from v0.52.0 to v0.53.0 #203
OCPBUGS-115120: detect GCP Dedicated and use hyperdisk-balanced StorageClass #204
OCPBUGS-86574: VolumeSnapshot snapshot-c9v52 is not ready within 5m0s… #193
OCPBUGS-83968: Bump google.golang.org/grpc to v1.79.3 #183
OCPBUGS-85023: Add test e2e manifest for images volumeSnapshotClass CSI tests #180
STOR-2762: Bump all deps for 4.22 #175
OCPBUGS-77558: Updating ose-gcp-pd-csi-driver-operator-container image to be consistent with ART for 4.22 #174
OCPBUGS-77428: Pass node name to csi-driver container #172
OCPBUGS-77183: Add RBAC permission for node driver to get Node objects #170
OCPBUGS-74521: Remove VolumeAttributesClass FeatureGate #168
STOR-2792: STOR-2842: Enable Hyperdisk-balanced High Availability disks #158
STOR-2793: Add volume snapshot class of type images #165
STOR-2543: Add VAC manifest to support tests on GCP PD #160
OCPBUGS-69742: Updating ose-gcp-pd-csi-driver-operator-container image to be consistent with ART for 4.22 #159
OCPBUGS-66113: Some containers do not have readOnlyRootFilesystem #157
Full changelog

gcp-workload-identity-federation-webhook

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #29
OCPBUGS-101955: Bump golang.org/x/net to v0.53.0 for CVE-2026-33814 #22
CCO-786: update to pick up tls-cipher-suites and tls-min-version #16
CCO-730: Revendor upstream changes #14
OCPBUGS-69839: Updating gcp-workload-identity-federation-webhook-container image to be consistent with ART for 4.22 #13
Full changelog

haproxy-router

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #865
OCPBUGS-126886: use add/del haproxy api calls #849
OCPBUGS-99286: Make external cert validation asynchronous and preserve deletion rejection #858
OCPBUGS-101956: Bump golang.org/x/net from v0.48.0 to v0.53.0 #834
OCPBUGS-87166: Prevent SSRF via FQDN-typed EndpointSlices #813
OCPBUGS-87167: Strip X-SSL-* headers for plain HTTP #793
OCPBUGS-83969: Bump google.golang.org/grpc to v1.79.3 #776
NE-2332: Add support for TLS curves in HAProxy configuration #755
TRT-2597: Revert “NE-2333: Add support for configurable SSL curves in HAProxy configuration” #754
NE-2333: Add support for configurable SSL curves in HAProxy configuration #678
OCPBUGS-77773: fix backend server health check if DCM is enabled #747
OCPBUGS-62238: configure TLS profile for metrics endpoint #748
NO-JIRA: Do not install weak dependencies such as logrotate #687
NE-2418: Add haproxy_max_connections metric #728
OCPBUGS-75009: sort list of map entries on DCM #738
OCPBUGS-75010: Change how DCM identifies state changes #725
OCPBUGS-67161: Replace HTTP backend liveness check with admin socket check #737
OCPBUGS-77412: reload router if route is changed on DCM #739
NO-JIRA: hack: steps to run router locally #712
NE-2468: Migrate away from deprecated ioutil #693
OCPBUGS-74511: remove RouteExternalCertificate feature gate #730
NE-2483: bump k8s libraries to v0.35.0 #729
OCPBUGS-72591: Lower verbosity for parseIPList empty list logging #709
NO-JIRA: hack: update image without push #711
NO-JIRA: add jcmoraisjr to owners #717
OCPBUGS-70068: Updating openshift-enterprise-haproxy-router-container image to be consistent with ART for 4.22 #707
OCPBUGS-65482: Fix HAProxy redirect: strip port from Host header #696
Full changelog

hyperkube, installer-kube-apiserver-artifacts, kube-proxy, pod

OCPBUGS-133399: UPSTREAM: 140661: admission/namespace/lifecycle: allow updates to resources in deleted namespaces #2829
NO-JIRA: add explicit merge commit message #2794
Rebase v1.35.9 in release-4.22 #2817
NO-JIRA: Rebase release-4.22 to Kubernetes v1.35.8 #2773
OCPBUGS-107557, OCPBUGS-107672: bump otel to v1.44.0 to fix CVE-2026-41178 #2770
OCPBUGS-98604: Add NodeSelectorAdjuster admission plugin for HCP clusters (part 2) #2767
OCPBUGS-98604: Add NodeSelectorAdjuster admission plugin for HCP clusters #2718
NO-JIRA: Update openshift-hack/rebase.sh #2733
OCPBUGS-96637: Bump golang.org/x/net from v0.47.0 to v0.55.0 #2737
OCPBUGS-91744, OCPBUGS-93526, OCPBUGS-93551, OCPBUGS-95549, OCPBUGS-95556: Bump golang.org/x/crypto/ssh to v0.52.0 #2725
OCPBUGS-99766: UPSTREAM: <carry>: upkeep cpu partitioning admission webhook #2724
OCPBUGS-90148: Rebase v1.35.6 in release-4.22 #2707
OCPBUGS-93787: backport kubernetes/conformance umbrella suite #2705
OCPBUGS-86898: Fix performance related issues when selinux metrics are emitted #2676
OCPBUGS-85499: Bump Kubernetes v1.35.5 to release-4.22 #2664
OCPBUGS-85415: [release-4.22] Improve WatchList test robustness #2663
OCPBUGS-84640: devicemanager: constrain topology hints to device NUMA nodes #2656
OCPBUGS-83607: Bump to k8s v1.35.4 #2646
OCPBUGS-84055: Update the csi-driver-host-path version to 1.17.1 #2650
OCPBUGS-78990: Bump 1.35.3 to master #2633
OCPBUGS-78986: UPSTREAM: 137926: KEP-961: demote maxUnavailable feature in statefulset to off by default #2632
NO-JIRA: UPSTREAM: <carry>: Register OpenShift cloud providers in k8s-tests-ext #2635
OCPBUGS-78504: unflake HPAConfigurableTolerance test #2631
UPSTREAM: <carry>: OCPBUGS-39360: Fix ClusterIsIPv6() detection for dual-stack v6-primary clusters #2603
NO-JIRA: UPSTREAM: <carry>: Add jacobsee and jubittajohn to DOWNSTREAM_OWNERS #2630
OCPBUGS-77866: Bump 1.35.2 to master #2612
OCPBUGS-73813: UPSTREAM: <carry>: un-skip MutableCSINodeAllocatableCount tests #2613
OCPSTRAT-2728: Rebase to 1.35 #2523
OCPBUGS-66338: UPSTREAM: 135629: selinux: Fix the controller to ignore finished pods #2538
OCPBUGS-67200: UPSTREAM: 136202: raise kubelet CSI init backoff to cover ~140s DNS delays #2578
OKD-259: Validate OKD featureset to prevent it from being enabled on OCP clusters #2420
OCPBUGS-73913: UPSTREAM: 135340: cbor: bump limits #2564
OCPBUGS-70170: add label serial for iperf2 testing #2559
OCPBUGS-63045: enable InPlace resize test #2532
NO-ISSUE: Extend k8s suite timeouts for parallel testing load #2497
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

hypershift

OCPBUGS-133444: Revert https://github.com/openshift/hypershift/pull/10106 Fix intermittent etcd peer communication failures #10138
build: [release-4.22] ACM-45149: Migrate Go builder for hypershift-cli, hypershift-release #10072
OCPBUGS-132102: etcd initialization bugs after etcdctl snapshot restore #10020
OCPBUGS-129442: Prevent infraID and clusterID removal via parent-level CEL rules #9925
OCPBUGS-133444: Fix intermittent etcd peer communication failures #10106
OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #9998
OCPBUGS-121867: Generate KubeVirt nmstate network config conditionally #9978
OCPBUGS-128505: fix: mount combined-pull-secret in OpenShift API Server #9884
OCPBUGS-129020: backport safe-to-evict annotation fix #9876
OCPBUGS-129145: Count only successful upsert updates #9900
OCPBUGS-127060: Replace exponential backoff with fixed-interval requeue in CRR controller #9721
CNTRLPLANE-4569: add kubeClientQPS and kubeClientBurst to ClusterAutoscaling #9886
OCPBUGS-129105: [release-4.22] OCPBUGS-127049: fix(globalps): schedule global-pull-secret-syncer on karpenter nodes #9895
OCPBUGS-95572: CVE-2026-46597 openshift4/ose-hypershift-rhel9: golang… #9264
OCPBUGS-101951: Fix CVE-2026-33814 by bumping golang.org/x/net to v0.53.0 #9528
OCPBUGS-119698: Add proxy env vars to cluster-storage-operator deployment” #9494
CNTRLPLANE-4158: Maintain ingress serving cert for HostedCluster ingress #9607
OCPBUGS-120746: Move packageserver PDB from guest cluster to management cluster #9548
OCPBUGS-127173: filter AWS-reserved tag keys before calling DeleteTags #9733
OCPBUGS-123727: fix(azure): skip KMS validation for private Key Vaults on ARO HCP #9624
OCPBUGS-112731: fix(certs): normalize IP SANs to stop dual-stack KAS cert churn #9496
OCPBUGS-114436: fix(konnectivity): enable –sync-forever to restore lost agent-server tunnels #9432
ACM-46124: improve hypershift-rhel9-operator container grade on MCE 2.12 [release-4.22] #9740
OCPBUGS-125659: fix(cpo): preserve immutable AWS load balancer annotations #9637
OCPBUGS-120704: [release-4.22] fix(operator): health probes + pki-operator TLS config #9600
OCPBUGS-100445: create virt-launcher NetworkPolicy on external infra cluster #9205
OCPBUGS-114889: hardcode ETCD_METRICS=extensive in etcd StatefulSet template #9440
CNTRLPLANE-4321: Cherry-pick kube-scheduler metrics support #9490
CNTRLPLANE-4024: feat(azure): support managed HSM for KMS encryption #9437
OCPBUGS-98328: fix(kubevirt): use only first MachineInternalIP per family in EndpointSlice endpoints #8979
CNTRLPLANE-3774: [release-4.22] fix: control-plane-operator: improve opaque conditions #9058
OCPBUGS-111083: fix(hcco): run kas-connection-checker as non-root #9320
OCPBUGS-105866: remove redhat-marketplace catalog from HyperShift #9289
OCPBUGS-105591: [release-4.22] use in-cluster service for oauth-server #9127
OCPBUGS-96711: Apply MetricsSet relabel configs to KAS ServiceMonitor #8901
OCPBUGS-105421: fix(upsert): add desired-state hash to detect spec field removals #9259
OCPBUGS-101964: [release-4.22] OCPBUGS-98213: fix router component ordering to prevent missing HAProxy backends #9212
OCPBUGS-100332: fix(konnectivity): conditionally prefer IPv4 based on HCP network config [release-4.22] #9191
OCPBUGS-100141: Add proxy env vars to AWS cloud-controller-manager deployment #9156
OCPBUGS-94518: add ACR pull identity to worker cloud.conf and VMSS #8865
OCPBUGS-100299: Avoid printing errors twice #9183
OCPBUGS-94170: fix registry override matching and propagation to init containers #8877
OCPBUGS-100176: Remove hardcoded quay.io credentials from EnsureGlobalPullSecret test #9169
OCPBUGS-90086: [release-4.22] clear stale EtcdRecoveryActive failure condition when etcd is healthy #8806
OCPBUGS-99554: fix(backport): konnectivity agent auth to 4.22 #9077
OCPBUGS-99299: [release-4.22] OCPBUGS-86296: Propagate management cluster proxy env vars to konnectivity sidecar #8592
CNTRLPLANE-3884: Add spec.monitoring API for metrics forwarding #8872
OCPBUGS-97921: fix(nodepool): skip CNI-internal IPs in ClusterNetworkCIDRConflict check #8948
OCPBUGS-98627: Skip Azure topology LB scope override for ARO HCP IngressController #8998
OCPBUGS-98220: fix(cpo,hcco): prevent premature KAS convergence during KMS key rotation [release-4.22] #8972
OCPBUGS-90083: Fix NodePool reconciliation failure when updating mirrored immutable ConfigMaps #8811
OCPBUGS-89236: Handle CA bundle aggregation delay by requeuing revocation #8746
CNTRLPLANE-3749: feat(api,cpo): add observedGeneration to ControlPlaneComponentStatus #8868
OCPBUGS-93921: bump catalog image version cap from 4.21 to 4.22 #8861
OCPBUGS-88325: fix(cpo) delete terminated MCD pods to retry in-place upgrades #8729
OCPBUGS-87364: Gate Route watch on management cluster capability #8692
CNTRLPLANE-3661: add etcd data re-encryption after encryption key rotation (#8219) #8790
OCPBUGS-88356: fix(cpo): deduplicate VPC endpoint subnets by AZ #8724
CNTRLPLANE-3619: backport API-driven Azure topology and private connectivity (Phase 1) #8721
OCPBUGS-90563: Fix metrics-proxy unbounded memory growth #8788
OCPBUGS-89352: build(operator): drop hypershift-no-cgo from operator container images #8756
OCPBUGS-86912: [release-4.22] Stop controllers fighting over HCP status #8632
OCPBUGS-86039: OCPBUGS-62177: [release-4.22] Verify cert revocation against all KAS pods #8538
OCPBUGS-86578: bootstrap serving certs at hypershift operator startup #8599
OCPBUGS-86354: add Konflux pipeline definitions for CPO 4.22 #8608
OCPBUGS-86354: set limits for aro.openshift.io/swift-nic in request overrides for ARO swift #8564
OCPBUGS-85620: Fix webhook TLS failure after service-ca to self-managed cert migration #8513
OCPBUGS-83836: add missing RBAC for webhook configurations #8295
OCPBUGS-84939: [release-4.22] add CP pull-secret watches for in-place propagation #8408
OCPBUGS-86026: Fix metrics-proxy deployment failure due to dots in volume names #8534
OCPBUGS-85779: Add AWS ISO domains to konnectivity IsCloudAPI #8447
OCPBUGS-85659: Clarify –base-domain flag default behavior #8525
ACM-33601: use the latest ubi9 nginx image #8465
OCPBUGS-78988: bump go builder and ubi images #8457
CNTRLPLANE-2939: Coordinate CRD lifecycle with Cluster CAPI Operator #8442
OCPBUGS-85104: fix, cno, skip cloud-network-config-controller check on non-cloud platforms #8438
NO-JIRA: fix(ci): use PR base SHA for api-lint diff in GHA #8430
OCPBUGS-84841: fix(ingress): set FIPS_ENABLED env var on ingress operator #8388
OCPBUGS-83709: fix(kubevirt): filter link-local addresses from EndpointSlice endpoints #8272
OCPBUGS-78988: chore(deps): weekly dependabot consolidation #8383
OCPBUGS-84632: fix(azure): detect and replace stale role assignments on cluster re-creation #8359
OCPBUGS-83576: fix(metrics-proxy): resolve ports from pods instead of deployments #8260
NO-JIRA: revert: remove .git/ from .dockerignore #8234
OCPBUGS-83285: revert 5.0 supported version from release-4.22 #8216
CNTRLPLANE-3233: ci(gha): add release-4.22 branch to GitHub Actions workflows #8218
CNTRLPLANE-3197: update latest supported version from 4.22 to 4.23 #8193
CNTRLPLANE-3174: Add unit tests for CPO controller packages #8184
CNTRLPLANE-3215: fix envtest GHA workflow path filters for CRD test suites #8200
CNTRLPLANE-2078: add unit tests for AWS Route53 and IAM #8079
OCPBUGS-82301: fix(catalogs): use semver comparison for catalog version cap to handle OCP 5.0 #8195
NO-JIRA: control-plane-pki-operator: fix Event emission logic, format #8190
OCPBUGS-82192: fix(webhookcerts): handle upgrade from service-ca managed certs #8189
OCPBUGS-82159: fix(ignition-server): use major+minor version comparison for OCP 5.0 payloads #8182
CNTRLPLANE-2511: refactor(cpo): move OAuth internal LB annotation into ReconcileService #8185
CNTRLPLANE-2511: Support OAuth LoadBalancer with Azure Private Link Service #8149
OCPBUGS-81644: fix(cli): fix Azure destroy cluster leaving vnet/nsg resource groups for private topology #8151
OCPBUGS-33097: Remove deprecated OVNSbDb service type from default strategy mappings #8164
CNTRLPLANE-3174: test: Add unit tests for product-cli, token-minter, and sync-fg-configmap #8178
CNTRLPLANE-3050: feat(ci): use Konflux-built image for GitHub Actions runners #8092
CNTRLPLANE-2841: test(e2e): add metrics-forwarder e2e test verifying data-plane scraping #8147
CNTRLPLANE-3037: Create separate assets package specifically for CRD management #8150
GCP-462: Add GCP hosted cluster documentation #8027
NO-JIRA: docs(ci): add sync-community-fork token rotation guide #8173
CNTRLPLANE-2841: feat(HCCO): reintroduce guest cluster metrics forwarder for control plane metrics #8146
NO-JIRA: fix(e2e): handle rate limiter context deadline error during cleanup #8137
NO-JIRA: fix(ci): remove catch-all pattern from codecov ignore list #8171
CNTRLPLANE-2511: Allow LoadBalancer publishing strategy for OAuthServer on self-managed Azure #8148
NO-JIRA: chore(ci): add client/ to codecov ignore list #8167
NO-JIRA: feat(e2e): add Azure platform support for backup/restore tests #8144
OCPBUGS-74960: prevent resource leak on deletion and handle DependencyViolation #7868
NO-JIRA: docs: expand custom images guide with Dockerfile.dev and CPO override #8155
CNTRLPLANE-3042: Parallelize make verify targets for faster local development #8051
NO-JIRA: ci: fix codecov ignore patterns for docs and nested files #8156
OCPBUGS-81270: fix(external-dns): mitigate Azure DNS API throttling #8098
NO-JIRA: ci: ignore non-Go files in codecov coverage analysis #8154
OCPBUGS-67240: Ignition generalize image download errors #7673
NO-JIRA: fix(Makefile): auto-detect upstream remote for lint #8152
OCPBUGS-79539: fix(cpo-v2): preserve HCCO modifications to OCM Controllers field #8072
AUTOSCALE-582: wire CRD sync and CEL adjustments into karpenter-api target #8119
CNTRLPLANE-3111: docs: add service publishing strategies reference documentation #8107
NO-JIRA: ci: make docs deploy preview non-blocking #8145
Revert “CNTRLPLANE-2841: feat(HCCO): add guest cluster metrics forwarder for control plane metrics” #8141
NO-JIRA: fix(e2e): handle dual RHCOS payloads in Karpenter drift OS image check #8128
OCPBUGS-50003: add ConfigMap fallback and EC2 error caching for vCPU metrics resolution #6723
CNTRLPLANE-2172: feat(azure): add private endpoint access topology for self-managed HostedClusters #7821
CNTRLPLANE-2841: feat(HCCO): add guest cluster metrics forwarder for control plane metrics #7790
CNTRLPLANE-2797: hypershift-operator webhooks port 9443 respect cluster TLS security profile #8078
OCPBUGS-50603: Create dedicated identity for KAS bootstrap container #6827
Revert “NO-JIRA: test(e2e): extend AWS guest resource cleanup timeout” #8138
NO-JIRA: ci: improve CI efficiency and codecov configuration #8113
NO-JIRA: test(e2e): add KubeVirt platform to backup/restore e2e test #8131
OCPBUGS-81162: fix(cpo): skip router LB services for ARO HCP #8087
NO-JIRA: ci: enable paths filter on envtest workflows #8125
NO-JIRA: test(e2e): extend AWS guest resource cleanup timeout #8124
NO-JIRA: fix(test): deep copy CRDs inside envtest retry loop #8127
NO-JIRA: chore(docs-agg): remove document count from aggregated file #8126
NO-JIRA: ci: separate envtest from unit tests in CI workflow #8120
OCPBUGS-80926: consolidate disaster-recovery prerequisites into dedicated page #8080
CNTRLPLANE-3116: fix(ci): drop pip cache from docs-preview workflow #8116
NO-JIRA: fix(api): regenerate feature gate manifests for ExternalOIDCWithUpstreamParity #8117
OCPBUGS-78763: fix: global-pull-secret daemonset node labeling race condition causes pods not to be scheduled on Replace upgrade strategy nodes in time #7981
CNTRLPLANE-3037: Introduce envtest for integration tests alternative #8089
CNTRLPLANE-3116: ci(docs): migrate docs-preview job to GitHub Actions #8109
CNTRLPLANE-244: fix(ci): configure Codecov PR comments and add unit tests #8085
NO-JIRA: chore(deps): weekly dependabot consolidation #8077
OCPBUGS-78931: add KubeVirt-specific backup settings #8022
OCPBUGS-81284: fix(release): allow multiple machine-os component versions #8101
NO-JIRA: fix(aws): load credentials from –aws-creds file using SDK v2 #8095
NO-JIRA: chore(ci): update hypershift-ci-2 manifests #8062
CNTRLPLANE-2678: Adapt etcd-backup command and add HO namespace manifests #8040
CNTRLPLANE-2551: Hypershift integration for API Auth Config changes #7774
GCP-447: inject token-minter as native sidecar init container #7965
AUTOSCALE-538, AUTOSCALE-539: Add Autonode status node counts + enabled condition to HostedCluster API #7794
CNTRLPLANE-244: ci: add Codecov integration to unit test workflow #8060
CNTRLPLANE-3050: Pre-build lint tools and fix Konflux pipeline triggers #8052
CNTRLPLANE-2838: feat(CPO): add metrics-proxy control plane component #7752
CNTRLPLANE-2787: Introduce BASE_DOMAIN env var for E2E test configuration #7930
CNTRLPLANE-2786: Extend controller architecture diagram with consumes relationship #8029
IR-350: add tls security profile configuration for the image registry operator #8011
AUTOSCALE-571: fix(karpenter): don’t associate public IP addresses for the default OpenshiftEC2NodeClass #7853
NO-JIRA: feat(e2e): skip SupportedVersionSkew condition on OCP < 4.21 in backup/restore tests #8067
CNTRLPLANE-2076: remove v2 import aliases left from SDK migration #8063
AUTOSCALE-559: PrivateLink plumbing for karpenter ec2nodeclass subnets #7791
STOR-2770: Generate Azure Disk and File CSI Driver Operator metrics serving certs by HCP controller #7970
CNTRLPLANE-2678: Add fetch-etcd-certs CPO subcommand for HCPEtcdBackup #8010
NO-JIRA: revert(api): remove APIServer Route CEL validation for Azure #8074
CNTRLPLANE-2172: feat(api): add Azure private endpoint access and PrivateLinkService CRD #8055
OCPSTRAT-2831: chore(owners): add cblecker to core-reviewers and core-approvers #8018
OCPBUGS-79428: Add recipe for ACM/MCE HyperShift Operator overrides #8057
CNTRLPLANE-2076: complete SDK v1 removal and post-migration cleanup #8038
CNTRLPLANE-2049: update GCP validation error expectations in TestOnCreateAPIUX #8037
CNTRLPLANE-3046: feat(ci): add monitoring and alerting for ARC runners #8044
CNTRLPLANE-3049: split verify checks into individual GitHub Actions workflows #8049
OCPBUGS-79352: fix(oapi): force WatchList feature gate to disabled for openshift-apiserver #8035
OCPBUGS-79071: Fix AWSEndpointService private-router teardown stuck on active VPC Endpoint connections #8030
CNTRLPLANE-3041: Override ARO/HCP 4.20 CPO with Azure Pod Identity backport #8025
CNTRLPLANE-3054: Apply init task 0.3 migration to fix broken Konflux pipelines #8053
OCPBUGS-70301: force-remove karpenter finalizer when guest KAS is down #7939
CNTRLPLANE-3047: fix(ci): use community fork token for checkout credential helper #8050
CNTRLPLANE-2788: validate memory quantity in KubeVirt nodepool create #7884
NO-JIRA: chore(ci): update Konflux Tekton tasks to latest versions #8048
CNTRLPLANE-3048: refactor gh-actions-runner pipelines and improve CEL triggers #8045
OCPBUGS-79369: Add Konflux archived PipelineRun skill and update task discovery #8043
CNTRLPLANE-3047: add workflow to sync hypershift-community fork #8042
NO-JIRA: chore(claude): add restructure-commits plugin command #7927
CNTRLPLANE-2986: feat(ci): Add self-hosted GitHub Actions runners for HyperShift #7980
NO-JIRA: fix(ci): pass –upgrade-versions to konflux task update skill #8036
CNTRLPLANE-2998: Migrate SQS to AWS SDK v2 #8015
NO-JIRA: refactor(oadp): unify backup/restore e2e test with platform auto-detection #7971
OCPBUGS-78996: fix(test): create SQS queue dynamically in spot termination handler e2e test #8007
CNTRLPLANE-2049: fix(api): audit and improve GCP API validation rules #8003
CNTRLPLANE-2081: Migrate RAM and ARN to AWS SDK v2 #7986
OCPBUGS-78778: fix(cpo): Don’t remove HCP Ingress from routes when CapabilityRoute is disabled #8001
NO-JIRA: Disable parent ownership for api subdir #8009
NO-JIRA: fix(api): replace CEL url() validators with regex to fix CRD cost budget #8004
OCPBUGS-78544: Update base images to address multiple CVEs flagged by MSFT security scans #7983
OCPBUGS-78705: Bootstrap CVO manifests should be filtered based on feature-set annotation #7984
NO-JIRA: fix(api): extend kubeapilinter scope to all non-vendor API types #8002
NO-JIRA: build(e2e): include hypershift binary in Dockerfile.e2e #7919
CNTRLPLANE-2925: add NodePool.Status.NodesInfo for node version distribution #7917
OCPSTRAT-2336: Adjust karpenter API to OpenShift conventions #7952
OCPBUGS-78539: chore(e2e): add temporary crash toleration for dns-operator #7978
CNTRLPLANE-2172: fix(e2e): register Azure private platform e2e flags #7977
NO-JIRA: chore(owners): require api-approvers approval for api/ changes #7972
Update Kube API Linter config for new APIs #7982
NO-JIRA: add .gitattributes to collapse generated files in PR diffs #7918
CNTRLPLANE-2910: feat(cpo): add Azure workload identity webhook as KAS sidecar #7867
CNTRLPLANE-2077: refactor(cleanzones): migrate AWS SDK from v1 to v2 #7960
CNTRLPLANE-2219: feat(aws): migrate ec2 to AWS SDK v2 #7871
GCP-440: Fix GCP boot image discovery from CoreOS stream metadata #7881
NO-JIRA: fix(oadp): correct Agent platform API group in backup/restore resources #7974
OCPBUGS-78356: fix(sharedingress): coalesce HAProxy reloads to prevent reload storms #7945
CNTRLPLANE-2172: fix(operator): accept Azure as valid private-platform value #7968
NO-JIRA: Rename cilium directory to v1.15.1 #7888
OCPBUGS-70354: add serviceAccount to global-pull-secret-syncer #7439
NO-JIRA: feat(e2e): add OIDC IAM fix and NodePool validation to backup/restore #7837
CNTRLPLANE-2172: feat(install): register Azure private platform flags #7912
CNTRLPLANE-2978: Add Azure CPO override for OCP 4.20 #7955
OCPBUGS-65687: fix(cpo): prevent informer creation for inaccessible resource types #7819
GCP-441: correct CCM crash toleration key to match pod label #7926
CNTRLPLANE-2916: conditionally create openshift-ingress network policy based on route labeling #7872
NO-JIRA: chore: add .git/ to .dockerignore #7944
NO-JIRA: fix(test): add aws-node-termination-handler to safe-evict audited list #7816
NO-JIRA: test(scheduler): add pair loss recovery unit coverage #7848
OCPBUGS-67262: fix(e2e): Use NodePool replicas as authoritative source for expected node count instead of CountAvailableNodes #7378
OCPBUGS-77160: include NMStateConfig in Agent platform OADP backup resources #7847
AUTOSCALE-571: fix(karpenter): select existing private subnets for default OpenshiftEC2NodeClass #7933
OCPBUGS-78198: fix(catalogs): update catalog image version cap to 4.21 #7915
OCPBUGS-78184: fix(hostedcluster): Remove referenced resource annotations regardless of hcp status #7913
CNTRLPLANE-2203: reintroduce ControlPlaneConnectionAvailable condition with conformance fix #7746
OCPBUGS-78185: Fix deadlock when changing release image during initial provisioning #7910
CNTRLPLANE-634: Make external-dns interval and AWS zones cache duration configurable #7931
OCPBUGS-78045: allow autonode provisioned arm instances #7893
OCPBUGS-78329: fix(releaseinfo): allow periods in version display name regex #7940
OCPBUGS-78223: add NodePool Rollouts reference documentation #7923
NO-JIRA: chore(gitignore): add .claude/worktrees/ to .gitignore #7938
OCPBUGS-78189: fix(e2e): fix nil deref in validateAWSGuestResourcesDeletedFunc #7911
OCPBUGS-77514: E2E filter rolling upgrade verification to current MachineSet #7864
OCPBUGS-77703: fix(api): add omitempty to NodePoolAutoScaling.Min for N-1 compatibility #7849
GCP-411: Add comprehensive unit tests for ReconcileInfrastructure #7895
NO-JIRA: fix KubeVirtAdvancedMultinetTest IPv6 and apk errors #7860
NO-JIRA: chore(e2e): increase nodepool condition check timeout #7906
CNTRLPLANE-2789: add StatefulSet test case to controlplane-component reconcile tests #7764
NO-JIRA: Add CodeRabbit config to exclude autogenerated files #7905
CNTRLPLANE-2933: add docs recipe for SPO configuration in HCP environments #7886
CNTRLPLANE-2031: test(e2e): add comprehensive backup and restore test suite #7745
CNTRLPLANE-2588: docs: add dependabot triage agent to AI CI jobs documentation #7889
CNTRLPLANE-2793: Cache MCS TLS certificate generation in ignition provider #7841
ROSAENG-132: fix(karpenter): Set Ready condition to False when version resolution fails #7866
NO-JIRA: api: fix AutoNode types to comply with OpenShift API conventions #7859
NO-JIRA: chore(deps): weekly dependabot consolidation #7876
OCPBUGS-39604: Include shared ingress resources in render output for proper uninstall cleanup #7836
OCPBUGS-76645: Make generated container names k8s compliant #7711
OCPBUGS-77254: fix(globalps): watch Machine updates to fix node labeling race condition #7803
GCP-441: tolerate 1 restart for GCP CCM token-minter race condition #7865
NO-JIRA: chore(deps): weekly dependabot consolidation #7863
OCPBUGS-77477: fix(awsutil): handle smithy errors in AWSErrorCode #7827
SREP-3855: unpause leaked child objects on deleting clusters (OCPBUGS-77530) #7861
CNTRLPLANE-2218: feat(aws): migrate ELB/ELBV2 to AWS SDK v2 #7825
OCPBUGS-77621: fix(nodepool): preserve ignition-reached annotation on token secret after restore #7851
OCPBUGS-76337: feat(scale-from-zero): add DescribeInstanceTypes IAM permission #7648
GCP-391: Add ImageRegistry GSA field and IAM binding for Image Registry Operator #7828
CNTRLPLANE-2801: fix(router): deploy router services for private ARO and remove KAS/OAPI dependencies #7845
CNTRLPLANE-2842: Fix context cancel accumulation in getMirrorFromICSPOrIDMS #7846
CNTRLPLANE-2801: api: remove redundant kubebuilder enum marker from KeyVaultAccess field #7835
NO-JIRA: bug(metrics): fix typo in hypershift_cluster_waiting_initial_availability_duration_seconds metric #7730
CNTRLPLANE-2840: fix(endpoint-resolver): sort pods by name for deterministic ordering #7854
CNTRLPLANE-2808: bump golang.org/x dependencies in / and /api modules #7818
CNTRLPLANE-2840: feat(CPO): add endpoint-resolver control plane component #7786
CNTRLPLANE-2794: Re-add TestGetDigest and TestGetManifest with mockgen mocks #7777
OCPBUGS-77034: fix(ho): add nil guard for Platform.AWS in metrics collector #7747
GCP-295: Add GCP platform support to E2E test framework #7697
OCPBUGS-76997: remove resource limits from Agent CAPI provider #7812
OCPBUGS-60936: fix(hccp): remove immutable field from kubeletconfigmap #6726
OCPBUGS-77311: handle HostedCluster deletion in secretJanitor to prevent stuck cluster deletions #7779
OCPBUGS-60185: Remove non-deterministic registry override computation from ignition-server #7811
CNTRLPLANE-2784: Document IAM policies for PowerVS credential fields #7778
CNTRLPLANE-2801: add Key Vault private endpoint TCP relay via private router #7701
CNTRLPLANE-2217: feat(aws): migrate kms and Resource Tagging to AWS SDK v2 #7795
CNTRLPLANE-2807: Fix version showing <unknown> in git worktree builds #7814
OCPBUGS-65636: add service account to konnectivity-agent #7309
NO-JIRA: docs(pki): add CA hierarchy diagram and trust distribution details #7799
CNTRLPLANE-2799: Unit test HCP availability and Ready flag reconciliation #7796
OCPBUGS-67262: fix(sync-global-pullsecret): compare content ignoring trailing newlines #7638
GCP-386: scope externaldns RBAC to GCP platform only #7781
OCPBUGS-76350: Honor AWS AMI override in NodePool token generation #7675
OCPBUGS-60185: Fix ignition-server pod restarts due to MIRRORED_RELEASE_IMAGE flapping #7588
NO-JIRA: docs(agents): add multi-module structure guidance to AGENTS.md #7797
OCPBUGS-76452: update OAuth certificate configuration doc #7785
GCP-402: Add gcp-project and gcp-region flags to hypershift install #7710
GCP-376: Add service account for storage #7676
GCP-367: enable multizone support in CCM cloud config #7731
OCPBUGS-77224: fix(routing): add Azure platform to LabelHCPRoutes() switch #7789
CNTRLPLANE-2220: feat(aws): migrate iam to AWS SDK v2 #7765
NO-JIRA: Skip ./dev directory in codespell checks #7775
NO-JIRA: MCE 2.17 konflux pipielines #7736
NO-JIRA: chore: add powervs-reviewers to OWNERS_ALIASES and OWNERS #7782
OCPBUGS-59876: feat: implement CLI-based OIDC disaster recovery command #7210
OCPBUGS-62177: revert CRR controller changes #7784
OCPBUGS-65824: Add dynamic NodePort range validation to prevent cluster creation failures #7652
CNTRLPLANE-2740: Set unhealthyPodEvictionPolicy to AlwaysAllow on all PDBs #7721
OCPBUGS-32770: fix(kubevirt): require CAPK image to be explicitly specified #7615
OCPBUGS-62177: fix(pki): use pod container port instead of kubeconfig service port #7744
CNTRLPLANE-1987: Ensure Azure HCP CLI infra commands work correctly #7436
NO-JIRA: fix(e2e): retry guest cluster API calls in EnsureFeatureGateStatus #7723
OCPBUGS-70152: Correct route labeling logic for HCP router infratructure #7605
CNTRLPLANE-2216: feat(aws): migrate route53 to AWS SDK v2 #7726
OCPBUGS-43449: Remove UltraSSD_LRS from DiskStorageAccountType for OS Disks #7727
CNTRLPLANE-644: Unify Validate/Complete Function Signatures Across Providers #7577
OCPBUGS-65879: Fix image-overrides annotation removal propagation to HCP #7533
CNTRLPLANE-2740: Add KAS liveness readiness sidecar to OAS and OAuth API Server #7722
OCPBUGS-34662: Manage AWS EBS CSI driver metrics serving certificates via CPO #7538
OCPBUGS-73915: Use openshift golang builder for MCE builds #7735
NO-JIRA: Remove .claude/settings.json #7751
OCPBUGS-62177: Fix certificate revocation validation across all KAS pods #7405
CNTRLPLANE-2696: docs(azure): add managed Azure control plane authentication documentation #7653
NO-JIRA: test(e2e): add CloudController field to GCP ServiceAccountsEmails structs #7739
AUTOSCALE-485: bump karpenter-aws dependencies to 1.8.6 #7611
TRT-2554: Revert #7489 “CNTRLPLANE-2203: add ControlPlaneConnectionAvailable condition” #7734
GCP-367: Implement GCP Cloud Controller Manager component #7677
OCPBUGS-72596: Fix node-tuning-operator metrics port configuration #7468
CNTRLPLANE-2203: add ControlPlaneConnectionAvailable condition #7489
GCP-386: feat(gcp): enable DNS delegation for hosted cluster ingress via DNSEndpoint #7702
NO-JIRA: ci: fix bug in leader election detection #7696
GCP-308: test: verify control plane workloads have resource requests #7623
OCPBUGS-60707: Fix user-ca-bundle cleanup when additionalTrustBundle is removed #6900
CNTRLPLANE-2736: Rename review-agent-single-pr to address-review-comments #7709
CNTRLPLANE-2215: feat(aws): migrate S3 to AWS SDK v2 #7678
NO-JIRA: test(nodepool): add unit tests for scale-from-zero annotations #7688
OCPBUGS-55151: Move proxy certificate validation from metrics collector to reconcile loop #7536
CNTRLPLANE-418: Aro swift private #7613
CNTRLPLANE-2700: docs: add HCP networking requirements documentation #7654
CNTRLPLANE-2675: chore(cpo): move infrastructure reconciliation to infra package #7658
GCP-216: feat(nodepool): add GCP platform support #7631
GCP-199: add DNS management to Control Plane Operator #7639
AUTOSCALE-492: karpenter-ignition controller #7582
OCPBUGS-66966: loop over node-pool conditions updating in order #7325
SREP-715: New option to dump data plane content through the kube API server service exposed in HCP namespaces #6533
OCPBUGS-74620: test(e2e): increase default node ready timeout to 45 minutes #7629
OCPBUGS-74498: Add UserAgent telemetry to CPO Azure SDK clients #7620
OCPBUGS-74931: fix(hcco): gate image registry workaround to pre-4.20 releases #7634
NO-JIRA: docs(aws): add AWS PrivateLink architecture documentation #7645
NO-JIRA: chore(ai): Add skills for dev workflow #7636
CNTRLPLANE-2709: Update Dependabot to use conventional commits #7672
CNTRLPLANE-2703: Disable Renovate dependency updates #7657
OCPBUGS-74988: fix(test): resolve E2E flakes in global-pull-secret-syncer DaemonSet readiness checks #7627
CNTRLPLANE-2214: Migrate STS to AWS SDK v2 #7386
NO-JIRA:Docs: update documentation URL from netlify to pages.dev #7622
GCP-366: add CloudController service account for CCM #7617
NO-JIRA: ci: Improves the isLeaderElectionFailure function: #7589
NO-JIRA: Fix teardown flag timing in e2e tests #7586
CNTRLPLANE-2548: add direct Jira REST API integration to pr-report #7532
OCPSTRAT-2437: add unit test for custom HAProxy image annotation #7458
CNTRLPLANE-1708: Enable EnsureGlobalPullSecret AtLeast Version418 #7624
CNTRLPLANE-418: fix shared ingress AllowedCIDRs to use fc_src for PROXY protocol #7587
AUTOSCALE-535: default block device mappings #7583
OCPBUGS-69447: feat(updates): enable CVO metrics access with RHOBS monitoring flag #7399
GCP-198: add PSC endpoint controller for customer-side management #7603
CNTRLPLANE-2650: docs(ci): add security requirement for Jira agent issues #7626
CNTRLPLANE-2650: docs: add AI-assisted CI jobs documentation #7598
OCPBUGS-62760: Pre-pull images to avoid startup delays and flaky e2e #7382
OCPBUGS-74247: CAPI image overrides aware of registry config #7575
CNTRLPLANE-1137: Add support for external CNI provider Cilium #7423
GCP-176: feat(gcp): add WIF credentials support for control plane op… #7600
NO-JIRA: test(assets): add unit test for CAPI resources file paths #7601
CNTRLPLANE-2580: feat(claude): update /update-konflux-tasks to work without log file #7591
GCP-213: feat(platform): add Google Cloud Platform support with CAPG Deployment #7305
OCPBUGS-62944: forceful termination of instances during HCP AutoNode deletion #7281
NO-JIRA: build: bump Go version to 1.25.3 #7592
CNTRLPLANE-1388: Spot with termination handler #7567
CNTRLPLANE-1892: chore(e2ev2): fixup GCP API checks #7555
NO-JIRA: ci: update build root image to Go 1.25 #7584
CNTRLPLANE-1988: Add Azure support to product CLI for self-managed customers #7407
AUTOSCALE-373: Proper ROSA instance tagging for AutoNode #6939
OCPBUGS-63345: AWS credential metric to distinguish unknown from invalid status #7075
OCPBUGS-74336: feat(cpo): check components have rolled out before setting available #7434
NO-JIRA: chore(deps): weekly dependabot consolidation #7563
OCPBUGS-64576: fix(dump): Fix dump command failure when EC2NodeClass resource is not registered #7147
CNTRLPLANE-2559: feat(contrib): add request serving setup utility #7534
CNV-76520: ci: allow restart of kubevirt-cloud-controller-manager #7469
NO-JIRA: fix(test): shorten scale-from-zero test name to avoid IAM role length limit #7558
OTA-1833: Adopt a new FeatureSet OKD #7557
OCPBUGS-62761: chore(e2e): remove KAS check from capi pod #7485
OCPBUGS-73817: fix: add hypershift.openshift.io/nodepool-globalps-enabled label to be ignored in cluster-autoscaler deployment #7480
OCPBUGS-65885: added 1.34 required ELBv2 perms to CCM role #7339
API-1835: Scaffold dynamic informers #7477
CNTRLPLANE-2579: feat(konflux): add script to update pipeline task bundles to latest trusted versions #7553
OCPBUGS-58397: feat(KubeVirt): configure External evictionStrategy on VMs #6380
GCP-197: add GCPPrivateServiceConnect controller for managing Service Attachments for Private Service Connect #7302
NO-JIRA: fix(e2e): TestNodePoolAutoscalingScaleFromZero for 4.20 and later only #7556
CNTRLPLANE-2291: feat(claude): add fix-hypershift-repo-robot-pr command #7438
CNTRLPLANE-2568: Update Konflux Tekton tasks to latest versions #7551
NO-JIRA: test(ingress): add test for clearing LoadBalancerSourceRanges #7544
NO-JIRA: fix(claude): fix Claude Code subagents frontmatter #7550
NO-JIRA: chore(deps): bump github.com/opencontainers/selinux from 1.11.0 to 1.13.0 #7462
OCPBUGS-55399: Add NTO Service and ServiceMonitor #7355
NO-JIRA: test(autoscaling): make GPU annotation optional in scale-from-zero test #7484
OCPBUGS-73914: Update Tekton tasks to pass enterprise contract validation #7535
NO-JIRA: chore(deps): bump github.com/cloudflare/circl from 1.3.7 to 1.6.1 in /hack/tools #7463
NO-JIRA: Add karpenter approvers and reviewers #7488
NO-JIRA: chore(ho): update lower bound version checks for OCP 5 #7472
NO-JIRA: fix(docs): strip markdown links from aggregated documentation #7487
NO-JIRA: chore(deps): bump github-dependencies group with 17 updates #7455
OCPBUGS-73847: fix(cli): use /tags endpoint for all release streams to enable RC filtering #7483
OCPBUGS-67234: fix(hostedcluster): unpause CAPI cluster when deleting paused HostedCluster #7389
OCPBUGS-72258: use InfraStatus.APIPort for custom DNS kubeconfig #7470
API-1835: Scaffold OpenShiftManager controller #7445
CNTRLPLANE-1768: feat(api): add support for graceful service account signing key rotation #7324
OCPBUGS-66205: [kubevirt] Make L3 migration labeling conditional #7308
NO-JIRA: chore(deps): bump Azure SDK and misc-dependencies groups #7464
NO-JIRA: chore(tekton): update Konflux task digests to latest versions #7465
OCPBUGS-70320: enable scale-up from zero with InPlace upgrade #7427
NO-JIRA: Add review process docs to CONTRIBUTING.md #7426
CNTRLPLANE-208: Document needed Azure infrastructure #7361
NO-JIRA: fix(deps): update k8s.io/utils digest to 914a6e7 #7450
NO-JIRA: chore(deps): bump misc-dependencies group with 11 updates #7437
OCPBUGS-72411: fix(cno): use brackets only for IPv6 in server URL #7447
NO-JIRA: chore(konflux): update Tekton tasks to latest versions #7451
OCPBUGS-72397: Fix Konflux EC voilation, update deprecated base … #7442
NO-JIRA: docs(konflux): add IMAGE_RELEASE_PROCESS.md #7432
NO-JIRA: test(e2e): fix AKS e2e test flakiness #7410
CNTRLPLANE-1978: add e2e tests for DataPlaneConnectionAvailable condition #7291
AUTOSCALE-473: Add HostedCluster annotation for karpenter ec2nodeclass instanceProfile #7392
NO-JIRA: fix(awseps): cache local zone ID in non-shared VPC case #7409
OCPBUGS-66211: fix(azure): preserve defaulted values in Infrastructure status #7393
OCPBUGS-69761: fix(ingress): clear LoadBalancerSourceRanges when AllowedCIDRBlocks is removed #7425
GCP-258: Use PullAlways for :latest image tags in control plane components #7313
OCPBUGS-63698: fix(azure): remove CSI secret ownership from hypershift-operator #7157
OCPBUGS-66154: add OAuth certificate configuration doc #7351
OCPBUGS-67224: fix(Portieris): Fix Portieris by mounting emptyDir to ‘./.trust’ work dir #7368
CNTRLPLANE-1622: Enable nodepool autoscaling min zero #6975
CNTRLPLANE-2119: feat(hostedcluster): implement service account signing key rotation #6874
OCPBUGS-66325: fix: ValidAWSIdentityProvider condition not being correctly copied from HCP #7352
NO-JIRA: fix(install): skip IPAM CRDs if they already exist #7363
CNTRLPLANE-1977: Add weekly PR report generation capability #7272
OCPBUGS-68366: CVE-2025-58183 #7374
CNTRLPLANE-2123: feat: update builder images from 4.21 to 4.22 #7317
OCPBUGS-63452: Add finalizer protection to control plane workloads #7258
CNTRLPLANE-2205: feat(aws): enable shared role in e2e #7400
NO-JIRA: chore(azure): bump AKS Kubernetes version to 1.33.0 #7371
CNTRLPLANE-2206: Create tool to aggregate upstream docs into single file for NotebookLM #7367
OCPBUGS-66211: fix(vendor): bump openshift/api dependency to current master #7345
OCPBUGS-66146: Add OADP backup recovery tool for HyperShift clusters #7385
CNTRLPLANE-2221: Add CI infrastructure documentation #7369
CNTRLPLANE-2123: Fix buildah-remote-oci-ta task enterprise contract violation #7396
CNTRLPLANE-2049: Update kube-api-linter dependency #7346
NVIDIA-314: Support Node CIDR Allocation for networkType=Other Using AllocateNodesCIDRs #7278
CNTRLPLANE-2123: feat: update latest supported version from 4.21 to 4.22 #7315
CNTRLPLANE-2205: cmd/aws: fix managed role handling and auto-detect on destroy #7373
CNTRLPLANE-2123: feat: add release-4.21 branch to renovate configuration #7318
NO-JIRA: test: remove network-dependent unit tests for image metadata #7381
OCPBUGS-67233: fix(konflux): update outdated Tekton tasks to pass enterprise contract validation #7372
And 17 elided commits (e.g. from squash or rebase merges)
Full changelog

ibm-cloud-controller-manager

OCPBUGS-123142: Bump Go builder to 1.26 and protobuf to v1.36.12 #121
OCPBUGS-120700: Bump golang.org/x/net to v0.58.0 to address CVE-2026-33814 #110
OCPBUGS-83973: Upgrade grpc for CVE-2026-33186 #105
OCPCLOUD-3273: Merge https://github.com/IBM-Cloud/cloud-provider-ibm:release-1.35 (7d70282) into main #87
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-101968: Bump golang.org/x/net to v0.53.0 #169
OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #177
OCPBUGS-83974: Bump google.golang.org/grpc to v1.79.3 #147
STOR-2754: Rebase to upstream v5.2.21 for OCP 4.22 #118
OCPBUGS-77598: Updating ose-ibm-vpc-block-csi-driver-container image to be consistent with ART for 4.22 #129
OCPBUGS-77167: standardize build paths #117
OCPBUGS-69849: Updating ose-ibm-vpc-block-csi-driver-container image to be consistent with ART for 4.22 #116
Full changelog

ibm-vpc-block-csi-driver-operator

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #200
OCPBUGS-101952: Bump golang.org/x/net to v0.53.0 #192
OCPBUGS-83774: Bump google.golang.org/grpc to v1.79.3 #171
STOR-2762: Bump all deps for 4.22 #168
OCPBUGS-77624: Updating ose-ibm-vpc-block-csi-driver-operator-container image to be consistent with ART for 4.22 #167
STOR-2852: Enable snapshot tests ibm vpc block csi #160
OCPBUGS-69909: Updating ose-ibm-vpc-block-csi-driver-operator-container image to be consistent with ART for 4.22 #159
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-123142: Bump Go builder to 1.26 and protobuf to v1.36.12 #189
OCPBUGS-101965: Replace golang.org/x/net with openshift-sustaining/net #176
OCPCLOUD-3296: Merge https://github.com/kubernetes-sigs/cluster-api-provider-ibmcloud:v0.13.1 (93d5b50) into main #142
OCPBUGS-77728: Updating ose-ibmcloud-cluster-api-controllers-container image to be consistent with ART for 4.22 #151
OCPCLOUD-3322: Update to new manifests-gen #150
NO-JIRA: UPSTREAM: <carry>: Add manifests verify target #145
OCPBUGS-70027: Updating ose-ibmcloud-cluster-api-controllers-container image to be consistent with ART for 4.22 #143
Full changelog

ibmcloud-machine-controllers

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #119
OCPBUGS-96641: bump golang.org/x/net to v0.57.0 #99
OCPCLOUD-3278: Rebase to Kube 1.35 for Machine API Provider IBM #83
OCPBUGS-77729: Updating ose-ibmcloud-machine-controllers-container image to be consistent with ART for 4.22 #80
NO-JIRA: Modernize test infrastructure to align with other MAPI providers #82
OCPBUGS-71220: Bump vpc go sdk #76
OCPBUGS-70030: Updating ose-ibmcloud-machine-controllers-container image to be consistent with ART for 4.22 #74
Full changelog

insights-operator

OCPBUGS-132727: gather MaasModelRefs #1402
OCPBUGS-133465: add CVO annotations to secret gatherer RBAC- #1399 #1408
OCPBUGS-128979: multiclusterhub gatherer #1384
OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #1393
OCPBUGS-128776: add insights-runtime-extractor-scc missing fields #1394
OCPBUGS-113495: Add multicluster gatherer #1351
OCPBUGS-122009: add custom proxy field to insights config #1362
OCPBUGS-105227: secrets and configmap revisions count gathering #1339
OCPBUGS-100173: Update installer dependency to use tagged version #1332
OCPBUGS-100154: [release-4.22] Fix indentation bug on livenessProbe #1330
OCPBUGS-96642: [release-4.22] Upgrade Golang and net library #1327
OCPBUGS-98383: controlplanemachinesets gatherer #1318
OCPBUGS-98153: update HyperShift deployment manifest #1315
OCPBUGS-98381: Optimize the CPU usage of insights-runtime-extractor #1317
OCPBUGS-88026: fall back to kube-system/global-pull-secret for Insights token #1305
OCPBUGS-86818: extractor controller #1296
OCPBUGS-86013: add trusted-ca-bundle to gatherin job #1290
OCPBUGS-83976: Bump google.golang.org/grpc to v1.79.3 #1287
CCXDEV-15964: fetch TLS profiles from API server #1257
CCXDEV-15963: kubeletconfig gatherer #1247
NO-JIRA: generate gatherer docs #1256
CCXDEV-16094: add config option to disable runtime extractor #1248
CCXDEV-16006: add permission for opentelemetrycollectors #1252
OCPBUGS-78115: Fix string accessor error #1253
OCPBUGS-78115: New Gatherer for OpenTelemetryCollector CRs #1246
OCPBUGS-78251: Updating ose-insights-operator-container image to be consistent with ART for 4.22 #1249
CCXDEV-15992: obfuscation config precedence #1223
MON-4511: Migrate Prometheus targets discovering from Endpoints to EndpointSlices #1225
NO-JIRA: Add CodeRabbit inheritance for org-wide rules #1245
CCXDEV-15829: subscription gathering #1235
CCXDEV-15776: install config update #1229
CCXDEV-15641: gather machineconfig size #1240
NO-JIRA: exclude vendors file from coderabbit review #1243
NO-JIRA: Upgrade Golangci-lint to version 2 #1237
NO-JIRA: enable InsightsDataGather in all clusters #1242
NO-JIRA: add custom coderabbit config #1232
OCPBUGS-66233: Custom Obfuscation unmarshal #1216
CCXDEV-15561: Improve test coverage 3 #1213
NO-JIRA: update on-demand gathering examples #1212
OCPBUGS-65500: reference ClusterRoles in ClusterOperator #1211
CCXDEV-15778: add event logging for operator version changes #1202
CCXDEV-15589: set limit for gathering interval #1171
OCPBUGS-67001: update dataGather status after job deletion #1201
OCPBUGS-66386: [bugfix] The ConfigMap value for StoragePath is ignored on basic routine #1203
CCXDEV-15561: Improve test coverage 2 #1199
OCPBUGS-65582: set Progressing condition on cluster update #1207
CCXDEV-15258: DataGather and InsightsDataGather update to v1 #1159
OCPBUGS-66996: Extends the time for the extractor liveness probe #1198
OCPBUGS-69764: Updating ose-insights-operator-container image to be consistent with ART for 4.22 #1204
CCXDEV-15561: Improve test coverage #1191
And 3 elided commits (e.g. from squash or rebase merges)
Full changelog

insights-runtime-exporter, insights-runtime-extractor

OCPBUGS-123142: Bump Dockerfile golang builders to 1.26 #97
OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #96
Update OWNERS to remove ‘tremes’ #67
Optimize the CPU usage of insights-runtime-extractor #60
OCPBUGS-77060: Update Go to 1.25 #63
OCPBUGS-76464: remove dnf cache from the container images #62
chore: Update JBoss EAP 8.1 runtime samples #61
eap 8.1 test fix #57
Full changelog

ironic

OCPBUGS-129095, OCPBUGS-129569: Bump ironic #934
Bug OCPBUGS-112711: Telco bugfixes sep26 #915
OCPBUGS-115160: bump ironic to include fix #907
OCPBUGS-112341: Update ironic hash to include fixes related to power management error… #901
OCPBUGS-105863: update ironic pin to include CVE-2026-54423 fix (release-4.22) #889
OCPBUGS-100167: Update openstack-ironic commit hash for CVE-2026-44918 #874
OCPBUGS-88478: Update openstack-ironic commit hash in requirements.cachito that addresses CVE-2026-43003 #860
OCPBUGS-98873: Selectively backport Redfish firmware update fix to 4.22 #870
OCPBUGS-84369: selectively backport servicing patches to 4.22 #848
OKD-362: Add watchdog to python-requirements.okd #844
OCPBUGS-84651: Bump sushy #843
OCPBUGS-82540: Bump pyasn1 to 0.5.1-5 #822
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #818
METAL-1758: Merge upstream 2026 03 16 #814
METAL-1735: Add TLS cipher suite and curves related options to ironic for centralized tls support #810
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #816
METAL-1771: Remove heredoc syntax for hermetic builds compatibility #815
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #812
OCPBUGS-77528: Fix interface detection when MAC/IP matches multiple interfaces #807
METAL-1726: Multi-stage wheel-builder for OCP builds #786
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #808
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #806
METAL-1749: Uplift setuptools to remove python-wheel deps #804
METAL-1748: Drop genisoimage in favor of xorriso #803
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #805
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #801
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #799
OCPBUGS-76935: Bump keystonemiddleware version to 10.9.0-0.20260216145500.557d173 for CVE-2026-22797 fix #790
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #793
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #789
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #784
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #783
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #773
ART-14497: Fix ART builds with -minimal #779
NO-ISSUE: Bump openstacksdk version to 4.9.0 #776
OCPBUGS-74579: fix for minimal builds #772
OCPBUGS-74427: Bump eventlet version to latest bugfix #770
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #768
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #762
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #758
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #757
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #755
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #754
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #751
OCPBUGS-70001: Updating ironic-container image to be consistent with ART for 4.22 #752
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #748
OCPBUGS-65969: Set the tls cacert path to writable mount when the IRONIC_CACERT_FILE is unset #728
Full changelog

ironic-agent

OCPBUGS-99897: Bump ironic-python-agent pinned commit for CVE-2026-66138 #294
OCPBUGS-88478: Update commit SHA in requirements.cachito to address CVE-2026-43003 #266
OCPBUGS-95061: Replace individual package removal with a single rpm -e loop #282
OCPBUGS-95061: Replace dnf remove with rpm -e to prevent dependency removal #270
METAL-1749: Uplift setuptools to remove python-wheel deps #245
NO-ISSUE: Update requirements.cachito with latest ironic-python-agent #243
NO-ISSUE: Update requirements.cachito with latest ironic-python-agent #242
OCPBUGS-74579: fixes for minimal builds #240
NO-ISSUE: Update requirements.cachito with latest ironic-python-agent #238
NO-ISSUE: Update requirements.cachito with latest ironic-python-agent #237
Updating ironic-agent-container image to be consistent with ART for 4.22 #225
NO-ISSUE: Update requirements.cachito with latest ironic-python-agent #223
Full changelog

ironic-machine-os-downloader

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #124
OCPBUGS-77617: Updating ironic-rhcos-downloader-container image to be consistent with ART for 4.22 #115
OCPBUGS-71233: Export TMPDIR to be available to child processes #111
OCPBUGS-69891: Updating ironic-rhcos-downloader-container image to be consistent with ART for 4.22 #110
Full changelog

ironic-static-ip-manager

OCPBUGS-70044: Updating ironic-static-ip-manager-container image to be consistent with ART for 4.22 #56
Full changelog

keepalived-ipfailover

OCPBUGS-70034: Updating openshift-enterprise-keepalived-ipfailover-container image to be consistent with ART for 4.22 #219
OCPBUGS-99767: Reinstall tzdata if /usr/share/zoneinfo is missing #247
Updating openshift-enterprise-base-rhel9-container image to be consistent with ART for 4.22 #229
OCPBUGS-72552: Updating openshift-enterprise-base-rhel9-minimal-container image to be consistent with ART for 4.22 #220
NO-JIRA: Install gpgme for RHEL/Centos 10 #228
ART-14594: Update Dockerfile for centos 10 base #223
OCPBUGS-76286: openshift-enterprise-base: remove subscription-manager, dbus, systemd #221
OCPBUGS-67357: Updating openshift-enterprise-base-rhel9-container image to be consistent with ART for 4.22 #218
Full changelog

kube-metrics-server

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #92
NO-ISSUE: synchronize OWNERS from main branch [release-4.22] #90
NO-JIRA: disable automatic coderabbit reviews #53
OCPBUGS-77817: Updating ose-kube-metrics-server-container image to be consistent with ART for 4.22 #52
OCPBUGS-74012: Updating ose-kube-metrics-server-container image to be consistent with ART for 4.22 #49
: NO-JIRA: Bump openshift/kubernetes-metrics-server to v0.8.1 #50
NO-JIRA: Bump golang image versions #51
OCPBUGS-69952: Updating ose-kube-metrics-server-container image to be consistent with ART for 4.22 #48
Full changelog

kube-rbac-proxy

OCPBUGS-129260: Address CVE-2026-84304 #177
OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #183
OCPBUGS-127951: Bump golang.org/x/net from v0.52.0 to v0.58.0 to resolve CVE-2026-39821 (release-4.22) #165
CNTRLPLANE-2932: Merge upstream v0.21.1 #133
OCPBUGS-69716: Updating kube-rbac-proxy-container image to be consistent with ART for 4.22 #129
CNTRLPLANE-882: 0.20.2 downstream #131
Full changelog

kube-state-metrics

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #201
OCPBUGS-127378: backport kube-state-metrics 2.18 memory leak fix #157
OCPBUGS-101958: Bump golang.org/x/net to v0.53.0 #168
NO-ISSUE: synchronize OWNERS from main branch [release-4.22] #187
OCPBUGS-87957: embed timezone data in kube-state-metrics binary #150
OCPBUGS-87957: fix: don’t panic on CronJobs with unparseable schedules #147
OCPBUGS-86653: [Backport] Handle DeletedFinalStateUnknown panic #142
NO-JIRA: disable automatic coderabbit reviews #135
OCPBUGS-77616: Updating kube-state-metrics-container image to be consistent with ART for 4.22 #134
OCPBUGS-73993: Updating kube-state-metrics-container image to be consistent with ART for 4.22 #129
OCPBUGS-71224: [bot] Bump openshift/kube-state-metrics to v2.18.0 #130
Updating kube-state-metrics-container image to be consistent with ART for 4.22 #126
Full changelog

kube-storage-version-migrator

OCPBUGS-101988: Bump golang.org/x/net to v0.55.0 to address CVE-2026-33814 #269
OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #268
OCPBUGS-77815: Updating ose-kube-storage-version-migrator-container image to be consistent with ART for 4.22 #240
OCPBUGS-123142: Update build-machinery-go vendor dependency #261
OCPBUGS-65984: add leader election #237
OCPBUGS-73955: Updating ose-kube-storage-version-migrator-container image to be consistent with ART for 4.22 #236
OCPBUGS-69726: Updating ose-kube-storage-version-migrator-container image to be consistent with ART for 4.22 #235
Full changelog

kubevirt-cloud-controller-manager

OCPBUGS-101978: Bump golang.org/x/net to v0.53.0 #98
OCPBUGS-123142: Bump Go builder to 1.26 and protobuf to v1.36.12 #100
OCPBUGS-69842: Updating ose-kubevirt-cloud-controller-manager-container image to be consistent with ART for 4.22 #59
NO-JIRA: Upstream Sync - 2026-01-27 #60
Full changelog

kubevirt-csi-driver

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #122
OCPBUGS-69717: Updating ose-kubevirt-csi-driver-container image to be consistent with ART for 4.22 #77
OCPBUGS-83883: Bump google.golang.org/grpc to v1.79.3 #107
CNV-82343: Add annotation-based fallback for infra VM node ID resolution (#170) #80
Full changelog

machine-api-operator

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #1584
OCPBUGS-130351: fix race in VAP MachineSet e2e test cleanup #1577
OCPBUGS-129423: Reduce vCenter API load in the vSphere machine controller #1574
OCPBUGS-126916: Add opt-in kube-rbac-proxy sidecar for pprof endpoint (AWS) #1558
SPLAT-2865: Added multi vCenter Day 2 Support #1531
OCPBUGS-101989: Bump golang.org/x/net from v0.49.0 to v0.53.0 #1541
OCPBUGS-115165: CORS-4521: GCP: Add regional permission #1538
OCPBUGS-85102: Populate status label selector for scale subresource #1497
OCPCLOUD-3346: tls: use centralized TLS #1456
MON-4497: metrics: migrate Prometheus SD from Endpoints to EndpointSlices #1457
SPLAT-2680: Changed DHA to require hostAffinity=host #1484
OCPCLOUD-3282, OCPCLOUD-3288: Bump to k8s 1.35 dependencies #1474
NO-JIRA: fix flaky TestReconcile/machine_with_node_likely_to_go_unhealthy#1483 #1483
SPLAT-2680: Fixed MAO to not allow dedicated host configurations for control plane nodes #1477
OCPBUGS-77941: Remove cluster-api-provider-libvirt references #1472
OCPNODE-4168: Add image only if its a boot disk #1471
OCPBUGS-44332: Suppress degraded reporting while MAO is actively upgrading. #1464
OCPBUGS-77606: Updating ose-machine-api-operator-container image to be consistent with ART for 4.22 #1468
SPLAT-2615: Added AWS dynamic dedicated host support #1455
OCPCLOUD-3166: Bump openshift/api #1453
OKD-259: Vendor API and add OKD featureset Specific CRDs #1448
SPLAT-2603: Updated AWS dedicated host id validation pattern #1451
OCPBUGS-64937: vsphere - Cache REST API sessions to prevent excessive vCenter logouts #1432
OCPCLOUD-3222: Adds agents.md #1449
OCPBUGS-69862: Updating ose-machine-api-operator-container image to be consistent with ART for 4.22 #1450
Full changelog

machine-config-operator

OCPBUGS-132160: reduce memory usage in MCC and MCD #6662
OCPBUGS-133703: stabilize test 66436 - disable weak SSH cipher suites #6684
[4.22 cherry-pick] OCPBUGS-132190: Handle restrictive image policies during layered OS updates #6677
OCPBUGS-132857: only enable signed policy when testing… #6674
OCPBUGS-128499: [release-4.22] Split wait-for-ipsec-connect into two services to avoid ipsec restart #6441
OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #6656
OCPBUGS-129432: logout vCenter clients after use #6636
OCPBUGS-128838: Run nmstatectl format in nmstate-configuration #6614
OCPBUGS-129268: Boot image controller skips MachineSets that don’t match any failure domain #6627
OCPBUGS-129375: Fix layered OS updates on older nodes whose host skopeo cannot process multi-architecture signatures #6617
OCPBUGS-128961: Filter cosign signature tags from the IRI release lookup #6620
OCPBUGS-127016: disable bootimages update in TC-52373 proxy test #6600
OCPBUGS-128622: Add fix TC 63866 failing in CI job #6601
OCPBUGS-123173: remove nft chains before checking the ignition config #6541
OCPBUGS-119240: drop GCD health-check ranges in openshift-gcp-routes #6564
OCPBUGS-101987: Fix CVE-2026-33814 by adding patch for golang.org/x/net package #6503
OCPBUGS-127018: Correctly handle MC deletion in image mode when no new build is required #6567
OCPBUGS-127016: Fix IsBootImageUpdateSupported to include vSphere and Azure platforms #6565
OCPBUGS-125661: Replace wildcard permissions with explicit verbs in MachineConfigServer ClusterRole #6551
OCPBUGS-122130: Retry on conflict in syncMachineConfigNodes #6521
OCPBUGS-126739: improve JSON unmarshalling for secret decoding #6561
OCPBUGS-126637: Mount /etc/container in mosb #6557
OCPBUGS-122239: [TNF] Add infinite retry on untaint systemd unit #6554
OCPBUGS-122961: updateLayeredOS deploy-from-self when skopeo < 1.22.2 #6538
OCPBUGS-122279: limit ContainerRuntimeConfig status condition to 3 #6531
OCPBUGS-121849: Fix vsphere network absolute paths #6512
OCPBUGS-120671: Skip vsphere fd-unmatched machinesets for bootimage updates #6494
OCPBUGS-119936: Increase TC-74751 Eventually timeout for vSphere OVA upload #6492
OCPBUGS-115401: Update message for MachineOSBuildFailed condition #6479
OCPBUGS-116943: Update AMI Whitelist #6489
OCPBUGS-112785: Revert TNF Graceful node shutdown #6461
OCPBUGS-114418: [release-4.22] OCPBUGS-113615: Azure confidential clusters should be flagged by skew enforcement #6459
OCPBUGS-114392: Use kubernetes scheme in drain controller event recorder #6458
AGENT-1583: post-feature promotion (NoRegistryClusterInstall) openshift/api dependencies bump #6418
OCPBUGS-112618: Fix upstreams for CoreDNS pods on Cloud platforms #6438
OCPBUGS-112614: OCPBUGS-109739: Increase rpm-ostree rebase retry backoff and preserve error #6436
OCPBUGS-105521: Fix SHA idempotency test in nmstate-configuration.sh #6392
OCPBUGS-105929: Fix duplicate template error and e2es #6397
Fixes OCPBUGS-105190: increase LRU cache and prefetch timeout for PinnedImageSet #6372
OCPBUGS-105447: fix nil pointer panic in IRI controller informer race #6390
OCPBUGS-105212: [release-4.22] Part2 Migrate OCB test-case #6374
OCPBUGS-105213: Update AMI Whitelist #6375
OCPBUGS-104563: Use providerSpec.Template in vSphere machineset reconciliation #6370
OCPBUGS-100583: [release-4.22] Part 1 Migrate OCB test cases from openshift-tests-private #6361
OCPBUGS-104576: [release-4.22] Add extension verification failure test cases OCP-89090 and OCP-89095 #6367
OCPBUGS-104451: [release-4.22] fix fencing_validator ocdebug fence dispatch race condition #6360
OCPBUGS-100293: Fix TC 43278 failing when release payload has no MCO commit info #6351
AGENT-1548: Backport NoRegistryClusterInstall feature to release-4.22 #6323
OCPBUGS-99712: Add TC 88940- Apply password only if changes exist #6339
OCPBUGS-98962: [release4.22] MCO-1997: MCO-2297: MCO-2440 Add osImagestream test-cases #6301
OCPBUGS-93804: move cleanUpDuplicatedMC to avoid double reboot on first updated Master node #6240
OCPBUGS-97904: Inject proxy into MCC deployment #6275
OCPBUGS-96145: Update AMI Whitelist #6260
OCPBUGS-89329: Fix kubelet certificate wait loop in criometricsproxy.yaml #6200
OCPBUGS-93743: Fix bootupd workaround in old nodes #6239
OCPBUGS-92026: OCPEDGE-2474: TNF - Add fencing taint/untaint alert agent scripts #6230
OCPBUGS-92022: MCO-2275: Migrate OS layering tests from openshift-tests-private #6218
[release:4.22] OCPBUGS-88330: MCO-2209 MCO-2213 MCO-2207: Migrate security, daemon, and kernel TCs from mco.go #6171
OCPBUGS-91958: Boot image skew check silently passes when MachineSets are reconcile-skipped #6227
OCPBUGS-91954: Make vsphere template updates atomic #6226
OCPBUGS-88184: Replace wildcard permissions with explicit verbs and resources in MCC ClusterRole #6170
OCPBUGS-88683: Process rebuild annotation on machine-os-builder restart #6190
OCPBUGS-87981: Fix MCP.status.osImageStream #6164
OCPBUGS-88496: Update custom containerfile OCB test to work in a disconnected environment #6188
OCPBUGS-88001: Add mco_extensions.go e2e test suite for MCO extension install, enable, and validation #6184
OCPBUGS-88329: In OCB to check when a image is removed the old build is triggered again and the MC should start updating directly and no new MOSB should be triggred #6175
OCPBUGS-87019: fix: update arbiter crio config #6142
OCPBUGS-88487: make test 69755 more stable #6186
OCPBUGS-88331: [release-4.22] Remove skopeo-install script #6176
OCPBUGS-84679: add RootCA cert to the sysContextBuilder certs #5897
OCPBUGS-87840: vSphere boot image hot loop detection is non-functional due to stable template names #6157
OCPBUGS-87900: [release-4.22] OCPBUGS-87181: MCO-2211: MCO-2210: MCO-2234 MCO-Migrate MCO tests from openshift-tests-private #6148
OCPBUGS-88114: Skip chrony-wait on first node join #6168
OCPBUGS-88120: daemon: don’t pull/extract extensions for all OS updates #6169
OCPBUGS-87811: [release-4.22] OCPBUGS-87550: Update TC-88366 to check osImageStream status after update completes #6153
OCPBUGS-87161: [release-4.22] OCPBUGS-87027: MCO-2212: MCO-2213: Migrate mco_observability and mco_daemon test-suite #6143
OCPBUGS-86865: Stabilize ocl 4.22 #6115
OCPBUGS-86985: MCO-2297: Add OCP-88366 and OCP-88814 for osImageStream with osImageURL #6083
OCPBUGS-87163: Remove trailing newline (\n) characters in klog message strings #6147
OCPBUGS-86893: Add version guard for OSStream rendering #6123
OCPBUGS-86997: [release-4.22] OCPBUGS-86984: MCO-2273: MCO-2215: MCO-2183: Migrate remaining TCs from mco.go to MCO, units, kublet suite #6126
OCPBUGS-86297: configure-ovs: copy lldp mode to br-ex port #6073
OCPBUGS-86870: Update AMI Whitelist #6116
OCPBUGS-86732: remove tests using base images older than 4.13 #6104
OCPBUGS-86769: Adapt test ‘54922 - daemon: add check before updating kernel #6103
MCO-2233: Migrate Kernel related MCO test-cases #5860
OCPBUGS-86262: Verify extension packages are installed #6071
OCPBUGS-85127: Fix wrong early exit during kubelet MCs regeneration #6009
OCPBUGS-86267: Fix CVE-2026-33186 #6072
OCPBUGS-85341: Apply password only if changes exist #6053
OCPBUGS-86047: Manually uncordoned nodes are not automatically re-cordoned #6060
OCPBUGS-85124: use --delete-if-present for karg removal #6007
OCPBUGS-85626: only check password hash in /etc/shadow #6042
OCPBUGS-85651: BareMetal skew e2e fails patching provisioning CR after CBO webhook fix #6047
OCPBUGS-85198: Add terminationMessagePolicy to build pod containers #6012
OCPBUGS-85481: Add fix for ossImagestream status #6026
OCPBUGS-84813: Include RootCA in the temporal CC #5904
OCPBUGS-84406: Fix CVE-2026-34986 #5986
OCPBUGS-85156: Bootloader update attempt should be conditional #6011
OCPBUGS-84693: prom rules: add alert for nodes using runc #5998
OCPBUGS-84667: Fix encapsulated IGN version #5895
OCPBUGS-84480: Fix units rollback if update failure #5882
OCPBUGS-84949: Fix OCL test to handle temporarily empty current-machine-os-build annotation #5989
OCPBUGS-84840: Fix ssh and password rollbacks #5906
OCPBUGS-84865: MachineOSConfig “build was not found” error #5912
OCPBUGS-83779: Auto-append :ref suffix to additionalLayerStores in storage.conf #5903
OCPBUGS-84861: Update AMI Whitelist #5911
OCPBUGS-84850: Custom pool booting must handle matchExpressions in nodeSelector #5909
OCPBUGS-84849: Support bootloader update #5908
OCPBUGS-84719: deploy-from-self when skopeo < 1.22.2 #5901
OCPBUGS-84700: Bump image build timeout for status reporting test #5900
OCPBUGS-83818: ClusterHostedDNS on AWS/Azure/GCP: Modify Corefile template to better handle empty record types #5862
OCPBUGS-83771: Make IRI registry read-only via environment variable #5859
OCPBUGS-83577: Allow enablement of systemd units with existing files #5855
OCPBUGS-83559: Update AMI Whitelist #5853
OCPBUGS-83540: order corosync after OVS configuration on TNF clusters] #5852
Revert “OCPBUGS-69936: ovs: increase CPU priority for Open vSwitch Forwarding Unit” #5850
MCO-2135: Add test for OSStream labeling of Machines, MachineSets, and ControlPaneMachineSets #5814
AGENT-1307: add MCD IRI manager #5807
MCO-2202: separate duplicate PinnedImageSet validation into OCP-88562 #5839
MCO-2163: adds machine-config-osimagestream installer helper #5770
OCPBUGS-69936: ovs: increase CPU priority for Open vSwitch Forwarding Unit #5797
MCO-1972: Removes OSImageURLConfig from the build controller #5424
Reapply “MCO-2120: Rework OS Image Stream label classification” #5767
OCPBUGS-68336: When adding new nodes, MCD executes commands after setting the nodes’ state as Done #5832
AGENT-1416: Add default NodeDisruptionPolicy for IRI #5683
NO-ISSUE: Fix order of cleanup to further avoid race #5826
MCO-2183: migrated configdrift, kubeletconfig, containerruntimeconfig… #5818
OCPBUGS-78154: Use HA leader election defaults for MCO on SNO #5764
OCPBUGS-78498: Update skew error message with doc links #5825
MCO-2168: Deleting a PinnedImageSet does not affect images pinned by another PinnedImageSet #5786
NO-ISSUE: In extended tests, disable Skew when disabling the bootimag… #5811
MCO-2171: Move long running boot image tests to MCO’s disruptive suites #5808
NO-ISSUE: Fix MCN Applied condition checks for TP and non-TP clusters #5796
OCPBUGS-80970: MCS fallback to latest v3 #5816
AGENT-1366: Report InternalReleaseImageController errors in IRI status #5803
OCPBUGS-62619: Add etcd size limit validation for rendered MachineConfigs #5729
MCO-2155: Add stream detection to some more boot image tests #5799
MCO-2167: Migrate alert test cases from the private repository #5781
OCPBUGS-78500: Skew enforcement should dynamically handle baremetal clusters #5768
OCPBUGS-79088: OCPBUGS-79357: Skip boot image updates until cluster is stable #5789
OCPBUGS-79361: Update AMI Whitelist #5788
NO-ISSUE: Update AMI collection script for installer changes #5790
OCPBUGS-75200: set default-timeout-stop to 200s globally #5782
MCO-2155: Add stream detection to boot image tests #5784
NO-ISSUE: Revert “extract oc binary from base OS image after build” #5785
OCPBUGS-66104: Fine tune CoreDNS pod configuration to improve performance #5695
MCO-2117: Allow default OSImageStream overrides #5714
OCPBUGS-78595: Fix log substring matching for disruptive test suite jobs #5769
OCPBUGS-74223: Re-order logger setting to eliminate race condition #5691
MCO-2146: do not use OSImageStream in Hypershift #5750
NO-ISSUE: always build golangci-lint from vendor #5772
OCPNODE-3201: Default Enablement of system-reserved-compressible in OpenShift #5408
OCPNODE-3880: Add criocredentialproviderconfig event handler #5487
OCPNODE-4074: Add additional storage configuration support for CRI-O #5666
NO-ISSUE: Increase timeout + interval for OCL test cleanup #5732
MCO-2151: Add stream detection to the boot image controller #5752
NO-ISSUE: Allow setting kubeletconfig log level to zero #5757
OCPBUGS-57473: extract oc binary instead of pulling OS image #5313
OCPBUGS-78107: Disable sandboxed-containers in arm64 10 #5754
MCO-2007: MCO-2096: MCO-2095: MCO-2011: Update MCO dependencies to Kubernetes 1.35 #5603
NO-ISSUE: remove boot image e2es from mco suite #5760
OCPNODE-4049: Revert “OCPNODE-3173: Disable OCI artifact mount by default.” #5687
OCPBUGS-74513: OCPBUGS-74519: Remove MachineConfigNodes and PinnedImages feature gates #5609
OCPBUGS-75869: kubelet: Less aggressive low memory reservation #5716
MCO-2136: Implement osImageStream inheritance for custom MCPs #5697
OCPBUGS-77839: Fix node degrades due to file and OS update failures #5744
MCO-2147: Remove all remaining hardcoded references for TLS configuration #5747
MCO-2145: Disable skew enforcement on SNO clusters #5739
MCO-2138: migrate multi-stream test cases from the private tests repo… #5701
OCPBUGS-77625: Update ose-machine-config-operator-container image to be consistent with ART for 4.22 #5730
OCPBUGS-77803: Update AMI Whitelist #5740
MCO-2025: Add functionality to populate OSImageStream value in MCP status #5689
AGENT-1424: Fix e2e iri tests #5717
OCPBUGS-77498: Fix failure domain matching during vsphere boot image updates #5723
MCO-2141: dont execute tls tests until OCPBUGS-76990 is fixed #5713
OCPBUGS-74514: OCPBUGS-74515: OCPBUGS-74516: OCPBUGS-74517: remove bootimage update feature gates #5718
OCPBUGS-77483: Update AMI Whitelist #5719
CORENET-6738: Remove lingering references to openshift-sdn #5591
NO-ISSUE: Increate timeout for sharded ocl test #5696
OCPBUGS-77318: Clean up vsphere login error logging #5702
NO-ISSUE: Revert “MCO-2120: Rework OS Image Stream label classification” #5703
MCO-2124, MCO-2125: migrate units and storage test cases #5660
NO-ISSUE: Create timeout per resource to clean up #5676
MCO-1870: Split MachineConfigNodeUpdateFilesAndOS condition into MachineConfigNodeUpdateOS and MachineConfigNodeUpdateFiles #5411
MCO-1803: Add test case: CPMS interaction with automatic skew #5661
MCO-2032: Avoid MCPs duplication at install time #5518
MCO-2131: Break e2e-ocl test suite into 2 #5669
MCO-2120: Rework OS Image Stream label classification #5650
OCPBUGS-24003: mcd_config_drift not working properly #5632
MCO-2035: Add a prometheus alert to indicate scaling risk #5615
MCO-2036: Enable boot image updates by default for vsphere and Azure #5583
OCPNODE-3880: bump openshift/client-go #5663
OCPBUGS-76444: pkg/daemon/update: Remove kernel-rt-kvm #5654
MCO-2110: Migrate security tests #5621
OCPNODE-3880: Bump openshift/api #5655
OCPBUGS-23418: Machine-config controller should not log about non-existent pull-secret changes #5625
OCPBUGS-76450: reduce MCO image size #5644
NO-ISSUE: Fix cleanup verification timeouts in e2e-ocl tests #5652
OCPBUGS-74692: Write all units when forcefile exists to recover from systemd unit config drift #5612
OCPBUGS-63699: Remove MCD liveness probe #5623
MCO-1984: Add Component Readiness tests for boot image skew enforcement #5547
TRT-2543: Revert #5586 “MCO-2065: Move systemctl execs to dbus calls” #5638
OCPBUGS-75916: crio: disable short_name_mode until we introduce ctrcfg api for it #5628
NO-ISSUE: Make TestImagePrunerErrors flexible to registry behavior changes #5613
OCPEDGE-2216: feat: increase reserved memory for tnf masters #5592
MCO-2065: Move systemctl execs to dbus calls #5586
NO-ISSUE: Fix-up AMI update script to work from CI image #5626
NO-ISSUE: Update AMI script and list #5616
MCO-1877: MCO-1879: MCO-1882: MCO-1884: Implement boot image skew enforcement MVP #5428
MCO-1924: MCO-500: Migrate direct runGetOut() to use CommandRunner in the MCD #5546
NO-JIRA: Fix OSImageStream validating admission policies for OKD #5618
MCO-1953: Refactor functionality to grab machines by state for calculating MCP status #5541
OCPBUGS-20561: machine-config-daemon: openshift: Exposure of Sensitive Data in Log Files in the Machine Configuration Daemon. [openshift-4] #5601
MCO-2090: migrate nodedisruptionpolicy tests from the private reposit… #5602
NO-JIRA: Pass TAGS argument to the machine-config-controller image build #5611
AGENT-1395: IRI followup changes #5562
AGENT-1424: Add e2e test for IRI deletion #5608
MCO-2088: Remove wasm extension #5598
OCPBUGS-72555: Restrict CPMS boot image configuration to only AWS, GCP and Azure platforms #5540
NO-ISSUE: Add bootstrap e2e guide #5604
NO-ISSUE: CPMS test should account for skew API #5599
OCPBUGS-74368: Stale operator metrics Service and ServiceMonitor resources need to be deleted #5593
MCO-2059: migrate machineconfignodes from private repo #5589
OCPBUGS-58023: Prevent unnecessary systemd unit disable #5582
NO-ISSUE: Fix e2e ocl intermittent failures #5595
MCO-1182: migrate private test case OCP-87023 #5587
AGENT-1424: add initial e2e tests for the InternalReleaseImage controller #5588
AGENT-1412: Prevent deletion of InternalReleaseImage when in use #5545
OCPBUGS-71238: Consider image mirrors for OSImageStream fetching #5560
NO-ISSUE: Fix Failure Status condition to True when kubeletconfig or container runtime config validation fails #5542
OCPBUGS-62295: Shorten HAProxy timeouts #5312
MCO-2055: migrate bootimages tests #5551
Revert “OCPBUGS-58023: Prevent unnecessary systemd unit disable” #5576
OCPBUGS-73802: Fix up bootstrap-e2e #5563
MCO-2028: Add target OS version detection #5556
NO-JIRA: bump openshift/client-go #5500
NO-ISSUE: Fixes the issue in the test TestKubeletConfigMaxPods when AutoNodeSizing is enabled by default #5555
OCPBUGS-72396: use D-Bus API to list systemd units #5537
OCPBUGS-56717: enable nodeip-configuration for platform external #5475
CORS-4208: set default KUBELET_NODE_IPS for dualstack nodes #5384
OCPBUGS-72553: CPMS boot image config should not override standard MachineSet configuration #5539
OCPBUGS-67229: Set NodeDegraded MCN condition when node state annotation is set to Degraded #5509
OCPBUGS-58023: Prevent unnecessary systemd unit disable #5527
AGENT-1411: fix IRI registry setup file #5543
OCPBUGS-71189: Configure proxy from ControllerConfig #5538
MCO-2047: migrate scale tests from private repository to MCO repository #5533
MCO-650: Implement custom pool booting #5361
MCO-2049: Validate MCP osImageStream reference #5535
NO-ISSUE: Add README for MCO Operator disruptive e2e tests #5522
MCO-2037: Fix timeout during configMap cleanup #5529
AGENT-1411: Preload the registry image when starting the iri-service #5514
NO-JIRA: kubelet: drop pod-infra-container-image usage #5460
OCPBUGS-70259: Enable existing units without content #5520
MCO-2018: Move operator metrics into the controller #5498
MCO-2033: Refactor bootstrap dependency handling #5519
OCPNODE-3973: Default CPU/Memory changes to Workers - AutoSizingReserved #5491
OCPBUGS-69910: Bump OpenShift builder images to 4.22 #5512
OCPBUGS-69674: Skip boot image updates if arch annotation is not found #5508
MCO-1961: Integrate OSImageStream into MCP and sync logic #5476
MCO-2006: Migrate pinned images sets private test cases #5466
OCPBUGS-66209: clusteroperator/machine-config blips Degraded=True in CI jobs #5465
MCO-2015: Use an event based queue in the boot image controller #5479
MCO-1016: Only update when there is an actual controller change #4742
MCO-1961: Rework MC’s OSImageURL merge logic #5488
OCPBUGS-62984: MCP is not correctly degraded when a pivotError happens #5492
OCPBUGS-62828: MCO degraded when an empty pull-secret is configured #5486
AGENT-1391: Use TLS cert for the InternalReleaseImage registry #5483
OCPBUGS-66420: Revert “Default Enablement of Auto Sizing Reserved in OpenShift 4.21” #5489
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

machine-image-customization-controller

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #200
OCPBUGS-101953: Bump golang.org/x/net to v0.53.0 #196
METAL-1720: Add kernel file support for multi-architecture PXE boot #170
OCPBUGS-77840: Return error when network data Secret lacks nmstate key #169
OCPBUGS-77737: Updating ose-image-customization-controller-container image to be consistent with ART for 4.22 #167
OCPBUGS-76461: Clean up dnf cache to reduce container image size #162
OCPBUGS-22175: Add IPA messages for console and SSH login #158
NO-ISSUE: Add AGENTS.md and CLAUDE.md #156
OCPBUGS-70040: Updating ose-image-customization-controller-container image to be consistent with ART for 4.22 #155
Full changelog

machine-os-images

OCPBUGS-87872: Add support for hermetic builds via Cachi2 prefetched CoreOS ISOs #96
OCPBUGS-85477: Force rebuild for OCP 4.22 #88
METAL-1729: Add dual CoreOS version support for RHCOS 9 and 10 #81
OKD-322: Swap uname -p to uname -m #80
METAL-1720: Add aarch64 symlinks for initramfs #79
NO-ISSUE: Run fetch_image with tracing #68
OCPBUGS-69857: Updating ose-machine-os-images-container image to be consistent with ART for 4.22 #76
NO-ISSUE: Add AGENTS.md file #75
Full changelog

metallb-frr

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #143
OCPBUGS-86568: Generate fallback BGP router-id on IPv6-only nodes #133
OCPBUGS-84960: [release-4.22]: Bump to frr10 #130
OCPBUGS-69901: Updating ose-frr-container image to be consistent with ART for 4.22 #116
CNF-20883: Downstream merge 2025-12-30 #118
Full changelog

monitoring-plugin

OCPBUGS-132931: fix metrics series color squares #1386
OU-1589: [release-4.22] sanitize linkified URLs in alert annotations #1382
OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #1362
OU-1392: [release-4.22] fix: parse datetime ranges from the specified format rather than browser specific apis #1349
OCPBUGS-129632: [release-4.22] escape regex variable values in regex matcher contexts #1340
OU-1528: [release-4.22] Optimize namespace changes in Alerts #1312
OCPBUGS-118239: Bump fast-uri to fix CVE-2026-84292 #1329
NO-JIRA: [release-4.22] Sanitize alert runbook URLs #1295
OCPBUGS-101991: CVE-2026-33814 openshift4/ose-monitoring-plugin-rhel9: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [openshift-4.22] #1202
OLS-3921: disable button shrink #1189
OCPBUGS-98787: replace outdated react-linkify dependency #1150
OCPBUGS-98787: replace outdated react-linkify dependency #1145
OCPBUGS-98432: fix for CVE-2026-59869 #1114
OU-1240: Makefile and package.json to enable test-frontend-ci #1094
OCPBUGS-99032: Fix CVE-2026-49978 - bump DOMPurify to >= 3.4.7 #1085
OCPBUGS-99234: graph redirect query parameter #1070
OU-651: Fix AlertRules page to display user defined loki alerts #1057
Fix for OCPBUGS-89698: CVE-2026-12143 #1053
Fix for OCPBUGS-91628: CVE-2026-45736 #1023
NO-JIRA: fix unit test severitySort and incidents #1036
Fix for OCPBUGS-94005: CVE-2026-13676 #1028
OU-1396: [release-4.22] fix: use replace to set variables to avoid navigation trap #1019
OCPBUGS-87979: [release-4.22] fast-uri: URI authority bypass due to improper delimiter handling #989
OCPBUGS-88413: [release-4.22] Fix CVE-2026-44494: bump axios to ^1.16.0 via overrides #997
OU-1360: reset queries when namespace changes in dev perspective #934
OU-1366: prevent namespace and project desync #935
OCPBUGS-85088: Sync Main to 4.22 #916
OU-1307: [release-4.22] don’t fight console to setActiveNamespace #881
NO-JIRA: re-enable get CSRF token #876
OU-1264: mcpToolUI basic implementation for OpenShift Lightpseed + obs-mcp + Perses #797
NO-JIRA: breaking changes follow up #875
OU-1175: OCP 4.22 Breaking Changes #863
OCPBUGS-81567: fix: re encode params when redirecting from graph to query-browser #869
OU-1184: lint enabled against cypress files and changes post coo #862
NO-JIRA: automation testing fix on podImage #868
NO-JIRA: exclude @xfail tests from CI incident commands #865
OBSINTA-1002: consolidate COO 1.4.0 test case documentation #793
NO-JIRA: podImage fix automation testing to remove extra click #864
OBSINTA-993: Tests for incident detection coo 1.4.0 changes #857
OCPBUGS-77113: feat: re enable dev console views #831
NO-JIRA: Incident Detection Tests Stabilization #854
NO-JIRA: switch to core platform page before test case run #837
NO-JIRA: Refactor cypress setup and operator commands #788
NO-JIRA: Add test configuration scenarios overview #745
NO-JIRA: add golangci-lint #835
OCPBUGS-78369: fix for CVE-2025-69873 #834
NO-JIRA: Add CodeRabbit inheritance for org-wide rules #822
OU-1247: Followup Persist TimeRange in Main #827
OU-1242: dont autofill rename #820
COO-1562: fix coo namespace issue #804
OCPBUGS-77718: Updating monitoring-plugin-container image to be consistent with ART for 4.22 #803
NO-JIRA: simplify dockerfile by removing cachito dependencies #799
OU-1162: perses automation testing - import dashboard and rbac #794
OU-1236: Kebab icon should be disable while “Checking permissions” is happening #783
NO-JIRA: fix radius of button groups #784
OU-1234: perses automation testing - rbac users scenarios added with project selector #781
OU-1139: feat: allow to import and migrate a dashboard #779
OU-1214: [Edit Dashboard] - Time range is not persisted when saving #778
OU-1195: List OCP namespaces in Create Dashboard ProjectSelector #765
OU-1231: customizable dashboards automation testing fixes after merge to main #771
NO-JIRA: Init Coderabbit config #770
OU-1189: automation for kebab management actions for perses dashboards #757
COO-1562: update acm alerting UI test case #753
OBSINTA-1063: Add incidents e2e command #740
OU-1213: IncidentPage add error state #750
OU-1062: feat: mark alert menu active for incidents tab #754
OU-1205: feat: force rounded dates for consecutive intervals #748
OU-915: create dashboards and rbac #746
OU-1039: add info alert to the Incident page #741
NO-JIRA: fix: update vulnerable dependencies #742
COO-1515: add the cluster-health-analyzer feature #736
OCPBUGS-72604: remove top level dispatch into useEffect #730
NO-JIRA: monitoring testing - metrics - ungraphable for periodics #731
OU-1134: edit perses dashboards automation testing #712
OU-1122: reuse existing handler to set alerts table data #690
NO-JIRA: fix: remove unnecessary package.lock #728
OCPBUGS-70014: Updating monitoring-plugin-container image to be consistent with ART for 4.22 #708
OBSINTA-1062: custom cluster-health-analyzer builds #720
NO-JIRA: metrics automation failing only in periodics - fix click and type timespan #725
NO-JIRA: fix esbuild optional dependencies for cross arch builds #721
OCPBUGS-70314: fix: update qs vulnerable dependency #715
NO-JIRA: metrics automation testing for presubmit and periodic #716
NO-JIRA: feat: use esbuild-loader, add push manifest command to makefile #713
OU-1064: list perses dashboards automation testing #711
NO-JIRA: monitoring automation fixing Core platform change #709
OU-632: Split ALERTS query_range into several requests for Incidents #678
OU-1082: claude slash commands cypress-setup and cypress-run #673
OU-1074: feat: add backport claude command #691
OU-1088: remove random multiplication #696
OU-1073: chore: add contributing guide #694
NO-JIRA: automation - dev user scenarios fixes with namespace level changes #692
OBSINTA-853: Cypress Incidents Remove Flaky Tag #688
OU-1081: allow claude-code to build-images #686
OU-1123: alerts chart in Incidents - set the container height same as char… #689
OBSINTA-858: [Incidents] Commands for AI-Assisted Development of Cypress Tests #621
OBSINTA-853: Incident tests CI: Incorrect MP namespace + Race Condition in Closing Guide Tour #679
OCPBUGS-68373: fix: upgrade node-forge vulnerable dependency #681
NO-ISSUE: expose argument’s default values #665
NO-JIRA: automation monitoring testing stabilization flaky scenarios #684
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

multus-admission-controller

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #145
OCPBUGS-101972: bump golang.org/x/net to v0.53.0 to fix CVE-2026-33814 #130
OCPBUGS-85569: Bump Go version to 1.25.0 for ML-KEM/PQC support #116
OCPBUGS-74025: Updating ose-multus-admission-controller-container image to be consistent with ART for 4.22 #114
OCPBUGS-69968: Updating ose-multus-admission-controller-container image to be consistent with ART for 4.22 #113
Full changelog

multus-cni, multus-cni-microshift

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #372
OCPBUGS-101992: [release-4.22] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #353
OCPBUGS-120707: Remove rhel8 build stage #360
OCPBUGS-120682: [Release 4.22] Cherry-pick fix for the issue of stripping delegate datastore config on CNI DEL, leaking IPAM addresses #350
OCPBUGS-114732: [release-4.22] Revert “Sort DeviceIDs in GetPodResourceMap for deterministic ordering” #346
CORENET-6886: downstream sync to kube 1.35 and go to 1.25 #281
OKD-322: Update Dockerfile to work on CentOS/RHEL 10 #275
CORENET-6864: Ds merge 3/3/2026 #280
Full changelog

multus-networkpolicy

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #137
OCPBUGS-101970: [release-4.22] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #124
downstream sync 2026-02-23 #97
ds: disable DependaBot downstream #96
OCPBUGS-77537: Updating ose-multus-networkpolicy-container image to be consistent with ART for 4.22 #101
OCPBUGS-76465: Clean up dnf cache #99
OCPBUGS-77019: Disable metrics server #98
CNF-21001: downstream: Transition to nftables backend #77
OCPBUGS-69727: Updating ose-multus-networkpolicy-container image to be consistent with ART for 4.22 #83
Full changelog

multus-route-override-cni

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #86
OCPBUGS-120707: Remove rhel8 build stage #79
OCPBUGS-120707: Remove rhel8 build stage #80
Full changelog

multus-whereabouts-ipam-cni

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #440
OCPBUGS-101984: Fix CVE-2026-33814 by adding patch for golang.org/x/net package #422
OCPBUGS-120707: Remove rhel8 build stage #429
Full changelog

must-gather

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #574
OCPBUGS-123142: Update build-machinery-go vendor dependency #565
MG-241: Adding support for skipping rotated logs #536
no-jira: build(make): default podman flags for ART DNF wrapper #535
no-jira: docs: add proposal for e2e #526
RFE-8344: Add Node Feature Discovery Operator collection script #508
RFE-8932: Included object size with the object count #527
OCPBUGS-77832: Updating ose-must-gather-container image to be consistent with ART for 4.22 #528
NO-JIRA:gather_ppc: detect NTO image from TuneD pods on HCP #518
no-jira: chore: ensure scripts are properly formatted #524
no-jira: test: add basic UT for collection-scripts #521
OSSM-11290: Collect Istio ZTunnel resources #511
OCPBUGS-70064: Updating ose-must-gather-container image to be consistent with ART for 4.22 #519
Full changelog

network-interface-bond-cni

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #125
OCPBUGS-120707: Remove rhel8 build stage #124
OCPBUGS-69972: Updating ose-network-interface-bond-cni-container image to be consistent with ART for 4.22 #109
OCPBUGS-97943: Update OWNERS for release-4.22 #119
Full changelog

network-metrics-daemon

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #165
OCPBUGS-77680: Updating ose-network-metrics-daemon-container image to be consistent with ART for 4.22 #142
OCPBUGS-101990: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.3 #149
OCPBUGS-74026: Updating ose-network-metrics-daemon-container image to be consistent with ART for 4.22 #141
OCPBUGS-69971: Updating ose-network-metrics-daemon-container image to be consistent with ART for 4.22 #140
Full changelog

network-tools

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #194
NO-JIRA: Image slimming #154
OCPBUGS-77809: Updating ose-network-tools-container image to be consistent with ART for 4.22 #173
NO-JIRA: Comment submariner team members until they’re ready for OVNK bugs #171
OCPBUGS-70066: Updating ose-network-tools-container image to be consistent with ART for 4.22 #170
Full changelog

networking-console-plugin

maintenance: Bump the npm group with 70 updates #658
OCPNETUI-168: Update Owners file #651
maintenance: Bump the npm group with 32 updates #636
OCPNETUI-182: migrate to @kubevirt-ui-ext/kubevirt-api #628
maintenance: Bump the npm group with 24 updates #620
OCPNETUI-187: Sync Dockerfile with Dockerfile.art #618
maintenance: Bump the npm group with 20 updates #596
OCPNETUI-147: dependency cleanup #591
OCPNETUI-147: reassign dev and prod dependencies #584
maintenance: Bump the npm group with 24 updates #578
maintenance: Bump the npm group across 1 directory with 21 updates #569
OCPNETUI-147: Align shared modules with Console #564
maintenance: Bump the npm group with 15 updates #552
maintenance: Bump the npm group across 1 directory with 20 updates #535
maintenance: Bump the npm group with 249 updates #507
OCPBUGS-82108: Marked strings for i18n in NetworkPolicies list page #475
OCPBUGS-98788: Updating linkify-it to 5.0.2 to fix CVE-2026-48801 #464
OCPBUGS-92205: Updated doc links based on release #438
OCPBUGS-92196: fixed translations of pod column titles #437
OCPBUGS-88314: Trim subnet input in UDN creation form #431
CNV-90049: [UDN] Add condition column to the list page #432
OCPBUGS-88025: Fix empty state Create button links #429
CNV-74110: new translations #407
OCPBUGS-84204: CVE dependency remediation #381
Bump lodash from 4.17.23 to 4.18.1 #366
OCPBUGS-70285: Upgrade cypress to v15 to fix CVEs #345
OCPBUGS-78542: Remove useHistory and replace with useNavigate #364
CNV-81752: Fix runtime error when clicking “Create Route” #363
OCPBUGS-74912: Fix namespace resolution and resource path for Routes and Services list pages #362
OCPBUGS-77868: Clean up cruft in /var/cache/dnf #360
OCPBUGS-77174: Fix display of NAD type for NADs created from YAML #358
OCPBUGS-77414: simplify dockerfile by removing cachito dependencies #356
CNV-59877: Fix permissions request for NADs #352
OCPBUGS-41199: Fix NAD creation using default namespace instead of selected one #348
Remove yarn references from ART Dockerfile #347
CNV-78079: remove Virtual machine networks page #344
CNV-78079: Virtual machine networks page - Other types tab #335
CNV-78079: Virtual machine networks - deletion #343
CNV-78079: Virtual machine networks - details page updates #333
CNV-77540: fix Enable MultiNetworkPolicies lead to invalid URL #339
CNV-78194: update PatternFly to 6.4.0 to align with Console main #336
CNV-70790: Navigation to Project Mapping Before Network Definition Com… #338
CNV-69219: New translations #337
CNV-78079: Virtual machine networks - list updates #329
OCPBUGS-74423: Migrate to npm #331
CNV-77547: add “Make this network available for all projects” option to Virtual machine network Wizard #328
CNV-76711: Remove @openshift-console/plugin-shared package #327
CNV-76879: Allow passing the physical network name via URL parameter in the VM network wizard #326
CNV-76435: CUDN breadcrumb link to page with Project selector #325
OCPBUGS-73548: remove whitelist for allowlist #321
CNV-75831: list all NetworkPolicies in “All projects” #313
CNV-76277: Fix name generator with unprofessional names #315
OCPBUGS-70000: Updating networking-console-plugin-container image to be consistent with ART for 4.22 #312
CNV-76211: Remove deprecated badge from localnet #314
CNV-74685: Fix vm network edit modal #311
CNV-74687: Fixing the title and redirect when deleting a vm network #307
CNV-72230: fix networking links #309
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

nutanix-cloud-controller-manager

OCPBUGS-123142: Bump Go builder to 1.26 and protobuf to v1.36.12 #87
OCPBUGS-101973: Bump golang.org/x/net to v0.58.0 to address CVE-2026-33814 #73
OCPCLOUD-3272: Merge https://github.com/nutanix-cloud-native/cloud-provider-nutanix:main (9c374cb) into main #54
OCPBUGS-69976: Updating ose-nutanix-cloud-controller-manager-container image to be consistent with ART for 4.22 #53
Full changelog

nutanix-cluster-api-controllers

OCPBUGS-78476: Bump manifests gen #8
Full changelog

nutanix-machine-controllers

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #144
OCPCLOUD-3277: Bump k8s 1.35 #134
OCPBUGS-74002: Updating ose-nutanix-machine-controllers-container image to be consistent with ART for 4.22 #129
OCPBUGS-69913: Updating ose-nutanix-machine-controllers-container image to be consistent with ART for 4.22 #128
Full changelog

oauth-apiserver

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #238
OCPBUGS-101982: Replace golang.org/x/net with github.com/openshift-sustaining/net v0.50.0-sec.4 #220
OCPBUGS-109741: Updating ose-oauth-apiserver-container image to be consistent with ART for 4.22 #218
OCPBUGS-114426: Update build-machinery-go vendor dependency #230
OCPBUGS-82579: [release-4.22]: chore: sync with openshift repositories #191
CNTRLPLANE-2989: feat: add external-oidc subcommand to oauth-apiserver #181
CNTRLPLANE-2260: cmd: wire up OTE ginkgo suite for tokenreviews #163
CNTRLPLANE-2436: bump(k8s)=1.34.1 #164
CNTRLPLANE-2260: cmd/oauth-apiserver-tests-ext: Update OTE framework integration #162
OCPBUGS-69818: Updating ose-oauth-apiserver-container image to be consistent with ART for 4.22 #160
CNTRLPLANE-1259: Simplified test infrastructure to single-module architecture #154
Full changelog

oauth-proxy

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #393
OCPBUGS-112096: bugfix: rewrite open redirect strings to ‘/’ #379
OCPBUGS-93565: update x/crypto to v0.52.0 and x/net to v0.55.0 #369
OCPBUGS-86213: Updating golang-github-openshift-oauth-proxy-container image to be consistent with ART for 4.22 #366
OCPBUGS-73848: test/e2e - do not use ambiguous container image short names #343
Full changelog

oauth-server

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #289
OCPBUGS-101994: Bump golang.org/x/net to v0.53.0 #285
OCPBUGS-92015: bugfix: default to english when Accept-Language header contains more than 1000 underscores #268
OCPBUGS-114426: Update build-machinery-go vendor dependency #263
OCPBUGS-100337: Updating oauth-server-container image to be consistent with ART for 4.22 #256
OCPBUGS-84381: Bump github.com/go-jose/go-jose/v3 from v3.0.3 to v3.0.5 #233
OCPBUGS-82579: [release-4.22]: chore: sync with openshift repositories #222
OCPBUGS-63228: groupmapper: avoid mutating original group users slice when removing user #211
CNTRLPLANE-2437: bump(k8s)=1.34.1 #208
Full changelog

oc-mirror

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #1587
OCPBUGS-129169: v1 accept catalog root entries and relative symlink targets #1574
OCPBUGS-92814: v1/e2e: reduce helm download flakiness #1455
OCPBUGS-90149: fix(helm): tolerate v-prefix version mismatch in disk-to-mirror #1448
OCPBUGS-105777: fix for CVE-2026-39829 #1501
OCPBUGS-98716: Include index image sub-digests in dry run mapping.txt #1474
OCPBUGS-93773: Make dry-run also generate cluster-resources #1457
OCPBUGS-97946: skip manifest list signatures #1469
OCPBUGS-88484: Include tag+digest images in both IDMS and ITMS #1442
OCPBUGS-87806: fixes race condition when mirroring operator catalogs #1434
OCPBUGS-84389: Upgrade go-jose to v4.1.4 to fix CVE-2026-34986 #1419
CLID-532: Separate Image struct into AdditionalImage, BlockedImage, SampleImage #1372
OCPBUGS-62603: Fix printing collection messages with 0 collection items #1385
OCPBUGS-61136: Only print catalog rebuild message if there are catalo… #1386
CLID-524: additionalImages collector error handling #1343
CLID-535: api: use OCI definitions from opencontainers spec #1341
CLID-547: v2: add list releases command #1373
CLID-540: v2: add list operators command #1370
NO-JIRA: Group dependabot updates by package origin #1336
no-jira: lint: Remove golangci-lint v1 config. #1374
OCPBUGS-77146: Remove status field from CatalogSource, ClusterCatalog… #1369
CLID-549: Update Dockerfile.tests to run Go integration tests #1368
CLID-197: Add TargetRepo, TargetTag to additionalImages #1327
OCPBUGS-77726: Updating oc-mirror-plugin-container image to be consistent with ART for 4.22 #1364
OCPBUGS-77726: Updating oc-mirror-plugin-container image to be consistent with ART for 4.22 (missing files from ART PR 1364 ) #1366
CLID-539: Remove unused constants and centralize widely used ones #1354
NO-JIRA: Bump github.com/containerd/containerd from 1.7.27 to 1.7.29 in the oc-mirror-v2-security-updates group across 1 directory #1308
OCPBUGS-77141: Fix registriesd “unknown userid” failure for arbitrary UIDs #1357
CLID-513: operator catalogs pinned by digest in ISC #1333
OCPBUGS-75013: Fix reg config detection for explicit false values #1348
OCPBUGS-73760: fix conversion issue for catalog #1338
OCPBUGS-69745: fix duplicated channel bug in filtered catalogs #1339
CLID-476: Fixes for cross-build errors #1303
OCPBUGS-70024: images: update images to 4.22 #1337
OCPBUGS-70024: Updating oc-mirror-plugin-container image to be consistent with ART for 4.22 #1331
NO-JIRA: Add tests/results-integration to .gitignore #1326
CLID-480: v2: do not invoke v1 make commands #1310
CLID-512: claude: add slash command for ISC generation #1328
NO-JIRA: add adolfo-ab as reviewer #1329
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

olm-catalogd, olm-operator-controller

OCPBUGS-123142: Bump Dockerfile golang builders to 1.26 #837
OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #822
OCPBUGS-102003: [release-4.22] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #800
OCPBUGS-102011: Bump golang.org/x/net to v0.53.0 to address CVE-2026-33814 #793
OCPBUGS-100305: Fix cache path to avoid /var/cache/dnf conflict #783
OCPBUGS-99298: increase catalog HTTP client timeout from 10s to 5m #768
OCPBUGS-94187: enable OLMv1 topology-based deployment scaling e2e test #761
OCPBUGS-94187: Backport HA topology deployment scaling to release-4.22 #758
OCPBUGS-85059: fix(test): drop blocking namespace-deletion wait between both-watch-modes scenarios #714
OPRUN-4546: Fix boxcutter finalizer ResourceNames in preflight test #695
NO-ISSUE: Synchronize From Upstream Repositories #694
NO-ISSUE: Synchronize From Upstream Repositories #693
OCPQE-31553: Test empty affinity erasure and cleanup #689
NO-ISSUE: Synchronize From Upstream Repositories #692
OPRUN-4518: Remove skip for incompatible operator check after rename of CER #690
OCPBUGS-60693, OCPBUGS-60958: Synchronize From Upstream Repositories #691
OPRUN-4426: add ocp-87557 #635
OCPQE-31553: update preflight permission case #686
NO-ISSUE: Add fgiudici as reviewer #681
OCPBUGS-78211, OCPBUGS-78455: Synchronize From Upstream Repositories #682
NO-ISSUE: Add long-duration test script and documents #664
OCPBUGS-81194: Update grpc in default-catalog-consistency tests #679
OCPBUGS-78092, OCPBUGS-78311: Synchronize From Upstream Repositories #677
OPRUN-4063: verify volume/volumeMount override #678
OCPBUGS-78999: Update quay-operator bundle version in OTE to fix missing arch #673
OCPQE-31636: enhance QE cases #666
OCPBUGS-76380: Synchronize From Upstream Repositories #676
OPRUN-4228: Add boxcutter tests #672
OPRUN-4468: Add OTE tests for OLMv1 DeploymentConfig support #662
OCPBUGS-78787: Synchronize from upstream #670
OCPBUGS-65634: UPSTREAM: <carry>: add service account to curl job #653
OPRUN-4063: deployment config cases #654
OCPQE-31265: update OCP-75441 to support multi-arch #668
OPRUN-4509: Synchronize From Upstream Repositories #669
NO-ISSUE: Synchronize From Upstream Repositories #667
NO-ISSUE: Synchronize From Upstream Repositories #665
NO-ISSUE: Synchronize From Upstream Repositories #663
NO-ISSUE: Synchronize From Upstream Repositories #661
OCPBUGS-77847: Increase install timeout and add diagnostic logging for CE install tests #660
OCPBUGS-76453: Synchronize From Upstream Repositories #659
OCPBUGS-77942: Fix OLMv1 test operator to listen on IPv6 #657
NO-ISSUE: Synchronize From Upstream Repositories #658
OCPQE-31707: serviceAccount validation unified across all runtimes to enhance cases #656
NO-ISSUE: Synchronize From Upstream Repositories #655
NO-ISSUE: Synchronize From Upstream Repositories #651
OCPQE-31637: fix 83026 for TP cluster #652
OPRUN-4461: Upgrade OTE and Default Catalog Tests dependencies and go #649
OPRUN-4459: Update OCP catalogs to v4.22 ( Release Blocker ; Must go in before OCP release 4.22 ) #627
OCPQE-31553: adjust qe sa and permission test cases per new change #631
NO-ISSUE: Synchronize From Upstream Repositories #648
OPRUN-4459, OPRUN-4460: Preflight tests use in-cluster catalog and bundles instead of openshift-pipelines-operator-rh #644
NO-ISSUE: Synchronize From Upstream Repositories #646
OCPBUGS-65634: add service account to verify pod #638
NO-ISSUE: Synchronize From Upstream Repositories #645
NO-ISSUE: Synchronize From Upstream Repositories #643
MON-4516: Synchronize From Upstream Repositories #641
NO-ISSUE: Synchronize From Upstream Repositories #640
NO-ISSUE: Synchronize From Upstream Repositories #639
NO-ISSUE: Synchronize From Upstream Repositories #637
OPRUN-4441: fix(ote): Fix up own-namespace invalid configuration test #634
NO-ISSUE: Synchronize From Upstream Repositories #633
NO-ISSUE: Synchronize From Upstream Repositories #632
NO-ISSUE: Synchronize From Upstream Repositories #630
OPRUN-4439: Update test-operator startup script to fix pod probe endpoints #629
NO-ISSUE: add 85889 automation #603
NO-ISSUE: add 83979 automation #602
NO-ISSUE: Synchronize From Upstream Repositories #625
OPRUN-4441: fix(ote): fix SingleOwnNamespace test for Boxcutter runtime compatibility and use as operator-controller dep from root instead of upstream release #628
OCPQE-31553: adjust watchnamespace qe case based on change #623
OPRUN-4439: Fix test operator controller pod probes #614
NO-ISSUE: Synchronize From Upstream Repositories #622
OPRUN-4446: Update preflight auth checks for Boxcutter feature gate #621
OPRUN-4112: Synchronize From Upstream Repositories #615
OPRUN-4403: OPRUN-4403 case for upgrade major version #618
OCPQE-31521: enhance ocp-79770 #616
OPRUN-4063: config watchnamespace api cases #612
NO-ISSUE: Synchronize From Upstream Repositories #610
OPRUN-4385: Remove marketplace index from tests #598
NO-ISSUE: Synchronize From Upstream Repositories #608
TRT-2516: Revert #594 “OCPBUGS-65634: add service account to curl job” #609
OCPBUGS-65634: add service account to curl job #594
NO-ISSUE: Synchronize From Upstream Repositories #601
OCPQE-31296: enhance qe cases to make it more stable #604
NO-ISSUE: Run upstream e2e tests tagged with @catalogd-update #605
NO-ISSUE: Synchronize From Upstream Repositories #597
OPRUN-4350: Update to golang 1.25 and ocp 4.22 #586
OCPQE-31263: update 83026 to specify the clustercatalog #583
OCPQE-30674: migrate bandrade’s OLMv1 test cases to OTE #562
OCPQE-31264: update 80458’s timeout to 180s #579
NO-ISSUE: Synchronize from upstream #581
Full changelog

openshift-apiserver

OCPBUGS-102004: Replace golang.org/x/net with openshift-sustaining/net v0.50.0-sec.4 for CVE-2026-33814 #694
OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #693
OCPBUGS-109742: Updating ose-openshift-apiserver-container image to be consistent with ART for 4.22 #675
OCPBUGS-114426: Update build-machinery-go vendor dependency #685
OCPBUGS-87022: fix concurrent map race in project authorization cache #653
OCPBUGS-84454: Address CVE-2026-35469 #651
OCPBUGS-82579: [release-4.22] CNTRLPLANE-3226: Sync with openshift apiserver 4.22 kubernetes 1.34.1 #631
CNTRLPLANE-2438: chore: bump(k8s)=1.34.1 #592
Revert “OCPBUGS-72408: block image import from cluster IP addresses” #599
OCPBUGS-72408: block image import from cluster IP addresses #591
OCPBUGS-70049: Updating ose-openshift-apiserver-container image to be consistent with ART for 4.22 #590
Full changelog

openshift-controller-manager

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #465
OCPBUGS-102001: Bump golang.org/x/net to v0.53.0 #461
CNTRLPLANE-2769: bump kubernetes dependencies to v1.35 #429
CNTRLPLANE-2620: bump github.com/openshift/library-go #427
OCPBUGS-69696: Updating ose-openshift-controller-manager-container image to be consistent with ART for 4.22 #425
Full changelog

openshift-state-metrics

NO-ISSUE: synchronize OWNERS from main branch #147
OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #143
OCPBUGS-77709: Updating openshift-state-metrics-container image to be consistent with ART for 4.22 #130
OCPBUGS-74036: Updating openshift-state-metrics-container image to be consistent with ART for 4.22 #129
OCPBUGS-69985: Updating openshift-state-metrics-container image to be consistent with ART for 4.22 #128
Full changelog

openstack-cluster-api-controllers

OCPBUGS-102013: CVE-2026-33814- Replace golang.org/x/net with openshift-sustaining/net v0.50.0-sec.4 [release-4.22] #434
: OCPBUGS-123142: Bump Go builder to 1.26 and protobuf to v1.36.12 #449
UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.14 into release-4.22 #419
UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.14 into release-4.22 #409
OCPBUGS-84994: Updating openstack-cluster-api-controllers-container image to be consistent with ART for 4.22 #410
OCPCLOUD-3321, OSASINFRA-3980: Migrate asset generation to ocp-manifests #386
NO-JIRA: Update DOWNSTREAM_OWNERS #398
NO-JIRA: Cleanup post-infracluster migration #397
OCPBUGS-69731: Updating openstack-cluster-api-controllers-container image to be consistent with ART for 4.22 #396
NO-JIRA: Sync main with latest upstream (release-0.14) #395
Full changelog

openstack-machine-api-provider

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #195
OCPBUGS-97826: Revendor CAPO #175
OCPBUGS-77724: Updating ose-machine-api-provider-openstack-container image to be consistent with ART for 4.22 #161
OCPBUGS-76788: Fix make test #154
OCPBUGS-70022: Updating ose-machine-api-provider-openstack-container image to be consistent with ART for 4.22 #149
OCPBUGS-67298: Don’t record event for every reconcile #142
Full changelog

openstack-resource-controller

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #49
OCPBUGS-101857: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.3 to address CVE-2026-33814 #43
OCPCLOUD-3321, OSASINFRA-3980: Update to image-based manifests #30
NO-JIRA: Update OWNERS_ALIASES #28
OCPBUGS-77719: Updating openstack-resource-controller-container image to be consistent with ART for 4.22 #26
UPSTREAM-SYNC: Sync main with upstream (release-1.0) #27
OCPBUGS-70015: Updating openstack-resource-controller-container image to be consistent with ART for 4.22 #25
Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

OCPBUGS-123142: Bump Dockerfile golang builders to 1.26 #1395
OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #1392
OCPBUGS-101995: Bump golang.org/x/net to v0.53.0 to address CVE-2026-33814 #1362
OCPBUGS-95441, OCPBUGS-95458: bumping containerd to v1.7.33 #1353
OCPBUGS-84411, OCPBUGS-84412: Update github.com/go-jose/go-jose/v4 to v4.1.4 [release-4.22] #1292
OCPBUGS-77984: test(olm): skip ppc64le/s390x for tests using single-arch images #1276
NO-ISSUE: Synchronize From Upstream Repositories #1278
NO-ISSUE: Synchronize From Upstream Repositories #1277
NO-ISSUE: retry transient registry errors in opm QE #1272
NO-ISSUE: Synchronize From Upstream Repositories #1275
NO-ISSUE: Synchronize From Upstream Repositories #1274
NO-ISSUE: Add pedjak and fgiudici as reviewers #1271
NO-ISSUE: Synchronize From Upstream Repositories #1268
: NO-ISSUE: Migrate away from deprecated ioutil #1160
OCPBUGS-79397: Fix SA restore resourceVersion conflict error #1264
OCPBUGS-77179: Synchronize From Upstream Repositories #1260
NO-ISSUE: remove etcd dependency from failing cases #1241
OCPQE-31468: verify images command log pollution #1262
OCPBUGS-78557: Re-Apply Fix admin context race condition in parallel tests #1259
OPRUN-4415: automate OCP-87188: Central TLS Profile Consistency #1207
TRT-2580: Revert “OCPBUGS-78557: Fix admin context race condition in parallel tests” #1258
OCPQE-31804: Fix admin context race condition in parallel tests #1256
NO-ISSUE: Synchronize From Upstream Repositories #1255
NO-ISSUE: Synchronize From Upstream Repositories #1248
OCPQE-31752: enhance qe test cases #1254
OCPQE-31756: enhance case to make it pass per test bundle change #1252
OCPQE-31607: update 43101 for FIPS enabled cluster #1249
OCPQE-31615: fix OCP-33450 for FIPS enabled cluster #1247
OCPBUGS-74928, OCPBUGS-76460: Synchronize From Upstream Repositories #1244
MON-4513, OCPBUGS-75921, OCPBUGS-76460: Synchronize From Upstream Repositories #1237
OCPBUGS-77006: Remove the collect-profiles info from the microshift kustomization file #1233
NO-ISSUE: Synchronize From Upstream Repositories #1228
NO-ISSUE: UPSTREAM:<carry>: automate OCP-40945 #1209
NO-ISSUE: Synchronize From Upstream Repositories #1226
OCPBUGS-76323: OCPQE-31553:remove qe case of testing collect-profiles #1221
NO-ISSUE: UPSTREAM: : migrate bandrade test cases to OTE #1193
OCPBUGS-31547: Remove the collect-profiles job #1215
OCPBUGS-26404: Add retry logic for SNO cluster detection in leader election configuration #1210
OCPQE-31553: continue to adjust case per collect-profiles change #1218
OPRUN-4407: automate OCP-87276 #1212
OCPQE-31558, OCPQE-31559: Update QE test cases to align with the removal of the redhat-marketplace catalog #1217
OCPQE-31553: change to check collect-profile networkpolicy dynamically #1216
OCPBUGS-74389: Synchronize From Upstream Repositories #1206
OPRUN-4414: Integrate APIServer TLS controller into PSM #1205
OPRUN-4415: Synchronize From Upstream Repositories #1202
NO-ISSUE: Synchronize From Upstream Repositories #1201
OPRUN-4416: Remove kube-rbac-proxy from PSM #1190
NO-ISSUE: automate ocp-85743 and ocp-85745 #1197
OCPQE-31468: add missed opm db testdata #1196
OCPQE-31468: recovery missed qe testdata #1194
OCPBUGS-65867: Synchronize From Upstream Repositories #1195
NO-ISSUE: Synchronize From Upstream Repositories #1192
OCPQE-30680: migrate ocp-25674 #1185
NO-ISSUE: UPSTREAM: <carry>: migrate bandrade test cases to OTE #1169
OCPQE-31297: enhance ocp and microshift olm case #1173
NO-ISSUE: Synchronize From Upstream Repositories #1168
OCPQE-30680: migrate OLMv0 test cases to OTE #1166
OPRUN-4351: Update Dockerfiles/CI to use golang 1.25/ocp 4.22 #1178
Updating ose-operator-framework-tools-container image to be consistent with ART for 4.22 #1174
OCPBUGS-69774: Updating operator-registry-container image to be consistent with ART for 4.22 #1177
OCPBUGS-69740: Updating operator-lifecycle-manager-container image to be consistent with ART for 4.22 #1175
Full changelog

operator-marketplace

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #801
NO-ISSUE: Bump github.com/operator-framework/api from 0.41.0 to 0.42.0 #738
NO-ISSUE: Add fgiudici as reviewer #739
NO-ISSUE: Bump the k8s-dependencies group with 3 updates #737
NO-ISSUE: Bump github.com/operator-framework/operator-lifecycle-manager from 0.40.0 to 0.41.0 #732
MON-4514: Migrate Prometheus targets discovering from Endpoints to EndpointSlices #725
NO-ISSUE: Bump sigs.k8s.io/controller-runtime from 0.23.1 to 0.23.3 in the k8s-dependencies group #731
OCPBUGS-74928: Bump github.com/operator-framework/api from 0.39.0 to 0.41.0 #728
NO-ISSUE: Bump the k8s-dependencies group with 3 updates #726
OCPBUGS-66980: Update NetworkPolicy egress to support HyperShift custom API ports #723
OPRUN-4458: Upgrade Catalog Source Index from 4.21 to 4.22 #727
OPRUN-4456: chore(deps): upgrade Go module dependencies (edge) #724
NO-ISSUE: Bump github.com/onsi/ginkgo/v2 from 2.27.5 to 2.28.1 #720
NO-ISSUE: Bump sigs.k8s.io/controller-runtime from 0.23.0 to 0.23.1 in the k8s-dependencies group #718
NO-ISSUE: Bump github.com/onsi/gomega from 1.39.0 to 1.39.1 #719
OCPBUGS-65581: marketplace-operator sets Progressing=True during upgrade #713
OPRUN-4410: Add Openshift TLS Profiles support to marketplace-operator #715
NO-ISSUE: Bump github.com/operator-framework/api from 0.37.0 to 0.38.0 #717
OPRUN-4302: Remove marketplace index #698
OCPBUGS-74360: Fix image for the build #714
NO-ISSUE: Bump sigs.k8s.io/controller-runtime from 0.22.4 to 0.23.0 in the k8s-dependencies group #711
NO-ISSUE: Bump github.com/sirupsen/logrus from 1.9.3 to 1.9.4 #712
OCPBUGS-74006: Updating marketplace-operator-container image to be consistent with ART for 4.22 #709
NO-ISSUE: Bump github.com/onsi/ginkgo/v2 from 2.27.3 to 2.27.4 #701
NO-ISSUE: Bump github.com/onsi/gomega from 1.38.3 to 1.39.0 #702
OCPBUGS-69441: Increase default catalog polling interval to 4h (240m) #695
NO-ISSUE: Bump the k8s-dependencies group with 2 updates #697
NO-ISSUE: Bump github.com/onsi/ginkgo/v2 from 2.27.2 to 2.27.3 #691
OPRUN-4354: Update to build containers to golang-1.25 #696
NO-ISSUE: update ports on deployment manifests, fix spacing #689
OCPBUGS-69929: Updating marketplace-operator-container image to be consistent with ART for 4.22 #694
NO-ISSUE: Bump github.com/onsi/gomega from 1.38.2 to 1.38.3 #692
NO-ISSUE: Bump github.com/operator-framework/api from 0.36.0 to 0.37.0 #693
NO-ISSUE: Bump the k8s-dependencies group with 3 updates #686
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-134986: NO-JIRA: Branch Sync release-5.0 to release-4.22 [10-27-2026] #3577
OCPBUGS-132903: NO-JIRA: Branch Sync release-5.0 to release-4.22 [10-16-2026] #3551
OCPBUGS-130567: Add pperiyasamy to OWNERS for release-4.22 #3527
OCPBUGS-128906: NO-JIRA: Branch Sync release-5.0 to release-4.22 [10-01-2026] #3502
NO-JIRA: Branch Sync release-5.0 to release-4.22 [09-29-2026] #3490
OCPBUGS-128612: Branch Sync release-5.0 to release-4.22 [09-25-2026] #3476
OCPBUGS-128244: Branch Sync release-5.0 to release-4.22 [09-18-2026] #3461
Full changelog

powervs-block-csi-driver

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #149
OCPBUGS-101580, OCPBUGS-102012, OCPBUGS-93554, OCPBUGS-95566, OCPBUGS-96671, OCPBUGS-98019: Fix CVE-2026-39828, 46597, 39835, 27136, 2502 and 33814 #142
OCPBUGS-84007: Mitigate CVE-2026-33186 by bumping grpc-go to v1.79.3 #132
OCPBUGS-77586: Updating ose-powervs-block-csi-driver-container image to be consistent with ART for 4.22 #115
MULTIARCH-6015: Rebase ibm-powervs-block-csi-driver with upstream #116
OCPBUGS-77586: Updating ose-powervs-block-csi-driver-container image to be consistent with ART for 4.22 #118
MULTIARCH-6016: Upgrade golangci-lint version to support go1.25 #117
MULTIARCH-6001: Rebase ibm-powervs-block-csi-driver with upstream #114
MULTIARCH-5838: Rebase ibm-powervs-block-csi-driver with upstream #109
OCPBUGS-69805: Updating ose-powervs-block-csi-driver-container image to be consistent with ART for 4.22 #108
Full changelog

powervs-block-csi-driver-operator

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #129
OCPBUGS-101993: Mitigate CVE-2026-33814 by bumping golang.org/x/net to v0.57.0 #121
OCPBUGS-107713: Mitigate CVE-2026-41178 by bumping go.opentelemetry.io/otel/sdk to v1.44.0 #120
OCPBUGS-84008: Mitigate CVE-2026-33186 by bumping grpc-go to v1.79.3 #113
STOR-2762: Bump all deps for 4.22 #104
OCPBUGS-77622: Updating ose-powervs-block-csi-driver-operator-container image to be consistent with ART for 4.22 #103
STOR-2809: Central TLS Profile consistency #97
STOR-2523: Add desired-version annotation to controller Deployment and use DeploymentVersionController in ibm-powervs-block-csi-driver-operator #90
No-JIRA: Update owners #93
OCPBUGS-69906: Updating ose-powervs-block-csi-driver-operator-container image to be consistent with ART for 4.22 #94
Full changelog

powervs-cloud-controller-manager

OCPBUGS-123142: Bump Go builder to 1.26 and protobuf to v1.36.12 #123
OCPBUGS-102007, OCPBUGS-107718: Bump x/net and otel to address CVEs #115
OCPBUGS-83398: Merge https://github.com/IBM-Cloud/cloud-provider-ibm:release-1.35 (e48649f) into release-4.22 #95
No-Jira: Update go.opentelemetry.io/otel and google.golang.org/grpc #94
OCPBUGS-70048: Updating ose-powervs-cloud-controller-manager-container image to be consistent with ART for 4.22 #91
No-Jira: Bump golang.org/x/crypto to 0.45.0 #90
Full changelog

powervs-machine-controllers

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #163
OCPCLOUD-3271: Update dependencies for OpenShift 4.22 release #140
NO-JIRA: Add damdo to approvers list in OWNERS file #141
OCPBUGS-77745: Updating ose-powervs-machine-controllers-container image to be consistent with ART for 4.22 #139
OCPBUGS-70051: Updating ose-powervs-machine-controllers-container image to be consistent with ART for 4.22 #133
Full changelog

prom-label-proxy

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #416
NO-ISSUE: synchronize OWNERS from main branch [release-4.22] #413
NO-JIRA: disable automatic coderabbit reviews #390
OCPBUGS-77739: Updating prom-label-proxy-container image to be consistent with ART for 4.22 #389
OCPBUGS-70042: Updating prom-label-proxy-container image to be consistent with ART for 4.22 #388
Full changelog

prometheus

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #400
OCPBUGS-107716: Bump go.opentelemetry.io/otel to fix CVE-2026-41178 #396
NO-ISSUE: synchronize OWNERS from main branch #391
OCPBUGS-93732: fix for CVE-2026-42151 #355
OCPBUGS-93919: fix(tsdb): temporarily ignore Direct IO enablement errors on unsupported filesystems #339
OCPBUGS-92818: bump x/crypto, x/net, and otel dependencies to fix CVEs #337
OCPBUGS-88666: remote: validate snappy decoded length before allocation in read endpoint #330
OCPBUGS-86248: fix: TLS client cert rotation when no CA is configured #313
OCPBUGS-84010: bump google.golang.org/grpc to v1.79.3 [release-4.22] #310
OCPBUGS-65568: chore(kubernetes): deduplicate warning logs from the API #296
NO-JIRA: disable automatic coderabbit reviews #295
OCPBUGS-77667: Updating golang-github-prometheus-prometheus-container image to be consistent with ART for 4.22 #294
NO-JIRA: update rh-manifest.txt #293
NO-JIRA: [bot] Bump openshift/prometheus to v3.9.1 #292
OCPBUGS-74015: Updating golang-github-prometheus-prometheus-container image to be consistent with ART for 4.22 #286
OCPBUGS-69956: Updating golang-github-prometheus-prometheus-container image to be consistent with ART for 4.22 #284
Full changelog

prometheus-alertmanager

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #202
NO-JIRA: synchronize OWNERS with main #198
OCPBUGS-98185: build(deps): bump github.com/hashicorp/memberlist from 0.5.4 to 0.6.0 #157
OCPBUGS-99442: embed tzdata in the alertmanager binary #141
NO-ISSUE: [bot] Bump openshift/prometheus-alertmanager to v0.31.1 #127
MON-4536: Bump alertmanager to v0.31.1 #118
NO-JIRA: disable automatic coderabbit reviews #126
OCPBUGS-77708: Updating golang-github-prometheus-alertmanager-container image to be consistent with ART for 4.22 #119
OCPBUGS-74035: Updating golang-github-prometheus-alertmanager-container image to be consistent with ART for 4.22 #112
OCPBUGS-69983: Updating golang-github-prometheus-alertmanager-container image to be consistent with ART for 4.22 #109
Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

NO-ISSUE: synchronize OWNERS from main branch #415
OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #409
OCPBUGS-102017, OCPBUGS-102031: [release-4.22] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #398
NO-ISSUE: [bot] Bump openshift/prometheus-operator to v0.90.1 #378
MON-4542: bump v0.90.0 #377
NO-JIRA: Update v0.89.0 #374
NO-JIRA: disable automatic coderabbit reviews #375
OCPBUGS-77597: Updating prometheus-operator-admission-webhook-container image to be consistent with ART for 4.22 #371
OCPBUGS-77753: Updating prometheus-operator-container image to be consistent with ART for 4.22 #373
Updating prometheus-config-reloader-container image to be consistent with ART for 4.22 #372
OCPBUGS-74491: backport upstream fix to reconcile resources with inconsistent status #364
OCPBUGS-73982: Updating prometheus-operator-admission-webhook-container image to be consistent with ART for 4.22 #355
OCPBUGS-67303: Validate webhookURL secret for MSTeams receiver in AlertmanagerConfig CRD #358
OCPBUGS-70007: Updating prometheus-config-reloader-container image to be consistent with ART for 4.22 #352
OCPBUGS-70055: Updating prometheus-operator-container image to be consistent with ART for 4.22 #353
OCPBUGS-69832: Updating prometheus-operator-admission-webhook-container image to be consistent with ART for 4.22 #351
OCPBUGS-67215: [bot] Bump openshift/prometheus-operator to v0.87.1 #349
Full changelog

prometheus-node-exporter

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #222
OCPBUGS-102026: Bump golang.org/x/net to v0.53.0 #198
NO-ISSUE: synchronize OWNERS from main branch [release-4.22] #200
NO-JIRA: disable automatic coderabbit reviews #176
OCPBUGS-77587: Updating golang-github-prometheus-node_exporter-container image to be consistent with ART for 4.22 #175
OCPBUGS-69806: Updating golang-github-prometheus-node_exporter-container image to be consistent with ART for 4.22 #174
Full changelog

rhel-coreos, rhel-coreos-extensions

OCPBUGS-105444: NetworkManager-ovs has moved to RHCOS #1956
NO-JIRA: Containerfile: restore meta.json as last layer in image #1950
NO-JIRA: Revert “OCPBUGS-77244: 9.8: override runc package to pull in newer fixes” #1925
OCPBUGS-64841: post-process: Remove workaround for openvswitch additional group #1918
OCPBUGS-77244: 9.8: override runc package to pull in newer fixes #1923
NO-JIRA: extensions: Add rhel-9.8-server-ose-4.22 #1910
NO-JIRA: tests: add openshift tag #1906
COS-3912: denylist: drop rhcos.network.init-interfaces-test #1900
NO-JIRA: OWNERS: Add angelcerveraroldan #1883
NO-JIRA: Rename extensions/Dockerfile to Containerfile #1896
NO-JIRA: packages-openshift: Fix repo versions #1895
NO-JIRA: extensions: add a label for extensions image discovery #1894
COS-3900: Start using rhel-10.2 #1892
NO-JIRA: rhaos-pkgs-match-openshift: exclude known package mismatches #1891
No-JIRA: move the OKD SIG repo to 4.22 #1890
NO-JIRA: OWNERS: add user Rolv-Apneseth #1882
NO-JIRA: Update to track 4.22 and rhel-9.8 #1881
NO-JIRA: rhel-10.1: enable rhel-10.1-fast-datapath #1885
NO-JIRA: packages-openshift: enable rhel-10.1-fast-datapath #1884
OCPNODE-4010: package: add ose-crio-credential-provider #1879
OCPBUGS-70162: extensions/rhel-10.1: Re-enable ipsec #1878
NO-JIRA: drop use of rhel-9.6-appstream-containernetworking repo #1877
And 10 elided commits (e.g. from squash or rebase merges)
Full changelog

rhel-coreos-10, rhel-coreos-10-extensions

OCPBUGS-105444: NetworkManager-ovs has moved to RHCOS #1956
NO-JIRA: Containerfile: restore meta.json as last layer in image #1950
NO-JIRA: Revert “OCPBUGS-77244: 9.8: override runc package to pull in newer fixes” #1925
OCPBUGS-64841: post-process: Remove workaround for openvswitch additional group #1918
OCPBUGS-77244: 9.8: override runc package to pull in newer fixes #1923
NO-JIRA: extensions: Add rhel-9.8-server-ose-4.22 #1910
NO-JIRA: tests: add openshift tag #1906
COS-3912: denylist: drop rhcos.network.init-interfaces-test #1900
NO-JIRA: OWNERS: Add angelcerveraroldan #1883
NO-JIRA: Rename extensions/Dockerfile to Containerfile #1896
NO-JIRA: packages-openshift: Fix repo versions #1895
NO-JIRA: extensions: add a label for extensions image discovery #1894
COS-3900: Start using rhel-10.2 #1892
NO-JIRA: rhaos-pkgs-match-openshift: exclude known package mismatches #1891
No-JIRA: move the OKD SIG repo to 4.22 #1890
NO-JIRA: OWNERS: add user Rolv-Apneseth #1882
NO-JIRA: Update to track 4.22 and rhel-9.8 #1881
NO-JIRA: rhel-10.1: enable rhel-10.1-fast-datapath #1885
NO-JIRA: packages-openshift: enable rhel-10.1-fast-datapath #1884
OCPNODE-4010: package: add ose-crio-credential-provider #1879
OCPBUGS-70162: extensions/rhel-10.1: Re-enable ipsec #1878
NO-JIRA: drop use of rhel-9.6-appstream-containernetworking repo #1877
And 10 elided commits (e.g. from squash or rebase merges)
Full changelog

route-controller-manager

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #115
OCPBUGS-86184: OCPBUGS-83892: Update grpc-go and x/net #90
OCPBUGS-20536: bump library-go version #70
NE-2484: bump k8s libraries to v0.35.0 and cr to v0.23.1 #72
OCPBUGS-63449: filter ingress namespace on UnmanagedRoutes metric #71
NO-JIRA: add jcmoraisjr to owners #69
Full changelog

service-ca-operator

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #382
OCPBUGS-114426: Update build-machinery-go vendor dependency #377
OCPBUGS-84953: e2e network policy tests #353
OCPBUGS-82110: fix service-ca-controller CrashLoop on MicroShift #344
CNTRLPLANE-2845: add service-ca operator and workload network policies #324
CNTRLPLANE-2947: Enable configurable PKI for signing CA and serving certificates #327
NO-JIRA: migrate from go-bindata to embed #326
NO-JIRA: OWNERS: remove vrutkovs and add sanchezl #318
NO-JIRA:Update e2e test owners #339
NO-JIRA: Add CLAUDE.md #333
CNTRLPLANE-3038: test/e2e: migrate validatingwebhook-ca-bundle-injection to OTE serial suite #336
CNTRLPLANE-3035: test/e2e: migrate mutatingwebhook-ca-bundle-injection to OTE serial suite #335
CNTRLPLANE-3034: test/e2e: migrate crd-ca-bundle-injection to OTE serial suite #334
CNTRLPLANE-3033: test/e2e: migrate apiservice-ca-bundle-injection to OTE serial suite #332
CNTRLPLANE-3015: test/e2e: restore operator config after forced rotation #331
CNTRLPLANE-3009: test/e2e: migrate forced-ca-rotation to OTE serial-disruptive suite #330
CNTRLPLANE-3000: test/e2e: migrate time-based-ca-rotation test for OTE compatibility #308
NO-JIRA: bump Go to 1.25 and update dependencies #328
CNTRLPLANE-2549: test/e2e: add control plane stabilization wait after CA rotation #325
CNTRLPLANE-2549: test/e2e: migrate refresh-CA test for OTE compatibility #306
CNTRLPLANE-2547: test/e2e: migrate metrics tests for OTE compatibility #305
CNTRLPLANE-2537: test/e2e: migrate headless-stateful-serving-cert-secret-delete-data test for OTE compatibility #304
CNTRLPLANE-2508: test/e2e: migrate vulnerable-legacy-ca-bundle-injection-configmap test for OTE compatibility #303
CNTRLPLANE-2499: test/e2e: migrate ca-bundle-injection-configmap-update test for OTE compatibility #302
CNTRLPLANE-2498: test/e2e: migrate ca-bundle-injection-configmap test for OTE compatibility #301
CNTRLPLANE-2494: test/e2e: migrate serving-cert-secret-delete-data test for OTE compatibility #300
CNTRLPLANE-2491: test/e2e: migrate serving-cert-secret-add-data test for OTE compatibility #299
CNTRLPLANE-2490: test/e2e: migrate serving-cert-secret-modify-bad-tlsCert test for OTE compatibility #298
CNTRLPLANE-2161: test/e2e: migrate serving-cert-annotation test for OTE compatibility #297
OCPBUGS-69911: Updating ose-service-ca-operator-container image to be consistent with ART for 4.22 #296
CNTRLPLANE-2159: cmd: add OTE infrastructure and clean up legacy test extension #295
Full changelog

telemeter

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #631
Fix OCPBUGS-107725: CVE-2026-41178 #613
OCPBUGS-84021: update google.golang.org/grpc #605
OCPBUGS-84937: fix(deps): bump go-jose/v3 to v3.0.5 for JWE unwrap DoS #598
SREP-3493: update cluster:usage:workload:capacity_physical_instance_hours #581
Updating telemeter-container image to be consistent with ART for 4.22 #580
SREP-3493: deduplicate cluster:usage:control_plane:instance_hours output series #579
SREP-3493: add cluster:usage:control_plane:instance_hours #578
SREP-3493: ROSA HCP billing for control planes #577
OCPBUGS-73928: Updating telemeter-container image to be consistent with ART for 4.22 #575
NO-ISSUE: switch http_request_size_bytes to histogram #574
NO-ISSUE: support native histograms #573
NO-ISSUE: update github.com/prometheus/client_golang #572
OCPBUGS-69697: Updating telemeter-container image to be consistent with ART for 4.22 #571
Full changelog

tests

OCPBUGS-132900: Fix node replacement test timestamp filter and allow job retry #31794
OCPBUGS-84695: [TNF] Fix update-setup job discovery to limit check to active job #31467
OCPBUGS-130609: Fix pathological events #31733
OCPBUGS-85827: fix tnf monitor tests #31184
OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #31753
OCPBUGS-129079: Skip Squid proxy configuration #31702
OCPBUGS-130606: Remove NLB hairpin workaround from dual-stack test #31752
OCPBUGS-131805: pathologicalevents: fix HPA FailedGetResourceMetric allowlist #31760
OCPBUGS-130353: Stabilize TNF kernel-panic recovery test #31736
OCPBUGS-129174: Improve TNF recovery test stability: AfterEach cleanup, migration-threshold, east-west fixes #31707
OCPBUGS-128819: Make operator log scraper and monitor tests topology-aware #31695
OCPBUGS-130852: stage the creation of test pods to minimize etcd impact #31738
AGENT-1522: bump InternalReleaseImage to v1 #31687
OCPBUGS-120717: Extend image-registry single replica exception to s390x architecture #31422
OCPBUGS-115199: fix: skip MCPs with non-ready nodes during MCN property validation #31525
OCPBUGS-114438: Fix probe termination test to use pod status instead of kubelet event text #31568
OCPBUGS-115161: Raise status polling timeout and write bound #31582
OCPBUGS-115191: fix: adjusting DaemonSet test to dynamically compute expected pod count #31522
AGENT-1583: post-feature promotion (NoRegistryClusterInstall) openshift/api dependencies bump #31565
OCPBUGS-111831: tolerate one NotReady CP node in EnsureNodesReady for degraded TNF #31527
OCPBUGS-100438: retry GetVotingMemberNames on transient etcd client fails #31506
OCPBUGS-88711: Backport node_e2e test migrations #31306
AGENT-1549: Backport NoRegistryClusterInstall feature to release-4.22 #31406
SPLAT-2802: Added VVCDO OTE binary to extensionBinary list #31321
SPLAT-2794: Added 3CMO OTE binary to extensionBinary list #31303
OCPBUGS-90522: Use AdminPolicyBasedExternalRoute CR for external gateway test #31317
OCPBUGS-87838: support Parents field on origin test suites #31270
OCPBUGS-92656: bump openshift-tests-extension to fix klog stdout parsing on 4.22 #31349
OCPBUGS-92048: fix PDB AlwaysAllow test failure on IPv6-primary dualstack clusters #31337
OCPBUGS-92047: Fix AWS DualStack CI jobs consistently encounter 2 EgressFirewall Test Failures #31336
OCPBUGS-85708: Raise OpenStack operator watch limits #31183
OCPBUGS-85655: Validate no WAL corruption when both nodes shutdown gracefully #31174
OCPBUGS-85515: Verify dynamic revision bump for etcd during kernel crash #31166
OCPBUGS-85339: Add e2e tests for KubeletEnsureSecretPulledImages feature gate #31148
OCPBUGS-85089: Allow OVN-Kubernetes CIDROverlap pathological events #31141
OCPBUGS-85122: Add ArtifactVolume tests and register artifact image #31108
OCPBUGS-84944: Fix timeout in PinnedImages GC test #31115
OCPBUGS-84946: skip on BM which has insufficient host #31116
OCPBUGS-84958: Optimize NetworkPolicy reconciliation test to reduce timeout #31119
OCPBUGS-84382: Add [Late] test to collect CRI-O goroutine dumps via SIGUSR1 #31074
OCPBUGS-84382: test: add monitortest to detect pods stuck in Pending state #31073
OCPBUGS-84888: Disable particular CSI tests if CSI driver is removed #31111
OCPBUGS-84654: fix openshift/network/third-party suite selecting zero tests #31090
SREP-4676: skipping namespaces are using default sa #31101
OCPBUGS-84362, OCPBUGS-84363: fix: skip unused tests for two node #31069
OCPBUGS-84706: Skip dev fuse test on runc runtime #31099
OCPBUGS-84628: Fix project name error during wait #31085
OCPBUGS-84674: retry transient kubeconfig read failures in GetClientConfig #31096
OCPBUGS-84676: Add sleep to give cvo time to reconcile #31097
OCPBUGS-84231: Skip image-registry operator tests for Libvirt platform in upgrade jobs. #31060
OCPBUGS-84322: Fix Gateway cleanup in parallel e2e test workers #31068
OCPBUGS-84049: [CNTRLPLANE-2751]:Adding e2e network policy cases for config-operator #31076
“OCPBUGS-84206: [release-4.22] STOR-2807: Add e2e test to verify CSI driver operators use service CA signed certificates” #31048
OCPBUGS-84210: skip serial and disruptive cases from suite #31057
OCPBUGS-84319: cache kube client instance #31067
OCPBUGS-84298: Skip test case updateLifecycle if the worker pool is paused #31065
OCPBUGS-84222: OVNK BGP: Improve VRF-Lite test stability #31058
OCPBUGS-83803: Move imagepolicy test to disruptive long-running suite #31056
OCPBUGS-83783: Add test to verify for backup container exists when etcd crashes #31035
OCPBUGS-83778: Verify etc pod should start with oom_score_adj as system-node-critical #31034
OCPBUGS-83712: Use upgrades.Skippable for Gateway API upgrade test skip logic #31030
OCPBUGS-83787: OCPSTRAT-3082:TLS propagation test #31038
OCPBUGS-78997: Revert “NO-ISSUE: test/e2e/upgrade: Raise default update-ack timeout to 10m” #30919
OCPBUGS-82557: DCM tests need to be backward compatible #30999
OCPBUGS-77948, OCPBUGS-77949, OCPBUGS-78298, OCPEDGE-2443: TNF node replacement test updates #30846
NO-JIRA: Update OWNERS #30996
OCPBUGS-82046: Revert “remove some duplicate ovnk test cases” #30975
OCPBUGS-78090: Avoid copy of the oc binary, to support heterogeneous environments #30992
OCPBUGS-81340: fix pacemaker CronJob duplicate-event namespace #30985
OCPEDGE-2491: Log pcs status and etcd member list after every recovery #30949
NE-2561: Add Gateway API OLM to NO-OLM migration upgrade test #30897
OCPBUGS-81716: Add retry logic for transient network errors in restartKubeletOnNode #30966
CORENET-6168: Add ovn tests extension #30560
OCPBUGS-81640: test/ccm: upgrade ccm healthz test to use aws sdk v2 #30954
TRT-2084: terminationmessagepolicy: relax for 5.0 #30979
OCPBUGS-81340: openshift-tests: allow duplicate pacemaker status collector CronJob events #30953
OCPBUGS-81737: Dynamically find worker-generated-kubelet MC name to support different platforms #30967
OCPBUGS-81742: Add exception for the newly added kas-bootstrap-container #30963
OCPNODE-4224: Migrating test case OCP-70987 from OTP to origin #30948
OCPBUGS-82039: Fix DCM ingress tests to support IPv6-only clusters #30972
OCPBUGS-81685: OVNK BGP: fix curl arguments not properly tokenized #30961
OCPBUGS-81751: Fix GatewayClass update conflict in markTestDone #30964
NO-JIRA: Ignore extra fields #30939
NO-JIRA: fix CUDN status condition tests for new TransportAccepted condition #30958
NE-2529: add new dcm e2e tests #30926
OCPBUGS-81629: Skip NoRegistryClusterInstall feature tests if InternalReleaseImage resource was not present #30955
NO-JIRA: feat: update etcd/certrotation suite to disruptive #30947
OCPCLOUD-3215: test/ccm: add support for verifying NLB health check configuration #30952
NE-2520: Enable Gateway API tests on vSphere and baremetal #30946
SPLAT-2672: e2e/ote/ccm-aws: moving binary to cccmo #30864
OCPNODE-3725: Add System compressible test #30935
OCPCLOUD-3215: Detect IPv6 clusters and apply correct policy #30938
OCPNODE-4179: Migrating test case OCP-80983 from openshift-tests-private to origin #30899
OCPSTRAT-886: Support dual-stack LB in service disruption monitor #30936
OCPBUGS-78978: Workaround packet sniffer timeouts in BGP tests #30912
OTA-1813: Allow for alerts to fire from an e2e test #30929
AGENT-1428: Add e2e extended tests for NoRegistryClusterInstall #30941
SPLAT-2627: Added MAPA OTE entry #30808
OCPSTRAT-2728: Rebase 1.35 #30866
OCPNODE-4043: Add DRA e2e tests to run on NVIDIA GPU #30758
NE-2422: Skip Gateway API tests on dual-stack clusters #30942
NE-2131: register CIO tests extension and remove tests migrated to CIO #30911
MCO-2171: remove MCO bootimage tests from origin #30933
OCPBUGS-78617: Fix PinnedImages test should respect node taints #30913
NO-ISSUE: Make MCN degrade test stable across TechPreview and non-TechPreview #30943
TRT-2573: Show non-blocking failure message in JUnit failure output #30921
NE-2422: Add dual-stack ingress e2e tests for AWSDualStackInstall featuregate #30904
OCPNODE-4031: Add criocredentialprovider tests #30821
OCPNODE-3720: Test for AutoNodeSizing #30789
NE-2422: Fix router e2e tests for dual-stack AWS clusters #30934
STOR-2505: Add storage binaries check #30698
OCPBUGS-78940: Treat groups as existent if they were found but discovery is stale #30923
NO-JIRA: Reverting case OOM score adjustment #30932
OCPEDGE-2447: IsMicroShiftCluster: return error instead of calling Skip from container node #30914
NE-2501: Allow prometheus test pods to access Ingress Operator metrics port #30928
NO-JIRA: remove extra character #30920
OCPEDGE-2447: increase precondition cluster health timeout to 10m #30893
OCPNODE-3751: Add automated tests for kubelet LimitedSwap drop-in configuration for CNV #30795
MCO-2155: add osstream exclusion for mco bootimage tests #30918
TRT-2539: Fix output capture in ginkgo RunSpec to capture stdout/stderr #30769
NE-2498: add new DCM e2e tests #30741
NO-ISSUE: test/e2e/upgrade: Raise default update-ack timeout to 10m #30917
TRT-2506: Add OS version info to ClusterData #30827
NE-2292: Tests for gatewayAPIWithoutOLM featuregate graduation #30905
OCPEDGE-2381: Verify etc pod should start with oom_score_adj as system-node-critical #30867
NO-JIRA: remove test exception for Insights operator #30849
NE-2292: Skip OLM tests when GatewayAPIWithoutOLM enabled #30896
NO-JIRA: Remove TNF node replacement test #30901
OCPBUGS-78384: changed http to https for three places to reduce test false positives and false negatives #30872
CNTRLPLANE-2999: Revert PR #30746: TLS 1.3 test causing instability in 4.22 #30895
NO-JIRA: Add a singleton instance for list of nodes #30830
OCPNODE-3932: Add automated tests for non-CNV swap configuration #30807
OCPBUGS-78016: Fix double counting of pod restart events #30862
CNTRLPLANE-2449: test(sig-builds][Feature:Builds]): ignore watchapi.Bookmark as they are synthetic and used only for signaling sync completion #30885
OCPBUGS-77281: Add exception for GCE CSI driver images #30870
OCPBUGS-77002: Remove temporarily skip of MCO tests creating custom MCPs in RHEL10 suites #30845
CNTRLPLANE-2549: monitortests: treat Thanos collection failure as flake in disruptive suites #30877
OCPBUGS-76334: Add TLS 1.3 (Modern profile) support to TestTLSDefaults #30746
OCPNODE-4093: Update readme to include long running test information #30791
OCPBUGS-48186: Add kubelet and CRI-O panic detection invariant test #30243
OCPBUGS-38666, OCPBUGS-38750, OCPBUGS-62623: Remove DNS test exceptions #30865
OCPBUGS-77991: suppress podman build - URLs #30851
SPLAT-2672: ote/ccm-aws removing binary while migrating to CCCMO #30869
OCPBUGS-8933: run resource request/limit check early #30874
TRT-2295: admit and extract non-payload OTE binaries #30863
CORENET-6462: Remove exceptions for network operator #30842
OCPEDGE-1036: fix: latency tuning for the rt-kernel tests on AWS metal #30790
OCPBUGS-78191: Exclude disruption during NoExecuteTaintManager serial tests #30855
TRT-2506: Add OS version validation to prow job name test #30826
OCPBUGS-66419: fix: handing static pods not appearing on SNO+RT metal lanes #30608
NO-JIRA: Add condition for rejecting connection #30835
OCPBUGS-77839: Remove ‘AppliedFilesAndOS’ reference in MachineConfigNode’s node degrade test #30841
NO-ISSUE: Automated - Update synthetic test data #30844
OCPBUGS-77807: Updating openshift-enterprise-tests-container image to be consistent with ART for 4.22 #30834
OCPBUGS-77014: Add Azure OS disk metrics to cloud monitor tests #30840
CNTRLPLANE-2202: Check for debug pod (regardless of ns) in default service account monitor test #30815
CORENET-6169, CORENET-6864: remove some duplicate ovnk test cases #30820
OCPBUGS-77736: add the missing namespace from managed openshift #30828
NO-JIRA: upkeep: remove dualreplica recert #30831
OCPBUGS-76943: Fix dualstack BMC secret and BMH lookup using short name extraction #30788
TRT-2372: document the manifest-list verification in the images command #30818
NO-JIRA: add NI&D team members #30816
NO-ISSUE: Automated - Update synthetic test data #30803
TRT-2563: Revert #30647 “STOR-2560: Add testcase for readonlyrootfilesystem” #30819
OCPBUGS-77085: Use multi-architecture zstd-chunked image #30805
TRT-2545: Extend known image checker to cover openshift-must-gather-* namespaces #30777
STOR-2560: Add testcase for readonlyrootfilesystem #30647
OCPBUGS-65623: Remove exception for monitoring OLM Progression condition #30754
STOR-2857: Enable MutableCSINodeAllocatableCount tests for all clusters #30767
CCO-690: Register cloud-credential-operator tests extension #29984
NE-906: fix DCM tests #30734
NO-JIRA: Exclude KubeJobFailed for periodic-gathering jobs in openshift-insights #30810
NO-JIRA: refactor(tnf): separate precondition timeouts from recovery cluster health #30812
NO-JIRA: Fix PodSecurityViolation in set-liveness-probe cmd test #30809
OCPNODE-4092: add the whole team as reviewers for node tests #30756
CNTRLPLANE-2202: add new exceptions + fail if uncaught default sa usage is detected #30685
NO-JIRA: Fix lack of human readable timestamps in two tests output #30796
NO-JIRA: update cluster-autoscaler component #30527
OCPBUGS-77010: [TNF] fix network disruption on ipv6 #30798
TRT-2372: filter-by-os is ignored when the image isn’t a manifest-list; leading to false positives in the check #30806
NE-1476: Allow test pods to access DNS metrics ports #30753
NO-JIRA: Batch etcdlog intervals to prevent hundreds of thousands slamming browser charts #30763
TRT-2471: Create massive test failure junit #30797
Revert “ OCPNODE-3932: Add automated tests for non-CNV swap configuration” #30804
TRT-2372: check that each of the required architectures is available for each image in the images command #30799
OCPBUGS-74151: Add test for CPMS OnDelete strategy with full master replacement #30760
OCPNODE-3932: Add automated tests for non-CNV swap configuration #30794
OCPBUGS-76551: Temporarily skip MCO tests creating custom MCPS with RHEL10 machines #30793
NO-JIRA:fixing CNV’s must-gather image ci failure #30784
NO-ISSUE: Automated - Update synthetic test data #30781
NO-JIRA: Remove RouteAdvertisements feature gate check #30787
OCPNODE-4093: Readme updates for Node tests #30773
NO-JIRA: Simplify zstd:chunked image test to use prebuilt image. #30739
OCPBUGS-60853: cert tests: mark TLS registry test as informing #30585
TRT-2545: Allow pathological Failed/ImagePullBackOff events in must-gather name #30776
OCPBUGS-76327: Fix flakiness in MutableCSINodeAllocatableCount test #30766
NO-JIRA: ote: fix duplicated topology label on SingleReplica #30759
NO-ISSUE: Automated - Update synthetic test data #30694
NO-JIRA: Ignore state transitions on upgrade failures and SNO #30762
SPLAT-2337: CCM-AWS OTE binary and skips #30747
NO-JIRA: Fix discrepancies in use of failure message vs output #30752
OCPEDGE-2166: test(two-node): stablize tnf recovery suite #30716
NO-JIRA: Fix OKD featureset test as it should only run if the current featureset is Default #30757
OCPBUGS-74917, TRT-2504: Claude command to manage watch request limits, split test by operator/component #30750
TRT-2540: Revert #30657 “OCPNODE-3944: Create e2e automation in origin for case OCP-84149” #30761
CNTRLPLANE-2196: reg ote bin for cluster auth operator #30735
NO-JIRA: upkeep: add collection of errors for crio tests #30743
OCPEDGE-1484: [TNF] kubelet disruption test #30290
OKD-259: Test OKD Feature set Against OKD and OCP clusters #30693
OCPNODE-3944: Create e2e automation in origin for case OCP-84149 #30657
OCPEDGE-2355: feat: skip unsupported commatrix tests for two node #30720
OCPEDGE-2274: fix: change arbiter topology test to verify pods do not run on arbiter nodes #30737
OCPQE-31524: Add conditional SCC wait for Kubernetes compatibility #30736
Revert “SPLAT-2337: Added OTE binary for ccm-aws” #30744
SPLAT-2337: Added OTE binary for ccm-aws #30525
NO-JIRA: bump SNO marketplace-operator watch count limit #30738
OCPBUGS-73778: revert LSO networkpolicy cases #30684
STOR-2838: fix OTP AsGuestKubeconf #30721
OCPBUGS-63307: Add/RemoveSigtermProtection event matcher for SigstoreImageVerification tests #30624
TRT-2522: Update optimized builds test to use rpm -qa instead of dnf #30722
NO-JIRA: Replace OCPBUGS-20062 with OCPBUGS-65984 #30554
OCPNODE-3203: Add a test suite for kubeletconfig testing #30648
OCPBUGS-61855: Revert “Temporarily disable InstallPlanStepAppliedWithWarnings alert for k8s 1.34 rebase” #30559
NO-ISSUE: Update boot image manifests for skew API #30712
NE-2376: Remove restriction of unmanaged x-k8s.io #30658
OCPBUGS-74237: Update MCN tests to better handle condition transitions through the “Unknown” state #30705
OTA-1681: remove etcd exceptions #30688
OCPBUGS-74280: Add filter for openshift-copy-to-node ns #30713
OCPBUGS-62929: Check router RBAC before external cert ops #30395
OCPCLOUD-3351: monitortest: add crdversionchecker #30603
OCPBUGS-65674: VsphereConfigurationTestsRollOutTooOften event matcher should use broader regex #30654
OCPSTRAT-2728: add images required for the 1.35 rebase (temporary) #30687
NO-JIRA: Remove exceptions for storage operators #30677
NO-ISSUE: Allow test to tolerate running on minimal images #30695
TRT-2483: feat(ginkgo): add monitor tests to extension test result output #30678
NO-JIRA: Update Networking team lead #30301
OCPEDGE-2303: update test logic for degraded cluster run #30649
NO-JIRA: CO must go Progressing during a minor-level upgrade #30626
OCPBUGS-39026: Remove exception for monitoring operator going degraded during upgrade #30012
NO-JIRA: Fix Pod.Create() to use –local flag for template processing #30686
OCPEDGE-1788: TNF add etcd cold boot recovery tests from graceful node shutdown #30519
NO-JIRA: Replace OCPBUGS-38667 with OCPBUGS-66225 #30551
OCPEDGE-2304: adjust olm test to pass on a degraded run #30664
OCPBUGS-72547: Isolate and reduce parallelism for OrderedNamespaceDeletion tests. #30672
OCPNODE-3823: Migrating test case from Openshift-test-private to origin #30512
NO-JIRA: add the intervals bucket for Netpol tests #30679
NO-ISSUE: Update synthetic test data #30680
NO-JIRA: Remove exceptions for co/machine-config on Available=False #30550
CNTRLPLANE-2167: Add oc-tests-ext to extension binaries #30653
OCPBUGS-69676: update watch request limits for cluster-autoscaler-operator #30656
NO-JIRA: Remove the exception for CO/console’s Available=False #30553
Revert “CNF-18661: add a skip on the commatrix test for the unsupported topology by commatrix” #30670
NO-ISSUE: Fix the PinnedImage test to set imageMinimumGCAge to 1s #30645
OCPBUGS-70170: change iperf2 test to serial from parallel #30671
NO-JIRA: register cluster-node-tuning-operator-test-ext the binary to origin for OTE migration #30598
NE-2056: auto negative tests of gatewayapicontroller #30599
NO-JIRA: Add more output for debegging #30583
NO-JIRA: Skip a ClusterOperator test if a cluster upgrade is blocked #30558
NO-JIRA: Track the total kubelet metrics outage durations with autodl framework #30593
NO-JIRA: Add images that shouldn’t be mirrored to the exception list. #30652
OCPBUGS-66225: Add more exceptions for CO/image-registry’s Degraded=True #30581
OCPBUGS-66065: remove duplicated events before processing lease intervals #30639
OCPBUGS-57665: only run Netpol two at a time #30618
OCPBUGS-70249: Unrevert tls tests with fixes #30536
OCPBUGS-70065: Updating openshift-enterprise-tests-container image to be consistent with ART for 4.22 #30636
OCPBUGS-69400: Ignore repeated TopologyAwareHintsDisabled events #30614
CNF-18661: add a skip on the commatrix test for the unsupported topology by commatrix #30640
CNTRLPLANE-2167: Migrate must-gather cases to origin #30594
NO-JIRA: Remove DennisPeriquet from OWNERS #30650
OCPSTRAT-2728: Update etcd test data for k8s 1.35 release #30605
OCPBUGS-67313: Fix race condition in external binary extraction #30616
OCPBUGS-70134: Fix JSONL parsing to handle stray JSON in test output #30634
TRT-2394: Detect duplicate tests #30498
CNTRLPLANE-947: E2E test adaptations for OIDC #30292
TRT-2418: Add CPU metrics autodl #30609
NO-JIRA: feat: render OTE JSON results in spyglass #30619
NO-JIRA: Increase tolerance of CO’s not reporting Progressing #30602
MCO-2006: move node-filecycle monitor to default #30592
NO-ISSUE: Two more COs report Available=False in a non-upgrade job #30588
CNTRLPLANE-1437: add monitor test for checking default service account in pods (static test name) #30561
NO-JIRA: feat(monitor): track test bucket execution intervals #30615
STOR-2550: add LSO network policy test case #30562
OCPBUGS-63618: BeforeEach was indirectly called in DetermineReleasePayloadImage #30610
CNTRLPLANE-1683: added the OTE binary for cluster-image-registry-operator #30612
OCPBUGS-67211: exculude Flaky tests for openshift/csi test suite #30597
OCPBUGS-65674: VsphereConfigurationTestsRollOutTooOften event matcher should match also dep and ds events #30547
NO-JIRA: Allow group snapshot tests to be re-tried #30607
OCPNODE-3780: Add e2e tests to validate DRA APIs #30462
And 4 elided commits (e.g. from squash or rebase merges)
Full changelog

thanos

OCPBUGS-129058: Bump github.com/klauspost/compress to fix CVE-2026-63209 #228
OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #222
fix for OCPBUGS-107709: CVE-2026-41178 #202
OCPBUGS-105471: UPSTREAM: <carry>: bump google.golang.org/grpc to v1.82.1 (GHSA-hrxh-6v49-42gf) #199
COO-2034, OCPBUGS-105219, OCPBUGS-105223, OCPBUGS-105224: [release-4.22] vendor: bump vulnerable Go dependencies for GovCloud CVE remediation #197
OCPBUGS-96898: Address CVE-2026-39882 #192
OCPBUGS-92813: Fix CVE-2026-39883 #191
OCPBUGS-81494: CVE-2026-33186 openshift4/ose-thanos-rhel9: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation #179
NO-JIRA: Bump to v0.41.0 #173
NO-JIRA: Disable default coderabbit reviews #171
OCPBUGS-77547: Updating ose-thanos-container image to be consistent with ART for 4.22 #170
OCPBUGS-69738: Updating ose-thanos-container image to be consistent with ART for 4.22 #166
Full changelog

volume-data-source-validator

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #25
OCPBUGS-102040: Bump golang.org/x/net to version 0.57.0 that fixes CVE-2026-33814 #19
STOR-2750: Rebase to upstream v1.6.0 for OCP 4.22 #9
OCPBUGS-69897: Updating volume-data-source-validator-container image to be consistent with ART for 4.22 #8
Full changelog

vsphere-cloud-controller-manager

OCPBUGS-123142: Bump Go builder to 1.26 and protobuf to v1.36.12 #142
OCPBUGS-102043: Bump golang.org/x/net to v0.53.0 in 4.22 #131
NO-JIRA: Merge https://github.com/kubernetes/cloud-provider-vsphere:release-1.35 (93af0f7) into main #113
OCPCLOUD-3275: Merge https://github.com/kubernetes/cloud-provider-vsphere:master (499b4a3) into main #101
Updating ose-vsphere-cloud-controller-manager-container image to be consistent with ART for 4.22 #102
Full changelog

vsphere-cluster-api-controllers

OCPBUGS-123142: Bump Go builder to 1.26 and protobuf to v1.36.12 #130
OCPBUGS-102045: Bump golang.org/x/net to v0.53.0 for CVE-2026-33814 [release-4.22] #128
OCPBUGS-84028: Merge https://github.com/kubernetes-sigs/cluster-api-provider-vsphere:v1.15.3 (e917f8e) into release-4.22 #108
OCPCLOUD-3295: Merge https://github.com/kubernetes-sigs/cluster-api-provider-vsphere:v1.15.2 (91522fc) into master #79
OCPCLOUD-3323: Update to new manifests-gen #82
OCPBUGS-69861: Updating ose-vsphere-cluster-api-controllers-container image to be consistent with ART for 4.22 #81
NO-JIRA: UPSTREAM: <carry>: Add manifests verify target #80
Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #222
UPSTREAM: 187: OCPBUGS-96686: Bump golang.org/x/net to v0.50.0-sec.4 #195
OCPBUGS-95573: Bump golang.org/x/crypto/ssh to v0.48.0-sec.1 #189
OCPBUGS-92190: Rebase 3.6.2 on 422 #188
OCPBUGS-83636: Bump spdystream to v0.5.1 #180
OCPBUGS-81525: Bump google.golang.org/grpc to 1.79.3 #170
OCPBUGS-77563: Updating ose-vmware-vsphere-csi-driver-container image to be consistent with ART for 4.22 #164
Updating vmware-vsphere-syncer-container image to be consistent with ART for 4.22 #165
OCPBUGS-69760: Updating vmware-vsphere-syncer-container image to be consistent with ART for 4.22 #153
OCPBUGS-69746: Updating ose-vmware-vsphere-csi-driver-container image to be consistent with ART for 4.22 #152
Full changelog

vsphere-csi-driver-operator

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #372
OCPBUGS-102036: Bump golang.org/x/net to v0.53.0 #352
SPLAT-2802: Port vSphere hybrid OTE to release-4.22 #349
STOR-2762: Bump all deps for 4.22 #334
STOR-2882: add feature gate for checking platform type is vsphere #331
OCPBUGS-77629: Updating ose-vmware-vsphere-csi-driver-operator-container image to be consistent with ART for 4.22 #333
OCPBUGS-74225: Bump library-go #328
OCPBUGS-74206: fix snapshot config non-deterministic ordering #329
STOR-2840: Declare RWX capability explicitly #324
STOR-2852: Enable snapshot tests for vsphere #321
OCPBUGS-69924: Updating ose-vmware-vsphere-csi-driver-operator-container image to be consistent with ART for 4.22 #320
OCPBUGS-66113: Some containers do not have readOnlyRootFilesystem #319
Full changelog

vsphere-problem-detector

OCPBUGS-123142: Bump Go to 1.26 and protobuf to v1.36.12 #250
OCPBUGS-105280: Fixed GetVCenter to handle removed FDs better #228
OCPBUGS-102050: Bump golang.org/x/net to 0.53.0 #229
OCPBUGS-86866: Fixed compute cluster permission logic for single fd with read-only custom resourcepool #221
STOR-2762: Bump all deps for 4.22 #214
OCPBUGS-77603: Updating ose-vsphere-problem-detector-container image to be consistent with ART for 4.22 #213
OCPBUGS-74989: GetVCenterHostnames lacks lock protection causing potential data race #209
OCPBUGS-70365: fix concurrent map writes #206
OCPBUGS-69856: Updating ose-vsphere-problem-detector-container image to be consistent with ART for 4.22 #199
Full changelog

Node Image Info

Loading node image info, this may take a while ...

Unable to show node image info: failed to fetch RPM diff for stream rhel-coreos-10: could not generate RPM diff for quay-proxy.ci.openshift.org/openshift/ci@sha256:1cb3a1640f0069e760c358af6ead7f5dcdebc605aa9ef4c148b87b195a798a0d to quay-proxy.ci.openshift.org/openshift/ci@sha256:091e5599fbcd8119d7e77201229d36550e7565345f326d24aac4bb1d55472421 (rpmdb-image rhel-coreos-10): could not run oc command: error: unable to parse image quay-proxy.ci.openshift.org/openshift/ci@sha256:091e5599fbcd8119d7e77201229d36550e7565345f326d24aac4bb1d55472421: cannot retrieve image configuration for manifest sha256:091e5599fbcd8119d7e77201229d36550e7565345f326d24aac4bb1d55472421: received unexpected HTTP status: 500 Internal Server Error

View changelog in Markdown or change previous release:

Source code for this page located on github