Back to index
4.10.38
Download the installer for your operating system or run
oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.10.38-x86_64
Tests:
- Blocking jobs
- Informing jobs
Upgrades from:
Untested upgrades:
4.10.10,
4.10.11,
4.10.12,
4.10.13,
4.10.14,
4.10.15,
4.10.16,
4.10.17,
4.10.18,
4.10.21,
4.10.22,
4.10.23,
4.10.24,
4.10.25,
4.10.26,
4.10.27,
4.10.28,
4.10.29,
4.10.31,
4.10.32,
4.10.33,
4.10.34,
4.10.7,
4.10.8,
4.10.9,
4.9.23,
4.9.25,
4.9.26,
4.9.27,
4.9.28,
4.9.29,
4.9.30,
4.9.31,
4.9.32,
4.9.33,
4.9.34,
4.9.35,
4.9.36,
4.9.37,
4.9.38,
4.9.39,
4.9.41,
4.9.42,
4.9.43,
4.9.45,
4.9.46,
4.9.47Upgrades to:
Loading changelog, this may take a while ...
Changes from 4.10.5
Created: 2022-10-19 10:14:55 +0000 UTC
Image Digest: sha256:50d7ee7fe5aa9a8900cce799868be7d2a504c796a6a999089c9bd56b14ccef97
Release 4.10.38 was created from registry.ci.openshift.org/ocp/release:4.10.0-0.nightly-2022-10-17-082154
Components
Removed images
- cluster-capi-controllers
- cluster-capi-operator
Rebuilt images without code change
- Updating ose-alibaba-machine-controllers images to be consistent with ART #23
- Full changelog
- BUG 2094051: Fix removing custom created service in openshift-ingress with same naming convention #820
- Bug 2079034: Add allowPrivilegeEscalation to the router container #748
- Bug 2097735: Fix loadBalancerServiceAnnotationsChanged check and update #784
- Bug 2100630: Fix flakey logic in haproxy timeout tests #792
- Bug 2082161: Delete LoadBalancer-type service finalizer logic #755
- BUG 2063283: Disable keepalive for canary probe #719
- Bug 2059210: Set Upgradeable=False if default cert has no SAN #710
- Full changelog
- Updating ose-cluster-kube-storage-version-migrator-operator images to be consistent with ART #65
- Full changelog
- e2e: check for tsc=reliable instead of tsc=nowatchdog (#428) #428
- Ignore Profile updates triggered by old operands (#357) #357
- Full changelog
- [release 4.10] Bug 2109235: openshift-apiserver pods never going NotReady #501
- Full changelog
- OCPBUGS-2142: Rebase openshift/etcd 4.10 onto 3.5.5 #156
- Update OWNERS #123
- Bug 2077498: Merge Upstream etcd 3.5.3 into Openshift 4.10 #118
- fix the flaky test TestV3AuthRestartMember #14454
- server: don’t panic in readonly serializable txn #14178
- etcdctl: allow move-leader to connect to multiple endpoints #14434
- testing: fix TestOpenWithMaxIndex cleanup #14440
- server/etcdmain: add build support for Apple M1 #14436
- server,test: refresh cache on each NewAuthStore #14409
- Fix corruption checks v3.5 #14282
- Move consistent_index forward when executing alarmList operation #14429
- fix the potential data loss for clusters with only one member #14424
- Backport of pull/14354 to release-3.5 #14397
- Refactor the keepAliveListener and keepAliveConn #14366
- clientv3: close streams after use in lessor keepAliveOnce method #14361
- etcdserver: bump OpenTelemetry to 1.0.1 and gRPC to 1.41.0 #14312
- Change default sampling rate from 100% to 0% #14318
- server/auth: protect rangePermCache with a RW lock #14227
- clientv3: Fix parsing of ETCD_CLIENT_DEBUG #14222
- Support configuring
MaxConcurrentStreams for http2 #14219
- Automated cherry pick of #14182 #14187
- client/v3: do not overwrite authTokenBundle on dial #14132
- Restrict the max size of each WAL entry to the remaining size of the WAL file #14127
- Backport two lease related bug fixes to 3.5 #14087
- scripts: Avoid additional repo clone #14050
- Test release scripts #14043
- [backport 3.5]: server/auth: enable tokenProvider if recoved store enables auth #13205
- Update golang.org/x/crypto to latest #13996
- Update consitent_index when applying fails #13946
- Revert #13714 #13950
- PR 13923 to release-3.5 #13938
- Dockerfile*: Switch baseimage to k8s hosted one #13862
- Set backend to cindex before recovering the lessor in applySnapshot #13933
- Support linearizable renew lease #13932
- clientv3: filter learners members during autosync #13917
- etcdserver: upgrade the golang.org/x/crypto dependency #13669
- Fix the data inconsistency issue by adding a txPostLockHook into the backend #13908
- server: Save consistency index and term to backend even when they decrease #13904
- go.mod: Upgrade to prometheus/client_golang v1.11.1 #13895
- server: Add verification of whether lock was called within out outsid… #13887
- Fix inconsistent log format #13866
- Makefile: Fix wrong target #13858
- Update go to 1.16.15 #13832
- Fix offline defrag in etcdctl #13792
- backport 3.5: #13676 load all leases from backend #13726
- server/storage/backend: restore original bolt db options after defrag #13701
- Always print raft term in decimal when displaying member list in json #13727
- *: fix IsOptsWithFromKey #13736
- enhance health check endpoint to support serializable request #13706
- Trim the suffix dot from the srv.Target for etcd-client DNS lookup #13714
- Update dep: gopkg.in/yaml.v2 v2.2.8 -> v2.4.0 due to: CVE-2019-11254 [release 3.5] #13616
- Backport watchablestore runlock bug fix to release-3.5 #13541
- Set the backend again after recovering v3 backend from snapshot #13501
- Backport Lease Checkpoints fix to release-3.5 #13515
- Backport PR 13308 to release-3.5 #13477
- cherry-pick to 3.5 from #13467 exclude the same alarm type activated by multiple peers #13476
- storage/backend: Add a gauge to indicate if defrag is active (backport) #13395
- Dockerfile: bump debian bullseye-20210927 #13380
- Cherry pick “Fix http2 authority header in single endpoint scenario” to release-3.5 #13375
- Fix for v3.5 Ensure that cluster members stored in v2store and backend are in sync #13348
- Stop using tip golang version in CI #13349
- [backport 3.5]: Automated cherry pick of #13145 #13237 #13257
- Full changelog
- Bug 2101326: bump to k8s 1.23.12 #1382
- Automated cherry pick of #112299: Reduce default gzip compression level from 4 to 1 in #112400
- Automated cherry pick of #112526: Limit redirect proxy handling to redirected responses #112529
- Automated cherry pick of #112508: kubeadm: allow RSA and ECDSA format keys in preflight check #112536
- Automated cherry pick of #111205: Fix problem in updating VolumeAttached in node status #112303
- Automated cherry pick of #112193: Add an option for aggregator #112358
- Automated cherry pick of #112017: exec auth: support TLS config caching #112338
- Automated cherry pick of #110951: fix nestedPendingOperations mount and umount parallel bug #112102
- Automated cherry pick of #110179: Prune defaults for CRD serving #110578
- Automated cherry pick of #111009: Windows: ensure runAsNonRoot does case-insensitive comparison #112212
- Automated cherry pick of #111999: fix error type #112140
- Automated cherry pick of #107025: Remove AttachID matching from Detach #111952
- Automated cherry pick of #112183: Tolerate sub-microsecond eventTime changes on update #112188
- Automated cherry pick of #112150: Improve kubectl display of invalid errors #112156
- Automated cherry pick of #108146: Fixing logic for kubelet permissions check on windows #111079
- Automated cherry pick of #111773: fix a memory leak problem when calling DryRunPreemption #111804
- Automated cherry pick of #111235: fix a possible panic because of taking the address of nil #111273
- Automated cherry pick of #110140: Fixing issue in generatePodSandboxWindowsConfig for #110965
- Automated cherry pick of #108593: tests: Updates the should delete a collection of pods test #109789
- Automated cherry pick of #111141: Fix kubelet panic when accessing metrics/resource endpoint #111164
- Automated cherry pick of #110075: Add retry logic for Unix Domain sockets on Windows #110934
- Automated cherry pick of #111477: Share a single etcd3 client logger across all clients #111649
- Automated cherry pick of #111721: Fix deleting UIDs tracking expectations #111723
- Automated cherry pick of #110813: Ensure the dir of –audit-log-path exists #111226
- Automated cherry pick of #111646: Fix JobTrackingWithFinalizers when a pod succeeds after the #111665
- Update Go to 1.17.13 #111640
- Update Go to 1.17.12 #111465
- kubeadm: fix the bug that configurable KubernetesVersion not respected during kubeadm join #111022
- Automated cherry pick of #111026: Do not skip job requeue in conflict error #111038
- [release-1.23 cherrypick] Bump cAdvisor to v0.43.1 #111013
- Hotfix: filter out unsatisfied nodes when calling AddPod in PodTopologySpread #110853
- Cherry pick of #110294 GIT-110239: fix activeDeadlineSeconds enforcement bug #110545
- Automated cherry pick of #107631: Avoid updating Services with stale specs Fix the bug that #109358
- Automated cherry pick of #110523: fix image pulling failure when IMDS is unavailalbe in kubelet #110555
- Automated cherry pick of #110791: kubeadm: fix the bug that configurable KubernetesVersion not #110909
- Automated cherry pick of #110408: apiserver: printers should use int64 #110602
- Automated cherry pick of #110469: add missing error handling steps #110577
- Automated cherry pick of #109124: Winkernel proxier cache HNS data to improve syncProxyRules #110702
- Automated cherry pick of #110652: fix: –chunk-size with selector returns missing result #110757
- Automated cherry pick of #108284: fix: exclude non-ready nodes and deleted nodes from azure #109932
- Revert “Automated cherry pick of #109124: Winkernel proxier cache HNS data to improve syncProxyRules” #110585
- Automated cherry pick of #108078: Skip updating Endpoints and EndpointSlice if no relevant #108879
- Automated cherry pick of #109624: Ignore EndpointSlices that are already marked for deletion #110483
- Automated cherry pick of #110256: kubelet: Mark ready condition as false explicitly for terminal pods #110480
- Automated cherry pick of #110145: fix audit union loop variables in closures #110275
- Automated cherry pick of #109124: Winkernel proxier cache HNS data to improve syncProxyRules #109981
- ipvs: fix prevent concurrent map read and map write for 1.23 #110322
- Automated cherry pick of #109987: Fix resizing of ephemeral volumes #110118
- Automated cherry pick of #110191: kubelet: Pod probes should be handled by pod worker #110417
- Update Go to 1.17.11 #110423
- Automated cherry pick of #107402: Reject proxy requests to 0.0.0.0 as well #110361
- Automated cherry pick of #110255: Endpoints and EndpointSlices should not publish IPs for terminal pods #110259
- Automated cherry pick of #109103: cpu manager policy set to none, no one remove container id #109156
- Backport of #106539: Replace url label in rest client latency metrics by host and path #109699
- Automated cherry pick of #110009: Fix requests scope classification #110091
- Automated cherry pick of #109969: authn: fix cache mutation by AuthenticatedGroupAdder #110005
- Automated cherry pick of #109858: GCE: skip updating and deleting external loadbalancers if #110002
- Automated cherry pick of #109947: Wait for cache to sync in job’s TestWatchOrphanPods #109980
- Update Go to 1.17.10 #110045
- Automated cherry pick of #109836: Fix OpenAPI loading error caused by empty APIService #109867
- Disable JobTrackingWithFinalizers due to unresolved bug #109491
- Automated cherry pick of #108107: kubelet apiserver: be gentle closing connections on #109381
- Automated cherry pick of #109486: Integration test for backoff limit and finalizers #109788
- Automated cherry pick of #108613: Fix a bug that out-of-tree plugin is misplaced when using #108890
- Automated cherry pick of #108429: Allow KUBE_TEST_REPO_LIST to be a remote url as well #109512
- Automated cherry pick of #108553: fix: race detected in TestErrConnKilled #109257
- Automated cherry pick of #106969: kubectl: fix hard-coded value in zsh completion #109235
- Automated cherry pick of #109074: kubeadm: add etcd flag for member data consistency #109075
- Automated cherry pick of #109442: Correct event registration for multiple scheduler plugins. #109446
- Automated cherry pick of #108496: iptables: remove port opener #108885
- Automated cherry pick of #108000: azure_file: add namespace tests for InTree to CSI #108600
- Update Go to 1.17.9 #109462
- Automated cherry pick of #109188 upstream release 1.23 #109216
- Automated cherry pick of #108752: Fix: Clean job tracking finalizer from orphan pods #109020
- Automated cherry pick of #109245: Fix: abort nominating a pod that was already scheduled to a #109246
- Fix non-enum CSR condition field, omit enums from static openapi snapshot #109179
- Adjust tests to pass for both client-side and server-side validation #109041
- Automated cherry pick of #108639: unmark non-validated types as enums. #108740
- Cherry pick 108772 #108791
- Automated cherry pick of #109137 upstream release 1.23 #109159
- Automated cherry pick of #107845: kubelet: If the container status is created, we are waiting #108882
- Automated cherry pick of #108455: Copy request in timeout handler #109015
- Automated cherry pick of #108928: kube-up: use registry.k8s.io for containerd-related jobs #108943
- Automated cherry pick of #107763: e2e: Wait for kube-root-ca.crt to be created #108860
- Move kubelet secret and configmap manager calls to sync_Pod functions #108756
- Automated cherry pick of #108366 (release-1.23): Delay writing a terminal phase until the pod is terminated #108723
- OCPBUGS-1266: UPSTREAM: <carry>: Remove reserved CPUs from default set #1362
- Bug 2106414: UPSTREAM: 109103: cpu/memory manager containerMap memory leak #1318
- Bug 2103381: UPSTREAM: <carry>: update list of deprecated apis #1306
- Bug 2104928: UPSTREAM: 109932: fix: exclude non-ready nodes and deleted nodes from azure load balancers #1263
- Bug 2067464: Backport 107821 and 107831 #1241
- Bug 2075831: UPSTREAM: 109487: Disable JobTrackingWithFinalizers due to unresolved… #1244
- Bug 2074094: UPSTREAM: <carry>: An APIRequestCount without dots in the name can cause a panic #1237
- Bug 2069311: UPSTREAM: <carry>: use hardcoded rest mapper from library-go #1231
- Bug 2065774: Backport 108723 OutofCpu Fixes #1221
- Bug 2065620: Rebase 1.23.5 #1220
- Automated cherry pick of #108631: Remove apf_fd from httplog #108634
- Update Go to 1.17.8 #108559
- Bump konnectivity-client@v0.0.30 #108438
- Automated cherry pick of #107131: Fix default config flags #108401
- Automated cherry pick of #108410: fix dryrun when ca file exists #108469
- Automated cherry pick of #107121: fix regression introduced by PR 100320 #108465
- Automated cherry pick of #107764: wrap error from RunCordonOrUncordon #107938
- Automated cherry pick of #107413: kube-proxy: fix duplicate port opening #108294
- Automated cherry pick of #107997: cronjob_controllerv2: do not filter jobs to be reconciled by #108306
- Automated cherry pick of #108209: increase Azure ACR credential provider timeout #108226
- Automated cherry pick of #108149: fix: do not return early in the node informer when there is #108177
- Automated cherry pick of #108167: Fix nodes volumesAttached status not updated #108461
- Automated cherry pick of #108002: kubeadm: fix the bug that ‘kubeadm init –dry-run #108120
- test/e2e/framework: include the new control plane taint for “–non-blocking-taints” #108336
- /test/e2e_kubeadm: adjust label / taint checks for 1.23 #108170
- Automated cherry pick of #108127: test/e2e_kubeadm: fix matching UnversionedKubeletConfigMap #108128
- Automated cherry pick of #107900: Add an e2e test for updating a static pod while it #107931
- Automated cherry pick of #108198: Updating EndpointSlice strategy to retain node name in #108201
- Automated cherry pick of #108138: Revert v1beta1 PodDisruptionBudget select patchStrategy #108139
- Automated cherry pick of #107670: Ignore container notfound error while getPodstatuses #108164
- Automated cherry pick of #107789: Mark device as uncertain if unmount device succeeds #107791
- Update Go to 1.17.7 #108100
- Automated cherry pick of #107575: fix: azurefile volumeid conflict in csi migration #107850
- Automated cherry pick of #106715: set secondary address on host-network pods #107988
- Automated cherry pick of #107970: Make JSON schema round tripping test more strict #108030
- Automated cherry pick of #107956: Deeply copy JSONSchemaProps.XValidations. #107968
- Automated cherry pick of #107786: Revert “Fix comparison between FQDN and hostname” #107902
- Automated cherry pick of #107847: service REST: Call Decorator(old) on update path #107875
- Automated cherry pick of #106280: Set max results if its not set #107651
- Automated cherry pick of #107695: kubelet: fix podstatus not containing pod full name #107761
- Full changelog
- Use non-strict mode when parsing global config #1619
- adopt existing immutable selectors to prevent errors reconciling components from roks toolkit clusters #1571
- cache registry files #1567
- feat(oauth): allow challenge override for OpenID #1543
- Add fallback set cache value from old token #1531
- Set Recommended Leader Election Values #1507
- feat(cpo): Support disable profiling annotation #1501
- Use ImagePullPolicyIfNotPresent for HO #1483
- Updated secret permissions to conform to kubernetes CIS benchmark #1480
- Ensure that everything uses imagePullPolicy IfNotPResent for resiliency #1475
- Add missing control plane prometheus rules #1471
- Ensure cache is set during token rotation before reconciling #1461
- Fix(cpo): Propagate TLS security profile config to kube-controller-manager and kube-scheduler #1416
- feat(cpo): adhere to upgrade order from kube version skew policy #1410
- Set shutdown params to improve graceful shutdown #1387
- fix(cpo): Scope down secrets access for olm collect profiles cj #1378
- move to ga apis for all components now that management clusters at minimum release boundary #1361
- configure cipher suites to prevent using medium strength ssl ciphers #1359
- Use apiserver host/port from InfraStatus in reconciling Kube API Server #1333
- Ignition server: Actually use workdir #1317
- Use forked processes instead of pods to generate ignition payload #1311
- disable reconcile of registry config in IBMCloud deployments #1309
- feat(cpo): Disable PodSecurity for 4.10 #1289
- Disable PodSecurity admission in 4.11 as it breaks conformance #1286
- Expose a service account signing key in the API #1265
- release-4.10 - Create valid route names with long namespace names #1252
- Fast-Forward from main #1233
- e2e: Don’t enable user workload monitoring on management clusters #1231
- Fix priority class for olm cronjob and verify priorityclasses in e2e #1226
- e2e: Don’t fail test on transient recoverable API lookup #1230
- Hypershift operator: Give a priority that is higher than any controlplane component #1229
- Get autoscaler/machine-approver images from the payload #1090
- Document KubeVirt Platform Ingress Setup #1213
- AntiAffinity rules to spread KubeVirt VMs across mgmt nodes #1218
- Retry EIP tagging failures during infra creation #1219
- Fix CPO to work with 4.11 #1217
- read apiserver-network-proxy image from ocp payload #1215
- Add support for AdditionalTrustBundle #972
- docs for DNS indirection #1208
- docs: Upgrade mkdocs/material to fix Netlify breakages #1212
- Dump: Always create an archive #1204
- Update staticcheck to a version that works with go 1.18 #1207
- Unique OpenShift vxlan port for KubeVirt Platform #1206
- Registry configuration: reconcile only what we need to changes #1202
- enable external-dns registry #1198
- sync MaxConcurrentReconciles across all controllers #1199
- add external-dns flags to CI install make target #1163
- KAS: Set proxy, but exempt pod and service CIDR #1200
- HO: Don’t report NotFund for hostedcluster as error #1192
- Forward from main #1190
- Revert “PKI: Use ECDSA keys by default” #1195
- add required-api to availablity prober for OLM and HCCO #1193
- Trigger reconcile when paused time is up #1184
- Fix
ko entries and update ignition-server dev docs #1191
- Converge helper binaries and ignition-server into CPO binary #1169
- KAS: Never set proxy #1187
- fix AWS HostedCluster fixture to set hostname in alignment with endpointAccess #1188
- Use patch instead of update when updating HCP status and finalizers #1186
- Introduce
OIDCConfigurationInvalid condition for OIDC setup validation #1180
- e2e: adjust budgets #1183
- Fix OLM container restart flakes in CI #1185
- Make clusterID optional in HostedControlPlane clusterID #1179
- Hypershift-operator: Increase worker count #1181
- Forward from main #1178
- Add ClusterID to HostedCluster #1151
- Remove CAPI-provider-agent ClusterRole from hypershift Agent platform #1162
- Fix typo in how to pause reconciliation doc #1174
- Update release-4.10 branch with latest from main #1173
- Ensure that all control plane pods use the cluster’s pull secret #1172
- PKI: Use ECDSA keys by default #1167
- dev: specify a more useful
ko base image #1165
- Unify hypershift install make targets #1171
- Run unitests with racedetector and -count=25 to detect flakes #1166
- Dump: Dump guest cluster nodes #1170
- Add proxy support #1157
- Resources: Improve runtime of test #1168
- ensure token minter, socks proxy, and availablity prober are versioned with the control plane operator to prevent large scale restarts on hypershift operator upgrades for IBM Cloud #1164
- add clusterid label to admin kubeconfig secret #1154
- Fix events message unit test flake #1161
- Switching KubeVirt platform’s default ingress to NodePort #1150
- Update release-4.10 branch with latest from main #1160
- e2e: support dns indirection #1149
- Surface cloud error conditions for HostedCluster resources #1135
- feat(cpo): Support OLM catalog placement #1139
- Allow overriding images at the hypershift operator level #1155
- Remove capi-provider-agent role from hypershift management #1153
- Restructure how-to docs to categorise per platform #1147
- Alow hypershift operator to grant RBAC permissions to the cpai-provider-agent #1152
- Enable DNS indirection to control plane endpoints #1145
- Forward from main #1148
- Validate that agent namespace exists #1138
- Agent: each hostedcluster provider should have it’s own role and role binding in the agent namespace #1137
- Documented howto BM agent/none #1079
- prevent privilege esclation by explicitly not allowing the escalate and bind verbs with rbac on the control plane operator #1136
- Run the konnektivity agent DS with hostnetwork #1142
- Azure: Fix image name to match what HPO expects #1141
- Rename variable for machineconfig and pretty print message #1140
- add konnectivity proxy sidecar to ingress-operator to ensure it can properly perform in cluster canary healthchecks #1131
- Azure: Add multi-AZ support #1127
- Azure: Stop logging errors during role assignment retry #1120
- Azure: Use an apiserver port that ends with 443 to make conformance tests happy #1133
- Give control-plane-operator access to the pull secret #1132
- add https prefix for proper redirects of console url #1129
- Move oidc configmap management back into install command #1128
- fix dns crd reconciliation for ibm cloud or providers that provide a subdomain #1123
- Fix create nodepool azure command #1118
- Azure: Fix credentials log #1126
- Updated secret permissions to 416 #1124
- Add missing readiness probes on HA deployments #1106
- Fix type in azurecluser for Private DNS name #1119
- Azure: Make the rootdisksize on nodepool configurable #1097
- Full changelog
- helm upgrades and uninstalls backport 4.10 (#663) #663
- OCPBUGS-251 Gather status of the cephclusters.ceph.rook.io resources (#659) #659
- Backport console helm installs to 4.10 (#638) #638
- Bug 2081844: Fix the clusteroperator conditions values when IO is (#619) #619
- Bug 2079318: Remove PSP gatherer (#608) (#615) #608
- Bug 2072848: Gather namespace names with overlapping UIDs (#605) #605
- Gather some error messages from the kube-controller-manager containers (#598) #598
- Full changelog
- Bug 2084289: Bumps net-attach-def client library (for CNI v1.0 IP compatibility) [backport 4.10] #128
- Updating multus-cni images to be consistent with ART #110
- Full changelog
- Updating ose-network-metrics-daemon images to be consistent with ART (#40) #40
- Fix field selector (#50) #50
- Added METRIC_TEST_IMAGE var (#47) #47
- Full changelog
- Bug 2075051: [release-4.10] fix: adds handling for channel with different prefixes in cincinnati.go (#413) #413
- build(deps): bump operator-registry dep to v1.21.1 (#390) #390
- Bug 2064901: fix(associations): modifies association return values to allows image… (#359) #359
- Bug 2065500: resolves multiple channel heads in merged catalogs (#372) #372
- chore: adds dynamic version info for version command with ldflags (#328) (#334) #328
- Full changelog
Source code for this page located on github