4.15.60

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.15.60-x86_64

Team Approvals:

Tests:

Blocking jobs
- upgrade Succeeded periodic-ci-openshift-release-master-stable-4.y-e2e-aws-ovn-upgrade
- upgrade-minor Succeeded periodic-ci-openshift-release-master-stable-4.y-e2e-aws-ovn-upgrade
Informing jobs
- aws-ovn-serial Succeeded periodic-ci-openshift-release-master-nightly-4.15-e2e-aws-ovn-serial
- aws-ovn-upgrade-micro Succeeded periodic-ci-openshift-release-master-ci-4.15-e2e-aws-ovn-upgrade
- aws-sdn-upgrade-4.15-micro Succeeded (2 retries) periodic-ci-openshift-release-master-nightly-4.15-e2e-aws-sdn-upgrade
- azure-ovn-upgrade-4.15-micro Failed (3 retries) periodic-ci-openshift-release-master-ci-4.15-e2e-azure-ovn-upgrade
- fips-scan Succeeded (1 retries) periodic-ci-openshift-release-master-nightly-4.15-fips-payload-scan
- gcp-ovn-rt-upgrade-4.15-minor Succeeded periodic-ci-openshift-release-master-ci-4.15-upgrade-from-stable-4.14-e2e-gcp-ovn-rt-upgrade
- hypershift-ovn-conformance-4.15 Succeeded periodic-ci-openshift-hypershift-release-4.15-periodics-e2e-aws-ovn-conformance
- metal-ipi-ovn-dualstack Succeeded periodic-ci-openshift-release-master-nightly-4.15-e2e-metal-ipi-ovn-dualstack
- metal-ipi-ovn-ipv6 Succeeded periodic-ci-openshift-release-master-nightly-4.15-e2e-metal-ipi-ovn-ipv6
- metal-ipi-sdn-bm Succeeded periodic-ci-openshift-release-master-nightly-4.15-e2e-metal-ipi-sdn-bm

Upgrades from:

Untested upgrades: 4.14.19, 4.14.20, 4.14.21, 4.14.22, 4.14.23, 4.14.24, 4.14.25, 4.14.26, 4.14.27, 4.14.28, 4.14.29, 4.14.30, 4.14.32, 4.14.33, 4.14.34, 4.14.35, 4.14.36, 4.14.37, 4.14.38, 4.14.39, 4.14.40, 4.14.41, 4.14.42, 4.14.44, 4.14.45, 4.14.46, 4.14.48, 4.14.49, 4.14.50, 4.14.51, 4.14.52, 4.14.53, 4.14.54, 4.14.55, 4.14.57, 4.15.10, 4.15.11, 4.15.12, 4.15.14, 4.15.15, 4.15.16, 4.15.17, 4.15.18, 4.15.19, 4.15.20, 4.15.21, 4.15.22, 4.15.23, 4.15.24, 4.15.25, 4.15.26, 4.15.29, 4.15.30, 4.15.31, 4.15.32, 4.15.33, 4.15.34, 4.15.35, 4.15.36, 4.15.37, 4.15.38, 4.15.39, 4.15.40, 4.15.41, 4.15.42, 4.15.43, 4.15.44, 4.15.45, 4.15.46, 4.15.47, 4.15.48, 4.15.49, 4.15.5, 4.15.50, 4.15.51, 4.15.52, 4.15.53, 4.15.54, 4.15.55, 4.15.56, 4.15.6, 4.15.7, 4.15.8, 4.15.9

4.15.59 (changes) - S F F F F F F S S S
4.15.58 (changes) - Failed
4.15.57 (changes) - Success
4.15.28 (changes) - Failed
4.15.27 - Failed
4.15.13 (changes) - Success
4.15.3 (changes) - Failed
4.15.2 (changes) - Failed
4.15.0 (changes) - Failed
4.14.60 (changes) - Failed Success
4.14.59 (changes) - Failed
4.14.58 (changes) - Success
4.14.56 (changes) - Failed
4.14.43 (changes) - Success
4.14.31 (changes) - Failed
4.14.18 (changes) - Success
4.14.17 (changes) - Failed
4.14.16 (changes) - Failed
4.14.0-0.nightly-2025-12-10-200242 (changes) - Success

Loading changelog, this may take a while ...

Changes from 4.15.27

Created: 2025-12-12 01:29:20 +0000 UTC

Image Digest: sha256:39236e073ff4b62406a472178263fd2220b0f544c3fd26036120b470596fa255

Components

Kubernetes upgraded from 1.28.11 to 1.28.15
Red Hat Enterprise Linux CoreOS upgraded from 415.92.202408020931-0 to 415.92.202512100122-0 (diff)

Removed images

ovirt-machine-controllers

Rebuilt images without code change

agent-installer-utils git 33b7d855 sha256:afca3c3bc2cd97d93b2179230abb1309301287a2c57a0e50177ec2637bb8cd17
alibaba-cloud-controller-manager git abf4fa96 sha256:ad6d5a790fda54201e63ab88baec9afcee83e2a542835c0dd27eae86716140f9
alibaba-cloud-csi-driver git be4888d3 sha256:19e57a16f15062b2c9a19e7c3c6e4235cc21088f77196b28cb181b2e31c9efcc
alibaba-disk-csi-driver-operator git 41b367ae sha256:cda017428da27942641237ba19aa4b4df9a841ac65e0c5c9796bf2f4abacd724
aws-ebs-csi-driver git 7043c1cc sha256:ddefb9d11e49cfc8d45453ce2cf081cd738067c7bd62bd4f334e2839bafd6ac2
aws-ebs-csi-driver-operator git 2a2b9dd1 sha256:4cbdc38b262d66f3e73ebaba44469ab4043f19a43486cfc4534e1b7b560b74a8
aws-pod-identity-webhook git 13385034 sha256:8f5f788a02afbc810ac2d85a1fb4e499264795e2b4e42e1dc51c13d41776bdd2
azure-cloud-controller-manager git 0d799a26 sha256:40f1bfea39f1cc235acf617ba02b549ae90d16e0521137fc4c8eeb9457b23e54
azure-cloud-node-manager git 0d799a26 sha256:b9a6a712f4c342e838a4f7d8f855c4f79d6c5de5b81e358f8cd1b40ffb439cf3
azure-cluster-api-controllers git 44832d2d sha256:3445b718fdf44ecc0384681510aa0a1ca66601bd98a35a6c7ce3e03ad4d67e99
azure-disk-csi-driver git dcb7e1c7 sha256:47b9ad92d900e984544e892f541fedabf25d74148fb2a66b44b0f5c186d3e43a
azure-disk-csi-driver-operator git 160cf624 sha256:6b77f3ba052589de5723cf6b3f2dd0995a6fbf32d8c60229823159c083fb8941
cloud-network-config-controller git 6864da06 sha256:b79df44694e3040d9dd6062cfaf438a6299a03e4260ad5f34f9796d15a79601e
cluster-authentication-operator git 7aaa40eb sha256:fa4ccaf5cde8f7c41446e32cc993d8ee2fae5dfb5f0a661ce68d8d77fbdc5400
cluster-bootstrap git 0849c462 sha256:ccbba925732864f6e94d573aed5bdcd0640f955225eb6233e9e46d7ed71f8e35
cluster-capi-controllers git 2053e13c sha256:0dfd6f84e38deffaa18b93a003d2f5d78e13a7e233e4fb05dbf00fabbb515aca
cluster-capi-operator git 203435ef sha256:32dc0b85d94687442bf4bc36359a5a7aaf6fca0563eef9c8aa4649a19be3c84d
cluster-config-api git 0a58f8c3 sha256:b5838003b8feb4c95d3aa8b87f7a95d87a206606468462a9aa0d87f6a125a9b4
cluster-config-operator git 0b4c69fd sha256:d5454885645c7ab02c79e8bb5830c72eacf17ea6b6d80520a87a7a0f0043f6d9
cluster-csi-snapshot-controller-operator git 65dbb12b sha256:15b672bf2c2690e9450c728e675504c0606e1bf28311f5efc6389b39941eda79
cluster-kube-cluster-api-operator git 128d8e08 sha256:11af37d47ec91d377f2cfd50a0aa1ece1febe4aa58f06a2a9b639df0b97789f6
cluster-kube-controller-manager-operator git ee8cf525 sha256:a7631bcae88e311f2851bbb37d5d7a76321538e1707b580d106780f1d3456c43
cluster-kube-scheduler-operator git f054dfaf sha256:afe5c9de660b59392a33fe135476fdbb42af91b2b3311f89c60123d26c1a3e30
cluster-kube-storage-version-migrator-operator git e76cea5f sha256:e94ff2b2bc5660ddac1aca805a8b164d65760ab5d6453a399efec5b53e58e563
cluster-olm-operator git a7ba8987 sha256:db9232a826f484d6d2ef47b5224a6e12b06b8d71beed9e35ec46d24b5ec7d926
cluster-openshift-apiserver-operator git 078c81f6 sha256:602809845fd880f28888ec0ad2d328586a8fd7787f1a76df4207a70b51ade167
cluster-platform-operators-manager git 37a0a919 sha256:7d43be3dc9396b276eaa72135711c3ff9e7d98b30cde8222537ce0cfcdc31546
cluster-policy-controller git cc48f315 sha256:9f2b44341c38de149a1e5b84cf94f8955743f3167d38a3017d6ee7e36353da2b
cluster-storage-operator git 4c2b89d6 sha256:c2d5c4bb75f3f61ecbf4d622b7136123589af21e0dbe34513c48a94a13aa1528
configmap-reloader git 617398f5 sha256:208b703c8823fae87b9464abdf890564dc8be348a82b82b1cc6edbc1534de270
coredns git 1326282c sha256:2ba41cbed9b06a9582d9f54291786a2fdad4a3c473aae97d43edc2924f953607
csi-driver-nfs git d032dc10 sha256:2cdd15b3d4ea667c4c32decc73623515ec0f9d87c6da65122af0c6e469e8acfb
csi-driver-shared-resource git 260a085a sha256:fb6d3bca1673d072fb6005395297ea28c9d3ef9321ddd87ae52972c7ca76188d
csi-driver-shared-resource-operator git 8d017b7f sha256:f5f972a7c6576a8cbf9ddf3855b530a8b3f7ae34c4a49009e5e4ee6df25b507e
csi-driver-shared-resource-webhook git 260a085a sha256:d0c8569aa993744634f26329b3c935f9b87bde80dbb5b26f8fa5a01b21b79921
csi-external-attacher git f806f266 sha256:89d9e925e7f3022c6bd9f6356fb92f95002bc9475e3e03015293820decb6fb06
csi-external-provisioner git ce5a1a33 sha256:ea613e132f20bc75f6eb37c530076c31f00498bba30dc9f821daf59bb57dbcd8
csi-external-resizer git 3b4236d3 sha256:ae17501e06ebff2d587416f102e71bece65fcdb5734c38c4bdb2fc059a992209
csi-external-snapshotter git 4f2955c7 sha256:f8381dd6a8c0f2c3da72a7b7cfbf3460e64d03de41cffa36e3fe3cea31c6e210
csi-livenessprobe git 240bb8c0 sha256:9ae6e464bf0c58d60d8fc927612c16f34db35a747fe40e1f8f3bd596cc2f79a8
csi-node-driver-registrar git 9005584e sha256:47300a0ffaa852a6227b417ac6a4358b762e24a964e3ef9d7fdc81881edd5089
csi-snapshot-controller git 4f2955c7 sha256:32ad7e402295096ecd9691bd8976fecefe8caae055b7aca6866e17d67fb62e0c
csi-snapshot-validation-webhook git 4f2955c7 sha256:624a5060696b74e3f7e822c3dfe0d40a6016a8b344b89c36621b4c25d25d45fa
driver-toolkit git 7a448c2e sha256:abb86e7366497e59604744be9b5017675014ecc4c24a7d411111f45326ac93e4
egress-router-cni git f8ec690b sha256:65afa697b863b17c32747b8c3dcb5910389e374d52b25182b15de1072b3b2117
etcd git a7005ef1 sha256:b7ff7835d1e00495f1c2398f626c4a7be4b13fa7ee742dddb4f87a39f680ef31
gcp-cloud-controller-manager git fc50272a sha256:79260b063ec631a388a1e728935654e94f0069e521d462a1d0829eabedca085e
gcp-cluster-api-controllers git bad54034 sha256:aaa6cedfbcfa3bd64b73d2ff1e93e81be16249cf80bdaac51664166c696b54e9
gcp-pd-csi-driver git 856ee3e2 sha256:9ebed6077b74b4357a9d5eb0095e497a4989b95da904e1d58adf544015791adb
gcp-pd-csi-driver-operator git 3b91ee31 sha256:7e01e77762c436c3e7858a342c3985e3c2c2236e038cf77a1c89e60b632abace
ironic-machine-os-downloader git bcbcd95b sha256:88c4a3631333b8fca55422f45fcd782b7e09e2b9965dc0972a8f32c987242d4a
kube-metrics-server git bcbf241c sha256:cbf3171128784107851d00d3f9bf6fa646f02e31e375db3113b385eb132b4250
kube-state-metrics git 037b59c2 sha256:fde46b18a7b8eada707609c319b2b4437c4d3559536850a3d24bb68496699dd3
kubevirt-cloud-controller-manager git dbaf9ea1 sha256:facd338649277af35e765561297b14867d915ee4015722549fe0980e01178af7
machine-image-customization-controller git 97d87657 sha256:3fd460121064d61e435761cbe82630fb2790b90a4f757e5994c30af2f32d0899
machine-os-content sha256:fab6d5f8318a9a45d3e987d81616e9c51eee1fc95cfa83003126557a3ec8b81f
multus-cni git 05497ad1 sha256:3dea9006b94960694cad0ff5e4155935b0f84718de82aea3209f48195c7b8aea
network-interface-bond-cni git f91decaa sha256:74d477bdfa196ec9bdddb5158194c9acb5754bc7af557b7df2611b3035ae70d7
network-tools git 17536c8d sha256:89c03e910b0ac7bc4fae213f1de356d2e1aff3f2779bf1226667c87ff2d9947d
oauth-apiserver git 0e158441 sha256:833b81debd3bd639fd04493144c3adc40a047517e242b9524c1012780136c3c0
oauth-server git c055dbb9 sha256:5bf405a0014fd1706962b3455c90117decf75e97909c90f2eb3ce135a652901a
olm-catalogd git 035d3835 sha256:94c9d814e85e6bc950d4691548c834bc2192b96efac796a4bfc062a00c104847
olm-operator-controller git 303b954f sha256:c6b226b8618bfbae5505c0389a833973fbda4a8ab081038e5dddd2607dbd2272
olm-rukpak git 5b09cd44 sha256:db86098b575077f0eb4c6c98fcf7aa002ae9bdf1bb491da7d8f9c0842c27c860
openshift-state-metrics git 1915f645 sha256:6f88ceea81d7aaefbbad50605bdd1a365c3eefe7d055d45503214ce5fad0b697
openstack-cinder-csi-driver-operator git d0c24077 sha256:f55e189b76ed319e75c1c2440a0716c99f74aca68cfb57c7104d854883fc1abb
openstack-cluster-api-controllers git 232472ea sha256:701fab7a9512d08e910436e1ec2a2174c2f5eccd414e5d50ec2d4740a4b11364
openstack-machine-api-provider git 396a09ff sha256:8d0924bf3735b4d997fa6e01a092e9517dabe2e9ede9f7d271d78b9def4ae9c7
ovirt-csi-driver git b8d25ad6 sha256:857571ce7065e83c89e6b3d91090f582268601679e86c7f803b07d1112e544ff
ovirt-csi-driver-operator git e9b0fa23 sha256:7791f6002702e308b5c0fb1ff94a6cb3538b2316104e1c54aaa1eb2d8186a9cf
powervs-block-csi-driver git 38bee567 sha256:472ea645fbb9bcf2c15639b4b662fd55dc6d618d6b5365c3df3714fb89c4763e
powervs-block-csi-driver-operator git a3729dcb sha256:1f0d165c2f07a433b89c64264670b6b49a3bdc090de5690c960788eb7fbbaf3e
prom-label-proxy git f3f1f5d1 sha256:9cd8f38b6e868069cbfc059513388ccccc76bbd72b8feb46e5edc3f529c0dedd
prometheus-alertmanager git 870ade52 sha256:57d32c74b617c6f872ceaf3bd4c9480812d860f7ac926537e070e60c2d8825ee
prometheus-node-exporter git aed837c3 sha256:d01899433e8b749274708812820cfa645fe3d8554b333cbf3a71fa75210c1fa2
rhel-coreos sha256:a1d7d1aa1b9f85c1c7071ed0ff6cecda8f913583005a8894ff2d882f50f7049b
rhel-coreos-extensions sha256:44aa7754412b7e8f16c64d81b00a14c7cd86108b2ce8784f46066feab6a61315
route-controller-manager git c5cc7a73 sha256:5333b53bca637e961f06dce8908c54557edecae71b42b876e32053eeeeaa2331
service-ca-operator git 19f312e9 sha256:dfdc3a2701cd777cb767166e4080a2e685c68cd9c267f9f131551841d7cccc00
telemeter git 14489f7d sha256:e1e2efabf4c194a4ce3e1246272ffe6286fa9be097886a0d3349a196ac4d82ff
thanos git 66161ad4 sha256:05f844d1bd69d0c24bbd3f9486c900ffc26641575c122184b72f256f61c5fe6b
vsphere-csi-driver git 4b15e93b sha256:10cc13d434ae8621ff9c3005701141e41b8de77f6a36282cd096cdc3d1847aeb
vsphere-csi-driver-operator git e0d46570 sha256:ba52faff05bcc0ca16c8b9b4345413589f785291e5446da5c9a7da6516271551
vsphere-csi-driver-syncer git 4b15e93b sha256:72a2afb321811014d7ddbbb9279b6859c47c7501fb05b53fc35828ea5d9a8828

agent-installer-api-server

OCPBUGS-58633, OCPBUGS-58638: Bump glog to v1.2.5 in release-4.15 (#7905) #7905
OCPBUGS-54402: Bump go-jwt to 4.5.2 to fix CVE-30204 (#7487) #7487
OCPBUGS-46940: OCPBUGS-46185: Bump golang.org/x/net to 0.33.0 (#7199) #7199
OCPBUGS-22539: Bump otelhttp from 0.35.1 to 0.44.0 using replace approach (#6858) #6858
OCPBUGS-43022: Update go-jose to v2.6.3 to mitigate CVE-2024-28180 (#6894) #6894
OCPBUGS-42571: Libraries bump to mitigate CVE-2024-27289 (#6834) #6834
OCPBUGS-36577: Switch to github.com/docker/distribution/reference to Mitigate CVE-2024-3727 (#6753) #6753
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-58643: Bump github.com/golang/glog pkg version to 1.2.4 (#1189) #1189
OCPBUGS-53714: Bump jwt to 4.5.2 in release-4.15 (#1092) #1092
Bump golang.org/x/net to 0.33.0 (#1011) #1011
OCPBUGS-43026: Pick up latest CVE changes by bumping service (#921) #921
OCPBUGS-42301: Switch to github.com/docker/distribution/reference to Mitigate CVE-2024-3727 (#907) #907
OCPBUGS-36779: Reload host inventory on conflict (#891) #891
Full changelog

agent-installer-node-agent

run go mod tidy / vendor #1020
And 5 elided commits (e.g. from squash or rebase merges)
Full changelog

alibaba-machine-controllers

[[release-4.15] OCPBUGS-41800: set required-scc for openshift workloads #57
Full changelog

apiserver-network-proxy

OCPBUGS-38065: Revert “Agent: Respect HTTPS_PROXY env vars for proxied connections” #60
Update golang Docker tag to v1.23.1 #58
Full changelog

aws-cloud-controller-manager

OCPBUGS-38577: Ensure that addresses are added in network device index order #92
Full changelog

aws-cluster-api-controllers

OCPBUGS-61943: UPSTREAM <carry>: revert: Only tag NetworkInterfaces in RunInstances if IAM Allows It #573
OCPBUGS-58668, OCPBUGS-58673: bump github.com/golang/glog to v1.2.5 #562
OCPBUGS-44294: [release-4.15] OSD-25934: Only tag NetworkInterfaces in RunInstances if IAM Allows It #532
Full changelog

aws-machine-controllers

OCPBUGS-63141: client: re-use a single file for building the session instead of randomly named files #153
OCPBUGS-63141: revert: client: re-use a single file for building the session instead of randomly named files #150
OCPBUGS-63141: client: re-use a single file for building the session instead of randomly named files #143
OCPBUGS-47680: fix Associate*IpAddress flag on launch EC2 #122
Full changelog

azure-file-csi-driver

ART-13080: Regenerate go.mod to fix build failure #94
OCPBUGS-39444: bump mount-utils to treat ENODEV error as corrupted mount #78
Full changelog

azure-file-csi-driver-operator

OCPBUGS-60544: add tag matching to Azure File storage class #110
Full changelog

azure-machine-controllers

OCPBUGS-56657: Fix failure when attempting to modify immutable availabilitySet #150
OCPBUGS-53226: dynamically setting the amount of fault domains #134
Full changelog

azure-workload-identity-webhook

OCPBUGS-53794: github.com/golang-jwt/jwt/v4 v4.5.2 #34
Full changelog

baremetal-installer, installer, installer-altinfra, installer-artifacts

OCPBUGS-42554: only allow a single network in failure domain topology #9060
OCPBUGS-62849: Release 4.15 bump terraform provider azurerm #10007
OCPBUGS-62410: Make swift containers removal not fatal for UPI. #9978
OCPBUGS-60497: update resolv.conf every time on bootstrap node #9885
OCPBUGS-39416: OpenStack: Install CI dependencies from rpm #9103
OCPBUGS-54353: aws/edge/byovpc: tag edge subnets with shared value #9612
OCPBUGS-54367: IBMCloud: Move to IBM TF openshift fork #9614
OCPBUGS-45961: Update upi references to api-internal #9298
OCPBUGS-50994: Bump terraform-provider-google version to v5.37.0 to fix consistent issues during cluster creation #9509
OCPBUGS-41815: Validate MTU for custom network #9294
OCPBUGS-28706: [azure] update tested x86 instance type on 4.15 #7966
OCPBUGS-47716: [release-4.15] Power VS: Create region-zone-sysType hierarchy #9340
OCPBUGS-44259: IBMCloud: Ignore failed VPC regions #9183
ARO-12457: Include bootstrap docker config file in go module #9260
OCPBUGS-45207: add chrony.conf file when additional NTP sources are configured #9251
CORS-3753: Allow mocking of the Azure client everywhere #9221
OCPBUGS-44035: IBMCloud: Handle pagination for subnets #9160
OCPBUGS-43760: azure: use filter when listing SKUs #9135
OCPBUGS-42139: add tested instance type for IBMCloud #9032
OCPBUGS-42335: Bump extract-machine-os timout to 20m #9051
OCPBUGS-42180: Add AWS r8g to arm tested instance types #9040
OCPBUGS-39288, OCPBUGS-42011: Openstack UPI - Reintroduce unique resource names #9047
OCPBUGS-38198: Remove timed context for gcp client #8824
OCPBUGS-29591: vsphere-fix convert if only provided name #8034
OCPBUGS-32179: Fix task for attaching IPv6 subnet to router. #8262
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

baremetal-machine-controllers

OCPBUGS-46641: Bump x/net to 0.33.0 #227
Full changelog

baremetal-operator

OCPBUGS-53336: BMO can expose any secret via BMCEventSubscription CRD #408
OCPBUGS-38939: [OCP] Ability to disable agent power off after deployment #373
Full changelog

baremetal-runtimecfg

OCPBUGS-37704: Change mechanism of debug flag #325
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-42726: Check cast result in adm prune deployments to prevent panic #1893
OCPBUGS-39426: Ignore pruning when deployment points to replicationcontroller #1865
Full changelog

cloud-credential-operator

OCPBUGS-60974: ccoctl: aws to use proper issuer url on subsequent runs #910
OCPBUGS-58678: github.com/golang/glog v1.2.5 #894
OCPBUGS-53417: github.com/golang/glog v1.2.4 #844
OCPBUGS-53818: update github.com/golang-jwt/jwt #840
OCPBUGS-51540: Ignore SNYK-GOLANG-GOLANGORGXOAUTH2JWS-8749594 due to not being affected #833
OCPBUGS-47068: golang.org/x/net v0.33.0 #806
OCPBUGS-45940: Add AWS region to aws-pod-identity-webhook #802
OCPBUGS-45008: Add retry to ccoctl gcp create functions #795
OCPBUGS-45003: github.com/golang-jwt/jwt/v4 v4.5.1 #784
OCPBUGS-43646: Only attempt timed token credentials on supported platforms. #774
OCPBUGS-43338: Update github.com/sirupsen/logrus v1.9.3 #768
OCPBUGS-41235: List secrets in batches to avoid api timeout #754
OCPBUGS-38377: Update google.golang.org/grpc v1.65.0 #749
OCPBUGS-37461: Set required-scc for openshift workloads #736
Full changelog

cluster-autoscaler

OCPBUGS-45149: [release-4.15] VPA: Update OWNERS file #326
OCPBUGS-40930: update VPA golang.org/x/net for http rapid reset for CVE-2024-8421 #315
Full changelog

cluster-autoscaler-operator

OCPBUGS-41798: set required-scc for openshift workloads #332
Full changelog

cluster-baremetal-operator

OCPBUGS-44046: SCC-pinning for metal3-baremetal-operator #454
[[release-4.15] OCPBUGS-41800: set required-scc for openshift workloads #443
OCPBUGS-31948: bump x/net to 0.23.0 #437
Full changelog

cluster-cloud-controller-manager-operator

OCPBUGS-63169: ccm: disable unused secure-serving port and webhook #424
Full changelog

cluster-control-plane-machine-set-operator

OCPBUGS-45839: relax validation on delete and if failureDomains not configured #336
[[release-4.15] OCPBUGS-41800: set required-scc for openshift workloads #326
OCPBUGS-24632: Prevent rollout due to irrelevant path artifacts #317
Full changelog

cluster-dns-operator

OCPBUGS-52499: [release-4.15] Add runbook_url for CoreDNSErrorsHigh #432
Full changelog

cluster-etcd-operator

OCPBUGS-53506: fix CVE-2025-30204 #1404
Full changelog

cluster-image-registry-operator

OCPBUGS-53866: bump github.com/golang-jwt/jwt #1220
OCPBUGS-51596: bump golang.org/x/oauth2 #1211
OCPBUGS-51264: ensure that storage names don’t end in dashes #1183
OCPBUGS-43918: fix proxy config and leader election test flakes #1150
OCPBUGS-42930: Continuous pull-secret updates / slow initialization on build01 (test platform infrastructure) #1136
OCPBUGS-43656: pkg/storage/azure: also check for auth failure error code on deletion #1146
OCPBUGS-42934: azureclient: stop validating credentials when creating the client #1135
OCPBUGS-39099: Avoid Shared Access Key usage for Azure Storage Account when using Managed Identity based auth #1111
OCPBUGS-38895: pkg/resource: invoke update-ca-trust extract with –output #1105
Full changelog

cluster-ingress-operator

OCPBUGS-49392: Block Upgrades in release 4.15 for CA-Signed Certs Using SHA1 #1172
OCPBUGS-42480: Limit SHA-1 check to the leaf cert in default cert chain #1154
OCPBUGS-41635: Refine logging for accurate infra CR status updates #1141
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-50661: Increase waitForFallbackDegradedConditionTimeout #1806
Full changelog

cluster-machine-approver

OCPBUGS-46034: Ensure trailing dots on DNS names do not block serving cert auth #258
OCPBUGS-46034: Client internal DNS checks should ignore trailing dot #252
OCPBUGS-44705: Client internal DNS checks should be case insensitive #245
Full changelog

cluster-monitoring-operator

OCPBUGS-66047: test: remove image registry e2e tests #2757
OCPBUGS-46570: Add new metrics for OpenShift logging telemetry #2541
OCPBUGS-44006: fix(monitoring-plugin): disable emitting nginx version on error pages #2519
OCPBUGS-43876: Add runbook url for TelemeterClientFail… #2509
OCPBUGS-42586: Exclude windows nodes from kubelet servicemonitor #2487
OCPBUGS-41913: filter alerts sent to Telemeter #2472
OCPBUGS-39172: Backport #2441 for 4.15 #2448
OCPBUGS-37608: set required-scc for openshift workloads #2420
Full changelog

cluster-network-operator

OCPBUGS-62980: Update CNO reviewers/approvers #2817
OCPBUGS-56649: Fix live migration with feature migration configured explicitly #2715
OCPBUGS-36688, OCPBUGS-43099: Unexpected Behavior During Cluster Upgrade for the ovn-ipsec-host pods #2658
OCPBUGS-53282: Not update status.migration of the network.config CR to empty #2669
[Release 4.15] OCPBUGS-51208: Use applyconfigurations for updating network.oprerator status #2653
OCPBUGS-47633: Prevent live migration process from flapping between step-2 and step-3 #2609
OCPBUGS-45890: Pass transit_switch_subnet options in ovnkube-node pod #2587
OCPBUGS-43716: Skip including default crypto policies to avoid authby issue #2599
OCPBUGS-46149: Remove ip xfrm state when IPsec is disabled #2596
OCPBUGS-43605: OCPBUGS-42244: Exporting environment varialbe NODE_CNI for live migration #2539
OCPBUGS-44973, SDN-5436: Provide support for user owned IPsec machine configs #2576
OCPBUGS-42753: Set mount propagation to HostToContainer for /var/lib/kubelet #2520
OCPBUGS-42865: Add configurable subnets while running hybrid-overlay-node binary #2523
OCPBUGS-43268: Update network operator status for IPsec #2530
OCPBUGS-43099: Configure narrowing=yes for IPsec connections #2529
OCPBUGS-42020: HyperShift: do not use antiaffinity on single replica control planes #2504
OCPBUGS-41947: Add proxy env vars to onvkube-node #2503
OCPBUGS-31447: Tighten the permissions on whereabouts.conf #2324
NP-1064, OCPBUGS-39336: Remove managed cluster checking for live migration #2485
OCPBUGS-34613, OCPBUGS-34726, OCPBUGS-34727: Live migration backports #2393
Full changelog

cluster-node-tuning-operator

e2e:performance: decode to valid kubeletconfig object (#1275) #1275
Fix context deadlines in ExecCommandOnPod() (#1265) #1265
OCPBUGS-44275: Drop sched_migration_cost_ns setting (#1207) #1207
OCPBUGS-44283: right-hand-side profile_dirs take precedence (#1208) #1208
OCPBUGS-42284: Add cluster-wide proxy env file (#1171) #1171
Full changelog

cluster-openshift-controller-manager-operator

OCPBUGS-48832: Add new team members to the OWNERS file #379
OCPBUGS-35922: lots of churn during image registry managed/removed transition #358
OCPBUGS-35869: nil pointer reference in ocm-operator #357
Full changelog

cluster-samples-operator

OCPBUGS-63517: references to github.com/sclorg/django-ex.git now also refer to the branch #660
OCPBUGS-55475: Adding mutex to func createSamples on handler.go #634
OCPBUGS-54481: add rhdmalone to owners #623
OCPBUGS-49369: add shannon and aroyoredhat as owners #597
OCPBUGS-37464: Set required-scc for openshift workloads #548
OCPBUGS-38157: add mfrancisc and metlos as owners add owners 4.15 #550
Full changelog

cluster-update-keys

OCPBUGS-43626: keys: Update Red Hat keys to use SHA256 signatures #65
Full changelog

cluster-version-operator

OCPBUGS-50591: Set openshift.io/required-scc: privileged annotation in version pods #1152
OCPBUGS-45330: deps: bump golang.org/x/net to 0.31.0 #1119
OCPBUGS-44328: Fix desired before sync_worker’s work is initialized #1104
Full changelog

console

OCPBUGS-65822: Remove required flag from ‘console.flag/model’ pipelines-plugin extension #15749
OCPBUGS-65601: /auth/error?error=missing_state&error_type=auth is showing blank page #15727
OCPBUGS-44159: bump dompurify to latest #15592
OCPBUGS-60672: Secret key with binary file changes when edited via Console #15422
OCPBUGS-59997: Remove the devconsole backend common internet proxy and replace it with dedicated ones #15359
OCPBUGS-59564: Add flags in console static plugin for all the components of this epic #15306
OCPBUGS-60029: fix bug where / in console.tab/horizontalNav href brea… #15353
OCPBUGS-57521: Debug pod logs are not accessible when debugging a node via OpenShift Console #15181
OCPBUGS-58223: Fix TypeError Cannot read properties of null (reading ‘metadata’) #15221
OCPBUGS-57097: Add all files to vendor regardless of gitignore #15134
OCPBUGS-45257: Enabling topology e2e tests on CI #14721
OCPBUGS-55733: fix bug where operator appears twice #15021
OCPBUGS-55174: Add missing pipelines plugin name to known plugins #14982
OCPBUGS-54673: Added token to proxy header #14943
OCPBUGS-54252: Update the monitoring topic used by the console team #14904
OCPBUGS-53138: fix run time error when no completed version exists #14879
OCPBUGS-53055: Show Observe section without PROMETHEUS and MONITORING flags #14867
OCPBUGS-52344: fix alert rule link #14828
OCPBUGS-51332: Do not pass CSV name to operand list page when an exen… #14800
OCPBUGS-49849: include external labels so silenced alerts not displayed in notifications #14718
OCPBUGS-48593: ReRun of Resolver based PipelineRuns fails from UI #14689
OCPBUGS-48592: ImagePullSecret getting duplicated when editing DeploymentConfig in Form View #14688
OCPBUGS-48048: Update vendor imports to include all PatternFly components #14662
OCPBUGS-47646: fix table combination #14649
OCPBUGS-46430: Plugins that use very old PF4 dropdown or menu components with grouped items have bullets and padding that needs to be removed. #14626
OCPBUGS-45950: Unable to remove finally tasks in pipeline builder mode #14606
OCPBUGS-46389: use TaskRuns results.tekton.dev/record annotation to get the logs #14622
OCPBUGS-45248: Remove ClusterTask dependency in console from Pipelines 1.17 #14564
OCPBUGS-44979: Don’t request user settings configmap if no user has been loaded. #14534
OCPBUGS-37397: RWOP accessMode is not available on OpenShift console UI #14078
OCPBUGS-44998: Add IBM Block Storage CSI driver support for RWX #14536
OCPBUGS-44738: Add flag to hide the pipelines-plugin pipeline builder extensions #14513
OCPBUGS-44355: A value submitted in From view is wrapped with single quotation after switching to Yaml view. #14476
OCPBUGS-42355: Fix TypeError: Cannot read properties of null (reading ‘metadata’) in Topology view #14319
OCPBUGS-43414: Console crashes when ssh is selected in add secret for starting a pipeline run #14401
OCPBUGS-36559: Increase login flow state paramater length/entropy #14422
OCPBUGS-37202: Bump github.com/cloudevents/sdk-go/v2 to 2.15.2 #14073
OCPBUGS-42470: List of default Camel K event sources disappears when adding a custom event source #14331
OCPBUGS-42471: Need to allow blank for Project/namespace when setting SA Subject in ‘Project access tab’ #14332
OCPBUGS-33283: Adjust NAD name to “network-xxx-xxx” when creating #14020
OCPBUGS-42611: Topology screen crashes when completed pod is selected #14353
OCPBUGS-42648: Switch to use annotations as labels from PipelineRuns created through Pipelines as Code is deprecated #14358
OCPBUGS-38764: Fix “Auto deploy when new image is available” becomes unchecked when editing a deployment from web console #14177
OCPBUGS-41991: Values entered into the Instantiate Template form are automatically cleared #14294
OCPBUGS-42384: Fix updating the “Until” field on the Silence > Edit page #14322
OCPBUGS-39343: The filepath including leading slash makes error during parsing devfile using Gitlab #14227
OCPBUGS-42144: Use vCenterCluster value from CM as primary resource #14307
OCPBUGS-38537: Include PatternFly-4 chart styles so they are available for dynamic plugins that still use PF4 react-charts #14158
OCPBUGS-38108: Revert - terminal: use username if uid is not present #14114
OCPBUGS-32793: Fix that telemetry events didn’t incl. an userId anymore #13792
OCPBUGS-38970: DeploymentConfigs deprecation info alert should not present on the Edit deployment page #14195
OCPBUGS-38969: Tooltip on Pipeline when expression is not shows #14194
OCPBUGS-39085: Fix utilization card limits/total display #14209
OCPBUGS-33938: Add validation for vSphere fields Handle submit errors correctly #14210
OCPBUGS-39112: Disable Knative e2e tests #14197
OCPBUGS-33076: Remove deprecated resources from spec of the Pipeline #13801
OCPBUGS-35495: fix crash if helm chart metadata is nil #13977
OCPBUGS-37452: Redirects to new PipelineRun logs URL from old PipelineRun logs URL #14083
OCPBUGS-38496: Fix password set to Secret created through Start Pipeline form #14152
OCPBUGS-37399: Add default sorting column for VirtualizedTable component of dynamic plugin sdk #14079
Full changelog

console-operator

OCPBUGS-46482: Dont disable console when authConfig type is set to None #953
OCPBUGS-37408: set required-scc for openshift workloads #924
Full changelog

container-networking-plugins

OCPBUGS-55948: Check error returned by ipv6 SettleAddresses #190
OCPBUGS-37732: Update owners #167
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-58885: CARRY: don’t ignore json files #342
OCPBUGS-43375: Merge https://github.com/kubernetes/cloud-provider-openstack:release-1.28 into release-4.15 #297
OCPBUGS-38170: rebase CPO on 4.15 #274
Full changelog

csi-driver-manila-operator

OCPBUGS-38023: Set required-scc for openshift workloads #236
Full changelog

docker-builder

OCPBUGS-65960: BuildConfig inline Dockerfile fails with heredoc syntax #491
OCPBUGS-58141: S2I build cpu limits observed by assemble are limited to 1 cpu #477
OCPBUGS-42917, OCPBUGS-43294: Bump buildah to 1.33.12 #442
OCPBUGS-43188: runc library bump to 1.1.12 #436
OCPBUGS-48298: skipping some unit tests to avoid failures as they are duplicate #428
OCPBUGS-48281: Add team members to the OWNERS file #427
Full changelog

docker-registry

OCPBUGS-53650: bump jwt and oauth dependencies #433
Full changelog

gcp-machine-controllers

OCPBUGS-55410, OCPBUGS-55411: Disable shielded VMs for non-UEFI disks #117
Full changelog

haproxy-router

OCPBUGS-49392: Block Upgrades for CA-Signed Certs Using SHA1 #641
Full changelog

hyperkube, pod

OCPBUGS-59147: UPSTREAM: 130047: adjusting loopback certificate validity in kube-apiserver #2358
OCPBUGS-59147: UPSTREAM: <carry>: disable some legacy cloud provider Azure tests #2359
OCPBUGS-52183: UPSTREAM: <carry>: kubelet/cm: fix bug where kubelet restarts from missing cpuset cgroup #2227
OCPBUGS-53139: UPSTREAM: 129180: prevent unnecessary resolving of iscsi/fc devices to dm #2244
OCPBUGS-44514: Bump k8s api to 1.28.15 #2132
OCPBUGS-42169: Bump k8s api to 1.28.14 #2091
OCPBUGS-39016: Update to Kubernetes v1.28.13 #2063
OCPBUGS-31467: Return from EnsureHostInPool on all NIC errors #1964
: OCPBUGS-38861: Upstream: 115702 kubelet: output log even file is rotated #2058
NO-JIRA: update downstream owners #2050
OCPBUGS-37622: Bump to Kubernetes v1.28.12 #2037
Full changelog

hypershift

CNTRLPLANE-1266: Drop extinct mce-2.5 pipeline #6655
CNTRLPLANE-1232: Move CPO pipeline to hermetic builds #6601
OCPBUGS-58506: [release-4.15] Add missing service network DNS entries to KAS cert #6394
OCPBUGS-57553: Add proxy variables for the MCD Pod #6293
OCPBUGS-57121: Add validation to avoid conflicts between KubeAPIServer and NamedCertificates SANs #6231
OCPBUGS-46467: Consistently look up and dial cloud API hostnames #5300
OCPBUGS-52590: Honor proxy vars in the util insecure http client #5791
CNTRLPLANE-920: Konflux build pipeline service account migration #6086
CNTRLPLANE-920: Konflux build pipeline service account migration #6081
OCPBUGS-55266: [release-4.15] Add konnectivity-proxy sidecar to openshift-oauth-apiserver #6070
OCPBUGS-51800: Fix golang crypto dependency go.mod replacement #5995
OCPBUGS-53898: bump golang-jwt v4 and v5 #5908
Red Hat Konflux update control-plane-operator-4-15 #5955
ART-11792: update go mod dependency for konflux #5923
OCPBUGS-51729, OCPBUGS-51800: Bump dependencies to OCP fork in backports #5902
OCPBUGS-50867: Prevent IgnitionServer from flooding the API server with patch requests #5633
OCPBUGS-52992: [release-4.15] OCPBUGS-52506: refactor aws identity health check into new controller #5815
OCPBUGS-52896: Make managed-trust-bundle optional #5813
OCPBUGS-50699: add region to AWS creds passed to operators managed by CPO #5669
NO-JIRA: chore(deps): update dependency mkdocs-material to v9.6.6 #5729
OCPBUGS-51253: OCPBUGS-50692: Fix IsIPv4 function identifying also addresses instead of CIDRs #5701
OCPBUGS-52172: [release-4.15] Add HostedCluster additional trustbundles to konnectivity-https-proxy #5722
NO-JIRA: chore(deps): update dependency mkdocs-material to v9.6.5 #5683
chore(deps): update registry.access.redhat.com/ubi9-minimal docker tag to v9.5-1739420147 #5624
NO-JIRA: chore(deps): update dependency mkdocs-material to v9 #5642
NO-JIRA: chore(deps): update registry.access.redhat.com/ubi9-minimal docker tag to v9.5-1738816775 #5576
NO-JIRA: chore(deps): update konflux references #5588
NO-JIRA: Red Hat Konflux update control-plane-operator-4-15 #5338
NO-JIRA: chore(deps): update dependency mkdocs-mermaid2-plugin to v0.6.0 #5589
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.6.3 #5586
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.6.2 #5577
OCPBUGS-49668: fix overwriting PKI operator HCP conditions #5512
NO-JIRA: chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v9.5-1737480393 #5486
NO-JIRA: chore(deps): update konflux references (release-4.15) #5480
NO-JIRA: Update squidfunk/mkdocs-material Docker tag to v9.5.50 (release-4.15) #5434
NO-JIRA: Update dependency mkdocs-material to v8.5.11 (release-4.15) #5429
NO-JIRA: chore(deps): update konflux references (release-4.15) #5425
NO-JIRA: chore(deps): update konflux references (release-4.15) #5386
NO-JIRA: chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v9.5-1736729788 (release-4.15) - abandoned #5380
NO-JIRA: chore(deps): update registry.access.redhat.com/ubi9-minimal docker tag to v9.5-1736404155 (release-4.15) #5379
NO-JIRA: Update squidfunk/mkdocs-material Docker tag to v9.5.49 (release-4.15) #5385
NO-JIRA: [release-4.15] Bump golang.org/x/crypto and golang.org/x/net #5371
NO-JIRA: chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v9.5-1734626445 (release-4.15) - abandoned #5344
NO-JIRA: chore(deps): update registry.access.redhat.com/ubi9-minimal docker tag to v9.5-1734497536 (release-4.15) #5343
OCPBUGS-46075: Do not send traffic to local audit-webhook through konnectivity #5274
NO-JIRA: Update dependency mkdocs-glightbox to v0.4.0 (release-4.15) #5327
NO-JIRA: Update Konflux references (release-4.15) #5326
OCPBUGS-47545: Separate CPO containerfiles #5334
NO-JIRA: chore(deps): update dependency mkdocs to v1.6.1 (release-4.15) #5292
NO-JIRA: chore(deps): update konflux references (release-4.15) #5291
NO-JIRA: chore(deps): update konflux references (release-4.15) #5251
OCPBUGS-44522: Add network policies for konnectivity server and ignition server proxy #5120
OCPBUGS-43931: Return the right tagReference on Catalogs ImageStream #5187
NO-JIRA: Update squidfunk/mkdocs-material Docker tag to v9.5.47 (release-4.15) #5210
NO-JIRA: chore(deps): update konflux references (release-4.15) #5208
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.46 (release-4.15) #5190
NO-JIRA: chore(deps): update konflux references to 7779f9e (release-4.15) #5182
OCPBUGS-44278: Configure OAuth https proxy to dial cloud endpoints directly #5068
NO-JIRA: chore(deps): update konflux references (release-4.15) #5159
chore(deps): update konflux references (release-4.15) #5136
NO-JIRA: chore(deps): update registry.access.redhat.com/ubi9-minimal docker tag to v9.5-1731604394 (release-4.15) #5129
chore(deps): update konflux references (release-4.15) #5118
NO-JIRA: chore(deps): update registry.access.redhat.com/ubi9-minimal docker tag to v9.5-1731518200 (release-4.15) #5106
chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v9 (release-4.15) #5110
NO-JIRA: Update Konflux references (release-4.15) #5109
NO-JIRA: chore(deps): update konflux references to 11b7f08 (release-4.15) #5101
chore(deps): update konflux references (release-4.15) #5077
NO-JIRA: chore(deps): update konflux references (release-4.15) #5054
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.44 (release-4.15) #5060
OCPBUGS-44201: add ValidIDPConfiguration condition to report IDP config issues #5037
NO-JIRA: Update Konflux references to fedcfe0 (release-4.15) #5040
chore(deps): update konflux references (release-4.15) #5025
chore(deps): update konflux references to f53fe54 (release-4.15) #5022
NO-JIRA: Update squidfunk/mkdocs-material Docker tag to v9.5.43 (release-4.15) #5016
NO-JIRA: Update Konflux references (release-4.15) #5010
NO-JIRA: chore(deps): update konflux references (release-4.15) #4974
OCPBUGS-43635: label routes only when HCP router used #4961
NO-JIRA: chore(deps): update konflux references (release-4.15) #4957
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.42 (release-4.15) #4949
OCPBUGS-43468: Use guest DNS resolution in Konnectivity HTTPS proxy by default #4929
NO-JIRA: chore(deps): update konflux references (release-4.15) #4932
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.41 (release-4.15) #4916
NO-JIRA: chore(deps): update konflux references (release-4.15) #4922
NO-JIRA: chore(deps): update konflux references to 674e70f (release-4.15) #4909
OCPBUGS-42881: Let payload generation pick the release for the NodePool #4867
OCPBUGS-42992: Conditionally manage kubeconfig secrets for DNS and Ingress operators #4876
NO-JIRA: chore(deps): update konflux references (release-4.15) #4897
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.40 (release-4.15) #4881
NO-JIRA: chore(deps): update konflux references to 37b9187 (release-4.15) #4850
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.39 (release-4.15) #4807
NO-JIRA: chore(deps): update konflux references (release-4.15) #4815
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.37 (release-4.15) #4793
NO-JIRA: chore(deps): update konflux references (release-4.15) #4777
chore(deps): update registry.access.redhat.com/ubi9-minimal docker tag to v9.4-1227.1726694542 (release-4.15) #4766
NO-JIRA: Update squidfunk/mkdocs-material Docker tag to v9 (release-4.15) #4770
chore(deps): update squidfunk/mkdocs-material docker tag to v8.5.11 (release-4.15) #4769
chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.21 (release-4.15) #4767
NO-JIRA: chore(deps): update konflux references (release-4.15) #4762
OCPBUGS-41373: CPO oauth idp converter: resolve names before dialing #4746
NO-JIRA: Security fixes for openshift-ci-security job #4751
OCPBUGS-42214: Make guest cluster components use the correct KAS port #4749
OCPBUGS-38059: Add HTTP konnectivity proxy to OAuth server #4497
HOSTEDCP-1956: bump CCO and go-jose version #4697
NO-JIRA: chore(deps): update konflux references (release-4.15) #4719
OCPBUGS-41701: cmd: report server version, supported OCP #4702
OCPBUGS-38065: [release-4.15] Use HTTP proxy for ingress controller #4699
OCPBUGS-41809: copy image-registry AdditionalTrustedCA configmap into HC openshift-config #4706
HOSTEDCP-1896: [release-4.15] Allow setting Kube APIServer maximum requests in flight #4552
OCPBUGS-39463: handle version skewed NodePools that do not have rhel9 binaries #4666
OCPBUGS-39077: Set KCM node monitor grace period #4628
OCPBUGS-30465: fix: bump google.golang.org/protobuf #4616
OCPBUGS-39171: fix: bump github.com/IBM/go-sdk-core/v5 #4625
OCPBUGS-35815: Add hypershift-cluster-version-operator image to release providers #4243
NO-JIRA: test: relax mgmt KAS egress check #4631
NO-JIRA: Tolerate restarts for kubevirt external infra #4200
NO-JIRA: Flaky cert validation test #4630
OCPBUGS-38943: copy oapi ca-trust recursively when building trust anchor #4613
OCPBUGS-39041: set proxy envvars on aws and azure CCMs #4624
OCPBUGS-38613: hcco: reconcile apiserver config into hosted cluster #4567
OCPBUGS-38561: Let the CPO oidc check resolve through data plane #4564
OCPBUGS-34904: remove weak ciphers from security profile #4547
OCPBUGS-37171: OCPBUGS-35899: Doubled machineHealthCheck timeout on Agent and None #4489
Full changelog

ibm-cloud-controller-manager

: OCPBUGS-37311: Bump otelgrpc to v0.49.0 #74
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-58739: bump github.com/golang/glog to version v1.2.4 #107
OCPBUGS-56064: tech debt: rework vendor patches #92
OCPBUGS-53906: bump github.com/golang-jwt/jwt/v4 to v4.5.2 #85
Full changelog

ibm-vpc-block-csi-driver-operator

OCPBUGS-59775: [IBM VPC] set offlineExpansion to false in e2e test manifest #150
OCPBUGS-42438: Reorder static resources to create RBAC first #130
Full changelog

ibm-vpc-node-label-updater

OCPBUGS-56064: tech debt: rework vendor patches #49
OCPBUGS-53538: bump github.com/golang-jwt/jwt/v4 to v4.5.2 #45
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-51814: CVE-2025-22869 Update golang.org/x/crypto to patched OpenShift fork #122
OCPBUGS-36078: UPSTREAM: <carry>: Fix go-retryablehttp CVE - 4.15 #87
Full changelog

ibmcloud-machine-controllers

OCPBUGS-36084: Bump dependency for CVE #54
OCPBUGS-43675: IBMCloud: Handle pagination for subnets #48
Full changelog

insights-operator

Ignore previous status when disabling alerts (#1060) #1060
OCPBUGS-45204: LokiStack gatherer (#1057) #1057
OCPBUGS-45044: insightsoperator.operator.openshift.io resource is create-only (#1056) #1056
gather selected clusterroles (#1024) #1024
OCPBUGS-39565: Not able to enable repositories during entitled build in OCP Cluster on IBM-Z (#1015) #1015
OCPBUGS-39395: collect some nmstate customresources (#986) (#989) (#995) (#1002) #986
Add haproxy metric (#983) #983
Full changelog

ironic

OCPBUGS-48148, OCPBUGS-48597: Bump jinja2 to 3.0.1-6.el9.2 #624
OCPBUGS-43953, OCPBUGS-43961: Bump python-waitress [4.15] #605
OCPBUGS-39018: Bump ironic-lib to fix utf8 decoding issue #570
OCPBUGS-38798: redfish-virtualmedia fails on XFusion nodes #565
OCPBUGS-37761, OCPBUGS-39381: Include fixes for CVE-2024-44082 #583
OCPBUGS-38512: set min version for python3-webob #554
OCPBUGS-33332: bump werkzeug #536
Full changelog

ironic-agent

OCPBUGS-39018: Bump ironic-lib to fix utf8 decoding issue #157
OCPBUGS-39381: Include fixes for CVE-2024-44082 #162
OCPBUGS-38512: set webob and bump werkzeug #150
Full changelog

ironic-static-ip-manager

OCPBUGS-49836: Fix subnet validation #49
Full changelog

k8s-prometheus-adapter

OCPBUGS-35820: Fix the podmetrics and nodemetrics command #109
Full changelog

keepalived-ipfailover

OCPBUGS-19254: Updating openshift-enterprise-keepalived-ipfailover images to be consistent with ART #152
Full changelog

kube-proxy, sdn

OCPBUGS-54868: Handle openshift-host-network namespace as special when it modifies #654
OCPBUGS-46576: Get rid of deps.diff so it doesn’t keep causing problems [4.15] #646
OCPBUGS-45955: Stop checking ruleVersion [4.16] #644
OCPBUGS-43605: backport fix for network policy during live migration #642
OCPBUGS-42171: fix redundant router-default iptables rule [4.15] #634
Full changelog

kube-rbac-proxy

OCPBUGS-31941: bump golang.org/x/net [4.15] #109
Full changelog

kube-storage-version-migrator

NO-JIRA: Add DOWNSTREAM_OWNERS (release 4-15). #228
Full changelog

kubevirt-csi-driver

fix for OCPBUGS-58587: CVE-2024-45339 openshift4/kubevirt-csi-driver #69
Full changelog

libvirt-machine-controllers

OCPBUGS-26506: Updating ose-libvirt-machine-controllers-container image to be consistent with ART for 4.15 #282
Full changelog

machine-api-operator

OCPBUGS-59861: Updates GCP CredentialsRequest #1397
OCPBUGS-55410, OCPBUGS-55411: Updates GCP credentials request #1356
OCPBUGS-53251: add image/read permissions #1349
OCPBUGS-52481: Drop oVirt support #1340
OCPBUGS-48105: Vsphere: Handle cloned instance with lost taskID #1321
OCPBUGS-46080: Ensure deletion annotation takes priority and oldestPolicy can distinguish longer ages #1314
[[release-4.15] OCPBUGS-41800: set required-scc for openshift workloads #1288
Full changelog

machine-config-operator

OCPBUGS-60214: [release-4.15] OCPBUGS-53248: Enforce VIPs to be collocated at the same host #4988
OCPBUGS-59737: Remove MachineConfigNode CRD from manifests #5188
OCPBUGS-48284: Do not run resolv-prepender from NM dispatcher #4783
OCPBUGS-57340: Do not enable on-prem-resolv-prepender.path for UPI #5115
OCPBUGS-36688: Add ipsec connect wait service #4937
OCPBUGS-54206: Update format verbs for alert logs #4943
OCPBUGS-54176: Update ObservedGeneration in KubeletConfig #4944
OCPBUGS-43742: Soften haproxy timeout for kubeapi probe #4663
OCPBUGS-50526: Add clarification to invalid maxUnavailable alert #4842
OCPBUGS-48583: trying to wait for sub-contorllers #4796
OCPBUGS-46034: Remove trailing periods from AWS provided hostnames #4745
OCPBUGS-44565: Post upgrading from 4.14 to 4.15.36, the observedGeneration count increased tremendously #4702
OCPBUGS-42137: Removal of additionalTrustBundle CA does not remove certificate from node backport #4687
OCPBUGS-44240: Disable ESP offload for OVS attached interfaces #4684
MCO-1341: Backport Telemetry to 4.15 #4648
OCPBUGS-42110: Do not use ‘restart’ for ‘oneshot’ service #4621
OCPBUGS-43582: Panic seen in CI job for MCC pod #4653
OCPBUGS-43575: MCPs report wrong number of nodes when we move nodes from one custom MCP to another custom MCP #4647
OCPBUGS-37704: Make logging configurable for on-prem components #4501
OCPBUGS-32329: Fix configure-ip-forwarding.sh #4324
OCPBUGS-37551: On-Prem resolv prepender to watch for NM changes #4499
OCPBUGS-38712: SCC-pinning for openshift workloads #4540
OCPBUGS-38370: Revert “MCD-pull: run after network-online.target in Azure” #4525
OCPBUGS-37768: Move StartLimitIntervalSec to Unit section #4506
Full changelog

machine-os-images

OCPBUGS-54170: Change rhcos release browser url #58
Full changelog

monitoring-plugin

OCPBUGS-44393: Manual cherry pick cross spawn 4.15 #277
OCPBUGS-43242: upgrade dynamic plugin sdk to remove vulnerable dependencies 4.15 #218
Full changelog

multus-admission-controller

OCPBUGS-58769: Update the github.com/golang/glog module to v1.2.4 #104
OCPBUGS-37727: Update owners #88
Full changelog

multus-networkpolicy

Update owners (#58) #58
Full changelog

multus-route-override-cni

OCPBUGS-41804: [release-4.15]Update owners #59
Full changelog

multus-whereabouts-ipam-cni

OCPBUGS-55619: Fixes leftover podref issue #366
OCPBUGS-37729: Update owners #305
Full changelog

must-gather

OCPBUGS-36371: Run ppc node collection in parallel #430
OCPBUGS-42970: Collect etcd object count #456
OCPBUGS-48083: Update owners #474
OCPBUGS-46451: Support gathering IPsec data #471
OCPBUGS-43057: [Relase-4.15] Multus is now a Pod and will be captured by normal #450
Full changelog

network-metrics-daemon

OCPBUGS-58779: Bump github.com/golang/glog to v1.2.4 (#114) #114
OCPBUGS-60374: Replace e2e test image (#126) #126
swtich golint install method (#124) #124
Full changelog

nutanix-cloud-controller-manager

OCPBUGS-22078: bump golang.org/x/net to v0.17.0 #40
Full changelog

nutanix-machine-controllers

OCPBUGS-47264: fixing CVE-2024-45338 #117
OCPBUGS-51850: CVE-2025-22868 #109
[[release-4.15] OCPBUGS-41800: set required-scc for openshift workloads #81
Full changelog

oauth-proxy

OCPBUGS-61447: Update x/crypto to v0.31.0 #336
Full changelog

oc-mirror

changes the owners file (#1014) #1014
OCPBUGS-48513: e2e: use same version of crane as in go.mod (#1022) #1022
Full changelog

openshift-apiserver

OCPBUGS-58822: Fix image reference in TestImageStreamImportQuayIO #517
OCPBUGS-47766: Pass expected type to deploymentconfig/scale object validation. #466
Full changelog

openshift-controller-manager

OCPBUGS-57761: Set node-pullsecrets volume to read-only to protect image pull credentials #396
OCPBUGS-56474: Empty proxy variables are causing issues during the build #383
OCPBUGS-54344: Unable to look up the service account secrets for build #370
OCPBUGS-48280: Add team members to the OWNERS file #359
NO-JIRA: cleanup root and app OWNERS #348
OCPBUGS-32871: replaces deprecated square/go-jose wtih go-jose/go-jose #333
OCPBUGS-41949: Add adambkaplan as approver #291
Full changelog

operator-lifecycle-manager, operator-registry

OCPBUGS-61466: [release-4.15] Add NetworkPolicy as a supported kind #1051
OCPBUGS-61389: [4.15] e2e stability fixes #1084
OCPBUGS-57430: reduce cache expiry frequency [release-4.19] #1023
OCPBUGS-56463: fix(olm): improve error logging for missing olm.managed label (#3558) #1010
OCPBUGS-48662: Fix concurrent namespace resolution #948
OCPBUGS-48697: Fix excessive catalog source snapshots cause severe performance regression #958
OCPBUGS-46926, OCPBUGS-46933, OCPBUGS-47313: x/net bump to v0.34.0 [release-4.15] #940
OCPBUGS-46479: CRD upgrade existing CR validation fix #917
OCPBUGS-42114: add optional schema migrations; default to olm.bundle.object instead of olm.csv.metadata #874
OCPBUGS-41981: (fix) registry pods do not come up again after node failure (#3366) #868
OCPBUGS-41819: [4.17] adds paginating lister for evaluating CRs’ upgrade fitness versus new CRDs. #864
OCPBUGS-41598: Fix e2e flake: upgrade CRD with deprecated version #862
OCPBUGS-38383: (fix) Resolver: list CatSrc using client, instead of referring to registry-server cache #840
OCPBUGS-38323: Update junit report file name to show spec results on Test Grid #839
Full changelog

operator-marketplace

OCPBUGS-62221: Remove Expect func so that the test case can use the retry logic #672
OCPBUGS-62119: Update memoryTarget on catalog source pods #666
OCPBUGS-49428: Upgrade golang.org/x/net [release-4.15] #588
OCPBUGS-24144: Updating marketplace-operator-container image to be consistent with ART [4.15] #553
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-56660, OCPBUGS-58162: Unpin OVS patch versions #2649 #2649
OCPBUGS-56419: Update to FDP25.A.1 24.03.5-40. #2573
OCPBUGS-50583: Bump OVN to 23.09.6-12 to consume fix for FDP-905 #2454
OCPBUGS-53384: [release-4.15] Dockerfile.base: bump OVS version to 3.3 #2492
OCPBUGS-43605: Add SDN node subnet gateway IP to host-network address_set #2419
OCPBUGS-46403: Add static route to the hairpin masquerade IPs to pod #2396
OCPBUGS-47799: Let OVN-northd bind remote ports #2407
OCPBUGS-44708: Add hybird overlay pod IPs to the namespace address_set #2399
OCPBUGS-45097: pin libreswan to 4.6-3.el9_0.3 #2374
OCPBUGS-44782: Bump ovs to 3.1.0-137 #2359
OCPBUGS-42943: Fix egress gateway pod cleanup for remote zone pods. #2342
OCPBUGS-41838: Use more exact name match when deleting static routes to HO nodes. #2298
OCPBUGS-42780: Add subnet overlap check for transit switch subnet #2313
OCPBUGS-41340: Delete EgressIP LRP stale nexthops when node is not found #2288
OCPBUGS-38262: [release-4.15] Bump OVSDBTimeout and make it configurable. #2252
Full changelog

powervs-cloud-controller-manager

OCPBUGS-36106: UPSTREAM: <carry>: Fix go-retryablehttp CVE 4.15 #74
Full changelog

powervs-machine-controllers

OCPBUGS-61702: Use OS_GIT_VERSION in Makefile when found (for Konflux builds) #128
OCPBUGS-54753: Fix for CVE-2024-51744 in github.com/golang-jwt/jwt/v4 in release-4.15 #115
OCPBUGS-41977: Update go.mod to fix CVE - 4.15 #85
Full changelog

prometheus

OCPBUGS-56740: BACKPORT: fix promtool analyze block shows metric name with 0 cardinality #256
OCPBUGS-43669: fix(discovery): Handle cache.DeletedFinalStateUnknown in node informers’ DeleteFunc #233
Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

OCPBUGS-38400: feat: sync proxy settings in Alertmanager configuration #300
OCPBUGS-36719: add proxyURL validation for smon,pmon and probe #298
Full changelog

tests

OCPBUGS-57335: Fix regex parser for censoring private key #29913
OCPBUGS-61229: images/tests: Remove rteval #30207
OCPBUGS-57136: aws/edge: prevent test using unschedulable nodes #29897
OCPBUGS-55477: support provider type external #29739
NO-JIRA: Sync OWNERS from main branch #29856
OCPBUGS-55695: [build] Ensure Git Clone Does Not Run Privileged #29752
OCPBUGS-54769: Fix egress firewall tests by updating the URL from docs.openshift.com to redhat.com #29664
OCPBUGS-52582: Use payload pullspec for image info test #29590
OCPBUGS-41614: Disable:Broken for [sig-builds][Feature:Builds][Slow] can use private repositories as build input build using an HTTP token should be able to clone source code via an HTTP token #29502
OCPBUGS-49647: Fixing build s2i ruby test data inline with latest ruby version(>=3.0) #29503
OCPBUGS-48749: Add/remove team members to the OWNERS file for Builds #29551
OCPBUGS-44106: Adjust createDNSPod() to support hypershift dual-stack test #29257
OCPBUGS-38086: vertical scaling test should not rely on CPMS replicas #28985
OCPBUGS-39136: Bump timeout for the pod-network-service endpoints check #29053
OCPBUGS-38787: [4.15] egressfirewall: skip ping tests in case of hypershift kubevirt on Azure infra #28994
OCPBUGS-36264: add Proxy config #28912
Full changelog

vsphere-cloud-controller-manager

OCPBUGS-37659: Bump otelgrpc to v0.49.0 #71
Full changelog

vsphere-cluster-api-controllers

OCPBUGS-61654: Fix unit tests #73
Full changelog

vsphere-problem-detector

OCPBUGS-37760: Drop event when CheckDefaultDatastore fails #170
Full changelog

View changelog in Markdown or change previous release:

Source code for this page located on github