4.16.24

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.16.24-x86_64

Team Approvals:

Accepted
- QE

Tests:

Blocking jobs
- upgrade Succeeded release-openshift-origin-installer-e2e-aws-upgrade
- upgrade-minor Failed release-openshift-origin-installer-e2e-aws-upgrade
Informing jobs
- aws-ovn-serial Succeeded periodic-ci-openshift-release-master-nightly-4.16-e2e-aws-ovn-serial
- aws-ovn-upgrade-micro Succeeded periodic-ci-openshift-release-master-ci-4.16-e2e-aws-ovn-upgrade
- aws-sdn-upgrade-4.16-micro Succeeded periodic-ci-openshift-release-master-nightly-4.16-e2e-aws-sdn-upgrade
- azure-ovn-upgrade-4.16-micro Succeeded (1 retries) periodic-ci-openshift-release-master-ci-4.16-e2e-azure-ovn-upgrade
- fips-scan Succeeded periodic-ci-openshift-release-master-nightly-4.16-fips-payload-scan
- gcp-ovn-rt-upgrade-4.16-minor Succeeded periodic-ci-openshift-release-master-ci-4.16-upgrade-from-stable-4.15-e2e-gcp-ovn-rt-upgrade
- hypershift-ovn-conformance-4.16 Succeeded periodic-ci-openshift-hypershift-release-4.16-periodics-e2e-aws-ovn-conformance
- metal-ipi-ovn-bm Succeeded (1 retries) periodic-ci-openshift-release-master-nightly-4.16-e2e-metal-ipi-ovn-bm
- metal-ipi-ovn-ipv6 Succeeded periodic-ci-openshift-release-master-nightly-4.16-e2e-metal-ipi-ovn-ipv6

Upgrades from:

Untested upgrades: 4.15.21, 4.15.23, 4.15.24, 4.15.25, 4.15.26, 4.15.27, 4.15.28, 4.15.29, 4.15.31, 4.15.32, 4.15.33, 4.15.35, 4.15.36, 4.16.10, 4.16.11, 4.16.12, 4.16.13, 4.16.16, 4.16.17, 4.16.18, 4.16.19, 4.16.3, 4.16.5, 4.16.6, 4.16.7, 4.16.8, 4.16.9

4.16.23 (changes) - S F S S S S
4.16.21 (changes) - Success
4.16.20 (changes) - Failed
4.16.15 (changes) - Success
4.16.14 (changes) - Failed
4.16.4 (changes) - Failed
4.16.2 - Success
4.16.1 (changes) - Success
4.16.0 (changes) - Failed
4.15.39 (changes) - Success
4.15.38 (changes) - Failed Success
4.15.37 (changes) - Failed
4.15.34 (changes) - Success
4.15.30 (changes) - Failed
4.15.22 (changes) - Success
4.15.20 (changes) - Success
4.15.19 (changes) - Success
4.15.18 (changes) - Failed
4.15.0-0.nightly-2024-11-21-143932 (changes) - Success

Upgrades to:

4.17.6 (changes) - Success

Loading changelog, this may take a while ...

Changes from 4.16.2

Created: 2024-11-22 05:12:03 +0000 UTC

Image Digest: sha256:6a653700eaae84e648f428c009de6aa6c9a3196600554947886083cf5280ed07

Components

Kubectl upgraded from 1.29.1 to 1.29.7
Kubernetes upgraded from 1.29.6 to 1.29.10
Kubernetes Tests 1.29.0
Red Hat Enterprise Linux CoreOS upgraded from 416.94.202407030122-0 to 416.94.202411201433-0 (diff)

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
ExternalRouteCertificate (0 tests)	Unconditional (Changed)	Unconditional (Changed)	Unconditional (Changed)	Unconditional (Changed)	Unconditional (Changed)	Unconditional (Changed)

New images

operator-framework-tools git d718c4c5 sha256:596c089a059d891268e068da5b46a6349ff163b579ea502fe3edf5dfb872210a

Rebuilt images without code change

agent-installer-utils git 6e6bb40d sha256:8a74d249fb363729faa50bcffa52bcb826f08f55a1a1953a6fe52965514528aa
alibaba-cloud-controller-manager git 97e8335e sha256:bee31024ce8328c7c093aff3a51055b31651c042b7716121a5476826a5d0168c
alibaba-machine-controllers git 064d4624 sha256:b2a44ef6ec8ff23fa73d48ffa6ca4112ab41f3173f97979ef69c96b56b781ca7
aws-cloud-controller-manager git a53e9def sha256:22a3013f8355f949177281056de5b276d0ff0cb30ba8bef7fafcebe29106f928
aws-ebs-csi-driver git 1d29a74a sha256:c5e6fc447a84f32c58de98be868a6f83dd3e5edef88ff543f8aa755e9575f1ee
aws-ebs-csi-driver-operator git ff69cd03 sha256:060472bbbe710c914528ea3e789f95b61c117c3308103373b6f36eab68a4605b
aws-machine-controllers git 61d60f6c sha256:661fd2be4574d409f8be32d8d30f6af22ea30366cd96294bdc39c117c0de6920
aws-pod-identity-webhook git 746491a6 sha256:6a7b24ac5137bb1890ee7600b778f3ffabc818769fcfdfa3be7872d961fbfd32
azure-cloud-controller-manager git 0e955329 sha256:7590e6a91e21edd7504a3f74ee963441beb3c9da9e2359ac900a1e3e0c3534d7
azure-cloud-node-manager git 0e955329 sha256:aec12eddfa9c26538d3bddf620f6aa0b64a28396afcaec36f5157927c7425c01
azure-cluster-api-controllers git a81e3b31 sha256:050156eda5709e7e1282340a3e42a1832d6d6e0f6323107ac56c4ebceec9eb7a
azure-disk-csi-driver git 6b55f6fb sha256:dd1a4065fcc5e214551452a73019ea9cce61c52548147e3b850b1d6a728f6d7c
azure-disk-csi-driver-operator git ff69cd03 sha256:cb27a1c7deae2fd7490c3fb8840f6d5035d77d79ca0da986e41f6d5edcc1157c
azure-file-csi-driver-operator git ff69cd03 sha256:38b45c4073c0323504c24cf3599dd45eb1daa2796cc6146ab7fa9b13613df001
azure-workload-identity-webhook git 4aca092a sha256:0b5d3f8bfdec88e4c57a940c25a7021d36ad96a9fff76c5f86db8fb1bb976740
baremetal-machine-controllers git 11ba601f sha256:21edff34de96155ebc68bafbbc40d1cf4c60d605e71d51ae86cc48a05ec9386e
cloud-network-config-controller git 8ceee788 sha256:e8708e72ded78f15acf69b54bc8b91f670674f0500cd2719717749d9d98aee00
cluster-autoscaler git eecb123a sha256:fbc9b9df3ac471b4a93169406ca17ab889241c9bd5217bd7c70ec03b96965bc6
cluster-autoscaler-operator git 40cadf8a sha256:4bee5df5f363e632b9b9f72707d1351cd6a2ed35619af5061d7bdf77e4fe2904
cluster-bootstrap git 27bfb59f sha256:cc50595b6f67e8c7edfc15ac5ced0c28f0316acf17b54218c4e104e9ef08e47b
cluster-capi-controllers git 5830a10a sha256:3123cb8c15a4aee9f7212a9eaed3732ffb5f6641892993d06f38c801beb98645
cluster-config-operator git 441d29c9 sha256:7dab312c8125d6e530e92dc0c16a689f517ba5825874baa86a207d9909bed8e3
cluster-csi-snapshot-controller-operator git 439826e1 sha256:5623cdfa2a659f633975c0794dc030b665be1a0a4d48888fc0b53abe571fcf17
cluster-kube-cluster-api-operator git 95ceaa9e sha256:2cae819ff54906174fba2a13da6afd57b52f00bceab4a048ad79598df7d50277
cluster-kube-controller-manager-operator git 0338b3be sha256:fb0cb13431c5a05ab5aa1ae89e23ae9d1e70ddf8cb9eda1356d69758030b1795
cluster-kube-scheduler-operator git 630f63bc sha256:48550c745e70b2c4a638aa134921613390511a9a9aea266fc9b9b191f910dc87
cluster-olm-operator git 27bf70dd sha256:cb08360bb46a8f10f16132fae60821002e98172693e3c6c675a2badb309aaff4
cluster-openshift-apiserver-operator git d26f3002 sha256:12bc6ace65ae548e7602901b46d05b86c5719ef6f0a87900c02f8cba525b2186
cluster-policy-controller git eaea543f sha256:288b0f3d6b4c0fd5aa501ccacb13b28d0ef33f634bede3ddd61bcbdd7cebc725
configmap-reloader git dc91ddc4 sha256:a13dae5be1f639b01c06f0f9c8c85e861dbcd58c3c80365566f06cb446cc7cb8
csi-driver-nfs git 406cec72 sha256:687bf25ed1cff2d1fff77489792f6041c003a9036d71ea0cf430c55dff87cf45
csi-driver-shared-resource git bc125def sha256:c285085ccbccf04f2fa0f2a684fc1508d4d7798a85482a29fb48a550a78ff3e1
csi-driver-shared-resource-operator git 1e1194bc sha256:5a69b2bac9595b4b670baeea7f568e4a8074506e4376bbd3763f9f597b006f16
csi-driver-shared-resource-webhook git bc125def sha256:7ee0a577dbd646dcf707cb0169a36f2c0b8e9b94ed1aa4835e0d29fd5d28e81e
csi-external-attacher git 7da80aab sha256:ab72e38729ca1f1c8108448bf781f66146608f4e48b1df76bbad82cfa4e8e4a2
csi-external-provisioner git 9e8af011 sha256:9472741af1031e3333f4008e6c5b96309440f98945bb6931a4a46b9bee550239
csi-external-resizer git bdf5bfb4 sha256:39da2683c9345074462e3487cc63ee007f7ddba3179cf4b625088d750435b5de
csi-external-snapshotter git 5315d37a sha256:0bcabbe55dcd8cae86681fa12786ce4c5cc0f9fd7a924892db4d199e8d26853d
csi-livenessprobe git f5e3ff55 sha256:9c630a7d2d9ebb71e5b5ced68ed5c49ab6632989fbd91f10903ab3fb3c7a3108
csi-node-driver-registrar git 8930c368 sha256:370b05f4d061395a9907ed4498748b841180ac408090e474a3a988c06bd216c3
csi-snapshot-controller git 5315d37a sha256:8226005b1c2d3c211b3306c6f43d308a87969c85b8766d8922e04bc1d3f500ac
csi-snapshot-validation-webhook git 5315d37a sha256:5abc01c72e1500771e20e3a59b59f4301a5bf201f4ae1970162458492b265be4
driver-toolkit git 1d5732f0 sha256:05e6e79639abac5e8a89e77a8cebbeec3c7d8e4679d595d57f361e69816b6347
gcp-cloud-controller-manager git 26b43dfc sha256:919e56440c36efee79ee48db97da491080f9ac9ee309ec3b71225f7632ac8b6b
gcp-cluster-api-controllers git 02432df8 sha256:8555675c91d4bcb0836713673daa0b51348052d88f2a2a22bbc65bbc827a0075
gcp-machine-controllers git e72657c0 sha256:28434d0c32981d43f7a9e77306d2600cf90462388bb0d84bd1077e935c857dcd
gcp-pd-csi-driver git 5ed71c64 sha256:06e283583ba0475b3147251e05daa9bdbfc4948473998b425574f786db4d22d5
gcp-pd-csi-driver-operator git 799327f7 sha256:e33bb9300358b635ca14fc87ced1838acdee92271c8bb7c3936bf8fdd01edf41
haproxy-router git 4d9b8c4a sha256:eb2185825dbc8551d841a3a61f1d70e0826564e28a58b9a67eb4eb1d71efafa6
ibm-cloud-controller-manager git f961f16d sha256:be9f3f0bc00e00019165e7474c8fa8ba01d5b2e8f308e06972cfcb987677dc65
ironic-machine-os-downloader git 93b8b5fa sha256:fee768db2af1f74c25c8aad153e4b09e4d99833a3bf8f2f744c18abe826835a5
ironic-static-ip-manager git e78e4c3e sha256:248ba479c707343670a6e71689a62d088a415936d35e9a736ed6c8efae96f441
k8s-prometheus-adapter git e4f859be sha256:ea54d919b544cae3a5449ee7927876c771b1a0bcb94352b607ae6ae227b8dd49
keepalived-ipfailover git b58673a3 sha256:ecddaee62b90a0ed75d9c92259e8bf56e6fd7d5b49c3dd23a2951d5a36b252b2
kube-state-metrics git 9b67b8d1 sha256:6405c8b85d35d933470b07d4035f4594c71eb5500fa54d7f57ba16467a835801
kube-storage-version-migrator git 969a60e9 sha256:8245e78254c74ae28cf19dd7dd9eecdf495979c775b061e8450712ae5b2a56f3
kubevirt-cloud-controller-manager git 3db76104 sha256:1d7a1c1f47ce940b6ac9b0a460cac9e295c2eef72c6340ace32a22c6ed68db31
kubevirt-csi-driver git 0693093f sha256:f7aed94483d77c13291f454b491072c2b46c610614cfc2fd084e8858e2ae0a37
libvirt-machine-controllers git a336f0b5 sha256:d288f4ad5c66c512a79b8607089110401ecc98f53abe29654046c81bf6a6b0d1
machine-image-customization-controller git 39480963 sha256:bffeacfb5667c0c5b37c50ab1bb117f75a6064c171274679cee70c6a70ac7c22
machine-os-images git 3cc97098 sha256:04443c9f4cdc77ddcd2fa2a19953dc546ea7c951b754184502b95efbc67dede7
multus-cni git c4aa21b9 sha256:7a073de2e28a7dfb54960e6e74af2a34d41e317531d763fd74d41cc9fc6f728c
multus-cni-microshift git c4aa21b9 sha256:1afbe32ccfa003816bfa821c04fdbbee2c2175b8fc85af800443ab365e2de037
network-interface-bond-cni git bb911451 sha256:80f63c6fa657cb8347e3ebdaf53359b451fe3ff6e0ebd0986442a0b52ec3496a
network-tools git 39eca100 sha256:07e564de2dfd1d5dcd66f2f206a13750b9afc09cb3072bf933c72712c606839c
nutanix-machine-controllers git f053e5a0 sha256:1b6a80280d2e37b41c1a9e1dad0ec47f963eb59cd9daef8b6a5c8d18a9b7e349
oauth-apiserver git fa1f097c sha256:29ca30b4159fe4ff939756ce55d9f351ad60b12e52f4ba070e4f260b97e0ca72
oauth-proxy git 30f80124 sha256:1e4a6f355db4a6685a14aadeb3ad079d327d26079c992badd678a14d40606daa
oauth-server git 3739138c sha256:88d978edbc4ef8326e99fa83c30a973162201e4b19d5ad2d5c46284d9f33f0e1
olm-catalogd git 79975a51 sha256:9cdf1ec32f0a534581a4b5c1c0e72bb9755501ea9d024e3471c9db95e7a72408
olm-operator-controller git 80b8649c sha256:2b5319928c3ab54e5b551f6a6157c34d6f9983c9ae7d6498d6452ded717229e6
olm-rukpak git 282cc84c sha256:6a35e359b782d97d3c8fc363f0b65ebe76ede1c623d917ffd6c5b24bb59f7cff
openshift-state-metrics git 59b8a0ff sha256:3234c9cd17167965bccd120b52ae7d0d268e00b1bad8229c54c40dd468c06011
openstack-cinder-csi-driver-operator git 85b52097 sha256:014fc10bf8a66c66541ed09764c65c5d945e6e88871ae680984e898cd8125735
operator-marketplace git 7db179fb sha256:3aea7c53c673184fc1528b4d6cb4d04e65707f6fffa7eba416ec4a48e2b2cb92
ovirt-csi-driver git 1db726a9 sha256:d066c1727b575e4d59c007d88b9e4b842a77918b7c31ff9f06175faf1e6d58c1
ovirt-csi-driver-operator git ac852f3e sha256:497d64c462b417458f89ab7ee0126b96c11b724d771ce23e36075239dfb035c7
ovirt-machine-controllers git abb91c84 sha256:115aa60b879439fd2915b38ac5a0433aee0323c098f1a6ee708a63d9428766fc
powervs-block-csi-driver-operator git 9c5dd8d1 sha256:1c2bf74f07bd9c4bb4f04a2e9ffcfbbc65cda2888bed63cdb4610ae48889a8d9
prom-label-proxy git 5e14722e sha256:28f002a06bbaf15b24b313df03d072a8b746b1f056f6208daeeede88673b4a31
prometheus-alertmanager git e9aea929 sha256:fd20548f5162bf02869ce07da50acd263e37e49151a90198a9257945aca2de20
prometheus-node-exporter git 29ba26d1 sha256:dea46cfd60b194244c4f529e650b51e7b77ab96c3ab65e983018da23070f1187
rhel-coreos sha256:81a132168128d804d4882de84b279ee282ac516bb33a58a6b0a964f3a5452571
rhel-coreos-extensions sha256:b877cfd9581072df601266cf9e2d1ff9e87d990cefd64f15c5085c261c0ca343
route-controller-manager git 3112b458 sha256:cc2b483e15b4890b48f0a1b6311d01fb1d1896647d8969b9c422ec1dd0eb6f9b
service-ca-operator git 538c7b98 sha256:5c41098e530f508907a7940ddc1ea0c8940f98225b3218176e66899a472b0b97
telemeter git c1ecd105 sha256:83e4446ca8953539e547d9dfd57b4fc191726e549e4c6ec2691cd3c11b05e11c
thanos git 85eee25c sha256:1fa54e7a6856a7153749258cef6e33dab125729a5692fb195194a811184f8e16
vsphere-cluster-api-controllers git be22f10a sha256:d9d566c7bc5da19ba97903de1b81f767341acfc5da030615aec739e3a8df3688
vsphere-csi-driver-operator git 483de9c5 sha256:f8c7d8315245aa0ff520a56b1ab6cef87b7a5ee1cf9af133210df6fa0910b8af

agent-installer-api-server

OCPBUGS-43021: Update go-jose to v2.6.3 to mitigate CVE-2024-28180 (#6893) #6893
OCPBUGS-42570: Libraries bump to mitigate CVE-2024-27289 (#6833) #6833
OCPBUGS-36577: Switch to github.com/docker/distribution/reference to Mitigate CVE-2024-3727 (#6752) #6752
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-38466: Allow controller to continue when assisted-service (#914) #914
OCPBUGS-43025: Pick up latest CVE changes by bumping service (#920) #920
OCPBUGS-36577: Switch to github.com/docker/distribution/reference to Mitigate CVE-2024-3727 (#906) #906
OCPBUGS-36779: Reload host inventory on conflict (#881) #881
Full changelog

agent-installer-node-agent

OCPBUGS-43028: Pick up latest CVE changes by bumping service (#804) #804
OCPBUGS-42300: Switch to github.com/docker/distribution/reference to Mitigate CVE-2024-3727 (#785) #785
Full changelog

apiserver-network-proxy

OCPBUGS-38062: Revert “Agent: Respect HTTPS_PROXY env vars for proxied connections” #59
Full changelog

aws-cluster-api-controllers

OCPBUGS-44234: [release-4.16] OSD-25934: Only tag NetworkInterfaces in RunInstances if IAM Allows It #531
Full changelog

aws-kms-encryption-provider

OCPBUGS-33693: Updating aws-kms-encryption-provider-container image to be consistent with ART for 4.16 #18
hack: display diff on verify-mod-tidy failure #26
Full changelog

azure-file-csi-driver

OCPBUGS-39145: bump mount-utils to treat ENODEV error as corrupted mount #76
Full changelog

azure-kms-encryption-provider

OCPBUGS-33692: Updating azure-kms-encryption-provider-container image to be consistent with ART for 4.16 #4
Full changelog

azure-machine-controllers

CFE-1050: Added support of capacity reservation group #111
Full changelog

baremetal-installer, installer, installer-altinfra, installer-artifacts

OCPBUGS-44348: Cherrypick oci ccm fix to 4.16 #9188
OCPBUGS-43967: Revendor assisted service external platform oci #9150
OCPBUGS-38930: import failure when esxi config is not the same in the cluster #8898
OCPBUGS-36290: IBMCloud: Ignore failed VPC regions #8674
OCPBUGS-41885: vSphere - If template is defined skip downloading #8999
OCPBUGS-41490: Update RHCOS 4.16 bootimage metadata to 416.94.202410211619-0 #9158
OCPBUGS-43476: IBMCloud: Handle pagination for subnets #9102
OCPBUGS-41490: Update RHCOS 4.16 bootimage metadata to 416.94.202410172137-0 #9132
OCPBUGS-42014: Update terraform provider for google #9077
OCPBUGS-38732: vsphere, if secureboot is enabled, disable it in the template #8904
OCPBUGS-39415: OpenStack: Install CI dependencies from rpm #8995
OCPBUGS-41334: Fix IPv6 security group rule for schedulable master #8971
OCPBUGS-38687: only allow a single network in failure domain topology #8875
OCPBUGS-42062: OCPBUGS-41865: [release-4.16] vault version updated to 1.13.10 #9036
OCPBUGS-42012: Systemd Fails to Parse Multiline EC Keys #9037
OCPBUGS-41845: Bump extract-machine-os timout to 20m #8997
OCPBUGS-38964: IngressController subnet selection in AWS #8910
OCPBUGS-42138: add tested instance type for IBMCloud #9031
OCPBUGS-39287: Fix var_files syntax to work on older version of ansible #8936
OCPBUGS-41929: Add AWS c7g,m7g,r8g to tested instance types #9009
OCPBUGS-36855: Openstack UPI - Reintroduce unique resource names. #8724
OCPBUGS-39082: incorrect folder gen, workaround govmomi vm folder path bug #8912
OCPBUGS-39496: capi/aws/byo-vpc/multi-cidr: fix group rules #8953
OCPBUGS-36861: Updates GCP terraform worker role #8939
OCPBUGS-38956: failed to install Nutanix OCP 4.16 cluster with DHCP #8905
OCPBUGS-38822: upstream capv bug causes session timeout #8891
OCPBUGS-39468: Enable TLS for virtual media in initial ironic deployment #8955
OCPBUGS-37606: vSphere validation fails if dc is in a folder #8777
OCPBUGS-39206: Update GCP Disk Types 4.16 #8920
OCPBUGS-39087: aws: validate public-only subnets configs #8913
OCPBUGS-38821: [release-4.16] Azure: Disable shared key access when using a managed identity #8855
OCPBUGS-38302: upi/aws: update lambda runtime python version #8897
OCPBUGS-38826: aws: add support for clusters with public-only subnets #8892
OCPBUGS-38517: [release-4.16] capi/aws: bump provider for instance register fix #8848
OCPBUGS-38196: Remove timed context for gcp client #8818
OCPBUGS-38502: PowerVS: Fix mad system pool #8846
OCPBUGS-37838: fix bogus analyze message when gather fails #8794
OCPBUGS-37492: openstack: Fix security group tagging #8767
OCPBUGS-37607: bootstrap gather fails in vsphere, only ipv6 address used #8778
OCPBUGS-37494: aws: do not require create permissions when BYO IAM role #8768
OCPBUGS-37510: [release-4.16] aws: bump CAPA for subnet tagging fix #8772
OCPBUGS-37180: ic: fix typo in warning message #8769
OCPBUGS-36968: [release-4.16]: capi/aws: bump provider for ingress rules fix #8734
OCPBUGS-36965: destroy/gcp: set value for DiscardLocalSsd #8733
OCPBUGS-36720: CORS-3582: capi: remove unused feature gates #8716
OCPBUGS-36890: [release-4.16] capi: start controllers after WaitGroup is created #8726
OCPBUGS-36091: [release-4.16] bump go-retryablehttp for CVE fix #8654
OCPBUGS-36777: Cleanup capi artifacts #8719
OCPBUGS-36607: aws: remove terraform configs #8705
OCPBUGS-36324: update RHCOS 4.16 bootimage metadata to 416.94.202406282145-0 #8692
OCPBUGS-36447: capi/aws: disable EKS controller in CAPA #8694
OCPBUGS-36351: vSphere - If the folder pre-exists do not tag #8683
Full changelog

baremetal-operator

OCPBUGS-39490: Disallow fetching secrets from namespaces different from the host’s one #378
OCPBUGS-38938: [OCP] Ability to disable agent power off after deployment #372
OCPBUGS-37765: HostFirmwareComponents doesn’t show the new firmware information in Status Components #355
OCPBUGS-37262: fix(redfish): set correct idrac-redfish management interface #366
OCPBUGS-36673: [4.16] Firmware Update causes BMH to get stuck in Preparing #363
Full changelog

baremetal-runtimecfg

OCPBUGS-35891: Change mechanism of debug flag #323
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-42720: Check cast result in adm prune deployments to prevent panic #1891
OCPBUGS-39341: Ignore pruning when deployment points to replicationcontroller #1862
OCPBUGS-37853: Revert “OCPBUGS-35994: pkg/cli/admin/upgrade/rollback: Drop this command” #1839
OCPBUGS-31639: Bump k8s dependencies to 1.29.7 #1824
OCPBUGS-36764: pkg/cli/admin/upgrade/rollback: Drop this command #1820
OCPBUGS-36328: Set required-scc annotation to privileged for node debug pods #1816
OCPBUGS-36379: bump(k8s)=1.29.6 #1810
Full changelog

cloud-credential-operator

OCPBUGS-43645: Only attempt timed token credentials on supported platforms. #772
OCPBUGS-43337: Update github.com/sirupsen/logrus v1.9.3 #767
OCPBUGS-41234: List secrets in batches to avoid api timeout #757
OCPBUGS-38376: Update google.golang.org/grpc v1.65.0 #748
OCPBUGS-37418: SNYK ignore go-client misreporting #735
OCPBUGS-36834: GCP passthrough permissions check to ignore problematic permissions. #714
OCPBUGS-36954: Update to azidentity v1.7.0 #727
OCPBUGS-36031: IBM/go-sdk-core update to v5.6.3 #718
Full changelog

cluster-authentication-operator

OCPBUGS-43367: manifests should not use APIs that are removed in upcoming releases #717
OCPBUGS-34790: update OpenShift favicon to new brand standard #676
NO-JIRA: Fixes for Keycloack IDP test and unit tests #683
Full changelog

cluster-baremetal-operator

OCPBUGS-43556: SCC-pinning for metal3-baremetal-operator #453
OCPBUGS-31961: bump x/net to 0.23.0 #431
OCPBUGS-36415: set required-scc for openshift workloads #433
OCPBUGS-36285: Move pull secret from env var to VolumeMount in metal3-image-customization container #436
OCPBUGS-36285: Mount htpasswds as volumeMounts in metal3-httpd container #434
Full changelog

cluster-capi-operator

OCPBUGS-37441: fix: sort CredentialsRequest manifests after namespace #190
OCPBUGS-37795: fix: align openstack e2e branch #192
Full changelog

cluster-cloud-controller-manager-operator

OCPBUGS-42125: IBMCloud: Modify liveness probe for IBM Cloud CCM to use loopback address #366
OCPBUGS-43473: update goimports targets #372
OCPBUGS-36317: PowerVS: Remove bind address #358
Full changelog

cluster-config-api

OCPBUGS-38773: remove duplicate featuregate ‘ExternalRouteCertificate’ #2007
OCPBUGS-37857: [release-4.16] OCPBUGS-37852: a rule to check if the featureSet is one of the known set of features #1985
Full changelog

cluster-control-plane-machine-set-operator

OCPBUGS-44179: relax validation on delete and if failureDomains not configured #331
CFE-1087: API Bump for capacity Reservation #314
Full changelog

cluster-dns-operator

OCPBUGS-37078: Bump version of DNSNameResolver controller #419
Full changelog

cluster-etcd-operator

OCPBUGS-33673: rename flowschema to avoid log noise in CVO #1348
OCPBUGS-37820: ensure ordering in member health checks #1311
OCPBUGS-36489: parallelize member health checks #1290
Full changelog

cluster-image-registry-operator

OCPBUGS-43797: fix proxy config and leader election test flakes #1148
OCPBUGS-43555: pkg/storage/azure: also check for auth failure error code on deletion #1143
OCPBUGS-42933: azureclient: stop validating credentials when creating the client #1134
OCPBUGS-42420: Continuous pull-secret updates / slow initialization on build01 (test platform infrastructure) #1126
Revert “[release-4.16] OCPBUGS-41903: pkg/operator/azurepathfixcontroller: do not sync on non-azure storage” #1119
OCPBUGS-41903: pkg/operator/azurepathfixcontroller: do not sync on non-azure storage #1115
OCPBUGS-39098: Avoid Shared Access Key usage for Azure Storage Account when using Managed Identity based auth #1104
OCPBUGS-38894: pkg/resource/azurepathfixjob: invoke update-ca-trust extract with –output #1102
OCPBUGS-38894: pkg/resource: invoke update-ca-trust extract with –output #1098
Full changelog

cluster-ingress-operator

OCPBUGS-39324: Refine logging for accurate infra CR status updates #1139
OCPBUGS-39323: Ingress operator status not degraded when canary route fails #1138
OCPBUGS-32887: Delete and recreate canary route to clear spec.host #1099
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-37563: add disabled syncer as reason to CFE for PSA #1714
OCPBUGS-35303: manifests: add ownership annotation for kubelet-bootstrap-kubeconfig #1701
OCPBUGS-35831: add SNO control plane high cpu usage alert #1705
Full changelog

cluster-kube-storage-version-migrator-operator

OCPBUGS-38269: bump protobuf #115
Full changelog

cluster-machine-approver

OCPBUGS-44629: Client internal DNS checks should be case insensitive #244
Full changelog

cluster-monitoring-operator

OCPBUGS-44005: fix(monitoring-plugin): disable emitting nginx version on error pages #2521
OCPBUGS-43826: Add runbook url for TelemeterClientFailures #2508
OCPBUGS-41967: disable user-defined monitoring per object #2474
OCPBUGS-42067: Reapply “chore: poll immediately in the e2e tests” #2476
OCPBUGS-41717: Configure graceful shutdown for metrics-server (4.16 backport) #2467
OCPBUGS-41910: filter alerts sent to Telemeter #2471
OCPBUGS-39170: Backport #2441 for 4.16 #2447
OCPBUGS-36907: Add deprecated config runbook #2411
OCPBUGS-36717: Exclude windows nodes from kubelet servicemonitor #2408
OCPBUGS-36482: add runbook_url annotations #2404
Full changelog

cluster-network-operator

OCPBUGS-43604: OCPBUGS-42244: Exporting environment varialbe NODE_CNI for live migration #2538
OCPBUGS-36210: Set global IP forwarding sysctl parameters while starting ovnkube-node #2422
OCPBUGS-43544: Use CNIConfDir for mounting directory to ovn-ipsec-host pod #2537
OCPBUGS-43035: Configure narrowing=yes for IPsec connections #2528
OCPBUGS-36594: Set mount propagation to HostToContainer for /var/lib/kubelet #2430
OCPBUGS-41840: Add configurable subnets while running hybrid-overlay-node binary #2502
OCPBUGS-37763: Handle random crictl errors in iptables-alerter #2452
OCPBUGS-41555: HyperShift: do not use antiaffinity on single replica control planes #2494
OCPBUGS-37937: Add proxy env vars to onvkube-node #2457
OCPBUGS-41607: set required-scc for openshift workloads #2496
OCPBUGS-35407: Use applyconfigurations for updating network.oprerator status #2413
OCPBUGS-37362: Fix IC distributed control plane alerts #2445
OCPBUGS-35836: Propogate hypershift control plane priority class override to multus and preserve container resource requests #2417
Full changelog

cluster-node-tuning-operator

Fixing empty tuned submodule when using Dockerfile (#1212) #1212
OCPBUGS-38900: Drop sched_migration_cost_ns setting (#1203) #1203
Make ocp-tuned-one-shot.service restart on-failure (#1202) #1202
Unblock 4.16 CI (#1204) #1204
e2e: performance: verify tuned one-shot service vs kubelet (#1192) #1192
E2E: Add test to verify cpuset.cpus.exclusive is writeable (#1153) #1153
OCPBUGS-39005: Add cluster-wide proxy env file (#1166) #1166
OCPBUGS-36431 Fix generated cpu mask for 512+ cpus (#1152) #1152
E2E: Remove checking of reserved cpus in irqbalance file (#1156) #1156
Fix the destination of asset’s copy (#1134) #1134
Full changelog

cluster-openshift-controller-manager-operator

OCPBUGS-38269: CVE-2024-24786 infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON #363
Full changelog

cluster-samples-operator

OKD-225: remove only the EOL CentOS 7 images #576
OCPBUGS-38159: add owners #555
Full changelog

cluster-storage-operator

OCPBUGS-43315: assets: shared-resource: hypershift: add pull-secret to operator SA #521
NO-JIRA: release-4.16: Run make update #512
OCPBUGS-36969: STOR-1839: VSphereDriverConfiguration feature Accessible-by-default #491
OCPBUGS-35298: revert vsphere problem detector controller name change #481
Full changelog

cluster-update-keys

OCPBUGS-43467: keys: Update Red Hat keys to use SHA256 signatures #64
Full changelog

cluster-version-operator

OCPBUGS-43964: Fix desired before sync_worker’s work is initialized #1097
OCPBUGS-37853: Revert “OCPBUGS-35994: Revert “OCPBUGS-24535: pkg/payload/precondition/clusterversion/rollback: Allow previous version within z-stream”” #1077
OCPBUGS-36898: vendor: Update openshift/api to pick up zz_generated.crd-manifests #1069
OCPBUGS-36764: Revert “OCPBUGS-24535: pkg/payload/precondition/clusterversion/rollback: Allow previous version within z-stream” #1065
Full changelog

console

OCPBUGS-44219: Add flag to hide the pipelines-plugin pipeline builder extensions #14466
OCPBUGS-41673: Update vendor imports to include all PatternFly components #14273
OCPBUGS-43834: Enabling topology e2e tests on CI #14438
OCPBUGS-35204: replace global refresh sync lock in OIDC provider with per-refresh-token one #13950
OCPBUGS-36556: Increase login flow state paramater length/entropy #14354
OCPBUGS-42369: Console crashes when ssh is selected in add secret for starting a pipeline run #14320
OCPBUGS-41904: fix annotation for ovn localnet #14366
OCPBUGS-37615: Include PatternFly-4 chart styles so they are available for dynamic plugins that still use PF4 react-charts #14091
OCPBUGS-37689: Switch to use annotations as labels from PipelineRuns created through Pipelines as Code is deprecated #14094
OCPBUGS-42015: Topology screen crashes when completed pod is selected #14298
OCPBUGS-35850: Fix: Quick Start “next” button requires double click to move to next step #13989
OCPBUGS-42382: Allow operators to enable monitoring by default #14317
OCPBUGS-41905: List of default Camel K event sources disappears when adding a custom event source #14290
OCPBUGS-41709: Need to allow blank for Project/namespace when setting SA Subject in ‘Project access tab’ #14278
OCPBUGS-42069: add Create button to Console plugins tab #14302
OCPBUGS-41996: Fix updating the “Until” field on the Silence > Edit page #14296
OCPBUGS-38112: do not directly mutate links in useMemo #14117
OCPBUGS-34518: Restore user toggle when authentification is disabled #13902
OCPBUGS-41619: Use vCenterCluster value from CM as primary resource #14268
OCPBUGS-37046: Fix TypeError: Cannot read properties of null (reading ‘metadata’) in Topology view #14059
OCPBUGS-38911: Values entered into the Instantiate Template form are automatically cleared #14187
OCPBUGS-38914: Unrelated readme opened when opening CodeReady workspaces from Quarkus using s2i quickstart #14188
OCPBUGS-38968: A value submitted in From view is wrapped with single quotation after switching to Yaml view. #14193
OCPBUGS-38424: fix bug where cluster version text appears black in da… #14144
OCPBUGS-38464: correct casing in “Lightspeed” #14148
OCPBUGS-37430: Fix utilization card limits/total display #14082
OCPBUGS-36510: DeploymentConfigs deprecation info alert should not present on the Edit deployment page #14031
OCPBUGS-37954: No access to list pipelines.tekton.dev prevents from using Delete application form #14107
OCPBUGS-36601: Tooltip on Pipeline when expression is not shows #14033
OCPBUGS-38803: CONSOLE-4108 [4.16 backport] Show deprecated operators in OperatorHub #14095
OCPBUGS-37048: Fix “Auto deploy when new image is available” becomes unchecked when editing a deployment from web console #14060
OCPBUGS-35839: Fix placement of icons on WebKit #13988
OCPBUGS-35271: Fix password set to Secret created through Start Pipeline form #13954
OCPBUGS-38093: correct link for Lightspeed operator #14112
OCPBUGS-36484: Revert - terminal: use username if uid is not present #14027
OCPBUGS-37097: Add useQuickStartContext hook and expose it via dynamic plugin API #14070
OCPBUGS-36864: maintain session across tabs #14051
OCPBUGS-36620: Redirects to new PipelineRun logs URL from old PipelineRun logs URL #14035
OCPBUGS-36759: RWOP accessMode is not available on OpenShift console UI #14040
OCPBUGS-37063: hide ‘View all steps in documentation’ for ROSA and OSD #14069
OCPBUGS-36411: fix BMH restart annotation #14022
OCPBUGS-36841: ensure correct API version for OperandDetails #14049
Full changelog

console-operator

OCPBUGS-34783: set required-scc for openshift workloads #908
OCPBUGS-34012: Cache organization ID #916
OCPBUGS-33788: Tolerate the absence of ingress capability on HyperShift clusters #910
Full changelog

container-networking-plugins, containernetworking-plugins-microshift

OCPBUGS-37725: Update owners #166
Full changelog

coredns

OCPBUGS-37078: UPSTREAM: <carry>: openshift: Bump the version of ocp_dnsnameresolver external plugin #127
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-38167: rebase CPO on 4.16 #291
Full changelog

csi-driver-manila-operator

OCPBUGS-38458: Add missing healthchecks #241
OCPBUGS-30438: Bump protobuf dependency #237
OCPBUGS-38013: Set required-scc for openshift workloads #235
Full changelog

docker-builder

OCPBUGS-30455: bump google.golang.org/protobuf to 1.33.0 #402
Full changelog

docker-registry

OCPBUGS-39412: pull upstream distribution changes to use a consistent multipart chunk size #410
Full changelog

egress-router-cni

OCPBUGS-35525: update to go 1.21 and k8s.io mods to v0.29.2 #85
Full changelog

etcd

OCPBUGS-34690: Rebase etcd 3.5.14 openshift 4.16 #274
Full changelog

hyperkube, pod

OCPBUGS-44513: Bump k8s api to 1.29.10 #2133
OCPBUGS-42555: Allow pod to be scheduled if node’s name and hostname mismatch #2099
OCPBUGS-42168: Bump k8s api to 1.29.9 #2090
release-4.16] OCPBUGS-42057: UPSTREAM: <drop>: bump(github.com/openshift/apiserver-library-go) #2096
OCPBUGS-39015: Bump k8s api to 1.29.8 #2066
OCPBUGS-36773: UPSTREAM: <carry>: Disable vSphere tests with pre-provisioned volumes #2021
NO-JIRA: update downstream owners #2049
OCPBUGS-37621: Bump k8s api to 1.29.7 #2039
OCPBUGS-19802: Bump 4.16 runc #2032
Full changelog

hypershift

NO-JIRA: chore(deps): update konflux references (release-4.16) #5161
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.45 (release-4.16) #5163
chore(deps): update konflux references (release-4.16) #5135
OCPBUGS-44277: Configure OAuth https proxy to dial cloud endpoints directly #5069
chore(deps): update konflux references (release-4.16) #5119
OCPBUGS-43973: Add network policies for konnectivity server and ignition server proxy #4998
NO-JIRA: Update Konflux references (release-4.16) #5112
NO-JIRA: Update Konflux references (release-4.16) #5099
chore(deps): update konflux references (release-4.16) #5078
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.44 (release-4.16) #5059
NO-JIRA: chore(deps): update konflux references (release-4.16) #5058
NO-JIRA: Update Konflux references (release-4.16) #5042
chore(deps): update konflux references (release-4.16) #5024
chore(deps): update konflux references (release-4.16) #5019
NO-JIRA: Update squidfunk/mkdocs-material Docker tag to v9.5.43 (release-4.16) #5017
NO-JIRA: Update Konflux references (release-4.16) #5012
OCPBUGS-43840: add ValidIDPConfiguration condition to report IDP config issues #4985
NO-JIRA: chore(deps): update konflux references (release-4.16) #4971
OCPBUGS-43046: Do not send traffic to local audit-webhook through konnectivity #4883
NO-JIRA: chore(deps): update konflux references (release-4.16) #4954
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.42 (release-4.16) #4947
NO-JIRA: chore(deps): update konflux references (release-4.16) #4933
OCPBUGS-43104: label routes only when HCP router used #4899
OCPBUGS-43308: Use guest DNS resolution in Konnectivity HTTPS proxy by default #4905
NO-JIRA: chore(deps): update konflux references (release-4.16) #4923
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.41 (release-4.16) #4919
NO-JIRA: chore(deps): update konflux references to 674e70f (release-4.16) #4908
NO-JIRA: chore(deps): update konflux references (release-4.16) #4896
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.40 (release-4.16) #4880
OCPBUGS-42432: Use KubeClientCABundle for HostedClusterConfigOperator cluster-signer-ca #4799
OCPBUGS-42342: Let payload generation pick the release for the NodePool #4787
OCPBUGS-42431: Conditionally manage kubeconfig secrets for DNS and Ingress operators #4798
NO-JIRA: chore(deps): update konflux references (release-4.16) #4853
OCPBUGS-42608: Add Annotation to skip deleting hcp namespace #4830
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.39 (release-4.16) #4827
chore(deps): update konflux references (release-4.16) #4816
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.38 (release-4.16) #4806
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.37 (release-4.16) #4796
chore(deps): update konflux references (release-4.16) #4781
NO-JIRA: chore(deps): update konflux references (release-4.16) #4760
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.36 (release-4.16) #4759
NO-JIRA: Security fixes for openshift-ci-security job #4750
OCPBUGS-41372: CPO oauth idp converter: resolve names before dialing #4689
NO-JIRA: chore(deps): update golang docker tag to v1.23 (release-4.16) #4729
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.34 (release-4.16) #4728
NO-JIRA: chore(deps): update konflux references (release-4.16) #4727
OCPBUGS-38058: Add HTTP konnectivity proxy to OAuth server #4496
HOSTEDCP-1955: bump CCO version #4696
OCPBUGS-34803: cmd: report server version, supported OCP #4141
OCPBUGS-39293: copy image-registry AdditionalTrustedCA configmap into HC openshift-config #4647
chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.21.11-9 (release-4.16) #4685
OCPBUGS-38062: [release-4.16] Use HTTP proxy for ingress controller #4688
NO-JIRA: chore(deps): update konflux references (release-4.16) #4684
OCPBUGS-39447: handle version skewed NodePools that do not have rhel9 binaries #4664
HOSTEDCP-1895: [release-4.16] Allow setting Kube APIServer maximum requests in flight #4551
chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.21.11-7.1724661022 (release-4.16) #4600
chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.33 (release-4.16) #4602
chore(deps): update konflux references (release-4.16) #4599
OCPBUGS-38942: copy oapi ca-trust recursively when building trust anchor #4615
NO-JIRA: Flaky cert validation test #4622
OCPBUGS-38259: Set KCM node monitor grace period #4520
OCPBUGS-38726: fix: bump github.com/IBM/go-sdk-core/v5 #4611
HOSTEDCP-1764: retrieve registryOverrides when ImageStream is not ava… #4541
chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.21.11-7 (release-4.16) #4525
OCPBUGS-36781: Set Azure VM identity if user assigned identity set #4341
OCPBUGS-37936: set proxy envvars on aws and azure CCMs #4476
OCPBUGS-38486: hcco: reconcile apiserver config into hosted cluster #4559
NO-JIRA: fix(KONFLUX-3663): format PipelineRun files and upload SAST results #4534
OCPBUGS-38131: Let the CPO oidc check resolve through data plane #4505
NO-JIRA: test: relax mgmt KAS egress check #4561
chore(deps): update quay.io/openshift/origin-base docker tag to v4.16 (release-4.16) #4528
chore(deps): update golang docker tag to v1.22 (release-4.16) #4527
NO-JIRA: Update Konflux references (release-4.16) #4524
OCPBUGS-34801: remove weak ciphers from security profile #4518
OCPBUGS-37060: OCPBUGS-35905: E2E test to verify openshift-apiserver TLS certificates #4366
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9 (release-4.16) #4482
NO-JIRA: chore(deps): update konflux references (release-4.16) #4481
OCPBUGS-37065: OCPBUGS-35899: Doubled machineHealthCheck timeout on Agent and None #4367
OCPBUGS-30282: Multiple MachineConfigs in one CM #4398
OCPBUGS-36937: [release-4.16] Add HTTP(s) konnectivity proxy and use it with OpenShift APIServer #4357
OCPBUGS-36766: Delete IDMS in dataplane once HCP ICS field is removed #4434
NO-JIRA: Konflux migration for release-4.16 #4436
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v8.5.11 (release-4.16) #4430
HOSTEDCP-1569: test: e2e: skip unknown conditions instead of erroring #4440
OCPBUGS-37645: Set right endpointSlice port #4431
OCPBUGS-37214: Separate ibmcloud kms encryption configuration types #4380
OCPBUGS-37302: fix(api): Nodepool CEL validation fix #4395
NO-JIRA: Red Hat Konflux update hypershift-release-mce-26 #4392
OCPBUGS-37241: extract rhel9 MCO binaries for rhel8 based MCO images #4383
NO-JIRA: [release-4.16] test/e2e: remove api budget checks #4368
HOSTEDCP-1795, HOSTEDCP-1796: Customize the self-generated cert validity and rotation #4371
NO-JIRA: chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.21.11-2 (release-4.16) - abandoned #4364
NO-JIRA: trivial typo fixes to configuring-storage.md #4353
OCPBUGS-36849: Add newline after TLS certs referenced by image.config #4352
OCPBUGS-36589: Fix Hypershift dump for non-OpenShift Management Clusters #4317
NO-JIRA: chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.21.10-1.1719562237 (release-4.16) - abandoned #4328
OCPBUGS-36358: enable audit log for oauth-openshift #4302
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-36067: CVE-2024-6104: bump github.com/hashicorp/go-retryablehttp to v0.7.7 #71
Full changelog

ibm-vpc-block-csi-driver-operator

OCPBUGS-42286: Reorder static resources to create RBAC first #129
OCPBUGS-36073: CVE-2024-6104: bump github.com/hashicorp/go-retryablehttp to v0.7.7 #120
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-43686: UPSTREAM: <carry>: Fix go-retryablehttp CVE - 4.16 #89
Full changelog

ibmcloud-machine-controllers

OCPBUGS-36698: IBMCloud: Handle pagination for subnets #42
Full changelog

insights-operator

gather selected clusterroles (#1023) #1023
OCPBUGS-39564: Not able to enable repositories during entitled build in OCP Cluster on IBM-Z (#1013) #1013
OCPBUGS-39394: collect some nmstate customresources (#986) (#989) (#995) #986
OCPBUGS-38021: Integration of the OpenStack CRs into the insights-operator (#974) #974
Add haproxy metric (#977) #977
OCPBUGS-37671: Ingress controller related certificates’ validate dates gathering (#970) #970
fix the configmapobserver notifications (#969) #969
Full changelog

ironic

OCPBUGS-43950, OCPBUGS-43958: Bump python-waitress [4.16] #604
OCPBUGS-43438: Include fixes for CVE-2024-5569 #599
OCPBUGS-42511: Include fix for CVE-2024-47211 #594
OCPBUGS-39017: Bump ironic-lib to fix utf8 decoding issue #569
OCPBUGS-38797: redfish-virtualmedia fails on XFusion nodes #564
OCPBUGS-42113: Update ironic-inspector to fix the memory leak #587
OCPBUGS-37758, OCPBUGS-39383: Include fixes for CVE-2024-44082 #579
OCPBUGS-38510: set min version for python3-webob #553
OCPBUGS-33376: bump werkzeug #534
OCPBUGS-36838: Update Jinja2 #521
OCPBUGS-36285: Read ironic and inspector htpasswds from files #517
Full changelog

ironic-agent

OCPBUGS-39017: Bump ironic-lib to fix utf8 decoding issue #156
OCPBUGS-39383: Include fixes for CVE-2024-44082 #161
OCPBUGS-38510: set webob and bump werkzeug #149
Full changelog

kube-metrics-server

OCPBUGS-41717: Wire server run options to flags. ([release-4.16] backport) #37
Full changelog

kube-proxy, sdn

OCPBUGS-44301: Use copy() to duplicate a net.IP #641
OCPBUGS-43344: OCPBUGS-42244: Implement namespaceSelectors on ingress with all pods IPs #635
OCPBUGS-42203: fix UDP conntrack cleanup #636
OCPBUGS-42159: fix redundant router-default iptables rule #633
Full changelog

kube-rbac-proxy

OCPBUGS-30447: protobuf bump [4.16] #111
Full changelog

machine-api-operator

OCPBUGS-39028: Updates message verbs to use %q where appropriate #1282
OCPBUGS-43433: Vsphere: Handle cloned instance with lost taskID #1298
CORS-3648: Add the hyperdisk-balanced disk type #1279
CFE-1051: Adding web-hook validation for capacityReservationGroupID #1263
Full changelog

machine-config-operator

OCPBUGS-44337: Removal of additionalTrustBundle CA does not remove certificate from node backport #4688
MCO-1342: Backport Telemetry to 4.16 #4649
OCPBUGS-44043: Disable ESP offload for OVS attached interfaces #4676
OCPBUGS-42109: Do not use ‘restart’ for ‘oneshot’ service #4616
OCPBUGS-42744: Check for kernel arg diff in updateOnClusterBuild #4628
OCPBUGS-42722: Panic seen in CI job for MCC pod #4626
OCPBUGS-42719: MCPs report wrong number of nodes when we move nodes from one custom MCP to another custom MCP #4625
OCPBUGS-41293: Enable the use of Linux Bridge as the ovs default port connection #4563
OCPBUGS-41256: Set ESP offloads off in bonds if slaves don’t support them #4627
OCPBUGS-41806: When newly built images rolled out, the update progress is not displaying correctly (went 0 –> 3) #4584
OCPBUGS-41518: CVE-2024-3727 ose-machine-config-operator-container: containers/image: digest type does not guarantee valid type #4569
OCPBUGS-38997: Machine-config daemon ListPools panic during tech-preview CI runs #4550
OCPBUGS-38711: SCC-pinning for openshift workloads #4539
OCPBUGS-36850: Port number 22623 exposing weak ciphers to external client from master node IP #4556
OCPBUGS-38373: Revert “MCD-pull: run after network-online.target in Azure” #4528
OCPBUGS-36171, OCPBUGS-36172: fix secret canonicalization #4432
OCPBUGS-37759: Guard MachineOSBuild & MachineOSConfig informers with feature gates #4505
OCPBUGS-37550: On-Prem resolv prepender to watch for NM changes #4498
OCPBUGS-37485: kubelet: boot without PSI for performance concerns #4486
OCPBUGS-37840: [release-4.16] Introduce versioning for Auto Node Sizing feature #4382
OCPBUGS-35891: Make logging configurable for on-prem components #4418
OCPBUGS-37470: Nodes are drained twice when an OCB image is applied #4484
OCPBUGS-37460: Openshift uncordoned compute-node that was intentionally cordoned #4483
OCPBUGS-37428: Machine-config operator should not hot loop generating ValidatingAdmissionPolicyUpdated events #4482
OCPBUGS-36775: templates: run disable-mglru conditionally #4462
OCPBUGS-36330: daemon: Handle correctly OS Version for 4.1 and 4.2 bootimages #4445
OCPBUGS-36536: MCD-pull: run after network-online.target in Azure #4453
Full changelog

monitoring-plugin

OCPBUGS-43239: upgrade dynamic plugin sdk to remove vulnerable dependencies 4.16 #217
OCPBUGS-42424: fix path-to-regexp dependency #197
Full changelog

multus-admission-controller

OCPBUGS-36341: Update owners #87
Full changelog

multus-networkpolicy

Update owners (#57) #57
Full changelog

multus-route-override-cni

OCPBUGS-37726: Update owners #58
Full changelog

multus-whereabouts-ipam-cni

OCPBUGS-37707, OCPBUGS-37708: [release-4.16] align api calls timeout and skip pods marked for deletion #304
OCPBUGS-37723: Update owners #294
Full changelog

must-gather

OCPBUGS-43056: Open [Release-4.16] Multus is now a Pod and will be captured by normal #449
Full changelog

network-metrics-daemon

Correct 4.16 owners file (#98) #98
Full changelog

nutanix-cloud-controller-manager

OCPBUGS-30524: bump google.golang.org/protobuf to v1.33.0 #38
Full changelog

oc-mirror

OCPBUGS-38035: Rebuild catalogs – without cache generation (#905) #905
OCPBUGS-36410: fix: creates tags for release images (#901) #901
OCPBUGS-37055: Use proxy for HTTP request release signatures (#893) #893
OCPBUGS-37040: use current working-dir for fetching release content for disk to mirror (#892) #892
OCPBUGS-36498: Fix to ensure invalid catalogs are skipped (#889) #889
OCPBUGS-362214: Fix V2 DiskToMirror should not require internet access (#884) #884
Full changelog

openshift-apiserver

OCPBUGS-42724: fail image import when both image and error are nil #455
Full changelog

openshift-controller-manager

NO-JIRA: cleanup root and app OWNERS #347
OCPBUGS-42420: Continuous pull-secret updates / slow initialization on build01 (test platform infrastructure) #343
OCPBUGS-39191: replaces deprecated square/go-jose wtih go-jose/go-jose #329
OCPBUGS-37526: Race condition when deleting ServiceAccount #324
OCPBUGS-36862: 4.16 “Bad” reconciliation loops can cause unbounded dockercfg secret creation #323
Full changelog

openstack-cluster-api-controllers

OCPBUGS-34931: rebase on release-0.10 (to fix trunks deletion) #321
OCPBUGS-37967: rebase CAPO for 4.16 #319
Full changelog

openstack-machine-api-provider

OCPBUGS-34931: bump CAPO to v0.9.2 #124
Full changelog

operator-lifecycle-manager, operator-registry

OCPBUGS-44802: fix: call TokenRequest API when service account token secret is missing #900
OCPBUGS-41540: [4.16] add optional schema migrations; default to olm.bundle.object instead of olm.csv.metadata (#1384) #859
OCPBUGS-41677: [4.17] adds paginating lister for evaluating CRs’ upgrade fitness versus new CRDs. #863
OCPBUGS-41557: Fix e2e flake: upgrade CRD with deprecated version #861
OCPBUGS-41217: (fix) registry pods do not come up again after node failure (#3366) #854
OCPBUGS-38290: release-4.16 Resolver: list CatSrc using client, instead of referring to registry-server cache #838
OCPBUGS-38129: [release-4.16] Update junit report file name to show spec results on Test Grid #833
OCPBUGS-37456: Updating ose-operator-framework-tools-container image to be consistent with ART for 4.16 #826
OCPBUGS-37559: [release-4.16] Update e2e config and backport list of flakes #814
OCPBUGS-37018: Bump github.com/containers/image/v5 #822
OCPBUGS-36450: Can’t install operator on 4.15 after uninstalling it on a prior version #809
OCPBUGS-25019: fix xplat compile for of-tools image; hide utest files from git; use rhel8 art builder image #793
OCPBUGS-36137: fix sorting unpack jobs #799
OCPBUGS-34979: Updates default security context behavior for catalog source pods #788
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-42244: Add hybird overlay pod IPs to the namespace address_set #2352
OCPBUGS-43344: Add SDN node subnet gateway IP to host-network address_set #2328
OCPBUGS-42942: Fix egress gateway pod cleanup for remote zone pods. #2341
OCPBUGS-36210: Implementation required to enable Forwarding if it is already disabled #2212
OCPBUGS-41551: Add subnet overlap check for transit switch subnet #2306
OCPBUGS-38697: Use more exact name match when deleting static routes to HO nodes. #2282
OCPBUGS-24386: [release-4.16] EgressService: Fix ETP=Local ingress reply for LGW #2278
OCPBUGS-38705: Delete EgressIP LRP stale nexthops when node is not found #2271
OCPBUGS-38054: Fix per-pod MCS/metadata blocking #2248
OCPBUGS-38699, OCPBUGS-38704: EgressIP VRF support & ignore localnet patch ports when bootstrapping #2267
OCPBUGS-37939: [release-4.16] Bump OVSDBTimeout and make it configurable. #2244
OCPBUGS-37362: Fix registering northd metrics on appropriate nodes #2232
OCPBUGS-36608: [release-4.16] ovspinning: Set affinity of each thread #2220
OCPBUGS-36486: Fix race condition when creating/deleting namespace address set #2218
OCPBUGS-35061: Allow ANPs at same priority #2205
Full changelog

powervs-block-csi-driver

OCPBUGS-36097: Fix CVE-2024-6104 by updating http-retryable to 0.7.7 #88
Full changelog

powervs-cloud-controller-manager

OCPBUGS-36107: UPSTREAM: <carry>: Fix go-retryablehttp CVE 4.16 #73
Full changelog

powervs-machine-controllers

OCPBUGS-41976: Update go.mod to fix CVE - 4.16 #84
Full changelog

prometheus

OCPBUGS-39179: Restore Prometheus functionality to accept samples with different timestamps from the same series in a single scrape. #224
OCPBUGS-36918: cherry-pick upstream fix to make PrometheusRemoteWriteBehind fire when remote endpoint is never reached. #214
OCPBUGS-37446: backport of upstream fix #217
OCPBUGS-36854: cherry-pick upstream remote-write fix #212
Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

OCPBUGS-38399: feat: sync proxy settings in Alertmanager configuration #299
Full changelog

tests

OCPBUGS-44105: Adjust createDNSPod() to support hypershift dual-stack test #29258
OCPBUGS-39135: Bump timeout for the pod-network-service endpoints check #29052
OCPBUGS-41611: Disable:Broken for [sig-builds][Feature:Builds][Slow] can use private repositories as build input build using an HTTP token should be able to clone source code via an HTTP token [apigroup:build.openshift.io] #29079
OCPBUGS-38707: run vsphere driver config test on non techpreview clusters #28992
OCPBUGS-38788: [4.16] egressfirewall: skip ping tests in case of hypershift kubevirt on Azure infra #28938
OCPBUGS-38015: vertical scaling test should not rely on CPMS replicas #28981
OCPBUGS-37771: fix pod not returning success on ‘Managed cluster should verify that nodes have no unexpected reboots #28959
OCPBUGS-36744: Expand allowance for kubelet metrics api endpoint outages during node upgrades #28928
OCPBUGS-36182: Removes dependency on samples operator images #28904
Full changelog

vsphere-cloud-controller-manager

OCPBUGS-37660: Bump otelgrpc to v0.53.0 #72
Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

OCPBUGS-43881: redact sensitive information when logging VCenter config #134
OCPBUGS-42878: Add compute resource entity to consider a standalone cluster for volu… #131
Full changelog

vsphere-problem-detector

OCPBUGS-37735: Drop event when CheckDefaultDatastore fails #168
Full changelog

View changelog in Markdown or change previous release:

Source code for this page located on github