Back to index
Download the installer for your operating system or run
oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.16.30-x86_64 Team Approvals:
Tests:
Blocking jobs Informing jobs Upgrades from:
Untested upgrades:
4.15.22 ,
4.15.23 ,
4.15.25 ,
4.15.26 ,
4.15.27 ,
4.15.28 ,
4.15.29 ,
4.15.31 ,
4.15.32 ,
4.15.33 ,
4.15.34 ,
4.15.35 ,
4.15.36 ,
4.15.37 ,
4.15.38 ,
4.15.39 ,
4.15.40 ,
4.16.10 ,
4.16.11 ,
4.16.12 ,
4.16.13 ,
4.16.14 ,
4.16.15 ,
4.16.16 ,
4.16.17 ,
4.16.18 ,
4.16.19 ,
4.16.20 ,
4.16.24 ,
4.16.25 ,
4.16.26 ,
4.16.3 ,
4.16.4 ,
4.16.5 ,
4.16.6 ,
4.16.7 ,
4.16.8 Upgrades to:
Loading changelog, this may take a while ...
Changes from 4.16.0
Created: 2025-01-09 10:22:53 +0000 UTC
Image Digest: sha256:7aacace57ab6ec468dd98b0b3e0f3fc440b29afce21b90bd716fed0db487e9e9
Components
FeatureGate Changes
FeatureGate
Default
Default
DevPreviewNoUpgrade
DevPreviewNoUpgrade
TechPreviewNoUpgrade
TechPreviewNoUpgrade
ExternalRouteCertificate
Unconditional
Unconditional
Unconditional
Unconditional
Unconditional
Unconditional
New images
Rebuilt images without code change
OCPBUGS-33693 : Updating aws-kms-encryption-provider-container image to be consistent with ART for 4.16 #18 hack: display diff on verify-mod-tidy failure #26
Full changelog
OCPBUGS-43797 : fix proxy config and leader election test flakes #1148 OCPBUGS-43555 : pkg/storage/azure: also check for auth failure error code on deletion #1143 OCPBUGS-42933 : azureclient: stop validating credentials when creating the client #1134 OCPBUGS-42420 : Continuous pull-secret updates / slow initialization on build01 (test platform infrastructure) #1126 Revert “[release-4.16] OCPBUGS-41903: pkg/operator/azurepathfixcontroller: do not sync on non-azure storage” #1119
OCPBUGS-41903 : pkg/operator/azurepathfixcontroller: do not sync on non-azure storage #1115 OCPBUGS-39098 : Avoid Shared Access Key usage for Azure Storage Account when using Managed Identity based auth #1104 OCPBUGS-38894 : pkg/resource/azurepathfixjob: invoke update-ca-trust extract with –output #1102 OCPBUGS-38894 : pkg/resource: invoke update-ca-trust extract with –output #1098 OCPBUGS-36037 : go.*,vendor: bump go-retryablehttp #1064 #1064 Full changelog
cmd: PPC: support tolerating heterogeneous core IDs (#1252) (#1268) #1252
e2e: add irdma to module_blacklist kernel args (#1267) #1267
OCPBUGS-47678 : performanceprofile cpuset input validation (#1264) #1264 Fix context deadlines in ExecCommandOnPod() (#1263) #1263
OCPBUGS-46496 : [release-4.16] Add vendor and architecture specific tuning options (#1254) #1254 OCPBUGS-45264 : Normalize cpu sets when rendering to Tuned profiles (#1238) (#1251) #1238 E2E: fix modify node selector to use lowercase (#1209) #1209
Fixing empty tuned submodule when using Dockerfile (#1212) #1212
OCPBUGS-38900 : Drop sched_migration_cost_ns setting (#1203) #1203 Make ocp-tuned-one-shot.service restart on-failure (#1202) #1202
Unblock 4.16 CI (#1204) #1204
e2e: performance: verify tuned one-shot service vs kubelet (#1192) #1192
E2E: Add test to verify cpuset.cpus.exclusive is writeable (#1153) #1153
OCPBUGS-39005 : Add cluster-wide proxy env file (#1166) #1166 OCPBUGS-36431 Fix generated cpu mask for 512+ cpus (#1152) #1152
E2E: Remove checking of reserved cpus in irqbalance file (#1156) #1156
Fix the destination of asset’s copy (#1134) #1134
Full changelog
OCPBUGS-45329 : deps: bump golang.org/x/net to 0.31.0 #1118 OCPBUGS-43964 : Fix desired before sync_worker’s work is initialized #1097 OCPBUGS-37853 : Revert “OCPBUGS-35994: Revert “OCPBUGS-24535: pkg/payload/precondition/clusterversion/rollback: Allow previous version within z-stream”” #1077 OCPBUGS-36898 : vendor: Update openshift/api to pick up zz_generated.crd-manifests #1069 OCPBUGS-36764 : Revert “OCPBUGS-24535: pkg/payload/precondition/clusterversion/rollback: Allow previous version within z-stream” #1065 Full changelog
NO-JIRA: Update Konflux references (release-4.16) #5328
NO-JIRA: Red Hat Konflux update control-plane-operator-4-16 #5337
OCPBUGS-47539 : Separate CPO containerfiles #5333 chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.22.7-1733160835 (release-4.16) #5295
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.49 (release-4.16) #5297
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.48 (release-4.16) #5294
NO-JIRA: Update Konflux References and Perform Migration for Release-4.16 #5261
OCPBUGS-39372 : Fixed NodePool version validation #5219 NO-JIRA: Update squidfunk/mkdocs-material Docker tag to v9.5.47 (release-4.16) #5209
NO-JIRA: chore(deps): update konflux references (release-4.16) #5207
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.46 (release-4.16) #5189
OCPBUGS-43930 : Return the right tagReference on Catalogs ImageStream #5133 NO-JIRA: chore(deps): update konflux references (release-4.16) #5161
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.45 (release-4.16) #5163
chore(deps): update konflux references (release-4.16) #5135
OCPBUGS-44277 : Configure OAuth https proxy to dial cloud endpoints directly #5069 chore(deps): update konflux references (release-4.16) #5119
OCPBUGS-43973 : Add network policies for konnectivity server and ignition server proxy #4998 NO-JIRA: Update Konflux references (release-4.16) #5112
NO-JIRA: Update Konflux references (release-4.16) #5099
chore(deps): update konflux references (release-4.16) #5078
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.44 (release-4.16) #5059
NO-JIRA: chore(deps): update konflux references (release-4.16) #5058
NO-JIRA: Update Konflux references (release-4.16) #5042
chore(deps): update konflux references (release-4.16) #5024
chore(deps): update konflux references (release-4.16) #5019
NO-JIRA: Update squidfunk/mkdocs-material Docker tag to v9.5.43 (release-4.16) #5017
NO-JIRA: Update Konflux references (release-4.16) #5012
OCPBUGS-43840 : add ValidIDPConfiguration condition to report IDP config issues #4985 NO-JIRA: chore(deps): update konflux references (release-4.16) #4971
OCPBUGS-43046 : Do not send traffic to local audit-webhook through konnectivity #4883 NO-JIRA: chore(deps): update konflux references (release-4.16) #4954
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.42 (release-4.16) #4947
NO-JIRA: chore(deps): update konflux references (release-4.16) #4933
OCPBUGS-43104 : label routes only when HCP router used #4899 OCPBUGS-43308 : Use guest DNS resolution in Konnectivity HTTPS proxy by default #4905 NO-JIRA: chore(deps): update konflux references (release-4.16) #4923
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.41 (release-4.16) #4919
NO-JIRA: chore(deps): update konflux references to 674e70f (release-4.16) #4908
NO-JIRA: chore(deps): update konflux references (release-4.16) #4896
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.40 (release-4.16) #4880
OCPBUGS-42432 : Use KubeClientCABundle for HostedClusterConfigOperator cluster-signer-ca #4799 OCPBUGS-42342 : Let payload generation pick the release for the NodePool #4787 OCPBUGS-42431 : Conditionally manage kubeconfig secrets for DNS and Ingress operators #4798 NO-JIRA: chore(deps): update konflux references (release-4.16) #4853
OCPBUGS-42608 : Add Annotation to skip deleting hcp namespace #4830 NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.39 (release-4.16) #4827
chore(deps): update konflux references (release-4.16) #4816
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.38 (release-4.16) #4806
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.37 (release-4.16) #4796
chore(deps): update konflux references (release-4.16) #4781
NO-JIRA: chore(deps): update konflux references (release-4.16) #4760
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.36 (release-4.16) #4759
NO-JIRA: Security fixes for openshift-ci-security job #4750
OCPBUGS-41372 : CPO oauth idp converter: resolve names before dialing #4689 NO-JIRA: chore(deps): update golang docker tag to v1.23 (release-4.16) #4729
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.34 (release-4.16) #4728
NO-JIRA: chore(deps): update konflux references (release-4.16) #4727
OCPBUGS-38058 : Add HTTP konnectivity proxy to OAuth server #4496 HOSTEDCP-1955 : bump CCO version #4696 OCPBUGS-34803 : cmd: report server version, supported OCP #4141 OCPBUGS-39293 : copy image-registry AdditionalTrustedCA configmap into HC openshift-config #4647 chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.21.11-9 (release-4.16) #4685
OCPBUGS-38062 : [release-4.16] Use HTTP proxy for ingress controller #4688 NO-JIRA: chore(deps): update konflux references (release-4.16) #4684
OCPBUGS-39447 : handle version skewed NodePools that do not have rhel9 binaries #4664 HOSTEDCP-1895 : [release-4.16] Allow setting Kube APIServer maximum requests in flight #4551 chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.21.11-7.1724661022 (release-4.16) #4600
chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.33 (release-4.16) #4602
chore(deps): update konflux references (release-4.16) #4599
OCPBUGS-38942 : copy oapi ca-trust recursively when building trust anchor #4615 NO-JIRA: Flaky cert validation test #4622
OCPBUGS-38259 : Set KCM node monitor grace period #4520 OCPBUGS-38726 : fix: bump github.com/IBM/go-sdk-core/v5 #4611 HOSTEDCP-1764 : retrieve registryOverrides when ImageStream is not ava… #4541 chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.21.11-7 (release-4.16) #4525
OCPBUGS-36781 : Set Azure VM identity if user assigned identity set #4341 OCPBUGS-37936 : set proxy envvars on aws and azure CCMs #4476 OCPBUGS-38486 : hcco: reconcile apiserver config into hosted cluster #4559 NO-JIRA: fix(KONFLUX-3663): format PipelineRun files and upload SAST results #4534
OCPBUGS-38131 : Let the CPO oidc check resolve through data plane #4505 NO-JIRA: test: relax mgmt KAS egress check #4561
chore(deps): update quay.io/openshift/origin-base docker tag to v4.16 (release-4.16) #4528
chore(deps): update golang docker tag to v1.22 (release-4.16) #4527
NO-JIRA: Update Konflux references (release-4.16) #4524
OCPBUGS-34801 : remove weak ciphers from security profile #4518 OCPBUGS-37060 : OCPBUGS-35905: E2E test to verify openshift-apiserver TLS certificates #4366 NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9 (release-4.16) #4482
NO-JIRA: chore(deps): update konflux references (release-4.16) #4481
OCPBUGS-37065 : OCPBUGS-35899: Doubled machineHealthCheck timeout on Agent and None #4367 OCPBUGS-30282 : Multiple MachineConfigs in one CM #4398 OCPBUGS-36937 : [release-4.16] Add HTTP(s) konnectivity proxy and use it with OpenShift APIServer #4357 OCPBUGS-36766 : Delete IDMS in dataplane once HCP ICS field is removed #4434 NO-JIRA: Konflux migration for release-4.16 #4436
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v8.5.11 (release-4.16) #4430
HOSTEDCP-1569 : test: e2e: skip unknown conditions instead of erroring #4440 OCPBUGS-37645 : Set right endpointSlice port #4431 OCPBUGS-37214 : Separate ibmcloud kms encryption configuration types #4380 OCPBUGS-37302 : fix(api): Nodepool CEL validation fix #4395 NO-JIRA: Red Hat Konflux update hypershift-release-mce-26 #4392
OCPBUGS-37241 : extract rhel9 MCO binaries for rhel8 based MCO images #4383 NO-JIRA: [release-4.16] test/e2e: remove api budget checks #4368
HOSTEDCP-1795 , HOSTEDCP-1796 : Customize the self-generated cert validity and rotation #4371 NO-JIRA: chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.21.11-2 (release-4.16) - abandoned #4364
NO-JIRA: trivial typo fixes to configuring-storage.md #4353
OCPBUGS-36849 : Add newline after TLS certs referenced by image.config #4352 OCPBUGS-36589 : Fix Hypershift dump for non-OpenShift Management Clusters #4317 NO-JIRA: chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.21.10-1.1719562237 (release-4.16) - abandoned #4328
OCPBUGS-36358 : enable audit log for oauth-openshift #4302 OCPBUGS-35522 : Copy infra-volumesnapshot-class-mapping to core binding #4291 NO-JIRA: chore(deps): update konflux references (release-4.16) #4299
OCPBUGS-36227 : kubevirt-csi-driver: Pass infra kubeconfig in case of external infra #4276 OCPBUGS-35341 : [release-4.16] Fixed ValidReleaseInfo condition #4204 OCPBUGS-36220 : Make guest cluster components use the correct KAS port #4275 OCPBUGS-35934 : check mgmt cluster for route capability before DeleteIfNeeded for ovn sbdb route #4264 NO-JIRA: chore(deps): update konflux references (release-4.16) #4260
OCPBUGS-34545 : Disable PersistentVolumeLabel admission plugin #4241 OCPBUGS-35838 : Remove KMS V1 provider support for IBM Cloud #4250 NO-JIRA: chore(deps): update konflux references (release-4.16) #4251
OCPBUGS-35369 : OCPBUGS-35252: Enforce Privileged Instead of Restricted PSA in 4.16 #4193 NO-JIRA: chore(deps): update konflux references (release-4.16) #4245
OCPBUGS-35557 : Complete KAS migration to none endpoint reconciler type #4227 NO-JIRA: chore(deps): update konflux references (release-4.16) #4238
NO-JIRA: feat(olm): Set packageserver replicas to 2 for IBMCloudPlatform #4230
OCPBUGS-35268 : Add hypershift-cluster-version-operator image to release providers #4185 NO-JIRA: chore(deps): update konflux references (release-4.16) #4235
NO-JIRA: Red Hat Konflux update hypershift-release-mce-26 #4233
OCPBUGS-35056 : Generate default worker security group rules based on machineCIDR #4174 Full changelog
Source code for this page located on github