4.16.67

Manual Override Applied

This release was manually Accepted.

Reason: Same CI infrastructure failure pattern as 4.14.70. Blocking upgrade-minor failed due to ci-operator CLI image import bug (not a product regression). Both informing failures were infrastructure issues: azure-ovn-upgrade hit the same CLI import bug, hypershift-ovn-conformance hit a quota lease 502. 8/10 informing jobs passed including the minor upgrade GCP RT test. Multiple successful upgrade paths confirmed. Re-triggered upgrade-minor test still running but failure cause already confirmed as infra. — https://redhat-internal.slack.com/archives/C0AMHBXQW9F/p1784743475499549

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.16.67-x86_64

Qualifiers (status api):

Tests:

Blocking jobs
- upgrade Succeeded (1 retry) periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Succeeded
- upgrade-minor Failed (2 retries) periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
Informing jobs
- aws-ovn-serial Succeeded periodic-ci-openshift-release-main-nightly-4.16-e2e-aws-ovn-serial
- aws-ovn-upgrade-micro Succeeded (1 retry) periodic-ci-openshift-release-main-ci-4.16-e2e-aws-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Succeeded
- aws-sdn-upgrade-4.16-micro Succeeded (1 retry) periodic-ci-openshift-release-main-nightly-4.16-e2e-aws-sdn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Succeeded
- azure-ovn-upgrade-4.16-micro Failed (1 retry) periodic-ci-openshift-release-main-ci-4.16-e2e-azure-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Failed
- driver-toolkit Succeeded periodic-ci-openshift-release-main-nightly-4.16-e2e-aws-driver-toolkit
- fips-scan Succeeded periodic-ci-openshift-release-main-nightly-4.16-fips-payload-scan
- gcp-ovn-rt-upgrade-4.16-minor Succeeded periodic-ci-openshift-release-main-ci-4.16-upgrade-from-stable-4.15-e2e-gcp-ovn-rt-upgrade
- hypershift-ovn-conformance-4.16 Failed (1 retry) periodic-ci-openshift-hypershift-release-4.16-periodics-e2e-aws-ovn-conformance
  - Attempt 1 Failed
  - Attempt 2 Failed
- metal-ipi-ovn-ipv4 Succeeded periodic-ci-openshift-release-main-nightly-4.16-e2e-metal-ipi-ovn-ipv4
- metal-ipi-ovn-ipv6 Succeeded periodic-ci-openshift-release-main-nightly-4.16-e2e-metal-ipi-ovn-ipv6

Upgrades from:

Untested upgrades: 4.15.21, 4.15.22, 4.15.23, 4.15.24, 4.15.25, 4.15.26, 4.15.27, 4.15.28, 4.15.29, 4.15.30, 4.15.31, 4.15.32, 4.15.33, 4.15.34, 4.15.35, 4.15.36, 4.15.37, 4.15.38, 4.15.39, 4.15.40, 4.15.41, 4.15.42, 4.15.43, 4.15.44, 4.15.45, 4.15.46, 4.15.47, 4.15.48, 4.15.49, 4.15.51, 4.15.52, 4.15.53, 4.15.54, 4.15.55, 4.15.56, 4.15.59, 4.15.60, 4.15.61, 4.15.62, 4.15.63, 4.15.64, 4.16.10, 4.16.11, 4.16.12, 4.16.13, 4.16.14, 4.16.15, 4.16.16, 4.16.17, 4.16.18, 4.16.19, 4.16.20, 4.16.21, 4.16.22, 4.16.23, 4.16.24, 4.16.25, 4.16.26, 4.16.27, 4.16.28, 4.16.29, 4.16.3, 4.16.30, 4.16.31, 4.16.32, 4.16.33, 4.16.34, 4.16.35, 4.16.36, 4.16.37, 4.16.38, 4.16.4, 4.16.40, 4.16.41, 4.16.42, 4.16.43, 4.16.44, 4.16.45, 4.16.46, 4.16.48, 4.16.49, 4.16.5, 4.16.50, 4.16.51, 4.16.52, 4.16.53, 4.16.54, 4.16.55, 4.16.56, 4.16.57, 4.16.58, 4.16.59, 4.16.6, 4.16.61, 4.16.62, 4.16.63, 4.16.7, 4.16.8, 4.16.9

4.16.66 (changes) - F S F F F S F S F
4.16.65 (changes) - Success
4.16.64 (changes) - Failed
4.16.60 (changes) - Failed
4.16.47 (changes) - Success
4.16.39 - Failed
4.16.2 (changes) - Failed
4.16.1 (changes) - Failed
4.16.0 (changes) - Failed
4.15.67 (changes) - F F F F F F F
4.15.66 (changes) - S F F
4.15.65 (changes) - Failed
4.15.58 (changes) - Failed
4.15.57 (changes) - Failed
4.15.50 (changes) - Failed
4.15.20 (changes) - Success
4.15.19 (changes) - Failed
4.15.18 (changes) - Failed
4.15.0-0.nightly-2026-07-22-000330 (changes) - Success

Loading changelog, this may take a while ...

Changes from 4.16.39

Created: 2026-07-22 11:49:42 +0000 UTC

Image Digest: sha256:6a5d0afd0e373aa47fe1598eaf01f359840f893a8ed6e4aa19339fb3a17f5e19

Components

Kubectl 1.29.7
Kubernetes 1.29.14
Kubernetes Tests 1.29.0
Red Hat Enterprise Linux CoreOS upgraded from 416.94.202504151456-0 to 416.94.202607210215-0 (diff)

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
StreamingCollectionEncodingToJSON (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
StreamingCollectionEncodingToProtobuf (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)

Removed images

ovirt-csi-driver
ovirt-csi-driver-operator

Rebuilt images without code change

alibaba-cloud-controller-manager git 97e8335e sha256:07c56c9fdc212ddd4a079730cce1124ee809df3ee95008823c33b88aa512f7f7
alibaba-machine-controllers git 248372a4 sha256:070551dc26c10fb153709319ec9798e1ed44f197c1fa0e98883b2914674e3bbd
apiserver-network-proxy git ca81b6a3 sha256:dfdcb1eab90a2b04c4bd223688498a958e37db3a8a456c889efbd2d18c9e67d5
aws-cloud-controller-manager git a53e9def sha256:643aae6b2a547162e87130283bd2bf8786e3ba68b43dfc07cb9eb80937da5270
aws-ebs-csi-driver git 1d29a74a sha256:0652dd3c91316424118797da368f2224a49e6c987e3958f629ab76f639ff930f
aws-kms-encryption-provider git c66065de sha256:ca354728f3e92e4980417f47cbee034932b68bbf78237da23169c373d323ec45
aws-pod-identity-webhook git 459c5314 sha256:5407d3a87fe7854bcf20dcbf616f83440f75416b074dd46b774e5eb98f4ece87
azure-disk-csi-driver git 6b55f6fb sha256:849221a68e3dc2095ff8a78673d3544fb4c0d3a0ec1a90c34a539a5ee9f880b8
azure-workload-identity-webhook git 5b8d171e sha256:367badb640023f8daa2d349341bbf102f9242e033f9d7b20d32535c45fa1ed8e
cluster-authentication-operator git 0e39ace5 sha256:f3fe1a8cb603680a600c0af2a0e6ed6ac81b93badf96bee24ddb2318d89b1850
cluster-autoscaler-operator git 70164fc6 sha256:29b9a55d16b67317e11ba3107e88e529c3f1a8342e3d88efb2f298c59094ad1d
cluster-bootstrap git 27bfb59f sha256:db6f0115fe07cb53b42f4c59cdb8335c95d2606f300772fb87af9de596425c57
cluster-capi-controllers git 5830a10a sha256:61c41303f4ae1d3569420ad12089acd1cd17a5a2f10b3f9c8a123e7226563b14
cluster-config-operator git 441d29c9 sha256:e7ff6d2fcefb1a33fa414d945dcd674b56c97dfd869dc761fcb1e324edc624f1
cluster-control-plane-machine-set-operator git 14571e8a sha256:7e3a8045bf833f4a6c1ae53a28e841999167d6ab73450fbb6057c91a7689a99c
cluster-csi-snapshot-controller-operator git 439826e1 sha256:66f912dd6114d5b76659782c58a99834566e077a9ad6f092fafb1409966727a8
cluster-dns-operator git a4b1cfb4 sha256:c4ec8f61ec6d095c7c55ef709b9b0cb1d44e20f1ff2b9d7afa937f19ded685db
cluster-kube-cluster-api-operator git 95ceaa9e sha256:6bd432dd6e97c955520c0b5975377f94abb342baa377a86d4be8579498d86b6d
cluster-machine-approver git 7685374f sha256:d3a0a27800a462ee44986f463eb86154b3f6deab6d0016b33da5b36eda8ae447
cluster-openshift-controller-manager-operator git 2ed3cf99 sha256:5355be5e7975e590cf4eaca71b6d8b6de132261304b96aa7ea49be3322ae7e33
cluster-policy-controller git eaea543f sha256:c219968d0870a9f36a41b77002cdc964cd0ad2f9b066ae9aa2c0ec2696ea07bb
cluster-update-keys git e8478585 sha256:8dc9b78115eaa1df533cb9cf785fe1b898f64bfa6e275f52dad6eae4f3edceeb
configmap-reloader git dc91ddc4 sha256:1b944afd72e95b265fdc1ad7f38ea307d367bc74fabb818ef944e425757bf070
csi-driver-manila-operator git c25d1ff2 sha256:f0638bcf5bf828eecf4a6a2003df26211fe67f86aada8c055c210ff37d4f5b3f
csi-driver-shared-resource git bc125def sha256:4ec666208efddbb10c133d19645daf387046687b930fa084f47a6d5fe3c8ba5b
csi-driver-shared-resource-operator git 1e1194bc sha256:a8638aa0116c91bc79d5a430bf94748eb00553928fcdcde6b4f42ec0c6bac0c3
csi-driver-shared-resource-webhook git bc125def sha256:919cac55972981b79905dc1dfab098032542aa59f1596d3a96060dd2f9a000f3
csi-external-attacher git 7da80aab sha256:5c9fa9719f52dd64e814ca10a124a96bb5f7d3b3dd728299a39090848bcbd156
csi-external-provisioner git 9e8af011 sha256:6ac987c076b78e8e1eb880ed77556704bf276fe14f72972c833c8fbd713e937c
csi-livenessprobe git f5e3ff55 sha256:54ff2cfcd84f74df90fd4aa0774fbb6b486f0d3cec08fd79e08bdbfd3d020c5f
driver-toolkit git 1d5732f0 sha256:a24c3d0b69d81ee43562f80e2d25ddd64dc3cb3c896f820a45cbdce6cdc50067
egress-router-cni git 7089efe6 sha256:6b7dfee4309409c58613bbbc7625a753c38923be4ed0a750c9dd99f0b54fa433
etcd git e7911c0d sha256:857ad645df494be9b176deeefc02ec8c9355ab038c8ad7d77e8d3fc0fd2c07b8
gcp-cloud-controller-manager git 26b43dfc sha256:71321fbe2e06bf4ae8162e8d659ab898d4947a752898cd11e0b778fcc9075f27
gcp-pd-csi-driver-operator git 799327f7 sha256:ae7ab85869f0fbb3a6c159b9ea139ba10c9e03ce5eae76981cf09529782e122e
ibm-cloud-controller-manager git f961f16d sha256:c2b26042c300f39d9d7cc1f7b31a97eb45a48e6e4f83327b3b25064d19cd7b91
ibmcloud-machine-controllers git d29506e7 sha256:aca801ec68ba6fdff9151bd2c1bbcd8a7b3e32edbde82de35b259c43e6704ec6
ironic-machine-os-downloader git 93b8b5fa sha256:b9a6cd850ca584854254f98f3dab96b3da3cbf49a2bb45f2d4a5cc7ab8e71700
ironic-static-ip-manager git f44e8a08 sha256:6033550782aa10023abe34bf6b05b0447ede37bb5745a3fb95dbe1f6e069b5cb
k8s-prometheus-adapter git e4f859be sha256:5c1ca986a6e6388bc7d004d0c3dc9be20811d992c6c945ae817eb973d4fe39cf
keepalived-ipfailover git b58673a3 sha256:c5c11b97d36283ef5e201b9ce196adfda29eaef838b44d09530a468a797d4fc3
kube-rbac-proxy git c38f4734 sha256:3ac6566c948a6a73ae9e6e0f62e5fdd6f45c64bf99825a31f4765dd86ab2564c
kubevirt-csi-driver git d474c42e sha256:1a7f9035973203f0c803f6bdaacf5b2f1824149413cbc38987f11f448f4efaaa
multus-networkpolicy git f988f894 sha256:dbf654b82a470a6165474be3961f5b6a48122598c42dd1ea754770519f2ee547
multus-route-override-cni git 73594f77 sha256:66255774fe75cf5a9db0624b1a801af435da23bb8a6c057a67e83f303f2e8197
network-tools git 234ed43e sha256:8256d17a3dbb74f07d0cac3deb544883bda3443632921ddc6c517f31fbb8f88f
nutanix-cloud-controller-manager git 28bf5963 sha256:90b60fd0564de58aede8d6f455202c3d0a4bae5cc75b19cde31b275d5128ed24
oauth-server git 3739138c sha256:497814bc8c4c5e357b60f7e73d22546c89845adc68d74f72c03e033c00c86758
oc-mirror git b137a53a sha256:5433b944e5599493c72560974a2680481e8d9463334376903d2befff902af297
olm-catalogd git 79975a51 sha256:244d6b6b5f60ed896dba93722c2214e008fdc63c7b1a210a835851be488340df
olm-operator-controller git 80b8649c sha256:bbf23c471864ebcc290a7661feb7da8998553fe9585a200f30b262f86758ad9d
olm-rukpak git 282cc84c sha256:33d09057628d548599fd291c58766a48dc3fae7da89980a6aca2f615da7760ed
openshift-state-metrics git 59b8a0ff sha256:02e3efb52922ae1bea0a5c79ba9b5477e8cb0324b8edbef6f1783d88780ad0dc
openstack-cinder-csi-driver-operator git 85b52097 sha256:abc90ceb3362b3729417e9794037454471cafc15c43a3d24f6cc4f4ca563b3d1
powervs-block-csi-driver git 26162bad sha256:042960ac1c60ae3ad476e66300692731cd6316e2d7a5f461683f2148abee5c45
powervs-block-csi-driver-operator git 9c5dd8d1 sha256:d9769005b0428abe3f493d02bd305868fc8bc583c940d38df474ef008305b719
powervs-cloud-controller-manager git 20e6dc70 sha256:7e6078b764275dd33dbe20b0647101b5dd3c8c421aa9883f25106a05e9257b6d
prom-label-proxy git 5e14722e sha256:37eec309c0fc71a249bfc52732a28ebd93dfc6a26d291c1241441764012e0659
prometheus-config-reloader git c7262a43 sha256:7a9c818ec9d5ec54bccb23244860772122c2bf8a54750128dd0eeb2e81eeaf10
prometheus-node-exporter git 29ba26d1 sha256:add4532fa541d2b55332de95b47f8b70b5b1925e7236c9aabe1d54e20cc60997
prometheus-operator git c7262a43 sha256:13a5adfd40fd0f1205dde9a29d0ff3a72919badc1d26879f42719529ba196e71
prometheus-operator-admission-webhook git c7262a43 sha256:ebb6877af14df9e89f32bb4d593000b564fcb8c327f84c44443076de1e7c9c1a
rhel-coreos sha256:93006f7127167e6e1795d2ceb46a5aba3ef31c6d3d4d0c833b63ec2346ddf1d2
rhel-coreos-extensions sha256:8cedd67f176720dff2286e09eb59f0925b1367666a311c9ce630db5b71853db4
service-ca-operator git 538c7b98 sha256:008040501c9528c974aff972a7cd38f34532bea9806a9dc0c4404ca42652da12
telemeter git c1ecd105 sha256:09c00f60d6a6f9765f469ea8a21be91e6546620321544eb8733db7b41de78946
thanos git 85eee25c sha256:b276e68f3566161317ea38e8cdd5cbada28a9d335f3eed4a18c3cd41c1d4b7c4
vsphere-csi-driver-operator git 7940ea16 sha256:bfd2ef1bbfbf0fbf858282293678fa33bfd5bedfeb1cad052f7abc914e1f702b

agent-installer-api-server

OCPBUGS-58631, OCPBUGS-58636: Bump glog to v1.2.5 in release-4.16 (#7901) #7901
OCPBUGS-47627: dnsmasq service on OCP SNO fails to read /etc/resolv.conf file during system startup (#7857) #7857
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-53718: Bump jwt to 4.5.2 in release-4.16 (#1091) #1091
Full changelog

agent-installer-node-agent

run go mod tidy / vendor #1019
And 3 elided commits (e.g. from squash or rebase merges)
Full changelog

agent-installer-utils

OCPBUGS-68046: bump github.com/sirupsen/logrus to v1.9.3 #239
Full changelog

aws-cluster-api-controllers

OCPBUGS-78227: [release-4.16] update go mod dependency for konflux #591
OCPBUGS-61942: UPSTREAM <carry>: revert: Only tag NetworkInterfaces in RunInstances if IAM Allows It #572
OCPBUGS-58666, OCPBUGS-58671: bump github.com/golang/glog to v1.2.5 #560
Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator

OCPBUGS-64831: Use 127.0.0.1 for healtz http-endpoints #467
OCPBUGS-64768: Add RBAC ClusterRole and Binding for driver node #465
OCPBUGS-61253: add ability to control kube rbac proxy container image… #426
OCPBUGS-60598: Bump library-go #423
OCPBUGS-59606: Backport stale conditions fix #407
OCPBUGS-60248: add tag matching to Azure File storage class #414
Full changelog

aws-machine-controllers

OCPBUGS-73903: Fix reconciler consistency checks in Update and Exists #168
OCPBUGS-63140: client: re-use a single file for building the session instead of randomly named files #144
Full changelog

azure-cloud-controller-manager, azure-cloud-node-manager

OCPBUGS-79998, OCPBUGS-85635, OCPBUGS-85636: Bump google.golang.org/grpc to v1.79.3 #182
Full changelog

azure-cluster-api-controllers

OCPBUGS-78176: [release-4.16] update go mod dependency for konflux #364
Full changelog

azure-file-csi-driver

OCPBUGS-89335: Address CVE-2026-33186 #139
Full changelog

azure-kms-encryption-provider

OCPBUGS-79927: Bump google.golang.org/grpc to 1.64.1-sec.1 patch #48
Full changelog

azure-machine-controllers

OCPBUGS-66044: Set updateDomainCount to one when faultDomainCount is one #177
OCPBUGS-52476: Remove unused vnet package #131
OCPBUGS-56169: [release-4.16] Update virtualmachines service to armcompute/v5 SDK #147
OCPBUGS-56656: Fix failure when attempting to modify immutable availabilitySet #151
OCPBUGS-56092: Update eviction policy for Spot VMs from Deallocate to Delete #142
OCPBUGS-54990: Re-reconcile machine on NIC provisioning failure #137
Full changelog

baremetal-installer, installer, installer-altinfra, installer-artifacts

OCPBUGS-74885: Azure UPI ARM template: use storageAccountId #10282
OCPBUGS-76586: terraform/provider/google: Fixing GCP inconsistencies present with the service account creation #10298
OCPBUGS-73879: data/manifests/bootkube/cvo-overrides: Default to eus-4.16 #10226
OCPBUGS-54165: aws: fix NLB creation in secret regions #10031
OCPBUGS-53237: Validation for API and Ingress VIPs when using user-managed load balancer #10048
OCPBUGS-62952: Update the RHCOS 4.16 bootimage metadata #10022
OCPBUGS-62653: Release 4.16 bump terraform provider azurerm #9993
OCPBUGS-59162: vSphere - remove unit tests using nip.io #9835
OCPBUGS-62235: Make swift containers removal not fatal for UPI. #9961
OCPBUGS-58290: sort zone slices extracted from map of byo subnets #9819
OCPBUGS-55807: update resolv.conf every time on bootstrap node #9694
OCPBUGS-57460: vsphere - check if host is powered down or on standby before uploading template #9786
OCPBUGS-36677: Power VS: Enable incoming traffic on port 5000 during installation in a restricted network #8711
OCPBUGS-57498: ensure ctrplane nodes can access bootstrap MCS #9788
OCPBUGS-54240: Update timeout for GCP WaitFor operation #9715
OCPBUGS-35040: Power VS: Add ports needed for private clusters to security group #8546
Full changelog

baremetal-machine-controllers

OCPBUGS-78099: [release-4.16] fix vendor/ for hermetic migration 4.16 #243
Full changelog

baremetal-operator

OCPBUGS-77278: Unblock BMH direct deletion when detached annotation is present #463
Full changelog

baremetal-runtimecfg

OCPBUGS-60113: Re-add ENABLE_NODEIP_DEBUG env var #362
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-64616: Help with must-gather scheduling through suggesting preferance of nodes #2151
OCPBUGS-64561: Update go-jose, x/crypto, x/net #2144
OCPBUGS-59938: Adding sos.conf file for default sos config into the tools image #2064
OCPBUGS-60675: Use fedora image in unit tests instead of centos #2079
Full changelog

cloud-credential-operator

OCPBUGS-65802: ccoctl azure: retry custom role creation on consistency errors #952
OCPBUGS-63550: ccoctl: add public-key-file flag to create-all #940
OCPBUGS-55129: snyk to ignore SNYK-GOLANG-GOLANGORGXNETHTML-9572088 #918
OCPBUGS-60973: ccoctl: aws to use proper issuer url on subsequent runs #909
OCPBUGS-60861: ccoctl: only add owned tag to azure resources on create #902
OCPBUGS-58676: github.com/golang/glog v1.2.5 #893
OCPBUGS-56981: Azure: resolve nil pointer exception when role assignment exists #867
Full changelog

cloud-network-config-controller

OCPBUGS-66346: [release-4.16] Fix capacity calculation #195
OCPBUGS-65567: [release-4.16] Change the capacity struct from int to ptrOfInt #192
OCPBUGS-56359: Increase API call timeout to 30 second #172
Full changelog

cluster-autoscaler

OCPBUGS-78702: allow clusterapi provider to skip paused resources #415
OCPBUGS-60915: revert openshift replica fix #377
OCPBUGS-59267: Fix cool down status condition to trigger scale down #363
OCPBUGS-60609: fix checkpoint gc of unknown recommenders #372
Full changelog

cluster-baremetal-operator

OCPBUGS-77447: Bump github.com/go-errors/errors to v1.5.1 #562
OCPBUGS-64741: Always have a service for ironic-api port #524
OCPBUGS-63417: Fix ironic inspector container privileges #513
OCPBUGS-61504: Remove webhookport (9447) as HostPort #506
Full changelog

cluster-capi-operator

OCPBUGS-79943: Bump google.golang.org/grpc to v1.79.3 #573
NO-JIRA: Allow sustaining engineering to self serve dependency updates #560
Full changelog

cluster-cloud-controller-manager-operator

OCPBUGS-63168: ccm: disable unused secure-serving port and webhook #422
OCPBUGS-60387: Add Service using common resource templating #411
OCPBUGS-60387: Update service selector to match deployment label #410
Full changelog

cluster-config-api

CNTRLPLANE-1982: Promote streaming list encoding to Default #2600
OCPBUGS-71202: Add HTTPKeepAliveTimeout to IngressController API #2640
NO-JIRA: Promote streaming list encoding to Default on Hypershift. #2568
CNTRLPLANE-1611: Add feature gates for StreamingCollectionEncoding #2542
OCPBUGS-58392: Add IPsec API for NAT-T UDP encapsulation support #2393
OCPBUGS-56424: Add IdleConnectionTerminationPolicy field to IngressControllerSpec #2330
Full changelog

cluster-etcd-operator

OCPBUGS-68058: Update logrus to 1.9.3 to address CVE-2025-65637 #1546
OCPBUGS-61505: Vendor latest mixin, including additional and modified alerts for etcdDatabaseQuotaLowSpace #1482
OCPBUGS-60836: add missing ports to svc and pod spec #1473
OCPBUGS-53510: fix CVE-2025-30204 #1403
Full changelog

cluster-image-registry-operator

OCPBUGS-68059: : Bump github.com/sirupsen/logrus to v1.9.1 #1285
OCPBUGS-53870: bump github.com/golang-jwt/jwt #1219
OCPBUGS-51600: bump golang.org/x/oauth2 #1210
Full changelog

cluster-ingress-operator

OCPBUGS-86713: Add configuration override for X-SSL strip #1487
OCPBUGS-71202: Implement HTTPKeepAliveTimeout tuning option #1337
OCPBUGS-56424: Add e2e tests for IdleConnectionTerminationPolicy #1235
OCPBUGS-56424: Add support for IdleConnectionTerminationPolicy #1234
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-68064: CVE-2025-65637 openshift4/ose-cluster-kube-apiserver-rhel9-operator: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload [openshift-4.16.z] #2043
OCPBUGS-60467: Add missing service ports to apiserver service #1895
Full changelog

cluster-kube-controller-manager-operator

OCPBUGS-60834: Missing endpoint slices for open ports the operator uses #864
Full changelog

cluster-kube-scheduler-operator

CNTRLPLANE-2843: chore: update OWNERS #624
Full changelog

cluster-kube-storage-version-migrator-operator

OCPBUGS-68069: Bump github.com/sirupsen/logrus to v1.9.1 #144
Full changelog

cluster-monitoring-operator

OCPBUGS-77276: AlertingRule: fix duplicate PrometheusRules after MD5->SHA-224 naming change #2831
OCPBUGS-64581: Fix KSM deny-list typo #2733
OCPBUGS-64637: Add mcd_local_unsupported_packages metric from MCO to telemetry 4.16 #2735
OCPBUGS-62765: port metric acm_managed_cluster_worker_cores:max to OCP 4.16 #2719
OCPBUGS-63235: test: remove image registry e2e tests #2727
OCPBUGS-61856: chore(jsonnet): use prometheus_remote_storage_queue_highest_timestamp_seconds in PrometheusRemoteWriteBehind #2676
Full changelog

cluster-network-operator

OCPBUGS-84182: fix(hypershift): use net.JoinHostPort for URL construction #2981
OCPBUGS-75890: Tweak iptables-alerter to try to avoid crictl bug #2898
: NO-JIRA: Update CNO reviewers/approvers #2768
OCPBUGS-63155: Add drop flows for GARPs #2819
OCPBUGS-57354: block upgrade if a CNI migration is in progress #2760
OCPBUGS-62055: Update CNO reviewers/approvers #2803
OCPBUGS-44443: Add controlplane cli image envar for use with hypershift #2791
OCPBUGS-58392: Add IPsec API for NAT-T UDP encapsulation support #2736
OCPBUGS-56992: iptables-alerter streamlining #2717
OCPBUGS-56195: Fix live migration with feature migration configured explicitly #2710
OCPBUGS-53317: Fix feature migration for EgressIP #2673
Full changelog

cluster-node-tuning-operator

OCPBUGS-82675: Bump github.com/moby/spdystream from v0.2.0 to v0.5.1 #1551
OCPBUGS-78766: [4.16] PPC: filter out namespaces dir #1466
Full changelog

cluster-olm-operator

OCPBUGS-86243: Update grpc-go to v1.67.3-sec.1 to fix CVE-2026-33186 #206
Full changelog

cluster-openshift-apiserver-operator

OCPBUGS-68072: CVE-2025-65637 - Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.16] #654
Full changelog

cluster-samples-operator

OCPBUGS-63516: references to github.com/sclorg/django-ex.git now also refer to the branch #659
OCPBUGS-55457: Adding mutex to func createSamples on handler.go #633
Full changelog

cluster-storage-operator

OCPBUGS-87613: remove oVirt code from CSO 4.16 #709
OCPBUGS-78769: Add patch permission to provisioner role #685
OCPBUGS-61252: add ability to control kube rbac proxy container image on controlplane #614
Full changelog

cluster-version-operator

OCPBUGS-58452: Failing=Unknown upon long CO updating #1213
OCPBUGS-55156: Fix a panic caused by a data race #1178
Full changelog

console

OCPBUGS-77123: [release-4.16] CVE-2026-26996 Bump minimatch library #16346
OCPBUGS-79439: Bump immutable #16657
OCPBUGS-88027: Fix JSON annotation parsing to prevent OperatorHub crash #16588
OCPBUGS-88377, OCPBUGS-88380, OCPBUGS-88412, OCPBUGS-88419, OCPBUGS-88444: CVE-2026-44495 #16612
OCPBUGS-88554: Stabilize legacy OperatorHub Cypress waits #16608
NO-JIRA: enable multi-architecture yarn builds #16417
OCPBUGS-83299: [release-4.16] openshift4/ose-console-rhel9: Axios: Remote Code Execution via Prototype Pollution escalation #16298
OCPBUGS-78673: Namespace is not persisting when switching to developer view from the topology page of admin page #16161
CONSOLE-5011: migrate to yarn berry #16078
OCPBUGS-76578: Bump axios #16032
NO-JIRA: Bump builder image to v29 #15993
OCPBUGS-74447: Bump lodash to latest #15967
OCPBUGS-69678: Disallowed Pipelines-plugin Pipelines navigation section #15857
OCPBUGS-64884: Remove required flag from ‘console.flag/model’ pipelines-plugin extension #15707
OCPBUGS-64649: /auth/error?error=missing_state&error_type=auth is showing blank page #15675
OCPBUGS-44157: bump dompurify to latest #15591
OCPBUGS-62123: Remove ancient X-XSS-Protection header #15528
OCPBUGS-61057: OpenShift console PVC clone cannot use B as the unit #15450
OCPBUGS-60175: Tolerate unknown fields in Infrastructur… #15368
OCPBUGS-60641: Secret key with binary file changes when edited via Console #15417
OCPBUGS-59869: Not able to launch terminal window from OCP web console due to console plugin conflicts #15334
OCPBUGS-57677: Update the golang.org/x/crypto/ssh to 0.31.0 in the openshift-console image #15328
OCPBUGS-60115: Cannot read properties of undefined (reading ‘node-role.kubernetes.io/master’) error while accessing node logs from console #15358
OCPBUGS-59358: fix bug where / in console.tab/horizontalNav href brea… #15286
OCPBUGS-37603: Manual backport of several incremental fixes for unauthenticated endpoints #15312
OCPBUGS-59274: Add the ability to launch multiple modals with useModal hook #15276
OCPBUGS-59445: Cannot read properties of undefined (reading ‘filter’) error while accessing nodes from console. #15291
OCPBUGS-58407: Add flags in console static plugin for all the components of this epic #15243
OCPBUGS-56838: Fetching taskRuns in PLR details page using PLR UID also #15099
OCPBUGS-58188: Fix TypeError Cannot read properties of null (reading ‘metadata’) #15214
OCPBUGS-57326: Remove logoutOpenShift method call #15172
OCPBUGS-57270: Debug pod logs are not accessible when debugging a node via OpenShift Console #15165
OCPBUGS-57096: Add all files to vendor regardless of gitignore #15133
OCPBUGS-57089: Sample segment sessions #15130
OCPBUGS-56858: remove 60 day alert from cluster update modal #15102
OCPBUGS-56715: update the Deployment pod on change in imageStream #15091
OCPBUGS-56472: Remove the devconsole backend common internet proxy and replace it with dedicated ones #15072
OCPBUGS-55378: Do not load CSRs if user does not have permissions #15000
OCPBUGS-55644: fix bug where operator appears twice #15016
OCPBUGS-45142: Add missing pipelines plugin name to known plugins #14550
Full changelog

console-operator

OCPBUGS-77992: update go mod dependency for konflux #1115
OCPBUGS-60794: Update downloads deployment configuration to use master node selector #1036
Full changelog

container-networking-plugins, containernetworking-plugins-microshift

OCPBUGS-85669: CI Build root image tag sync with ART #234
OCPBUGS-55648: Check error returned by ipv6 SettleAddresses #188
Full changelog

coredns

OCPBUGS-77463: Modify .gitignore to not exclude vendor build folders #168
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-79978: Bump google.golang.org/grpc #389
OCPBUGS-68080: fix CVE-2025-65637 #361
OCPBUGS-58884: CARRY: don’t ignore json files #341
Full changelog

csi-driver-nfs

OCPBUGS-84931: Replace google.golang.org/grpc with github.com/openshift-sustaining/grpc-go v1.67.3-sec.1 to avoid go version bump and fix CVE-2026-33186 #182
Full changelog

csi-external-resizer

OCPBUGS-62465: Requeue PVC over PV creation #174
Full changelog

csi-external-snapshotter, csi-snapshot-controller, csi-snapshot-validation-webhook

OCPBUGS-60450: UPSTREAM: 1238: Snapshot Controller startup should not LIST all volumesnapshots #186
Full changelog

csi-node-driver-registrar

OCPBUGS-64632: update log level verbosity to not clutter logs #91
Full changelog

docker-builder

OCPBUGS-65907: BuildConfig inline Dockerfile fails with heredoc syntax #489
OCPBUGS-58074: S2I build cpu limits observed by assemble are limited to 1 cpu #475
Full changelog

docker-registry

OCPBUGS-60183: bump openshift/docker-distribution #441
OCPBUGS-53654: bump jwt and oauth dependencies #432
Full changelog

gcp-cluster-api-controllers

OCPBUGS-78280: [release-4.16] update go mod dependency for konflux #267
Full changelog

gcp-machine-controllers

OCPBUGS-79970: Bump google.golang.org/grpc to v1.79.3 #167
OCPBUGS-79970: [release-4.16] Fix setup-envtest GCS 401 by downloading binaries directly #176
OCPBUGS-55249: Disable shielded VMs for non-UEFI disks #116
Full changelog

gcp-pd-csi-driver

OCPBUGS-68087: Update logrus to 1.9.3 #92
Full changelog

haproxy-router

OCPBUGS-86713: Strip X-SSL-* headers for plain HTTP #805
OCPBUGS-79960: Bump google.golang.org/grpc to v1.79.3 #769
OCPBUGS-56424: Add support for IdleCloseTerminationPolicy #655
OCPBUGS-49391: Reject All CA-Signed Certs Using SHA1 #651
Full changelog

hyperkube, pod

OCPBUGS-68041, OCPBUGS-68091: CVE-2025-65637 - bump github.com/sirupsen/logrus to v1.9.3 [4.16] #2582
OCPBUGS-74299: Skip E2e: attach on previously attached volumes should work #2568
OCPBUGS-65694: Fix Concurrentmap Iteration #2519
CNTRLPLANE-1612: Backport StreamingCollectionEncoding for JSON and protobuf #2485
OCPBUGS-61908: UPSTREAM: <carry>: Don’t retry storage calls with side effects. #2470
OCPBUGS-60553: [4.16]: podresources: list: use active pods #2454
4.16: OCPBUGS-60872: UPSTREAM: 127757: scheduler: Improve CSILimits plugin accuracy by using VolumeAttachments #2435
OCPBUGS-60272: Bump nfs server provisioner #2402
OCPBUGS-58054: UPSTREAM: 130047: adjusting loopback certificate validity in kube-apiserver #2342
OCPBUGS-58054: UPSTREAM: <carry>: disable some legacy cloud provider Azure tests #2352
OCPBUGS-57290: UPSTREAM: <carry>: Bump cadvisor version to fix kubelet #2325
Full changelog

hypershift

OCPBUGS-84182: fix(cno): use brackets only for IPv6 in server URL #8348
OCPBUGS-76534: feat(updates): enable CVO metrics access with RHOBS monitoring flag #7704
OCPBUGS-74375, OCPBUGS-74376: Support proxy authentication when user/pass is included in URL #7578
OCPBUGS-73118: Fix Konflux EC voilation, update deprecated base … #7459
OCPBUGS-63640: [release-4.16] fix(konnectivity): resolve circular dependency causing DNS timeouts and excessive retries #7113
OCPBUGS-64680: Update DNS names for ovn-kubernetes cp metrics #7158
CNTRLPLANE-1904: Migrate 4.16 pipelines to common pipeline template #7212
CNTRLPLANE-1426: feat(konflux): tag MCE HO images with latest #6839
OCPBUGS-61252: dont use registryOverrides on kube rbac proxy image be… #6756
OCPBUGS-61582: Update KCM node monitor grace period #6797
OCPBUGS-61860: Use the common MCE konflux pipeline #6844
OCPBUGS-60150: Always compress and encode payload in token secret for inplace upgrades #6750
OCPBUGS-60951: MCE 2.6 konflux hcp cli #6701
CNTRLPLANE-1203: HO MCE change to hermetic ta build #6654
CNTRLPLANE-1231: Move CPO pipeline to hermetic builds #6599
OCPBUGS-58505: [release-4.16] Add missing service network DNS entries to KAS cert #6393
OCPBUGS-57494: Add proxy variables for the MCD Pod #6286
OCPBUGS-55697: Add validation to avoid conflicts between KubeAPIServer and NamedCertificates SANs #6114
CNTRLPLANE-919: Konflux build pipeline service account migration #6087
CNTRLPLANE-919: Konflux build pipeline service account migration #6082
OCPBUGS-51804: Fix golang crypto dependency go.mod replacement #5994
OCPBUGS-54914: Add konnectivity-proxy sidecar to openshift-oauth-apiserver #6026
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-79964: Bump google.golang.org/grpc to v1.79.3 #145
OCPBUGS-77210: [release-4.16] standardize build paths #124
OCPBUGS-58737: bump github.com/golang/glog to version v1.2.4 #106
OCPBUGS-56063: tech debt: rework vendor patches #91
Full changelog

ibm-vpc-block-csi-driver-operator

OCPBUGS-59727: [IBM VPC] set offlineExpansion to false in e2e test manifest #149
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-67288: [release-4.16] Fix incomplete vendor/ #138
OCPBUGS-51818: CVE-2025-22869 Update golang.org/x/crypto to patched OpenShift fork #109
Full changelog

insights-operator

OCPBUGS-68370: Add filtering to add other possible pod status to QEMU gatherer #1200
OCPBUGS-67009: QEMU logs are not gathered if there are pending status virt-launcher pods #1197
And 5 elided commits (e.g. from squash or rebase merges)
Full changelog

ironic

OCPBUGS-76457: Bump pyasn1 to 0.5.1-4 #828
OCPBUGS-69789: Bump eventlet version to 0.33.1-7 #763
Full changelog

ironic-agent

OCPBUGS-95070: Replace individual package removal with a single rpm -e loop #288
OCPBUGS-95070: Replace dnf remove with rpm -e to prevent dependency removal #276
OCPBUGS-61165: netutils: Use ethtool ioctl to get permanent mac address #215
OCPBUGS-69781: Bump eventlet version to 0.33.1-7 #232
Full changelog

kube-metrics-server

OCPBUGS-79929: Bump google.golang.org/grpc to v1.79.3 #66
Full changelog

kube-proxy, sdn

OCPBUGS-54457: Drop SYNACK as well in MCS side #658
Full changelog

kube-state-metrics

OCPBUGS-74875: Deduplicate CRS stores #133
Full changelog

kube-storage-version-migrator

NO-JIRA: Add DOWNSTREAM_OWNERS (release 4-16). #227
Full changelog

kubevirt-cloud-controller-manager

OCPBUGS-95082: OWNERS: Update component to Cloud Compute / KubeVirt Provider #82
Full changelog

libvirt-machine-controllers

OCPBUGS-77196: Fix incomplete vendor/ #302
OCPBUGS-26525: Updating ose-libvirt-machine-controllers-container image to be consistent with ART for 4.16 #283
Full changelog

machine-api-operator

OCPBUGS-98439: Use resource group when generating default Azure image #1516
OCPBUGS-76849: bumped logrus to v1.9.3 #1463
OCPBUGS-57210: Updates GCP CredentialsRequest #1378
OCPBUGS-55248, OCPBUGS-55249: Updates GCP credentials request #1355
Full changelog

machine-config-operator

OCPBUGS-98960: Remove sensitive ControllerConfig logging #6315
OCPBUGS-98253: Bootstrap MCS logging entire ignition #6290
OCPBUGS-62171: Fix - NetworkManager restart or crash renders br-ex unusable #5354
OCPBUGS-60113: Enable debug logging for nodeip-configuration #5218
OCPBUGS-77253: Machine-config controller should not log about non-existent pull-secret changes #5694
OCPBUGS-77184: machine-config-daemon: openshift: Exposure of Sensitive Data in Log Files in the Machine Configuration Daemon. [openshift-4] #5685
OCPBUGS-63155: [release-4.16] Networking: reset ovn-remote config and allow ovnkube controller to set it #5359
OCPBUGS-60773: scope MCD node listers to current node #5260
OCPBUGS-63553: Add control-plane label for master nodes on legacy clusters #5376
OCPBUGS-57423: pkg/operator/status: Drop PoolUpdating as an Upgradeable=False condition #5119
OCPBUGS-63332: Recheck generatedByControllerVersion annotation prior to deleting a degraded MC #5364
OCPBUGS-56753: Support NODEIP_HINT in IPI deployments too #5079
OCPBUGS-62689: Add mcd_local_unsupported_packages recording rule #5328
OCPBUGS-59931, OPNET-681: Support migration to NMState #5205
OCPBUGS-61869: Override NMState service definition #5290
OCPBUGS-60621: Add workaround fix for static pod race #5252
OCPBUGS-56558: Log CRC MC deletion #5178
OCPBUGS-58270: Do not set cpu system reserve below the default value #5163
add missing vendors #4952
OCPBUGS-48283: Do not run resolv-prepender from NM dispatcher #4784
OCPBUGS-56868: daemon: fix ostree-finalize-staged race workaround for package mode RHEL workers #5090
OCPBUGS-56626: error from generateAndValidateRenderedMachineConfig function can be misleading #5075
OCPBUGS-54831: Make mtu-migration run after wait-for-primary-ip #4990
OCPBUGS-55684: MSBIC should not update windows machinesets #5028
OCPBUGS-35921: userCA and cloudCA certfiicates are not removed from nodes and ignition config #4419
Full changelog

machine-image-customization-controller

OCPBUGS-68093: [4.16] uplift logrus #153
Full changelog

machine-os-images

OCPBUGS-87878: Add support for hermetic builds via Cachi2 prefetched CoreOS ISOs #102
Full changelog

monitoring-plugin

Fix for OCPBUGS-90069 OCPBUGS-90073: CVE-2026-12151 CVE-2026-9697 #1007
OCPBUGS-79441: immutable bump #898
OU-1260: [release-4.16] feat: use npm instead of yarn #813
OCPBUGS-76807: fix for CVE-2025-69873 #849
OCPBUGS-54316: Fix “Export as CSV” #469
Full changelog

multus-admission-controller

OCPBUGS-58767: Update the github.com/golang/glog module to v1.2.4 #103
Full changelog

multus-cni, multus-cni-microshift

OCPBUGS-85251: Fix server url in kubeconfig #300
NO-ISSUE: [release-4.16] Bump Go to 1.21 and fix CI build root image #292
OCPBUGS-47472: adds getcontext (backport 4.16) #261
Full changelog

multus-whereabouts-ipam-cni

OCPBUGS-70215: Prevent accidental IP deallocation in statefulsets #396
OCPBUGS-55618: Fixes leftover podref issue #365
Full changelog

must-gather

OCPBUGS-86218: Collect object size with the object count #550
OCPBUGS-66106: Separate resources with comma to fix malformed inspect #515
Full changelog

network-interface-bond-cni

OCPBUGS-61348: Bump github.com/containernetworking/plugins from to 1.7.1 #95
NO-JIRA: Updating ose-network-interface-bond-cni-container image to be consistent with ART for 4.16 #91
NO-JIRA: Add ci-operator.yaml file on release-4.16 #84
Full changelog

network-metrics-daemon

OCPBUGS-58777: Bump github.com/golang/glog to v1.2.4 (#113) #113
OCPBUGS-60186: Replace e2e test image (#122) #122
swtich golint install method (#123) #123
Full changelog

nutanix-machine-controllers

OCPBUGS-51854: CVE-2025-22868 #110
OCPBUGS-47266: fixing CVE-2024-45338 #93
Full changelog

oauth-apiserver

OCPBUGS-74112: UPSTREAM: <carry>: bump kubernetes-apiserver to pick up loopback cert expiration update #166
NO-JIRA: (chore): update OWNERS file #172
Full changelog

oauth-proxy

OCPBUGS-61446: Update x/crypto to v0.31.0 #335
OCPBUGS-62707: Fix oauth-proxy e2e-component tests #338
Full changelog

openshift-apiserver

OCPBUGS-82682: Address CVE-2026-35469 #649
OCPBUGS-68104: CVE-2025-65637 - Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.16] #610
OCPBUGS-74113: UPSTREAM: <carry>: bump kubernetes-apiserver to pick up loopback cert expiration update #595
OCPBUGS-63394: Wire dry run option to Image API server operations #566
OCPBUGS-61474: Skip blocked registry check for registries with mirrors #552
OCPBUGS-56612: Fix image reference in TestImageStreamImportQuayIO #516
Full changelog

openshift-controller-manager

OCPBUGS-61707: legacy image pull secret rollback controller #416
OCPBUGS-60233: ignore error failing to find pull/push secrets #409
OCPBUGS-57513: Set node-pullsecrets volume to read-only to protect image pull credentials #394
OCPBUGS-56354: Empty proxy variables are causing issues during the build #382
Full changelog

openstack-cluster-api-controllers

OCPBUGS-58028: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.10 into release-4.16 #346
Full changelog

openstack-machine-api-provider

OCPBUGS-78170: hermetic 4.16 #163
OCPBUGS-76794: Fix make test #155
Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

OCPBUGS-79980, OCPBUGS-79981, OCPBUGS-87898: Fix CVE-2026-33186 with openshift-sustaining/grpc-go v1.67.3-sec.1 [release-4.16] #1318
OCPBUGS-82057: Drop github.com/distribution/distribution dep #1302
OCPBUGS-77959: Remove the collect-profiles info from the microshift kustomization file #1251
OCPBUGS-77169: Remove the collect-profiles job #1235
OCPBUGS-58881: operatorgroup: ensure clusterroleselectors in clusterrole aggregation rules are sorted #1102
OCPBUGS-59647: Reduce Frequency of Update Requests for Copied CSVs (#3597) #1042
OCPBUGS-60847: Add NetworkPolicy as a supported kind #1050
OCPBUGS-61388: [4.16] e2e stability fixes #1083
OCPBUGS-57429: reduce cache expiry frequency [release-4.19] #1022
OCPBUGS-56358: fix(olm): improve error logging for missing olm.managed label (#3558) #1006
Full changelog

operator-marketplace

OCPBUGS-68108, OCPBUGS-68109: CVE-2025-65637 fixed in logrus v1.9.3+ #722
OCPBUGS-62220: Remove Expect func so that the test case can use the retry logic #671
OCPBUGS-61920: Update memoryTarget on catalog source pods #664
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-83497: External gateway: Remove routes for external gateway pods in terminating or not ready state #3140
OCPBUGS-78033: Add pperiyasamy to OWNERS for release-4.16 #3047
OCPBUGS-77685: Clear stale conntrack UDP entries for nodePorts #3038
OCPBUGS-77187: Fix conntrack reconciliation to use service port instead of endpoint port #2998
CORENET-6055, OCPBUGS-76277: [release-4.16] Dockerfile: Unpin OVN and consume the latest from FDP #2972
OCPBUGS-71219: [release-4.16] CVE-2025-65637 Bump github.com/sirupsen/logrus to v1.9.1 through indirect dependency conversion (go-controller module) #2906
OCPBUGS-72541: NetPol & MultiNetPol: Process update only when spec fields and/or related annotation are updated #2933
OCPBUGS-68349: Add ricky-rav to OWNERS for release-4.16 #2899
OCPBUGS-66155: Skip Pending pods in EgressIP status updates #2880
OCPBUGS-64944: [release-4.16]: Configure sec nic EIPv6 address with NODAD and maximum lifetime #2853
OCPBUGS-64858: Fix stale EIP assignments during failover and controller restart #2851
OCPBUGS-63155: Fix EgressIP stale GARP post reboot + pod restart #2809
OCPBUGS-63230: Fix dnsnameresolver address set #2812
OCPBUGS-60079: Always enable global IPv6 forwarding #2743
OCPBUGS-60494: Update OWNERS file: Add Patryk/Martin as approvers #2718
OCPBUGS-58161: Unpin OVS patch versions #2648
OCPBUGS-57396: Fix predicate for cluster subnet route to gateway router #2645
OCPBUGS-55282: Fix hybrid overlay node subnets collision with cluster subnets #2621
OCPBUGS-48121: Increase InformerSyncTimeout to 60s #2624
OCPBUGS-56242: Handles unspecified protocol in network policy port #2571
OCPBUGS-56812: egressfirewall: avoid nil dereference on node delete #2591
OCPBUGS-52503: Fixes unexpected mp0 route removal during start up #2479
Full changelog

powervs-machine-controllers

OCPBUGS-61511: Use OS_GIT_VERSION in Makefile when found (for Konflux builds) #127
OCPBUGS-54752: Fix for CVE-2024-51744 in github.com/golang-jwt/jwt/v4 in release-4.16 #114
Full changelog

prometheus

OCPBUGS-79985: Bump google.golang.org/grpc #321
OCPBUGS-61856: chore: compute highestTimestamp at queryManager level #270
OCPBUGS-56739: BACKPORT: fix promtool analyze block shows metric name with 0 cardinality #255
OCPBUGS-54942: Scraping: Bump cache iteration after error to avoid false duplicate detection. #250
Full changelog

prometheus-alertmanager

OCPBUGS-76536: Include go-verify-deps expected files in gitignore #116
Full changelog

route-controller-manager

OCPBUGS-79934: Bump google.golang.org/grpc to v1.79.3 #87
OCPBUGS-56152: Added error event for failed ingress to route conversion #61
OCPBUGS-55201: ingress: Reset metrics when ingress is deleted #58
Full changelog

tests

OCPBUGS-74299: Update to latest openshift/kubernetes #30825
OCPBUGS-63395: Backport pr 29834 to release-4.18 #30409
OCPBUGS-62934: Fix bearer token exposure in exit condition as well #30365
OCPBUGS-61170: images/tests: Remove rteval #30203
NO-JIRA: Update extended/networking OWNERS #30091
OCPBUGS-60272: Bump kubernetes version to fix NFS ganesha version #30086
OCPBUGS-57311: Replace RunHostCmd with Exec function to censor bearer token being exposed #29908
OCPBUGS-57203: fix: remove un-needed test #29849
OCPBUGS-34163: Fix regex parser for censoring private key #29805
OCPBUGS-56704: aws/edge: prevent test using unschedulable nodes #29847
OCPBUGS-55476: support provider type external #29738
OCPBUGS-55636: [build] Ensure Git Clone Does Not Run Privileged #29746
Full changelog

vsphere-cloud-controller-manager

OCPBUGS-78028: hermetic migration 4.16 #107
Full changelog

vsphere-cluster-api-controllers

OCPBUGS-78020: hermetic migration 4.16 #86
OCPBUGS-61653: Fix unit tests #72
Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

OCPBUGS-86874: Bump google.golang.org/grpc #182
OCPBUGS-68119: CVE-2025-65637: Bump github.com/sirupsen/logrus to v1.8.3 #158
Full changelog

vsphere-problem-detector

OCPBUGS-86445: fix concurrent map writes #219
Full changelog

View changelog in Markdown or change previous release:

Source code for this page located on github