Back to index
Download the installer for your operating system or run
oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.17.34-x86_64 Team Approvals:
Tests:
Blocking jobs Informing jobs Upgrades from:
Untested upgrades:
4.16.11 ,
4.16.12 ,
4.16.13 ,
4.16.14 ,
4.16.15 ,
4.16.16 ,
4.16.17 ,
4.16.18 ,
4.16.19 ,
4.16.20 ,
4.16.21 ,
4.16.23 ,
4.16.24 ,
4.16.25 ,
4.16.26 ,
4.16.27 ,
4.16.28 ,
4.16.29 ,
4.16.32 ,
4.16.34 ,
4.16.35 ,
4.16.36 ,
4.16.37 ,
4.16.39 ,
4.17.11 ,
4.17.12 ,
4.17.13 ,
4.17.14 ,
4.17.15 ,
4.17.17 ,
4.17.18 ,
4.17.19 ,
4.17.20 ,
4.17.21 ,
4.17.22 ,
4.17.23 ,
4.17.25 ,
4.17.26 ,
4.17.27 ,
4.17.28 ,
4.17.29 ,
4.17.3 ,
4.17.30 ,
4.17.4 ,
4.17.5 ,
4.17.6 ,
4.17.7 ,
4.17.8 ,
4.17.9 Upgrades to:
Loading changelog, this may take a while ...
Changes from 4.17.0
Created: 2025-06-19 14:17:12 +0000 UTC
Image Digest: sha256:8b32e036f2a0a18fc48e26de96d491ef89d225958c63cf284fefe5b881117e2f
Components
Kubectl upgraded from 1.30.2 to 1.30.5
Kubernetes upgraded from 1.30.4 to 1.30.12
Kubernetes Tests upgraded from 1.30.0 to 1.30.12
Red Hat Enterprise Linux CoreOS upgraded from 417.94.202409121747-0 to 417.94.202506170509-0 (diff )
New images
Removed images
ovirt-machine-controllers
Rebuilt images without code change
Updating ose-agent-installer-orchestrator-container image to be consistent with ART for 4.17 (#1087) #1087
OCPBUGS-53719 : Bump jwt to 4.5.2 in release-4.17 (#1086) #1086 abi: let the bootstrap waiting for workers before rebooting (#1028) #1028
OCPBUGS-47493 : MGMT-19537: Bump golang.org/x/net to 0.33.0 (#989) #989 OCPBUGS-44904 : Rhcos fails to reboot for skip mco reboot on s390x (#942) #942 OCPBUGS-38466 : Allow controller to continue when assisted-service (#918) #918 OCPBUGS-43023 : Pick up latest CVE changes by bumping service (#919) #919 OCPBUGS-42156 : Switch to github.com/docker/distribution/reference to Mitigate CVE-2024-3727 (#904) #904 Full changelog
OCPBUGS-52994 : Update to latest ghw version (#986) #986 Updating ose-agent-installer-node-agent-container image to be consistent with ART for 4.17 (#798) #798
OCPBUGS-53711 : Bump jwt to 4.5.2 in release-4.17 (#964) #964 NO-ISSUE: Increase image pull timeout during install (#922) #922
MGMT-19537 : Bump golang.org/x/net to 0.33.0 (#873) #873 OCPBUGS-43024 : Pick up latest CVE changes by bumping service (#805) #805 OCPBUGS-42157 : Switch to github.com/docker/distribution/reference to Mitigate CVE-2024-3727 (#783) #783 Full changelog
OCPBUGS-34314 : Updating aws-kms-encryption-provider-container image to be consistent with ART for 4.17 #19 hack: display diff on verify-mod-tidy failure #25
Full changelog
OCPBUGS-55518 : iptables-alerter streamlining #2698 OCPBUGS-55033 : Add IPv6 NGINX configuration #2689 OCPBUGS-52951 : Unexpected Behavior During Cluster Upgrade for the ovn-ipsec-host pods #2654 OCPBUGS-49816 : ovn-k, rbac: Enable users read & modify UserDefinedNetwork CRs #2655 OCPBUGS-49961 : Update egressfirewall CRD to be consistent with ovn-kubernetes repo #2642 : OCPBUGS-44863: Add nodeslicepool #2574
OCPBUGS-44807 : ovn-k, cudn: Add missing permissions to ovnkube-node #2575 OCPBUGS-43714 : Skip including default crypto policies to avoid authby issue #2597 OCPBUGS-46146 : Remove ip xfrm state when IPsec is disabled #2594 OCPBUGS-44415 : Pass transit_switch_subnet options in ovnkube-node pod #2561 OCPBUGS-44807 , SDN-4930 , SDN-5297 : OVN-Kubernetes node RBAC tightening #2568 OCPBUGS-44807 , SDN-5297 , SDN-5472 : bindata, ovn-k: Add ClusterUserDefinedNetwork CRD and RBAC #2566 OCPBUGS-44807 , SDN-4930 , SDN-5297 : ovn-k, udn: Update UserDefinedNetwork CRD #2551 OCPBUGS-44807 , SDN-4930 , SDN-5297 : Adds UDN list/watch to ovnknode rbac #2540 OCPBUGS-44779 , SDN-5436 : Provide support for user owned IPsec machine configs #2564 OCPBUGS-44330 : Add controlplane cli image envar for use with hypershift #2542 OCPBUGS-43343 : OCPBUGS-42244: Exporting environment varialbe NODE_CNI for live migration #2536 OCPBUGS-43317 : Use CNIConfDir for mounting directory to ovn-ipsec-host pod #2533 OCPBUGS-39300 : rebase openshift/api for openshift-sdn removal [4.17] #2477 OCPBUGS-39121 : Live migration: report network overlap via live_migration_blocked metric #2483 OCPBUGS-42260 : Configure narrowing=yes for IPsec connections #2510 Full changelog
use ROLE_WORKER_CNF environment variable to determine mcp name (#1290) #1290
Add missing Polarion test case id (#1288) #1288
e2e: tuned degraded test fix (#1259) #1259
OCPBUGS-48213 : [release-4.17][manual] Adjust Workload Hints test cases based on Intel or AMD (#1277) #1277 PPC: correct EnableHardwareTuning flag value (#1271) #1271
e2e: add irdma to module_blacklist kernel args (#1266) #1266
OCPBUGS-45964 : performanceprofile cpuset input validation (#1247) #1247 OCPBUGS-43664 : Add vendor and architecture specific tuning options (#1191) #1191 OCPBUGS-44644 : cmd: PPC: support tolerating heterogeneous core IDs (#1252) #1252 OCPBUGS-45264 : Normalize cpu sets when rendering to Tuned profiles (#1238) (#1248) #1238 e2e: wait for node inspector deletion (#1205) #1205
Fixing empty tuned submodule when using Dockerfile (#1211) #1211
E2E: fix modify node selector to use lowercase (#1186) #1186
OCPBUGS-38900 : Drop sched_migration_cost_ns setting (#1201) #1201 Make ocp-tuned-one-shot.service restart on-failure (#1187) #1187
Fix context deadlines in ExecCommandOnPod() (#1189) #1189
OCPBUGS-43566 : CI: unblock (#1188) #1188 E2E: wait for ovs services affinity to reset after deployment deletion (#1160) #1160
OCPBUGS-38721 : tuned: distinguish deferred updates (#1149) #1149 OCPBUGS-39005 : Add cluster-wide proxy env file (#1145) #1145 Full changelog
append .0 to go.mod version #372
OCPBUGS-34217 : Updating ose-csi-driver-shared-resource-container image to be consistent with ART for 4.17 #188 OCPBUGS-44510 : Updating ose-csi-driver-shared-resource-webhook-container image to be consistent with ART for 4.17 #233 Full changelog
DOWNSTREAM: <carry>: OCPBUGS-53447: fix a compaction induce latency issue #321
ETCD-714 : Rebase etcd 3.5.18 openshift 4.17 #310 NO-ISSUE: Add support for cachi2 based deps #297
OCPBUGS-42680 : Rebase etcd 3.5.16 openshift 4.17 #291 NO-JIRA: use golang 1.22 image #286
Full changelog
OCPBUGS-57432 : Add proxy variables for the MCD Pod #6258 CNTRLPLANE-918 : Konflux build pipeline service account migration #6088 CNTRLPLANE-918 : Konflux build pipeline service account migration #6083 OCPBUGS-55723 : Don’t check if olm images exist if guest cluster #6115 OCPBUGS-55500 , RHOCPPRIO-433 : Add validation to avoid conflicts between KubeAPIServer and NamedCertificates SANs #6098 OCPBUGS-51808 : Fix golang crypto dependency go.mod replacement #5993 OCPBUGS-54841 : Add konnectivity-proxy sidecar to openshift-oauth-apiserver #6017 OCPBUGS-53323 : Handle multiple mirror entries for source #5894 OCPBUGS-54631 : Sync RBAC for attaching volumes on VM level #5997 NO-JIRA: update konflux references #5479
OCPBUGS-53903 : bump golang-jwt v4 and v5 #5906 NO-JIRA: Red Hat Konflux update control-plane-operator-4-17 #5959
ART-11792 : update go mod dependency for konflux #5920 OCPBUGS-51737 , OCPBUGS-51808 : Bump dependencies to OCP fork in backports #5900 OCPBUGS-48439 : kubevirt, Don’t break on hostname NodePort.Address #5394 OCPBUGS-51240 : bump go-jose #5863 OCPBUGS-52657 : Make managed-trust-bundle optional #5794 OCPBUGS-52425 : [release-4.17] refactor aws identity health check into new controller #5772 OCPBUGS-46340 : change plaform to platform #5562 OCPBUGS-51339 : [release-4.17] Fix IsProgressing condition in HostedClusters #5712 OCPBUGS-50697 : add region to AWS creds passed to operators managed by CPO #5671 OCPBUGS-51098 : 4.17 Add HostedCluster additional trustbundles to konnectivity-https-proxy #5675 NO-JIRA: Update dependency mkdocs-material to v9.6.5 #5682
OCPBUGS-50596 : Honor proxy vars in the util insecure http client #5605 OCPBUGS-49828 : Duplicate hostDevices.name when hostDevices.deviceName has multiple types. #5558 OCPBUGS-48487 , OCPBUGS-48488 , OCPBUGS-48490 : Fix IPv6 Disconnected HCP deployments #5402 OCPBUGS-47533 : Prevent IgnitionServer from flooding the API server with patch requests #5332 NO-JIRA: Update dependency mkdocs-material to v9.6.3 #5590
OCPBUGS-45268 : Reconcile proxy CA bundle into hosted cluster #5228 OCPBUGS-46465 : Consistently look up and dial cloud API hostnames #5302 NO-JIRA: Update dependency mkdocs-material to v9.6.1 #5528
OCPBUGS-49638 : fix overwriting PKI operator HCP conditions #5504 OCPBUGS-46440 : Allow ARM64 arch deployment on Agent platform #5296 OCPBUGS-48170 : fix disconnected via CLI #5465 OCPBUGS-38810 : nodepoolcontroller: List() PerformanceProfile status per NodePool #4585 NO-JIRA: Update dependency mkdocs-mermaid2-plugin to v1.2.1 (release-4.17) #5428
NO-JIRA: Update dependency mkdocs-material to v9.5.50 (release-4.17) #5427
OCPBUGS-44927 : Add multi-arch validation for HC/NodePool compatibility #5238 NO-JIRA: [release-4.17] Bump golang.org/x/crypto and golang.org/x/net #5368
NO-JIRA: Update Konflux references (release-4.17) #5329
OCPBUGS-46412 : Separate CPO containerfiles #5285 NO-JIRA: chore(deps): update konflux references (release-4.17) #5289
NO-JIRA: chore(deps): update dependency mkdocs to v1.6.1 (release-4.17) #5290
OCPBUGS-44114 : Add external kas address to no proxy skip list #5028 NO-JIRA: Red Hat Konflux update hypershift-release-mce-28 #5174
NO-JIRA: chore(deps): update konflux references (release-4.17) #5249
OCPBUGS-44630 : Use ingress role in private link controller for DNS operations #5142 NO-JIRA: chore(deps): update konflux references (release-4.17) #5183
NO-JIRA: chore(deps): update konflux references (release-4.17) #5154
NO-JIRA: chore(deps): update konflux references (release-4.17) #5144
OCPBUGS-44184 : dont use registryOverrides on kube rbac proxy image be… #5033 NO-JIRA: chore(deps): update konflux references (release-4.17) #5113
OCPBUGS-43929 : Return the right tagReference on Catalogs ImageStream #4993 OCPBUGS-44276 : Configure OAuth https proxy to dial cloud endpoints directly #5070 OCPBUGS-44268 : Fix order rendering HCP objects #5064 NO-JIRA: Update Konflux references (release-4.17) #5098
chore(deps): update konflux references (release-4.17) #5075
HOSTEDCP-2046 : CPO 4.17 tekton builds #5006 NO-JIRA: chore(deps): update konflux references (release-4.17) #5053
NO-JIRA: Update Konflux references to fedcfe0 (release-4.17) #5041
chore(deps): update konflux references (release-4.17) #5023
chore(deps): update konflux references to f53fe54 (release-4.17) #5018
NO-JIRA: Update Konflux references (release-4.17) #5009
OCPBUGS-42879 : Add network policies for konnectivity server and ignition server proxy #4865 NO-JIRA: bump catalog operators version #4992
NO-JIRA: chore(deps): update konflux references (release-4.17) #4972
OCPBUGS-43746 : add ValidIDPConfiguration condition to report IDP config issues #4969 NO-JIRA: chore(deps): update konflux references (release-4.17) #4958
OCPBUGS-43464 : Pass feature flags to clusterpolicy controller #4928 NO-JIRA: chore(deps): update konflux references (release-4.17) #4931
OCPBUGS-42704 : Run 2 replicas of active/passive HA components #4843 OCPBUGS-43316 : Enforce privileged PSA by default #4834 NO-JIRA: chore(deps): update konflux references (release-4.17) #4921
OCPBUGS-43374 : release-4.17 openstack/e2e: re-work nodepool tests #4914 NO-JIRA: chore(deps): update konflux references to 674e70f (release-4.17) #4907
NO-JIRA: chore(deps): update konflux references (release-4.17) #4895
OCPBUGS-43051 : Use guest DNS resolution in Konnectivity HTTPS proxy by default #4885 HOSTEDCP-2020 : [release-4.17] Add support for SharedVPC #4873 HOSTEDCP-2023 : [release-4.17] Split worker and vpc endpoint security groups #4882 OCPBUGS-42974 : [release-4.17] Do not send traffic to local audit-webhook through konnectivity #4869 NO-JIRA: Remove EnsurePSANotPrivileged check #4855
OCPBUGS-42714 : label routes only when HCP router used #4845 NO-JIRA: chore(deps): update konflux references to 37b9187 (release-4.17) #4854
OCPBUGS-42390 : Add Annotation to skip deleting hcp namespace #4792 NO-JIRA: chore(deps): update konflux references (release-4.17) #4812
NO-JIRA: e2e: openstack: fix nil deref in route53 teardown #4810
OCPBUGS-42261 : Conditionally manage kubeconfig secrets for DNS and Ingress operators #4764 OCPBUGS-42098 : Use KubeClientCABundle for HostedClusterConfigOperator cluster-signer-ca #4736 chore(deps): update konflux references to 5ac9b24 (release-4.17) #4780
OCPBUGS-41552 : Let payload generation pick the release for the NodePool #4691 chore(deps): update konflux references to 2c3426a (release-4.17) #4774
NO-JIRA: chore(deps): update konflux references (release-4.17) #4761
NO-JIRA: Security fixes for openshift-ci-security job #4748
NO-JIRA: chore(deps): update konflux references (release-4.17) #4726
HOSTEDCP-1953 : bump CCO version #4694 Full changelog
OCPBUGS-57480 : Set node-pullsecrets volume to read-only to protect image pull credentials #393 OCPBUGS-55826 : Empty proxy variables are causing issues during the build #379 OCPBUGS-47769 : Add team members to the OWNERS file #357 OCPBUGS-44093 : user system:serviceaccount:openshift-infra:serviceaccount-pull-secrets-controller in ns/openshift-infra must not produce too many applies #350 NO-JIRA: cleanup root and app OWNERS #346
OCPBUGS-42362 : Continuous pull-secret updates / slow initialization on build01 (test platform infrastructure) #339 Full changelog
Source code for this page located on github