4.17.43

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.17.43-x86_64

Team Approvals:

Accepted
- QE

Tests:

Blocking jobs
- upgrade Succeeded release-openshift-origin-installer-e2e-aws-upgrade
- upgrade-minor Succeeded release-openshift-origin-installer-e2e-aws-upgrade
Informing jobs
- aws-ovn-serial Succeeded periodic-ci-openshift-release-master-nightly-4.17-e2e-aws-ovn-serial
- aws-ovn-upgrade-4.17-micro Succeeded periodic-ci-openshift-release-master-ci-4.17-e2e-aws-ovn-upgrade
- aws-ovn-upgrade-micro Succeeded periodic-ci-openshift-release-master-ci-4.17-e2e-aws-ovn-upgrade
- azure-ovn-upgrade-4.17-micro Succeeded periodic-ci-openshift-release-master-ci-4.17-e2e-azure-ovn-upgrade
- fips-scan Succeeded periodic-ci-openshift-release-master-nightly-4.17-fips-payload-scan
- gcp-ovn-rt-upgrade-4.17-minor Succeeded periodic-ci-openshift-release-master-ci-4.17-upgrade-from-stable-4.16-e2e-gcp-ovn-rt-upgrade
- hypershift-ovn-conformance-4.17 Succeeded periodic-ci-openshift-hypershift-release-4.17-periodics-e2e-aws-ovn-conformance
- metal-ipi-ovn-bm Succeeded periodic-ci-openshift-release-master-nightly-4.17-e2e-metal-ipi-ovn-bm
- metal-ipi-ovn-ipv6 Succeeded periodic-ci-openshift-release-master-nightly-4.17-e2e-metal-ipi-ovn-ipv6

Upgrades from:

Untested upgrades: 4.16.12, 4.16.13, 4.16.14, 4.16.15, 4.16.16, 4.16.17, 4.16.18, 4.16.19, 4.16.20, 4.16.21, 4.16.23, 4.16.24, 4.16.25, 4.16.26, 4.16.27, 4.16.28, 4.16.29, 4.16.30, 4.16.33, 4.16.34, 4.16.35, 4.16.36, 4.16.37, 4.16.38, 4.16.39, 4.16.40, 4.16.41, 4.16.42, 4.16.43, 4.16.44, 4.16.45, 4.16.47, 4.16.48, 4.17.10, 4.17.11, 4.17.12, 4.17.13, 4.17.14, 4.17.15, 4.17.16, 4.17.17, 4.17.18, 4.17.19, 4.17.20, 4.17.21, 4.17.22, 4.17.23, 4.17.25, 4.17.26, 4.17.28, 4.17.29, 4.17.3, 4.17.30, 4.17.31, 4.17.32, 4.17.33, 4.17.34, 4.17.35, 4.17.36, 4.17.37, 4.17.38, 4.17.39, 4.17.4, 4.17.5, 4.17.7, 4.17.8, 4.17.9

4.17.42 (changes) - S S S S S
4.17.41 (changes) - Success
4.17.40 (changes) - Failed
4.17.27 (changes) - Failed
4.17.24 - Success
4.17.6 (changes) - Failed
4.17.2 (changes) - Failed
4.17.1 (changes) - Failed
4.17.0 (changes) - Failed
4.16.51 (changes) - Failed Success
4.16.50 (changes) - Success
4.16.49 (changes) - Failed
4.16.46 (changes) - Success
4.16.32 (changes) - Success
4.16.11 (changes) - Failed
4.16.10 (changes) - Success
4.16.9 (changes) - Failed
4.16.8 (changes) - Failed
4.16.0-0.nightly-2025-10-30-025025 (changes) - Success

Upgrades to:

Loading changelog, this may take a while ...

Changes from 4.17.24

Created: 2025-10-30 13:27:43 +0000 UTC

Image Digest: sha256:8f7bac89fde3605d5a9deb078b1c72c213d5250ae1a6d32906e529fb99b94cc1

Components

Kubectl 1.30.5
Kubernetes upgraded from 1.30.11 to 1.30.14
Kubernetes Tests upgraded from 1.30.0 to 1.30.14
Red Hat Enterprise Linux CoreOS upgraded from 417.94.202504012217-0 to 417.94.202510282022-0 (diff)

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
StreamingCollectionEncodingToJSON (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
StreamingCollectionEncodingToProtobuf (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)

Rebuilt images without code change

aws-ebs-csi-driver git 2bb5b316 sha256:63bb5b70e07a9e3c0ecebfecc807de961d0dea4b5d51d3d639f3f018993cec07
aws-kms-encryption-provider git 9d401670 sha256:a092dfa1a6c690fca1a04bdd3a9c9698fb9b23f00e3b373fc2e44555173287c0
aws-pod-identity-webhook git 80efc4ea sha256:0beb741ecff5f79909d64521caa996e527902e2107fbb21b899cc3ed0dd96525
azure-cloud-controller-manager git 626ecd1c sha256:7f00eda2658fb9c931e9bcbf5500cd340ac5a2b1520673557b81e0283054c55f
azure-cloud-node-manager git 626ecd1c sha256:542bad0e50aefea34557e6de33a3c4f562253600ff4ebfc1e8f72f7905bd8845
azure-cluster-api-controllers git d359bfe5 sha256:24583be0f07720a698fd43071ceff409aba369f782d0503c025574b55185e59f
azure-disk-csi-driver git a544f30b sha256:1628b44c5ca44f78919842ad892450dad9ebd141f7a4e38208e9b45f3163c2cc
azure-file-csi-driver git 9f4c38c2 sha256:47750de66cc491f6607e22cd05f397eda0fb8dcb518459e353f998b9b381ebfc
azure-workload-identity-webhook git 6707f899 sha256:f061ff2a28176efea978bfa5f87c0496ad1c8ac1160602503b1a56b0721be2bb
baremetal-machine-controllers git 6e7aa77e sha256:4dca813e7505511f5fd8e5e0782e151f14a9e468cd1b469fa2e4c5fe35142692
cluster-autoscaler-operator git ea4a8878 sha256:153db8e41763f14cb8bdeda559a9c5289b230643bd1f9da9618001ca7ec9c258
cluster-bootstrap git 95dd9129 sha256:7a3e5e82ed6bc6e8def1f51f734226f8ac4c143160e59654aa0e53e19f09b8bc
cluster-capi-controllers git 77ef4fc5 sha256:d6dbc97351746722489f7ac7953900c781ecaec118f67aae507a51dd4697c45a
cluster-control-plane-machine-set-operator git f7e01c2f sha256:324189bef8e0f2d870e59881ac0f833a6150d43dc0e9a71779f3e28b0dcb8dd7
cluster-csi-snapshot-controller-operator git ffba005b sha256:37d683745c8ca050d8f80f916391c1d311967f18e7bc71bf27cf3344f2e400cd
cluster-dns-operator git 81507f04 sha256:c21a7d4cf92bb602ef4e7f033a0d2e2969786b1794a357ae5eb9b20369eb533b
cluster-kube-cluster-api-operator git aed5f6c7 sha256:b783078f38b06795340a8b753179fc8dff50e48aac4b54652f49f07b343c42e9
cluster-kube-scheduler-operator git 98ca953b sha256:bf51874f2b38be95623523912df787f395c12bd23c5530cf822ae746dea6c968
cluster-kube-storage-version-migrator-operator git ab40b611 sha256:cb247900d411854b9444d39eb485515fcdf162616b6808ab7f57d67989a00e0e
cluster-machine-approver git acc2380e sha256:34416e647cedb1f3712c56fb298b340dc31208d1fa483875420033b505962350
cluster-olm-operator git e31b7775 sha256:d402c06b7ea3e1c70d1c3c8dc9b897af77928f074d63f1e25da4f46dd991936c
cluster-openshift-apiserver-operator git 2b2ba3be sha256:822b9808414566c0a9bb40340118e47c1681d60e4e73ce56207f48c7d704869b
cluster-openshift-controller-manager-operator git b05a249d sha256:9c290aac37bbf6fe96c791f46ccc0698c332dc1ba1be09a5a323c4aed87d28e6
cluster-policy-controller git 7209e90d sha256:65d72c7b4b145c2c77c4b9c58b293314351c4c7f723dc6de00f79062bbed559c
csi-driver-manila-operator git efc99a2a sha256:58471ba2b9c955626d4aa41e4ede33930a61a532fb4b99b37047b5e3abeeebf2
csi-driver-shared-resource-operator git c095a1f2 sha256:dd43900d6003f27539fba52a16d90df423cd7a50808b4b0b2336d967a8d126ce
csi-external-attacher git c3fe8e2e sha256:9affb5db0b5a953cdddb5173cd0fafe92136dc10e0575c51b9d32b35d1f89af5
csi-external-provisioner git fe460e56 sha256:0add8f8243ad941665881b4430af182e23b3dee688cf271fb930d00887c3f29b
driver-toolkit git 859518f6 sha256:765889fa2cf1cbb582b21000432358478218537304bc634d5322d84ec00ea515
egress-router-cni git 3193a756 sha256:44f0cdaa39386aba91e3d910fd47af621b33c24b34c8fe121583e44a507c5de6
etcd git 0d9e0a90 sha256:e239a5385f3390cc503e7d2cb727c53205f7e3dff85a99279c4889eb4cebacdd
gcp-cloud-controller-manager git 8ce997d7 sha256:52d716514d9c71bce7a52a38206b8afcdabe07e2d274371c149f7ad70297730a
gcp-cluster-api-controllers git 9c561f2d sha256:1febe46f130b798c07a2be3732cc119deb5c6e2e58371b04d75c601969b8ade3
gcp-pd-csi-driver git c770b412 sha256:93c592dbb85d54e214578fcdf1cccde3e97990ceb11426c2e029b7159e94621c
gcp-pd-csi-driver-operator git c23b064f sha256:7b2fcac9ba2c3e957e9d52f2679f9ea3095d750ffc5ac06f0d09441a3edf655f
gcp-workload-identity-federation-webhook git 08579e9f sha256:94be7b73ccdfdf227c8293aecf0548a5969ad19e4d2236f248071f4e67d28c59
ibm-cloud-controller-manager git ad8f7eb0 sha256:4d77c1f617c42be6bf11ab4cfa4a76c620240c63fdb240f69a4a08c624f55282
ironic git 391f57f8 sha256:6facaa14fa08684d03201b43c38f4418f3e4b02b16780c5c9c0fcf9f61adfbbf
ironic-static-ip-manager git bc5b8a2c sha256:c87a975fbd5bcc63f053ded6d16426fdae270712f2d3bc80ead9fc4b3bfea30c
keepalived-ipfailover git e3879e9e sha256:9f16557d942a49df460a53d701c93ffe95fd34a9b261ef1f573bc6f6bc22cb94
kube-proxy git dee082de sha256:c30a5ac42ed244ad3d91987be832f9473e7eb489c87d3c2efcfbbab09a2e3fe6
kube-state-metrics git 462e63f6 sha256:5964513bf6afc8888b587ca7d2fb7d02c208a59f9efb45b9670d7e17723d234d
libvirt-machine-controllers git a336f0b5 sha256:efd89b8f05d47b19b7455b37df7ec6dc48cd3420e68ae227ee5241c928098a07
machine-os-images git f85666be sha256:a105c173c5747131dad8459c0452846c0d40b140789afcb3020dced4038f2141
multus-route-override-cni git 391c1b03 sha256:a683b8cd15a2bf2a36745cd71ad5962de253ac13e4011794809477fc1186acbd
nutanix-cloud-controller-manager git c9f6cd1f sha256:25ad67386b29369ae5d2d790b2bfb2f137e52754e39099bcfbc2501ef6c3f753
olm-catalogd git c740e056 sha256:503bf646b7f6c184baddc6fecced9226a1f6121fb204edce5eca60ad418f652a
openstack-cinder-csi-driver-operator git f89b6dbc sha256:08af9528f45f48718ef935cd3a66894df8a3fd4eb2c0703f8785e42994322295
openstack-machine-api-provider git 68971874 sha256:4cc9301c168b3c6145adf6c86c91ceba409bcdd6500f1d2dc6ed3b53cae38244
ovirt-csi-driver git 1db726a9 sha256:86fd848fff169ff694863822d028f3c74cde70936f27d63a38a3dcf3abb06e5a
ovirt-csi-driver-operator git 0feae256 sha256:107b81bf6e1a1d3deb4744bf56fa7b4ccd6375a995f7309ada32ca7f9c75ce73
powervs-block-csi-driver git aaa6afa9 sha256:bbc829bfd67c9daadab29a0c7f1ba2019818fb4fd0fe2badebf894990aeb9413
powervs-block-csi-driver-operator git f6f037c5 sha256:0ae3c061061c482a41221ced2e49430001bbfc50455ff33410bc6c5b1414344e
powervs-cloud-controller-manager git bd3d72e5 sha256:f4106c7bf6f223dc82daea931fbb3531c0e31d5036aac2e27d4900ba45308715
prometheus-config-reloader git 77cedd6c sha256:492b092ad18727996065a4608037701dcb8e98cec0e546a914593fa1ec7f59ca
prometheus-operator git 77cedd6c sha256:6b844ced62f6a54e730b07b4d53ee5839cb8d0d620704fd741906b02585eb57a
prometheus-operator-admission-webhook git 77cedd6c sha256:18f70feaadea7973a87a990c2b7807cd8829b8861922260e7ca3334642ac807c
rhel-coreos sha256:190f79151265d057771947e022caebe7d0f35acd845104053b46219c0fcfe5b5
rhel-coreos-extensions sha256:caf96fe92c367801687165d12796f894f1e4ce52a3136d235695c9330db1fc94
vsphere-cloud-controller-manager git 097d823b sha256:2da9d0ed1d23d1de6401f13b2e874abf9b35258dad64eb987c9801f2d2c341c4
vsphere-csi-driver git 039ee368 sha256:5a8e56090e348c838485727bf774d4cb813237fb3ad143e8f77897fd25971f0d
vsphere-csi-driver-operator git e1de36a2 sha256:a952b433239bc89410e5d38f6dd3684e708e316a7ea36d3cb35759028091f603
vsphere-csi-driver-syncer git 039ee368 sha256:32e8fd43db6d9b60be7207ccfff90715ef77758f1a1d0f18a10828e2cd61ae1b

agent-installer-api-server

NO-ISSUE: pin gotestsum to v1.12.3 (#8017) #8017
OCPBUGS-58634, OCPBUGS-58639: Bump glog to v1.2.5 in release-4.17 (#7895) #7895
OCPBUGS-47627: dnsmasq service on OCP SNO fails to read /etc/resolv.conf file during system startup (#7724) #7724
OCPBUGS-51230: Revert go-jose from v4.0.5 to v0.3.04 (#7605) #7605
OCPBUGS-51230: Bump github.com/go-jose/go-jose/v4 to v4.0.5 in release-4.17 (#7574) #7574
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-58649: Bump glog pkg to 1.2.4 (#1182) #1182
Updating ose-agent-installer-csr-approver-container image to be consistent with ART for 4.17 (#1088) #1088
Updating ose-agent-installer-orchestrator-container image to be consistent with ART for 4.17 (#1087) #1087
OCPBUGS-53719: Bump jwt to 4.5.2 in release-4.17 (#1086) #1086
Full changelog

agent-installer-node-agent

OCPBUGS-58654, OCPBUGS-58659: Bump glog to v1.2.5 in release-4.17 (#1070) #1070
OCPBUGS-52994: Update to latest ghw version (#986) #986
Updating ose-agent-installer-node-agent-container image to be consistent with ART for 4.17 (#798) #798
OCPBUGS-53711: Bump jwt to 4.5.2 in release-4.17 (#964) #964
Full changelog

agent-installer-utils

append .0 to go.mod version #110
Full changelog

apiserver-network-proxy

append .0 to go.mod version #82
Full changelog

aws-cloud-controller-manager

append .0 to go.mod version #109
Full changelog

aws-cluster-api-controllers

OCPBUGS-61940: UPSTREAM <carry>: revert: Only tag NetworkInterfaces in RunInstances if IAM Allows It #571
OCPBUGS-58669, OCPBUGS-58674: bump github.com/golang/glog to v1.2.5 #559
OCPBUGS-53727: bump to github.com/golang-jwt/jwt/v4@v4.5.2 #546
Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator

OCPBUGS-62974: Add withCABundleDaemonSetHook() to AWS EFS operator #449
OCPBUGS-60597: Bump library-go to fix assignment to nil map issue #422
OCPBUGS-60470: Backport stale conditions fix #416
Full changelog

aws-machine-controllers

OCPBUGS-63139: client: re-use a single file for building the session instead of randomly named files #145
Full changelog

azure-kms-encryption-provider

append .0 to go.mod version #19
OCPBUGS-53495: bump golang-jwt v4 #12
Full changelog

azure-machine-controllers

OCPBUGS-56168: [release-4.17] Update virtualmachines service to armcompute/v5 SDK #146
OCPBUGS-56655: Fix failure when attempting to modify immutable availabilitySet #152
OCPBUGS-55729: Update eviction policy for Spot VMs from Deallocate to Delete #140
OCPBUGS-54393: Re-reconcile machine on NIC provisioning failure #136
Full changelog

baremetal-cluster-api-controllers

ART-13124: Update go.mod to include patch version in go directive #46
Full changelog

baremetal-installer, installer, installer-altinfra, installer-artifacts

OCPBUGS-62951: Update the RHCOS 4.17 bootimage metadata #10021
OCPBUGS-62054: Make swift containers removal not fatal for UPI. #9952
OCPBUGS-54599: Update the RHCOS 4.17 bootimage metadata #9902
OCPBUGS-58319: vSphere - remove unit tests using nip.io #9821
OCPBUGS-57293: sort zone slices extracted from map of byo subnets #9778
OCPBUGS-56448: vsphere - check if host is powered down or on standby before uploading template #9726
OCPBUGS-57292: ensure ctrplane nodes can access bootstrap MCS #9775
OCPBUGS-57304: IBI nmstate unit test fix #9777
OCPBUGS-55224: Fix Load balancer IP setup #9675
OCPBUGS-51116: update resolv.conf every time on bootstrap node #9504
OCPBUGS-51210: Fixes panic during GCP tags fetch due to unstable network #9512
OCPBUGS-46375: Allow spaces in the aws tags [release-4.17] #9315
Full changelog

baremetal-operator

OCPBUGS-53325: BMO can expose any secret via BMCEventSubscription CRD #406
Full changelog

baremetal-runtimecfg

OCPBUGS-60112: Re-add ENABLE_NODEIP_DEBUG env var #363
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-56734: Adding sos.conf file for default sos config into the tools image #2027
OCPBUGS-58091: avoid transfering permissions when copying artifacts from node-joiner pod #2053
OCPBUGS-57446: Use fedora image in unit tests instead of centos #2038
Full changelog

cloud-credential-operator

OCPBUGS-55128: snyk to ignore SNYK-GOLANG-GOLANGORGXNETHTML-9572088 #917
OCPBUGS-60972: ccoctl: aws to use proper issuer url on subsequent runs #908
OCPBUGS-58679: github.com/golang/glog v1.2.5 #892
OCPBUGS-58248: ccoctl: only add owned tag to azure resources on create #883
OCPBUGS-56980: Azure: resolve nil pointer exception when role assignment exists #868
OCPBUGS-54828: Render: configure proxy on bootstrap static pod #863
OCPBUGS-53415: github.com/golang/glog v1.2.4 #842
Full changelog

cloud-network-config-controller

OCPBUGS-56257: Increase API call timeout to 30 second #171
Full changelog

cluster-authentication-operator

OCPBUGS-54580: Avoid duplicate OAuth client creation #765
Full changelog

cluster-autoscaler

OCPBUGS-60913: revert openshift replica fix #376
OCPBUGS-60608: fix checkpoint gc of unknown recommenders #371
OCPBUGS-59266: Fix cool down status condition to trigger scale down #362
OCPBUGS-54325: improve replica counting and decrease target size behavior #352
Full changelog

cluster-baremetal-operator

OCPBUGS-61097: Remove webhookport (9447) as HostPort #505
OCPBUGS-54542: Add missing relatedObjects #469
Full changelog

cluster-capi-operator

append .0 to go.mod version #314
Full changelog

cluster-cloud-controller-manager-operator

OCPBUGS-60211: Update service selector to match deployment label #406
OCPBUGS-60211: Add Service using common resource templating #407
Full changelog

cluster-config-api

CNTRLPLANE-1611: Add feature gates for StreamingCollectionEncoding #2538
OCPBUGS-57285: Add IPsec API for NAT-T UDP encapsulation support #2363
OCPBUGS-49702: Add IdleConnectionTerminationPolicy field to IngressControllerSpec #2186
Full changelog

cluster-config-operator

append .0 to go.mod version #441
Full changelog

cluster-etcd-operator

OCPBUGS-61337: Vendor latest mixin, including additional and modified alerts for etcdDatabaseQuotaLowSpace #1480
OCPBUGS-60220: add missing ports to svc and pod spec #1461
OCPBUGS-53511: fix CVE-2025-30204 #1414
Full changelog

cluster-image-registry-operator

OCPBUGS-53871: bump github.com/golang-jwt/jwt #1218
OCPBUGS-51604: bump golang.org/x/oauth2 #1209
Full changelog

cluster-ingress-operator

OCPBUGS-49702: Add e2e tests for IdleConnectionTerminationPolicy #1225
OCPBUGS-49702: Add support for IdleConnectionTerminationPolicy #1223
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-60398: Add missing service ports to apiserver service #1893
Full changelog

cluster-kube-controller-manager-operator

OCPBUGS-60249: Missing endpoint slices for open ports the operator uses #855
Full changelog

cluster-monitoring-operator

OCPBUGS-63123: test: remove image registry e2e tests #2715
OCPBUGS-61766: chore(jsonnet): use prometheus_remote_storage_queue_highest_timestamp_seconds in PrometheusRemoteWriteBehind #2672
OCPBUGS-60017: operator: increase wait time till degraded to max 4 times 5m #2634
Full changelog

cluster-network-operator

[Release 4.17] OCPBUGS-61765: Update CNO reviewers/approvers #2799
OCPBUGS-58066: [release-4.17]: Manual feature backport of cert rotation for whereabouts #2784
OCPBUGS-57285: Implement IPsec NAT-Traversal encapsulation option #2726
OCPBUGS-55518: iptables-alerter streamlining #2698
OCPBUGS-55033: Add IPv6 NGINX configuration #2689
Full changelog

cluster-node-tuning-operator

OCPBUGS-63504: Do not cause kubelet failed dependency by ocp-tuned-one-shot.service #1418
Full changelog

cluster-samples-operator

OCPBUGS-55800: only update LastTransitionTime if operator status change #640
OCPBUGS-55795: Adding filter to clusterOperatorInformerEventHandler #639
OCPBUGS-55894: Samples Operator should sort failing image imports #641
OCPBUGS-55042: Adding mutex to func createSamples on handler.go #632
Full changelog

cluster-storage-operator

OCPBUGS-41160: Move metrics to vsphere driver #633
Full changelog

cluster-update-keys

NO-ISSUE: Updating ose-cluster-update-keys-container image to be consistent with ART for 4.17 #79
Full changelog

cluster-version-operator

OCPBUGS-58451: Failing=Unknown upon long CO updating #1212
Full changelog

configmap-reloader

append .0 to go.mod version #70
Full changelog

console

OCPBUGS-63212: switch to dev perspective for /dev-monitoring #15614
OCPBUGS-63397: fix bug where Roles list was displaying invalid data f… #15627
OCPBUGS-62282: Fix desync of console and variable namespace #15545
OCPBUGS-44154: bump dompurify to latest #15590
OCPBUGS-61737: Remove ancient X-XSS-Protection header #15494
OCPBUGS-54241: VolumeSnapshots are not displayed in OpenShift Web Console #15465
OCPBUGS-59747: OpenShift console PVC clone cannot use B as the unit #15324
NO-JIRA: Increase the timeout on the cypress test #15420
OCPBUGS-58365: change ‘/metrics/usage’ endpoint to ‘/api/metrics/usage’ #15271
OCPBUGS-59544: Secret key with binary file changes when edited via Console #15301
OCPBUGS-59784: Update the golang.org/x/crypto/ssh to 0.31.0 in the openshift-console image #15329
OCPBUGS-58337: Tolerate unknown fields in Infrastructur… #15236
OCPBUGS-59492: Cannot read properties of undefined (reading ‘node-role.kubernetes.io/master’) error while accessing node logs from console #15294
OCPBUGS-59879: add data-test attrs to console plugins … #15338
OCPBUGS-59510: Not able to launch terminal window from OCP web console due to console plugin conflicts #15297
OCPBUGS-59265: fix bug where / in console.tab/horizontalNav href brea… #15270
OCPBUGS-58318: Implement sessions in openshift authenticator #15238
OCPBUGS-58224: Add the ability to launch multiple modals with useModal hook #15222
OCPBUGS-58378: Cannot read properties of undefined (reading ‘filter’) error while accessing nodes from console. #15241
OCPBUGS-57835: Add flags in console static plugin for all the components of this epic #15192
OCPBUGS-57932: Fix TypeError Cannot read properties of null (reading ‘metadata’) #15197
OCPBUGS-57182: Fix ‘/metrics’ endpoint token review to handle interna… #15154
OCPBUGS-56895: HorizontalPodAutoscalers via console require CPU resource limit even though HPAs use requests for scaling #15108
OCPBUGS-57095: Add all files to vendor regardless of gitignore #15132
OCPBUGS-57114: Debug pod logs are not accessible when debugging a node via OpenShift Console #15142
OCPBUGS-56975: Sample segment sessions #15114
OCPBUGS-56844: Enable knative tests #14387
OCPBUGS-56375: remove 60 day alert from cluster update modal #15062
OCPBUGS-55924: Fetching taskRuns in PLR details page using PLR UID also #15029
OCPBUGS-55756: update the Deployment pod on change in imageStream #15022
OCPBUGS-56238: Remove the devconsole backend common internet proxy and replace it with dedicated ones #15049
OCPBUGS-55447: Authenticate user token in openshift Authenticate func #15010
OCPBUGS-55415: fix bug where operator appears twice #15002
OCPBUGS-55202: Do not load CSRs if user does not have permissions #14985
OCPBUGS-52999: Pipeline visualisation shows all tasks as Failed and after that goes to Running state #14862
OCPBUGS-53168: Remove logoutOpenShift method call #14883
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

console-operator

OCPBUGS-60298: Update downloads deployment configuration to use master node selector #1033
Full changelog

container-networking-plugins, containernetworking-plugins-microshift

OCPBUGS-55622: Check error returned by ipv6 SettleAddresses #187
Full changelog

coredns

OCPBUGS-62825: UPSTREAM: 7083 and 6836: Fix failing TestZoneExternalCNAMELookupWithProxy #155
append .0 to go.mod version #135
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-58839: CARRY: don’t ignore json files #340
Full changelog

csi-driver-nfs

append .0 to go.mod version #156
Full changelog

csi-driver-shared-resource, csi-driver-shared-resource-webhook

append .0 to go.mod version #372
Full changelog

csi-external-resizer

OCPBUGS-62466: Requeue PVC over PV creation #175
Full changelog

csi-external-snapshotter, csi-snapshot-controller, csi-snapshot-validation-webhook

OCPBUGS-60449: UPSTREAM: 1238: Snapshot Controller startup should not LIST all volumesnapshots #184
Full changelog

csi-livenessprobe

append .0 to go.mod version #73
Full changelog

csi-node-driver-registrar

append .0 to go.mod version #80
Full changelog

docker-builder

OCPBUGS-57939: S2I build cpu limits observed by assemble are limited to 1 cpu #474
Full changelog

docker-registry

OCPBUGS-60090: bump docker distribution to fix purgeuploads panic #440
OCPBUGS-53655: bump jwt and oauth dependencies #431
Full changelog

gcp-machine-controllers

OCPBUGS-53037: Disable shielded VMs for non-UEFI disks #115
Full changelog

haproxy-router

OCPBUGS-49390: Reject All CA-Signed Certs Using SHA1 #650
OCPBUGS-49702: Add support for IdleCloseTerminationPolicy #652
Full changelog

hyperkube, pod

OCPBUGS-63460: UPSTREAM: <carry>: backporting fix for concurrent map iteration and write #2456 #2496
CNTRLPLANE-1611: Backport StreamingCollectionEncoding for JSON and protobuf #2486
OCPBUGS-61584: UPSTREAM: <carry>: Don’t retry storage calls with side effects. #2458
OCPBUGS-60552: [4.17] podresources: list: use active pods #2426
4.17: OCPBUGS-60998: scheduler: Improve CSILimits plugin accuracy by using VolumeAttachments #2434
OCPBUGS-57888: Bump k8s api to 1.30.14 #2355
OCPBUGS-57196: UPSTREAM: 130047: adjusting loopback certificate validity in kube-apiserver #2328
OCPBUGS-57289: kubelet: fix a stall on startup from waiting too long for a stat call #2206
OCPBUGS-55269: Bump k8s api to 1.30.12 #2280
Full changelog

hypershift

OCPBUGS-63370: fix: Make the hypershift CLI binary FIPS-compliant #7094
CNTRLPLANE-1425: feat(konflux): tag MCE HO images with latest #6838
OCPBUGS-57143: [release-4.17] HCP payload doesn’t respect multiple mirrors #6771
OCPBUGS-61290: Update KCM node monitor grace period #6760
OCPBUGS-61208: use common MCE konflux pipeline #6749
OCPBUGS-60149: [release-4.17] Always compress and encode payload in token secret for inplace upgrades #6740
OCPBUGS-61101: Use system trust bundle in CPO IDP https client #6735
OCPBUGS-60921: konflux for hcp-cli #6699
CNTRLPLANE-1204: HO MCE change to hermetic ta build #6653
CNTRLPLANE-1230: Move CPO pipeline to hermetic builds #6598
CNTRLPLANE-936: fix(tekton): drop multiarch builds on PR #6224
OCPBUGS-57432: Add proxy variables for the MCD Pod #6258
CNTRLPLANE-918: Konflux build pipeline service account migration #6088
CNTRLPLANE-918: Konflux build pipeline service account migration #6083
OCPBUGS-55723: Don’t check if olm images exist if guest cluster #6115
OCPBUGS-55500, RHOCPPRIO-433: Add validation to avoid conflicts between KubeAPIServer and NamedCertificates SANs #6098
OCPBUGS-51808: Fix golang crypto dependency go.mod replacement #5993
OCPBUGS-54841: Add konnectivity-proxy sidecar to openshift-oauth-apiserver #6017
OCPBUGS-53323: Handle multiple mirror entries for source #5894
OCPBUGS-54631: Sync RBAC for attaching volumes on VM level #5997
NO-JIRA: update konflux references #5479
OCPBUGS-53903: bump golang-jwt v4 and v5 #5906
NO-JIRA: Red Hat Konflux update control-plane-operator-4-17 #5959
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-58740: bump github.com/golang/glog to version v1.2.4 #105
OCPBUGS-56062: tech debt: rework vendor patches #90
append .0 to go.mod version #100
OCPBUGS-53911: bump github.com/golang-jwt/jwt/v4 to v4.5.2 #83
Full changelog

ibm-vpc-block-csi-driver-operator

OCPBUGS-58435: [IBM VPC] set offlineExpansion to false in e2e test manifest #146
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-51823: CVE-2025-22869 Update golang.org/x/crypto to patched OpenShift fork #121
OCPBUGS-50566: Fix for CVE-2024-45338 in golang.org/x/net/html in release-4.17 #101
Full changelog

ibmcloud-machine-controllers

OCPBUGS-52957: IBMCloud: MAPI replacing unhealthy CP nodes #63
Full changelog

insights-operator

OCPBUGS-61656: virt launcher logs gatherer (#1135) (#1138) #1135
avoid possible Go panic when searching existing conditions (#1125) #1125
fix: incorrect anonymization of domains (#1116) #1116
feat: copy proxy envs from IO pod to gathering pods (#1107) #1107
Full changelog

ironic-agent

OCPBUGS-55680: Delay determining the hostname to put into ignition #185
Full changelog

ironic-machine-os-downloader

append .0 to go.mod version #104
Full changelog

kube-metrics-server

append .0 to go.mod version #43
Full changelog

kube-rbac-proxy

ART-13124: Update go.mod to include patch version in go directive #120
Full changelog

kube-storage-version-migrator

NO-JIRA: Add DOWNSTREAM_OWNERS (release 4-17). #226
ART-13124: Update go.mod to include patch version in go directive #217
Full changelog

kubevirt-cloud-controller-manager

OCPBUGS-34447: Updating ose-kubevirt-cloud-controller-manager-container image to be consistent with ART for 4.17 #44
Full changelog

kubevirt-csi-driver

OCPBUGS-54631: Ensure volume stays attached through reboots #56
Full changelog

machine-api-operator

OCPBUGS-57073: Updates GCP CredentialsRequest #1377
OCPBUGS-53036, OCPBUGS-53037: Updates GCP credentials request #1345
Full changelog

machine-config-operator

OCPBUGS-63540: Add control-plane label for master nodes on legacy clusters #5375
OCPBUGS-63364: Invalid architecture value found in annotation during 4.19 update #5368
OCPBUGS-63055: Recheck generatedByControllerVersion annotation prior to deleting a degraded MC #5346
OCPBUGS-62741: Add /etc/docker/certs.d to template #5335
OCPBUGS-62683: Add mcd_local_unsupported_packages recording rule #5327
OCPBUGS-60890: Race in configure-ovs.sh affects bonding interface configuration. #5267
OCPBUGS-61859: Override NMState service definition #5289
OCPBUGS-59930, OPNET-681: Support migration to NMState #5206
OCPBUGS-56752: Support NODEIP_HINT in IPI deployments too #5080
OCPBUGS-60704: operator: switch out VAP v1beta1 to v1 #5256
OCPBUGS-57084: scope MCD node listers to current node #5107
OCPBUGS-60239: Add workaround fix for static pod race #5231
OCPBUGS-58292: Do not set cpu system reserve below the default value #5157
OCPBUGS-58063: Update desired config in MCN on OCL update #5139
OCPBUGS-56625: Give keepalived container chroot cap #5072
OCPBUGS-58219: Boot image controller should correctly handle marketplace boot images #5151
OCPBUGS-58218: add MachineConfiguration to CO related objects #5150
OCPBUGS-57135: pkg/operator/status: Drop PoolUpdating as an Upgradeable=False condition #5111
OCPBUGS-56901: Fix dynamic-system-reserved-calc.sh when only true parameter is used #5096
OCPBUGS-56976: Boot Image Controller should not degrade when golden configmap is slow to update #5101
OCPBUGS-56990: Only update boot disks during GCP boot image updates #5102
OCPBUGS-56828: daemon: fix ostree-finalize-staged race workaround for package mode RHEL workers #5087
OCPBUGS-52313: Update machine-config-daemon-pull.service to use custom policy for Podman < 4.4.1 #4893
OCPBUGS-56665: Add hot loop detection in the boot image controller #5077
OCPBUGS-56395: error from generateAndValidateRenderedMachineConfig function can be misleading #5060
OCPBUGS-56218: Rewrote TestFirstBootHasSSHKeys e2e test in pure Go #5053
OCPBUGS-55615: MSBIC should not update windows machinesets #5021
OCPBUGS-55490: MCO should fall back to us-east-1 for AWS bootimages if no region specific-AMI exists #5020
OCPBUGS-54830: Make mtu-migration run after wait-for-primary-ip #4989
OCPBUGS-52314: on-prem/resolv-prepender: stop leaking tmp files #4894
OCPBUGS-45989: Do not run resolv-prepender from NM dispatcher #4785
OCPBUGS-52188: ignore mc not found error #4957
Full changelog

machine-image-customization-controller

append .0 to go.mod version #135
Full changelog

metallb-frr

OCPBUGS-55021: Backport DynamicASN #92
OCPBUGS-55344: OpenShift Only: TEMPORARY: pin FRR version to known working rpm #89
Full changelog

monitoring-plugin

OCPBUGS-62282: align dev and admin persective tab names #602
OCPBUGS-62282: add missing translation string #587
OCPBUGS-61891: feat: add alerting rules tab to dev console #538
OCPBUGS-59399: Fix “Export as CSV” #468
OCPBUGS-54211: fix issue preventing dev silences from loading #374
OU-724: remove deleted image #377
Full changelog

multus-admission-controller

OCPBUGS-58770: Update the github.com/golang/glog module to v1.2.4 #102
append .0 to go.mod version #97
Full changelog

multus-cni, multus-cni-microshift

OCPBUGS-43391: Update net-attach-def client library to 1.7.5 for cri-o functionality [backport 4.17] #257
OCPBUGS-47471: adds getcontext (backport 4.17) #260
Full changelog

multus-networkpolicy

append .0 to go.mod version #71
Full changelog

multus-whereabouts-ipam-cni

OCPBUGS-55617: Fixes leftover podref issue #364
Full changelog

must-gather

NO-JIRA: append .0 to go.mod version #492
Full changelog

network-interface-bond-cni

OCPBUGS-59620: Bump github.com/containernetworking/plugins from to 1.7.1 #83
NO-JIRA: Add ci-operator file #82
Full changelog

network-metrics-daemon

append .0 to go.mod version #105
And 2 elided commits (e.g. from squash or rebase merges)
Full changelog

network-tools

append .0 to go.mod version #148
Full changelog

networking-console-plugin

OCPBUGS-60180: Fix ingress details #265
OCPBUGS-60128: Fix requiremenets with no value #260
Add translations 4.17 #239
Add translations scripts #235
Full changelog

nutanix-machine-controllers

OCPBUGS-51859: CVE-2025-22868 #111
OCPBUGS-47267: fixing CVE-2024-45338 #92
OCPBUGS-55728: Fix link-local addresses being added to machine #102
Full changelog

oauth-apiserver

OCPBUGS-61584: Bump openshift/kubernetes-apiserver for etcd retry patches. #143
append .0 to go.mod version #133
Full changelog

oauth-proxy

OCPBUGS-61445: Update x/crypto to v0.31.0 #334
OCPBUGS-58472: fix e2e tests #327
OCPBUGS-30443: Update dependencies to address CVE-2024-24786 #298
Full changelog

oauth-server

OCPBUGS-61584: Bump openshift/kubernetes-apiserver for etcd retry patches. #198
append .0 to go.mod version #185
Full changelog

oc-mirror

Adding r4f4 and Prashanth684 as approvers and removing contributors who are not working with oc-mirror anymore. (#1269) #1269
Full changelog

openshift-apiserver

OCPBUGS-63392: Wire dry run option to Image API server operations #565
OCPBUGS-61584: Bump openshift/kubernetes-apiserver for etcd retry patches. #554
OCPBUGS-53382: Skip blocked registry check for registries with mirrors #500
OCPBUGS-58821: Fix image reference in TestImageStreamImportQuayIO #515
append .0 to go.mod version #525
Full changelog

openshift-controller-manager

OCPBUGS-61199: legacy image pull secret rollback controller #413
OCPBUGS-57950: ignore error failing to find pull/push secrets #400
OCPBUGS-57480: Set node-pullsecrets volume to read-only to protect image pull credentials #393
OCPBUGS-55826: Empty proxy variables are causing issues during the build #379
Full changelog

openshift-state-metrics

append .0 to go.mod version #124
Full changelog

openstack-cluster-api-controllers

OCPBUGS-44455: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.10 into release-4.17 #343
append .0 to go.mod version #364
Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

OCPBUGS-57092: [release-4.17] e2e stability fixes #1081
OCPBUGS-60791: Add NetworkPolicy as a supported kind #1058
OCPBUGS-57428: reduce cache expiry frequency [release-4.19] #1021
OCPBUGS-59253: Reduce Frequency of Update Requests for Copied CSVs (#3597) #1036
OCPBUGS-57438: operatorgroup: ensure clusterroleselectors in clusterrole aggregation rules are sorted #1025
OCPBUGS-56250: fix(olm): improve error logging for missing olm.managed label (#3558) #1004
OCPBUGS-51226, OCPBUGS-51228, OCPBUGS-51246: (vendor) pin go-jose/v4@v4.0.5 #998
Full changelog

operator-marketplace

OCPBUGS-62219: Remove Expect func so that the test case can use the retry logic #670
OCPBUGS-61036: Update memoryTarget on catalog source pods #663
ART-13124: append .0 to go.mod version #638
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-61749: [release-4.17] Fix dnsnameresolver address set #2796
OCPBUGS-60484: Update OWNERS file: Add Patryk/Martin as approvers #2717
OCPBUGS-59381: [release-4.17] Fix default network -> localnet #2667
OCPBUGS-58160: Unpin OVS patch versions, move to ovs 3.5 #2647
OCPBUGS-57109: Fix hybrid overlay node subnets collision with cluster subnets #2620
OCPBUGS-57107: Increase InformerSyncTimeout to 60s #2623
OCPBUGS-56443: Fix predicate for cluster subnet route to gateway router #2578
OCPBUGS-56244: Allow default network pods to reach localnet on the same node #2572
OCPBUGS-52480: Handles unspecified protocol in network policy port #2478
Full changelog

powervs-machine-controllers

OCPBUGS-61204: Use OS_GIT_VERSION in Makefile when found (for Konflux builds) #126
append .0 to go.mod version #117
OCPBUGS-54750: Fix for CVE-2024-51744 in github.com/golang-jwt/jwt/v4 in release-4.17 #113
Full changelog

prom-label-proxy

append .0 to go.mod version #381
Full changelog

prometheus

OCPBUGS-61766: chore: compute highestTimestamp at queryManager level #268
append .0 to go.mod version #258
OCPBUGS-56738: BACKPORT: fix promtool analyze block shows metric name with 0 cardinality #254
OCPBUGS-54941: Scraping: Bump cache iteration after error to avoid false duplicate detection. #249
Full changelog

prometheus-alertmanager

append .0 to go.mod version #102
Full changelog

prometheus-node-exporter

append .0 to go.mod version #167
Full changelog

route-controller-manager

OCPBUGS-55943: Added error event for failed ingress to route conversion #60
OCPBUGS-53077: ingress: Reset metrics when ingress is deleted #57
Full changelog

service-ca-operator

append .0 to go.mod version #266
Full changelog

telemeter

ART-13124: Update go.mod to include patch version in go directive #562
Full changelog

tests

OCPBUGS-63392: Backport pr 29834 to release-4.18 #30408
OCPBUGS-61162: images/tests: Remove rteval #30202
NO-JIRA: Update extended/networking OWNERS #30090
OCPBUGS-57324: Fix bearer token exposure in exit condition as well #29910
OCPBUGS-57888: Bump to Kubernetes v1.30.14 #29983
OCPBUGS-50664: Replace RunHostCmd with Exec function to censor bearer token being exposed #29539
OCPBUGS-56221: aws/edge: prevent test using unschedulable nodes #29792
OCPBUGS-55451: support provider type external #29737
OCPBUGS-55269: Bump to Kubernetes v1.30.12 #29771
OCPBUGS-55498: [build] Ensure Git Clone Does Not Run Privileged #29743
OCPBUGS-54767: Fix egress firewall tests by updating the URL from docs.openshift.com to redhat.com #29660
Full changelog

thanos

append .0 to go.mod version #161
Full changelog

vsphere-cluster-api-controllers

OCPBUGS-61652: Fix unit tests #71
Full changelog

vsphere-problem-detector

OCPBUGS-61755: Check for number of FailureDomain-s in GetVCenter() #190
Full changelog

View changelog in Markdown or change previous release:

Source code for this page located on github