Back to index
Download the installer for your operating system or run
oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.17.47-x86_64 Team Approvals:
Tests:
Blocking jobs Informing jobs Upgrades from:
Untested upgrades:
4.16.11 ,
4.16.12 ,
4.16.13 ,
4.16.14 ,
4.16.16 ,
4.16.17 ,
4.16.18 ,
4.16.19 ,
4.16.20 ,
4.16.23 ,
4.16.24 ,
4.16.25 ,
4.16.26 ,
4.16.27 ,
4.16.28 ,
4.16.30 ,
4.16.32 ,
4.16.33 ,
4.16.34 ,
4.16.35 ,
4.16.36 ,
4.16.37 ,
4.16.38 ,
4.16.39 ,
4.16.40 ,
4.16.41 ,
4.16.42 ,
4.16.43 ,
4.16.44 ,
4.16.45 ,
4.16.46 ,
4.16.47 ,
4.16.48 ,
4.16.49 ,
4.16.50 ,
4.16.51 ,
4.16.52 ,
4.17.10 ,
4.17.11 ,
4.17.12 ,
4.17.13 ,
4.17.14 ,
4.17.16 ,
4.17.17 ,
4.17.18 ,
4.17.19 ,
4.17.20 ,
4.17.21 ,
4.17.22 ,
4.17.23 ,
4.17.24 ,
4.17.25 ,
4.17.26 ,
4.17.27 ,
4.17.28 ,
4.17.29 ,
4.17.3 ,
4.17.30 ,
4.17.31 ,
4.17.33 ,
4.17.34 ,
4.17.35 ,
4.17.36 ,
4.17.37 ,
4.17.38 ,
4.17.39 ,
4.17.40 ,
4.17.41 ,
4.17.42 ,
4.17.43 ,
4.17.5 ,
4.17.6 ,
4.17.7 ,
4.17.8 ,
4.17.9 Upgrades to:
Loading changelog, this may take a while ...
Changes from 4.17.0
Created: 2026-01-15 22:57:47 +0000 UTC
Image Digest: sha256:d49a4f1a4532e3822e8769a97d87f538f9101701d3997e6e883c8abff7b58a43
Components
Kubectl upgraded from 1.30.2 to 1.30.5
Kubernetes upgraded from 1.30.4 to 1.30.14
Kubernetes Tests upgraded from 1.30.0 to 1.30.14
Red Hat Enterprise Linux CoreOS upgraded from 417.94.202409121747-0 to 417.94.202601120213-0 (diff )
FeatureGate Changes
FeatureGate
Default
Default
DevPreviewNoUpgrade
DevPreviewNoUpgrade
TechPreviewNoUpgrade
TechPreviewNoUpgrade
StreamingCollectionEncodingToJSON
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
StreamingCollectionEncodingToProtobuf
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
New images
Removed images
ovirt-machine-controllers
Rebuilt images without code change
OCPBUGS-58649 : Bump glog pkg to 1.2.4 (#1182) #1182 Updating ose-agent-installer-csr-approver-container image to be consistent with ART for 4.17 (#1088) #1088
Updating ose-agent-installer-orchestrator-container image to be consistent with ART for 4.17 (#1087) #1087
OCPBUGS-53719 : Bump jwt to 4.5.2 in release-4.17 (#1086) #1086 abi: let the bootstrap waiting for workers before rebooting (#1028) #1028
OCPBUGS-47493 : MGMT-19537: Bump golang.org/x/net to 0.33.0 (#989) #989 OCPBUGS-44904 : Rhcos fails to reboot for skip mco reboot on s390x (#942) #942 OCPBUGS-38466 : Allow controller to continue when assisted-service (#918) #918 OCPBUGS-43023 : Pick up latest CVE changes by bumping service (#919) #919 OCPBUGS-42156 : Switch to github.com/docker/distribution/reference to Mitigate CVE-2024-3727 (#904) #904 Full changelog
OCPBUGS-34314 : Updating aws-kms-encryption-provider-container image to be consistent with ART for 4.17 #19 hack: display diff on verify-mod-tidy failure #25
Full changelog
OCPBUGS-45086 : Re-disable metrics server #2579 OCPBUGS-63154 : Add drop flows for GARPs #2818 [Release 4.17] OCPBUGS-61765: Update CNO reviewers/approvers #2799
OCPBUGS-58066 : [release-4.17]: Manual feature backport of cert rotation for whereabouts #2784 OCPBUGS-57285 : Implement IPsec NAT-Traversal encapsulation option #2726 OCPBUGS-55518 : iptables-alerter streamlining #2698 OCPBUGS-55033 : Add IPv6 NGINX configuration #2689 OCPBUGS-52951 : Unexpected Behavior During Cluster Upgrade for the ovn-ipsec-host pods #2654 OCPBUGS-49816 : ovn-k, rbac: Enable users read & modify UserDefinedNetwork CRs #2655 OCPBUGS-49961 : Update egressfirewall CRD to be consistent with ovn-kubernetes repo #2642 : OCPBUGS-44863: Add nodeslicepool #2574
OCPBUGS-44807 : ovn-k, cudn: Add missing permissions to ovnkube-node #2575 OCPBUGS-43714 : Skip including default crypto policies to avoid authby issue #2597 OCPBUGS-46146 : Remove ip xfrm state when IPsec is disabled #2594 OCPBUGS-44415 : Pass transit_switch_subnet options in ovnkube-node pod #2561 OCPBUGS-44807 , SDN-4930 , SDN-5297 : OVN-Kubernetes node RBAC tightening #2568 OCPBUGS-44807 , SDN-5297 , SDN-5472 : bindata, ovn-k: Add ClusterUserDefinedNetwork CRD and RBAC #2566 OCPBUGS-44807 , SDN-4930 , SDN-5297 : ovn-k, udn: Update UserDefinedNetwork CRD #2551 OCPBUGS-44807 , SDN-4930 , SDN-5297 : Adds UDN list/watch to ovnknode rbac #2540 OCPBUGS-44779 , SDN-5436 : Provide support for user owned IPsec machine configs #2564 OCPBUGS-44330 : Add controlplane cli image envar for use with hypershift #2542 OCPBUGS-43343 : OCPBUGS-42244: Exporting environment varialbe NODE_CNI for live migration #2536 OCPBUGS-43317 : Use CNIConfDir for mounting directory to ovn-ipsec-host pod #2533 OCPBUGS-39300 : rebase openshift/api for openshift-sdn removal [4.17] #2477 OCPBUGS-39121 : Live migration: report network overlap via live_migration_blocked metric #2483 OCPBUGS-42260 : Configure narrowing=yes for IPsec connections #2510 Full changelog
OCPBUGS-63504 : Do not cause kubelet failed dependency by ocp-tuned-one-shot.service #1418 And 20 elided commits (e.g. from squash or rebase merges)
Full changelog
NO-ISSUE: Updating ose-cluster-update-keys-container image to be consistent with ART for 4.17 #79
Full changelog
append .0 to go.mod version #372
OCPBUGS-34217 : Updating ose-csi-driver-shared-resource-container image to be consistent with ART for 4.17 #188 OCPBUGS-44510 : Updating ose-csi-driver-shared-resource-webhook-container image to be consistent with ART for 4.17 #233 Full changelog
DOWNSTREAM: <carry>: OCPBUGS-53447: fix a compaction induce latency issue #321
ETCD-714 : Rebase etcd 3.5.18 openshift 4.17 #310 NO-ISSUE: Add support for cachi2 based deps #297
OCPBUGS-42680 : Rebase etcd 3.5.16 openshift 4.17 #291 NO-JIRA: use golang 1.22 image #286
Full changelog
fix: OCPBUGS-72956: Fix Konflux EC voilation, update deprecated base … #7457
OCPBUGS-69865 : test: remove unit tests that depend on network communication [release-4.17] #7411 OCPBUGS-57123 : Add support for registry root entry only in the IDMS/ICSP #6230 CNTRLPLANE-1903 : Migrate 4.17 pipelines to use common pipeline #7215 OCPBUGS-63639 : [release-4.17] fix(konnectivity): resolve circular dependency causing DNS timeouts and excessive retries #7112 OCPBUGS-64604 : Update DNS names for ovn-kubernetes cp metrics #7150 OCPBUGS-63370 : fix: Make the hypershift CLI binary FIPS-compliant #7094 CNTRLPLANE-1425 : feat(konflux): tag MCE HO images with latest #6838 OCPBUGS-57143 : [release-4.17] HCP payload doesn’t respect multiple mirrors #6771 OCPBUGS-61290 : Update KCM node monitor grace period #6760 OCPBUGS-61208 : use common MCE konflux pipeline #6749 OCPBUGS-60149 : [release-4.17] Always compress and encode payload in token secret for inplace upgrades #6740 OCPBUGS-61101 : Use system trust bundle in CPO IDP https client #6735 OCPBUGS-60921 : konflux for hcp-cli #6699 CNTRLPLANE-1204 : HO MCE change to hermetic ta build #6653 CNTRLPLANE-1230 : Move CPO pipeline to hermetic builds #6598 CNTRLPLANE-936 : fix(tekton): drop multiarch builds on PR #6224 OCPBUGS-57432 : Add proxy variables for the MCD Pod #6258 CNTRLPLANE-918 : Konflux build pipeline service account migration #6088 CNTRLPLANE-918 : Konflux build pipeline service account migration #6083 OCPBUGS-55723 : Don’t check if olm images exist if guest cluster #6115 OCPBUGS-55500 , RHOCPPRIO-433 : Add validation to avoid conflicts between KubeAPIServer and NamedCertificates SANs #6098 OCPBUGS-51808 : Fix golang crypto dependency go.mod replacement #5993 OCPBUGS-54841 : Add konnectivity-proxy sidecar to openshift-oauth-apiserver #6017 OCPBUGS-53323 : Handle multiple mirror entries for source #5894 OCPBUGS-54631 : Sync RBAC for attaching volumes on VM level #5997 NO-JIRA: update konflux references #5479
OCPBUGS-53903 : bump golang-jwt v4 and v5 #5906 NO-JIRA: Red Hat Konflux update control-plane-operator-4-17 #5959
ART-11792 : update go mod dependency for konflux #5920 OCPBUGS-51737 , OCPBUGS-51808 : Bump dependencies to OCP fork in backports #5900 OCPBUGS-48439 : kubevirt, Don’t break on hostname NodePort.Address #5394 OCPBUGS-51240 : bump go-jose #5863 OCPBUGS-52657 : Make managed-trust-bundle optional #5794 OCPBUGS-52425 : [release-4.17] refactor aws identity health check into new controller #5772 OCPBUGS-46340 : change plaform to platform #5562 OCPBUGS-51339 : [release-4.17] Fix IsProgressing condition in HostedClusters #5712 OCPBUGS-50697 : add region to AWS creds passed to operators managed by CPO #5671 OCPBUGS-51098 : 4.17 Add HostedCluster additional trustbundles to konnectivity-https-proxy #5675 NO-JIRA: Update dependency mkdocs-material to v9.6.5 #5682
OCPBUGS-50596 : Honor proxy vars in the util insecure http client #5605 OCPBUGS-49828 : Duplicate hostDevices.name when hostDevices.deviceName has multiple types. #5558 OCPBUGS-48487 , OCPBUGS-48488 , OCPBUGS-48490 : Fix IPv6 Disconnected HCP deployments #5402 OCPBUGS-47533 : Prevent IgnitionServer from flooding the API server with patch requests #5332 NO-JIRA: Update dependency mkdocs-material to v9.6.3 #5590
OCPBUGS-45268 : Reconcile proxy CA bundle into hosted cluster #5228 OCPBUGS-46465 : Consistently look up and dial cloud API hostnames #5302 NO-JIRA: Update dependency mkdocs-material to v9.6.1 #5528
OCPBUGS-49638 : fix overwriting PKI operator HCP conditions #5504 OCPBUGS-46440 : Allow ARM64 arch deployment on Agent platform #5296 OCPBUGS-48170 : fix disconnected via CLI #5465 OCPBUGS-38810 : nodepoolcontroller: List() PerformanceProfile status per NodePool #4585 NO-JIRA: Update dependency mkdocs-mermaid2-plugin to v1.2.1 (release-4.17) #5428
NO-JIRA: Update dependency mkdocs-material to v9.5.50 (release-4.17) #5427
OCPBUGS-44927 : Add multi-arch validation for HC/NodePool compatibility #5238 NO-JIRA: [release-4.17] Bump golang.org/x/crypto and golang.org/x/net #5368
NO-JIRA: Update Konflux references (release-4.17) #5329
OCPBUGS-46412 : Separate CPO containerfiles #5285 NO-JIRA: chore(deps): update konflux references (release-4.17) #5289
NO-JIRA: chore(deps): update dependency mkdocs to v1.6.1 (release-4.17) #5290
OCPBUGS-44114 : Add external kas address to no proxy skip list #5028 NO-JIRA: Red Hat Konflux update hypershift-release-mce-28 #5174
NO-JIRA: chore(deps): update konflux references (release-4.17) #5249
OCPBUGS-44630 : Use ingress role in private link controller for DNS operations #5142 NO-JIRA: chore(deps): update konflux references (release-4.17) #5183
NO-JIRA: chore(deps): update konflux references (release-4.17) #5154
NO-JIRA: chore(deps): update konflux references (release-4.17) #5144
OCPBUGS-44184 : dont use registryOverrides on kube rbac proxy image be… #5033 NO-JIRA: chore(deps): update konflux references (release-4.17) #5113
OCPBUGS-43929 : Return the right tagReference on Catalogs ImageStream #4993 OCPBUGS-44276 : Configure OAuth https proxy to dial cloud endpoints directly #5070 OCPBUGS-44268 : Fix order rendering HCP objects #5064 NO-JIRA: Update Konflux references (release-4.17) #5098
chore(deps): update konflux references (release-4.17) #5075
HOSTEDCP-2046 : CPO 4.17 tekton builds #5006 NO-JIRA: chore(deps): update konflux references (release-4.17) #5053
NO-JIRA: Update Konflux references to fedcfe0 (release-4.17) #5041
chore(deps): update konflux references (release-4.17) #5023
chore(deps): update konflux references to f53fe54 (release-4.17) #5018
NO-JIRA: Update Konflux references (release-4.17) #5009
OCPBUGS-42879 : Add network policies for konnectivity server and ignition server proxy #4865 NO-JIRA: bump catalog operators version #4992
NO-JIRA: chore(deps): update konflux references (release-4.17) #4972
OCPBUGS-43746 : add ValidIDPConfiguration condition to report IDP config issues #4969 NO-JIRA: chore(deps): update konflux references (release-4.17) #4958
OCPBUGS-43464 : Pass feature flags to clusterpolicy controller #4928 NO-JIRA: chore(deps): update konflux references (release-4.17) #4931
OCPBUGS-42704 : Run 2 replicas of active/passive HA components #4843 OCPBUGS-43316 : Enforce privileged PSA by default #4834 NO-JIRA: chore(deps): update konflux references (release-4.17) #4921
OCPBUGS-43374 : release-4.17 openstack/e2e: re-work nodepool tests #4914 NO-JIRA: chore(deps): update konflux references to 674e70f (release-4.17) #4907
NO-JIRA: chore(deps): update konflux references (release-4.17) #4895
OCPBUGS-43051 : Use guest DNS resolution in Konnectivity HTTPS proxy by default #4885 HOSTEDCP-2020 : [release-4.17] Add support for SharedVPC #4873 HOSTEDCP-2023 : [release-4.17] Split worker and vpc endpoint security groups #4882 OCPBUGS-42974 : [release-4.17] Do not send traffic to local audit-webhook through konnectivity #4869 NO-JIRA: Remove EnsurePSANotPrivileged check #4855
OCPBUGS-42714 : label routes only when HCP router used #4845 NO-JIRA: chore(deps): update konflux references to 37b9187 (release-4.17) #4854
OCPBUGS-42390 : Add Annotation to skip deleting hcp namespace #4792 NO-JIRA: chore(deps): update konflux references (release-4.17) #4812
NO-JIRA: e2e: openstack: fix nil deref in route53 teardown #4810
OCPBUGS-42261 : Conditionally manage kubeconfig secrets for DNS and Ingress operators #4764 OCPBUGS-42098 : Use KubeClientCABundle for HostedClusterConfigOperator cluster-signer-ca #4736 chore(deps): update konflux references to 5ac9b24 (release-4.17) #4780
OCPBUGS-41552 : Let payload generation pick the release for the NodePool #4691 chore(deps): update konflux references to 2c3426a (release-4.17) #4774
NO-JIRA: chore(deps): update konflux references (release-4.17) #4761
NO-JIRA: Security fixes for openshift-ci-security job #4748
NO-JIRA: chore(deps): update konflux references (release-4.17) #4726
HOSTEDCP-1953 : bump CCO version #4694 Full changelog
append .0 to go.mod version #105
And 4 elided commits (e.g. from squash or rebase merges)
Full changelog
Adding r4f4 and Prashanth684 as approvers and removing contributors who are not working with oc-mirror anymore. (#1269) #1269
fixes CVEs upgrading go-git dependency (#1033) #1033
OCPBUGS-47453 : Use one of the newer sha256 keys to verify release signatures (#1000) (#1024) #1000 changes the owners file (#1017) #1017
OCPBUGS-48513 : e2e: use same version of crane as in go.mod (#1020) #1020 OCPBUGS-37867 : Use tag only when image by tag and digest (#911) (#932) #911 Full changelog
OCPBUGS-61199 : legacy image pull secret rollback controller #413 OCPBUGS-57950 : ignore error failing to find pull/push secrets #400 OCPBUGS-57480 : Set node-pullsecrets volume to read-only to protect image pull credentials #393 OCPBUGS-55826 : Empty proxy variables are causing issues during the build #379 OCPBUGS-47769 : Add team members to the OWNERS file #357 OCPBUGS-44093 : user system:serviceaccount:openshift-infra:serviceaccount-pull-secrets-controller in ns/openshift-infra must not produce too many applies #350 NO-JIRA: cleanup root and app OWNERS #346
OCPBUGS-42362 : Continuous pull-secret updates / slow initialization on build01 (test platform infrastructure) #339 Full changelog
Source code for this page located on github