4.21.12

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.21.12-x86_64

Team Approvals:

Tests:

Blocking jobs
- upgrade Succeeded periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
- upgrade-minor Succeeded (1 retry) periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Succeeded
Informing jobs
- aws-ovn-serial-1of2 Succeeded periodic-ci-openshift-release-main-nightly-4.21-e2e-aws-ovn-serial-1of2
- aws-ovn-serial-2of2 Failed (1 retry) periodic-ci-openshift-release-main-nightly-4.21-e2e-aws-ovn-serial-2of2
  - Attempt 1 Failed
  - Attempt 2 Failed
- aws-ovn-single-node-upgrade-4.21-micro Succeeded periodic-ci-openshift-release-main-ci-4.21-e2e-aws-upgrade-ovn-single-node
- aws-ovn-upgrade-4.21-micro-fips Succeeded (1 retry) periodic-ci-openshift-release-main-nightly-4.21-e2e-aws-ovn-upgrade-fips
  - Attempt 1 Failed
  - Attempt 2 Succeeded
- aws-ovn-upgrade-4.21-micro-fips-no-nat-instance Succeeded periodic-ci-openshift-release-main-nightly-4.21-e2e-aws-ovn-upgrade-fips-no-nat-instance
- azure-ovn-upgrade-4.21-micro Succeeded periodic-ci-openshift-release-main-ci-4.21-e2e-azure-ovn-upgrade
- driver-toolkit Succeeded (1 retry) periodic-ci-openshift-release-main-nightly-4.21-e2e-aws-driver-toolkit
  - Attempt 1 Failed
  - Attempt 2 Succeeded
- fips-scan Succeeded periodic-ci-openshift-release-main-nightly-4.21-fips-payload-scan
- gcp-ovn-rt-upgrade-4.21-minor Failed (1 retry) periodic-ci-openshift-release-main-ci-4.21-upgrade-from-stable-4.20-e2e-gcp-ovn-rt-upgrade
  - Attempt 1 Failed
  - Attempt 2 Failed
- hypershift-ovn-conformance-4.21 Succeeded periodic-ci-openshift-hypershift-release-4.21-periodics-e2e-aws-ovn-conformance
- metal-ipi-ovn-bm Succeeded (1 retry) periodic-ci-openshift-release-main-nightly-4.21-e2e-metal-ipi-ovn-bm
  - Attempt 1 Failed
  - Attempt 2 Succeeded
- metal-ipi-ovn-ipv6 Succeeded periodic-ci-openshift-release-main-nightly-4.21-e2e-metal-ipi-ovn-ipv6
- microshift-ovn-conformance-parallel Succeeded periodic-ci-openshift-microshift-release-4.21-periodics-e2e-aws-ovn-ocp-conformance
- microshift-ovn-conformance-serial Succeeded periodic-ci-openshift-microshift-release-4.21-periodics-e2e-aws-ovn-ocp-conformance-serial

Upgrades from:

Untested upgrades: 4.21.3, 4.21.7, 4.21.8

4.21.11 (changes) - S S S F S S S
4.21.10 (changes) - Failed
4.21.9 (changes) - Success
4.21.6 (changes) - Success
4.21.5 (changes) - Success
4.21.4 (changes) - Failed
4.21.2 (changes) - Success
4.21.1 - Success
4.21.0 (changes) - Failed
4.20.19 (changes) - S F S
4.20.18 (changes) - Success
4.20.17 (changes) - Failed
4.20.16 (changes) - Success
4.20.15 (changes) - Success
4.20.0-0.nightly-2026-04-22-115050 (changes) - Failed Failed

Loading changelog, this may take a while ...

Changes from 4.21.1

Created: 2026-04-23 11:00:23 +0000 UTC

Image Digest: sha256:809c037c016c7c0cbc83ce459ed344a55d65fa6cc0d3aa4d51e9a2d9d0cf7ffa

Components

Kubectl 1.34.1
Kubernetes upgraded from 1.34.2 to 1.34.6
Kubernetes Tests 1.34.1
Red Hat Enterprise Linux CoreOS upgraded from 9.6.20260204-0 to 10.2.20260408-0

The CoreOS links above are for the base CoreOS layer used to build the OpenShift node image and do not contain OpenShift components. This is normally only useful to devs working closely with the CoreOS team. For info about the node image, see the Node Image Info section.

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
EventTTL (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled	Enabled
IngressControllerDynamicConfigurationManager (0 tests)	Disabled	Disabled	Enabled	Enabled	Enabled (Changed)	Enabled (Changed)
KMSEncryptionProvider (0 tests)	Disabled	Disabled	Enabled	Enabled	Disabled (Changed)	Disabled (Changed)
KMSEncryption (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)

Removed images

cluster-kube-cluster-api-operator
libvirt-machine-controllers

Rebuilt images without code change

agent-installer-node-agent git e5713826 sha256:26b64e7552c1c6495e45240d290ea59c547fb8564399fe5bacf6bef9c6671b66
apiserver-network-proxy git 35ba137a sha256:36876d41b61936a9cab5c5b970f214731594f1bb0b8787f2eb0e1afa0ab48a9b
aws-cluster-api-controllers git 10ceef5e sha256:25eb6bf603932c19265a9fd2769e277c25eaa474e563f4cf57ec178a6d29914d
aws-ebs-csi-driver git 57eebffc sha256:05c789f91c1f57d41389a4fb3324100339333fef0c6af1f9b81be2c371122423
aws-karpenter-provider-aws git ff9c8d4e sha256:5429b40261e92320becad7a4eb48f84aece6b4a8c0cf34357e7a0c879cfd53e5
aws-kms-encryption-provider git 19e7b623 sha256:a22eb73940bf653c26c1882ca55abdf1356e08dea1cce76aac96f72612647c17
aws-machine-controllers git 938565c9 sha256:58ba1ea2c043ce2fa2405695c2d9035ed337dc6cca2b4259f3da482f83ca0f97
aws-pod-identity-webhook git 5cd42ed1 sha256:27aa22fe60c26a6f4928fd8633ae6ea426443c7a4b061bc6f39d51d0a02c9127
azure-cloud-controller-manager git 83b3f9ec sha256:2956d6872e287268ea1389980e4819b9b3bdb2ced88f5b29dabfe6baca6f0c4d
azure-cloud-node-manager git 83b3f9ec sha256:7467774ea19837d6c47d5e917a9d94481e342de8bb60a56e9477bf4a98a157ba
azure-cluster-api-controllers git 5d6af81d sha256:ce567e5ccd673003c6408c44c84e0d805aeae169c2c06af30c253f25a99fe627
azure-file-csi-driver git c77d75f9 sha256:f03c718e2527a7597f1d3c41556e2a64b46707e025e67ebc0df23bb0a110ed00
azure-kms-encryption-provider git fe1d311b sha256:8680ec7782dfc9886aef7eae6a6dc7f895053902ffdbe382563ef889b8f35b0a
azure-machine-controllers git b8b8cb1c sha256:6904c5048f44b76d182d4b5094a0344e12df77dcfe455db107e75c4959912d05
azure-service-operator git 17e57462 sha256:0c953219ec285a6ccdc41b8a0158dd0d29acd56d18cb25258b3a2b40fbb11d77
azure-workload-identity-webhook git 3f2a6e0d sha256:f9f719c98771db1bf98620ddd14593a5957f2c5f52b190a9ad144d0aaf1c3459
baremetal-cluster-api-controllers git 659138fe sha256:53d18ce26242a6dc42e3b725193f818300dfd6e832f2310f511eb058b7e33032
baremetal-machine-controllers git 4e6a729c sha256:859359fc5c3a431a5cec0b96e5d555c81cb10baee9cdec5136ff1013f9c8e50f
cluster-autoscaler-operator git dec12ba6 sha256:85ce92487d0a8a3ea1b019a86ca5a71276eb909ce3ebb22dddde13d6549e9bba
cluster-bootstrap git dc0d4a5c sha256:d4f2d2603f3f56f334a32e21117f753d8858966197c941d55b9a6c3564247a17
cluster-capi-controllers git a957484a sha256:fdc223ac451a566fbc5ec17d9ec35fd44e6cf4d7f170d36424f8ba09c2ab3250
cluster-capi-operator git 80728a61 sha256:808a5139b49a7c455cd6439ed15fab96d06854c11aa7877df4c0054328cd88e3
cluster-cloud-controller-manager-operator git 6148c0cc sha256:bb48075c3d9a4af6f67012d6c6f3bdbf7e086cb7807cb16eb233908d03a82a25
cluster-config-operator git 1eb450a3 sha256:9f5634252b97f9cae7fb8d3f67eee8bacd2a59aec9c55083467058a7168bfe2d
cluster-control-plane-machine-set-operator git 2dde33fb sha256:9e93410950179aa28f27b327fc9ff8028eebe8e646b9c443690d87b734d5c206
cluster-dns-operator git 41a53fed sha256:8f90e3451ef02c474d94ffad38181b155d15447da321f22487a14dcd9bee516d
cluster-image-registry-operator git b2dfc3bb sha256:c80ee0cc6483647a677986ecba1d08fa6643321f78f77f3dd2d888d6287c1803
cluster-kube-controller-manager-operator git 395de967 sha256:96af8b262b90018d0e5e3f1cca15010f1001e4ae4f79c7a77fb91541be886d64
cluster-kube-storage-version-migrator-operator git 8a42beeb sha256:249b58389e43e4312dcc7bd7ff788ded53bf79bf9eb27770b102818d388e205f
cluster-machine-approver git d864813c sha256:64e45da7c2d9703fe3ed546d1ad43bd4c1722ec8d72bfe1337a80abdcb011b67
cluster-openshift-controller-manager-operator git 2617a201 sha256:7cfb718876ddfcecebf4ee98fab8103bbb79b9925a107e95fade59e860c9beab
cluster-policy-controller git 8b775487 sha256:56f5d3142e7566cff4d52503eb2e96043744b02d662286848b3b7b4ca756882e
cluster-samples-operator git 11ed1942 sha256:7c54cefbf2c8edd374efac20f5178e57880f3d8dcd1279573dc35e645722cce3
cluster-update-keys git b3cae8f2 sha256:5ff8b3de17dfdb48b97b517c3425a3ec507f971410ef69c17f5622a98c39ddb1
configmap-reloader git 16114b8d sha256:912df925e4b76e14942f4687ddf103d1bd15d3dab6d9568fe6f253eddaeca17c
container-networking-plugins git 747ad66c sha256:b04b22a3d8ab01c7594d6b52a5a596a0a94725056ebda4f6c6e2040210746fb3
containernetworking-plugins-microshift git 747ad66c sha256:7b2467373878b7498447de1b5585dc892c1f5243d11662f924e1cfb98a84dab3
coredns git 7486e9e4 sha256:549b356183abd2f8c43f865b53b337eadd57a10b2852221c4554b314afd9ee37
csi-driver-manila git bf508c06 sha256:246489feb6a2cd2233c6c42110c901fdec616e403aca15a19c0e6a85a45d58f2
csi-driver-nfs git 49f2d86f sha256:2a8c09f9c92214735bf51e892e94019dda047f3271f3fc971b9fdd939efaae3f
csi-external-attacher git 344669a2 sha256:9895e2af0858a483605cb605f1551c9f44fe23b6d6d7d716ada34cf610de73bf
csi-external-provisioner git f18190fb sha256:88caecb487445c6ce99fff4aec3b356b10f74bef2e66e717552287c85f8edafd
csi-external-resizer git d880a1ec sha256:beb5361f6cf04bf95bce30a122b0aa4624c14d8860133ce752f4628a73ba6652
csi-external-snapshot-metadata git af250fdb sha256:a354a75bcb2368cab77a99c8e66ebee05467b4f8314456bb54fe6d48ca04cc36
csi-external-snapshotter git 9098db0e sha256:ae2a6ce9396c20c0e61623720bc6692ee508f8432d441d078a699c84c98588f7
csi-livenessprobe git 78dacb7c sha256:d77fee179086467c2e2727424073ef06ec3a164418a6b6a62fcc0de5d5804532
csi-node-driver-registrar git d29f3f7a sha256:d19f38c9d17b0798ab29af677fafb6647499573fd20e35b696c15dcaff8a7fcc
csi-snapshot-controller git 9098db0e sha256:948706f8ca4420b6ae52ee28ffdcc190b03d6282898e995fdc03e4b4f74ba393
docker-registry git 602f51c7 sha256:307788f3aa06615d990c913f0e48a1754dcc1e614fa2b20bb21cc3d14d6a255d
egress-router-cni git 5e0f8d1b sha256:4d74906a9125fa12b71b7dab4fc1084235a998500cf3e89df6a01bb5db0176c1
etcd git 806f690e sha256:479aa0d6866982c2069b200b06e679413abfdb050f22162bd6742825d69b348e
gcp-cluster-api-controllers git e2d0c20e sha256:d24c21981b77cc7377f29cb293439809c99d73d208d82e8ee6be1469528c2422
gcp-machine-controllers git 91f71c9a sha256:8edfdb3445eccf9f9f4c614903d81832c0906704ea225823809c7d52a9724c95
gcp-workload-identity-federation-webhook git d481e5cb sha256:d20fa4b7de014f0a95066009a60a33bd0642273a87bf41d4658f76391520a1d5
ibm-cloud-controller-manager git c566572b sha256:0a9e23c1ad3f5e65b88af0b38d0965939a7e279354494b882faf5fd0ad991241
ibm-vpc-block-csi-driver-operator git 00bc7407 sha256:ce7b3360f04133ce284c44feb8363e81c083489ad5f0b1bb93339e66c1536675
ibmcloud-cluster-api-controllers git f7e3ec30 sha256:8906de27bdc238197643af0f7162c8b75bfe645baa467d342a3b0c2bf3732500
ironic-static-ip-manager git b95b05fe sha256:b0b8fee70da7c5964499ccab6b25f1f4ac09346e706bab751c34c3e42ed9896f
kube-metrics-server git ed76a5e8 sha256:ee0b2f669c02b0981ef5f88bdf7f0fafc7e8224783bfdac20f6aa22fb23fcee7
kube-rbac-proxy git cd636680 sha256:a8cffee2e5522fe4bb17e80c8d9746f59aace8d5cabfff978fdae1f550f5c815
kube-state-metrics git cb0aa591 sha256:bd4573519350692915584b44394c74588d589c584255e92aca6caf4186718764
kube-storage-version-migrator git ce5ff17e sha256:631211ed586ba472d507f240dd2e5fde77e5a90a87c499b9defbb6a479fb0cc8
machine-os-images git 9a8e96a6 sha256:097f7d88e59f159388e4ce6757acc6f0a4715b3fe298caebbe98198727dcae8a
metallb-frr git c82bfaad sha256:a3ff10afac444ae8658c6d8d1212b47779921e3885673dfd73448acfab7421aa
multus-admission-controller git d95feb67 sha256:0b7129b8401b882d4b5ed1eae5527139b3da13d4f20a749583665d0d0a073cb1
multus-route-override-cni git 08af4127 sha256:2864c76315c9f5cde6b31331da8ec1cda1cd6f5ae4fdfc64ed194ecce401a926
multus-whereabouts-ipam-cni git d691040e sha256:b7b1623d082ae51f9b310c43cc6cdd3a2ab71bba3dd17396b8b33cf7018643ee
must-gather git b4b434c4 sha256:bb1cdf79328e0658f1277219a223ed479d1714f72b7ea410d265c0cf05d31a07
network-interface-bond-cni git 297eeb43 sha256:26244a3e075cd445fc0e0984d7d307db03ee1ec3ede8db8fc687ae2f45b558ee
network-metrics-daemon git 844fa588 sha256:9594435469804e8bf7519ae525e0d37dfe743693594b2d5d76c08b32d062926a
network-tools git d6717e45 sha256:e5b704fddc4a9ed871585ffdd44f9ec7690b46963c3dc7f39bb8e772bfae71ad
nutanix-cloud-controller-manager git 33b7bec6 sha256:7ca88ab8ae79294b936d7a8a4c5fda530dba2c873ce362a737460ce1083c82b4
nutanix-machine-controllers git b15a665c sha256:8c46802144882b597318479816c0ae25e15314b35ffcb9226168b02488a43f64
oauth-apiserver git 71c41b2d sha256:a364cdc9563ebfe1efeadf799029877e7c959f20d6f5cc37b14332e906e89914
oauth-proxy git 7f518c02 sha256:f9d5cc5e37fc2cac533f249173799150e51c9d4de1b0e743c1c79665ef8989f2
openshift-apiserver git 64dea074 sha256:47594ec183ff28e862f90ea19ccd8246237564cb26936cc57b1f043eef9cc1c9
openshift-controller-manager git 438d52e7 sha256:f0756c90c6c5f0c1678c85258986e63aa5d6f6089b7ae4e8f32252ed889560e0
openshift-state-metrics git ab605a4b sha256:88d598bb6eed4f5e06a8ac729e399b105a5867573d76e259fba488a05ed1e1ce
openstack-cinder-csi-driver git bf508c06 sha256:a14104e6970924a9c3a442ab29b88a86ef822f0c8de9694fb5a5d71184bc6f9c
openstack-cloud-controller-manager git bf508c06 sha256:69330f15ecf7c5964ab3f181079b45d9e0581a36739bf409fdbd3a984f8d0892
openstack-cluster-api-controllers git e1c0f2f9 sha256:b2cb4ea4ac134a535d3931426c9b0db4b4f322a58d1ab1507d67255e36947256
openstack-resource-controller git 70f5ad34 sha256:7c2510925002bbf225fef1aa2920d8ca2232f42c56fcd08c92ad4609f371c1b4
powervs-cloud-controller-manager git 969a04e9 sha256:93eb7353a4102c91b98f77613b5bc24271de547f5cb100e15ef8efff409e68dd
powervs-machine-controllers git 551974ef sha256:e69873dca7fcdcf4d9b0bb01e844a70c374557362210078f8d9987d20228b965
prom-label-proxy git 610c11b5 sha256:422d9f021082652d7b9cfb43997dae35e47aff88808574db44deb2702984fbe9
prometheus-alertmanager git 3dbe0b64 sha256:d2adc67952305c41bf4653b9bc3281131275f89096e57cae752d94359de14c9e
prometheus-node-exporter git 39d72873 sha256:aabbf12dc2581731fabbeba7bd248bf2e1a9a6c4dae2a68561000f7e6e9dcebb
service-ca-operator git e9622ba1 sha256:b7242db527eab2aeda7184283365af2bbe3609575b19dcf57f84ad165216bdb5
telemeter git a54acdfe sha256:baea7c170c1e4a4ed455e8810ebfada30f945ed6c6de060b47e8f7f20b4c3faf
thanos git 6ea20ffa sha256:fb727b125e768e883758758c46456601f94488ed23af085788e3c793379d2616
volume-data-source-validator git 8b929332 sha256:598b666472bc13ec4b9ba3d98601d93f39a1c3b915235c82d65f182fb3591314
vsphere-cloud-controller-manager git f69584d6 sha256:a6cae470bc2fc5174dab8ddb6423ebfe596aaecb57841db6c9a91a16c0ef797f
vsphere-cluster-api-controllers git 6626b299 sha256:785ee6c5371675ffc470bded1b86803dcf635f5b53bcf0d58c4b0be9aa48f5c4
vsphere-problem-detector git a35d685a sha256:0d2f93c18af560cbf2e904ce19049931db64ef43162d7bc94c70b2f019d8f9cd

agent-installer-api-server

OCPBUGS-81843: Prefer multipath disk in ABI disk selection #10112
OCPBUGS-79580: Fix multi-document YAML parsing for NMStateConfig #10058
AGENT-1431: Backport feature NoRegistryClusterInstall to 4.21 #8806
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-81642: fix: allow workers to join TNA cluster when 1 master + arbiter are ready #2066
OCPBUGS-77536: Fix root partition before copying IRI registry data #2038
Full changelog

agent-installer-ui

OCPBUGS-81589: bump react-router-dom-v5-compat to ^6.30.3 to address CVE-2026-22029 (#3581) #3581
OCPBUGS-83303: bump axios to ^1.15.0 for fixing CVE-2026-40175 (#3583) #3583
OCPBUGS-81587: upgrade lodash and lodash-es to 4.17.23 to address CVE-2025-13465 (#3535) #3535
Add support for release branches in PR workflow (#3528) #3528
populate default values in local ui from infraEnv (#3503) #3503
Full changelog

agent-installer-utils

OCPBUGS-82588: Update OCP version in Konflux #285
OCPBUGS-82539: Update Konflux references #265
OCPBUGS-81645: Update operator versions #282
OCPBUGS-78393: Update Konflux release version to 4.21.5 #270
OCPBUGS-78188: Add a flag to provide a custom appliance image #273
OCPBUGS-78144: Update to use the 4.21 Catalog #271
OCPBUGS-77538: (Backport) Override prefilled rendezvousIP #263
OCPBUGS-77302: Remove multiple redhat-operator-index catalogs #262
OCPBUGS-77236: Update quay.io/konflux-ci/konflux-vanguard/task-rpms-signature-scan:0.2 Docker digest to 2f3015a #222
OCPBUGS-77220: Update Konflux references #251
OCPBUGS-76590: Update Konflux files to build 4.21.1 #254
OCPBUGS-76411: Include additional operators in OVE config #253
AGENT-1431: Backport feature NoRegistryClusterInstall to 4.21 #248
Full changelog

aws-cloud-controller-manager

OCPCLOUD-3341: Updates ecr-credential-provider make target #134
Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator

OCPBUGS-78779: Fix readonly root fs in Azure init containers #528
OCPBUGS-78155: Add only to tags to volume object, if volume is not already tagged #521
Full changelog

azure-disk-csi-driver

UPSTREAM: 3569: OCPBUGS-80741: Bump grpc to v1.79.3 #137
OCPBUGS-78012: 4.21 rebase v1.34.2 #126
Full changelog

baremetal-installer, installer, installer-artifacts

OCPBUGS-82439: [release-4.21] Mount pullsecret manifest to UI container #10489
OCPBUGS-79074: [release 4.21] - Allow all instance types in the install config for GCP #10417
OCPBUGS-79378: Use correct Project ID with GCP Shared VPC #10423
OCPBUGS-79424: Do not discard NMStateConfig when agent-config is on disk for unconfigured-ignition #10428
OCPBUGS-79421: Fix race condition: wait for agent-register-infraenv before showing UI URL #10425
no-jira: fix SC2328 shellcheck errors #10424
OCPBUGS-77900: Add c8g* to tested_instance_types_aarch64 #10366
OCPBUGS-79375: Don’t auto-calculate RendezvousIP in unconfigured-ignition #10410
OCPBUGS-78696: [release-4.21] : Disable LoadBalancer in cloud config when Octavia is unavailable #10399
OCPBUGS-78241: Increase timeout for waiting control plane #10383
OCPBUGS-77504: fix wavelength zone name regex #10343
OCPBUGS-77551: Increase size of /var/ostreecontainer mount #10346
OCPBUGS-73878: handle SSH rule deletion for Azure private #10225
OCPBUGS-76358: [release-4.21] Fix destroy bootstrap command for Azure #10293
AGENT-1431: Backport feature NoRegistryClusterInstall to 4.21 #10250
Full changelog

baremetal-operator

OCPBUGS-65683: OCPBUGS-78835: PR2774 and PR2793 backports [release-4.21] #469
Bug OCPBUGS-76492: BMO fails to start servicing despite updates to HFC spec #459
Full changelog

baremetal-runtimecfg

OCPBUGS-77168: Install dbus-tools, needed in pkg/monitor/dnsmasqmonitor.go #383
Full changelog

cli, cli-artifacts, deployer, tools

MCO-1961: Allow multiple machine-os versions #2244
COS-4005: Allow periods in display name labels for version validation #2243
OCPBUGS-77486: Makefile: Strip debugging symbols by default #2211
OCPBUGS-77168: Install subscription-manager in required images #2208
Full changelog

cloud-credential-operator

OCPBUGS-79367: google.golang.org/grpc v1.79.3 #993
OCPBUGS-78199: Fix infrastructure resource name filtering in watch predicate #988
OCPBUGS-71222: test-ext: remove kubernetes module dependency #958
OCPBUGS-74545: Resolve nil pointer exception in hasResourceTags #969
Full changelog

cloud-network-config-controller

OCPBUGS-77154: Refrain from adding Egress IP to public LB backend pool #205
Full changelog

cluster-authentication-operator

OCPBUGS-74418: Bump library-go to get KMS #847
OCPBUGS-74418: carry test assertion #848
OCPBUGS-74418: Conditionally add the KMS plugin volume mount to the oauth-apiserver container #846
OCPBUGS-74418: Add KMS test scenarios #844
Full changelog

cluster-autoscaler

OCPBUGS-78684: allow clusterapi provider to skip paused resources #410
OCPBUGS-76296: Pick upstream commits to Fix VPA recommender concurrent access panic #404
Full changelog

cluster-baremetal-operator

OCPBUGS-78580: Allow ProvisioningCIDR for unmanaged network #576
OCPBUGS-77418: Fix ironic-proxy service routing for port 6385 #560
OCPBUGS-77035: Update kubebuilder tools to more latest version #558
OCPBUGS-74204: Fix libguestfs /tmp access in machine-os-downloader init container #551
Full changelog

cluster-config-api

OCPBUGS-83756: fix(config/v1): define constants for authentication types as typed constants #2815
CNTRLPLANE-2796: promote the event-ttl feature #2809
OCPBUGS-82578: [release-4.21] postpone the removal of the DeploymentConfig API #2801
OCPBUGS-74418: Introduce KMSEncryption feature gate #2670
OCPBUGS-76408: Move DynamicConfigurationManager back to TPNU #2703
Full changelog

cluster-csi-snapshot-controller-operator

OCPBUGS-82971: Fix PDB unhealthyPodEvictionPolicy field name #272
Full changelog

cluster-etcd-operator

OCPBUGS-77921: Prefer to remove members where they have another healthy machine in the same failure domain index #1563
OCPBUGS-77097: Wait for revision stability before removing etcd members #1555
OCPBUGS-74489: configure inertia for all controllers, bump to 10m #1535
Full changelog

cluster-ingress-operator

OCPBUGS-77432, OCPBUGS-77433: Ensure canary cert matches the default ingress controller’s cert #1367
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-78548: [release-4.21] : Always set service-account-jwks-uri to LB URL even with custom issuer #2071
OCPBUGS-78784: [4.21] move event-ttl test to its own suite #2073
OCPBUGS-74418: Bump library-go to get KMS #2063
OCPBUGS-77969: Add support for event-ttl cases and go test cases in Kube API Server Operator #2066
OCPBUGS-74418: Carry test assertion #2064
OCPBUGS-74418: Conditionally add the KMS plugin volume mount to the kube-apiserver container #2061
OCPBUGS-74418: Add KMS test scenarios #2054
OCPBUGS-74181: SCC: allow image volume type for all SCCs #2007
Full changelog

cluster-kube-scheduler-operator

CNTRLPLANE-2843: chore: update OWNERS #619
Full changelog

cluster-monitoring-operator

OCPBUGS-80765: bump 4.21 grpc to v1.79.3 #2875
OCPBUGS-74425: Include kube_pod_labels in minimal profile #2797
OCPBUGS-77908: [release-4.21] add app.kubernetes.io/part-of=openshift-monitoring label to thanos-ruler pod #2840
OCPBUGS-76541: Fix NodeRAIDDegraded & NodeRAIDDiskFailure alerts #2815
OCPBUGS-77271: AlertingRule: fix duplicate PrometheusRules after MD5->SHA-224 naming change #2829
Full changelog

cluster-network-operator

OCPBUGS-83422: wait for patch port to apply drop garp flows #2946
OCPBUGS-76333: Silence ovnkube-lib.sh to avoid mass of logs to collectors #2900
OCPBUGS-77147: Add config override for openflow-probe #2917
OCPBUGS-76285: Remove duplicated openssl parameter #2899
Full changelog

cluster-node-tuning-operator

OCPBUGS-81122: CNF-21333: [4.21]:perfprof: enable exec-cpu-affinity by default #1484
OCPBUGS-76375: AA: E2E: LLC: Add tests related to odd cpus #1467
OCPBUGS-77464: E2E: Add test case to check Infrastructure pods affinity #1476
OCPBUGS-78173: workloadhints: use IsVM to skip BM-only tests #1480
Full changelog

cluster-olm-operator

OCPBUGS-76269: add resources to clusterOperator relatedObjects #170
OCPBUGS-81311: Fix golangci-lint timeout in CI #189
OCPBUGS-77826: cluster-olm-operator sets Progressing=True during upgrade #177
Full changelog

cluster-openshift-apiserver-operator

OCPBUGS-74418: Bump library-go to get KMS #666
OCPBUGS-74418: Conditionally add the KMS plugin volume mount to the openshift-apiserver container #664
OCPBUGS-74418: Add KMS test scenarios #656
Full changelog

cluster-storage-operator

OCPBUGS-79531: volume-data-source-validator should run on master nodes #687
OCPBUGS-74569: add vsphere permissions for checking if users is authorized to see metrics #660
Full changelog

cluster-version-operator

OCPBUGS-77256: Implement mTLS authentication and authorization for CVO metrics endpoint #1326
Full changelog

console

OCPBUGS-83572: fix Developer Sandbox telemetry #16286
OCPBUGS-83418: Fix resource log dropdown TypeError #16281
OCPBUGS-81517: Follow up on fixing the remaining issues in the multi-group impersonation feature #16236
OCPBUGS-81714: Add missing i18n translations for Pagination component #16255
OCPBUGS-79351: Make folder field optional for vsphere #16189
OCPBUGS-79040: Fix incorrect OLMv1 documentation URL #16186
OCPBUGS-81308: Fix VolumeSnapshot and VolumeSnapshotContent tables sorting #16216
OCPBUGS-79037: Fix useOperatorCatalogCategories hook. #16185
OCPBUGS-81330: Fix entire app suspending to load perspective switcher icon #16226
OCPBUGS-81488: Add robots.txt policy to console #16227
OCPBUGS-80931: Hide filter category selector when only one filter exists #16199
OCPBUGS-77246: AsyncComponent type improvements #16058
OCPBUGS-79035: Fix TypeError in OLS code import to console #16184
OCPBUGS-78799: Fix search component to not pass ALL_NAMESPACES_KEY to… #16170
OCPBUGS-79533: enable keyboard shortcut for DataViewTextFilter #16195
OCPBUGS-78927, OCPBUGS-78928: OLM prompts for GCP Workload Identity parameters during Kiali Operato… #16176
OCPBUGS-78308: “Import from Git” should not force HTTPS/443 for Git providers (GitHub/GitLab/Bitbucket) #16050
OCPBUGS-78599: Migrate InstallPlan components table to PatternFly Table #16159
OCPBUGS-78599: Reset pagination page when changing namespace #16158
OCPBUGS-77029: Fixed Metrics page React error #306 by exporting QueryBrowser component #16038
OCPBUGS-77251: Fix editing secrets with mixed text and binary data #16060
OCPBUGS-77561: Fix ConsolePluginStatus icon #16090
OCPBUGS-75000: Clean up old session cookies to prevent accumulation #15985
OCPBUGS-77957: [CI] Fix the VolumeSnapshot CRUD flaky test failures #16118
OCPBUGS-77882: Fix infinite recursion in project access form #16112
OCPBUGS-65948: prep for 4.21 GA SDK publish #16116
OCPBUGS-76385: Workloads - Edit pod count and Edit parallelism : Content is in English #16005
OCPBUGS-76387: DataView Pagination page menus : i18n misses #16007
OCPBUGS-76386: i18n upload/download routine task - 4.21 / 281 (Latest) #16006
OCPBUGS-77430: run and enforce yarn dedupe #16075
CONSOLE-5011: migrate to yarn berry #16059
OCPBUGS-76389: Use Actions button instead of kebab menu on Subscription details page #16008
Full changelog

console-operator

OCPBUGS-82037: Redeploy console pods upon cert rotation #1139
OCPBUGS-78929: Remove orphaned console-conversion-webhook deployment and related resource #1128
Sync Dockerfile.ocp image #1126
OCPBUGS-72562: Add missing relatedObjects + small refactoring #1090
OCPBUGS-74686: Add rhel8 and rhel9 oc binaries for Linux OS in CLI downloads #1104
Full changelog

docker-builder

OCPBUGS-70149: bump buildah to 1.39.7 to fix CVE-2025-52881 #495
Full changelog

driver-toolkit

OCPBUGS-78535: Support ubi minimal base image #186
OCPBUGS-77887: Clean up cruft in /var/cache/dnf #183
Full changelog

gcp-cloud-controller-manager

OCPBUGS-83615: Fix OSD ILB bug #108
Full changelog

gcp-pd-csi-driver

OCPBUGS-77716: Support Downward API node name #101
Full changelog

gcp-pd-csi-driver-operator

OCPBUGS-77494: Pass node name to csi-driver container #173
OCPBUGS-77310: Add RBAC permission for node driver to get Node objects #171
Full changelog

haproxy-router

OCPBUGS-79374: Lower verbosity for parseIPList empty list logging #752
Full changelog

hyperkube, kube-proxy, pod

NO-JIRA: UPSTREAM: <carry>: Add jacobsee and jubittajohn to DOWNSTREAM_OWNERS #2636
OCPBUGS-78991: Bump 1.34.6 to release-4.21 #2634
OCPBUGS-77475: Bump v1.34.5 to release-4.21 #2601
OCPBUGS-76516: Bump v1.34.4 #2590
Full changelog

hypershift

OCPBUGS-81745: [release-4.21] Honor AWS AMI override in NodePool token generation #8170
OCPBUGS-81836: OCPBUGS-81670: fix(cpo-v2): preserve HCCO modifications to OCM Controllers field #8157
OCPBUGS-81490: fix(cpo): skip router LB services for ARO HCP #8135
OCPBUGS-77966: fix: global-pull-secret-syncer pod ~15-minute delay scheduling on new nodes #8129
OCPBUGS-81287: fix(release): allow multiple machine-os component versions #8103
OCPBUGS-81285: fix(releaseinfo): allow periods in version display name regex #8102
OCPBUGS-78933: fix(cpo): Don’t remove HCP Ingress from routes when CapabilityRoute is disabled #8014
CNTRLPLANE-3006: Azure web identity webhook 4.21 #7997
OCPBUGS-78957: fix(hostedcluster): Remove referenced resource annotations regardless of hcp status #7975
OCPBUGS-78473: Fix deadlock when changing release image during initial provisioning #7954
OCPBUGS-78484: fix(catalogs): update catalog image version cap to 4.21 #7956
OCPBUGS-77456: Add dynamic NodePort range validation #7820
OCPBUGS-77647: remove resource limits from Agent CAPI provider #7844
OCPBUGS-78304: Fix context cancel accumulation in getMirrorFromICSPOrIDMS #7891
OCPBUGS-78196: fix(sync-global-pullsecret): compare content ignoring trailing newlines #7914
CNTRLPLANE-2812: feat(aro): Swift support #7826
OCPBUGS-77365: Fix ignition-server pod restarts due to MIRRORED_RELEASE_IMAGE flapping #7834
OCPBUGS-75930: [release-4.21] fix(cpo): Correct route labeling logic for HCP router infrastructure #7641
OCPBUGS-75884: feat(updates): enable CVO metrics access with RHOBS monitoring flag #7632
fix: OCPBUGS-74104: Fix CVE-2025-58183 #7545
OCPBUGS-71133: fix(ingress): clear LoadBalancerSourceRanges when AllowedCIDRBlocks is removed #7433
OCPBUGS-74893: fix: add hypershift.openshift.io/nodepool-globalps-enabled label to be ignored in cluster-autoscaler deployment #7618
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-77203: [release-4.21] standardize build paths #121
Full changelog

ibmcloud-machine-controllers

OCPBUGS-77445: [release-4.21] bump vpc go sdk #81
NO-JIRA: Modernize test infrastructure to align with other MAPI providers #84
Full changelog

insights-operator

OCPBUGS-81573: kubeletconfig gatherer #1266
OCPBUGS-79534: [release-4.21] Add OpenTelemetry CR Gatherer #1258
OCPBUGS-76960: Extends the time for the extractor liveness probe #1233
Full changelog

insights-runtime-exporter, insights-runtime-extractor

Updating ose-insights-runtime-extractor-container image to be consistent with ART for 4.21 #78
Updating ose-insights-runtime-exporter-container image to be consistent with ART for 4.21 #77
Updating ose-insights-runtime-exporter-container image to be consistent with ART for 4.21 #75
Updating ose-insights-runtime-exporter-container image to be consistent with ART for 4.21 #71
Updating ose-insights-runtime-extractor-container image to be consistent with ART for 4.21 #72
Revert “Bump Go to 1.25” #73
Bump Go to 1.25 #70
OCPBUGS-77491: remove dnf cache from the container images #64
Fix EAP 8.1 e2e test #65
Full changelog

ironic

ART-14497: Fix ART builds with -minimal #809
OCPBUGS-76934: Bump keystonemiddleware version to 10.9.0-0.20260216145500.557d173 for CVE-2026-22797 fix #791
OCPBUGS-76474: Update requirements.cachito for 4.21 with heartbeat inspection fix commit #785
OCPBUGS-76282: Update ironic hash #780
OCPBUGS-74603: fix for minimal builds #774
Full changelog

ironic-agent

OCPBUGS-74603: fixes for minimal builds #241
Full changelog

ironic-machine-os-downloader

OCPBUGS-74204: Export TMPDIR to be available to child processes #112
Full changelog

keepalived-ipfailover

OCPBUGS-78048: openshift-enterprise-base: remove subscription-manager, dbus, systemd #226
Full changelog

kubevirt-cloud-controller-manager

OCPBUGS-76994: [release-4.21] Sync Upstream 2026-01-27 #61
Full changelog

kubevirt-csi-driver

OCPBUGS-79038: Add annotation-based fallback for infra VM node ID resolution #83
Full changelog

machine-api-operator

OCPBUGS-77943: Remove cluster-api-provider-libvirt references #1473
Full changelog

machine-config-operator

OCPBUGS-83390: Use HA leader election defaults for MCO on SNO #5838
OCPBUGS-81711: When adding new nodes, MCD executes commands after setting the nodes’ state as Done #5836
OCPBUGS-79482: Skip boot image updates until cluster is stable #5804
OCPBUGS-79426: Update AMI Whitelist #5798
OCPBUGS-79372: set default-timeout-stop to 200s globally #5793
OCPBUGS-78800: Re-order logger setting to eliminate race condition #5779
OCPBUGS-78528: Fix e2e iri tests #5759
OCPBUGS-78201: kubelet: Less aggressive low memory reservation #5756
OCPBUGS-77833: Update AMI Whitelist #5743
OCPBUGS-77689: Create admin-ack gates for azure/vsphere clusters upgrading to 4.22 #5735
OCPBUGS-77577: Fix failure domain matching during vsphere boot image updates #5727
OCPBUGS-77534: Update AMI Whitelist #5722
OCPBUGS-77354: Clean up vsphere login error logging #5705
OCPBUGS-76555: Remove MCD liveness probe #5651
OCPBUGS-77072: mcd_config_drift not working properly #5675
OCPBUGS-76823: reduce MCO image size #5657
OCPBUGS-76833: Machine-config controller should not log about non-existent pull-secret changes #5659
OCPBUGS-73805: Prevent unnecessary systemd unit disable #5648
MCO-2017: Backport OSImageStreams to 4.21 #5515
OCPBUGS-76356: crio: disable short_name_mode until we introduce ctrcfg api for it #5636
OCPBUGS-76359: Update AMI script and list #5639
OCPBUGS-76271: machine-config-daemon: openshift: Exposure of Sensitive Data in Log Files in the Machine Configuration Daemon. [openshift-4] #5624
AGENT-1431: Backport InternalReleaseImage support #5610
OCPBUGS-74145: enable nodeip-configuration for platform external #5581
Full changelog

machine-image-customization-controller

OCPBUGS-78536: Return error when network data Secret lacks nmstate key #171
OCPBUGS-77031: Add IPA messages for console and SSH login #163
OCPBUGS-77490: Clean up dnf cache to reduce container image size #164
Full changelog

monitoring-plugin

OCPBUGS-83304: [release-4.21] openshift4/ose-monitoring-plugin-rhel9: Axios: Remote Code Execution via Prototype Pollution escalation #890
OCPBUGS-82302: [release-4.21] fix: re encode params when redirecting from graph to query-browser #871
OCPBUGS-78358: fix for CVE-2025-69873 #845
NO-JIRA: [release-4.21] e2e-monitoring fixing loop on legacy dashboard #828
OCPBUGS-77227: [openshift-4.21] CVE-2026-25639 openshift4/ose-monitoring-plugin-rhel9:Axios affected by Denial of Service via proto Key in mergeConfig #795
OU-1062: [release-4.21] feat: mark alert menu active for incidents tab #761
NO-JIRA: [release-4.21] simplify frontend build in Dockerfile.art #808
OCPBUGS-74909: fix: update vulnerable dependencies #751
Full changelog

multus-cni, multus-cni-microshift

OCPBUGS-82064: Bump CNI version to 1.1.0 #284
Full changelog

multus-networkpolicy

OCPBUGS-77489: Clean up dnf cache #100
Full changelog

networking-console-plugin

OCPBUGS-83388: Fix CVE-2026-34043 in serialize-javascript #369
OCPBUGS-82161: Migrate to npm #359
OCPBUGS-66283, OCPBUGS-67252, OCPBUGS-70285, OCPBUGS-74473: Fix CVEs via upgrading yarn.lock #346
CNV-59877: Fix permissions request for NADs #353
OCPBUGS-77887: Clean up cruft in /var/cache/dnf #361
OCPBUGS-77225: Fix NAD creation using default namespace instead of selected one #349
Full changelog

oauth-server

OCPBUGS-77454: groupmapper: avoid mutating original group users slice when removing user #213
Full changelog

oc-mirror

CLID-549, OCPBUGS-78458: Update Dockerfile.tests to run Go integration tests #1371
OCPBUGS-77222: Fix registriesd “unknown userid” failure for arbitrary UIDs #1358
OCPBUGS-76126: Fix reg config detection for explicit false values #1349
OCPBUGS-74981: fix conversion issue for catalog #1346
Full changelog

olm-catalogd, olm-operator-controller

OCPBUGS-79059: update OCP-75441 to support multi-arch[release-4.21] #671
Full changelog

openstack-machine-api-provider

OCPBUGS-76789: Fix make test #156
OCPBUGS-69644: Don’t record event for every reconcile #146
Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

OCPBUGS-79398: Fix SA restore resourceVersion conflict error #1266
OCPBUGS-79400: Fix nil pointer dereference in sortUnpackJobs when sorting non-failed jobs #1265
OCPBUGS-79380: enhance case to make it pass per test bundle change #1263
OCPBUGS-78558: Re-Apply Fix admin context race condition in parallel tests #1261
OCPBUGS-77712: Update NetworkPolicy egress to support HyperShift custom API ports #1246
OCPBUGS-77067: Remove the collect-profiles info from the microshift kustomization file #1234
OCPBUGS-76325: [release-4.21]remove qe case of testing collect-profiles #1222
OCPBUGS-76266: Remove the collect-profiles job #1220
Full changelog

operator-marketplace

OCPBUGS-77580: Update NetworkPolicy egress to support HyperShift custom API ports #729
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-83566: Branch Sync release-4.22 to release-4.21 [03-25-2026] #3087
OCPBUGS-81475: node: fix serviceUpdateNotNeeded nil pointer comparison #3098
OCPBUGS-77257, OCPBUGS-78094: Branch Sync release-4.22 to release-4.21 [03-23-2026] #3080
OCPBUGS-78771: Branch Sync release-4.22 to release-4.21 [03-11-2026] #3050
OCPBUGS-76472: OCPBUGS-72532: Branch Sync release-4.22 to release-4.21 [12-19-2025] #3022
OCPBUGS-77147: Minimize ACLs by combining ipBlocks into single ACL #2995
OCPBUGS-77309: Clear stale conntrack UDP entries for nodePorts #3002
OCPBUGS-77046, OCPBUGS-77086: [release-4.21] combined backport PR for 2 escalations #2984
Full changelog

powervs-block-csi-driver

OCPBUGS-80852: Fix CVE-2026-33186 by bumping google.golang.org/grpc to 1.79.3 #127
OCPBUGS-82924: Fix CVE-2026-35469 by bumping github.com/moby/spdystream to v0.5.1 #121
Full changelog

powervs-block-csi-driver-operator

Updating ose-powervs-block-csi-driver-operator-container image to be consistent with ART for 4.21 #107
OCPBUGS-80853: Fix CVE-2026-33186 by bumping google.golang.org/grpc to v1.79.3 #106
Full changelog

prometheus

OCPBUGS-78581: [release-4.21] chore(kubernetes): deduplicate warning logs from the API #298
Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

OCPBUGS-77295: backport upstream fix to reconcile resources with inconsistent status #365
OCPBUGS-74477: Validate webhookURL secret for MSTeams receiver in AlertmanagerConfig CRD #359
Full changelog

rhel-coreos, rhel-coreos-10, rhel-coreos-10-extensions, rhel-coreos-extensions

OCPBUGS-82523: post-process: Remove workaround for openvswitch additional group #1926
- [release-4.21] extensions: Add rhel-9.6-server-ose-4.21 #1914
NO-JIRA: [release-4.21] extensions: Fix repo name to match 4.21 #1913
COS-3946: Backport rhel-10.2 support to release-4.21 branch #1898
NO-JIRA: rhaos-pkgs-match-openshift: exclude known package mismatches #1889
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

route-controller-manager

OCPBUGS-76641: filter ingress namespace on UnmanagedRoutes metric #73
Full changelog

tests

OCPBUGS-81638: Manual cherry-pick node swap feature testcases to 4.21 #30973
OCPBUGS-82064: Assert CNI version greater than equal to 1.0.0 #30977
OCPBUGS-81638: Add openshift/disruptive-longrunning testsuite in release-4.21 branch #30976
OCPBUGS-78780: changed http to https for three places to reduce test false positives and false negatives #30902
OCPBUGS-79365: Verify etc pod should start with oom_score_adj as system-node-critical #30916
OCPBUGS-78485: run resource request/limit check early #30879
OCPBUGS-78192: Exclude disruption during NoExecuteTaintManager serial tests #30857
OCPBUGS-78064: Update optimized builds test to use rpm -qa instead of dnf #30856
OCPBUGS-78064: Allow test to tolerate running on minimal images #30852
OCPBUGS-77823: add the missing namespace from managed openshift #30838
OCPBUGS-77826: Remove exception for monitoring OLM Progression condition #30839
OCPBUGS-77097: Add test for CPMS OnDelete strategy with full master replacement #30802
: OCPBUGS-76856:cert tests: mark TLS registry test as informing #30779
OCPBUGS-76529: Fix flakiness in MutableCSINodeAllocatableCount test #30772
OCPBUGS-76955: co/kube-storage-version-migrator reports Available=False in a non-upgrade job #30740
Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

OCPBUGS-80878: Bump google.golang.org/grpc to 1.79.3 #171
Full changelog

vsphere-csi-driver-operator

OCPBUGS-74701: Fix update of stable-generation annotation #330
Full changelog

Node Image Info

Loading node image info, this may take a while ...

Unable to show node image info: too many concurrent oc adm release info --rpmdb/--rpmdb-diff operations (limit 16)

View changelog in Markdown or change previous release:

Source code for this page located on github