4.20.0-ec.3

PullSpec:

quay.io/openshift-release-dev/ocp-release:4.20.0-ec.3-multi

Team Approvals:

Tests:

Informing jobs
- e2e-aws-ovn-multi-x-ax Succeeded periodic-ci-openshift-multiarch-master-nightly-4.20-ocp-e2e-aws-ovn-multi-x-ax
- e2e-aws-ovn-multi-x-x Succeeded periodic-ci-openshift-multiarch-master-nightly-4.20-ocp-e2e-aws-ovn-multi-x-x

Upgrades from:

Untested upgrades: 4.19.0, 4.19.1, 4.20.0-ec.0, 4.20.0-ec.2

Loading changelog, this may take a while ...

Changes from 4.20.0-ec.2

Created: 2025-06-23 16:33:21 +0000 UTC

Image Digest: sha256:5ae5dcffe8cb4d5b386ffccf8135eb9f933dc5625bd004efc34df5acf664b869

Release 4.20.0-ec.3 was created from quay.io/openshift-release-dev/ocp-release-nightly@sha256:4507846d8d14f413a2443ae4f25881fbf492761c68086066613dd03327da5d06

Components

Kubectl 1.32.1
Kubernetes upgraded from 1.32.4 to 1.32.5
Kubernetes Tests upgraded from 1.32.4 to 1.32.5
Red Hat Enterprise Linux CoreOS upgraded from 9.6.20250523-0 to 9.6.20250611-0

The CoreOS links above are for the base CoreOS layer used to build the OpenShift node image and do not contain OpenShift components. This is normally only useful to devs working closely with the CoreOS team. For info about the node image, see the Node Image Info section.

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
MultiArchInstallAWS (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
NodeDisruptionPolicy (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
PlatformOperators (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
PrivateHostedZoneAWS (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
RouteAdvertisements (11 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled	Enabled
VSphereMultiNetworks (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled	Enabled
AWSServiceLBNetworkSecurityGroup (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
AzureDedicatedHosts (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
BootImageSkewEnforcement (0 tests)			Enabled (New)	Enabled (New)
ManagedBootImagesAzure (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
MutatingAdmissionPolicy (0 tests)
PreconfiguredUDNAddresses (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)

Rebuilt images without code change

aws-cloud-controller-manager git 425c1c5b sha256:9c2923bb44f945c4a494b489512b2d14ec1c6e907b49ba5d9c15703eb8141094
aws-cluster-api-controllers git de68d01b sha256:a50a19bc443fd2779300045d25652f1b4f6a0c02e49cf643bc9686729dd60616
aws-ebs-csi-driver git 479c1a80 sha256:55e0f82c119718c1c5ab5654f5098c45ba0755c436020f7ac6eafc110a20311f
aws-kms-encryption-provider git 088dcaf7 sha256:ab9cdda90a3f800055359fa9dcd63aa320811dc0c7b9b5e14893b53b27e448fb
aws-pod-identity-webhook git b0a16d53 sha256:4251c1440bd566ac42364adc94e1f44a8650b0a4f6a1000a7e441146e8f6e913
azure-cloud-controller-manager git 7109d6b4 sha256:b53382f5f97f816dffeb29a7c2d1f7ca12ef39dbd84e2394498fea843e3f2a2c
azure-cloud-node-manager git 7109d6b4 sha256:0c7a257b9e4ca35f7d79fb12e95519d043f4dbb9e821c6592c1f506c3c0f2002
azure-disk-csi-driver git 41226812 sha256:0463407dabc2492e0aa1d3fe729bbfd37fb0df2413fd2e94de564e23b3f7627a
azure-file-csi-driver git 0c0bab7a sha256:a69f3b985ec935d89fb779f0e04271a9520479d5b70b225ab5d2d740209b38fb
azure-service-operator git 0ae129b4 sha256:16638f210f089074ea98703567e67eda1506e88b6d005811bdf0bad906cbbbf0
azure-workload-identity-webhook git 892d3c4d sha256:b2447afe92e8c9c5d009cb36760f7d6d4669ca7b4d953c884b30b8d5a62bf78f
baremetal-cluster-api-controllers git 6cda30c7 sha256:2f2c5c6901a135d3854baf041dfbbd9c7b09de80c60a6f6f2cdbea3f8021bfc4
baremetal-machine-controllers git f7a78954 sha256:103eb5f52fcf1d30cde1c62409da614f31fe3762d3a146cd9ebc24b0475af828
baremetal-runtimecfg git 1331e6d7 sha256:fce63c2836c745e459ab4d8d7d2331dd75e48bf4987b5b5ec175c025ee6ba88c
cloud-network-config-controller git 98ae311b sha256:68228c48885f0d76a952e84bfb347d2f468daed4163432d00fd465734d12d6f3
cluster-autoscaler git f746d442 sha256:38474061ab4acc3065595a9f1bc02c30d816de3a2bea298e1b347e623d0af374
cluster-bootstrap git 8fde9c52 sha256:31956f2291731f0b87cdaae1c51f27c9cefb59c590f779dfde25b454a4481aa1
cluster-control-plane-machine-set-operator git 1dbf0c7a sha256:340e77b0f102c078afd04a956d15b76c0ec904012e30697ad555171ff657c20f
cluster-csi-snapshot-controller-operator git cf99de97 sha256:91235f287a732818b99567fb57ee38e132f2af4979c31826b603c3f216ba9c06
cluster-dns-operator git 65981306 sha256:f38588330d14b4de6121c04c638f23d5a2e4e878ee28b8fbabe0981cfce3c5a3
cluster-kube-cluster-api-operator git 3ec30377 sha256:e1f6ff8d2cee1dc54f80cc0165df39645df9a879b04e5f8682904716e6a52936
cluster-kube-controller-manager-operator git 07401428 sha256:64f3676ead54f9c40ae5184f30bbe5b524422274c9b00a11b7f68d21e22df54b
cluster-kube-scheduler-operator git 0d060e4b sha256:8f19cecdc1577fe1b83a6e3cd500b92b6db705a8447602b7db58ec81ceb1a8b4
cluster-kube-storage-version-migrator-operator git 4e514049 sha256:a4ad093f4dea8f4ec9db07ef20279d6c6d2038ab055d304413561221280c0e6a
cluster-machine-approver git a437e95c sha256:f97f534905960cd151238ef330a11ca0bff9075207ac3b1b3289c070d4f6d316
cluster-policy-controller git 74852478 sha256:49df8691cdcfa3899d5fa0842467c248e5bd3fbc54001a0e2268dbb1e786a9cc
cluster-update-keys git c1c56b4c sha256:1303c9f863c11dd383798492eabb5917ee4f2b2fd569c919cec04ba5c7549257
container-networking-plugins git b09f487c sha256:a852c188921ac1fb7d29f9db8179b9407a6a10668e029b198bf6ba4b18172c92
containernetworking-plugins-microshift git b09f487c sha256:6cf230945511893937e72dcd660c066a750275e65f02b7953f9a1da890322c7a
csi-external-attacher git a8175e39 sha256:b69386c92d42c57af2a0f6ddac71db042798a7a2ea1aa0efe278a70464d1a59e
csi-external-provisioner git 9db1cdb1 sha256:5ae3abf91e3d0645bb34b1b6d0af235d0bc08587a49230fbfae1e8d50042bee6
csi-external-resizer git cca04e39 sha256:64f2310a451a994d31e1abdf7ce6b6eae6600fb2934f0a99fea9c72acbe1e975
csi-external-snapshotter git ac82cafc sha256:04271eb6f1bff81557b9fe9bf0ab4d4531b98b9755c07d6f39f1d2446ca146fa
csi-livenessprobe git ca514478 sha256:59cdbeef8f88d47b8adb74de88dcaf57f3cd61062454038568a4d3ce9506462a
csi-node-driver-registrar git d18edb3a sha256:a4c5ced8ae0cbac74d458f917b98cfb72874a8c5a26c2bc61054eb6ac16cf4b4
csi-snapshot-controller git ac82cafc sha256:561ea00ef93e1f5a797c2b3343bcbc74b44d002f6ea2eed3b1e283c25c47a8f8
driver-toolkit git 686fdac5 sha256:f318370b9929b4c83d1b791d1b4c3e3f4d2e018771b4a7d8caa671e773ccd72c
egress-router-cni git 85353bb9 sha256:13d3ed917d699961e9330322c54d7ad15a574efffc2638c10c48c5cf54996d7a
etcd git a5421dfe sha256:4c919b6e93d12efa32cc820bbad629ebb2b1ccfba66670d0b065bcd2978fb0a4
gcp-cloud-controller-manager git d8d3aeba sha256:17ba4a8d14214e58eac62723294c73b17659df30356980c37c5916a5b1e147af
gcp-cluster-api-controllers git c1ebdb12 sha256:09cee2a5f3b2ec435853e870f97e2b17b4667286eaeff393aab787ce6f9c831a
gcp-machine-controllers git 55edb1bc sha256:a91af583e6e70160c07a396e38b66a85553a8272cdc8bd9113a386aaa4709a28
gcp-pd-csi-driver git 3aeac35b sha256:c140b4868aa86c534ced09a6196332da2d3a2974d86ae71cbed611edafeed415
gcp-pd-csi-driver-operator git 44c74f24 sha256:5fca8ecc7860d2974b91074917f9ff89b595c8b396b5f95a4e9ab1b28cdbb8a1
gcp-workload-identity-federation-webhook git fbf4c1b2 sha256:74cdbe21b75eba311d80fe5aa55e6fa87b636724393c0eaf0183921ae2af4d66
haproxy-router git b41f9d05 sha256:04e30afb5e724b6421a136c1d53600b357b7a2c52dc9d42262aa7289402ed43f
ibm-cloud-controller-manager git 7422aab2 sha256:8f879c7100a30c6300077121285931b9cd58fa24167207759164913e80939c98
ibm-vpc-block-csi-driver git 176b6ef1 sha256:b58659624eb6dd30aa9993f67f398c8e7303a9d8b83eb9cedd4b29c7864191ae
ibm-vpc-block-csi-driver-operator git 3dfcfa12 sha256:c982f517837dc57f289662ced4cfee121d52c2772bc223684fd44e4ce702d27b
ibmcloud-cluster-api-controllers git ca6e538e sha256:26c4a267c4a66f46472dd588f3638820caf9ba4f10df1c8cd91e0585525e1018
ibmcloud-machine-controllers git 989bd874 sha256:18df61eeb017180ac07be265d9ee0b9be1f4d813756d2b59f3259884c086a101
ironic-agent git 973c5d5b sha256:628cb22dfb2184b06761d47ff1cc01200fd12208a7a3d503ddedf75bc70a39e3
ironic-static-ip-manager git fcd9564e sha256:f67df0b7a8ed6c4547b656f256058d71c3ec294cac27c7a2ce61d226b0d9844a
keepalived-ipfailover git 3321f1a1 sha256:1b7f8b17079993d15340adf007e96dd7f95464f7d80faecabc58198de4a73011
kube-metrics-server git 037a0e7e sha256:698d4c8bec132fe744f649c54f3a473360a69b4df9b980d2b5aed75af7172e5e
kube-state-metrics git c3da3b5f sha256:804258f57f6125b76596e5af609126845d5845f16a4f56aba3fee0bbe3eddf62
kubevirt-cloud-controller-manager git 3f4542ec sha256:23b08c5abc4893b9b094eabe84de265cfeb7d541a7600a1d98851a88a1715e4e
libvirt-machine-controllers git a336f0b5 sha256:9c29926e59e7a9e4a9dccb6569b917da40c482209a0bf4289e0421494ac20d7b
machine-os-images git 90d083d2 sha256:927bfa0fce3049e1259434169cedc10ecb807eed38c67dc75b7ce5cdd63b99a0
metallb-frr git 5076dbc4 sha256:a67f384f9c3dd1f93aa3893e886ba6f6c8a0bef54af528876bb5628b5ee70899
multus-cni git cf0f68ec sha256:aa8e08a1f6ae9bb6ee240a21dee41d02c72029b6e8616a918be48c90e786ba13
multus-cni-microshift git cf0f68ec sha256:5a6f1ff0605ee802f106e333c2cf71828a1b739ce5443f161a5bdbb7ffaa3faa
multus-networkpolicy git 6fffe5d7 sha256:bab17b714c8fec020b82beac267751034f1525c2e511a471428e8b5c96d641f0
multus-route-override-cni git 391c1b03 sha256:e1accdc7ddfe3bfcf8a119ec84e80009f07ee4b6859a1d49b378d7cf29577342
multus-whereabouts-ipam-cni git 45624b63 sha256:81d7622eb240a4596e93593b0bca8b25b3c32f2e97b6c724b688a9bfe534e8b8
must-gather git 97a538c8 sha256:fe1848d88897b7f90b61b90e3981b17c7e431874331e889c274e9eddcb3ae7fd
network-metrics-daemon git 5ec8c6bd sha256:7cd5cdc11aa18d4a049c504dac4975e20bc5dd511a9827d5f6f0f88792cbfe3f
nutanix-cloud-controller-manager git db1f264a sha256:2cacf3c29e6ef1fc8d1e09c442ac340dca21ea84fb3783229e2a34fca7b95e47
nutanix-machine-controllers git a26db5a0 sha256:779293d623e4b9b78e3ba0b6ba0a88a366b5512a8c3d602ba3a85d490a58ebb4
oauth-apiserver git 75914068 sha256:fb420caf3f108854c932a7a63e05a84cebd4b661b25fe2898ae2727bda372c59
oauth-proxy git 3d12ccbe sha256:611507426fa0bf79ef7c720ed0b832bd22db3b6c7031736f8757d01b7271d394
openstack-cluster-api-controllers git dddf3f30 sha256:75cf53e3d8670bb4912a3fa2a0b8b755430f06dffb055474f2e440c067eac6fb
operator-marketplace git 25b4d771 sha256:3c5dbea9cfd4a655b85a0afa1890dee90edf461e9e8d699fee4eefdc18a739aa
ovirt-csi-driver git 1db726a9 sha256:c24d722af10d7b8a350af3088d3ec150f2dd35da83e31eb98e9d94330bc57628
ovirt-csi-driver-operator git 76db379d sha256:eab8f0cb9e3b92899237ce5bd2e35e7179e8f9626c340c39f75725db71a8e4de
powervs-block-csi-driver git f681413d sha256:db6f3ceafe858c3da6bd9a36f59e4ba9fd3504fd7420725eaf19d4e6f2d5b7a5
powervs-block-csi-driver-operator git 059d95c2 sha256:74c59b2cca0e813189d1ddc3b52703959cbb05f82a2b8e0dc5ae7a3a13a65a53
powervs-cloud-controller-manager git ef83f3f5 sha256:11b9c9308f595694b8e0c199a95280a05b87f22584c1df220d0d042d1825bc3f
prom-label-proxy git f5ee40f8 sha256:0aa6a8cd40b682909afaf1b1747db54738c2fd2537f13402b733dced70a90620
prometheus-alertmanager git a2346ca5 sha256:15e3128b9b70dfda41053052a5b391af7066ddba9ca9fad95458c0f79adb3c96
prometheus-config-reloader git b8debb4c sha256:7903e64145174ac23a7d4f34a57ae02de1e6a3dabd281e8f75d78377b068fdc3
prometheus-node-exporter git c90542d8 sha256:028a463277b670c0a916544bb98d08b82bb887730d442a18a91974310dff8cad
prometheus-operator git b8debb4c sha256:598f03995cf7810e6ec5ebdcba40f7a71db6db0b95bbf335574b9df9506071ec
prometheus-operator-admission-webhook git b8debb4c sha256:d4fd0b35bf443fd5378efbf080b91b04f3a55c507bef93ee42ec6497f1da1372
rhel-coreos git 7fa9e2aa sha256:1b17f179b312657ed51b8c7127ef171366ddade40776a616423509555bbfd93e
rhel-coreos-extensions git 7fa9e2aa sha256:be3f67a87e3b188e77ca26b1d6133a92ce046aff9b5c530317cf78efe8943a88
route-controller-manager git bc97534a sha256:c3efdb17a532768b6145416b0b42636168184492d53a5d5d93908749f7b9e69f
service-ca-operator git 4dfa6916 sha256:7fb2ee388b121012705ad3cf9b95879f6bf5f81122f95d5f7a2d9204aae5b317
thanos git 95f7bb21 sha256:f5206201c1ad27d884d22de0575bf054861169379c45cdd7dd96c9771667e4f9
vsphere-cluster-api-controllers git 64ebe003 sha256:448a7bcb02cea1539187c47a00aec911d805091e9da738960a92a276d4286eb2
vsphere-csi-driver git 01302477 sha256:d60a54f0a1b945b308525fe7e489abea100354dc78110165b1171df640227b91
vsphere-csi-driver-operator git c2b41c36 sha256:7d457c5370e31683a7d08c401332a17bf2c5900922bae85a45da3a3ee111fcd5
vsphere-csi-driver-syncer git 01302477 sha256:cb5498747a728c1d9cbad48bbbe8a659be395756f2944595c8611d135579f054
vsphere-problem-detector git 46923455 sha256:29e70da80703571b07b8ffc4e2e168d1346ddbb3283d2704c3d21ec6c7d3ba17

agent-installer-api-server

MGMT-20464: Fix NFD detection of NVIDIA GPUs #7696
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

NO-ISSUE: Update Konflux references (#1139) #1139
ACM-21380: Make ACM builds multi-arch (#1136) #1136
NO-ISSUE: Update Konflux references (#1131) #1131
NO-ISSUE: Update Konflux references (#1130) #1130
NO-ISSUE: Add konflux service account migration (#1129) #1129
NO-ISSUE: Modify Konflux YAMLs to ocm-2.15 (#1126) #1126
MGMT-11622: assisted-installer controller: operator status should be logged (#1079) #1079
Use rsync over cp to set up networking files for first boot (#1123) #1123
Full changelog

agent-installer-node-agent

Revert “NO ISSUE: Test (#1015)” (#1016) #1015
NO-ISSUE: Update Konflux references (#1013) #1013
ACM-21380: Make ACM builds multi-arch (#1017) #1017
NO ISSUE: Test (#1015) #1015
NO-ISSUE: Modify Konflux YAMLs to ocm-2.15 (#1009) #1009
NO-ISSUE: Update Konflux references (#1003) #1003
Full changelog

agent-installer-utils

OCPBUGS-57346: Bump iso-builder appliance dependency #114
NO-ISSUE: Enable ‘q’ and ‘c’ hotkeys for quit and configure network #107
OCPBUGS-57297: Update mtv-operator to version used in 4.19 catalog #111
ART-13079: append .0 to go.mod version #105
OCPBUGS-56934: Disable ESC key on checks page #102
OCPBUGS-56977: OVE isobuilder fails on CentOS Stream 9 due to missing… #103
OCPBUGS-56880: Log error from nmtui and change modal background #101
OCPBUGS-56546: ISOBuilder- Remove default password for nodes #96
AGENT-1195: bump appliance to 936210 #98
Full changelog

apiserver-network-proxy

ART-13079: append .0 to go.mod version #78
Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator

STOR-2330: Add labels to subscribe AWS-EBS CSI driver controller to NPs #387
NO-JIRA: create-efs-volume: print files to log as a fallback #388
NO-JIRA: Update openstack approvers #385
Full changelog

aws-karpenter-provider-aws

AUTOSCALE-259: migrate upstream karpenter-core dependency to downstream #12
Full changelog

aws-machine-controllers

OCPCLOUD-2717: bump openshift/api #131
Full changelog

azure-cluster-api-controllers

NO-JIRA: Merge https://github.com/kubernetes-sigs/cluster-api-provider-azure:v1.19.4 (99a359a) into master #338
Full changelog

azure-kms-encryption-provider

ART-13079: append .0 to go.mod version #17
Full changelog

azure-machine-controllers

OCPBUGS-55372: Fix regression on ASH with armcompute/v5 #155
OCPBUGS-56380: Fix failure when attempting to modify immutable availabilitySet #148
Full changelog

baremetal-installer, installer, installer-artifacts

OCPBUGS-57021: Use less permissive access for /var/lib/etcd for SNO #9769
CFE-1119: Removes instances of deprecated experimentalPropagateUserTags #8917
OCPBUGS-56658: Prompt User for AWS Creds when none are found #9751
CORS-3998: Remove base domain from metadata #9711
OCPBUGS-56616: pkg/types/validation: Validate all SSH public keys #9770
OCPBUGS-51299: Set default project and location for KMS key manifest #9767
AGENT-997: Internal dev docs for authentication-authorization #9224
OCPBUGS-57000: Revert “CORS-3883: Remove user-assigned identity from ARM template” #9766
SPLAT-2045: [vsphere] promote multi-nic to default #9493
no-jira: Bump CAPZ Version #9704
NO-JIRA: openstack docs: Fix type of clusterOSImageProperties #9754
OCPBUGS-54885: Validate agent diskEncryption fields #9674
OCPBUGS-54413: Make swift containers removal not fatal for UPI. #9728
OCPBUGS-56808: Remove configv1.GCPServiceEndpointNameTagManager references #9749
no-jira: add unit tests for vsphere VIPS/machinenetworks population #9744
OCPBUGS-56713: update the punctuation #9746
OCPBUGS-54487: Power VS: Provide detailed error when entered VPCName cannot be found #9634
CORS-4066: Remove the function to check if multiarch is enabled/allowed #9750
OCPBUGS-6508: Update Control Plane replica validation for Single Node OpenShift #9048
CORS-3682: log falsy conditions when CAPI infra/machine provisioning failed #9722
MGMT-20702, OCPBUGS-56601: Avoid duplicate machine networks #9743
OCPBUGS-55671: AWS Mutliarch feature gate is enabled by default #9729
OCPBUGS-55672: Remove MultiArchInstallGCP featuregate #9725
OCPBUGS-56645: Update RHCOS 4.20 bootimage metadata to 9.6.20250523-0 #9741
Full changelog

baremetal-operator

OCPBUGS-54629, OCPBUGS-54965: merge upstream #418
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-56691: Rely on overall available disk space of the mounted volume #2028
WRKLDS-1713: Remove schema1 #2037
WRKLDS-1716: oc image serve: Remove as deprecated #2033
OTA-1539: pkg/cli/admin/upgrade/recommend: Add a –quiet option #2023
OTA-1532: pkg/cli/admin/upgrade/recommend: New, feature-gated –accept #2017
OCPBUGS-49897: avoid transfering permissions when copying artifacts from node-joiner pod #2031
Full changelog

cloud-credential-operator

OCPBUGS-57296: Remove duplicate cluster role rules #864
OCPBUGS-57349: Use constant for first parameter of fmt.Errorf #874
CCO-645: Add new clock parameter when using library-go:NewKubeRecorder #872
OCPBUGS-55777: Add missing Role, RoleBinding #860
OCPBUGS-56607: Azure: resolve nil pointer exception when role assignment exists #861
Full changelog

cluster-authentication-operator

NO-JIRA: add logging when rendering bootstrap manifests #770
CNTRLPLANE-939: test/e2e-oidc: poll test preconditions for a short time instead of checking once #769
CNTRLPLANE-939: Create separate make rule for e2e oidc tests #768
AUTH-544: Extend e2e test to leverage new functionality #737
Full changelog

cluster-autoscaler-operator

OCPBUGS-42875: mitigate operator Degraded status flapping #344
OCPBUGS-57041: update cluster provider type early #343
NO-JIRA: Add autoscale members to OWNERS file #345
Full changelog

cluster-baremetal-operator

NO-ISSUE: Remove inactive OWNERS #480
OCPBUGS-54244: no default for provisioningIP when provisioningInterface is set #476
OCPBUGS-54965: Inform BMO when provisioning network is disabled #473
NO-ISSUE: Makefile: don’t run all linters when running unit tests #475
NO-ISSUE: Silence a bogus error with newer golangci-lint #477
Full changelog

cluster-capi-controllers

NO-JIRA: Merge https://github.com/kubernetes-sigs/cluster-api:v1.10.2 (5255664) into master #240
Full changelog

cluster-capi-operator

OCPBUGS-54705: mapi2capi: Create new machine template when changing MAPI providerSpec #295
OCPBUGS-57013: Fix reset sync status in migration controllers #313
NO-JIRA: Assorted cleanups #312
OCPBUGS-57040: Fix failure to retry unpause #309
OCPBUGS-56604: fix: ensure CAPI machineset is created not paused when authoritative #299
OCPBUGS-56709: fix: bump openshift/library-go to fix ValidatingAdmissionPolicyV1 apply in capiinstaller #301
OCPBUGS-56487: fix: watch CAPI resources in the migration controllers #300
Full changelog

cluster-cloud-controller-manager-operator

OCPBUGS-56508: Fix config-sync-controller logging #389
Full changelog

cluster-config-api

OCPBUGS-55663: Remove NodeDisruptionPolicy featuregate #2359
Register MutatingAdmissionPolicy in feature gates #2349
WRKLDS-1676: OCM config: Remove obsolete fields #2364
OCPBUGS-55652: Remove PrivateHostedZoneAWS feature gate #2338
CNTRLPLANE-337: authentication: oidc: make username claim mapping required #2352
NO-ISSUE: Remove redundant image stream #2358
Promote RouteAdvertisements feature gate to default feature set #2225
MCO-1671: Add feature gates for azure boot image updates & skew management #2353
SPLAT-2137: FG for Service Type LB NLB with Security Group #2354
OCPBUGS-56725: Add max length validation for apiserver namedCertificates #2342
Remove DataGather state print column #2350
OCPBUGS-44462: Remove PlatformOperators from feature list #2333
CORENET-6004: Add PreconfiguredUDNAddresses featuregate #2348
OCPCLOUD-2717: Deprecate DeleteOnTermination for EBS volumes #2341
SPLAT-2175: introduce AzureDedicatedHosts feature gate #2293
OCPBUGS-52556: Revert v1alpha1 removal #2343
SPLAT-2044: [vsphere] promote multi-nic to default #2204
OCPBUGS-55671: Remove MultiArchInstallAWS featuregate #2336
Full changelog

cluster-config-operator

OCPBUGS-57187: featuregates: always complete featuregates when feature set is CustomNoUpgrade #440
Full changelog

cluster-etcd-operator

NO-JIRA: remove grafana-dashboard-etcd #1429
OCPBUGS-56199: increase tnf job timeouts #1426
Full changelog

cluster-image-registry-operator

OCPBUGS-56606: bump github.com/golang-jwt/jwt #1212
Full changelog

cluster-ingress-operator

OCPBUGS-55652: Removed PrivateHostedZoneAWS from component #1230
OCPBUGS-54745: status: Conditionally add CRDs to relatedObjects #1217
Full changelog

cluster-kube-apiserver-operator

NO-JIRA: Use new PSS annotation #1833
Full changelog

cluster-monitoring-operator

OCPBUGS-57184: chore(alerts): adjust PrometheusPossibleNarrowSelectors description and add link to to-be-added runbook #2608
NO-JIRA: [bot] Synchronize versions of the downstream components #2607
NO-JIRA: [bot] Synchronize versions of the downstream components #2606
OCPBUGS-18282: provide more context in externalLabels unmarshalling error #2605
Full changelog

cluster-network-operator

OCPBUGS-56086: Validate NAD name and spec only in multus admission controller #2718
CORENET-5704: Consume latest vendoring from ocp api repo #2720
OCPBUGS-56878: whereabouts-config is a reserved name for user interaction. #2707
CNTRLPLANE-341: Issue shorter certificates when ShortRotation featuregate is enabled #2556
Full changelog

cluster-node-tuning-operator

Change /master to /control-plane node label (#1327) #1327
NO-JIRA: E2E: Additional Functional tests for align cpus by UncoreCache Feature (#1324) #1324
Update performance_profile.md (#1329) #1329
fix: stop referencing non existing git references in go.mod (#1332) #1332
e2e: arm: fix ginkgo doesn’t recognize kernelPageSize suite (#1330) #1330
Full changelog

cluster-olm-operator

OCPSTRAT-1976: Add readonlyRootFilesystem #120
OCPBUGS-56903: fix: report correct next version when incompatible operators are installed #123
OCPBUGS-56813: fix olm.maxOpenShiftVersion float parsing #121
Full changelog

cluster-openshift-apiserver-operator

NO-JIRA: operator: annotate image-import-ca configmap with owner #616
Full changelog

cluster-openshift-controller-manager-operator

WRKLDS-844: sync: Use more descriptive variable name #390
WRKLDS-844: pkg/operator: Split OCM/RCM status conditions #387
Full changelog

cluster-samples-operator

NO-JIRA: cleanup hello-openshift yaml #642
Full changelog

cluster-storage-operator

STOR-2330: Add labels to subscribe AWS-EBS CSI driver operator to NPs #584
STOR-2330: Network Policies for CSI drivers and operators #579
OSASINFRA-3675: Add credentialRequest for manila namespace #573
OCPBUGS-56201: improve message template for PodStartupStorageOperationsFailing alert #583
NO-JIRA: Update openstack approvers #581
Full changelog

cluster-version-operator

OTA-1531: [⁶⁄₆] cvo: use early gate checker to avoid delayed initialization #1196
NO-JIRA: test: remove unnecessary integration tests layers #1202
NO-JIRA: tests: fix make integration-test target #1203
NO-JIRA: Add myself as an approver #1201
OCPBUGS-56114: Fix ImplicitlyEnabledCapabilities #1191
Full changelog

configmap-reloader

ART-13079: append .0 to go.mod version #67
Full changelog

console

OCPBUGS-55828: Edit paralelism modal has unresponsive decrease button in the number spinner #15126
OCPBUGS-49709: Fix webpack build warnings for dynamic-core-api exports #15149
OCPBUGS-56629: use EmptyState for quick starts empty state #15081
OCPBUGS-56050: Cannot read properties of undefined (reading ‘filter’) error while accessing nodes from console. #15170
OCPBUGS-57174: Percent sign on creating HPA page doesn’t align in the center of outer box. #15162
OCPBUGS-56174: ConfigMap form stuck after making input errors. #15166
OCPBUGS-56845: OpenShift console PVC clone cannot use B as the unit #15163
OCPBUGS-57205: i18n upload/download routine task - Sprint 270 #15158
OCPBUGS-56186: Add Select project field in import forms #15150
OCPBUGS-57074: Incorrect property name requests in ContainerSpec.resources type #15148
OCPBUGS-57087: Update Dockerfile.dev to use latest build images #15129
OCPBUGS-43792: Follow-on fix. Add new “plugins-order” flag to bridge cli args #14981
OCPBUGS-56985: Getting “Oh no something went wrong” error message in web console. #15147
CONSOLE-4550: Remove usage of Bootstrap grid in Console #15119
OCPBUGS-56999: Cannot read properties of undefined (reading ‘node-role.kubernetes.io/master’) error while accessing node logs from console #15122
OCPBUGS-57147: Disable tests A-02-TC02 and A-02-TC05 #15146
OCPBUGS-56804: clarify verbiage for Lightspeed hide button #15144
OCPBUGS-56050: Cannot read properties of undefined (reading ‘filter’) error while accessing nodes from console #15121
OCPBUGS-56044: fix VirtualizedTable runtime error if sortColumn is no… #15112
OCPBUGS-56986: Fix runtime error when navigating alert actions #15118
OCPBUGS-49709: Add useOverlay hook to dynamic plugin SDK and deprecate useModal hook #14707
OCPBUGS-56179: Add isAllNamespacesKey function to dynamic plugin API #15066
OCPBUGS-56707: fix bug where Roles list was displaying invalid data f… #15115
OCPBUGS-56917, OCPBUGS-56922: Remove ExternalLink and Timestamp reexport #15110
OCPBUGS-56889: Add flags in console static plugin for all the components of this epic #15101
OCPBUGS-56700: UI for search by label is distorted in topology #15090
OCPBUGS-55431: Add initialization link annotation support to csv anno… #15020
OCPBUGS-54185: Helm resource list error in console #15084
OCPBUGS-56439: Remove duplicate sinkUri code #15085
OCPBUGS-56137: Added developer getting started card in Admin project overview page #15079
OCPBUGS-52842: Fix TypeError Cannot read properties of null (reading ‘metadata’) #15092
OCPBUGS-56628: Fix regression with drawers and modals #15080
OCPBUGS-56087: Opening Edit Secret modal and saving without changes throws error #15058
ODC-7722: Remove service binding plugin #15035
OCPBUGS-55456: Fix and enable web terminal tests #15082
OCPBUGS-54726: Layout of Welcome to the new OpenShift experience! buttons is wonky on mobile #14951
OCPBUGS-56353: Initialize log package #15069
ODC-7797: Expose PodRingSet via Dynamic Plugin SDK #15068
Full changelog

console-operator

ODC-7790: Remove ODO download link #987
OCPBUGS-52556: Revert v1alpha1 removal #990
Full changelog

coredns

ART-13079: append .0 to go.mod version #132
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

NO-JIRA: OWNERS: Update team osasinfra #326
Full changelog

csi-driver-nfs

NO-JIRA: OWNERS: Update team osasinfra #155
Full changelog

docker-builder

OCPBUGS-56106: S2I build cpu limits observed by assemble are limited to 1 cpu #470
Full changelog

docker-registry

OCPBUGS-56483: bump jwt and oauth dependencies #427
Full changelog

hyperkube, kube-proxy, pod

TRT-2097: UPSTREAM: <carry>: Fix up kube test suite definitions for OTE #2330
Revert “TRT-2068: Reintroduce removal of non-suite annotation rules, and fix topology selector” #2329
TRT-2068: Reintroduce removal of non-suite annotation rules, and fix topology selector #2322
OCPNODE-3010: openshift-hack: enable userns e2e tests #2239
TRT-2141: Revert #2299 “TRT-1854: remove annotation rules that don’t relate to suites” #2318
TRT-1854: remove annotation rules that don’t relate to suites #2299
OCPBUGS-56436: Bump 4.20 1.32.5 #2308
Full changelog

hypershift

MGMT-20801: Enable disabling of Insights capability #6246
CNTRLPLANE-983: Enable codespell in verify and fix all spelling mistakes #6262
NO-JIRA: Add misspell to golangci-lint #6253
CNV-61396: set kubevirt cis rbac valid only for kubevirt platform #6254
CNTRLPLANE-942: update KAS bootstrapping to get RBR from CAO #6137
AUTOSCALE-119: Add pod monitors to karpenter components #6206
OCPBUGS-45265: Don’t use /version for haproxy health checks #6202
CNTRLPLANE-374: hcco: handle post-install creation of OIDC client secrets #6227
OCPBUGS-56861: Remove CapacityReservation validation that requires aws access #6248
CNTRLPLANE-977: Update Konflux references #6217
OCPBUGS-55892: make image registry managed identity optional #6127
CNV-61396: Sync RBAC for expansion support in kubevirt CSI driver #6226
OCPBUGS-57125: Support deserializing monitoring manifests when RHOBS enabled #6238
OCPBUGS-56966: Fix ignition server route getting constantly recreated #6225
OCPBUGS-57125: Support RHOBS when loading cpov2 monitoring manifests by replacing the API group #6228
OCPBUGS-53259: Reuse hosted cluster release and metadata providers #6095
OCPBUGS-54720: HCP payload doesn’t respect multiple mirrors #6222
ARO-15626: Disallow users from setting .spec.managementState to Removed in the image registry operator config on Azure #6013
NO-JIRA: cpo/oidc: remove validation functions that use default CEL compiler #6221
NO-JIRA: Create test fixtures for all resources in TestControlPlaneComponents #6216
OCPBUGS-42938: Support proxy authentication when user/pass is included in URL #6207
OCPBUGS-30260: Allow setting target node selector for control plane router #3946
OCPBUGS-56930: test/e2e: fix version gate checks on minor upgrade #6219
NO-JIRA: Follow up PR from #6192 #6204
MGMT-20682: Enable disabling of openshift-samples capability #6197
OCPBUGS-56430: Add DR operations after HC restoration #6195
CNTRLPLANE-936: fix(tekton): drop multiarch builds on PR #6223
CNTRLPLANE-844: Delete legacy unused DeploymentConfig code #6210
CNTRLPLANE-206: Add NetworkPolicy to shared-ingress #6173
WRKLDS-1676: ocm: Make config compatible with library-go #6203
NO-JIRA: Fix documentation field name for KubeAPIServerDNSName #6220
OCPBUGS-56814: PodSecurityConfiguration Kas config render from gate #6213
OCPBUGS-56777: Move EnsurePSANotPrivileged to AtLeast(t, Version420) #6211
AUTOSCALE-266: Refactor karpenter-operator and karpenter into v2 components #6187
CNTRLPLANE-201: feat(shared-ingress): Bump ubi10 out of beta #6200
OCPBUGS-56492: Fix CatalogSource image check when unauthorized #6192
CNTRLPLANE-931: update konflux references #6188
NO-JIRA: Add unit test for reconciling components with a WithManifestAdapter for SA #6191
Full changelog

insights-operator

NO-JIRA: update github.com/openshift/api and openshift/client-go to latest version (#1092) #1092
feat: add Progressing condition (#1090) #1090
OCPBUGS-55805 Enhance insights-runtime-extractor errors (#1085) #1085
OCPBUGS-55804 Report an error when the insights-runtime-extractor is not running (#1086) #1086
Full changelog

insights-runtime-exporter, insights-runtime-extractor

test: Fix JBoss EAP 8.0 version #45
Full changelog

ironic

METAL-1376: Make sushy support NetworkAdapters #662
Full changelog

ironic-machine-os-downloader

ART-13079: append .0 to go.mod version #101
Full changelog

kube-rbac-proxy

NO-JIRA: v0.19.1 #119
Full changelog

kube-storage-version-migrator

Fix verify job failure with build-machinery bump #214
ART-13079: append .0 to go.mod version #212
Full changelog

kubevirt-csi-driver

CNV-61396: Implement volume expansion #61
Full changelog

machine-api-operator

OCPBUGS-57018: Fixed test logic for UPI scenario #1375
OCPBUGS-56923: Revert “SPLAT-2082 - Create e2e for vSphere vm-host zonal feature” #1373
SPLAT-2082: Create e2e for vSphere vm-host zonal feature #1369
OCPCLOUD-2717: bump openshift/api #1372
Full changelog

machine-config-operator

OCPBUGS-56555: openvswitch3.5-ipsec package not included with ipsec os extension #5112
NO-ISSUE: Add Jetbrains IDEs files to .gitignore #5116
OCPBUGS-55663: Remove NodeDisruptionPolicy featuregate #5092
OCPBUGS-7747: Do not set cpu system reserve below the default value #5046
OCPBUGS-45459: Remove trailing period from hostnames #4966
OCPBUGS-56744: Fix typo in MCN’s MachineConfigNodePinnedImageSetsDegraded message #5099
OCPBUGS-55830: Only update boot disks during GCP boot image updates #5084
OCPBUGS-55365: Regardless of Pool configuration wait on other sub-controllers to Render #5022
OCPBUGS-45621: Fix dynamic-system-reserved-calc.sh when only true parameter is used #4733
NO-JIRA: OWNERS: Update team osasinfra #5066
Full changelog

machine-image-customization-controller

NO-ISSUE: Remove inactive OWNERS, add Riccardo #136
Full changelog

monitoring-plugin

OU-842: fix: override notistack dependency to avoid conflict #422
NO-JIRA: chore: Update OWNERS #420
OU-830: fix: add error boundary to variable dropdown #417
Full changelog

multus-admission-controller

ART-13079: append .0 to go.mod version #94
Full changelog

network-interface-bond-cni

CNF-17883: Upstream Sync 26052025 #71
Full changelog

network-tools

ART-13079: append .0 to go.mod version #145
Full changelog

networking-console-plugin

OCPBUGS-56929: Add fileupload translation #245
OCPBUGS-49386: Fix pod contenxt #246
CNV-61902: fetch description of terms for popovers #244
CNV-61827: fix styling issues #243
Full changelog

oauth-server

Use newer build-machinery-go #177
ART-13079: append .0 to go.mod version #175
Full changelog

oc-mirror

OCPBUGS-55074: deletes cosign tag based signatures (#1169) #1169
adds code to handle signature errors in the archive pkg (#1162) #1162
OCPBUGS-55078: skips signature mirroring for rebuilt operator catalogs (#1154) #1154
OCPBUGS-56009: Bug fix for no release signature found (#1147) #1147
OCPBUGS-56486: v2/config: allow delete and mirror words (#1164) #1164
OCPBUGS-56642: update the Dockerfile to work with the 1.23 go.mod (#1159) #1159
Full changelog

olm-catalogd, olm-operator-controller

OPRUN-3957: Synchronize From Upstream Repositories #382
NO-ISSUE: Synchronize From Upstream Repositories #381
NO-ISSUE: Synchronize From Upstream Repositories #380
NO-ISSUE: Synchronize From Upstream Repositories #377
NO-ISSUE: Synchronize From Upstream Repositories #375
NO-ISSUE: Synchronize From Upstream Repositories #367
NO-ISSUE: Synchronize From Upstream Repositories #365
NO-ISSUE: Synchronize From Upstream Repositories #363
Full changelog

openshift-apiserver

NO-JIRA: Add Apache 2.0 License file #523
OCPBUGS-45729: Updating ose-openshift-apiserver-container image to be consistent with ART for 4.19 #486
OCPBUGS-56736: Revert “OCPBUGS-38120: project: run validation function when deleting an object” #519
OCPBUGS-35944: Allow updates to ImageStreams that violate existing LimitRanges #513
OCPBUGS-35855: Wire dry run option to Image API server operations #511
Full changelog

openshift-controller-manager

OCPBUGS-57198: Make the pull secrets volume mounts in build containers read-only. #387
WRKLDS-1676: pkg/cmd: Add –kubeconfig and –namespace flag #385
WRKLDS-1676: Delete unused pkg/serviceaccounts #381
Full changelog

openshift-state-metrics

ART-13079: append .0 to go.mod version #121
Full changelog

openstack-machine-api-provider

NO-JIRA: OWNERS: Update team osasinfra #133
NO-JIRA: Unignore generated files in the vendor directory #134
Full changelog

openstack-resource-controller

NO-JIRA: Merge from upstream #17
Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

NO-ISSUE: Synchronize From Upstream Repositories #1024
NO-ISSUE: Synchronize From Upstream Repositories #1016
OCPBUGS-43966, OCPBUGS-57222: Synchronize From Upstream Repositories #1014
NO-ISSUE: Synchronize From Upstream Repositories #1013
OCPBUGS-56467: Synchronize From Upstream Repositories #1005
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-44481: DownStream Merge [06-10-2025] #2627
OCPBUGS-55098: DownStream Merge [06-04-2025] #2618
OCPBUGS-56768, OCPBUGS-56769: DownStream Merge [05-28-2025] #2588
Full changelog

powervs-machine-controllers

NO-ISSUE: Use OS_GIT_VERSION in Makefile when found (for Konflux builds) #118
Full changelog

prometheus

MON-4245: chore(image): reduce binary size by excluding unused SD deps #251
MON-4251: update prometheus to v3.3.1 #252
Full changelog

telemeter

ART-13079: append .0 to go.mod version #559
OCPBUGS-56425: Accept and discard metadata requests over remote write #558
Full changelog

tests

OCPBUGS-57294: Fix e2e-aws-ovn-image-ecosystem test - Part 2 - remove old nodejs 18,ruby 3.1 ubi9 #29905
OCPBUGS-57421: Add sustaining engineers to owners on image ecosystem #29916
OCPNODE-3330: SigstoreImageVerification uses client-go to create test CRs #29896
MULTIARCH-5391: Add new featuregate test to check if desired.Architecture is set as intended #29808
OCPBUGS-57169: Fix failed tests of e2e-aws-ovn-tls-13 #29872
OCPBUGS-50701: Add test case for checking EgressFirewall DNS names in caps #29898
MCO-1652: Add MCO disruptive suite #29776
OCPBUGS-56786: RouteExternalCertificate : Add fix for None platform type #29868
OCPBUGS-56512: updates ruby to version 3.3 #29832
OCPBUGS-57049: TLS registry: refactor testcase annotations #29327
OCPBUGS-49441: Use different certificates for gRPC interoperability test routes #29757
OCPBUGS-56436: Bump 4.20 1.32.5 #29889
TRT-1854: set network for MicroShift to OVNKubernetes #29887
add smg247 as root approver #29860
OCPBUGS-56037: Stabilize custom MCP cleanup on MCN tests #29874
Revert “OCPNODE-2849: Add testcase to verify removal of cgroupv1 in OCP 4.19” #29886
OCPBUGS-56698: Skip tests modifying cluster/network.config when it is not permitted #29859
OCPBUGS-54412: Do not retry extension-sourced tests #29867
OCPBUGS-35855: Add dry-run server test for imagestreamtag #29834
OCPBUGS-56933: fix deployment rollout wait to wait for desired replicas #29876
SPLAT-2231: Updated tests to work with hybrid environments #29827
MCO-1722: Handle check for Disconnnected Clusters for PIS Testing using curl #29870
OCPBUGS-55830: Only update boot disks during GCP boot image updates tests #29869
Add oceanc80 to olm owners #29864
NO-JIRA: OVNK BGP: workaround OCPBUGS-56488 #29853
OCPBUGS-56743: Poll project deletion to fix flaky behavior #29850
OCPEDGE-1922: feat: rename and move arbiter tests #29846
CNTRLPLANE-353: Add test which verifes that only short duration tests are present #29629
NO-JIRA: ovn, virt, skip ipv6 for secondaries #29858
OCPBUGS-55721, OCPBUGS-55832: Fix RouteExternalCertificate tests for few other on-prem jobs #29764
ODC-7790: Remove ODODownloadsSyncDegraded #29835
NO-JIRA: router: Rename MarshalPrivateKeyToDERFormat to MarshalPrivateKeyToPEMString #29855
NO-JIRA: OVNK: ignore stderr when running commands #29845
NO-JIRA: OVNK BGP: set VRF-Lite timeout #29844
Full changelog

vsphere-cloud-controller-manager

OCPBUGS-56720: gitignore doesn’t ignore certain files in vendor/ #91
Full changelog

Node Image Info

Loading node image info, this may take a while ...

Unable to show node image info: node image info is still loading, check back later...

View changelog in Markdown or change previous release:

Source code for this page located on github