4.16.0-0.nightly-multi-2026-10-14-093246

PullSpec:

quay.io/openshift-release-dev/ocp-release-nightly@sha256:f4e46d4a04548db001c5bd7318d6218eed4d1ba852f67515fa32dc991ab3f933

Qualifiers (status api): None

Tests:

Blocking jobs
- multi-e2e-ovn Succeeded periodic-ci-openshift-multiarch-main-nightly-4.16-ocp-e2e-aws-ovn-heterogeneous
Informing jobs
- e2e-aws-ovn-minor-upgrade-multi-a-a Failed periodic-ci-openshift-multiarch-main-nightly-4.16-ocp-e2e-upgrade-aws-ovn-multi-a-a
- e2e-nightly-upgrade-aws-ovn-multi-a-a Failed periodic-ci-openshift-multiarch-main-nightly-4.16-ocp-e2e-upgrade-aws-ovn-multi-a-a

Upgrades from:

Upgrades to:

4.17.0-0.nightly-multi-2026-10-14-120754 (changes) - Pending

Loading changelog, this may take a while ...

Changes from 4.15.0-0.nightly-multi-2026-10-13-131250

Created: 2026-10-14 09:53:39 +0000 UTC

Image Digest: sha256:629fef70e32e337522ba551bf705d34edd2fbbbe21ae9dccea790adf69838a6a

Components

Kubectl 1.29.7
Kubernetes upgraded from 1.28.15 to 1.29.14
Kubernetes Tests 1.29.0
Red Hat Enterprise Linux CoreOS upgraded from 415.92.202610081130-0 to 416.94.202610130258-0 (diff)

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
DisableKubeletCloudCredentialProviders (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled (New)	Enabled (New)	Enabled (Changed)	Enabled (Changed)
AdminNetworkPolicy (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled (New)	Enabled (New)	Enabled	Enabled
MetricsServer (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled (New)	Enabled (New)	Enabled	Enabled
VSphereControlPlaneMachineSet (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled (New)	Enabled (New)	Enabled	Enabled
VSphereStaticIPs (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled (New)	Enabled (New)	Enabled	Enabled
BareMetalLoadBalancer (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
ClusterAPIInstallAWS (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
ClusterAPIInstallNutanix (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
ClusterAPIInstallOpenStack (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
ClusterAPIInstallVSphere (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
HardwareSpeed (3 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
KMSv1 (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
NetworkDiagnosticsConfig (6 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
StreamingCollectionEncodingToJSON (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
StreamingCollectionEncodingToProtobuf (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
VSphereDriverConfiguration (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
GatewayAPI (0 tests)	Disabled	Disabled	Enabled (New)	Enabled (New)	Disabled (Changed)	Disabled (Changed)
ExternalOIDC (0 tests)	Enabled (New)		Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
ChunkSizeMiB (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
ClusterAPIInstallAzure (0 tests)
ClusterAPIInstallGCP (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
ClusterAPIInstallIBMCloud (0 tests)
ClusterAPIInstallPowerVS (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
EtcdBackendQuota (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
Example (1 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
ImagePolicy (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
InsightsConfig (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
InsightsOnDemandDataGather (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
MetricsCollectionProfiles (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
NewOLM (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
NodeDisruptionPolicy (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
PinnedImages (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
PlatformOperators (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
ServiceAccountTokenNodeBinding (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
ServiceAccountTokenNodeBindingValidation (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
ServiceAccountTokenPodNodeInfo (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
TranslateStreamCloseWebsocketRequests (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
UpgradeStatus (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
VSphereMultiVCenters (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
VolumeGroupSnapshot (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)

New images

aws-kms-encryption-provider git c66065de sha256:ced72bf5ddf56719a742a5f8c08932b8ffc7577f602ffd6ec8ad96b0e47c6bdf
azure-kms-encryption-provider git de233896 sha256:d99d3ee0b99fa481ebf9eb7317c3b5412665539cb92478d1e7680aeec800552f
containernetworking-plugins-microshift git b37e7f89 sha256:ab81eadb7f78dcc6c44da6c8d2bd1216d599e7092a6fe460c811b54d3f33a53b
multus-cni-microshift git 89c3e1cc sha256:dd057dcb1068505645e6912927df9e09de1c05ff7f2008348f37f9f2279a4e7d
operator-framework-tools git c6bdcdc0 sha256:6bedb5f51bb090a2e1e832af76c80944eabb840ec5556d08839cab4a9c59219b

Removed images

alibaba-cloud-csi-driver
alibaba-disk-csi-driver-operator
cluster-platform-operators-manager
ibm-vpc-node-label-updater
machine-os-content

Rebuilt images without code change

rhel-coreos sha256:46c58d2f8f672e8f776609289e8265b4ee2d1a44cd6058f91e418520d37b62a6
rhel-coreos-extensions sha256:0c4287d59ba8199b410bb85f65c1adcb4ae482f962c449701a6772a92e154b23

agent-installer-api-server

OCPBUGS-89848: patching golang.org/x/crypto with sustaining/crypto@v0.33.0-sec.2 #10802
And 213 elided commits (e.g. from squash or rebase merges)
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-102901: Bump x/net to v0.35.0-sec.4 #2295
And 44 elided commits (e.g. from squash or rebase merges)
Full changelog

agent-installer-node-agent

OCPBUGS-102913: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #1616
run go mod tidy / vendor #1019
And 32 elided commits (e.g. from squash or rebase merges)
Full changelog

agent-installer-utils

OCPBUGS-68046: bump github.com/sirupsen/logrus to v1.9.3 #239
OCPBUGS-24960: Updating ose-agent-installer-utils-container image to be consistent with ART #32
NO-ISSUE: Tidy up Dockerfiles #33
Full changelog

alibaba-cloud-controller-manager

OCPBUGS-102906: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 to address CVE-2026-33814 #62
OCPBUGS-23004: Merge https://github.com/kubernetes/cloud-provider-alibaba-cloud:master (8244569) into master #37
OCPBUGS-25563: Updating ose-alibaba-cloud-controller-manager-container image to be consistent with ART #44
OCPBUGS-25632: Add Snyk file to exclude vendor directory on scan #47
OCPBUGS-25457: Bump golang.org/x/net to v0.19.0 #42
OCPBUGS-24926: Updating ose-alibaba-cloud-controller-manager-container image to be consistent with ART #40
Full changelog

alibaba-machine-controllers

OCPBUGS-44242: change the VERSION makefile variable to use OS_GIT_VERSION #58
AUTH-482: set required-scc for openshift workloads #50
OCPBUGS-25571: Updating ose-alibaba-machine-controllers-container image to be consistent with ART #49
OCPBUGS-24945: Updating ose-alibaba-machine-controllers-container image to be consistent with ART #48
OCPBUGS-24124: Updating ose-alibaba-machine-controllers-container image to be consistent with ART #46
Full changelog

apiserver-network-proxy

OCPBUGS-38062: Revert “Agent: Respect HTTPS_PROXY env vars for proxied connections” #59
OCPBUGS-31716: Bump golang.org/x/net to v0.23.0 #50
OCPBUGS-27932: Updating ose-apiserver-network-proxy-container image to be consistent with ART for 4.16 #47
OCPBUGS-25004: Updating ose-apiserver-network-proxy-container image to be consistent with ART #46
Full changelog

aws-cloud-controller-manager

OCPBUGS-88174: replace golang.org/x/net with sustaining fork v0.35.0-sec.4 #180
OCPBUGS-31968: update for CVE-2023-45288 [release-4.16] #82
OCPBUGS-34046: Ensure that addresses are added in network device index order #88
OCPBUGS-8213: Ensure removal of security group rules on deleting load balancers #57
OCPBUGS-30466: Update google.golang.org/protobuf to v1.33.0 #79
OCPBUGS-27879: Add snyk exclusion file #78
OCPBUGS-28548: Updates build-rpm.sh to set release to build time #75
OCPBUGS-28548: spec: add Provides: ose-aws-ecr-image-credential-provider #74
OCPBUGS-25662: UPSTREAM: <carry>: Removes escaping from pwd in rpm build script #69
OCPBUGS-25662: Updates rpm build script #68
OCPBUGS-25662: ecr-credential-provider RPM CI builds #65
OCPBUGS-25662: Installs ecr-credential-provider to /usr/libexec #66
OCPBUGS-25662: Adds ecr-credential-provider specfile #63
OCPBUGS-22542, OCPBUGS-26061, OCPCLOUD-2423: Merge https://github.com/kubernetes/cloud-provider-aws:master (65e4f1a) into master #53
OCPBUGS-24959: Updating ose-aws-cloud-controller-manager-container image to be consistent with ART #59
Full changelog

aws-cluster-api-controllers

🌱 OCPBUGS-123712: UPSTREAM: <carry>: Remove upstream .github files unused in OpenShift CI #645
OCPBUGS-78227: [release-4.16] update go mod dependency for konflux #591
OCPBUGS-61942: UPSTREAM <carry>: revert: Only tag NetworkInterfaces in RunInstances if IAM Allows It #572
OCPBUGS-58666, OCPBUGS-58671: bump github.com/golang/glog to v1.2.5 #560
OCPBUGS-53726: Update golang-jwt to v4.5.2 #547
OCPBUGS-44234: [release-4.16] OSD-25934: Only tag NetworkInterfaces in RunInstances if IAM Allows It #531
OCPBUGS-33170: All containers must fallback to logs on error #510
NO-JIRA: Merge https://github.com/kubernetes-sigs/cluster-api-provider-aws:v2.4.2 (1c23009) into master #507
NO-JIRA: Merge https://github.com/kubernetes-sigs/cluster-api-provider-aws:v2.4.1 (cbf5317) into master #502
OCPBUGS-30586: fix e2e tests on release branches #503
OCPBUGS-25565, OCPCLOUD-2441: Merge https://github.com/kubernetes-sigs/cluster-api-provider-aws:v2.4.0 (25a0086) into master #499
OCPBUGS-27871: Update snyk exclusion file #498
OCPBUGS-26181: Add Snyk file to exclude vendor directory on scan #495
OCPBUGS-24928: Updating ose-aws-cluster-api-controllers-container image to be consistent with ART #488
NO-JIRA: Merge https://github.com/kubernetes-sigs/cluster-api-provider-aws:v2.3.0 (2562a8b) into master #487
Full changelog

aws-ebs-csi-driver

OCPBUGS-31101: UPSTREAM: 1966: Add missing instances to instance store volumes table #261
OCPBUGS-30468: CVE-2024-24786: bump google.golang.org/protobuf to v1.33.0 #259
OCPBUGS-23260: UPSTREAM: 1919: Add reserved-volume-attachments #260
STOR-1575: Rebase to v1.26.1 for OCP 4.16 #257
OCPBUGS-25500: UPSTREAM: 1877: CVE-2023-48795: bump golang.org/x/crypto to v0.17.0 #252
STOR-1688: Chore: add .snyk file to ignore false positives #248
OCPBUGS-25549: Updating ose-aws-ebs-csi-driver-container image to be consistent with ART #250
OCPBUGS-25197: UPSTREAM: 1858: Bump otelhttp to fix CVE-2023-45142 #249
OCPBUGS-25126: Updating ose-aws-ebs-csi-driver-container image to be consistent with ART #247
OCPBUGS-24867: Updating ose-aws-ebs-csi-driver-container image to be consistent with ART #246
Full changelog

aws-ebs-csi-driver-operator

OCPBUGS-102919, OCPBUGS-102939: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #608
OCPBUGS-64831: Use 127.0.0.1 for healtz http-endpoints #467
OCPBUGS-64768: Add RBAC ClusterRole and Binding for driver node #465
OCPBUGS-61253: add ability to control kube rbac proxy container image… #426
OCPBUGS-60598: Bump library-go #423
OCPBUGS-59606: Backport stale conditions fix #407
OCPBUGS-60248: add tag matching to Azure File storage class #414
OCPBUGS-34392: Adjust port for registrar sidecar in aws-ebs csi driver container #230
OCPBUGS-32785: add token audience for Azure File #224
STOR-1726: auto-generate assets for CIFS/Samba driver #217
OCPBUGS-28230: Add terminationMessagePolicy to all containers #216
STOR-1726: Delete static resources when ClusterCSIDriver is removed #215
AUTH-482: set required-scc for openshift workloads #170
NO-JIRA: Remove unused assests for azure-file #213
OCPBUGS-31044: Add cluster-wide proxy in the azure-file driver node container #207
OCPBUGS-31306: Azure Disk: Add cluster-wide proxy in the driver container in the node #206
OCPBUGS-28230: enforce termination message policy on all platform pods #214
STOR-1726: Add OLM metadata for SMB operator #210
STOR-1726: Add test manifest for SMB CSI driver #212
STOR-1818: enable pvcDataSource capability for tests #204
STOR-1726: Simple rename of objects in assets/overlays/samba/generated/standalone/ #211
STOR-1726: Add Dockerfile for Samba operator #209
Bump github.com/prometheus/client_model from 0.5.0 to 0.6.0 #168
STOR-1726: Minimal implementation of CIFS/Samba CSI driver operator #205
Bump google.golang.org/grpc from 1.61.0 to 1.62.1 #190
Bump github.com/go-openapi/swag from 0.22.9 to 0.23.0 #198
Bump github.com/emicklei/go-restful/v3 from 3.11.2 to 3.12.0 #203
Bump github.com/felixge/fgprof from 0.9.3 to 0.9.4 #185
STOR-1794: add location for azcopy logs #200
OCPBUGS-23260: Explicitly reserve 1 attachment for the root disk #199
Bump go.uber.org/zap from 1.26.0 to 1.27.0 #173
Bump the opentelemetry-dependencies group with 8 updates #177
Bump the golang-dependencies group with 6 updates #191
OCPBUGS-30620: remove legacy directory and duplicate Dockerfile.*.test files #196
OCPBUGS-30469: CVE-2024-24786: bump google.golang.org/protobuf to v1.33.0 #197
NO-JIRA: Configure dependabot for security updates only #174
OCPBUGS-30620: move test manifests to top-level directory #194
STOR-1464: Enable RWOP tests in CI #187
STOR-1762: Add azure file hypershift #163
Bump the k8s-dependencies group with 6 updates #172
STOR-1726: Bump openshift/api dependency #169
STOR-1750: Build image from legacy folder #162
Bump the opentelemetry-dependencies group with 8 updates #161
STOR-1574: Bump all deps #156
OCPBUGS-26924: Add healthcheck for node-driver-registrar container #155
Bump github.com/grpc-ecosystem/grpc-gateway/v2 from 2.19.0 to 2.19.1 #149
STOR-1750: Add legacy azure file driver #154
Bump go.etcd.io/etcd/client/v3 from 3.5.11 to 3.5.12 #150
Bump github.com/evanphx/json-patch from 5.8.1+incompatible to 5.9.0+incompatible #148
Bump github.com/go-openapi/swag from 0.22.8 to 0.22.9 #147
Bump github.com/google/uuid from 1.5.0 to 1.6.0 #144
Bump google.golang.org/grpc from 1.60.1 to 1.61.0 #145
Bump the k8s-dependencies group with 3 updates #146
STOR-1574: Bump library-go #137
Bump github.com/go-openapi/swag from 0.22.7 to 0.22.8 #142
Bump github.com/pkg/profile from 1.3.0 to 1.7.0 #138
Bump github.com/emicklei/go-restful/v3 from 3.11.0 to 3.11.2 #141
Bump go.uber.org/zap from 1.24.0 to 1.26.0 #139
Bump github.com/go-openapi/jsonreference from 0.20.2 to 0.20.4 #140
Bump github.com/go-openapi/swag from 0.22.4 to 0.22.7 #136
Bump github.com/prometheus/common from 0.45.0 to 0.46.0 #135
Bump the opentelemetry-dependencies group with 4 updates #134
Bump github.com/go-openapi/jsonpointer from 0.19.6 to 0.20.2 #128
Bump github.com/evanphx/json-patch from 5.6.0+incompatible to 5.8.1+incompatible #125
Bump the k8s-dependencies group with 5 updates #133
Bump go.etcd.io/etcd/client/v3 from 3.5.9 to 3.5.11 #124
STOR-1722: Add support hypershift for azure-disk #73
Bump github.com/go-logr/logr from 1.3.0 to 1.4.1 #129
OCPBUGS-27267: Updating ose-azure-disk-csi-driver-operator-container image to be consistent with ART for 4.16 #132
Bump the opentelemetry-dependencies group with 2 updates #122
Bump github.com/sirupsen/logrus from 1.9.0 to 1.9.3 #123
Bump go.etcd.io/etcd/client/pkg/v3 from 3.5.9 to 3.5.11 #119
Bump github.com/fsnotify/fsnotify from 1.6.0 to 1.7.0 #120
NO-JIRA: Bump github.com/go-errors/errors from 1.4.2 to 1.5.1 #106
NO-JIRA: Bump google.golang.org/grpc from 1.59.0 to 1.60.1 #104
NO-JIRA: Bump github.com/spf13/cobra from 1.7.0 to 1.8.0 #103
NO-JIRA: Bump github.com/google/uuid from 1.3.1 to 1.5.0 #101
OCPBUGS-27056: Update to RHEL9 and go 1.21 #117
NO-JIRA: Bump the golang-dependencies group with 5 updates #109
NO-JIRA: Bump github.com/prometheus/client_golang from 1.17.0 to 1.18.0 #108
STOR-1714: AWS EBS operator: Release leadership on SIGTERM #94
NO-JIRA: Bump google.golang.org/protobuf from 1.31.0 to 1.32.0 #107
NO-JIRA: Add valid-reference label to dependabot PRs #116
OCPBUGS-27050: Updating ose-azure-disk-csi-driver-operator-container image to be consistent with ART for 4.16 #114
STOR-1713: Don’t ignore azure-disk-csi-driver-operator #110
NO-JIRA: Add dependabot configuration #97
STOR-1696: Add legacy azure disk #88
OCPBUGS-24245: Add selinux #89
OCPBUGS-25125: Add test AssetOrderer #86
OCPBUGS-25557: Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART #87
OCPBUGS-25125: Create RBAC objects first #84
OCPBUGS-24226: setting TLSSecurityProfile with no minTLSVersion crashes controller #76
NO-JIRA: Add “Quick start” section to README.md #80
STOR-1688: Chore: add .snyk file to ignore false positives #85
OCPBUGS-25147: Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART #81
OCPBUGS-23827: CVE-2023-47108: bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp to v0.46 #77
OCPBUGS-23306: Add annotation to CSI driver Pod preventing eviction from the cluster-autoscaler #79
OCPBUGS-24905: Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART #78
Full changelog

aws-machine-controllers

OCPBUGS-73903: Fix reconciler consistency checks in Update and Exists #168
OCPBUGS-63140: client: re-use a single file for building the session instead of randomly named files #144
OCPBUGS-46508: fix Associate*IpAddress flag on launch EC2 #121
OCPBUGS-28325: add an extra vendor exclude to snyk config #100
OCPCLOUD-2429: Rebase k8s to 1.29 and update dependencies #99
OCPBUGS-26187: Add Snyk file to exclude vendor directory on scan #98
OCPBUGS-24934: Updating ose-machine-api-provider-aws-container image to be consistent with ART #94
Full changelog

aws-pod-identity-webhook

OCPBUGS-52513: github.com/go-jose/go-jose/v4 v4.0.5 #203
OCPBUGS-30711: Upgrade go-jose module to 4.0.1 #187
OCPBUGS-25588: Updating ose-aws-pod-identity-webhook-container image to be consistent with ART #183
OCPBUGS-25002: Updating ose-aws-pod-identity-webhook-container image to be consistent with ART #181
OCPBUGS-25002: Updating ose-aws-pod-identity-webhook-container image to be consistent with ART #180
Full changelog

azure-cloud-controller-manager, azure-cloud-node-manager

OCPBUGS-102933, OCPBUGS-103121: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #210
OCPBUGS-79998, OCPBUGS-85635, OCPBUGS-85636: Bump google.golang.org/grpc to v1.79.3 #182
OCPBUGS-47645: Prevent panic when informer receives cache.DeletedFinalStateUnknown #133
OCPBUGS-29012: Improvements to client timeouts to prevent hangs #116
OCPBUGS-28244: Merge https://github.com/kubernetes-sigs/cloud-provider-azure:master (de765cc) into master #104
OCPBUGS-26124, OCPBUGS-27861: update snyk file #107
OCPBUGS-29012: Remove concurrent-service-syncs limitation #106
OCPCLOUD-2460: Adds acr-credential-provider spec file and build script #105
OCPBUGS-26115: Add Snyk file to exclude vendor directory on scan #103
OCPBUGS-22556, OCPCLOUD-2422: Update to kubernetes v1.29 #88
OCPBUGS-25590: Updating ose-azure-cloud-controller-manager-container image to be consistent with ART #102
OCPBUGS-25589: Updating ose-azure-cloud-node-manager-container image to be consistent with ART #101
OCPBUGS-25005: Updating ose-azure-cloud-controller-manager-container image to be consistent with ART #100
OCPBUGS-25003: Updating ose-azure-cloud-node-manager-container image to be consistent with ART #99
Full changelog

azure-cluster-api-controllers

OCPBUGS-78176: [release-4.16] update go mod dependency for konflux #364
OCPBUGS-36025: Update go-retryablehttp to v0.7.7 #310
OCPBUGS-33083: Merge https://github.com/kubernetes-sigs/cluster-api-provider-azure:v1.13.5 (1f08b9d) into master #302
OCPBUGS-27450: add a snyk configuration file #299
NO-JIRA: Merge https://github.com/kubernetes-sigs/cluster-api-provider-azure:v1.13.0 (7ee3a6a) into master #298
OCPCLOUD-2443: Merge https://github.com/kubernetes-sigs/cluster-api-provider-azure:v1.12.1 (f32b78b) into master #297
OCPBUGS-25626: Add Snyk file to exclude vendor directory on scan #295
OCPBUGS-24896: Updating ose-azure-cluster-api-controllers-container image to be consistent with ART #293
Full changelog

azure-disk-csi-driver

OCPBUGS-30475: CVE-2024-24786: bump google.golang.org/protobuf to v1.33.0 #78
STOR-1579: Rebase v1.29.3 #75
OCPBUGS-27242: fix or ignore snyk errors for ocp storage repos #74
OCPBUGS-25503: UPSTREAM: 2132: CVE-2023-48795: bump golang.org/x/crypto to v0.17.0 #71
OCPBUGS-18701: UPSTREAM: 1904, UPSTREAM: 1917, UPSTREAM: 1955: Update disk number table #49
OCPBUGS-25569: Updating ose-azure-disk-csi-driver-container image to be consistent with ART #70
STOR-1688: Chore: add .snyk file to ignore false positives #69
OCPBUGS-22559: OCPBUGS-23831: UPSTREAM: 2090: Bump OpenTelemetry libraries to fix CVEs #66
OCPBUGS-25050: Updating ose-azure-disk-csi-driver-container image to be consistent with ART #67
OCPBUGS-24938: Updating ose-azure-disk-csi-driver-container image to be consistent with ART #65
Full changelog

azure-disk-csi-driver-operator

OCPBUGS-102919, OCPBUGS-102939: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #608
OCPBUGS-64831: Use 127.0.0.1 for healtz http-endpoints #467
OCPBUGS-64768: Add RBAC ClusterRole and Binding for driver node #465
OCPBUGS-61253: add ability to control kube rbac proxy container image… #426
OCPBUGS-60598: Bump library-go #423
OCPBUGS-59606: Backport stale conditions fix #407
OCPBUGS-60248: add tag matching to Azure File storage class #414
OCPBUGS-34392: Adjust port for registrar sidecar in aws-ebs csi driver container #230
OCPBUGS-32785: add token audience for Azure File #224
STOR-1726: auto-generate assets for CIFS/Samba driver #217
OCPBUGS-28230: Add terminationMessagePolicy to all containers #216
STOR-1726: Delete static resources when ClusterCSIDriver is removed #215
AUTH-482: set required-scc for openshift workloads #170
NO-JIRA: Remove unused assests for azure-file #213
OCPBUGS-31044: Add cluster-wide proxy in the azure-file driver node container #207
OCPBUGS-31306: Azure Disk: Add cluster-wide proxy in the driver container in the node #206
OCPBUGS-28230: enforce termination message policy on all platform pods #214
STOR-1726: Add OLM metadata for SMB operator #210
STOR-1726: Add test manifest for SMB CSI driver #212
STOR-1818: enable pvcDataSource capability for tests #204
STOR-1726: Simple rename of objects in assets/overlays/samba/generated/standalone/ #211
STOR-1726: Add Dockerfile for Samba operator #209
Bump github.com/prometheus/client_model from 0.5.0 to 0.6.0 #168
STOR-1726: Minimal implementation of CIFS/Samba CSI driver operator #205
Bump google.golang.org/grpc from 1.61.0 to 1.62.1 #190
Bump github.com/go-openapi/swag from 0.22.9 to 0.23.0 #198
Bump github.com/emicklei/go-restful/v3 from 3.11.2 to 3.12.0 #203
Bump github.com/felixge/fgprof from 0.9.3 to 0.9.4 #185
STOR-1794: add location for azcopy logs #200
OCPBUGS-23260: Explicitly reserve 1 attachment for the root disk #199
Bump go.uber.org/zap from 1.26.0 to 1.27.0 #173
Bump the opentelemetry-dependencies group with 8 updates #177
Bump the golang-dependencies group with 6 updates #191
OCPBUGS-30620: remove legacy directory and duplicate Dockerfile.*.test files #196
OCPBUGS-30469: CVE-2024-24786: bump google.golang.org/protobuf to v1.33.0 #197
NO-JIRA: Configure dependabot for security updates only #174
OCPBUGS-30620: move test manifests to top-level directory #194
STOR-1464: Enable RWOP tests in CI #187
STOR-1762: Add azure file hypershift #163
Bump the k8s-dependencies group with 6 updates #172
STOR-1726: Bump openshift/api dependency #169
STOR-1750: Build image from legacy folder #162
Bump the opentelemetry-dependencies group with 8 updates #161
STOR-1574: Bump all deps #156
OCPBUGS-26924: Add healthcheck for node-driver-registrar container #155
Bump github.com/grpc-ecosystem/grpc-gateway/v2 from 2.19.0 to 2.19.1 #149
STOR-1750: Add legacy azure file driver #154
Bump go.etcd.io/etcd/client/v3 from 3.5.11 to 3.5.12 #150
Bump github.com/evanphx/json-patch from 5.8.1+incompatible to 5.9.0+incompatible #148
Bump github.com/go-openapi/swag from 0.22.8 to 0.22.9 #147
Bump github.com/google/uuid from 1.5.0 to 1.6.0 #144
Bump google.golang.org/grpc from 1.60.1 to 1.61.0 #145
Bump the k8s-dependencies group with 3 updates #146
STOR-1574: Bump library-go #137
Bump github.com/go-openapi/swag from 0.22.7 to 0.22.8 #142
Bump github.com/pkg/profile from 1.3.0 to 1.7.0 #138
Bump github.com/emicklei/go-restful/v3 from 3.11.0 to 3.11.2 #141
Bump go.uber.org/zap from 1.24.0 to 1.26.0 #139
Bump github.com/go-openapi/jsonreference from 0.20.2 to 0.20.4 #140
Bump github.com/go-openapi/swag from 0.22.4 to 0.22.7 #136
Bump github.com/prometheus/common from 0.45.0 to 0.46.0 #135
Bump the opentelemetry-dependencies group with 4 updates #134
Bump github.com/go-openapi/jsonpointer from 0.19.6 to 0.20.2 #128
Bump github.com/evanphx/json-patch from 5.6.0+incompatible to 5.8.1+incompatible #125
Bump the k8s-dependencies group with 5 updates #133
Bump go.etcd.io/etcd/client/v3 from 3.5.9 to 3.5.11 #124
STOR-1722: Add support hypershift for azure-disk #73
Bump github.com/go-logr/logr from 1.3.0 to 1.4.1 #129
OCPBUGS-27267: Updating ose-azure-disk-csi-driver-operator-container image to be consistent with ART for 4.16 #132
Bump the opentelemetry-dependencies group with 2 updates #122
Bump github.com/sirupsen/logrus from 1.9.0 to 1.9.3 #123
Bump go.etcd.io/etcd/client/pkg/v3 from 3.5.9 to 3.5.11 #119
Bump github.com/fsnotify/fsnotify from 1.6.0 to 1.7.0 #120
NO-JIRA: Bump github.com/go-errors/errors from 1.4.2 to 1.5.1 #106
NO-JIRA: Bump google.golang.org/grpc from 1.59.0 to 1.60.1 #104
NO-JIRA: Bump github.com/spf13/cobra from 1.7.0 to 1.8.0 #103
NO-JIRA: Bump github.com/google/uuid from 1.3.1 to 1.5.0 #101
OCPBUGS-27056: Update to RHEL9 and go 1.21 #117
NO-JIRA: Bump the golang-dependencies group with 5 updates #109
NO-JIRA: Bump github.com/prometheus/client_golang from 1.17.0 to 1.18.0 #108
STOR-1714: AWS EBS operator: Release leadership on SIGTERM #94
NO-JIRA: Bump google.golang.org/protobuf from 1.31.0 to 1.32.0 #107
NO-JIRA: Add valid-reference label to dependabot PRs #116
OCPBUGS-27050: Updating ose-azure-disk-csi-driver-operator-container image to be consistent with ART for 4.16 #114
STOR-1713: Don’t ignore azure-disk-csi-driver-operator #110
NO-JIRA: Add dependabot configuration #97
STOR-1696: Add legacy azure disk #88
OCPBUGS-24245: Add selinux #89
OCPBUGS-25125: Add test AssetOrderer #86
OCPBUGS-25557: Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART #87
OCPBUGS-25125: Create RBAC objects first #84
OCPBUGS-24226: setting TLSSecurityProfile with no minTLSVersion crashes controller #76
NO-JIRA: Add “Quick start” section to README.md #80
STOR-1688: Chore: add .snyk file to ignore false positives #85
OCPBUGS-25147: Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART #81
OCPBUGS-23827: CVE-2023-47108: bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp to v0.46 #77
OCPBUGS-23306: Add annotation to CSI driver Pod preventing eviction from the cluster-autoscaler #79
OCPBUGS-24905: Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART #78
STOR-1500: Switch to the new operator #69
Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART #75
STOR-1402, STOR-1453: update libraries and specify TLS_MIN_VERSION #71
STOR-1400: Add support for Batch DescribeVolume #74
STOR-1400: Sync sidecar arguments with upstream #72
STOR-1500: Add log for the new operator #70
Pull the latest AWS EBS operator #67
Fix vendoring of golang.org/x/net #68
hack: remove existing path from .gitignore #65
Drop Guest prefix from client names #64
Update all generated assets in a single run #63
Verify generated assets in make verify #62
Move operator config into pkg/drivers #61
Add AWS EBS CSI driver operator starter #58
OCPBUGS-21593: CVE-2023-44487: bump golang.org/x/net to v0.17.0 #59
STOR-1455: Add asset generator #53
Delegate to aws-ebs-csi-driver-operator for tests and verify #57
Add aws ebs operator legacy #56
Add ci-operator config #54
Clean the repository, it will be reused for all CSI driver operators #52
Obsolete the operator #51
Fix hostpath image sample to support dynamic registration #47
Add kubelet-registration-path flag to csi-driver-registrar #44
Fix golint error #45
Output error message when failed to get CSIDriverDeployment and requeued #46
Add -nometadata to go-bindata to stop updating generated files by every build #43
Disable automatic installation of the operator in OpenShift #41
Pass SecurityContext to sidecar containers #40
Move EBS deployment sample to the right place #39
Use correct context timeouts #38
Add EBS sample deployment file #37
Add leader election to the operator #36
Embed git version into the operator binary #35
Generate bindata during build #34
Add more unit tests #33
Add controller unit tests #32
Fix deletion of non-namespaced objects #31
Fix e2e test #30
Add e2e test #29
Update to operator-sdk 0.1.1 #28
Fix liveness probe version #27
ADd a RHEL7 dockerfile and standardize format #26
Documentation update #23
Add unit test for validation #14
Fix status.conditions json name #11
Add CRD printer columns #12
Add configuration of liveness probe. #9
Increase resync period #10
Add /var/lib/kubelet HostPath directory to node drivers #8
Fix role bindings #7
Add liveness probe. #6
Fix operator images #5
Add OpenShift manifests to operator image #4
Use label selector for informers. #3
Use constants where appropriate #2
Add initial operator #1
And 26 elided commits (e.g. from squash or rebase merges)
Full changelog

azure-file-csi-driver

OCPBUGS-102923: Bump golang.org/x/net to v0.35.0-sec.4 #160
UPSTREAM: 3221: OCPBUGS-115466: Bump golang.org/x/crypto to v0.33.0-sec.5 #165
OCPBUGS-89335: Address CVE-2026-33186 #139
OCPBUGS-39145: bump mount-utils to treat ENODEV error as corrupted mount #76
OCPBUGS-32785: Rebase v1.29.5 for OCP 4.16 #64
OCPBUGS-32046: Updating ose-azure-file-csi-driver-container image to be consistent with ART for 4.16 #60
OCPBUGS-31869: Updating ose-azure-file-csi-driver-container image to be consistent with ART for 4.16 #59
STOR-1794: use azcopy base image to build driver #56
OCPBUGS-30476: CVE-2024-24786: bump google.golang.org/protobuf to v1.33.0 #57
STOR-1586: Rebase v1.29.3 #54
OCPBUGS-27242: fix or ignore snyk errors for ocp storage repos #52
OCPBUGS-25550: Updating ose-azure-file-csi-driver-container image to be consistent with ART #47
OCPBUGS-25504: UPSTREAM: 1626: CVE-2023-48795: bump golang.org/x/crypto to v0.17.0 #49
OCPBUGS-25550: UPSTREAM: <drop>: Regenerate go.mod with go 1.21 #48
STOR-1688: Chore: add .snyk file to ignore false positives #46
OCPBUGS-24874: Updating ose-azure-file-csi-driver-container image to be consistent with ART #45
Full changelog

azure-file-csi-driver-operator

OCPBUGS-102919, OCPBUGS-102939: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #608
OCPBUGS-64831: Use 127.0.0.1 for healtz http-endpoints #467
OCPBUGS-64768: Add RBAC ClusterRole and Binding for driver node #465
OCPBUGS-61253: add ability to control kube rbac proxy container image… #426
OCPBUGS-60598: Bump library-go #423
OCPBUGS-59606: Backport stale conditions fix #407
OCPBUGS-60248: add tag matching to Azure File storage class #414
OCPBUGS-34392: Adjust port for registrar sidecar in aws-ebs csi driver container #230
OCPBUGS-32785: add token audience for Azure File #224
STOR-1726: auto-generate assets for CIFS/Samba driver #217
OCPBUGS-28230: Add terminationMessagePolicy to all containers #216
STOR-1726: Delete static resources when ClusterCSIDriver is removed #215
AUTH-482: set required-scc for openshift workloads #170
NO-JIRA: Remove unused assests for azure-file #213
OCPBUGS-31044: Add cluster-wide proxy in the azure-file driver node container #207
OCPBUGS-31306: Azure Disk: Add cluster-wide proxy in the driver container in the node #206
OCPBUGS-28230: enforce termination message policy on all platform pods #214
STOR-1726: Add OLM metadata for SMB operator #210
STOR-1726: Add test manifest for SMB CSI driver #212
STOR-1818: enable pvcDataSource capability for tests #204
STOR-1726: Simple rename of objects in assets/overlays/samba/generated/standalone/ #211
STOR-1726: Add Dockerfile for Samba operator #209
Bump github.com/prometheus/client_model from 0.5.0 to 0.6.0 #168
STOR-1726: Minimal implementation of CIFS/Samba CSI driver operator #205
Bump google.golang.org/grpc from 1.61.0 to 1.62.1 #190
Bump github.com/go-openapi/swag from 0.22.9 to 0.23.0 #198
Bump github.com/emicklei/go-restful/v3 from 3.11.2 to 3.12.0 #203
Bump github.com/felixge/fgprof from 0.9.3 to 0.9.4 #185
STOR-1794: add location for azcopy logs #200
OCPBUGS-23260: Explicitly reserve 1 attachment for the root disk #199
Bump go.uber.org/zap from 1.26.0 to 1.27.0 #173
Bump the opentelemetry-dependencies group with 8 updates #177
Bump the golang-dependencies group with 6 updates #191
OCPBUGS-30620: remove legacy directory and duplicate Dockerfile.*.test files #196
OCPBUGS-30469: CVE-2024-24786: bump google.golang.org/protobuf to v1.33.0 #197
NO-JIRA: Configure dependabot for security updates only #174
OCPBUGS-30620: move test manifests to top-level directory #194
STOR-1464: Enable RWOP tests in CI #187
STOR-1762: Add azure file hypershift #163
Bump the k8s-dependencies group with 6 updates #172
STOR-1726: Bump openshift/api dependency #169
STOR-1750: Build image from legacy folder #162
Bump the opentelemetry-dependencies group with 8 updates #161
STOR-1574: Bump all deps #156
OCPBUGS-26924: Add healthcheck for node-driver-registrar container #155
Bump github.com/grpc-ecosystem/grpc-gateway/v2 from 2.19.0 to 2.19.1 #149
STOR-1750: Add legacy azure file driver #154
Bump go.etcd.io/etcd/client/v3 from 3.5.11 to 3.5.12 #150
Bump github.com/evanphx/json-patch from 5.8.1+incompatible to 5.9.0+incompatible #148
Bump github.com/go-openapi/swag from 0.22.8 to 0.22.9 #147
Bump github.com/google/uuid from 1.5.0 to 1.6.0 #144
Bump google.golang.org/grpc from 1.60.1 to 1.61.0 #145
Bump the k8s-dependencies group with 3 updates #146
STOR-1574: Bump library-go #137
Bump github.com/go-openapi/swag from 0.22.7 to 0.22.8 #142
Bump github.com/pkg/profile from 1.3.0 to 1.7.0 #138
Bump github.com/emicklei/go-restful/v3 from 3.11.0 to 3.11.2 #141
Bump go.uber.org/zap from 1.24.0 to 1.26.0 #139
Bump github.com/go-openapi/jsonreference from 0.20.2 to 0.20.4 #140
Bump github.com/go-openapi/swag from 0.22.4 to 0.22.7 #136
Bump github.com/prometheus/common from 0.45.0 to 0.46.0 #135
Bump the opentelemetry-dependencies group with 4 updates #134
Bump github.com/go-openapi/jsonpointer from 0.19.6 to 0.20.2 #128
Bump github.com/evanphx/json-patch from 5.6.0+incompatible to 5.8.1+incompatible #125
Bump the k8s-dependencies group with 5 updates #133
Bump go.etcd.io/etcd/client/v3 from 3.5.9 to 3.5.11 #124
STOR-1722: Add support hypershift for azure-disk #73
Bump github.com/go-logr/logr from 1.3.0 to 1.4.1 #129
OCPBUGS-27267: Updating ose-azure-disk-csi-driver-operator-container image to be consistent with ART for 4.16 #132
Bump the opentelemetry-dependencies group with 2 updates #122
Bump github.com/sirupsen/logrus from 1.9.0 to 1.9.3 #123
Bump go.etcd.io/etcd/client/pkg/v3 from 3.5.9 to 3.5.11 #119
Bump github.com/fsnotify/fsnotify from 1.6.0 to 1.7.0 #120
NO-JIRA: Bump github.com/go-errors/errors from 1.4.2 to 1.5.1 #106
NO-JIRA: Bump google.golang.org/grpc from 1.59.0 to 1.60.1 #104
NO-JIRA: Bump github.com/spf13/cobra from 1.7.0 to 1.8.0 #103
NO-JIRA: Bump github.com/google/uuid from 1.3.1 to 1.5.0 #101
OCPBUGS-27056: Update to RHEL9 and go 1.21 #117
NO-JIRA: Bump the golang-dependencies group with 5 updates #109
NO-JIRA: Bump github.com/prometheus/client_golang from 1.17.0 to 1.18.0 #108
STOR-1714: AWS EBS operator: Release leadership on SIGTERM #94
NO-JIRA: Bump google.golang.org/protobuf from 1.31.0 to 1.32.0 #107
NO-JIRA: Add valid-reference label to dependabot PRs #116
OCPBUGS-27050: Updating ose-azure-disk-csi-driver-operator-container image to be consistent with ART for 4.16 #114
STOR-1713: Don’t ignore azure-disk-csi-driver-operator #110
NO-JIRA: Add dependabot configuration #97
STOR-1696: Add legacy azure disk #88
OCPBUGS-24245: Add selinux #89
OCPBUGS-25125: Add test AssetOrderer #86
OCPBUGS-25557: Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART #87
OCPBUGS-25125: Create RBAC objects first #84
OCPBUGS-24226: setting TLSSecurityProfile with no minTLSVersion crashes controller #76
NO-JIRA: Add “Quick start” section to README.md #80
STOR-1688: Chore: add .snyk file to ignore false positives #85
OCPBUGS-25147: Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART #81
OCPBUGS-23827: CVE-2023-47108: bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp to v0.46 #77
OCPBUGS-23306: Add annotation to CSI driver Pod preventing eviction from the cluster-autoscaler #79
OCPBUGS-24905: Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART #78
STOR-1500: Switch to the new operator #69
Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART #75
STOR-1402, STOR-1453: update libraries and specify TLS_MIN_VERSION #71
STOR-1400: Add support for Batch DescribeVolume #74
STOR-1400: Sync sidecar arguments with upstream #72
STOR-1500: Add log for the new operator #70
Pull the latest AWS EBS operator #67
Fix vendoring of golang.org/x/net #68
hack: remove existing path from .gitignore #65
Drop Guest prefix from client names #64
Update all generated assets in a single run #63
Verify generated assets in make verify #62
Move operator config into pkg/drivers #61
Add AWS EBS CSI driver operator starter #58
OCPBUGS-21593: CVE-2023-44487: bump golang.org/x/net to v0.17.0 #59
STOR-1455: Add asset generator #53
Delegate to aws-ebs-csi-driver-operator for tests and verify #57
Add aws ebs operator legacy #56
Add ci-operator config #54
Clean the repository, it will be reused for all CSI driver operators #52
Obsolete the operator #51
Fix hostpath image sample to support dynamic registration #47
Add kubelet-registration-path flag to csi-driver-registrar #44
Fix golint error #45
Output error message when failed to get CSIDriverDeployment and requeued #46
Add -nometadata to go-bindata to stop updating generated files by every build #43
Disable automatic installation of the operator in OpenShift #41
Pass SecurityContext to sidecar containers #40
Move EBS deployment sample to the right place #39
Use correct context timeouts #38
Add EBS sample deployment file #37
Add leader election to the operator #36
Embed git version into the operator binary #35
Generate bindata during build #34
Add more unit tests #33
Add controller unit tests #32
Fix deletion of non-namespaced objects #31
Fix e2e test #30
Add e2e test #29
Update to operator-sdk 0.1.1 #28
Fix liveness probe version #27
ADd a RHEL7 dockerfile and standardize format #26
Documentation update #23
Add unit test for validation #14
Fix status.conditions json name #11
Add CRD printer columns #12
Add configuration of liveness probe. #9
Increase resync period #10
Add /var/lib/kubelet HostPath directory to node drivers #8
Fix role bindings #7
Add liveness probe. #6
Fix operator images #5
Add OpenShift manifests to operator image #4
Use label selector for informers. #3
Use constants where appropriate #2
Add initial operator #1
And 26 elided commits (e.g. from squash or rebase merges)
Full changelog

azure-machine-controllers

OCPBUGS-103039: replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 #215
OCPBUGS-66044: Set updateDomainCount to one when faultDomainCount is one #177
OCPBUGS-52476: Remove unused vnet package #131
OCPBUGS-56169: [release-4.16] Update virtualmachines service to armcompute/v5 SDK #147
OCPBUGS-56656: Fix failure when attempting to modify immutable availabilitySet #151
OCPBUGS-56092: Update eviction policy for Spot VMs from Deallocate to Delete #142
OCPBUGS-54990: Re-reconcile machine on NIC provisioning failure #137
OCPBUGS-50966: dynamically setting the amount of fault domains #129
CFE-1050: Added support of capacity reservation group #111
OCPBUGS-29956: Remove startupScript vmextension lookup #102
OCPBUGS-28309: add an extra vendor exclude to snyk config #99
OCPBUGS-25940: Don’t create availability set when using spot instances #91
OCPCLOUD-2428: Rebase k8s to 1.29 and update dependencies #94
OCPBUGS-26122: Add Snyk file to exclude vendor directory on scan #92
OCPBUGS-23544: Improving performance of creating VMs in Azure #87
OCPBUGS-25591: Updating ose-machine-api-provider-azure-container image to be consistent with ART #90
OCPBUGS-25008: Updating ose-machine-api-provider-azure-container image to be consistent with ART #88
Full changelog

azure-workload-identity-webhook

OCPBUGS-53798: github.com/golang-jwt/jwt/v4 v4.5.2 #33
OCPBUGS-52510: github.com/go-jose/go-jose/v4 v4.0.5 #29
OCPBUGS-31283: Updating ose-azure-workload-identity-webhook-container image to be consistent with ART for 4.16 #16
OCPBUGS-30712: Update to go-jose v4.0.1 #15
OCPBUGS-26203: Upgrade golang/x/net for CVE-2023-39325 (main) #12
OCPBUGS-25777: Updating ose-azure-workload-identity-webhook-container image to be consistent with ART for 4.16 #11
OCPBUGS-25543: Updating ose-azure-workload-identity-webhook-container image to be consistent with ART #10
OCPBUGS-24854: Updating ose-azure-workload-identity-webhook-container image to be consistent with ART #8
NO-JIRA: UPSTREAM: <carry> Update OWNERS #9
Full changelog

baremetal-installer, installer, installer-altinfra, installer-artifacts

OCPBUGS-89841, OCPBUGS-89843, OCPBUGS-89847, OCPBUGS-92760: Replace golang.org/x/crypto with github.com/openshift-sustaining/crypto@v0.33.0-sec.4 #10924
OCPBUGS-127603: Update gcloud version to one that can be found #10918
OCPBUGS-67206: Update RHCOS-release-4.16 bootimage metadata to 416.94.202608150307-0 #10798
Revert “OCPBUGS-60668: Update RHCOS-release-4.16 bootimage metadata to 416.94.202601221345-0” #10846
OCPBUGS-60668: Update RHCOS-release-4.16 bootimage metadata to 416.94.202601221345-0 #10281
OCPBUGS-74885: Azure UPI ARM template: use storageAccountId #10282
OCPBUGS-76586: terraform/provider/google: Fixing GCP inconsistencies present with the service account creation #10298
OCPBUGS-73879: data/manifests/bootkube/cvo-overrides: Default to eus-4.16 #10226
OCPBUGS-54165: aws: fix NLB creation in secret regions #10031
OCPBUGS-53237: Validation for API and Ingress VIPs when using user-managed load balancer #10048
OCPBUGS-62952: Update the RHCOS 4.16 bootimage metadata #10022
OCPBUGS-62653: Release 4.16 bump terraform provider azurerm #9993
OCPBUGS-59162: vSphere - remove unit tests using nip.io #9835
OCPBUGS-62235: Make swift containers removal not fatal for UPI. #9961
OCPBUGS-58290: sort zone slices extracted from map of byo subnets #9819
OCPBUGS-55807: update resolv.conf every time on bootstrap node #9694
OCPBUGS-57460: vsphere - check if host is powered down or on standby before uploading template #9786
OCPBUGS-36677: Power VS: Enable incoming traffic on port 5000 during installation in a restricted network #8711
OCPBUGS-57498: ensure ctrplane nodes can access bootstrap MCS #9788
OCPBUGS-54240: Update timeout for GCP WaitFor operation #9715
OCPBUGS-35040: Power VS: Add ports needed for private clusters to security group #8546
OCPBUGS-54327: Remove error logging when determining image arch #9610
OCPBUGS-54345: Remove tmp directory used for agent pxe files #9611
OCPBUGS-54263: IBMCloud: Move to IBM TF openshift fork #9604
OCPBUGS-50547: aws/edge/byovpc: tag edge subnets with shared value #9482
OCPBUGS-52191: [release-4.16] capi/aws: bump provider for LB DNS lookup fix #9547
OCPBUGS-51207: Log correct hostname for validation status #9511
OCPBUGS-51111: PowerVS: destroy dhcp hack #9502
OCPBUGS-48762: Update RHCOS-release-4.16 bootimage metadata to 416.94.202501270445-0 #9478
OCPBUGS-43469: pkg/asset/installconfig/azure: send full certifcate chain #9467
OCPBUGS-49416: [Nutanix] Installation failed with timeout when uploading images to PC #9412
OCPBUGS-47663: [release-4.16] Power VS: Create region-zone-sysType hierarchy #9338
OCPBUGS-48442: Ensure rendezvousIP is checked against host IP #9369
OCPBUGS-45999: Always set cross_tenant_replication_enabled parameter to false #9321
OCPBUGS-45669: aws: fix Node Port Service rule removal #9312
OCPBUGS-45669: [release-4.16] capi/aws: remove allow-all Node Port Service #9281
OCPBUGS-39434: dropping this warning as the move from terraform is transparent to the end user #8951
OCPBUGS-45852: Update upi references to api-internal #9290
OCPBUGS-41813: Validate MTU for custom network #9104
ARO-12457: Include bootstrap docker config file in go module #9259
OCPBUGS-45181: add chrony.conf file when additional NTP sources are configured #9247
CORS-3753: Allow mocking of the Azure client everywhere #9220
OCPBUGS-44348: Cherrypick oci ccm fix to 4.16 #9188
OCPBUGS-43967: Revendor assisted service external platform oci #9150
OCPBUGS-38930: import failure when esxi config is not the same in the cluster #8898
OCPBUGS-36290: IBMCloud: Ignore failed VPC regions #8674
OCPBUGS-41885: vSphere - If template is defined skip downloading #8999
OCPBUGS-41490: Update RHCOS 4.16 bootimage metadata to 416.94.202410211619-0 #9158
OCPBUGS-43476: IBMCloud: Handle pagination for subnets #9102
OCPBUGS-41490: Update RHCOS 4.16 bootimage metadata to 416.94.202410172137-0 #9132
OCPBUGS-42014: Update terraform provider for google #9077
OCPBUGS-38732: vsphere, if secureboot is enabled, disable it in the template #8904
OCPBUGS-39415: OpenStack: Install CI dependencies from rpm #8995
OCPBUGS-41334: Fix IPv6 security group rule for schedulable master #8971
OCPBUGS-38687: only allow a single network in failure domain topology #8875
OCPBUGS-42062: OCPBUGS-41865: [release-4.16] vault version updated to 1.13.10 #9036
OCPBUGS-42012: Systemd Fails to Parse Multiline EC Keys #9037
OCPBUGS-41845: Bump extract-machine-os timout to 20m #8997
OCPBUGS-38964: IngressController subnet selection in AWS #8910
OCPBUGS-42138: add tested instance type for IBMCloud #9031
OCPBUGS-39287: Fix var_files syntax to work on older version of ansible #8936
OCPBUGS-41929: Add AWS c7g,m7g,r8g to tested instance types #9009
OCPBUGS-36855: Openstack UPI - Reintroduce unique resource names. #8724
OCPBUGS-39082: incorrect folder gen, workaround govmomi vm folder path bug #8912
OCPBUGS-39496: capi/aws/byo-vpc/multi-cidr: fix group rules #8953
OCPBUGS-36861: Updates GCP terraform worker role #8939
OCPBUGS-38956: failed to install Nutanix OCP 4.16 cluster with DHCP #8905
OCPBUGS-38822: upstream capv bug causes session timeout #8891
OCPBUGS-39468: Enable TLS for virtual media in initial ironic deployment #8955
OCPBUGS-37606: vSphere validation fails if dc is in a folder #8777
OCPBUGS-39206: Update GCP Disk Types 4.16 #8920
OCPBUGS-39087: aws: validate public-only subnets configs #8913
OCPBUGS-38821: [release-4.16] Azure: Disable shared key access when using a managed identity #8855
OCPBUGS-38302: upi/aws: update lambda runtime python version #8897
OCPBUGS-38826: aws: add support for clusters with public-only subnets #8892
OCPBUGS-38517: [release-4.16] capi/aws: bump provider for instance register fix #8848
OCPBUGS-38196: Remove timed context for gcp client #8818
OCPBUGS-38502: PowerVS: Fix mad system pool #8846
OCPBUGS-37838: fix bogus analyze message when gather fails #8794
OCPBUGS-37492: openstack: Fix security group tagging #8767
OCPBUGS-37607: bootstrap gather fails in vsphere, only ipv6 address used #8778
OCPBUGS-37494: aws: do not require create permissions when BYO IAM role #8768
OCPBUGS-37510: [release-4.16] aws: bump CAPA for subnet tagging fix #8772
OCPBUGS-37180: ic: fix typo in warning message #8769
OCPBUGS-36968: [release-4.16]: capi/aws: bump provider for ingress rules fix #8734
OCPBUGS-36965: destroy/gcp: set value for DiscardLocalSsd #8733
OCPBUGS-36720: CORS-3582: capi: remove unused feature gates #8716
OCPBUGS-36890: [release-4.16] capi: start controllers after WaitGroup is created #8726
OCPBUGS-36091: [release-4.16] bump go-retryablehttp for CVE fix #8654
OCPBUGS-36777: Cleanup capi artifacts #8719
OCPBUGS-36607: aws: remove terraform configs #8705
OCPBUGS-36324: update RHCOS 4.16 bootimage metadata to 416.94.202406282145-0 #8692
OCPBUGS-36447: capi/aws: disable EKS controller in CAPA #8694
OCPBUGS-36351: vSphere - If the folder pre-exists do not tag #8683
OCPBUGS-36286: PowerVS: Add ibmcloud plugins #8672
OCPBUGS-35818: baremetal: bootstrap: bind icc to localhost #8632
OCPBUGS-34457: [release-4.16] bump envtest binaries version #8470
OCPBUGS-35718: Fix ethertype for masters service router SG creation #8623
OCPBUGS-36156: Configured logger for controller-runtime #8657
OCPBUGS-36249: capi: shutdown local controlplane as the last step #8670
OCPBUGS-35470: add machine series ‘A3’ and ‘C3D’ to ‘Tested instance types for GCP’ #8614
OCPBUGS-35722: Support CAPI provider custom timeouts #8624
OCPBUGS-35733: [release-4.16] remove terraform libvirt from the installer #8626
OCPBUGS-35531: For GCP, only configure kmsKeyServiceAccount if set #8613
OCPBUGS-35529: capi aws: append random string in caller ref #8612
OCPBUGS-35706: capi/aws: allow 6443 for private cluster NLB #8622
OCPBUGS-35570: capi/aws: retry SSH ingress rule removal #8618
OCPBUGS-35515: SPLAT-1437: CAPI/AWS/BYOIP: supporting Public IPv4 Pool #8608
OCPBUGS-35493: Validate OnHostMaintenance and ConfidentialCompute #8606
OCPBUGS-35435: vsphere - allow network selection on cluster name #8595
OCPBUGS-35527: [release-4.16] bump github.com/container/images for CVE fix #8611
OCPBUGS-35471: capi/aws: disable CAPA’s TagUnmanagedNetworkResources feature gate #8604
OCPBUGS-35023: azure: bump profile used for network #8537
OCPBUGS-35448: [release-4.16] capi/aws: bump provider for fixes #8598
OCPBUGS-35460: save etcd data to its own directory #8600
OCPBUGS-35384: Add ELB V2 permission to set security groups on API server load balancer #8589
OCPBUGS-35344: baremetal: check if HardwareDetails is nil #8579
OCPBUGS-35392: aws: delete ignition bucket on bootstrap destroy #8590
OCPBUGS-35383: capi: use polling instead of exponential backoff #8588
OCPBUGS-35372: openstack: Attach a bootstrap FIP to the cluster network port #8585
OCPBUGS-35323: Add S3 permission to allow attaching S3 bucket policy #8576
OCPBUGS-35379: capi/aws: do not set proxy for masters #8586
OCPBUGS-35253: AWS remove extra tags from awsmachines for security groups and subnets #8569
OCPBUGS-35235: baremetal: Don’t always enable provisioning-interface.service #8563
OCPBUGS-35302: Prevent multiple invocations on CAPI #8571
OCPBUGS-35101: [release-4.16] Add 4 new regions for PowerVS #8533
OCPBUGS-35312: capi/aws: rename preserveBootstrapIgnition #8574
OCPBUGS-35192: write etcd and kube-apiserver logs #8558
OCPBUGS-34760: capi/aws: fix setting custom AMI #8520
OCPBUGS-35243: capi: do not override KUBECONFIG #8566
OCPBUGS-35224: PowerVS: Destroy DHCP in ERROR state #8561
OCPBUGS-35151: wait for ip addresses to be present on machines #8554
OCPBUGS-34499: unique AWS HostedZone Caller Ref #8476
OCPBUGS-35103: OCPBUGS-4466: Prevent cluster installation with mismatched worker assets and worker replicas #8553
OCPBUGS-35098: capi/aws: add BootstrapDestroyer guard #8552
OCPBUGS-35088: PowerVS: fix AddIPToLoadBalancerPool #8551
OCPBUGS-35030: Increase timeout for bootstrap complete #8539
OCPBUGS-35049: capi/aws: don’t use S3 stub for masters #8548
OCPBUGS-35044: aws: don’t always require s3:Delete* permissions #8547
OCPBUGS-34620: Use infrastructure API to detect cluster topology #8499
OCPBUGS-34822: [Nutanix] installer intermittent failed at uploading the bootstrap image to PC when CAPI enabled #8524
OCPBUGS-34976: [release-4.16] aws: terraform: add spot instance support for masters #8526
OCPBUGS-34707: attach tag to folder,fix folder destroy #8509
OCPBUGS-33794: Make Ingress capability required for standalone OpenShift #8528
OCPBUGS-34628: tfvars: change asset’s name #8501
OCPBUGS-34388: Add –dir /tmp to node-joiner-monitor.sh #8461
OCPBUGS-34728: [release-4.16] MULTIARCH-4076: PowerVS: Default region bug fix #8506
OCPBUGS-34693: update RHCOS 4.16 bootimage metadata to 416.94.202405291527-0 #8517
OCPBUGS-34419: PowerVS: update capi ibmcloud to release 0 8 0 #8465
OCPBUGS-34623, OCPBUGS-34625: capv - missing cores/socket,disk type #8500
OCPBUGS-34427: aws/cluster: restrict SSH on private clusters #8467
OCPBUGS-34528: Nutanix IPI install with capi failed to set bootType #8481
OCPBUGS-31845: Detect Release Image Arch in a Disconnected Env #8490
OCPBUGS-33962: [release-4.16] Remove vSphere Terraform #8431
OCPBUGS-34506: [release-4.16] bump golang-protobuf for CVE fix #8478
OCPBUGS-34417: capi/aws: don’t modify BYO role’s policy #8463
OCPBUGS-34220: Reintroduce CAPI-installer to 4.16 #8451
OCPBUGS-33976: Enable leader election for baremetal operator #8435
Trt-1674: 4.16 capi revert 1 #8434
CORS-2840: [release-4.16] GA CAPI Installer #8428
OCPBUGS-33668: Changed folder name to match cluster name instead of infra-id. #8414
AGENT-903: monitor-add-nodes should only show CSRs matching node #8376
CORS-3480: aws/sdk: remove sdk provisioner #8358
CORS-3460: Always collect clusterapi manifests #8411
OCPBUGS-33709: GCP mixup when using the ignition shim vs the signed url #8342
CORS-3297: Add GCP firewall rule to access bootstrap node via ssh #8374
CORS-2905: capi-aws delete bootstrap ssh rule #8359
OCPBUGS-33370: baremetal: always write masters file #8365
OCPBUGS-33531: update RHCOS 4.16 bootimage metadata to 416.94.202405132047-0 #8409
no-jira: Vendor api changes for tech preview with capg #8407
CORS-3269: Azure ignite control plane machines #8126
OCPBUGS-31017: aws: add missing permission for IPv4 pools #8408
OCPBUGS-33649: add quota support to ca-west-1 #8406
CORS-3460: capi: collect generated assets in hidden dir and save into log bundle #8387
OCPBUGS-33006: baremetal: aarch64-related fixes #8385
OCPBUGS-33610: fix API detection, azure bootstrap disk size, and use get to verify endpoint #8371
no-jira: Removing unused terraform variables #8360
OCPBUGS-33502: capi/aws: fix setting IMDSv2 value #8399
CORS-3516: hack: do not execute cross-compiled binaries #8397
OCPBUGS-33578: capi/aws: fix HostedZone ID lookup #8396
OCPBUGS-30860: improve bootstrap logic to wait for at least 2 apiserver instances #8394
OKD-213: Reference stream-coreos instead of centos-stream-coreos-9 #8356
OCPBUGS-33470: use read/write cache on azure masters #8380
no-jira: AzureMachines: set disk caching to ReadWrite #8390
AGENT-863: Change $@ to “$*” to fix shellcheck #8402
OCPBUGS-33481: set the node tag used by CAPG for CloudProviderConfig #8386
OCPBUGS-23022: Installer should not complain when API and API-INT are resolved. #7701
no-jira: vendor: capi-installer in tech preview #8372
CORS-2895: capa/machines: fix zone placement for control planes #8347
OCPBUGS-32947: Changed vsphere CPMS to not include fields controlled by failure domains. #8354
AGENT-872: Generate JWT token #8110
no-jira: vSphere - update owners aliases #8384
AGENT-906: Script to run monitor-add-nodes in cluster #8294
OCPBUGS-33430: Fix CAPI installation typo #8375
CORS-3471: standalone destroy bootstrap support with capi #8350
CORS-3477: hack: build capi + providers by default #8357
OCPBUGS-33189: OCPBUGS-33006: baremetal: correct libvirt defaults #8366
OCPBUGS-33157: baremetal: pause provisioning #8346
NO-ISSUE: baremetal: disable bmo webhook on bootstrap #8340
OCPBUGS-33240: avoid FAT32 error messages when generating the agent ISO #8353
no-jira: Private domains in survey for PowerVS #8303
CORS-3250: images: use pre-built KAS/etcd binaries #8343
SPLAT-1599: Convert storage policy id to SpbmStoragePolicy. #8352
no-jira: Power VS: Refactor InfraReady to use metadata client #8337
CORS-3466: CAPG set instance group name #8314
MULTIARCH-4633: Power VS: Configure load balancers for the private scenario #8331
OCPBUGS-26216: Fix parameter used to disable smt for ppc64 systems #8178
COS-2744: update RHCOS 4.16 bootimage metadata to 416.94.202404301731-0 #8335
METAL-872: baremetal: write masters.json file #8336
no-jira: azure: Add securityProfile to control plane machines #8334
no-jira: CAPI-Install Feature Gates per Platform #8311
SPLAT-1599: Added support for secure boot and storage policies to UPI pwsh. #8328
CORS-2797: images: move container images to RHEL 9 #8196
AGENT-864: cleanup dnf cache after installing node-joiner reqs #8329
OCPBUGS-32981: baremetal: use ControlPlane.Replicas #8322
AGENT-863: docs fix #8325
OCPBUGS-33006: baremetal: set bootstrap domain arch #8317
OCPBUGS-33024: agent: escape ‘%’ in proxy settings #8320
AGENT-863: fix oc dependency in installer images #8326
OCPBUGS-29968: Generate ZTP manifests with correct Group/Version/Kind metadata #8068
CORS-3437: infra/capi: add provisioning timeout #8307
SPLAT-1596: Created new function to workaround issue with Set-HardDisk. #8315
CORS-3214: capi-aws - Wavelength Zones network provisioning #8174
AGENT-863: node-joiner cluster script #8242
OSASINFRA-3434: Use cluster-api-provider-openstack v0.10 and CAPO v1beta1 manifests #8021
CORS-2893: capi-aws: implement preserveBootstrapIgnition #8313
OCPBUGS-4466: Add check for compact-cluster install on GCP, AWS & Azure #8226
CORS-3250: images/altinfra: add etcd/kas binaries from containers #8309
CORS-2899: AWS/CAPI Local Zones network provisioning #8173
OCPBUGS-32981: baremetal: template the number of master nodes #8316
OCPBUGS-32519: Fix appliance CI jobs #8297
OCPBUGS-31017: fix ec2:DisassociateAddress requirement #8296
OCPBUGS-32292: Remove deprecated replace directives #8271
no-jira: PowerVS: Update CAPI IBMcloud to 188d9e99 #8310
CORS-3076: azure: Add additional tags to AzureCluster #8301
CORS-3294: CAPA health check configuration for control plane ELBv2 #8223
CORS-3470: capi/aws: add custom endpoint support. #8306
MULTIARCH-4111: Updating CI image to include qemu-kvm #8312
MULTIARCH-4616: Power VS: Add ServiceEndpoints for endpoint overrides #8292
no-jira: cluster-api/aws: bump capa to latest version #8288
OCPBUGS-32306: GCP Destroy find regional and global addresses #8275
OCPBUGS-32517: Ensure worker BMH’s get unpaused #8299
OCPBUGS-32591: GCP Destroy target pools fix misleading log #8298
CORS-3260: CAPI: Create GCP Internal LB #8151
OCPBUGS-15845: Check host for compatibility with target cluster config #7566
no-jira: bump golangci lint to 1.54.2 #8291
OCPBUGS-32425: Test for the presence of “provisioned” server #8289
SPLAT-1585: capv - allow no auth to vcenter #8276
SPLAT-1208: replace UPI terraform with powercli #7699
OCPBUGS-29765: Fills CIS or DNS CRN in Metadata, never both #8057
OCPBUGS-32042: fix usage of addtionalTrustBundle field #8253
METAL-872: Remove terraform libvirt provider #8160
MULTIARCH-4549: Logic for creating private DNS records for PowerVS CAPI #8246
OCPSTRAT-915: Nutanix capi support #8211
OCPBUGS-32133: GCP: Fixing GCP Bootstraping #8248
METAL-939: baremetal: monitor bootstrap process #8181
no-jira: gather: replace deprecated errors package #8280
no-jira: azure: Update capz version to 1.14.2 #8268
OCPBUGS-31017: aws: add ec2:DisassociateAddress permission #8247
OCPBUGS-31563: sdk/aws: add ssh security group rule for compute #8229
MULTIARCH-4550: Power VS: Use a custom resolver when publish strategy is Internal #8243
MULTIARCH-2678, OCPBUGS-14478: Refactored updateIgnitionImg to use NewIgnitionImageReader from isoeditor to support s390x #8205
CORS-3050: capi/aws: copy AMI to target region, if needed #8157
SPLAT-1592: bump capv to v1.9.3 #8267
OCPBUGS-30774: always save serial logs if they were gathered #8263
CORS-3261: GCP cluster api add disk encryption #8222
CORS-3419, OCPBUGS-30941: Include baremetal IPI in openshift-installer #8161
no-jira: PowerVS: Open port 10258 #8261
OCPBUGS-31711: AWS update explain docs #8258
OCPBUGS-27965: escape ‘%’ in proxy settings #8265
OCPBUGS-32174: save correct bootstrap public IP #8264
CORS-3420: Remove libvirt platform from openshift-baremetal-install #8244
no-jira: capi: replace deprecated --metrics-bind-addr arg #8251
CORS-3436: capi: save log output to file #8218
no-jira: PowerVS: Add destroy Power Server subnets #8260
OCPBUGS-32091: Add Top-level Context for Create Commands #8063
CORS-3063: Support control plane disk encryption #8124
CORS-3269: Azure CAPI Ignite Bootstrap #8255
no-jira: PowerVS: add AddIPToLoadBalancerPool #8257
SPLAT-1293: Bump API version to promote vSphereStaticIPs from TechPreview. #7943
no-jira: capi/aws: bump controller log level to debug #8252
CORS-3254: Update google.golang.org/api/cloudresourcemanager library version #8213
MULTIARCH-4111: Update the CI image with virt-install #8259
CORS-3218: GCP Remove the use case of users passing contents for json secret data #8234
OCPBUGS-27844: Fix task for attaching IPv6 subnet to router. #8087
CORS-3270: azure: tag installer-created LB resources #8236
OCPBUGS-31813: AWS: bump CCO for permission fix #8233
CORS-3289, CORS-3308, CORS-3426: Bump CAPA provider for various fixes #8232
OCPBUGS-32041: update RHCOS 4.16 bootimage metadata to 416.94.202404101051-0 #8256
no-jira: docs: Fix typos #8245
no-jira:PowerVS: Wait for IPs #8239
CORS-3075: Allow for installation in existing resource group #8123
CORS-3446: Add instructions for obtaining correct binary #8230
AGENT-858: Agent day2 ignition services #8093
CORS-3418: images: move installer images to static builds #8215
CORS-3417: capi/aws: support ignition proxy and CA bundle #8170
OSASINFRA-3365: clusterapi: Add worker asset to PreProvision #8237
HIVE-2476: OpenStack.MachineSets(): Allow nil Replicas #8227
CORS-3195: Azure CAPI Supplemental Load Balancers #8115
no-jira: PowerVS: Set VPC service region #8217
OCPBUGS-12890: Create bucket, signed url and use proxy info for installs #8056
no-jira: PowerVS: Fix COS region and VPC subnets #8219
OCPBUGS-31546: azure: use filter when listing SKUs #8134
CORS-3245: Azure CAPI rhcos image #8018
AGENT-874: use AddNodesConfig asset #8080
no-jira: this clusterprofile isn’t actually used #8214
no-jira: pkg/asset/machines: remove static ip log lines #8190
CORS-2895: aws/capi: setting zones to when creating cluster #8156
CORS-3071: Create DNS entries for CAPZ implementation #8045
no-jira: PowerVS: Fix CAPI created service instance case #8212
AGENT-857: Agent day2 use clusterinfo #8009
CORS-3431: CAPI: Add firewall rule for worker nodes #8200
OSASINFRA-3421: OpenStack: Customizable clientOpts for CheckNetworkEx… #8209
no-jira: infra: aws: move SDK provisioner to its own dir #8194
AGENT-868: Generate ECDSA public private keys and pass it to assisted service #8105
MULTIARCH-4096: PowerVS: Generate the cluster assets #8116
CORS-2901, CORS-3428: pkg/types/aws: limit additionalSecurityGroups to 10 #8184
OCPBUGS-27848: If host is offline or disconnected don’t check ver #8206
METAL-855: baremetal: remove ironic-inspector #8128
CORS-3280: Bump cluster-api-provider-gcp to v1.6.0 #8153
OSASINFRA-3420: openstack: Decouple OpenStack API calls from Machine generation #8187
CORS-2898: capi/aws: configure IMDS #8152
CORS-2905: capi/aws: destroy CAPA resources #8179
no-jira: capi/aws: reuse GenerateMachines for bootstrap #8193
OCPBUGS-31209: CAPG - Fix setting ServiceAccount role bindings for GCP #8192
OCPBUGS-31050: openstack: Honour worker server group policy #8180
OCPBUGS-26052: aws: altinfra: fix role creation in C2S #7871
OCPBUGS-15941: ABI - Validate release image arch, add cpu_architectures to RELEASE_IMAGES #7349
CORS-3256: GCP destroy updates for CAPG #8113
Bug OCPBUGS-30154: OpenStack: enable 30000:32767 nodePort IPv6 traffic #8195
OCPBUGS-30882: GCP capg distribute instances across zones #8176
CORS-3142: capi: write manifests to disk during create manifests #8166
OCPBUGS-28870: IBMCloud: Restrict CIS and DNS Service lookup #7987
OCPBUGS-31013: Fix vsi image missing #8177
CNF-10170: bootkube.sh: Render kernel boot arguments for SNO #8099
CORS-2894, CORS-3051: Create DNS resources and PHZ for CAPI/aws #8142
CORS-3417: capa bump fallout #8169
CORS-3307: add ‘A2’ as tested machine types on GCP #8148
CORS-2902: capi/aws: add ext-LB as CAPA secondary LB #8149
CORS-3213: Tweak GCPCluster Failure Domain Logic #8017
CORS-3215: capi: implement bootstrap gather #8036
NO-JIRA: OWNERS: pkg/infrastructure/openstack #8165
OPNET-476: GA Load balancer feature for vSphere and Baremetal #8101
no-jira: Power VS: Fix comment on default for wait_for_workspace #8158
OPNET-476: GA Load balancer feature for Nutanix #8102
CORS-3303: GCP: Add me-central2 (Dammam, Saudi Arabia, Middle East) region to the survey as supported region #8132
SPLAT-1390: remove feature gate for vSphere control plane machinesets #7908
CORS-2892: capi/aws: add user tags to CAPA cluster #8150
OCPBUGS-30836: Power VS: Fix wait_for_workspace #8145
OCPBUGS-25462: Validate control plane replicas #8082
OCPBUGS-30642: pin google oauth2 version #8133
OCPBUGS-30600: update RHCOS 4.16 bootimage metadata to 416.94.202403071059-0 #8121
CORS-3257: Create GCP ServiceAccounts and assign to machines #8066
OCPBUGS-15861: Use a static pure-go libvirt library #7252
OCPBUGS-29437, OCPBUGS-30547: Run kubelet directly #8131
METAL-871: baremetal: remove ironic tf files #8117
OCPBUGS-30641: Enable deploy by Service ID on PowerVS #8111
CORS-3288: bump CAPA for LB scheme fix #8114
no-jira: machines/aws: fix subnet filter comment #8120
METAL-871: baremetal: bootstrap: rename master label #8107
OCPBUGS-29388: upi: aws: fix typo in worker templates #8112
OSASINFRA-3362: Fix CAPI bootstrap deletion #8104
OCPBUGS-24415, OCPVE-661: bump openshift/api version #7546
MULTIARCH-4095: Generate PowerVS machine manifests for CAPI #8020
CORS-2900: CAPI AWS IAM #8031
OCPBUGS-30200: Authn with platform-services-go-sdk for PowerVS #8025
CORS-3281: IBMCloud: initial CAPI infrastructure #8090
CORS-2890: Bump CAPA Dependencies for Secondary Load Balancers #8088
SPLAT-1460: Make vSphere default ResourcePool formatting not contain double slash. #8044
CORS-3212: CAPG Add ignition for CAPG machines #8027
METAL-871: Remove terraform-provider-ironic #7649
SPLAT-1468: Added log message for import vsphere ova progress during CAPI install. #8097
no-jira: capi: aws: report all conflicting user tags at once #8085
OCPBUGS-29469: fix Azure API SKU calls timing out - part 2 #8070
SPLAT-1423: Added static ip support to CAPI installer. #8081
MULTIARCH-4159: Updated libvirt installer to include multi-arch yq and symlink for backwards compatibility #8098
OCPBUGS-30058: GCP: The CAPG bootstrap machine IP should be set according to the publish strategy #8079
OCPBUGS-30057: Don’t auto create subnets for CAPG #8083
MULTIARCH-4153: Incorporating Eltorito Boot Loader fix for Agent #8069
no-jira: Missing permission from vsphere docs #7789
OCPBUGS-30135: fix “OpenShiftSDN deprecated” error message #8092
CORS-3274: GCP: add africa-south1 region to the survey as supported region #8055
CORS-3251: Create capz machine manifests #7969
CORS-3259: GCP CAPI Infra: auth with service account #8077
CFE-857: Apply user defined tags on created gcp resources #7279
AGENT-853: Add ClusterInfo asset #7997
SPLAT-1173: Enhance vSphere Installer to use IPAddressClaims for static IP #7501
CORS-3273: capi system: don’t log env vars #8084
OCPBUGS-29860: double looping of failuredomains breaks zonal #8059
no-jira: Remove v1alpha3 #8061
OCPBUGS-30005: remove github.com/IBM-Cloud/bluemix-go/api/account/accountv2 #8072
OSASINFRA-3363: ShiftStack CAPO integration #7939
MULTIARCH-4158: pkg/infrastructure/powervs: add initial CAPI provider #8060
OCPBUGS-29469: fix Azure API SKU calls timing out #8046
SPLAT-1459: capv machines only full clone #8042
OCPBUGS-29895: PowerVS: Add debugging to ServiceInstanceNameToGUID #8058
SPLAT-1434: aws: add support of BYO public ipv4 pool #7983
no-jira: images: libvirt: add oc to libvirt CI image #8008
SPLAT-1465: capv - add additional extra configs #8054
SPLAT-1462: capv - Remove unneeded auth env vars #8053
OCPBUGS-29429: feat: add check for SNO bootstrap condition #8004
Bug OCPBUGS-29084: OpenStack: Fix dualstack with external load-balancer #8028
CORS-3259: GCP: Create DNS records and internal load balancer for CAPG Install #8014
SPLAT-1198: migrate vSphere installation to CAPV #7962
OCPBUGS-29587: Power VS: Fix service instance list #8033
OCPBUGS-22410: vsphere-fix convert if only provided name #7931
OCPBUGS-29584: PowerVS: handle composite_instance #8029
OCPBUGS-29482: Bump terraform-provider-ibm to v1.61.0 #8023
CORS-2890: pkg/infrastructure/aws: add initial CAPI provider #8012
CORS-3185: update default release image #7874
OCPBUGS-28590: gcp: better error msg when service accnt missing #8002
OCPBUGS-28203: Power VS: Add sleep to allow workspace to configure PER #7889
CORS-3220: Initiate CAPG installation #8011
CORS-3213: Create the GCP cluster manifest #7917
OCPBUGS-29441: update RHCOS 4.16 bootimage metadata to 416.94.202402130130-0 #8015
OCPBUGS-29425: PowerVS Fix next start search #8010
Bug OCPBUGS-29198: OpenStack: fix controlPlanePort validation #7998
SPLAT-1447: Move MCO imports to API; update library-go, api #8000
NO-ISSUE: integrationt tests support for env vars substitution #7992
OCPBUGS-29114: Fixed control plane machine set handling of static IPs when AddressesFromPools is not in use. #7985
OCPBUGS-29068: GCP: Skip validation of public and private zones for terraform vars #7986
OCPBUGS-29067: Copy GCP manifests within MCO bootstrap to the correct location #7991
OCPBUGS-20085: IBMCloud: Handle disk delete errors #7515
OCPBUGS-28827: do not rename boot.catalog for arm64 iso #7972
OSASINFRA-3371: Pass rhcosImage and manifests to the PreProvision hook #7967
SPLAT-1387: enable additional tags to be associated with vsphere machines #7905
CORS-3242: PowerVS: Replace deprecated primary_ipv4_address with primary_ip list item #7861
OPNET-357: Populate network configuration at install-time #7604
CORS-3240: add OWNERS_ALIASES madhu-pillai #7733
CNF-10170: Revert “bootkube.sh: Render kernel boot arguments for SNO” #7979
CORS-3188: Bump k8s deps #7970
OCPBUGS-2135: Include CAPG objects in uninstall filter #7907
AGENT-848: add node-joiner cli tool main #7958
CORS-3207: Generate GCP machine manifests for CAPI #7944
OCPBUGS-24575: ic: gcp: validate instance architecture #7850
CORS-3196: capg: add infrastructure components #7968
CORS-3208: Create the GCP infrastructure controller #7940
OCPBUGS-27156: GCP Destroy cleanup correct zones/records #7932
OCPBUGS-27737: aws-edge-zones preventing err before discovering #7945
OCPBUGS-28708: update tested Azure Arm64 instance type on 4.15 #7965
OCPBUGS-28643: PowerVS: Add dal12 region #7956
OCPBUGS-27263: Bump golang 1.21 #7925
CNF-10170: bootkube.sh: Render kernel boot arguments for SNO #7692
OCPBUGS-28705: [azure] update tested x86 instance type on 4.15 #7961
CORS-3139: Move CAPI behind infrastructure provider interface #7824
OCPBUGS-27507: bump containerd for vulnerability fix #7942
NO-ISSUE: test fix to support slightly different nmstate error messages #7954
NO-JIRA: Minor fixes #7947
no-jira: azure: add metadata info to resource group tags #7725
OCPBUGS-25453: duplicate failure domains in CMPS #7860
OCPBUGS-27788: PowerVS: COS region configurable #7941
SPLAT-1345: Remove alibaba #7832
OCPBUGS-27366: set the –cluster-profile flag for openshift/api rendering #7924
OCPBUGS-27192: remove retired serial NCv2 from azure tested instance type list on x86 #7911
no-jira: images/altinfra: allow CAPI ARG #7891
OCPBUGS-25835: Validate baremetal capability is set for baremetal platform #7901
no-jira: Add AWS m6a to tested instance types #7851
OCPBUGS-24956: Fix typo in CloudCredential validation #7915
OCPBUGS-24303: Check provided sha for agent ISO download #7893
CORS-3203: Fix depreciated typo #7834
OCPBUGS-14257: normalize ISO files extensions to three chars #7896
OCPBUGS-26434: Redact platform passwords in agent-gather output #7873
OCPBUGS-27092: baremetal: gather all recently refactored services #7854
OCPBUGS-25996: baremetal: correct external_http_url for v6-only BMCs #7898
CORS-2950: Remove openshift-sdn as an install-time option #7720
OPNET-415: Upgrade o/api to include extended network config #7869
METAL-829: Set node cpu_arch from bmh #7814
OCPBUGS-26399: Support singular VIP in ACI for BareMetal #7859
CORS-3190: GCP: Add load balancer info to cluster infra #7888
MULTIARCH-4072: Power VS: Add eu-de-1, eu-de-2, sao04, and wdc07 as supported zones #7870
OCPBUGS-24956: Add cloud credential capability validation #7884
OCPBUGS-25841: preserve category name when trying to find tag category #7876
ARO-4744: Do not run platform validation on ARO #7865
OCPBUGS-24956: Add cloud credential capability validation #7875
OSASINFRA-3280: OpenStack: clarify root volume size requirements #7698
OCPBUGS-26048: Bump default channel to stable-4.16 #7867
OCPBUGS-24862: Updating ose-installer-altinfra-container image to be … #7872
CORS-2852: cmd/create: allow clean shutdown of resources #7864
OCPBUGS-24820: Updating ose-baremetal-installer-container image to be consistent with ART #7817
OCPBUGS-24814: Updating ose-installer-container image to be consistent with ART #7816
OCPBUGS-25600: aws: validate instance arch #7835
OCPBUGS-25440: ic: aws: add iam:TagInstanceProfile permission requirement #7843
OCPBUGS-25132: Fixes for the OpensStack UPI playbooks. #7833
OCPBUGS-24853: Updating ose-installer-artifacts-container image to be consistent with ART #7818
OCPBUGS-19054: Warn that FeatureSet is not supported #7825
CORS-2315: GCP: Skip populating Private/Public Zones within DNS manifest #7846
no-jira: build: drop vsphereprivate build workaround #7847
CORS-2870: build: only rebuild terraform providers if needed #7688
OCPBUGS-24473: IBMCloud: Set IBM TF visibility based on URLs #7805
CORS-3029: GCP: Update DNSType within GCP PlatformStatus based on UserProvisionedDNS #7837
OCPBUGS-24241: Pin openstack.cloud version. #7821
Revert “OCPBUGS-4038: bootstrap: Skip gatewayd units only on OKD agent-installer” #7651
no-jira: Revert “Merge pull request #7823 from patrickdillon/build-capi-altinfra” #7828
OCPBUGS-19303: Changed OKD/FCOS workaround to also support Agent-based Installer #7484
OCPBUGS-25191: ic: azure: fix retrieving marketplace image #7826
OCPBUGS-24995: Revert “Merge pull request #7642 from AnnaZivkovic/azure_duplicate_im… #7822
CORS-2840: images/altinfra: enable CAPI builds #7823
CORS-3003: [ibmcloud] add key-protect plugin in ibmcloud cli #7811
CORS-2852: Support installing OpenShift via Cluster API #7807
SPLAT-1272: Modify the terraform variables to support Nutanix Failure Domains #7806
And 3 elided commits (e.g. from squash or rebase merges)
Full changelog

baremetal-machine-controllers

OCPBUGS-78099: [release-4.16] fix vendor/ for hermetic migration 4.16 #243
OCPBUGS-46645: Bump x/net to 0.33.0 #226
OCPBUGS-30477: Bump golang-protobuf version #213
OCPBUGS-28835: Extend metal3remediation aggregation role #209
OCPBUGS-25561: Updating baremetal-machine-controller-container image to be consistent with ART #208
OCPBUGS-25159: Updating baremetal-machine-controller-container image to be consistent with ART #207
OCPBUGS-24919: Updating baremetal-machine-controller-container image to be consistent with ART #206
Full changelog

baremetal-operator

OCPBUGS-77278: Unblock BMH direct deletion when detached annotation is present #463
OCPBUGS-53322: BMO can expose any secret via BMCEventSubscription CRD #407
OCPBUGS-49703: Handle HFC for non-redfish HW #396
OCPBUGS-39490: Disallow fetching secrets from namespaces different from the host’s one #378
OCPBUGS-38938: [OCP] Ability to disable agent power off after deployment #372
OCPBUGS-37765: HostFirmwareComponents doesn’t show the new firmware information in Status Components #355
OCPBUGS-37262: fix(redfish): set correct idrac-redfish management interface #366
OCPBUGS-36673: [4.16] Firmware Update causes BMH to get stuck in Preparing #363
OCPBUGS-33254: Merge upstream #354
NO-ISSUE: Revert “downstream-only: Disable webhooks” #335
OCPBUGS-33048: PreprovisioningImage should not be created on poweroff #349
NO-ISSUE: Sync upstream April 29 #348
NO-ISSUE: Merge upstream #347
NO-ISSUE: Sync with upstream #344
NO-ISSUE: Merge upstream #340
NO-ISSUE: Update OWNERS #339
METAL-866: Merge upstream #336
NO-ISSUE: Merge upstream (2024.02.02) #330
OCPBUGS-27825: Merge upstream #329
OCPBUGS-25567: Updating ose-baremetal-operator-container image to be consistent with ART #328
OCPBUGS-24935: Updating ose-baremetal-operator-container image to be consistent with ART #327
Full changelog

baremetal-runtimecfg

OCPBUGS-60113: Re-add ENABLE_NODEIP_DEBUG env var #362
OCPBUGS-35891: Change mechanism of debug flag #323
OCPBUGS-35743: Fix handling of ELB Node IP detection #320
OCPBUGS-35486: Add support for OVN HostCidrs annotation #318
OCPBUGS-29067: Fix generation of DNSUpstreams on cloud platforms #308
NO-ISSUE: Fix wrong golang version, bump to 1.21 #311
Revert “OCPBUGS-32348: Make log level configurable” #310
OCPBUGS-32348: Make log level configurable #305
OCPBUGS-29067: Do not add VRRP config to Node on Cloud Platforms #303
OCPBUGS-29931: Updating ose-baremetal-runtimecfg-container image to be consistent with ART for 4.16 #300
OCPBUGS-29919: Decrease log level when detecting node IP #301
OCPBUGS-29095: Ignore egress IP when selecting Node IP #298
OCPBUGS-24865: Updating ose-baremetal-runtimecfg-container image to be consistent with ART #291
NO-ISSUE: Upgrade k8s api and client-go deps #297
OCPBUGS-26765: Add .snyk file to ignore vendor and test files #292
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-102912, OCPBUGS-102935, OCPBUGS-103104: Use patched x/net fork v0.35.0-sec.4 #2416
OCPBUGS-91215, OCPBUGS-91552, OCPBUGS-91589: Bump golang.org/x/net to openshift-sustaining/net v0.35.0-sec.2 #2346
OCPBUGS-111894: Fix pre-existing unit test failures #2374
OCPBUGS-64616: Help with must-gather scheduling through suggesting preferance of nodes #2151
OCPBUGS-64561: Update go-jose, x/crypto, x/net #2144
OCPBUGS-59938: Adding sos.conf file for default sos config into the tools image #2064
OCPBUGS-60675: Use fedora image in unit tests instead of centos #2079
OCPBUGS-51043: Add HOST env var in oc debug for sos report collects more #1977
OCPBUGS-42720: Check cast result in adm prune deployments to prevent panic #1891
OCPBUGS-39341: Ignore pruning when deployment points to replicationcontroller #1862
OCPBUGS-37853: Revert “OCPBUGS-35994: pkg/cli/admin/upgrade/rollback: Drop this command” #1839
OCPBUGS-31639: Bump k8s dependencies to 1.29.7 #1824
OCPBUGS-36764: pkg/cli/admin/upgrade/rollback: Drop this command #1820
OCPBUGS-36328: Set required-scc annotation to privileged for node debug pods #1816
OCPBUGS-36379: bump(k8s)=1.29.6 #1810
OCPBUGS-35924: upgrade status: control plane completion estimate #1804
OCPBUGS-34886: Hardcode resource groups/kinds for now #1796
OCPBUGS-33917: add alert data to upgrade health in oc adm upgrade status #1794
OCPBUGS-33975: pkg/cli/admin/upgrade/rollback: Gate on OC_ENABLE_CMD_UPGRADE_ROLLBACK #1776
OCPBUGS-34406: Simplify output when not updating #1781
OCPBUGS-33918: adm update status: Show information about the upgrade target version #1772
OCPBUGS-33916: Add s390x based oc into extraction target #1770
OCPNODE-2281: Support multiple icsps in migrate icsp #1751
OCPNODE-2282: Support multiple ImageDigestMirrorSet objects in the th… #1756
OTA-1275: cli/admin/release/git: use optimized git flags #1754
WRKLDS-1251: Switch cli image to RHEL9 base image #1752
OTA-1154: pkg/cli/admin/upgrade/status: Drop free-form Progressing output line #1753
OTA-1279: pkg/cli/admin/upgrade/status: Move Failing from free-form to updateInsight #1744
OCPBUGS-32841: Bump go-jose indirect reference to 2.6.3 #1747
OTA-1174: update status: unify on --details #1748
OCPBUGS-32786: Improve error message when binary is not in target list #1746
OCPBUGS-32080: release: extract ccoctl.rhel8 and ccoctl.rhel9 #1734
OTA-1174: upgrade status: Show resources in --details=health #1737
OTA-1155: update status: Simplify CO status line #1741
OCPBUGS-20097: Migrate tools image to RHEL9 #1652
NO-JIRA: Print an error msg instead of panicking when all image manifests are filtered out #1729
WRKLDS-1190: oc adm must-gather: print timestamp when logging in fallback mode #1738
OTA-1202: Changing the conditional risk to known issues #1739
OTA-1174: upgrade status: Expand health insights with --detailed=health #1736
OTA-1174: upgrade status: add --detailed=nodes that shows all nodes #1735
MCO-1056: MCO-1057: Implement oc adm prune machineconfigs command #1723
NO-JIRA: Report tests for feature #1728
OTA-1036: adm update status: Refactor node status #1732
OTA-1036: adm upgrade status: Add control plane nodes status #1731
OCPBUGS-31498: Add OIDC specific certificate authority bundle flag #1720
WRKLDS-1171: Add openshift-install-fips target to oc release extract #1725
OCPBUGS-31615: Add help text the behavior of filter-by-os against single image #1721
make output table slightly easier to read #1719
NO-JIRA: update featuregate diff for clusterprofiles #1714
WRKLDS-1128: revert cli/admin/release/git: use optimized git flags #1718
OCPBUGS-31484: Remove some of newapp unit tests relying on external deprecated images #1717
WRKLDS-1128: cli/admin/release/git: use optimized git flags #1708
WRKLDS-1076: oc idle: Remove redundant endpoint resource modification #1692
OCPBUGS-30703: Bump coreos/go-oidc to 3.10.0 #1713
WRKLDS-1103: tools: extend the image with sosreport #1704
OTA-1165: adm upgrade status: Add Worker Node Status #1689
OCPBUGS-29623: Introduce certificate-authority flag for image related commands #1693
OCPBUGS-30212: oc adm catalog mirror: use ToSlash and FromSlash to unify the path separators #1680
OCPBUGS-30244: Add images mismatching kubectl version into warning to track #1695
OCPBUGS-30162: Introduce –issuer-url flag in oc login #1694
NO-JIRA: Bump k8s dependencies to 1.29.1 #1684
OCPBUGS-23386: Extract oc also for linux/ppc64le #1691
OTA-1080: pkg/cli/admin/inspectalerts: New tech-preview inspect-alerts subcommand #1674
OCPBUGS-29210: Update some commands incorrect examples #1686
NO-JIRA: Print log rather than returning an error when kubectl version mistmaches #1685
Do not force the ancient OS version dist tag. #1536
TRT-1503: Tools image no longer has python;adding #1682
Revert “NO-JIRA: Bump k8s dependencies to 1.29.1” #1683
NO-JIRA: Bump k8s dependencies to 1.29.1 #1681
OCPBUGS-29039: fix copy-to-node #1679
OCPBUGS-28540: Copy oc.rhel8 instead of symlink #1669
OCPBUGS-27732: Bump joelanford/ignore to bump go-git to 5.11.0 #1671
WRKLDS-1016: Bump kube dependencies to 1.29.0 #1661
OCPBUGS-27957: pkg/cli/admin/inspect: use since/since-time for previous container logs #1666
NO-JIRA: Fix –parallelism flag formatting in help #1664
NO-JIRA: pkg/cli/admin/inspect: format RFC3339 parse error #1663
OCPBUGS-28230: add FallbackToLogsOnError for easier debugging #1667
OCPBUGS-27489: Use correct hash sum of extracted tarball after re-signing with codesign #1659
NO-JIRA: Simplified kubectl component version check #1662
CNV-37284: Add –all-images flag to must-gather #1633
Revert “WRKLDS-1016: Bump kube dependencies to 1.29.0” #1660
WRKLDS-1016: Bump kube dependencies to 1.29.0 #1655
NO-JIRA: Consider kubectl version checks only from cli and cli-artifact images #1656
WRKLDS-998: oc login: Built-in cred exec plugin implementation and wiring #1640
NO-JIRA: adm update status: add TODOs to remind us to revise early decisions #1654
WRKLDS-1012: oc adm must-gather: pull gather container logs #1641
WRKLDS-950: add since and since-time flags to limit log collection on must-gather #1648
WRKLDS-1010: pkg/cli/admin/inspect: use since/since-time for rotated logs #1653
NO-ISSUE: add information about featuregate diff in a particular release #1650
NO-JIRA: report kubectl version to the release controller #1651
OCPBUGS-25461: Add RHEL9 and RHEL8 based oc as new targets in command extraction #1647
OTA-1087: Add upgade health section to adm update status #1636
OCPBUGS-19807: pkg/cli/admin/release/extract: Log a warning on –credentials-requests without –included #1551
NO-JIRA: Sanitize path using filepath Clean #1645
OTA-492: pkg/cli/admin/upgrade/rollback: New rollback command #1642
NO-JIRA: oc adm prune images: fix –certificate-authority flag name in validation code #1644
OCPBUGS-25703: validate tag name on creation #1643
NO-JIRA: Migrate from deprecated ioutils to relevant libraries #1602
OCPBUGS-23386: Generate FIPS compatible RHEL9 oc binary #1632
OCPBUGS-25021: Bump ocp images to 4.16 in addition to go 1.21 #1628
OCPNODE-1656: oc release extract: Introduce –idms-file and deprecate icsp-file #1624
OCPBUGS-24834: Bump api to include the new CloudCredential cap #1622
OCPBUGS-24225: Remove deprecated password defaulting in default config flag #1619
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

cloud-credential-operator

OCPBUGS-81849: Bump go-jose/go-jose/v4@v4.1.4 #1040
OCPBUGS-79941: Bump google.golang.org/grpc to v1.79.3 #1026
OCPBUGS-65802: ccoctl azure: retry custom role creation on consistency errors #952
OCPBUGS-63550: ccoctl: add public-key-file flag to create-all #940
OCPBUGS-55129: snyk to ignore SNYK-GOLANG-GOLANGORGXNETHTML-9572088 #918
OCPBUGS-60973: ccoctl: aws to use proper issuer url on subsequent runs #909
OCPBUGS-60861: ccoctl: only add owned tag to azure resources on create #902
OCPBUGS-58676: github.com/golang/glog v1.2.5 #893
OCPBUGS-56981: Azure: resolve nil pointer exception when role assignment exists #867
OCPBUGS-53416: github.com/golang/glog v1.2.4 #843
OCPBUGS-53822: update github.com/golang-jwt/jwt #839
OCPBUGS-51544: Ignore SNYK-GOLANG-GOLANGORGXOAUTH2JWS-8749594 due to not being affected #829
OCPBUGS-52512: github.com/go-jose/go-jose/v4 v4.0.5 #826
OCPBUGS-47070: golang.org/x/net v0.33.0 #805
OCPBUGS-45939: Add AWS region to aws-pod-identity-webhook #800
OCPBUGS-45007: Add retry to ccoctl gcp create functions #794
OCPBUGS-45002: github.com/golang-jwt/jwt/v4 v4.5.1 #788
OCPBUGS-43645: Only attempt timed token credentials on supported platforms. #772
OCPBUGS-43337: Update github.com/sirupsen/logrus v1.9.3 #767
OCPBUGS-41234: List secrets in batches to avoid api timeout #757
OCPBUGS-38376: Update google.golang.org/grpc v1.65.0 #748
OCPBUGS-37418: SNYK ignore go-client misreporting #735
OCPBUGS-36834: GCP passthrough permissions check to ignore problematic permissions. #714
OCPBUGS-36954: Update to azidentity v1.7.0 #727
OCPBUGS-36031: IBM/go-sdk-core update to v5.6.3 #718
OCPBUGS-34117: AWS STS should not error when a credentailsRequest does not have awsSTSIAMRoleARN #704
OCPBUGS-32948: Update documentation to restart pods when enabling workload identity #701
OCPBUGS-32026: Docs: Fix migration to azure workload identy to apply the webhook config #695
OCPBUGS-31290: Dockerfile should keep prior rhel8 behavior for ccoctl default #694
OCPBUGS-31290: Updating ose-cloud-credential-operator-container image to be consistent with ART for 4.16 #693
OCPBUGS-31290: Add binaries for RHEL8 and RHEL9, defaulting to RHEL9 #692
OCPBUGS-31678: aws: remove non-existent permission #690
AUTH-482: set required-scc for openshift workloads #681
OCPBUGS-30713: update go-jose module to v4.0.1 #687
OCPBUGS-30478: Update to cloud.google.com/go/storage v1.39.1 #688
OCPBUGS-25193: Scope networkResourceGroup permissions to more operators #682
OCPBUGS-28787: gcp actuator update check to consider custom roles #685
CCO-525: Azure workload identity doc updates #680
NO-JIRA:docu change: fix find command #677
NO-JIRA: Fix update-codegen.sh #669
OCPBUGS-28230: add FallbackToLogsOnError for easier debugging #672
OCPBUGS-28388: Fix the ClusterOperator watch of the status controller #665
OCPBUGS-27214: ccoctl - use proxy when validating CloudFront URL #654
OCPBUGS-28535: stop LoadInfrastructureRegion from panicking when being called on a non-AWS cluster #667
NO-JIRA: Fix user-facing typos #668
OCPBUGS-28230: add FallbackToLogsOnError for easier debugging #663
NO-JIRA: Keep metrics.md up-to-date #664
OCPBUGS-27446: Report manualpodidentity mode in metrics when using Azure Workload Identity #657
OCPBUGS-27445: Use cached clients to avoid client side throttling #656
NO-JIRA: azwi doc: apply webhook manifest to cluster #652
CCO-454: Bump go.mod k8s deps to 0.29.1 #655
OCPBUGS-16181: Write manifests when AWS IAM roles already exist. #514
CCO-519: Resolve all outstanding snyk vulnerabilities #648
OCPBUGS-26488: Use live client for metrics #645
OCPBUGS-25533: Updating ose-cloud-credential-operator-container image to be consistent with ART #642
NO-JIRA: Update docs/sts.md #634
OCPBUGS-24807: Updating ose-cloud-credential-operator-container image to be consistent with ART #639
NO-JIRA: Fixed typos #633
Full changelog

cloud-network-config-controller

OCPBUGS-66346: [release-4.16] Fix capacity calculation #195
OCPBUGS-65567: [release-4.16] Change the capacity struct from int to ptrOfInt #192
OCPBUGS-56359: Increase API call timeout to 30 second #172
OCPBUGS-33617: Avoid panic when looking up attachedOutboundRule.ID in azure #144
NO-JIRA: Update dependency google.golang.org/api #143
OCPBUGS-33154: Incorrect use of go wait groups #140
OCPBUGS-29915: GCP: Explicitly set UniverseDomain to the default universe domain #136
OCPBUGS-27422: Avoid nil pointer panic while assigning private IP on Azure #133
OCPBUGS-30146: Serialize scheme construction to prevent panic #134
OCPBUGS-31289: Updating ose-cloud-network-config-controller-container image to be consistent with ART for 4.16 #135
OCPBUGS-29915: GCP: Explicitly set UniverseDomain to the default universe domain #132
SDN-4405: 1.29_rebase: #131
OCPBUGS-28282: Add Snyk file to exclude vendor dependent libraries on scan #130
OCPBUGS-24823: Updating ose-cloud-network-config-controller-container image to be consistent with ART #129
Full changelog

cluster-authentication-operator

OCPBUGS-102924: replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 #990
OCPBUGS-54655: Avoid duplicate OAuth client creation #766
OCPBUGS-43367: manifests should not use APIs that are removed in upcoming releases #717
OCPBUGS-34790: update OpenShift favicon to new brand standard #676
NO-JIRA: Fixes for Keycloack IDP test and unit tests #683
NO-JIRA: remove go-jose not to get flagged with its CVEs #668
AUTH-482: set required-scc for openshift workloads #656
OCPBUGS-24195: the apiservice controller waits until bootstrap complete #662
OCPBUGS-22969: Use v1 for flowcontrol API #640
NO-JIRA: e2e Keycloak: retry logging in as admin #666
OCPBUGS-32089: wellknown-readiness: perform several attempts to connect before going unavailable #664
NO-ISSUE: bump to the latest version of openshift/api #663
NO-ISSUE: bump dependencies #659
NO-JIRA: test/lib: create SA on deploy #660
NO-ISSUE: oauth-apiserver: disable priority and fairness #658
NO-ISSUE: oauth-apiserver: enable shutdown-send-retry-after #657
NO-JIRA: _output - remove dir #651
OCPBUGS-18939: manifest: drop slo latency metrics in favor of sli #632
WRKLDS-1004: use AlwaysAllow UnhealthyPodEvictionPolicy in PDBs #646
OCPBUGS-24883: Updating ose-cluster-authentication-operator-container image to be consistent with ART #644
OCPBUGS-18115: Remove “include.release.openshift.io/ibm-cloud-managed:” annotation #636
Full changelog

cluster-autoscaler

OCPBUGS-78702: allow clusterapi provider to skip paused resources #415
OCPBUGS-60915: revert openshift replica fix #377
OCPBUGS-59267: Fix cool down status condition to trigger scale down #363
OCPBUGS-60609: fix checkpoint gc of unknown recommenders #372
OCPBUGS-54326: improve replica counting and decrease target size behavior #353
OCPBUGS-48732: UPSTREAM: <carry>: 🐛(metrics) Initialize metrics for autoscaler errors, scale events, and pod evictions #339
OCPBUGS-45148: [release-4.16] VPA: Update OWNERS file #325
OCPBUGS-33932: fix: scale up broken for providers not implementing NodeGroup.GetOptions() #303
NO-JIRA: UPSTREAM: 6796: Avoid expesive pointer copy in capi nodegroup #298
OCPBUGS-31421: add check for taint.value == nil #292
OCPBUGS-28334: update snyk file #287
PODAUTO-99: Fix VPA e2e test failures #286
OCPCLOUD-2431: rebase on upstream 1.29.0 release #285
PODAUTO-104: Add downstream pod autoscaling team member jkyros to VPA OWNERS #283
OCPBUGS-27509: Fix unstructured taint parsing in Cluster API provider #281
OCPBUGS-26504: Updating atomic-openshift-cluster-autoscaler-container image to be consistent with ART for 4.16 #279
OCPBUGS-25855: Updating ose-vertical-pod-autoscaler-container image to be consistent with ART for 4.16 #277
OCPBUGS-25625: Add Snyk file to exclude vendor directory on scan #276
OCPBUGS-24783: Updating atomic-openshift-cluster-autoscaler-container image to be consistent with ART #271
OCPBUGS-25579: Updating ose-vertical-pod-autoscaler-container image to be consistent with ART #274
PODAUTO-91: Add joelsmith to OWNERS for approving of VPA-only PRs #273
OCPBUGS-24974: Updating ose-vertical-pod-autoscaler-container image to be consistent with ART #272
Full changelog

cluster-autoscaler-operator

OCPBUGS-102934: Bump x/net package in release-4.16 #390
OCPBUGS-52329: set max soft bulk taint count to zero #341
AUTH-482: set required-scc for openshift workloads #315
OCPBUGS-20565: Set webhook minimum TLS version to 1.3 #320
OCPCLOUD-2493: Add empty string as value for GpuType if GpuCount is empty 0 #317
OCPBUGS-31960: Bump x/net to v.0.24.0 #318
OCPCLOUD-2493: Update CAO to add upstream annotations #316
OCPCLOUD-2523: add ExpanderOrderList api option #304
OCPBUGS-29863: Apply hypershift cluster-profile for ibm-cloud-managed #314
OCPBUGS-28207: update min/max memory limit documentation #313
MIXEDARCH-429: Revert “OCPBUGS-18137: Provide the architecture of the control plane as argument to –scale-up-from-zero-default-arch” #311
OCPBUGS-28230: add FallbackToLogsOnError for easier debugging #312
MIXEDARCH-429: Add the environment variable value for CAPI_SCALE_ZERO_DEFAULT_ARCH #297
OCPCLOUD-2432: Bump k8s packages to v1.29 #310
OCPBUGS-25559: Updating ose-cluster-autoscaler-operator-container image to be consistent with ART #305
OCPBUGS-25633: Add Snyk file to exclude vendor directory on scan #306
OCPBUGS-24911: Updating ose-cluster-autoscaler-operator-container image to be consistent with ART #303
Full changelog

cluster-baremetal-operator

OCPBUGS-77447: Bump github.com/go-errors/errors to v1.5.1 #562
OCPBUGS-64741: Always have a service for ironic-api port #524
OCPBUGS-63417: Fix ironic inspector container privileges #513
OCPBUGS-61504: Remove webhookport (9447) as HostPort #506
OCPBUGS-54546: Add missing relatedObjects #470
OCPBUGS-43556: SCC-pinning for metal3-baremetal-operator #453
OCPBUGS-31961: bump x/net to 0.23.0 #431
OCPBUGS-36415: set required-scc for openshift workloads #433
OCPBUGS-36285: Move pull secret from env var to VolumeMount in metal3-image-customization container #436
OCPBUGS-36285: Mount htpasswds as volumeMounts in metal3-httpd container #434
OCPBUGS-35381: provisioning: add ownership for tls secret #425
OCPBUGS-35503: Add capability to metal3-ramdisk-logs container #426
OCPBUGS-34041: Run metal3 containers as specific users and groups #418
OCPBUGS-33493: Enable leader election for baremetal-operator #416
OCPBUGS-27145: Drop unneccessary capabilities #401
OCPBUGS-33254: Wait for bootstrapping to finish before starting #415
OCPBUGS-28230: enforce termination message policy on all platform pods #413
METAL-979: Add RBAC for newer CRDs hostfirmwarecomponents and dataimages #412
METAL-904: Move parts of ICC config to a new secret #406
OCPBUGS-31341: Refactor Pull Secret application #409
OCPBUGS-27760: Update the leader election durations to be tolerant #403
OCPBUGS-24579: pass all IPs to image-customization-controller #400
OCPBUGS-27145: Reduce container privileges #396
OCPBUGS-28230: add terminationmessagepolicy to show last of error log in API #399
METAL-856: set USE_IRONIC_INSPECTOR explicitly #398
OCPBUGS-25766: manifests/0000_31_cluster-baremetal-operator_06_deployment: Enable leader election #395
OCPBUGS-25572: Updating ose-cluster-baremetal-operator-container image to be consistent with ART #394
OCPBUGS-24946: Updating ose-cluster-baremetal-operator-container image to be consistent with ART #393
Full changelog

cluster-bootstrap

OCPBUGS-24975: Updating ose-cluster-bootstrap-container image to be consistent with ART #103
OCPBUGS-24975: Updating ose-cluster-bootstrap-container image to be consistent with ART #102
Full changelog

cluster-capi-controllers

OCPBUGS-33170: All containers must fallback to logs on error #207
OCPBUGS-30480: Merge https://github.com/kubernetes-sigs/cluster-api:v1.6.4 (36c0e55) into master #203
NO-JIRA: Merge https://github.com/kubernetes-sigs/cluster-api:v1.6.2 (da795db) into master #199
OCPBUGS-30586: fix e2e tests on release branches #200
OCPCLOUD-2517: openshift: promote core CAPI IPAM CRDs to GA #197
OCPBUGS-29519: openshift: add CustomNoUpgrade annotation value to feature-set #196
OCPBUGS-29476: openshift: generate separate manifest for core CAPI CRDs #195
OCPBUGS-26111: add snyk file #194
OCPCLOUD-2449: Merge https://github.com/kubernetes-sigs/cluster-api:v1.6.0 (14efefe) into master #192
NO-JIRA: e2e: add openstack testing script #193
OCPBUGS-25586: Updating ose-cluster-api-container image to be consistent with ART #191
OCPBUGS-25000: Updating ose-cluster-api-container image to be consistent with ART #190
Full changelog

cluster-capi-operator

OCPBUGS-79943: Bump google.golang.org/grpc to v1.79.3 #573
NO-JIRA: Allow sustaining engineering to self serve dependency updates #560
OCPBUGS-49603: fix: always update clusteroperator status versions when differing #253
OCPBUGS-37441: fix: sort CredentialsRequest manifests after namespace #190
OCPBUGS-37795: fix: align openstack e2e branch #192
OCPBUGS-33170: All containers must fallback to logs on error #172
OCPBUGS-28230: enforce termination message policy on all platform pods #171
OCPCLOUD-1609, OCPCLOUD-1610: Add Support for VSphere #149
NO-JIRA: CAPA: use v1beta2 #151
NO-JIRA: Fix manifests-gen tool + testing #168
OCPBUGS-29832, OCPCLOUD-2451: Bump CAPI 1.6 and k8s 1.28 #164
OCPBUGS-29676: create openshift-cluster-api namespace in CustomNoUpgrade #163
OCPCLOUD-2517: manifests-gen: promote Core CAPI IPAM CRDs to GA #162
OCPBUGS-29519: manifests-gen: also add CustomNoUpgrade annotation value #161
OCPBUGS-29476: manifests-gen: store core capi crds also in their own manifest #159
OCPBUGS-28539: Start operator controllers only on supported platforms, add unsupported controller #157
OCPBUGS-26121: Add Snyk file to exclude vendor directory on scan #156
OCPCLOUD-1726: GCP Credential Req. manifest for CAPI to use new API field #87
NO-JIRA: e2e: add openstack testing script #154
OCPBUGS-25778: Updating ose-cluster-capi-operator-container image to be consistent with ART for 4.16 #153
OCPBUGS-24979: Updating ose-cluster-capi-operator-container image to be consistent with ART #150
Full changelog

cluster-cloud-controller-manager-operator

OCPBUGS-63168: ccm: disable unused secure-serving port and webhook #422
OCPBUGS-60387: Add Service using common resource templating #411
OCPBUGS-60387: Update service selector to match deployment label #410
OCPBUGS-42125: IBMCloud: Modify liveness probe for IBM Cloud CCM to use loopback address #366
OCPBUGS-43473: update goimports targets #372
OCPBUGS-36317: PowerVS: Remove bind address #358
OCPBUGS-34826: Nutanix CCM pods Cipher Suites vulnerability issue #350
NO-JIRA: Ensure termination message policy in tests #344
OCPBUGS-33405: update azure and ash tolerations on node manager #342
OCPBUGS-13680: Pass –cluster-name to OpenStack CCM #337
OCPCLOUD-2515: remove CloudControllerOwner condition logic #335
Bug OCPBUGS-29605: Allow to patch events in OpenStack RBAC #336
OCPVE-660: add CloudController capability annotation #284
OCPCLOUD-2514: Remove reliance on feature gates for whether to deploy CCMs #334
OCPBUGS-29012: Increase Azure Concurrent Service Syncs to 10 #328
OCPBUGS-29220: Set AZURE_FEDERATED_TOKEN_FILE on CCM container #332
OCPBUGS-29012: Add EndpointSlices permissions for Azure #331
OCPBUGS-13106: Increase GCP Concurrent Service Syncs to 10 #329
OCPBUGS-28230: add FallbackToLogsOnError for easier debugging #330
NO-JIRA:Use expressive Gomega matchers with Eventually #327
OCPBUGS-24486: Enforce the use of shared health checks #326
OCPCLOUD-2424: Bump k8s packages to v1.29 #325
OCPBUGS-25887: IBMCloud: Patch CCM for 4.16 #323
OCPBUGS-26494: PowerVS: handle 4.16 changes #322
OCPBUGS-25483: Adds CloudConfigTransformer for Azure #316
OCPBUGS-24948: Updating ose-cluster-cloud-controller-manager-operator-container image to be consistent with ART #308
OCPBUGS-25750: Add Snyk file to exclude vendor directory on scan #313
OCPBUGS-5825: Adds GCP ClusterRole and ClusterRoleBinding #310
OCPCLOUD-1724: GCP Credentials req. manifest of CCMO to use new API field #205
trt-1382: reorder flag initialization #309
trt-1382: test add space #307
Full changelog

cluster-config-api

CNTRLPLANE-1982: Promote streaming list encoding to Default #2600
OCPBUGS-71202: Add HTTPKeepAliveTimeout to IngressController API #2640
NO-JIRA: Promote streaming list encoding to Default on Hypershift. #2568
CNTRLPLANE-1611: Add feature gates for StreamingCollectionEncoding #2542
OCPBUGS-58392: Add IPsec API for NAT-T UDP encapsulation support #2393
OCPBUGS-56424: Add IdleConnectionTerminationPolicy field to IngressControllerSpec #2330
OCPBUGS-38773: remove duplicate featuregate ‘ExternalRouteCertificate’ #2007
OCPBUGS-37857: [release-4.16] OCPBUGS-37852: a rule to check if the featureSet is one of the known set of features #1985
OCPBUGS-33788: add console and download URLs to console operator config #1915
CFE-1047: Add the field “CapacityReservationGroupID” to “AzureMachineProviderSpec” in openshift/api #1923
OCPBUGS-35742: prevent removing featureSet entirely #1933
OCPBUGS-26466: Disable PSA in non-previews 4.16 #1912
STOR-1839: promote VSphereDriverConfiguration feature to Accessible-by-default #1904
temporarily break the featuregate check to show we can get results #1911
Feature gates for platforms, architecture, and installs #1910
OCPBUGS-34398: Streamline bootstrap crds #1905
ETCD-602: Move etcd hardware speed feature to GA #1901
Move CAPI install platforms to default feature set #1892
OCPBUGS-33727: Fix Gateway API Feature Gate #1894
NO-JIRA: Set listType for .status.serviceNetwork and .status.clusterNetwork in networks.config #1890
SDN-4600: Add NetworkDiagnosticsConfig to the default featureset #1886
Revert “Revert “Merge pull request #1851 from slashpai/metrics-server”” #1865
CORS-3488: Add GCP CAPI installer to tech preview feature set. #1889
Add eligible CAPI-install platforms to TechPreview #1880
NO-JIRA: Update runtime image and drop color in CI #1885
add MachineConfiguration conditions for boot image updates #1882
SPLAT-1452: Changed vcenter MaxItems to be 3 for TechPreview. #1842
ETCD-520: add BackendQuotaGiB example #1874
Update SSA tag markers #1881
Expose chunksize variable for S3 storage driver #1864
ETCD-520: add etcd dbsize field #1736
Update imageregistry component SSA tags #1877
Add Machine V1 to payload CRDs #1876
Recurse when loading CRD schemas to check #1875
MCO-1148: Attempt to tombstone MachineConfiguration/StaticPodOperatorStatus #1789
OPNET-512: config/v1/types_infrastructure: change set to atomic for networks #1873
OCPBUGS-31666: route: Fix insecureEdgeTerminationPolicy default #1845
features: add capi-installer gate per platform #1868
Simplify CEL validations in network operator #1871
clean up NodeDisruptionPolicySpecAction godoc #1870
fix MachineOSBuild printer columns #1867
NO-JIRA: move featuregate definitions to a new package #1821
Revert #1851 “MON-3538: Promote MetricsServer FeatureGate to GA” #1863
MCO-838: machineconfiguration/v1: update MCP feature gated field to omitempty #1862
NO-JIRA: Change PreviousFlakePercentage value type from int to float #1861
MON-3538: Promote MetricsServer FeatureGate to GA #1851
Provide a small help when invoking tests/hack/gen-minimal-test.sh #1860
NO-JIRA: Add DevPreviewNoUpgrade as a featureset #1825
OCPBUGS-30954: Reintroduce CEL IP/CIDR validation for Config APIs #1817
remove alpha level of AlertingRules which are GA since 4.14 #1854
add explanation of how to provide automated testing for FeatureGate #1855
MCO-838: machineconfig/v1: add PoolSynchronizers to MCP status #1852
STOR-1803: add vsphere snapshot configuration fields to ClusterCSIDriver #1783
NO-JIRA: add command to restrict features from promotion without tests #1843
NO-JIRA: add type for recording tests per featuregate #1848
MCO API Cleanup #1850
OCPBUILD-9: Adds seperate controllers for default rolebindings #1770
MCO-993: MachineOSBuild API #1773
OCPBUGS-28673: Ingress - add connect timeout to tuning options #1829
SDN-4599: Configurable network diagnostics pod placement #1800
MCO-838: machineconfiguration/v1alpha1: add PinnedImageSet to MCN #1824
SDN-4596: Promote AdminNetworkPolicy to GA #1840
Proposed new api structure for ovnkubernetes / transit switch api #1626
OCPBUGS-31058: config/ingress: Make Hostname godoc user-friendly #1819
use CEL to enforce immutable featureset #1839
NO-JIRA: enable the SA token node thing #1831
OCPCLOUD-2573: Enables kubelet cloud credential providers #1786
update vendor for new test changes and vendoring #1834
MON-3486: add feature gate for Collection Profiles #1835
Add models-schema to make clean #1828
NO-JIRA: remove single-node-developer clusterProfile #1827
NO-JIRA: update integration testing to be by gate #1833
machineconfiguration/v1alpha1: add PinnedImageSetStatus #1830
bump(golang.org/x/tools) to match k8s 1.28 #1832
MCO-1010: Add node disruption policies to MachineConfiguration CRD #1764
MCO-838: machineconfiguration/v1alpha1: add PinnedImageSet #1822
NO-JIRA: Switch integration tests to ordered to save time #1823
add markdown generator for featuregates #1820
explain roughly what the new generator is doing #1816
BUILD-854: Updates to build API reviewers #1792
add section about adding new APIs #1815
add doc.go to each generated mainfest dir #1814
TRT-1563: Revert #1802 “Move config v1 IP validation to CEL” #1810
move to new directory #1803
skip rendering mutation of CustomNoUpgrade featuresets #1806
All remaining genererated by new generator #1808
Move config v1 IP validation to CEL #1802
make featuregate manifest pattern consistent and remove legacy files #1805
convert generation in a couple more v1 APIs #1804
update the last manifests used directly from this image to featuregate generation #1796
OPNET-466: PlatformLoadBalancer becomes GA for On-Prem #1757
updating config stragglers to by-feature-gate generation #1793
update network group to use “normal” generation #1795
SPLAT-1293: Moved vSphereStaticIPs into Default from TechPreview #1729
update the machine group to use the featuregate generator #1799
tighten up the useCRD interface #1801
Add tooling for publishing OpenShift kubebuilder tools #1774
update machineconfiguration to use featuregated generation #1797
update sharedresource to use featuregate generation #1798
updating console stragglers to by-feature-gate generation #1794
Merge manifests based on clusterProfile and featureSet #1791
specify Featuregates by cluster profile #1788
make the serialized featuregate location an input param #1790
remove ungated case from manifest-merge #1784
Generate config.openshift.io using FeatureGates instead of FeatureSets #1731
OCPBUGS-25594: Fix text and indentation for TLS Security Profile #1730
OCPVE-658: add CloudController capability #1579
MCO-820: Add boot images update opt-in mechanism #1672
OCPBUGS-23788: Only allow valid values for gatewayConfig.ipForwarding #1691
ImagePolicy uses byte format for base64 fields #1765
OCPBUGS-29435: allow multiple audiences to be configured for kube-apiserver #1771
config/v1/types_cluster_version: Drop never-implemented ‘Evaluating’ conditionalUpdates condition type #1753
NE-1303: cluster version: add v4.16 set and ingress capability #1724
OCPBUGS-29196: Update AWSCSIDriverConfigSpec fields validation to accept all current AWS partitions #1740
SPLAT-1441: promote vSphere failure domain template field #1759
OCPBUGS-23900: config.openshift.io/v1/scheduler: allow profile customizations for DRA #1738
STOR-1724: Add Samba/CIFS CSI driver provider #1741
OCPBUGS-29075: Move network.config status.conditions to GA #1755
OCPBUGS-18991: Add BuildInterrupted type #1752
OCPBUGS-26498: Add UnservableInFutureVersions route status condition type #1722
STOR-1700: Add new API for VolumeGroupSnapshot #1746
NP-874: Promote SDN Live Migration to GA #1747
OCPBUGS-27222: Allow modified IPv6 address as CPIC name #1727
Switch to K8s yaml to ensure consistent formatting of CRDs #1744
OCPBUGS-27366: add separate authentication config manifest for hypershift #1732
SPLAT-1396: promote feature gate and vSphere failure domains to default #1733
OCPBUGS-27468: features: enabled TranslateStreamCloseWebsocketRequests through TechPreviewNoUpgrade #1737
CFE-857: Add new param ResourceManagerTags to GCPMachineProviderSpec #1506
OCPBUGS-27366: respect the cluster profile in rendering #1734
OTA-1169: Add feature gate for upgrade status #1725
SPLAT-1385: introduce TagIDs field to vSphere providerSpec #1697
Add ImagePolicyList and ClusterImagePolicyList to scheme known types #1726
Add generated featuregate files inertly to payloads #1720
add-IPsecExternal #1667
AUTH-439: authentication: use CRD validation for the ‘type’ field #1716
OPNET-415: Revert the revert “Extend infra CR to store VIPs and MachineNetwork”” #1695
OCPBUGS-24955: Updating ose-cluster-config-api-container image to be consistent with ART for 4.16 #1710
MCO-838: Add feature gate for pinned images #1703
OCPBUGS-24955: Updating ose-cluster-config-api-container image to be consistent with ART #1709
OCPBUGS-24955: Updating ose-cluster-config-api-container image to be consistent with ART #1708
OCPNODE-1890: Bump k8s api to v0.29.0 #1676
Add KMSv1 to default feature gates #1706
CORS-3029: Add Cloud LB IPs to GCP PlatformStatus of Infrastructure CR #1685
Add ClusterImagePolicy and ImagePolicy #1457
OCPBUGS-24955: Updating ose-cluster-config-api-container image to be consistent with ART #1700
Add payload manifests dir #1648
OCPBUGS-24573: Generate Tech Preview version of ControllerConfig CRD #1698
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

cluster-config-operator

SPLAT-1630: Bump API version to get new VSphereMultiVCenters featuregate. #418
AUTH-482: set required-scc for openshift workloads #410
OCPBUGS-24871: Updating ose-cluster-config-operator-container image to be consistent with ART #390
TRT-1581: default to self-managed clusterprofile #414
NO-JIRA: change the customnoupgrade featureset to work as force enable and force disable #412
OCPBUGS-29576: Apply hypershift cluster-profile for ibm-cloud-managed #408
NO-JIRA: add check to ensure clusterprofile matches for featuregates #411
OCPBUGS-28621: Fix PSa labels #406
STOR-1700: Bump(openshift/api): to get new VolumeGroupSnapshot API #405
OCPBUGS-28621: Add required PSa labels #401
SPLAT-1400: promote vSphere control plane machinesets from tech preview #400
OCPBUGS-26541: remove duplicate manifests in image #399
Revert “OCPBUGS-26541: remove duplicate manifests in image” #397
OCPBUGS-26541: remove duplicate manifests in image #392
OCPNODE-1671: Update api,client-go to add imagepolicy api #376
Full changelog

cluster-control-plane-machine-set-operator

OCPBUGS-44179: relax validation on delete and if failureDomains not configured #331
CFE-1087: API Bump for capacity Reservation #314
OCPBUGS-35476: Wait for ControlPlaneMachineSet to be created when waiting for it to be updated #307
OCPBUGS-34970: Add unreadyNodeGracePeriod for allowing brief node hiccups #298
OCPBUGS-35227: Improved debugging of API listing errors #300
OCPBUGS-32947: Modified webhook to reject changes to vsphere fields coming from failure domains. #291
AUTH-482: set required-scc for openshift workloads #282
Drop CRDs for CPMS #292
OCPBUGS-31808: Fix ExportFailureDomain to handle empty platform spec #287
OCPBUGS-32295: Modified webhook to allow templates by name instead of just by path. #288
SPLAT-1440: prevent rollout due to irrelevant path artifacts #275
OCPBUGS-26127: add snyk configuration file #277
SPLAT-1410: Fix vSphere machineprovider InjectFailureDomain to handle empty network device list. #281
SPLAT-1410: Modified vSphere config provider to not lose AddressesFromPools when applying Failure Domains #273
OCPBUGS-29249: Never delete a Machine when there’s a single Machine in an index #278
OCPBUGS-29114: Fixed control plane machine set handling of static IPs when AddressesFromPools is not in use. #276
OCPBUGS-28230: add FallbackToLogsOnError for easier debugging #274
SPLAT-1391: promote vSphere from tech preview #272
OCPCLOUD-2415: Update K8s deps to 1.29 #271
OCPBUGS-25577: Updating ose-cluster-control-plane-machine-set-operator-container image to be consistent with ART #270
OCPCLOUD-1894: Implement admission warning for missing target pools #269
OCPBUGS-24967: Updating ose-cluster-control-plane-machine-set-operator-container image to be consistent with ART #268
Full changelog

cluster-csi-snapshot-controller-operator

OCPBUGS-102965: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #291
AUTH-482: set required-scc for openshift workloads #196
STOR-1817: Avoid deleting VolumeGroupSnapshot resources #200
OCPBUGS-28230: add FallbackToLogsOnError for easier debugging #193
STOR-1573: Update manifests to v7.0.0 #201
OCPBUGS-31497: create suitable role and roleBinding for csi-snapshot-webhook #202
STOR-1805: Set SecurityContext for HyperShift #197
OCPBUGS-30483: CVE-2024-24786: bump google.golang.org/protobuf to v1.33.0 #198
OCPBUGS-29577: Apply hypershift cluster-profile for ibm-cloud-managed #194
STOR-1700: Fix: typo of volumegroupsnapshots #195
STOR-1700: Pass VolumeGroupSnapshot argument if feature is enabled #191
STOR-1574: Bump all deps #192
STOR-1574: Bump library-go #190
STOR-1714: Release leadership on SIGTERM #187
HOSTEDCP-1308: Revert “HOSTEDCP-1308: add KAS access label to csi-snapshot-controller and csi-snapshot-webhook” #188
HOSTEDCP-1308: add KAS access label to csi-snapshot-controller and csi-snapshot-webhook #182
OCPBUGS-25558: Updating ose-cluster-csi-snapshot-controller-operator-container image to be consistent with ART #183
STOR-1688: Chore: add .snyk file to ignore false positives #181
OCPBUGS-25149: Updating ose-cluster-csi-snapshot-controller-operator-container image to be consistent with ART #179
OCPBUGS-23838: CVE-2023-47108: bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp to v0.46 #177
OCPBUGS-24908: Updating ose-cluster-csi-snapshot-controller-operator-container image to be consistent with ART #178
Full changelog

cluster-dns-operator

OCPBUGS-52498: [release-4.16] Add runbook_url for CoreDNSErrorsHigh #431
OCPBUGS-37078: Bump version of DNSNameResolver controller #419
CFE-964: Add DNSNameResolver controller #394
OCPBUGS-32941: Bump to Kubernetes 1.29 and controller-runtime 0.17.3 #408
OCPBUGS-27924: Updating ose-cluster-dns-operator-container image to be consistent with ART for 4.16 #402
CFE-852: Enable ocp_dnsnameresolver CoreDNS plugin #393
OCPBUGS-28230: add FallbackToLogsOnError for easier debugging #403
OCPBUGS-24884: Updating ose-cluster-dns-operator-container image to be consistent with ART #397
OCPBUGS-24602: Enable topology-aware hints iff nodes in >=2 zones #398
Full changelog

cluster-etcd-operator

OCPBUGS-68058: Update logrus to 1.9.3 to address CVE-2025-65637 #1546
OCPBUGS-61505: Vendor latest mixin, including additional and modified alerts for etcdDatabaseQuotaLowSpace #1482
OCPBUGS-60836: add missing ports to svc and pod spec #1473
OCPBUGS-53510: fix CVE-2025-30204 #1403
OCPBUGS-33673: rename flowschema to avoid log noise in CVO #1348
OCPBUGS-37820: ensure ordering in member health checks #1311
OCPBUGS-36489: parallelize member health checks #1290
OCPBUGS-35500: Update etcd-tls-assets.md #1276
ETCD-621: Update api vendor libraries to get GA’ed tuning profiles #1265
OCPBUGS-33495: return errors in wait-for-ceo #1260
OCPBUGS-31849: check the quorum in case the cluster is healthy or not after generating certs #1239
NO-JIRA: remove cluster-backup pod #1182
OCPBUGS-31956: update golang x net #1252
OCPBUGS-31249: remove etcd-health-probe log #1230
ETCD-583: add signer expiration metric and alert #1249
API-1800: manifests: convert SecretTypeTLS secrets to kubernetes.io/tls #1247
NO-ISSUE: use IsBootstrapComplete from library-go #1244
OCPBUGS-32217: avoid race conditions during render cert creation #1246
OCPBUGS-32176: immediately return on dynamic certs errors #1245
Revert “ETCD-579: store revision at which signers are rotated” #1243
ETCD-579: store revision at which signers are rotated #1235
ETCD-580: Decrease validity period to prevent cert expiry for offline clusters #1238
OCPBUGS-31658: Fix feature set custom no upgrade #1233
NO-JIRA: fail certsignercontroller sync when secret can not be applied #1226
ETCD-535: Manual CA rotation should rotate all leaf certs #1200
Revert “OCPBUGS-30169: add timeout to etcd client.New config” #1222
OCPBUGS-30873: CEO aliveness check should only detect deadlocks #1223
WRKLDS-1071: bump(library-go)=master #1219
ETCD-518: garbage collect unused dynamic certs #1209
OCPBUGS-30169: add timeout to etcd client.New config #1215
NO-JIRA: replace nodelister with master nodelister #1205
ETCD-517: run certsignercontroller for bootstrap render #1186
ETCD-516: CEO needs to react on changing CA cert bundle and client certs #1202
NO-JIRA: increase client pool size #1203
OCPBUGS-29417: Sno fix bootstrap race #1201
OCPBUGS-27926: Updating cluster-etcd-operator-container image to be c… #1189
Revert “Revert “OCPBUGS-22969: Use v1 for flowcontrol API”” #1199
ETCD-512: refactoring the cert signer controller #1194
AUTH-481: Add PSa labels to openshift-etcd-operator namespace #1198
Revert “OCPBUGS-22969: Use v1 for flowcontrol API” #1197
TRT-1485: Revert #1177 “ETCD-512: refactoring the cert signer controller” #1193
ETCD-512: refactoring the cert signer controller #1177
OCPBUGS-27959: fix panic in health check timeouts #1190
OCPBUGS-22969: Use v1 for flowcontrol API #1149
OCPBUGS-21846: update library-go to latest commit #1180
OCPBUGS-24889: Updating cluster-etcd-operator-container image to be consistent with ART #1175
NO-JIRA: bump library-go and use default UnhealthyPodEvictionPolicy #1171
add ownership for etcd-ca-bundle that I don’t think is updated #1159
And 2 elided commits (e.g. from squash or rebase merges)
Full changelog

cluster-image-registry-operator

OCPBUGS-68059: : Bump github.com/sirupsen/logrus to v1.9.1 #1285
OCPBUGS-53870: bump github.com/golang-jwt/jwt #1219
OCPBUGS-51600: bump golang.org/x/oauth2 #1210
OCPBUGS-51167: ensure that storage names don’t end in dashes #1181
OCPBUGS-43797: fix proxy config and leader election test flakes #1148
OCPBUGS-43555: pkg/storage/azure: also check for auth failure error code on deletion #1143
OCPBUGS-42933: azureclient: stop validating credentials when creating the client #1134
OCPBUGS-42420: Continuous pull-secret updates / slow initialization on build01 (test platform infrastructure) #1126
Revert “[release-4.16] OCPBUGS-41903: pkg/operator/azurepathfixcontroller: do not sync on non-azure storage” #1119
OCPBUGS-41903: pkg/operator/azurepathfixcontroller: do not sync on non-azure storage #1115
OCPBUGS-39098: Avoid Shared Access Key usage for Azure Storage Account when using Managed Identity based auth #1104
OCPBUGS-38894: pkg/resource/azurepathfixjob: invoke update-ca-trust extract with –output #1102
OCPBUGS-38894: pkg/resource: invoke update-ca-trust extract with –output #1098
OCPBUGS-36037: go.*,vendor: bump go-retryablehttp #1064 #1064
OCPBUGS-34779: add SAR capability to image-registry #1054
OCPBUGS-34165: azure-path-fix: get client secret from k8s secret #1041
OCPBUGS-34166: pkg/storage/s3: use force path style in favour of virtual hosted style config #1042
OCPBUGS-34069: Bump openshift api, client-go & library-go #1039
OCPBUGS-33172: azurepathfix: check if platform status is nil before accessing it #1030
OCPBUGS-32491: Power VS: Add support for Power VS endpoint overrides #1024
OCPBUGS-29559: Apply hypershift cluster-profile for ibm-cloud-managed #999
OCPBUGS-32328: azure-path-fix: support auth via account key (without clientID) #1021
OCPBUGS-30484: bump indirect google protobuf dependency #1015
NO-JIRA: remove bparees from owners #1019
OCPBUGS-29233: bump aws-sdk-go from v1.44 to v1.50 #1012
AUTH-482: set required-scc for openshift workloads #1008
NO-JIRA: bump golangci-lint to v1.56.2 #1013
OCPBUGS-29932: cmd/move-blobs: log and exit 1 on error instead of panic #1006
OCPBUGS-29637: azurepathfix: fix stack hub, government and workload identity setup #1003
OCPBUGS-29003: move azure storage blobs from docker back into /docker #998
NO-JIRA: Add hack/local-dev.sh #996
OCPBUGS-28225: pkg/storage/s3: enable bucket key on encryption settings #993
OCPBUGS-28230: add FallbackToLogsOnError for easier debugging #992
NO-JIRA: build(deps): bump golang.org/x/oauth2 from 0.8.0 to 0.16.0 #989
OCPBUGS-26767: MULTIARCH-4074: PowerVS: update supported regions #987
IR-409: build(deps): bump github.com/IBM/platform-services-go-sdk from 0.18.15 to 0.55.0 #974
OCPBUGS-24997: Updating ose-cluster-image-registry-operator-container image to be consistent with ART #979
IR-410: build(deps): bump github.com/aliyun/alibaba-cloud-sdk-go from 1.61.1263 to 1.62.637 #980
OCPBUGS-11624: manifests/02-rbac.yaml: stop using wild cards #964
OCPBUGS-24649: add private endpoint permissions to Azure credentials request #971
OCPBUGS-24997: Updating ose-cluster-image-registry-operator-container image to be consistent with ART #975
IR-412: IBMCloud: Add support for endpoint overrides #955
CCO-248: Revert “Merge pull request #965 from jstuever/TRT-1368” #967
Full changelog

cluster-ingress-operator

OCPBUGS-102952: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #1573
OCPBUGS-86713: Add configuration override for X-SSL strip #1487
OCPBUGS-71202: Implement HTTPKeepAliveTimeout tuning option #1337
OCPBUGS-56424: Add e2e tests for IdleConnectionTerminationPolicy #1235
OCPBUGS-56424: Add support for IdleConnectionTerminationPolicy #1234
OCPBUGS-39324: Refine logging for accurate infra CR status updates #1139
OCPBUGS-39323: Ingress operator status not degraded when canary route fails #1138
OCPBUGS-32887: Delete and recreate canary route to clear spec.host #1099
OCPBUGS-36184: Add e2e test for connect timeout #1094
OCPBUGS-35883: Add Regexp Anchor to TestAll #1093
OCPBUGS-34835: internalServiceChanged: Fix target port logic #1072
OCPBUGS-34837: Bump openshift/library-go to resolve NewPrometheusClient E2E failures #1074
OCPBUGS-32887: Allow operator to update Route spec.subdomain #1047
OCPBUGS-32942: Bump controller-runtime to v0.17.3 #1050
OCPBUGS-28673: implement connect timeout tuning option #1035
NE-1317: manifests - add ingress capability annotation #950
OCPBUGS-32371: Bump openshift/api, and update CRD generation #1045
OCPBUGS-25193: Add vnet subnet read and join permission for azure #1029
OCPBUGS-30834: Update to go 1.21 #1040
OCPBUGS-31722: Use centos7 tag for quay.io/centos7/httpd-24-centos7 image #1037
OCPBUGS-3522: Include recent errors in canary checks fail #865
OCPBUGS-30091: TestHostNetworkPortBinding: Delete t.Parallel() #1032
CFE-987: Use RouterExternalCertificate feature gate for adding ROUTER_ENABLE_EXTERNAL_CERTIFICATE env var to the router pods #1017
CORS-2317: Add Ingress LB IPs to Infra CR and set DNS unmanaged when BYO DNS is enabled #1016
OCPBUGS-28596: Updating ose-cluster-ingress-operator-container image to be consistent with ART for 4.16 #1020
OCPBUGS-28230: add FallbackToLogsOnError for easier debugging #1019
NE-1490: update to go v1.20 #1012
OCPBUGS-15253: Include namespace in prometheus alerts IngressWithoutClassName and UnmanagedRoutes #980
CCO-249: Replace GCP role with explicit permissions #844
OCPBUGS-25006: Updating ose-cluster-ingress-operator-container image to be consistent with ART #1006
OCPBUGS-24531: Revert “ OCPBUGS-24531 Skip CI for scope change until OCPBUGS-24044 is resolved” #1011
OCPBUGS-24531: Revert “Merge pull request #1007 from candita/OCPBUGS-24531-SkipScopeChangeTest” and add changes to skip test only for Azure and GCP #1008
OCPBUGS-24531: Skip CI for scope change until OCPBUGS-24044 is resolved #1007
OCPVE-780: annotate credentials request manifests #995
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-68064: CVE-2025-65637 openshift4/ose-cluster-kube-apiserver-rhel9-operator: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload [openshift-4.16.z] #2043
OCPBUGS-60467: Add missing service ports to apiserver service #1895
OCPBUGS-50575: Increase waitForFallbackDegradedConditionTimeout #1805
OCPBUGS-37563: add disabled syncer as reason to CFE for PSA #1714
OCPBUGS-35303: manifests: add ownership annotation for kubelet-bootstrap-kubeconfig #1701
OCPBUGS-35831: add SNO control plane high cpu usage alert #1705
OCPBUGS-25104: revert dev cert rotation 4.16 #1695
OCPBUGS-34408: Create one-shot migrations for the flowcontrol group. #1690
OCPBUGS-33522: add a controller that reconciles SCCs’ volumes #1675
NO-ISSUE: Revert “add SNO control plane high cpu usage alert” #1674
OCPBUGS-33184: Fix incorrect name for hostmount-anyuid SCC ClusterRole #1671
OCPEDGE-902: add SNO control plane high cpu usage alert #1660
WRKLDS-1015: tolerate node-role.kubernetes.io/control-plane:NoExecute #1664
OCPBUGS-22969: Use v1 for flowcontrol API #1577
OCPBUGS-31384: use RotatedSigningCASecret controller in update only mode #1659
NO-ISSUE: Revert “certrotationcontroller: set AutoRegenerateAfterOfflineExpiry for generated certificates #1661
NO-JIRA: certrotationcontroller: set AutoRegenerateAfterOfflineExpiry #1652
OCPBUGS-30119: certrotation: Bump library-go to latest master #1651
OCPCLOUD-2514: External CCM should no longer rely on feature gate access #1649
OCPBUGS-25894: operator: stop removing kube-apiserver-slos asset #1642
NO-JIRA: extend node-system-admin-client validity to 2 years #1618
OBSDA-553: add provider name to cluster_infrastructure_provider when external platform #1638
AUTH-481: Add PSa labels to openshift-kube-apiserver-operator namespace #1637
OCPBUGS-27842: Add sno section to alert description #1633
NO-JIRA: Add Vu and Vadim to OWNERS #1634
OCPBUGS-24005: when skipping a webhook check because of missing CA log the name of the webhook #1632
NO-JIRA: Add ownership for the admin kubeconfig #1584
OCPBUGS-18939: manifest: drop slo latency metrics in favor of sli #1546
NO-ISSUE: prevent update status conflicts #1621
OCPBUGS-21846: sync(library-go): revision_controller: update last revision only when a revision is completely rendered #1619
OCPBUGS-14496: manifests: fix the scope of the TechPreviewNoUpgrade alert #1512
OCPBUGS-24907: Updating ose-cluster-kube-apiserver-operator-container image to be consistent with ART #1606
OCPNODE-1892: Rebase 1.29.0 #1608
OCPBUGS-24005: webhookcontroller: report when a webhook resource is missing a caBundle provided by the service-ca-operator #1587
TRT-1420: revert #1586 #1596 #1607
OCPNODE-1890: Bump k8s api to v0.29.0 #1586
OCPNODE-1892: Set flag to skip setting cloud-provider=external #1596
OCPBUGS-24701: ignore vendor folder in SAST scan #1599
Full changelog

cluster-kube-cluster-api-operator

OCPBUGS-28592: Updating ose-cluster-kube-cluster-api-operator-container image to be consistent with ART for 4.16 #37
OCPBUGS-26140: Fix formatting in snyk vendor exclusions #36
OCPBUGS-25634: Add Snyk file to exclude vendor directory on scan #33
OCPBUGS-24887: Updating ose-cluster-kube-cluster-api-operator-container image to be consistent with ART #32
Full changelog

cluster-kube-controller-manager-operator

OCPBUGS-60834: Missing endpoint slices for open ports the operator uses #864
OCPBUGS-33933: Remove cloud-provider, cloud-config, and cloud-volume-plugin flags #808
API-1800: bindata: convert SecretTypeTLS secrets #804
WRKLDS-1169: tolerate node-role.kubernetes.io/control-plane:NoExecute #802
OCPBUGS-31384: use RotatedSigningCASecret and RotatedSelfSignedCertKeySecret only in update mode #800
WRKLDS-1071: revision_controller: do not create a new revision when a required object is missing #796
OCPCLOUD-2515: remove CloudControllerOwner condition #795
OCPBUGS-30488: bump(google.golang.org/protobuf)=v1.33.0 #798
OCPCLOUD-2514: Remove reliance on Cloud Provider feature gates for determining if CCM should be deployed. #794
OCPBUGS-29565: Apply hypershift cluster-profile for ibm-cloud-managed #793
OCPBUGS-21846: sync(library-go): revision_controller: update last revision only when a revision is completely rendered #786
OCPBUGS-26117: Add .snyk file to exclude vendor and ignore unit tests #784
OCPBUGS-25587: Updating ose-cluster-kube-controller-manager-operator-container image to be consistent with ART #780
NO-JIRA: Make render unit pass consistently #782
TRT-1420: Bump openshift/library-go to pick up revision_controller revert #781
OCPNODE-1890: Bump k8s api to v0.29.0 #770
OCPBUGS-5825: Removes legacy cloud-provider resources #778
OCPBUGS-25001: Updating ose-cluster-kube-controller-manager-operator-container image to be consistent with ART #777
OCPBUGS-18115: Remove “include.release.openshift.io/ibm-cloud-managed:” annotation #757
OCPBUGS-25001: Updating ose-cluster-kube-controller-manager-operator-container image to be consistent with ART #775
Full changelog

cluster-kube-scheduler-operator

CNTRLPLANE-2843: chore: update OWNERS #624
WRKLDS-1168: tolerate node-role.kubernetes.io/control-plane:NoExecute #539
OCPBUGS-30489: bump(google.golang.org/protobuf)=v1.33.0 #538
WRKLDS-1071: bump(library-go)=release-4.16 #536
OCPBUGS-29566: Apply hypershift cluster-profile for ibm-cloud-managed #535
OCPBUGS-23900: README: fix dynamicResourceAllocation field name #534
OCPBUGS-23900: Profile customizations: dynamic resource allocation through TechPreviewNoUpgrade feature gate #532
AUTH-481: add PSa labels to openshift-kube-scheduler-operator namespace #533
NO-JIRA: readme: describe mapping between logLevel and log level #531
NO-JIRA: README: add notes about dumping KS’s node cache #530
OCPBUGS-21846: sync(library-go): revision_controller: update last revision only when a revision is completely rendered #526
OCPBUGS-23631: Add .snyk file to exclude vendor and ignore unit tests #524
OCPBUGS-24915: Updating ose-cluster-kube-scheduler-operator-container image to be consistent with ART #522
TRT-1420: Bump openshift/library-go to pick up revision_controller revert #521
OCPNODE-1890: Bump k8s api to v0.29.0 #510
OCPBUGS-24915: Updating ose-cluster-kube-scheduler-operator-container image to be consistent with ART #519
OCPBUGS-24915: Updating ose-cluster-kube-scheduler-operator-container image to be consistent with ART #517
Full changelog

cluster-kube-storage-version-migrator-operator

OCPBUGS-68069: Bump github.com/sirupsen/logrus to v1.9.1 #144
OCPBUGS-38269: bump protobuf #115
AUTH-482: set required-scc for openshift workloads #107
OCPBUGS-29567: Apply hypershift cluster-profile for ibm-cloud-managed #106
OCPBUGS-27930: Updating ose-cluster-kube-storage-version-migrator-operator-container image to be consistent with ART for 4.16 #103
OCPBUGS-24989: Updating ose-cluster-kube-storage-version-migrator-operator-container image to be consistent with ART #101
Full changelog

cluster-machine-approver

OCPBUGS-48258: Fix race condition in CO status controller test #267
OCPBUGS-47704: Filter CSRs by signerName #263
OCPBUGS-45974: Ensure trailing dots on DNS names do not block serving cert auth #257
OCPBUGS-45974: Client internal DNS checks should ignore trailing dot #251
OCPBUGS-44629: Client internal DNS checks should be case insensitive #244
OCPBUGS-34161: check for machine crd before listing machines #233
OCPBUGS-29568: Apply hypershift cluster-profile for ibm-cloud-managed #229
OCPBUGS-28230: add FallbackToLogsOnError for easier debugging #227
OCPBUGS-26116: Add Snyk file to exclude vendor directory on scan #225
OCPCLOUD-2417: Update to kube 1.29 and controller-runtime 0.17.0 #224
OCPBUGS-23544: Increase concurrent reconciles to 10 #222
OCPBUGS-25582: Updating ose-cluster-machine-approver-container image to be consistent with ART #223
OCPBUGS-24985: Updating ose-cluster-machine-approver-container image to be consistent with ART #218
Full changelog

cluster-monitoring-operator

NO-ISSUE: synchronize OWNERS from main branch [release-4.16] #3113
OCPBUGS-102945: [release-4.16] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #3090
OCPBUGS-77276: AlertingRule: fix duplicate PrometheusRules after MD5->SHA-224 naming change #2831
OCPBUGS-64581: Fix KSM deny-list typo #2733
OCPBUGS-64637: Add mcd_local_unsupported_packages metric from MCO to telemetry 4.16 #2735
OCPBUGS-62765: port metric acm_managed_cluster_worker_cores:max to OCP 4.16 #2719
OCPBUGS-63235: test: remove image registry e2e tests #2727
OCPBUGS-61856: chore(jsonnet): use prometheus_remote_storage_queue_highest_timestamp_seconds in PrometheusRemoteWriteBehind #2676
OCPBUGS-46066: Add new metrics for OpenShift logging telemetry #2537
OCPBUGS-44005: fix(monitoring-plugin): disable emitting nginx version on error pages #2521
OCPBUGS-43826: Add runbook url for TelemeterClientFailures #2508
OCPBUGS-41967: disable user-defined monitoring per object #2474
OCPBUGS-42067: Reapply “chore: poll immediately in the e2e tests” #2476
OCPBUGS-41717: Configure graceful shutdown for metrics-server (4.16 backport) #2467
OCPBUGS-41910: filter alerts sent to Telemeter #2471
OCPBUGS-39170: Backport #2441 for 4.16 #2447
OCPBUGS-36907: Add deprecated config runbook #2411
OCPBUGS-36717: Exclude windows nodes from kubelet servicemonitor #2408
OCPBUGS-36482: add runbook_url annotations #2404
OCPBUGS-36206: Add deprecation for prometheus adapter #2396
OCPBUGS-34530: inject trusted CA bundle into UWM Alertmanager #2373
OCPBUGS-35904: opt-out of multi-cluster Prometheus dashboard #2391
OCPBUGS-34383: remove deprecated logtostderr argument #2370
OCPBUGS-35884: attach runbook to the PrometheusDuplicateTimestamps alert #2389
MON-3795, OCPBUGS-35061: Backport anp telemetry #2379
OCPBUGS-34806: send cnv_abnormal metric via telemetry #2364
MON-3861: Bump go tools 1.21 #2348
MON-3856: Bump openshift/prometheus to v2.52.0 #2342
OCPBUGS-32510: change metrics-server probes for SNO #2337
MON-3851: Bump openshift/thanos to v0.35.0 #2338
MON-3847: Bump openshift/node_exporter to v1.8.0 #2336
OCPBUGS-32510: tweak Prometheus RBAC setup as a temp fix. #2334
AUTH-482: set required-scc for openshift workloads #2335
MON-3163: support VPAs #2078
OCPBUGS-23801: update OTEL google.golang.org/grpc/otelgrpc #2321
NO-JIRA: Increase checkAlertmanagerAPIVerbs timeout #2330
MON-3487: base CP enablement on dedicated feature gate #2153
OCPBUGS-32177: fix wrong dir hack/tools of tools.go #2327
MON-3707: Add ipsec state metric into telemetry #2326
MON-3701: clean-up injection of trusted CA bundle for k8s Prometheus #2323
MON-3839: test: add skip tests for prometheus adapter tests #2328
MON-3820: allow read-only access for Alertmanager API #2319
MON-3701: remove trusted CA bundle from Thanos Querier #2325
MON-3701: follow-up of PR #2308 #2324
MON-3825: Synchronize versions of the downstream components #2322
OCPBUGS-30430: update google.golang.org/protobuf #2320
MON-3701: clean-up injection of trusted CA bundle for main Alertmanager #2310
MON-3783: add controller-id annotation to pods deployments and operator #2309
OCPBUGS-18643: address lint warnings #2284
WINC-1180: assets, jsonnet: Add container_network openshift-kubernetes.rules #2314
OCPBUGS-31847: Synchronize versions of the downstream components #2318
MON-3701: remove references to OAuth proxy #2308
MON-3706: chore: simplify GetServiceAccountToken() #2272
MON-3621: Enable extra-scrape-metrics feature in PrometheusUWM #2302
OCPBUGS-31411: add runbook link for KubeAggregatedAPIErrors alert #2316
OCPBUGS-29531: Add include.release.openshift.io/hypershift label #2264
MON-3778, OLS-117: Add OLS metrics to telemetry whitelist #2300
OCPBUGS-31920: go.mod: bump openshift/api #2290
MON-3700: replace OAuth proxy for Thanos Ruler #2294
MON-3799: Synchronize versions of the downstream components #2301
MON-3749: enable request headers flags for metrics server #2293
OCPBUGS-28650: fix generation of telemeter token hash #2298
MON-3801: remove oauth-redirectreference annotations #2299
MON-3793: Synchronize versions of the downstream components #2295
MON-3793: jsonnet: Bump jsonnet deps for prometheus-operator #2296
MON-3792: fix metrics-server path for /test versions #2286
MON-3789: add a golangci-lint-fix makefile target to fix golangci-lint errros when possible #2275
MON-3771: update Prometheus operator to v0.72.0 #2288
MON-3498: Modify prometheus-adapter e2e tests to compact with metrics server #2196
OCPBUGS-30257: Making sure proxy settings are correctly forwarded in the generated remote write configs #2269
OCPNODE-2100: jsonnet: update crio port to TLS port 9637 #2257
MON-3694: chore: encourage the use of the new ‘slices’ package instead of ‘golang.org/x/exp/slices’ #2243
MON-3748: Enable audit logs by default for metrics-server #2280
MON-3380: adjust prometheus-k8s service openshift.io/description #2279
MON-3747: Increase e2e test timeout to 150 min #2278
MON-3381: replace OAuth proxy for Alertmanager #2260
OCPBUGS-28246: fix Thanos ruler alert generator url #2267
MON-3706: Revert “chore: poll immediately in the e2e tests” #2271
MON-3717: pkg/client.go: make some CreateOrUpdateXXX functions use library-go’s resourceapply utils. #2226
MON-3717: update library-go to get https://github.com/openshift/libra… #2266
MON-3380: re-add kube-rbac-proxy for /metrics and /federate #2261
MON-3172: describe monitoring services #2188
MON-3706: chore: poll immediately in the e2e tests #2258
MON-3380: replace OAuth proxy for prometheus-k8s #2246
OCPBUGS-18326: add Console cap annotation to dashboards #2254
TRT-1489: Revert “jsonnet: update crio port to TLS port 9637” #2255
OCPNODE-2022: jsonnet: update crio port to TLS port 9637 #2229
MON-3705: [bot] Update jsonnet dependencies #2208
MON-3699: chore: merge OmitFromDoc with HideFromDoc introduced in https://github.com/https://github.com/openshift/cluster-monitoring-operator/pull/2210 to hide fields from the doc #2247
MON-3697: use maximumStartupDurationSeconds instead of container patch #2251
OCPBUGS-28246: fix: set externalURL in UWM Prometheus #2250
MON-3689: Synchronize versions of the downstream components #2245
OCPBUGS-27289: followup of https://github.com/openshift/cluster-monitoring-operator/pull/2242 #2244
STOR-1289: Move vSphere prometheus rules to cluster-storage-operator #2235
OCPBUGS-27289: rollout metrics-server on cert rotations #2242
OCPBUGS-27213: Adjust lastError injection to wait.PollUntilContextTimeout’s final error #2234
MON-3676: move raptorsun out of reviewer list #2240
MON-3673: [bot] Synchronize versions of the downstream components #2238
MON-2853: add runbook link to TargetDown alert #2237
MON-3661: [bot] Synchronize versions of the downstream components #2236
OCPBUGS-26983: rollout monitoring plugin on TLS rotation #2233
MON-3661: chore: update Prometheus operator to v0.71.0 #2230
MON-3667: remove outdated documentation #2232
OCPBUGS-25849: make PrometheusAdapter and MetricsServer tasks less conflict prone #2218
OCPBUGS-25378: drop InfoInhibitor from default Alertmanager config #2225
MON-3664: chore: avoid issues with std.set* functions #2231
MON-3654: use Go standard errors package instead of github.com/pkg/errors #2224
MON-1047: fix: add terminationMessagePolicy: FallbackToLogsOnError to all conta… #2228
MON-3552: remove temporary cleanup code and no longer needed tests #2210
MON-3650: Synchronize versions of the downstream components #2222
MON-3649: Synchronize versions of the downstream components #2221
MON-3644: Ease the tracking of monitoring components versions. #2220
OCPBUGS-25803: make CMO ConsolePluginComponents task resilient to dependencies #2193
OCPBUGS-25676: fix(tasks): adjust ‘trusted CA bundle ConfigMap’ related logs for alertmanagers. #2219
MON-3633: Synchronize versions of the downstream components #2214
OCPBUGS-24977: Updating cluster-monitoring-operator-container image to be consistent with ART #2211
OCPBUGS-25403: go.mod update k8s.io/api* to v0.29.0 #2205
MON-3589: Refactor assertExemplarsEnabled check for UWM Prometheus xand add a check for –scrape.timestamp-tolerance on Platform Prometheus #2194
OCPBUGS-24977: use 1.20 in go.mod #2199
MON-3592: Use strict yaml unmarshaling #2195
OCPBUGS-25025: go.mod: bump prometheus-operator to v0.70.0 #2191
OCPBUGS-24977: Updating cluster-monitoring-operator-container image to be consistent with ART #2190
OCPBUGS-24630: additionalArgs: list items must have named fields #2189
Full changelog

cluster-network-operator

OCPBUGS-67000: Re-disable metrics server #2855
OCPBUGS-63233: Manual feature backport of cert rotation for whereabouts #3040
OCPBUGS-84182: fix(hypershift): use net.JoinHostPort for URL construction #2981
OCPBUGS-75890: Tweak iptables-alerter to try to avoid crictl bug #2898
: NO-JIRA: Update CNO reviewers/approvers #2768
OCPBUGS-63155: Add drop flows for GARPs #2819
OCPBUGS-57354: block upgrade if a CNI migration is in progress #2760
OCPBUGS-62055: Update CNO reviewers/approvers #2803
OCPBUGS-44443: Add controlplane cli image envar for use with hypershift #2791
OCPBUGS-58392: Add IPsec API for NAT-T UDP encapsulation support #2736
OCPBUGS-56992: iptables-alerter streamlining #2717
OCPBUGS-56195: Fix live migration with feature migration configured explicitly #2710
OCPBUGS-53317: Fix feature migration for EgressIP #2673
OCPBUGS-52952: Unexpected Behavior During Cluster Upgrade for the ovn-ipsec-host pods #2663
[Release 4.16] OCPBUGS-50712: Not update status.migration of the network.config CR to empty #2651
OCPBUGS-51074: Update egressfirewall CRD to be consistent with ovn-kubernetes repo #2650
OCPBUGS-43803: Start feature migration when the cluster CNI is changed to the target type #2552
OCPBUGS-43715: Skip including default crypto policies to avoid authby issue #2598
OCPBUGS-44338: Prevent live migration process from flapping between step-2 and step-3 #2565
OCPBUGS-46148: Remove ip xfrm state when IPsec is disabled #2595
OCPBUGS-45593: Pass transit_switch_subnet options in ovnkube-node pod #2584
OCPBUGS-44846, SDN-5436: Provide support for user owned IPsec machine configs #2571
OCPBUGS-42727: Live migration: report network overlap via live_migration_blocked metric #2519
OCPBUGS-43604: OCPBUGS-42244: Exporting environment varialbe NODE_CNI for live migration #2538
OCPBUGS-36210: Set global IP forwarding sysctl parameters while starting ovnkube-node #2422
OCPBUGS-43544: Use CNIConfDir for mounting directory to ovn-ipsec-host pod #2537
OCPBUGS-43035: Configure narrowing=yes for IPsec connections #2528
OCPBUGS-36594: Set mount propagation to HostToContainer for /var/lib/kubelet #2430
OCPBUGS-41840: Add configurable subnets while running hybrid-overlay-node binary #2502
OCPBUGS-37763: Handle random crictl errors in iptables-alerter #2452
OCPBUGS-41555: HyperShift: do not use antiaffinity on single replica control planes #2494
OCPBUGS-37937: Add proxy env vars to onvkube-node #2457
OCPBUGS-41607: set required-scc for openshift workloads #2496
OCPBUGS-35407: Use applyconfigurations for updating network.oprerator status #2413
OCPBUGS-37362: Fix IC distributed control plane alerts #2445
OCPBUGS-35836: Propogate hypershift control plane priority class override to multus and preserve container resource requests #2417
OCPBUGS-35829: Create the configmap mtu if not found #2416
OCPBUGS-35923: update whereabouts crd #2419
OCPBUGS-34736: Limit iptables-alerter’s cpu #2407
OCPBUGS-34736: Handle pod exiting race conditions in iptables-alerter #2394
MON-3795, OCPBUGS-35061: Add ANP metric rule expressions for telemetry exposure #2398
OCPBUGS-34612, OCPBUGS-34660, OCPBUGS-34663: Live migration backports #2392
OCPBUGS-34964: Fix DNSResolver feature gate enablement #2402
OCPBUGS-34770: Ensure that the node-identity webhook address contains colons for IPv6 #2395
OCPBUGS-34214: Add conditions for ignored-namespaces #2378
OCPBUGS-34013: Add custom masquerade subnet against right key at ovnkube-config CM #2374
CFE-888: Enable DNSNameResolver feature-gate #2131
OCPBUGS-32979: Update network operator status for IPsec #2360
USHIFT-2912: Add ref to MicroShift’s Multus and CNI Plugins #2365
OCPBUGS-29403: add more safe sysctls #2273
OCPBUGS-32525: Check every MachineConfigPool for IPsec plugin existence #2349
OCPBUGS-28230: enforce termination message policy on all platform pods #2364
OCPBUGS-33080: Update EQoS CRD to latest #2362
SDN-4726: Reapply “Merge pull request #2330 from pperiyasamy/block-sdn-upgrade” #2361
OCPBUGS-28230: enforce termination message policy on all platform pods #2354
Revert #2330 “SDN-4726: Block upgrade for openshift-sdn” #2356
SDN-4434: Network diagnostics scheduling #2339
SDN-4726: Block upgrade for openshift-sdn #2330
SDN-4114: Add iptables-alerter daemonset #2329
OCPBUGS-31528: infraconfig: handle vSphere UPI by not updating any fields #2327
SDN-4163: Improved prometheus rule for ipsec metric #2346
OCPBUGS-32402: Fix wait logic for IPsec certificate signing request #2342
SDN-4688: ANP: Add RBAC for cluster-manager #2338
OCPBUGS-32347: Improve IPsec MachineConfig readiness check #2341
SDN-4163: Add ipsec state to telemetry #2270
OCPBUGS-22969: Use v1 for flowcontrol API #2095
OCPBUGS-28230: enforce termination message policy on all platform pods #2340
SDN-4519: Configure CNO as per new API changes for join and transit switch subnet #2318
OCPBUGS-28230: enforce termination message policy on all platform pods #2334
NP-956: Remove managed cluster checking for live migration #2321
OCPBUGS-26408: automountServiceAccountToken:false hosted CP pods #2306
SDN-4596: Update (B)ANP CRDs; prepare for GA #2328
SDN-4500: Add write permission for EgressQoS status #2319
SDN-4607: Allow HyperShift ability to set ConfigMap through env var #2309
OCPBUGS-22995: Tighten the permissions on whereabouts.conf #2106
OCPBUGS-24690: Fully disable network-node-identity on ROKS #2313
SDN-4598: Set runAsUser to env variable if it is set #2307
OCPBUGS-30103: ensure local networking deployments within hypershift use the client side load balancer to be resilient to control plane node failures #2288
OCPBUGS-30831: Updating cluster-network-operator-container image to be consistent with ART for 4.16 #2308
OCPBUGS-30299: Fix managed cluster detection on ARO #2299
OPNET-358, OPNET-360: Allow VIP mutation in Infra CR #2130
OCPBUGS-29288: Ensure proper deprecation for the default field manager #2274
OCPBUGS-24380, OCPBUGS-24381, OCPBUGS-24382: Update APBExternalRoute, EgressFirewall, EgressQoS permissions for ovnkube pods #2262
OCPBUGS-25764: memory-trim-on-compaction is enabled by default #2260
OCPBUGS-23788: Only allow valid values for gatewayConfig.ipForwarding #2127
OCPBUGS-29341: Run dhcp-daemon pods as system-node-critical priority #2280
OCPBUGS-24690: Disable network-node-identity on ROKS #2197
OCPBUGS-26492: Not set CNO to degraded if API server returns conflict error #2192
OCPBUGS-24214: Add ownership annotations #2120
OCPBUGS-24601: Add minReadySeconds to network-node-identity #2151
OCPBUGS-29305: ipsec: fix openssl typo #2269
OCPBUGS-28920: Update ingressconfig_controller to use field Manager #2259
NO-JIRA: Remove ILB from CNCC #2182
OCPBUGS-27222: Fix CloudPrivateIPConfig CRD in common #2249
OCPBUGS-24976: Updating cluster-network-operator-container image to be consistent with ART for 4.16 #2233
OCPBUGS-28676: Remove libreswan rpm existence checks #2238
OCPBUGS-29099: Add hostNetwork:true to cni-sysctl-allowlist ds #2237
OCPBUGS-24436: Add probes to node-network-identity #2148
OCPBUGS-24299: network-node-identity mounts secrets with mode 0640 #2142
OCPBUGS-28230: add FallbackToLogsOnError for easier debugging #2224
NP-874, OCPBUGS-27222: Bump openshift API #2246
OCPBUGS-24383: Limit write permissions for egressservices #2171
NP-903: Only allows live migration on standalone managed clusters #2236
OCPBUGS-19551: ovnkube: simplify northd threading and SNO templating #2234
OCPBUGS-24976: Updating cluster-network-operator-container image to be consistent with ART #2156
OCPBUGS-25079: Prevent NoRunningOvnControlPlane alert getting fired continuously #2208
NO-JIRA: add kyrtapz as reviewer and approver #2226
OCPBUGS-27823: Not update migration conditions when any MCP is updating #2213
OCPBUGS-26986: Add ConfigMap mount to the whereabouts-reconciler #2209
SDN-3708: Support configurable masquerade subnet in ovn-k #1807
OCPBUGS-26952: Deploy CNO IPsec MC even if user already have one #2201
OCPBUGS-27264: Only reconcile on Node updates with Label changes #2206
NO-JIRA: Fix jira component info #2199
SDN-4166: Enable N-S IPsec #2191
OCPBUGS-24379: Remove egressip write permissions from ovn-kubernetes-node #2170
OCPBUGS-24635: network node identity: tolarate all taints #2153
OCPBUGS-25207: Render IPsec MachineConfig after cluster settles with MachineConfigs #2187
OCPBUGS-25688: remove microshift folder, since CNO doesn’t manage it #2173
OCPBUGS-25669: Update ovn-k managed control-plane RBAC #2169
OCPBUGS-25760: Keep the live migration annotation consistant with the enhancement doc #2179
OCPBUGS-19635: OVN-K in SNO deployment mode: fix Lease override for CM #2070
SDN-4227: Use specific permissions for CNCC in GCP #2069
OCPBUGS-24693: HyperShift, network-node-identity: Check the deployment in the management cluster #2166
OCPBUGS-24176: Ignore invalid PEM blocks #2178
OCPBUGS-25337: Avoid removal of ipsec-host daemonset when node is NotReady #2161
HOSTEDCP-1308: remove service account token mount in cloud-network-con… #2165
OCPBUGS-23729: Set replicas of Multus admission controller according to Hypershift ControllerAvailabilityPolicy #2159
OCPBUGS-24036: remove all managed fields used by old manager #2114
OCPBUGS-23199: add env var in whereabouts-reconciler daemonset #2160
OCPBUGS-19830: fix whereabouts conformance test failures #2103
OCPBUGS-24650, SDN-4308: Set enable-multi-external-gateway flag in ovnkube.conf #2149
Full changelog

cluster-node-tuning-operator

OCPBUGS-82675: Bump github.com/moby/spdystream from v0.2.0 to v0.5.1 #1551
OCPBUGS-78766: [4.16] PPC: filter out namespaces dir #1466
And 123 elided commits (e.g. from squash or rebase merges)
Full changelog

cluster-olm-operator

OCPBUGS-86243: Update grpc-go to v1.67.3-sec.1 to fix CVE-2026-33186 #206
AUTH-482: set required-scc for openshift workloads #54
OPRUN-3291: Add roles for clusterextensions #53
OPRUN-3291: Add roles for validating admission policy APIs #52
OPRUN-3291: Update dependencies #51
OCPBUGS-31280: manual art compliance #50
OCPBUGS-32188: Update README.md #49
OCPBUGS-30491: Update kube dep to 1.27.12 #48
OCPBUGS-29553: Apply hypershift cluster-profile for ibm-cloud-managed #46
NO-ISSUE: Remove ncdc from OWNERS #45
OCPBUGS-28597: Reenable cluster-olm-operator #44
OCPBUGS-28597: Disable cluster-olm-operator #43
OCPBUGS-25542: Updating ose-cluster-olm-operator-container image to be consistent with ART #42
OCPBUGS-24794: Updating ose-cluster-olm-operator-container image to be consistent with ART #39
NO-ISSUE: Bump k8s.io/apiextensions-apiserver #37
Full changelog

cluster-openshift-apiserver-operator

OCPBUGS-68072: CVE-2025-65637 - Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.16] #654
AUTH-482: Set required-scc for openshift workloads #573
WRKLDS-1015: tolerate node-role.kubernetes.io/control-plane:NoExecute #574
OCPBUGS-29580: Apply hypershift cluster-profile for ibm-cloud-managed #572
OCPBUGS-32346: the apiservice controller waits until bootstrap complete #575
NO-ISSUE: Makefile: fixes test-e2e-encryption-rotation targets #577
NO-ISSUE: fix: TestRedeployOnConfigChange #576
OCPBUGS-22969: Use v1 for flowcontrol API #559
OCPBUGS-18115: Remove “include.release.openshift.io/ibm-cloud-managed:” annotation #566
OCPBUGS-18939: manifest: drop slo latency metrics in favor of sli #547
WRKLDS-1004: use AlwaysAllow UnhealthyPodEvictionPolicy in PDBs #562
OCPBUGS-24972: Updating ose-cluster-openshift-apiserver-operator-container image to be consistent with ART #561
Full changelog

cluster-openshift-controller-manager-operator

OCPBUGS-48657: Add new team members to owners file #378
OCPBUGS-38269: CVE-2024-24786 infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON #363
OCPBUGS-34213: lots of churn during image registry managed/removed transition #348
OCPBUGS-35822: nil pointer reference in ocm-operator #356
OCPBUGS-34384: [release-4.16] Disable Rolebindings for Capabilities #350
AUTH-482: set required-scc for openshift workloads #336
OCPBUGS-23848: Bumps opentelemetry dependencies #341
OCPBUGS-29973: Updating ose-cluster-openshift-controller-manager-operator-container image to be consistent with ART for 4.16 #337
OCPBUGS-29581: Apply hypershift cluster-profile for ibm-cloud-managed #334
OCPBUGS-22969: Use v1 for flowcontrol API #316
BUILD-854: Add adambkaplan as approver #338
OCPBUGS-24888: Updating ose-cluster-openshift-controller-manager-operator-container image to be consistent with ART #321
OCPBUGS-28666: Replace ‘coreydaley’ with ‘sayan-biswas’ in OWNERS file #326
OCPBUGS-23624: Add .snyk file to exclude vendor and ignore unit tests #325
WRKLDS-1016: Bump k8s dependencies to 1.29.0 #324
OCPBUGS-24190: Disable deployer-controller when deploymentconfig is disabled #320
Full changelog

cluster-policy-controller

OCPBUGS-30496: bump(google.golang.org/protobuf)=v1.33.0 #147
WRKLDS-1016: bump k8s to 1.29.1 #146
OCPBUGS-24877: Updating ose-cluster-policy-controller-container image to be consistent with ART #144
OCPBUGS-26190: Add .snyk file to exclude vendor and ignore unit tests #145
Full changelog

cluster-samples-operator

OCPBUGS-63516: references to github.com/sclorg/django-ex.git now also refer to the branch #659
OCPBUGS-55457: Adding mutex to func createSamples on handler.go #633
OCPBUGS-54420: add rhdmalone to owners #620
OCPBUGS-48848: add shannon and aroyoredhat as owners #596
OKD-225: remove only the EOL CentOS 7 images #576
OCPBUGS-38159: add owners #555
SO-121: Syncing the library for only S2i Samples for OCP 4.16 #543
Revert “SO-121: Resync Libray for 4.16” #542
SO-121: Resync Libray for 4.16 #540
OCPBUGS-31303: bump K8s version to 29.2 #536
AUTH-482: set required-scc for openshift workloads #535
OCPBUGS-26992: Align builder and base for Dockerfile.okd with Dockerfile #531
OCPBUGS-28230: add FallbackToLogsOnError for easier debugging #532
OCPBUGS-24787: Updating ose-cluster-samples-operator-container image to be consistent with ART #530
OCPBUGS-24787: Updating ose-cluster-samples-operator-container image to be consistent with ART #527
Full changelog

cluster-storage-operator

OCPBUGS-102969: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #733
OCPBUGS-87613: remove oVirt code from CSO 4.16 #709
OCPBUGS-78769: Add patch permission to provisioner role #685
OCPBUGS-61252: add ability to control kube rbac proxy container image on controlplane #614
OCPBUGS-52353: fix Vsphere cluster Storage operator in Unavailable state #563
OCPBUGS-46077: Fix PodStartupStorageOperationsFailing alert #548
OCPBUGS-43315: assets: shared-resource: hypershift: add pull-secret to operator SA #521
NO-JIRA: release-4.16: Run make update #512
OCPBUGS-36969: STOR-1839: VSphereDriverConfiguration feature Accessible-by-default #491
OCPBUGS-35298: revert vsphere problem detector controller name change #481
OCPBUGS-28230: enforce termination message policy on all platform pods #470
OCPBUGS-29126: vsphere-problem-detector: don’t set Available condition #456
OCPBUGS-28230: enforce termination message policy on all platform pods #467
STOR-1804: update ClusterCSIDriver CRDs #464
AUTH-482: set required-scc for openshift workloads #459
OCPBUGS-28748: log default storage class names when collector is triggered #460
OCPBUGS-30498: CVE-2024-24786: bump google.golang.org/protobuf to v1.33.0 #463
STOR-1758: Add azure file hypershift #454
OCPBUGS-28879: Fix problem-detector proxy setting #457
OCPBUGS-29573: Apply hypershift cluster-profile for ibm-cloud-managed #458
OCPBUGS-28765: Remove master node selector from azure-csi-driver-operator deployment #448
OCPBUGS-29196: Update AWSCSIDriverConfigSpec fields validation to accept all current AWS partitions #455
STOR-1574: Bump all deps #447
STOR-1611: remove ibm-vpc-node-label-updater #445
OCPBUGS-27159: Allow vSphere CSI driver to be disabled #444
STOR-1289: Move vSphere prometheus rules to CSO #442
STOR-1354: Remove Alibaba Disk CSI Driver #440
STOR-1574: Bump library-go #443
STOR-1722: Azure disk hypershift #420
STOR-1714: Release leadership on SIGTERM #437
OCPBUGS-22994: Add UsernameWithoutDomain as a reason for triggering VSphereOpenshitConnectionFailure alert #430
OCPBUGS-22422: Fix PodStartupStorageOperationsFailing alert #436
STOR-1688: Chore: add .snyk file to ignore false positives #434
OCPBUGS-25564: Updating ose-cluster-storage-operator-container image to be consistent with ART #435
CCO-251: replace instanceAdmin role with specific compute permissions #429
OCPBUGS-24927: Updating ose-cluster-storage-operator-container image to be consistent with ART #432
OCPBUGS-23852: CVE-2023-47108: bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp to v0.46 #431
Full changelog

cluster-update-keys

OCPBUGS-43467: keys: Update Red Hat keys to use SHA256 signatures #64
OCPBUGS-29570: Apply hypershift cluster-profile for ibm-cloud-managed #54
OCPBUGS-24932: Updating ose-cluster-update-keys-container image to be consistent with ART #53
Full changelog

cluster-version-operator

OCPBUGS-58452: Failing=Unknown upon long CO updating #1213
OCPBUGS-55156: Fix a panic caused by a data race #1178
OCPBUGS-50590: Set openshift.io/required-scc: privileged annotation in version pods #1153
OCPBUGS-46408: Filter out shallowly UpdateEffectNone errors from a MultipleErrors message in the Failing condition #1128
OCPBUGS-45329: deps: bump golang.org/x/net to 0.31.0 #1118
OCPBUGS-43964: Fix desired before sync_worker’s work is initialized #1097
OCPBUGS-37853: Revert “OCPBUGS-35994: Revert “OCPBUGS-24535: pkg/payload/precondition/clusterversion/rollback: Allow previous version within z-stream”” #1077
OCPBUGS-36898: vendor: Update openshift/api to pick up zz_generated.crd-manifests #1069
OCPBUGS-36764: Revert “OCPBUGS-24535: pkg/payload/precondition/clusterversion/rollback: Allow previous version within z-stream” #1065
OCPBUGS-35249: Revert: Add support for Custom Certificate Authorities for custom signature stores” #1053
OCPBUGS-24700: Add support for Custom Certificate Authorities for custom signature stores #1030
OTA-1160: pkg/cvo/reconciliation_issues: Publish ClusterOperator transitionStart #1044
NO-ISSUE: pkg/payload/task: Drop unused Requeued property #1043
NE-1318: Add always-enable-capabilities flag and set Ingress as always enabled #946
OCPBUGS-9133: pkg/cvo/metrics: Connect ClusterVersion to ClusterOperatorDown and ClusterOperatorDegraded #746
AUTH-482: set required-scc for openshift workloads #1038
NO-ISSUE: docs/user/tasks-*by-number-and-component.svg: Update to 4.15 #1042
OTA-1159: pkg/cvo: Render status.Failure in ReconciliationIssues #1041
OTA-1210: *: Add –update-service command-line option #1035
OTA-1159: [²⁄₃] Maintain ReconciliationIssues condition #1032
OCPBUGS-29868: Apply hypershift cluster-profile for ibm-cloud-managed #1037
NO-JIRA: Runbook URLs for ClusterOperatorDown and ClusterOperatorDegraded #1036
OCPVE-659: bump openshift/api with new capability #979
OTA-1159: [1/x] Refactor syncStatus for testability #1031
OCPBUGS-18454: Avoid using risk names as condition reasons when invalid #962
OCPBUGS-7714: yield lock while retrieving payload #1005
NO-JIRA: manifests: fix service manifest filename #1027
OCPBUGS-27468: bump(openshift/api)=master to pick up new TechPreviewNoUpgrade features #1026
OCPBUGS-7714: Refactor & improve SyncWorker lock code #1020
OTA-1169: deps: bump openshift/api and k8s.io/client.go #1022
OCPBUGS-25862: CO health: only track current in-progress upgrade start #1011
OCPBUGS-26014: clusterOperatorBuilder: Reconcile metadata on COs #1012
OCPBUGS-25708: pkg/cvo/availableupdates: Only bump LastAttempt on Cincinnati pulls #1009
OCPBUGS-24535: pkg/payload/precondition/clusterversion/rollback: Allow previous version within z-stream #996
OCPBUGS-24963: Updating cluster-version-operator-container image to be consistent with ART #1006
OCPBUGS-25055: pkg/cvo/sync_worker: Verification-failure details for unforced updates too #1003
OCPBUGS-24963: Updating cluster-version-operator-container image to be consistent with ART #1004
Full changelog

configmap-reloader

MON-3671: add machine424 and rexagod to OWNERS #55
OCPBUGS-24912: Updating configmap-reload-container image to be consistent with ART #58
Full changelog

console

OCPBUGS-98424: CVE-2026-59869 bump js-yaml #17158
Fix for OCPBUGS-92076: CVE-2026-44990 #16719
OCPBUGS-100513, OCPBUGS-101789: Fix CVE-2026-69153 and CVE-2026-45623 - Bump postcss #17060
OCPBUGS-114417: Prevent binary secret data corruption when editing #17101
OCPBUGS-105793: Disable failing OLM and other e2e tests to unblock CI #16958
OCPBUGS-105796: Fix operator-hub e2e test by replacing unavailable Red Hat catalog source with Community #17081
OCPBUGS-87987: [release-4.16] shell-quote: Arbitrary code execution via command injection due to unescaped line terminators #16599
OCPBUGS-81597: CVE-2026-4800 #16566
OCPBUGS-77123: [release-4.16] CVE-2026-26996 Bump minimatch library #16346
OCPBUGS-79439: Bump immutable #16657
OCPBUGS-88027: Fix JSON annotation parsing to prevent OperatorHub crash #16588
OCPBUGS-88377, OCPBUGS-88380, OCPBUGS-88412, OCPBUGS-88419, OCPBUGS-88444: CVE-2026-44495 #16612
OCPBUGS-88554: Stabilize legacy OperatorHub Cypress waits #16608
NO-JIRA: enable multi-architecture yarn builds #16417
OCPBUGS-83299: [release-4.16] openshift4/ose-console-rhel9: Axios: Remote Code Execution via Prototype Pollution escalation #16298
OCPBUGS-78673: Namespace is not persisting when switching to developer view from the topology page of admin page #16161
CONSOLE-5011: migrate to yarn berry #16078
OCPBUGS-76578: Bump axios #16032
NO-JIRA: Bump builder image to v29 #15993
OCPBUGS-74447: Bump lodash to latest #15967
OCPBUGS-69678: Disallowed Pipelines-plugin Pipelines navigation section #15857
OCPBUGS-64884: Remove required flag from ‘console.flag/model’ pipelines-plugin extension #15707
OCPBUGS-64649: /auth/error?error=missing_state&error_type=auth is showing blank page #15675
OCPBUGS-44157: bump dompurify to latest #15591
OCPBUGS-62123: Remove ancient X-XSS-Protection header #15528
OCPBUGS-61057: OpenShift console PVC clone cannot use B as the unit #15450
OCPBUGS-60175: Tolerate unknown fields in Infrastructur… #15368
OCPBUGS-60641: Secret key with binary file changes when edited via Console #15417
OCPBUGS-59869: Not able to launch terminal window from OCP web console due to console plugin conflicts #15334
OCPBUGS-57677: Update the golang.org/x/crypto/ssh to 0.31.0 in the openshift-console image #15328
OCPBUGS-60115: Cannot read properties of undefined (reading ‘node-role.kubernetes.io/master’) error while accessing node logs from console #15358
OCPBUGS-59358: fix bug where / in console.tab/horizontalNav href brea… #15286
OCPBUGS-37603: Manual backport of several incremental fixes for unauthenticated endpoints #15312
OCPBUGS-59274: Add the ability to launch multiple modals with useModal hook #15276
OCPBUGS-59445: Cannot read properties of undefined (reading ‘filter’) error while accessing nodes from console. #15291
OCPBUGS-58407: Add flags in console static plugin for all the components of this epic #15243
OCPBUGS-56838: Fetching taskRuns in PLR details page using PLR UID also #15099
OCPBUGS-58188: Fix TypeError Cannot read properties of null (reading ‘metadata’) #15214
OCPBUGS-57326: Remove logoutOpenShift method call #15172
OCPBUGS-57270: Debug pod logs are not accessible when debugging a node via OpenShift Console #15165
OCPBUGS-57096: Add all files to vendor regardless of gitignore #15133
OCPBUGS-57089: Sample segment sessions #15130
OCPBUGS-56858: remove 60 day alert from cluster update modal #15102
OCPBUGS-56715: update the Deployment pod on change in imageStream #15091
OCPBUGS-56472: Remove the devconsole backend common internet proxy and replace it with dedicated ones #15072
OCPBUGS-55378: Do not load CSRs if user does not have permissions #15000
OCPBUGS-55644: fix bug where operator appears twice #15016
OCPBUGS-45142: Add missing pipelines plugin name to known plugins #14550
OCPBUGS-48628: Added token to proxy header #14693
OCPBUGS-54174: Update the monitoring topic used by the console team #14900
OCPBUGS-52450: fix run time error when no completed version exists #14840
OCPBUGS-52851: Show Observe section without PROMETHEUS and MONITORING flags #14849
OCPBUGS-52288: While upgrading the cluster from UI observed Warning alert:Admission Webhook Warning #14821
OCPBUGS-49409: ERROR in search tool: Cannot read properties of undefined (reading ‘state’) #14703
OCPBUGS-52418: While accessing the node terminal from UI observed ‘Warning alert:Admission Webhook Warning` #14837
OCPBUGS-49979: Set default build option as BUILDS for Builder Image sample #14730
OCPBUGS-49800: Fix Function Import: An error occurred Cannot read properties of undefined (reading ‘filter’) #14715
OCPBUGS-49801: use default StorageClass for ServerlessFunction pipelineVolumeClaimTemplate #14716
OCPBUGS-46388: fix alert rule link #14808
OCPBUGS-52252: Fix alert rule link to alert in dev perspective #14817
OCPBUGS-46441: Do not pass CSV name to operand list page when an exen… #14627
OCPBUGS-36963: Manually create an API token for a ServiceAccount #14057
OCPBUGS-35394: sessions: fix sessions pruning #13969
OCPBUGS-46602: ReRun of Resolver based PipelineRuns fails from UI #14641
OCPBUGS-46567: ImagePullSecret getting duplicated when editing DeploymentConfig in Form View #14636
OCPBUGS-48162: OCP web console show pod status as Init:0/1 after using Native sidecars #14668
OCPBUGS-43672: Disable GQL introspection #14638
OCPBUGS-45334: fix table combination #14576
OCPBUGS-41342: fix namespace for networkpolicy #14244
OCPBUGS-46022: Plugins that use very old PF4 dropdown or menu components with grouped items have bullets and padding that needs to be removed. #14612
OCPBUGS-45229: Unable to remove finally tasks in pipeline builder mode #14558
OCPBUGS-45245: use TaskRuns results.tekton.dev/record annotation to get the logs #14563
OCPBUGS-41523: i18n upload/download routine task - Sprint 254 #14258
OCPBUGS-45015: Remove ClusterTask dependency in console from Pipelines 1.17 #14537
OCPBUGS-44792: Collapse/Expand Feature Added, Removal Option Removed in Version 4.16 #14519
OCPBUGS-44875: Start last run do not work in buildConfig details page #14529
OCPBUGS-44874: Telemetry userPreference results in empty nodes output to the DOM #14528
OCPBUGS-45124: Add multiline support to template instantiation #14545
OCPBUGS-44885: include external labels so silenced alerts not displayed in notifications #14530
OCPBUGS-44932: Add IBM Block Storage CSI driver support for RWX #14533
OCPBUGS-43447: Ensure envs are initted upon first load #14405
OCPBUGS-44806: Don’t request user settings configmap if no user has been loaded. #14522
OCPBUGS-44207: Create RoleBinding will trigger Admission Webhook Warning #14465
OCPBUGS-44219: Add flag to hide the pipelines-plugin pipeline builder extensions #14466
OCPBUGS-41673: Update vendor imports to include all PatternFly components #14273
OCPBUGS-43834: Enabling topology e2e tests on CI #14438
OCPBUGS-35204: replace global refresh sync lock in OIDC provider with per-refresh-token one #13950
OCPBUGS-36556: Increase login flow state paramater length/entropy #14354
OCPBUGS-42369: Console crashes when ssh is selected in add secret for starting a pipeline run #14320
OCPBUGS-41904: fix annotation for ovn localnet #14366
OCPBUGS-37615: Include PatternFly-4 chart styles so they are available for dynamic plugins that still use PF4 react-charts #14091
OCPBUGS-37689: Switch to use annotations as labels from PipelineRuns created through Pipelines as Code is deprecated #14094
OCPBUGS-42015: Topology screen crashes when completed pod is selected #14298
OCPBUGS-35850: Fix: Quick Start “next” button requires double click to move to next step #13989
OCPBUGS-42382: Allow operators to enable monitoring by default #14317
OCPBUGS-41905: List of default Camel K event sources disappears when adding a custom event source #14290
OCPBUGS-41709: Need to allow blank for Project/namespace when setting SA Subject in ‘Project access tab’ #14278
OCPBUGS-42069: add Create button to Console plugins tab #14302
OCPBUGS-41996: Fix updating the “Until” field on the Silence > Edit page #14296
OCPBUGS-38112: do not directly mutate links in useMemo #14117
OCPBUGS-34518: Restore user toggle when authentification is disabled #13902
OCPBUGS-41619: Use vCenterCluster value from CM as primary resource #14268
OCPBUGS-37046: Fix TypeError: Cannot read properties of null (reading ‘metadata’) in Topology view #14059
OCPBUGS-38911: Values entered into the Instantiate Template form are automatically cleared #14187
OCPBUGS-38914: Unrelated readme opened when opening CodeReady workspaces from Quarkus using s2i quickstart #14188
OCPBUGS-38968: A value submitted in From view is wrapped with single quotation after switching to Yaml view. #14193
OCPBUGS-38424: fix bug where cluster version text appears black in da… #14144
OCPBUGS-38464: correct casing in “Lightspeed” #14148
OCPBUGS-37430: Fix utilization card limits/total display #14082
OCPBUGS-36510: DeploymentConfigs deprecation info alert should not present on the Edit deployment page #14031
OCPBUGS-37954: No access to list pipelines.tekton.dev prevents from using Delete application form #14107
OCPBUGS-36601: Tooltip on Pipeline when expression is not shows #14033
OCPBUGS-38803: CONSOLE-4108 [4.16 backport] Show deprecated operators in OperatorHub #14095
OCPBUGS-37048: Fix “Auto deploy when new image is available” becomes unchecked when editing a deployment from web console #14060
OCPBUGS-35839: Fix placement of icons on WebKit #13988
OCPBUGS-35271: Fix password set to Secret created through Start Pipeline form #13954
OCPBUGS-38093: correct link for Lightspeed operator #14112
OCPBUGS-36484: Revert - terminal: use username if uid is not present #14027
OCPBUGS-37097: Add useQuickStartContext hook and expose it via dynamic plugin API #14070
OCPBUGS-36864: maintain session across tabs #14051
OCPBUGS-36620: Redirects to new PipelineRun logs URL from old PipelineRun logs URL #14035
OCPBUGS-36759: RWOP accessMode is not available on OpenShift console UI #14040
OCPBUGS-37063: hide ‘View all steps in documentation’ for ROSA and OSD #14069
OCPBUGS-36411: fix BMH restart annotation #14022
OCPBUGS-36841: ensure correct API version for OperandDetails #14049
OCPBUGS-36186: Add default sorting column for VirtualizedTable component of dynamic plugin sdk #14008
OCPBUGS-36002: fix flaking crd-extension tests #14003
OCPBUGS-35565: remove duplicate OAuth config #13982
OCPBUGS-35571: Update Go prereq in README.md #13981
OCPBUGS-35465: ManagedField in YAML editor is not collapsed by default which is incorrect #13974
OCPBUGS-35408: fix pseudolocalization #13972
OCPBUGS-35280: Ensure requiredVersion is set for Console provided shared modules #13956
OCPBUGS-34011: Use bridge instead of cnv-bridge #13875
OCPBUGS-35946: Fix invalid node filesystem query #13999
OCPBUGS-34717: The s2i build strategy is not assumed for Serverless Functions #13915
OCPBUGS-34968: Update plugin docs regarding Console 4.16 shared module changes #13933
OCPBUGS-35281: Display of “Auth Token GCP” filter in OperatorHub should be conditioned #13955
OCPBUGS-35472: bump helm to 3.14 #13971
OCPBUGS-35481: fix crash if helm chart metadata is nil #13975
OCPBUGS-35395: Keep useUserSettings hook in the internal api #13970
OCPBUGS-35152: restore missing CloseButton styles #13947
OCPBUGS-35318, OCPBUGS-35319, OCPBUGS-35320: disabling add-flow A-04-TC01 test and knative tests due to flakes #13962
(chore) Update tectonic builder image to use golang-1.21 #13944
OCPBUGS-34139: Improve Pipeline list page performance #13882
OCPBUGS-34002: Fix console crash-loop with OIDC auth config #13874
OCPBUGS-34711: show “Debug container” link for pods with status.phase… #13914
OCPBUGS-33965: i18n - Download and merge French and Spanish languages translations in the OCP Console #13870
OCPBUGS-34393: fix bug where textarea is not resizable #13894
OCPBUGS-33989: Updating the secrets using Form editor displays an unknown warning message #13873
OCPBUGS-34112: Fix Admission webhook warning for Route and BuildConfig creation via import flow #13881
OCPBUGS-34141: UI inconsistency in topology when application grouping is collapsed #13883
OCPBUGS-34142: Import from Git allow users to import an app with Build option Pipeline also when no Pipeline is available #13884
OCPBUGS-34143: Create Serverless form does not create BuildConfig #13885
OCPBUGS-33872: add user-impersonation to QuickStartGettingStartedCard,… #13864
OCPBUGS-32631: TaskRuns should not be fetched for Failed PLR’s #13806
OCPBUGS-33567: Expose useUserSettings hooks in dynamic plugin sdk #13843
ODC-7576: Pipelines plugin test fixes #13841
OCPBUGS-31901: Patch PF dynamic module parser to exclude ‘next’ modules #13832
ODC-7574: Add e2e tests for QuickStart from Masthead in CI #13837
OCPBUGS-33523: restrict Masthead logo to max-height #13838
OCPBUGS-29745: Fix Pipeline details page with when expression using CEL expression #13834
CONSOLE-4019: Display a warning message from kube-apiserver when creating resource integration tests #13814
CONSOLE-3943: Backup to segment public api key #13821
OCPBUGS-33352: Fix PatternFly modules check #13817
OCPBUGS-33345: Disable create button on NAD empty state for regular user #13805
CNV-36170: Multi NetworkPolicies #13772
OCPBUGS-33219: Fix StatusItem layout when no timestamp is present #13815
OCPBUGS-31558: Fix NAD creation defaulting to the default namespace #13822
OCPBUGS-33222: List DeploymentConfig triggers a warning notification which is not required for Display warning policy feature #13818
OCPBUGS-33199: The filepath including leading slash makes error during parsing devfile using Gitlab #13812
OCPBUGS-33202: Pipeline list page is crashed when navigating from Search page #13813
CONSOLE-3939: Display a warning message from kube-apiserver when creating / updating workloads resource #13763
OCPBUGS-32707: Fix React Router useParams in dynamic demo plugin #13803
CONSOLE-1756: replace PodIP with PodIPs or HostIP with HostIPs if mor… #13774
ODC-7437: Remove pf classes in topology package #13710
OCPBUGS-33011: fix issues with Edit Route form #13799
CONSOLE-4014, OCPBUGS-32791: Consume telemetry CLUSTER_ID and use it together with orgId as segment identifier #13786
ODC-7435: Remove pf classes in pipelines package #13739
ODC-7569: Automation of the Recently Used Resources Section in the Search Resource page Dropdown #13791
ODC-7566: Remove the Approvals Feature from the Console Repository #13789
ODC-7547: Add e2e tests for QuickStarts in CI #13764
ODC-7438, ODC-7535: web-terminal automation improvement #13749
OCPBUGS-32741: change OperatorHub filter FIPS Mode to Designed for FIPS #13790
WINC-1180: Use record created for container_network metrics #13759
OBSDOCS-986: Update the Monitoring topic used by the console team #13765
ODC-7433: Remove PatternFly classes from helm integration tests #13777
CONSOLE-4020: i18n upload/download routine task - Sprint 252 #13760
OCPBUGS-32725: fix OIDC logging out #13755
OCPBUGS-32059: Helm Plugin’s Catalog incorrectly renders a single index entry into multiple tiles #13776
OCPBUGS-32222: Add warning about service binding operator will not be supported from 4.15 #13766
ODC-7554: Update the UI according to the recent changes from UX #13723
ODC-7565: Update owners files (remove reviewers and add Avik and Prabhu as approvers for ODC) #13773
OCPBUGS-13114: Add visual connector between VMs and non VMs workloads #13617
OCPBUGS-31809: Pipeline details page Metrics tab crashed due to no custom data #13733
OCPBUGS-30426: Bump github.com/cloudevents/sdk-go/v2 to 2.15.2 #13661
OCPBUGS-28723: Improve Create serverless function error message #13591
OCPBUGS-32218: fix runtime error on Pending pod details page #13768
ODC-7479: automation of quick-starts-cluster-overview.feature #13715
OCPBUGS-12857: Add NaN handling for Stacked Graphs #13712
OCPBUGS-26073: setting correct image trigger annotation #13492
CONSOLE-3944: Disable segment analytics when cluster telemetry is disabled #13677
OCPBUGS-32019: Handle loading issue for PLR status in PLR list page #13747
OCPBUGS-29377: Routes created by devfiles do not always use HTTPS #13725
OCPBUGS-32307: Increase Max node limit for topology page to 300 #13761
OCPBUGS-22405: Add a button to enable autoscaling for a deployment that is scaled to 0 #13711
OCPBUGS-32189: Fix PatternFly version resolution check script for MacOS #13757
CONSOLE-3759: Update file-loader pkg #13743
OCPBUGS-31430: Re-enable Pipelines e2e tests #13700
OCPBUGS-32175: Update i18n docs : Change “traditional Chinese” to “simplified Chinese” #13754
OCPBUGS-32117: Add flag to hide Output tab contributed by pipelines-plugin #13751
CONSOLE-3997: Bump Yarn to v1 latest & add script to check PatternFly modules #13706
OCPBUGS-31745: TaskRun status is not displayed near the name #13746
CONSOLE-3916: Direct OIDC tech debt #13647
OCPBUGS-31082: Remove deprecated resources from spec of the Pipeline #13741
OCPBUGS-31759: Update i18n docs on how to update Phrase Project Template #13730
OCPBUGS-31843: Use UserInfo username field when logging out as kubeadmin #13740
OCPBUGS-31680: Correct the button text for VolumeSnapshotContent #13742
WINC-1182: [node] Modify filesystem queries to include Windows metrics #13662
OCPBUGS-31703: Resource yaml with create #13722
CONSOLE-4014: Consume the telemetry parameter ORGANIZATION_ID and pass it as organizationId parameter to segment #13728
OCPBUGS-23319: fix bug where paused MCPs were incorrectly unpausing w… #13717
OCPBUGS-31744: Add fr and es languages to i18n script for Memsource upload #13729
OCPBUGS-29616, OCPBUGS-29823, OCPBUGS-31613: Add validation for vSphere fields #13726
OCPBUGS-23480: Improve PipelineRun list view performance #13676
OCPBUGS-31732: Hide the cluster configuration for analytics #13727
OCPBUGS-31482: oidc: use our own pre-configured client for token refreshes #13716
OCPBUGS-31695: Use bearer-token for local dev with auth #13720
OCPBUGS-31355: add readOnly option to ResourceYAMLEditor #13694
ODC-7436: shipwright test package update concerning pf5 update #13660
OCPBUGS-31431: Hide dev perspective Pipelines nav option if dynamic plugin nav option is enable #13701
ODC-7431: dev-console test package update concerning pf5 update #13685
OCPBUGS-31315: i18n upload/download routine task - Sprint 249 #13692
OCPBUGS-29479: fix asynccache improper initialization #13703
OCPBUGS-24830: Updating openshift-enterprise-console-container image to be consistent with ART #13454
Revert “OCPBUGS-19640: Dont render ARN mode role field and warning for HyperShift clusters” #13705
CONSOLE-3883: Improve local plugin development docs #13679
OCPBUGS-30958: Upgrade Pipeline trigger resources to v1beta1 #13702
OCPBUGS-30824: Remove react-helmet from Console provided shared modules #13687
CONSOLE-3971: add impersonate action to Group list and details pages #13671
OCPBUGS-28585: remove generics from use*Modal docs #13689
OCPBUGS-24637: Fix storage request unit dropdown to display any valid unit #13620
OCPBUGS-29992, OCPBUGS-30584: PatternFly upgrade to 5.2.1 followup to… #13693
CONSOLE-3972: add Last Status to Pod details Container list and Conta… #13674
ODC-7531: Added the ApprovalTask List Tabbed Page #13651
ODC-7546: Fix that the UI doesn’t load on non-openshift clusters #13408
ODC-7498: Show an opt-in / opt-out option to the user depending on the cluster configuration #13587
ODC-7434: Knative test package update concerning pf5 update #13562
OCPBUGS-24049: Add option to enable/disable tailing to Pod log viewer mobile screen issues #13394
CONSOLE-3949: Add support for returning response.header in consoleFetchCommon function #13623
CONSOLE-3969: Enable French and Spanish in the OCP Console #13665
ODC-7519: Update the Pipeline Topology to adjust the new node design for the CustomRun #13613
CONSOLE-3922: Convert legacy ListPage to dynamic-plugin-sdk ListPage- components in Console VolumeSnapshots Storage #13560
ODC-7489: automation for getting-started-tour-dev-perspective feature file #13531
OCPBUGS-30052, OCPBUGS-30575: PipelineRuns in Console show wrong status or load indefinitely #13659
CONSOLE-3965: i18n upload/download routine task for version-4.16/ sprint-248 #13652
ODC-7492: automation for sample-card-add-page feature file #13589
OCPBUGS-30567: Remove wrong arguments in K8sCreate method instance for Create YAML editor #13658
OCPBUGS-30297: TaskRun with same name in different project don’t show 2 entries when listing in all namespace #13650
CONSOLE-3931: replace existing CloseButton with one from @patternfly/… #13588
OCPBUGS-30805: fix Configure link in AlertmanagerReceiversNotConfigur… #13666
OCPBUGS-30762: Fix bugs in Console dynamic plugin SDK webpack code #13657
ODC-7539: Update devfile library to v2.2.2 #13045
OCPBUGS-26415: Application creation fail when manually entering input scaling value in local setup #13487
OCPBUGS-30551: Switch to service to get the PLR and TR logs from the Tekton results summary API #13654
OCPBUGS-29513: Update the Pipeline List and Details Pages to acknowledge Custom Task #13614
OCPBUGS-29365: Requesting for country codes in localization of openshift - webconsole #13612
OCPBUGS-25931: fix for execute inline markdown syntax issue #13580
RHSTOR-4130: Cross storage class clone /restore #13549
OCPBUGS-27469: “Deploy Image” with “Serverless Deployment”, Scaling “Min Pods”/“Max Pods” should set “autoscaling.knative.dev/min-scale”/max-scale not minScale/maxScale #13534
OCPBUGS-30073: Upload Jar form’s Clear button is not functioning #13644
OCPBUGS-21800: Dev console buildconfig got [the server does not allow this method on the requested resource] error when not setting metadate.namespace #13544
OCPBUGS-30046: Missing dependency warning error in console UI dev env #13640
OCPBUGS-22894: adjusting documentation links for 4.15 #13634
OCPBUGS-30077: Add additional search filters in the toolbar #13233
ODC-7480: Recently Searched Section in Search Resource Page Dropdown #13389
CONSOLE-3907: add actions extension point to Events #13554
OCPBUGS-22487: Fix operands list endpoint. #13632
CONSOLE-3948: rename ‘supported but not recommended’ to ‘known issues… #13622
OCPBUGS-29701: Use selfsubjectreview API from frontend #13605
ODC-7478: Gherkin and automation of “Install Red Hat Developer Hub with a Helm Chart” guided tour #13511
CONSOLE-3924: i18n upload/download routine task - version4.16/sprint247 #13608
CONSOLE-3776: Add GCP token auth to Infrastructure features filter section in OpertorHub #13559
OCPBUGS-29816: Switch to service from external result route endpoint #13624
OCPBUGS-29757: Use HTTP proxy configuration from environment variables in dev-console proxies, so that our backend proxies works fine on airgapped clusters #13619
OCPBUGS-28967: ‘Oh no somthing went wrong’ shown on Image Manifest Vulnerability page after create IMV via CL #13578
CONSOLE-3921: Remove Disks/NICs page from Node details #13552
CONSOLE-3883: Update dynamic plugins README #13598
OCPBUGS-29760: Dev console: Observe > Dashboard page should be called “Dashboards” (OU-260) #13597
CONSOLE-3774: Enable OperatorHub filter by TLSProfiles annotation #13555
ODC-7477: automation of quick-start-access-code-snippet.feature #13494
OCPBUGS-29423: update TableData doc to use PatternFly 5 classname #13606
OCPBUGS-29363: TaskRuns list page is loading constantly for all projects #13604
OCPBUGS-29355: Output image url link leads to 404 for Shipwright Builds #13602
OCPBUGS-29601: Disabling pipeline tests to restore CI health #13611
ODC-7476: automation for getting-started-serverless gherkin #13476
OCPBUGS-27473: Error in displaying BuildRun logs in Console #13583
CONSOLE-3883: Update Console vs. dynamic plugin SDK package compat table #13586
OCPBUGS-9714: Any namespace after deletion is still visible on UI if it is the default selection in namespace dropdown #13411
OCPBUGS-28718: Revision tab and routes tab in serving details page showing no resource found #13556
OCPBUGS-26566: Page fails to return to the Secrets list after clicking ‘Cancel’ on any Secret creation page #13504
OCPBUGS-28383: Activity card event has expanded content that is not correctly left aligned with the rest of the card content #13547
OCPBUGS-27247: improve empty state message for Machines and MachineSets page #13577
OCPBUGS-25942: make sure folder is encapsulated with quotas #13477
OCPBUGS-27246: Unhealthy conditions table should put Type as first column on MachineHealthCheck details page #13576
OCPBUGS-22749: Adjust NAD name to “network-xxx-xxx” when creating #13568
ODC-7490: Add TaskRun tab in PLR details page using plugin #13527
OCPBUGS-28856: make getGroupVersionKindForResource null safe #13574
OCPBUGS-27908: fix i18n for Remove volume modal #13550
CONSOLE-3377: Add Cypress integration tests for ConsoleYAMLSample CRDs #13567
OCPBUGS-28836: AUTH-440: fix usersettings identifier creation #13557
OCPBUGS-27310: Source column header not displayed in PVC > VolumeSnapshots tab #13565
CONSOLE-3853: Optimize module federation of PatternFly packages #13521
CONSOLE-3909: i18n upload/download routine task - chore(i18n): update translations #13519
CONSOLE-3818: Remove Chrome from the console builder image #13539
OCPBUGS-28216: Adjust width and spacing so that warning icons are not clipped. #13546
OCPBUGS-26236: VolumeSnapshots data not displayed in PVC > VolumeSnapshots tab #13485
OCPBUGS-25936: fix copy-execute-demo.yaml inline syntax #13471
AUTH-440: OIDC: refresh sessions with a refresh token if present #13513
OCPBUGS-25843: Fixed bug with user feedback where inform the direction of RedHat was not showing up #13483
OCPBUGS-25881: remove “openshift-storage” namespace usage from the console #13418
OCPBUGS-27455: do not deduplicate ImageManifestVulns in Overview popover #13529
OCPBUGS-27016: fix resizeObserver limit exceed for dev-console #13502
OCPBUGS-27152: Fix popover jump in Tables #13524
OCPBUGS-25788: Add Node Maintenance menu actions to Node list/details #13506
OCPBUGS-27779: fix bug where Expand PVC modal assumes pvc.spec.resou… #13532
CONSOLE-3430: add Cluster Settings > Details integration tests #13515
ODC-7482: Add flags checks to hide Pipeline static plugin List and details pages #13512
OCPBUGS-27498: Update get method so it can display zero value when set #13533
OCPBUGS-16736: Addition of optional chaining to prevent yaml crash #13510
OCPBUGS-27399: Filter out Client CSRs for nodes which already exist #13522
CONSOLE-3829, OCPBUGS-16814: backend: use the k8s SelfSubjectReview API to get info about a user #13321
AUTH-440: expand options for the OIDC authenticator #13276
OCPBUGS-26772: fix bug where Clone PVC modal assumes pvc.spec.resourc… #13503
OCPBUGS-26039: Make editor sidebar width consistent #13495
OCPBUGS-10851: Add source maps to production builds #13497
OCPBUGS-25890: Prevent complete page reload when changing perspective #13500
OCPBUGS-14481: update check for the ‘provider’ label on the PackageMa… #13491
OCPBUGS-26554: Fixed some problems in topology Chinese translation text #13458
OCPBUGS-18699: add additional check to determine if file is binary #13496
ODC-7465: Update Getting started section in Openshift UI to use expandable section #13466
chore(i18n): update translations: Completed OCP-4.15/Master Branch/Sprint 245 #13441
OCPBUGS-25722: Add support for custom segment domains (to load JS and make API calls) #13459
OCPBUGS-26049: Tab VolumeSnapshots crashed on PVC page #13481
OCPBUGS-25780: add integration test to check that Update cluster moda… #13480
OCPBUGS-25898: Fix PipelineRun Logs tab navigation #13470
OCPBUGS-25840: make Azure warning title consistent #13472
OCPBUGS-25771: Enable catalog source badge to truncate for long names #13474
OCPBUGS-25780: fix bug where Update cluster modal will not open #13473
OCPBUGS-25934: clean up icon color and sizes #13460
OCPBUGS-25927: Fix config ini format #13210
OCPBUGS-25612: Logs for PipelineRuns fetched from the Tekton Results API is not loading #13455
OCPBUGS-24592: Fix CI tests in helm and devconsole packages #13464
OCPBUGS-25206: Re-enable and fix pipelines e2e tests #13438
OCPBUGS-18844: Replace the old sr-only class to the patternfly pf-v5-u-screen-reader class #13453
HELM-522: bump helm version to 3.13.2 for OCP 4.15 #13410
OCPBUGS-25441: fix Observe tab in Topology overview #13451
OCPBUGS-25530: fix bug where filter at mobile could be empty on Searc… #13456
OCPBUGS-25396: update the checks for showing Archived to Tekton results icon for PLRs and TRs list and details page #13450
CONSOLE-3874: Refactor EventStream #13431
OCPBUGS-23299: Replace checkbox with PF checkbox component to correct alignment #13397
OCPBUGS-23925: Follow on logic for only showing VPAs associated with a deployment for a specific project #13445
OCPBUGS-24711: fix preferredTab selection on Pipelines page #13430
OCPBUGS-24715, OCPBUGS-25018: Fix pipelineRuns loading on repository details page #13432
OCPBUGS-24830: Updating openshift-enterprise-console-container image to be consistent with ART #13434
OCPBUGS-24408: fix runtime error on Node details Overview when Machin… #13422
OCPBUGS-23378: Prevent text overlap with popover close button on Create NetworkPolicy form #13429
CONSOLE-3853: Prevent PatternFly styles from being included in plugin compilation #13388
OCPBUGS-24280: Add missing https:// check for an external link #13421
chore(i18n): update translations: : Completed OCP-4.15/Master Branch/Sprint 244 #13403
OCPBUGS-5113: Date&Time values are not showing as per browser default language #12506
OCPBUGS-23925: Only show VPAs that are associated with the selected namespace #13417
OCPBUGS-24186: Strip ‘Server’ header from proxy response #13404
Console-3733: Add support for Azure Workload Identity / Federated Identity based installs in OperatorHub #13082
And 7 elided commits (e.g. from squash or rebase merges)
Full changelog

console-operator

OCPBUGS-102982: Use github.com/openshift-sustaining/net patch to fix CVE-2026-33814 #1225
OCPBUGS-77992: update go mod dependency for konflux #1115
OCPBUGS-60794: Update downloads deployment configuration to use master node selector #1036
OCPBUGS-46481: Dont disable console when authConfig type is set to None #952
OCPBUGS-34783: set required-scc for openshift workloads #908
OCPBUGS-34012: Cache organization ID #916
OCPBUGS-33788: Tolerate the absence of ingress capability on HyperShift clusters #910
CONSOLE-4047: Console-operator should be internally using listers for fetching data #901
OCPBUGS-33505: Add missing return statement to fix crash in healthcheck controller #900
OKD-214: Dockerfile: Add ARG TAGS=ocp #896
TRT-1664: Revert #895 “CONSOLE-4047: Console-operator should be internally using listers for fetching data” #899
CONSOLE-4047: Console-operator should be internally using listers for fetching data #895
CONSOLE-3943: Default telemetry values #890
CONSOLE-4014: Pass OCM organization ID and OCP cluster ID to console-config.yaml #893
TRT-1623: Revert “Merge pull request #889 from jhadvig/CONSOLE-4014” #892
CONSOLE-4014: Pass OCM organization ID and OCP cluster ID to console-config.yaml #889
OCPBUGS-20129: Fix triggering upgradenotification in the cluster installation time #790
OCPBUGS-20466: Tighten console operator permissions for cluster operators #873
OCPBUGS-32400: base OIDC status updates on the ExternalOIDC feature gate #887
OCPBUGS-29547: Apply hypershift cluster-profile for ibm-cloud-managed #868
OCPBUGS-30458: Bump k8s.io/component-base to latest #884
CONSOLE-3944, OCPBUGS-31020: Disable segment analytics when cluster telemetry is disabled #877
CONSOLE-3910: Add quickstart to impersonate a system:admin user #865
OCPBUGS-31482: oidc: synchronize the CM with a CA to trust the issuer, if configured #879
OCPBUGS-29331: Update RHDH QuickStarts and add CR examples #878
OCPBUGS-24913: Updating openshift-enterprise-console-operator-container image to be consistent with ART for 4.16 #827
OCPBUGS-28541: Remove Janus IDP and update RHDH quickstarts #862
OCPBUGS-29479: Add startupProbe to console container. #869
OCPBUGS-29532: ouathclients: further split oidc and integrated oauth handling #861
CONSOLE-3912: always sync oidcClients in authn status if the field is present #857
OCPBUGS-28982: oauthclients: fix oauthclients degraded condition that never gets removed #855
CONSOLE-3912: OAuthClients: only add oidcClients to authentication status if the field exists #847
CONSOLE-3912: OIDC: setup the volume name properly when custom CA is configured #849
OCPBUGS-27335: use InfrastructureTopology for clusters using external CP as the console deploys on the worker nodes #841
CONSOLE-3912: Merge auth cert configmap deployment annotations into one #842
OCPBUGS-25484: make it impossible double set conditions in a single loop #848
CONSOLE-3912: Add secrets for session encryption/authentication in OIDC #839
OCPBUGS-27335: The console-deployment should set the number of replicas based on the ControlPlaneTopology #838
NO-JIRA:(chore) remove unused loglevel #830
OCPBUGS-25484: Bump library-go to deal with GET conflict #836
OCPBUGS-24041: Prevent healthcheck controller from Available=False blipping #834
OCPBUGS-7656: Remove service ca controller annotation from console-redirect service. #826
OCPBUGS-15827: Revert #831 and fix cluster proxy annotation on console conversion webhook deployment #833
Revert #822 “OCPBUGS-15827: Update console conversion webhook server to use sig.k8s.io certwatcher” #831
OCPBUGS-15827: Update console conversion webhook server to use sig.k8s.io certwatcher #822
OCPBUGS-25618: Bump documentationBaseURL to 4.16 #824
OCPBUGS-24913: Updating openshift-enterprise-console-operator-container image to be consistent with ART #823
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

container-networking-plugins

OCPBUGS-85669: CI Build root image tag sync with ART #234
OCPBUGS-55648: Check error returned by ipv6 SettleAddresses #188
OCPBUGS-37725: Update owners #166
OCPBUGS-32212: modify to invoke SAST test #159
OCPBUGS-28559: Updating ose-containernetworking-plugins-container image to be consistent with ART for 4.16 #150
USHIFT-2219: Dockerfile for MicroShift #153
OCPBUGS-29888: cherry-pick containernetworking/plugins#997 #154
OCPBUGS-24810: Updating ose-containernetworking-plugins-container image to be consistent with ART #146
OCPBUGS-24810: Updating ose-containernetworking-plugins-container image to be consistent with ART #145
OCPBUGS-24810: Updating ose-containernetworking-plugins-container image to be consistent with ART #142
Full changelog

coredns

OCPBUGS-77463: Modify .gitignore to not exclude vendor build folders #168
OCPBUGS-37078: UPSTREAM: <carry>: openshift: Bump the version of ocp_dnsnameresolver external plugin #127
OCPBUGS-35296: UPSTREAM: 6692: openshift: Fix OCPBUGS-35296 #123
CFE-963: UPSTREAM: <carry>: openshift: Move ocp_dnsnameresolver before cache in plugin chaining order #116
OCPBUGS-31768: UPSTREAM: <carry>: Address CVE-2023-49295 and CVE-2024-22189 #108
CFE-963: UPSTREAM: <carry>: openshift: Add ocp_dnsnameresolver external plugin #115
OCPBUGS-27928: Updating coredns-container image to be consistent with ART for 4.16 #111
OCPBUGS-27397: UPSTREAM: 6277: openshift: Fix OCPBUGS-27397 #109
OCPBUGS-24957: Updating coredns-container image to be consistent with ART #107
OCPBUGS-15755: UPSTREAM: <carry>: openshift: Fix OCPBUGS-15755 #105
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-79978: Bump google.golang.org/grpc #389
OCPBUGS-68080: fix CVE-2025-65637 #361
OCPBUGS-58884: CARRY: don’t ignore json files #341
OCPBUGS-43426: Merge https://github.com/kubernetes/cloud-provider-openstack:release-1.29 into release-4.16 #303
OCPBUGS-38167: rebase CPO on 4.16 #291
OCPBUGS-13680: Allow changing cluster-name on existing deployments #276
OCPBUGS-29605: Remove enforcement of IPv6 LB as internal #275
NO-JIRA: More snyk ignores #265
don’t use static version in sed replacement rules #2510
bump k8s e2e test to 1.29 #2509
update docs in order to reflect the current state of the ovn lb-provider support #2489
update CSI version #2478
And 80 elided commits (e.g. from squash or rebase merges)
Full changelog

csi-driver-manila-operator

OCPBUGS-38458: Add missing healthchecks #241
OCPBUGS-30438: Bump protobuf dependency #237
OCPBUGS-38013: Set required-scc for openshift workloads #235
OCPBUGS-28230: enforce termination message policy on all platform pods #229
STOR-1574: Bump all deps #226
OCPBUGS-28934: Updating csi-driver-manila-operator-container image to be consistent with ART for 4.16 #227
NO-ISSUE: Remove local manifests #208
STOR-1574: Bump library-go #225
OCPBUGS-23809: Bump opentelemetry libs #220
STOR-1714: Release leadership on SIGTERM #223
STOR-1688: Chore: add .snyk file to ignore false positives #218
OCPBUGS-24226: setting TLSSecurityProfile with no minTLSVersion crashes controller #217
OCPBUGS-23306: Add annotation to CSI driver Pod preventing eviction from the cluster-autoscaler #214
OCPBUGS-24824: Updating csi-driver-manila-operator-container image to be consistent with ART #213
Full changelog

csi-driver-nfs

OCPBUGS-84931: Replace google.golang.org/grpc with github.com/openshift-sustaining/grpc-go v1.67.3-sec.1 to avoid go version bump and fix CVE-2026-33186 #182
OCPBUGS-30439: Merge https://github.com/kubernetes-csi/csi-driver-nfs:master into master #139
NO-JIRA: Merge https://github.com/kubernetes-csi/csi-driver-nfs:master into master #138
NO-JIRA: Add snyk configuration file #137
OCPBUGS-24952: Updating csi-driver-nfs-container image to be consistent with ART #136
Full changelog

csi-driver-shared-resource, csi-driver-shared-resource-webhook

BUILD-877: BUILD-887: Add konflux config for push and pull request #183
BUILD-961: use separate dockerfile for using catalog images #180
OCPBUGS-33513: Updating ose-csi-driver-shared-resource-container image to be consistent with ART for 4.16 #178
OCPBUGS-33511: Updating ose-csi-driver-shared-resource-webhook-container image to be consistent with ART for 4.16 #177
BUILD-957: Update Images with Red Hat Catalog Images #173
BUILD-953: Compare to Other Secret Stores #176
BUILD-953: Simplify README #174
OCPBUGS-30501: bump google.golang.org/grpc to 1.63.0 #172
OCPBUGS-29871: Apply hypershift cluster-profile for ibm-cloud-managed #171
OCPBUGS-28663: Replace ‘coreydaley’ with ‘sayan-biswas’ in OWNERS file #165
OCPBUGS-27860, OCPBUGS-28261: address SAST/SNYK findings #164
OCPBUGS-26081, OCPBUGS-26114, OCPBUGS-26145: add snyk config file for SAST scan #161
OCPBUGS-24984: Updating ose-csi-driver-shared-resource-container image to be consistent with ART #159
OCPBUGS-25035: Updating ose-csi-driver-shared-resource-mustgather-container image to be consistent with ART #160
OCPBUGS-24903: Updating ose-csi-driver-shared-resource-webhook-container image to be consistent with ART #158
Full changelog

csi-driver-shared-resource-operator

OCPBUGS-102984: Bump golang.org/x/net to v0.35.0-sec.3 #128
OCPBUGS-28230: enforce termination message policy on all platform pods #107
STOR-1574: Bump all deps #100
OCPBUGS-28941: Updating ose-csi-driver-shared-resource-operator-container image to be consistent with ART for 4.16 #101
OCPBUGS-28664: Replace ‘coreydaley’ with ‘sayan-biswas’ in OWNERS file #99
STOR-1574: Bump library-go #98
OCPBUGS-26087: add snyk config file for SAST scan #95
OCPBUGS-24855: Updating ose-csi-driver-shared-resource-operator-container image to be consistent with ART #94
Full changelog

csi-external-attacher

STOR-1573: Rebase external-attacher to v4.5.1 for OCP 4.16 #72
OCPBUGS-30437: CVE-2024-24786: bump google.golang.org/protobuf to v1.33.0 #71
OCPBUGS-27242: fix or ignore snyk errors for ocp storage repos #70
OCPBUGS-25576: Updating csi-attacher-container image to be consistent with ART #69
STOR-1688: Chore: add .snyk file to ignore false positives #68
OCPBUGS-25053: Updating csi-attacher-container image to be consistent with ART #67
OCPBUGS-24966: Updating csi-attacher-container image to be consistent with ART #66
Full changelog

csi-external-provisioner

STOR-1573: Rebase external-provisioner to v4.0.1 for OCP 4.16 #95
OCPBUGS-30442: CVE-2024-24786: bump google.golang.org/protobuf to v1.33.0 #94
OCPBUGS-29971: Updating csi-provisioner-container image to be consistent with ART for 4.16 #93
OCPBUGS-27242: fix or ignore snyk errors for ocp storage repos #88
OCPBUGS-25492: UPSTREAM: 1132: CVE-2023-48795: bump golang.org/x/crypto to v0.17.0 #85
OCPBUGS-25532: Updating csi-provisioner-container image to be consistent with ART #84
STOR-1688: Chore: add .snyk file to ignore false positives #83
OCPBUGS-22528, OCPBUGS-23812: UPSTREAM: 1124: Bump OpenTelemetry to fix CVEs #81
OCPBUGS-25082: Updating csi-provisioner-container image to be consistent with ART #80
OCPBUGS-24804: Updating csi-provisioner-container image to be consistent with ART #79
Full changelog

csi-external-resizer

OCPBUGS-102985: Bump golang.org/x/net to v0.35.0-sec.4 #215
OCPBUGS-62465: Requeue PVC over PV creation #174
STOR-1573: Rebase external-resizer to v1.10.0 for OCP 4.16 #160
OCPBUGS-30502: CVE-2024-24786: bump google.golang.org/protobuf to v1.33.0 #159
OCPBUGS-29984: Updating ose-csi-external-resizer-container image to be consistent with ART for 4.16 #158
OCPBUGS-25540: Updating ose-csi-external-resizer-container image to be consistent with ART #154
STOR-1688: Chore: add .snyk file to ignore false positives #153
OCPBUGS-24846: Updating ose-csi-external-resizer-container image to be consistent with ART #152
Full changelog

csi-external-snapshotter, csi-snapshot-controller, csi-snapshot-validation-webhook

OCPBUGS-102978, OCPBUGS-102990: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #230
OCPBUGS-60450: UPSTREAM: 1238: Snapshot Controller startup should not LIST all volumesnapshots #186
OCPBUGS-31746: Backport volumegroupsnapshot fixes to OCP 4.16 #148
OCPBUGS-31439: Backport volumegroupsnapshot fixes to OCP 4.16 #146
STOR-1573: Rebase external-snapshotter to v7.0.1 for OCP 4.16 #145
OCPBUGS-30503: CVE-2024-24786: bump google.golang.org/protobuf to v1.33.0 #144
STOR-1700: Rebase external-snapshotter to v7.0.0 to get VolumeGroupSnapshot #139
OCPBUGS-24996: Updating ose-csi-snapshot-validation-webhook-container image to be consistent with ART #137
STOR-1688: Chore: add .snyk file to ignore false positives #133
OCPBUGS-25548: Updating ose-csi-snapshot-controller-container image to be consistent with ART #135
OCPBUGS-25575: Updating ose-csi-external-snapshotter-container image to be consistent with ART #136
OCPBUGS-24996: Updating ose-csi-snapshot-validation-webhook-container image to be consistent with ART #132
OCPBUGS-25052: Updating ose-csi-external-snapshotter-container image to be consistent with ART #131
OCPBUGS-25124: Updating ose-csi-snapshot-controller-container image to be consistent with ART #130
OCPBUGS-24996: Updating ose-csi-snapshot-validation-webhook-container image to be consistent with ART #129
OCPBUGS-24964: Updating ose-csi-external-snapshotter-container image to be consistent with ART #128
OCPBUGS-24866: Updating ose-csi-snapshot-controller-container image to be consistent with ART #127
Full changelog

csi-livenessprobe

STOR-1573: Rebase livenessprobe to v2.12.0 for OCP 4.16 #64
OCPBUGS-30440: CVE-2024-24786: bump google.golang.org/protobuf to v1.33.0 #63
OCPBUGS-29972: Updating csi-livenessprobe-container image to be consistent with ART for 4.16 #62
OCPBUGS-25534: Updating csi-livenessprobe-container image to be consistent with ART #58
STOR-1688: Chore: add .snyk file to ignore false positives #57
OCPBUGS-25093: Updating csi-livenessprobe-container image to be consistent with ART #56
OCPBUGS-24815: Updating csi-livenessprobe-container image to be consistent with ART #55
Full changelog

csi-node-driver-registrar

OCPBUGS-64632: update log level verbosity to not clutter logs #91
STOR-1573: Rebase node-driver-registrar to v2.10.0 for OCP 4.16 #70
OCPBUGS-30441: CVE-2024-24786: bump google.golang.org/protobuf to v1.33.0 #69
OCPBUGS-29987: Updating csi-node-driver-registrar-container image to be consistent with ART for 4.16 #68
OCPBUGS-27242: fix or ignore snyk errors for ocp storage repos #64
OCPBUGS-25544: Updating csi-node-driver-registrar-container image to be consistent with ART #62
STOR-1688: Chore: add .snyk file to ignore false positives #61
OCPBUGS-25117: Updating csi-node-driver-registrar-container image to be consistent with ART #59
OCPBUGS-23811: UPSTREAM: 354: Bump Bump OpenTelemetry to fix CVEs #58
OCPBUGS-24856: Updating csi-node-driver-registrar-container image to be consistent with ART #57
Full changelog

docker-builder

OCPBUGS-89824, OCPBUGS-90269, OCPBUGS-92346, OCPBUGS-92576, OCPBUGS-92768: Bump golang.org/x/crypto to fix CVE-2025-22869,CVE-2025-47913,CVE-2026-46597,CVE-2026-39829,CVE-2026-39832 #553
OCPBUGS-65907: BuildConfig inline Dockerfile fails with heredoc syntax #489
OCPBUGS-58074: S2I build cpu limits observed by assemble are limited to 1 cpu #475
OCPBUGS-53076: Upgraded Kubernetes dependency from 1.28.2 to 1.29.0 #468
OCPBUGS-42893, OCPBUGS-42914: buildah dependency bump to fix - Buildah allows arbitrary directory mount and symlink traversal vulnerability in the containers/storage library #450
OCPBUGS-43186: runc library bump to 1.1.12 #420
OCPBUGS-47775: skipping some unit tests to avoid failures as they are duplicate #424
OCPBUGS-48159: Add team members to the OWNERS file #426
OCPBUGS-30455: bump google.golang.org/protobuf to 1.33.0 #402
OCPBUGS-35283: Bumps openshift/api & related dependencies #397
OCPBUGS-30672: bump go-jose to fix CVE-2024-28176 #386
OCPBUGS-31930: Updating openshift-enterprise-builder-container image to be consistent with ART for 4.16 #385
OCPBUGS-24746: Updating openshift-enterprise-builder-container image to be consistent with ART for 4.16 #382
BUILD-854: Add adambkaplan as approver #380
OCPBUGS-28661: Replace ‘coreydaley’ with ‘sayan-biswas’ #377
Full changelog

docker-registry

OCPBUGS-60183: bump openshift/docker-distribution #441
OCPBUGS-53654: bump jwt and oauth dependencies #432
OCPBUGS-49696: bump docker distribution #423
OCPBUGS-39412: pull upstream distribution changes to use a consistent multipart chunk size #410
OCPBUGS-35567: use SelfSubjectReview to obtain user info #405
OCPBUGS-34779: Use SAR instead of SSAR #403
OCPBUGS-29233: vendor: bump aws-sdk-go to support ca-west-1 #395
OCPBUGS-29003: update distribution with bugfix #392
OCPBUGS-26173: Updating openshift-enterprise-registry-container image to be consistent with ART #390
OCPBUGS-24902: Updating openshift-enterprise-registry-container image to be consistent with ART #389
OCPBUGS-24902: Updating openshift-enterprise-registry-container image to be consistent with ART #388
Full changelog

driver-toolkit

Adding the + char to the RT kernel version. (#156) #156
ART bash parser is failing on [[…]] syntax Replace with sh compatible syntax. (#152) #152
Patch manifests to require stream-coreos instead of rhel-coreos in the OKD/SCOS case (#150) #150
Use a default RHEL_VERSION when the build argument is not specified (#148) #148
Add importMode and set it to PreserveOriginal to import (#144) #144
MCO-392: Start using rhel-coreos image rather than machine-os-content. (#142) #142
apply hypershift cluster-profile (#143) #143
Add support for 64k pages with ARM64 (#140) #140
Updating driver-toolkit-container image to be consistent with ART (#139) #139
Full changelog

egress-router-cni

OCPBUGS-35525: update to go 1.21 and k8s.io mods to v0.29.2 #85
OCPBUGS-28581: Updating ose-egress-router-cni-container image to be consistent with ART for 4.16 #80
OCPBUGS-24860: Updating ose-egress-router-cni-container image to be consistent with ART #79
Full changelog

etcd

NO-ISSUE: Add support for cachi2 based deps #298
OCPBUGS-34690: Rebase etcd 3.5.14 openshift 4.16 #274
CORS-3191: DOWNSTREAM <carry>: add native binary to installer images #269
CORS-3249: DOWNSTREAM <carry>: installer: make etcd binaries static #268
CORS-3249: DOWNSTREAM <carry>: add installer Dockerfile for ART builds #267
OCPBUGS-31624: Rebase etcd 3.5.13 openshift 4.16 #259
no-issue: Update Installer dockerfile to use golang-1.20 #251
OCPBUGS-28730: Rebase etcd 3.5.12 openshift 4.16 #242
CORS-3191: Add Dockerfile to build etcd for openshift-installer #249
OCPBUGS-24988: Updating ose-etcd-container image to be consistent with ART #236
OCPBUGS-24931: Rebase etcd 3.5.11 openshift 4.16 #237
Full changelog

gcp-cloud-controller-manager

OCPCLOUD-2463: Adds auth-provider-gcp .spec file and build script #58
OCPBUGS-22598: Merge https://github.com/kubernetes/cloud-provider-gcp:master (58ec6ae) into master #53
OCPBUGS-25754: Add Snyk file to exclude vendor directory on scan #54
OCPBUGS-24044: Merge https://github.com/kubernetes/cloud-provider-gcp:master (522e293) into master #40
OCPBUGS-25581: Updating ose-gcp-cloud-controller-manager-container image to be consistent with ART #52
OCPBUGS-24981: Updating ose-gcp-cloud-controller-manager-container image to be consistent with ART #48
Full changelog

gcp-cluster-api-controllers

OCPBUGS-78280: [release-4.16] update go mod dependency for konflux #267
OCPBUGS-33170: Container fallback to logs on error #224
OCPBUGS-28331: add test directory to snyk excludes #220
OCPBUGS-30586: fix e2e tests on release branches #222
OCPCLOUD-2445: Merge https://github.com/kubernetes-sigs/cluster-api-provider-gcp:v1.6.0 (be17146) into master #221
OCPBUGS-26143: Fix formatting in snyk vendor exclusions #219
OCPBUGS-24875: Updating ose-gcp-cluster-api-controllers-container image to be consistent with ART #215
OCPBUGS-25628: Add Snyk file to exclude vendor directory on scan #216
Full changelog

gcp-machine-controllers

OCPBUGS-103045: Bump golang.org/x/net to v0.35.0-sec.3 #191
OCPBUGS-79970: Bump google.golang.org/grpc to v1.79.3 #167
OCPBUGS-79970: [release-4.16] Fix setup-envtest GCS 401 by downloading binaries directly #176
OCPBUGS-55249: Disable shielded VMs for non-UEFI disks #116
OCPBUGS-48484: Refactor exists() to handle gcp API change #106
OCPBUGS-30520: Bump protobuf to v1.34.0 #82
CFE-684: Add user defined tags to the created gcp resource #54
OCPBUGS-27866: Update Snyk file to exclude other vendor folders #81
OCPCLOUD-2427: Rebase k8s to 1.29 and update dependencies #78
OCPBUGS-26128: Add Snyk file to exclude vendor directory on scan #77
OCPBUGS-25578: Updating ose-machine-api-provider-gcp-container image to be consistent with ART #75
OCPBUGS-24970: Updating ose-machine-api-provider-gcp-container image to be consistent with ART #73
Full changelog

gcp-pd-csi-driver

OCPBUGS-68087: Update logrus to 1.9.3 #92
OCPBUGS-30511: CVE-2024-24786: bump google.golang.org/protobuf to v1.33.0 #60
STOR-1581: Rebase to new upstream version 1.13.0 #59
OCPBUGS-27242: fix or ignore snyk errors for ocp storage repos #58
OCPBUGS-25553: Updating ose-gcp-pd-csi-driver-container image to be consistent with ART #56
STOR-1688: Chore: add .snyk file to ignore false positives #55
OCPBUGS-25138: Updating ose-gcp-pd-csi-driver-container image to be consistent with ART #54
OCPBUGS-24886: Updating ose-gcp-pd-csi-driver-container image to be consistent with ART #53
Full changelog

gcp-pd-csi-driver-operator

OCPBUGS-28230: enforce termination message policy on all platform pods #119
OCPBUGS-26924: Add node registrat healthcheck #118
STOR-1574: Bump all deps #116
OCPBUGS-28939: Updating ose-gcp-pd-csi-driver-operator-container image to be consistent with ART for 4.16 #117
STOR-1574: Bump library-go #115
OCPBUGS-26486: Increase data source provision timeout #112
STOR-1714: Release leadership on SIGTERM #110
STOR-1688: Chore: add .snyk file to ignore false positives #105
OCPBUGS-25541: Updating ose-gcp-pd-csi-driver-operator-container image to be consistent with ART #106
OCPBUGS-24226: setting TLSSecurityProfile with no minTLSVersion crashes controller #104
OCPBUGS-25113: Updating ose-gcp-pd-csi-driver-operator-container image to be consistent with ART #101
OCPBUGS-23859: CVE-2023-47108: bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp to v0.46 #98
OCPBUGS-23306: Add annotation to CSI driver Pod preventing eviction from the cluster-autoscaler #100
OCPBUGS-24847: Updating ose-gcp-pd-csi-driver-operator-container image to be consistent with ART #99
Full changelog

haproxy-router

OCPBUGS-103005: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 to address CVE-2026-33814 #844
OCPBUGS-86713: Strip X-SSL-* headers for plain HTTP #805
OCPBUGS-79960: Bump google.golang.org/grpc to v1.79.3 #769
OCPBUGS-56424: Add support for IdleCloseTerminationPolicy #655
OCPBUGS-49391: Reject All CA-Signed Certs Using SHA1 #651
CFE-1020: feature:route external certificate reference #565
OCPBUGS-29373: generateHAProxyCertConfigMap: No H2 with dup certs #589
OCPBUGS-26498: Optimize Upgrade Validation plugin by skipping unnecessary changes #587
OCPBUGS-26498: Make ingressConditionsEqual more efficient #588
OCPBUGS-29690: Count active services before setting weight to 1 #576
“OCPBUGS-26498: Add Upgrade Validation force arguments for running E2E tests” #575
OCPBUGS-26498: Reject routes with SHA1 certs #552
OCPBUGS-26498: Upgrade Validation plugin for SHA1 certs #555
OCPBUGS-32044: Introduce ‘idle-close-on-response’ option for frontends #573
OCPBUGS-22739: Properly handle rewrite-target annotation #534
NO-JIRA: hack/Dockerfile.debug: use ubi9 for base image #567
OCPBUGS-30314: Refactor logging in DoHTTPProbe to avoid serialisation errors #566
NE-1444: Bump HaProxy to the latest version 2.8 #563
TRT-1507: Revert #551 “NE-1444: Upgrade OpenShift Router to HAProxy 2.8” #561
NE-1444: Upgrade OpenShift Router to HAProxy 2.8 #551
OCPBUGS-26539: Reject routes with MD5 certs #553
OCPBUGS-25546: Updating ose-haproxy-router-base-container image to be consistent with ART #550
NO-JIRA: hack - fix broken RPM link and use UBI image in Dockerfile.debug, use podman in Makefile.debug #544
OCPBUGS-25029: Updating openshift-enterprise-haproxy-router-container image to be consistent with ART #547
NE-1446: Update to RHEL9 base image #548
OCPBUGS-24859: Updating ose-haproxy-router-base-container image to be consistent with ART #546
Full changelog

hyperkube, pod

OCPBUGS-68041, OCPBUGS-68091: CVE-2025-65637 - bump github.com/sirupsen/logrus to v1.9.3 [4.16] #2582
OCPBUGS-74299: Skip E2e: attach on previously attached volumes should work #2568
OCPBUGS-65694: Fix Concurrentmap Iteration #2519
CNTRLPLANE-1612: Backport StreamingCollectionEncoding for JSON and protobuf #2485
OCPBUGS-61908: UPSTREAM: <carry>: Don’t retry storage calls with side effects. #2470
OCPBUGS-60553: [4.16]: podresources: list: use active pods #2454
4.16: OCPBUGS-60872: UPSTREAM: 127757: scheduler: Improve CSILimits plugin accuracy by using VolumeAttachments #2435
OCPBUGS-60272: Bump nfs server provisioner #2402
OCPBUGS-58054: UPSTREAM: 130047: adjusting loopback certificate validity in kube-apiserver #2342
OCPBUGS-58054: UPSTREAM: <carry>: disable some legacy cloud provider Azure tests #2352
OCPBUGS-57290: UPSTREAM: <carry>: Bump cadvisor version to fix kubelet #2325
OCPBUGS-49906: Bump k8s api to 1.29.14 #2211
OCPBUGS-45931: UPSTREAM: <carry>: kubelet/cm: fix bug where kubelet restarts from missing cpuset cgroup #2158 #2200
OCPBUGS-46003: Bump k8s api to 1.29.11 #2161
OCPBUGS-44513: Bump k8s api to 1.29.10 #2133
OCPBUGS-42555: Allow pod to be scheduled if node’s name and hostname mismatch #2099
OCPBUGS-42168: Bump k8s api to 1.29.9 #2090
release-4.16] OCPBUGS-42057: UPSTREAM: <drop>: bump(github.com/openshift/apiserver-library-go) #2096
OCPBUGS-39015: Bump k8s api to 1.29.8 #2066
OCPBUGS-36773: UPSTREAM: <carry>: Disable vSphere tests with pre-provisioned volumes #2021
NO-JIRA: update downstream owners #2049
OCPBUGS-37621: Bump k8s api to 1.29.7 #2039
OCPBUGS-19802: Bump 4.16 runc #2032
OCPBUGS-35551: Bump k8s 1.29.6 #1990
OCPBUGS-34545: UPSTREAM: <carry>: Disable PersistentVolumeLabel by default #1993
OCPBUGS-35291: Backport 125337 #1989
OCPBUGS-27074: UPSTREAM: <carry>: extend termination events #1980
OCPBUGS-34545: UPSTREAM: <carry>: Disable e2e tests that need PersistentVolumeLabel #1985
OCPBUGS-33710: Bump k8s API to 1.29.5 #1972
UPSTREAM: <carry>: OCPBUGS-34102: force static build of linux binaries #1978
OCPBUGS-33574: bump openshift/library-go@e22d25a #1967
OCPBUGS-32934: UPSTREAM: 124795: e2e: DaemonSet maxSurge test should account for terminated pods #1966
no-jira: UPSTREAM <carry>: add native build to installer image #1961
API-1809: Provide SCC access via RBAC #1959
NO-JIRA: UPSTREAM: <carry>: Revert create readyz event for kubeapi server #1957
OCPBUGS-20097: Migrate tools image to RHEL9 #1954
OCPBUGS-32296: Bump K8s api to 1.29.4 #1947
OCPBUGS-22301: UPSTREAM: <carry>: Fix garbage-collection for CRDs. #1811
OCPBUGS-26440: UPSTREAM: <carry>: create readyz event for kubeapi server #1914
UPSTREAM: <carry>: OCPEDGE-807: add support for cpu limits into management workloads #1902
CFE-910: RouteExternalCertificate validation in openshift-kube-apiserver custom resource validator #1904
NO-JIRA: UPSTREAM: <carry>: featureset validation moved to CEL #1944
CFE-910: bump library-go #1941
OCPBUGS-11933: UPSTREAM: <drop>: bump apiserver-library-go #1910
OCPBUGS-31663: UPSTREAM: <carry>: add management workload check for guaranteed qos #1928
OCPBUGS-30957: Use the right feature gate when updating uncertain … #1919
OCPBUGS-31384: UPSTREAM: <carry>: allow type mutation for specific secrets #1932
OCPNODE-1886: Bump k8s 1.29.3 #1925
OCPBUGS-31384: UPSTREAM: <carry>: allow type mutation for specific secrets #1929
OCPBUGS-31384: UPSTREAM: <carry>: allow type mutation for specific secrets #1924
OCPBUGS-30767: UPSTREAM: 124110: retry policy creation for CRD type checking E2E test #1922
OCPBUILD-13: UPSTREAM: <carry>: fix [sig-auth] ServiceAccounts no secret-based service account token should be auto-generated #1909
CFE-910: [o/k-apis] Add context to ObjectValidator; Consume FeatureGate(s) in kube-apiserver #1852
UPSTREAM: <carry>: OCPBUGS-29520: fix cpu manager cpuset check #1892
OCPBUGS-30954: Set up CEL IP/CIDR library from 4.14 onwards #1911
OCPBUGS-24481: Enable SELinux tests #1908
MCO-392: openshift-hack/images/os: delete #1805
OCPBUGS-23900: UPSTREAM: 123512: system:kube-scheduler: extend the RBAC with pods/finalizers #1900
OCPBUGS-10996: Fix race condition between resizer and kubelet #1899
OCPBUGS-29437: Upstream: <carry>: RPM: Split apiserver, scheduler, k-c-m, kubelet into subpackages #1882
OCPNODE-1892: Bump k8s to 1.29.2 #1888
NO-JIRA: Clean carry patches #1880
OCPBUGS-29435: UPSTREAM: 123165: Add AudienceMatchPolicy and support multiple audien… #1881
CORS-3191: Add Dockerfile to buld kube-apiserver for openshift-install architectures #1872
NO-JIRA: Revert “OCPBUGS-24404: add ignore for SAST scan” #1870
OCPBUGS-24404: UPSTREAM <carry>: use snyk file #1871
OCPBUGS-26058: UPSTREAM: <carry>: watch-termination: termination.log file with restricted permissions #1841
OCPBUGS-16760: permanently disable NodeLogQuery e2e test #1792
OCPNODE-1892: Bump k8s to 1.29.1 #1858
OCPNODE-1892: Switch to golang 1.21 #1845
OCPBUGS-24606: UPSTREAM: <carry>: Update management webhook pod admission logic #1821
OCPNODE-1892: UPSTREAM: <carry>: update test rules #1849
OCPBUGS-17249: UPSTREAM: <carry>: openshift-kube-apiserver: pod .spec.nodeName should not override project node selector in podNodeEnvironment admission plugin #1787
OCPNODE-1892: UPSTREAM: 122683: Use v1beta1 endpoints when cleaning up ValidatingAdmissionPolicies #1848
OCPBUGS-23896: Fix device uncertain errors on reboot #1829
OCPBUGS-24404: add ignore for SAST scan #1824
AUTH-439: loosen authentication.spec.type validation #1770
OCPNODE-1892: UPSTREAM: 122643: Add a new neverTerminate job behavior just for upgrade #1846
OCPBUGS-26067: Backport CEL IP and CIDR validations #1828
OCPNODE-1892: Bump k8s api to 1.29.0 #1840
OCPNODE-1895: temporarily disable reporting e2e text bugs #1836
OCPNODE-1892: Rebase 1.29.0 #1815
Full changelog

hypershift

OCPBUGS-33097: [release-4.16] fix(api): remove deprecated OVNSbDb service type #9820
OCPBUGS-120748: update Containerfile.cli base images to floating tags [release-4.16] #9560
OCPBUGS-99075: fix(backport): konnectivity agent auth #9097
OCPBUGS-84182: fix(cno): use brackets only for IPv6 in server URL #8348
OCPBUGS-76534: feat(updates): enable CVO metrics access with RHOBS monitoring flag #7704
OCPBUGS-74375, OCPBUGS-74376: Support proxy authentication when user/pass is included in URL #7578
OCPBUGS-73118: Fix Konflux EC voilation, update deprecated base … #7459
OCPBUGS-63640: [release-4.16] fix(konnectivity): resolve circular dependency causing DNS timeouts and excessive retries #7113
OCPBUGS-64680: Update DNS names for ovn-kubernetes cp metrics #7158
CNTRLPLANE-1904: Migrate 4.16 pipelines to common pipeline template #7212
CNTRLPLANE-1426: feat(konflux): tag MCE HO images with latest #6839
OCPBUGS-61252: dont use registryOverrides on kube rbac proxy image be… #6756
OCPBUGS-61582: Update KCM node monitor grace period #6797
OCPBUGS-61860: Use the common MCE konflux pipeline #6844
OCPBUGS-60150: Always compress and encode payload in token secret for inplace upgrades #6750
OCPBUGS-60951: MCE 2.6 konflux hcp cli #6701
CNTRLPLANE-1203: HO MCE change to hermetic ta build #6654
CNTRLPLANE-1231: Move CPO pipeline to hermetic builds #6599
OCPBUGS-58505: [release-4.16] Add missing service network DNS entries to KAS cert #6393
OCPBUGS-57494: Add proxy variables for the MCD Pod #6286
OCPBUGS-55697: Add validation to avoid conflicts between KubeAPIServer and NamedCertificates SANs #6114
CNTRLPLANE-919: Konflux build pipeline service account migration #6087
CNTRLPLANE-919: Konflux build pipeline service account migration #6082
OCPBUGS-51804: Fix golang crypto dependency go.mod replacement #5994
OCPBUGS-54914: Add konnectivity-proxy sidecar to openshift-oauth-apiserver #6026
OCPBUGS-54632: Sync RBAC for attaching volumes on VM level #5998
OCPBUGS-49914: Reconcile proxy CA bundle into hosted cluster #5983
OCPBUGS-53902: bump golang-jwt v4 and v5 #5907
Red Hat Konflux update control-plane-operator-4-16 #5957
ART-11792: update go mod dependency for konflux #5922
OCPBUGS-51733, OCPBUGS-51804: Bump dependencies to OCP fork in backports #5901
OCPBUGS-53308: fix(deps): bump go-jose #5866
OCPBUGS-52506: refactor aws identity health check into new controller #5781
OCPBUGS-52857: Make managed-trust-bundle optional #5809
OCPBUGS-52426: change plaform to platform #5773
OCPBUGS-50993: Honor proxy vars in the util insecure http client #5662
OCPBUGS-46466: Consistently look up and dial cloud API hostnames #5301
OCPBUGS-50698: add region to AWS creds passed to operators managed by CPO #5670
OCPBUGS-51296: 4.17 Add HostedCluster additional trustbundles to konnectivity-https-proxy #5707
NO-JIRA: chore(deps): update dependency mkdocs-material to v9.6.5 #5686
OCPBUGS-50694: OCPBUGS-50692: Fix IsIPv4 function identifying also addresses instead of CIDRs #5620
NO-JIRA: chore(deps): update dependency mkdocs-material to v9 #5635
OCPBUGS-50557: Prevent IgnitionServer from flooding the API server with patch requests #5599
NO-JIRA: chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v9.5-1739267472 #5597
NO-JIRA: chore(deps): update dependency mkdocs-material to v8.5.11 #5591
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.6.3 #5587
NO-JIRA: chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v9.5-1738746453 #5574
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.6.2 #5575
NO-JIRA: chore(deps): update dependency mkdocs to v1.6.1 #5531
NO-JIRA: chore(deps): update dependency mkdocs-glightbox to v0.4.0 #5532
OCPBUGS-49640: fix overwriting PKI operator HCP conditions #5506
NO-JIRA: chore(deps): chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v9.5-1737480393 - abandoned #5484
NO-JIRA: chore(deps): update konflux references (release-4.16) #5477
NO-JIRA: Update squidfunk/mkdocs-material Docker tag to v9.5.50 (release-4.16) #5437
NO-JIRA: Update Konflux references (release-4.16) #5431
NO-JIRA: chore(deps): update konflux references (release-4.16) #5384
NO-JIRA: Update registry.access.redhat.com/ubi9/go-toolset Docker tag to v9 (release-4.16) #5298
NO-JIRA: [release-4.16] Bump golang.org/x/crypto and golang.org/x/net #5370
NO-JIRA: Update Konflux references (release-4.16) #5328
NO-JIRA: Red Hat Konflux update control-plane-operator-4-16 #5337
OCPBUGS-47539: Separate CPO containerfiles #5333
chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.22.7-1733160835 (release-4.16) #5295
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.49 (release-4.16) #5297
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.48 (release-4.16) #5294
NO-JIRA: Update Konflux References and Perform Migration for Release-4.16 #5261
OCPBUGS-39372: Fixed NodePool version validation #5219
NO-JIRA: Update squidfunk/mkdocs-material Docker tag to v9.5.47 (release-4.16) #5209
NO-JIRA: chore(deps): update konflux references (release-4.16) #5207
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.46 (release-4.16) #5189
OCPBUGS-43930: Return the right tagReference on Catalogs ImageStream #5133
NO-JIRA: chore(deps): update konflux references (release-4.16) #5161
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.45 (release-4.16) #5163
chore(deps): update konflux references (release-4.16) #5135
OCPBUGS-44277: Configure OAuth https proxy to dial cloud endpoints directly #5069
chore(deps): update konflux references (release-4.16) #5119
OCPBUGS-43973: Add network policies for konnectivity server and ignition server proxy #4998
NO-JIRA: Update Konflux references (release-4.16) #5112
NO-JIRA: Update Konflux references (release-4.16) #5099
chore(deps): update konflux references (release-4.16) #5078
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.44 (release-4.16) #5059
NO-JIRA: chore(deps): update konflux references (release-4.16) #5058
NO-JIRA: Update Konflux references (release-4.16) #5042
chore(deps): update konflux references (release-4.16) #5024
chore(deps): update konflux references (release-4.16) #5019
NO-JIRA: Update squidfunk/mkdocs-material Docker tag to v9.5.43 (release-4.16) #5017
NO-JIRA: Update Konflux references (release-4.16) #5012
OCPBUGS-43840: add ValidIDPConfiguration condition to report IDP config issues #4985
NO-JIRA: chore(deps): update konflux references (release-4.16) #4971
OCPBUGS-43046: Do not send traffic to local audit-webhook through konnectivity #4883
NO-JIRA: chore(deps): update konflux references (release-4.16) #4954
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.42 (release-4.16) #4947
NO-JIRA: chore(deps): update konflux references (release-4.16) #4933
OCPBUGS-43104: label routes only when HCP router used #4899
OCPBUGS-43308: Use guest DNS resolution in Konnectivity HTTPS proxy by default #4905
NO-JIRA: chore(deps): update konflux references (release-4.16) #4923
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.41 (release-4.16) #4919
NO-JIRA: chore(deps): update konflux references to 674e70f (release-4.16) #4908
NO-JIRA: chore(deps): update konflux references (release-4.16) #4896
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.40 (release-4.16) #4880
OCPBUGS-42432: Use KubeClientCABundle for HostedClusterConfigOperator cluster-signer-ca #4799
OCPBUGS-42342: Let payload generation pick the release for the NodePool #4787
OCPBUGS-42431: Conditionally manage kubeconfig secrets for DNS and Ingress operators #4798
NO-JIRA: chore(deps): update konflux references (release-4.16) #4853
OCPBUGS-42608: Add Annotation to skip deleting hcp namespace #4830
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.39 (release-4.16) #4827
chore(deps): update konflux references (release-4.16) #4816
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.38 (release-4.16) #4806
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.37 (release-4.16) #4796
chore(deps): update konflux references (release-4.16) #4781
NO-JIRA: chore(deps): update konflux references (release-4.16) #4760
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.36 (release-4.16) #4759
NO-JIRA: Security fixes for openshift-ci-security job #4750
OCPBUGS-41372: CPO oauth idp converter: resolve names before dialing #4689
NO-JIRA: chore(deps): update golang docker tag to v1.23 (release-4.16) #4729
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.34 (release-4.16) #4728
NO-JIRA: chore(deps): update konflux references (release-4.16) #4727
OCPBUGS-38058: Add HTTP konnectivity proxy to OAuth server #4496
HOSTEDCP-1955: bump CCO version #4696
OCPBUGS-34803: cmd: report server version, supported OCP #4141
OCPBUGS-39293: copy image-registry AdditionalTrustedCA configmap into HC openshift-config #4647
chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.21.11-9 (release-4.16) #4685
OCPBUGS-38062: [release-4.16] Use HTTP proxy for ingress controller #4688
NO-JIRA: chore(deps): update konflux references (release-4.16) #4684
OCPBUGS-39447: handle version skewed NodePools that do not have rhel9 binaries #4664
HOSTEDCP-1895: [release-4.16] Allow setting Kube APIServer maximum requests in flight #4551
chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.21.11-7.1724661022 (release-4.16) #4600
chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.33 (release-4.16) #4602
chore(deps): update konflux references (release-4.16) #4599
OCPBUGS-38942: copy oapi ca-trust recursively when building trust anchor #4615
NO-JIRA: Flaky cert validation test #4622
OCPBUGS-38259: Set KCM node monitor grace period #4520
OCPBUGS-38726: fix: bump github.com/IBM/go-sdk-core/v5 #4611
HOSTEDCP-1764: retrieve registryOverrides when ImageStream is not ava… #4541
chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.21.11-7 (release-4.16) #4525
OCPBUGS-36781: Set Azure VM identity if user assigned identity set #4341
OCPBUGS-37936: set proxy envvars on aws and azure CCMs #4476
OCPBUGS-38486: hcco: reconcile apiserver config into hosted cluster #4559
NO-JIRA: fix(KONFLUX-3663): format PipelineRun files and upload SAST results #4534
OCPBUGS-38131: Let the CPO oidc check resolve through data plane #4505
NO-JIRA: test: relax mgmt KAS egress check #4561
chore(deps): update quay.io/openshift/origin-base docker tag to v4.16 (release-4.16) #4528
chore(deps): update golang docker tag to v1.22 (release-4.16) #4527
NO-JIRA: Update Konflux references (release-4.16) #4524
OCPBUGS-34801: remove weak ciphers from security profile #4518
OCPBUGS-37060: OCPBUGS-35905: E2E test to verify openshift-apiserver TLS certificates #4366
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9 (release-4.16) #4482
NO-JIRA: chore(deps): update konflux references (release-4.16) #4481
OCPBUGS-37065: OCPBUGS-35899: Doubled machineHealthCheck timeout on Agent and None #4367
OCPBUGS-30282: Multiple MachineConfigs in one CM #4398
OCPBUGS-36937: [release-4.16] Add HTTP(s) konnectivity proxy and use it with OpenShift APIServer #4357
OCPBUGS-36766: Delete IDMS in dataplane once HCP ICS field is removed #4434
NO-JIRA: Konflux migration for release-4.16 #4436
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v8.5.11 (release-4.16) #4430
HOSTEDCP-1569: test: e2e: skip unknown conditions instead of erroring #4440
OCPBUGS-37645: Set right endpointSlice port #4431
OCPBUGS-37214: Separate ibmcloud kms encryption configuration types #4380
OCPBUGS-37302: fix(api): Nodepool CEL validation fix #4395
NO-JIRA: Red Hat Konflux update hypershift-release-mce-26 #4392
OCPBUGS-37241: extract rhel9 MCO binaries for rhel8 based MCO images #4383
NO-JIRA: [release-4.16] test/e2e: remove api budget checks #4368
HOSTEDCP-1795, HOSTEDCP-1796: Customize the self-generated cert validity and rotation #4371
NO-JIRA: chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.21.11-2 (release-4.16) - abandoned #4364
NO-JIRA: trivial typo fixes to configuring-storage.md #4353
OCPBUGS-36849: Add newline after TLS certs referenced by image.config #4352
OCPBUGS-36589: Fix Hypershift dump for non-OpenShift Management Clusters #4317
NO-JIRA: chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.21.10-1.1719562237 (release-4.16) - abandoned #4328
OCPBUGS-36358: enable audit log for oauth-openshift #4302
OCPBUGS-35522: Copy infra-volumesnapshot-class-mapping to core binding #4291
NO-JIRA: chore(deps): update konflux references (release-4.16) #4299
OCPBUGS-36227: kubevirt-csi-driver: Pass infra kubeconfig in case of external infra #4276
OCPBUGS-35341: [release-4.16] Fixed ValidReleaseInfo condition #4204
OCPBUGS-36220: Make guest cluster components use the correct KAS port #4275
OCPBUGS-35934: check mgmt cluster for route capability before DeleteIfNeeded for ovn sbdb route #4264
NO-JIRA: chore(deps): update konflux references (release-4.16) #4260
OCPBUGS-34545: Disable PersistentVolumeLabel admission plugin #4241
OCPBUGS-35838: Remove KMS V1 provider support for IBM Cloud #4250
NO-JIRA: chore(deps): update konflux references (release-4.16) #4251
OCPBUGS-35369: OCPBUGS-35252: Enforce Privileged Instead of Restricted PSA in 4.16 #4193
NO-JIRA: chore(deps): update konflux references (release-4.16) #4245
OCPBUGS-35557: Complete KAS migration to none endpoint reconciler type #4227
NO-JIRA: chore(deps): update konflux references (release-4.16) #4238
NO-JIRA: feat(olm): Set packageserver replicas to 2 for IBMCloudPlatform #4230
OCPBUGS-35268: Add hypershift-cluster-version-operator image to release providers #4185
NO-JIRA: chore(deps): update konflux references (release-4.16) #4235
NO-JIRA: Red Hat Konflux update hypershift-release-mce-26 #4233
OCPBUGS-35056: Generate default worker security group rules based on machineCIDR #4174
OCPBUGS-35369: OCPBUGS-35252: vendor: bump openshift/api #4197
NO-JIRA: hack: make the e2e script generic #4198
OCPBUGS-35308: fix router on 4.14 y-stream upgrade #4194
HOSTEDCP-1715: Kubernetes API Server Log Verbosity Annotation cherry pick to 4.16 #4177
HOSTEDCP-1570: remove liveness and readiness probes using metrics endpoint #4116
OCPBUGS-35052: Add missing Tag permissions to cli role #4173
OCPBUGS-34903: Allow access to root-ca configmap in cluster-network-operator role #4155
OCPBUGS-34575: Rename machine-config operator CRD references #4105
OCPBUGS-34759: add AWS STS URL to OIDC provider audiences #4134
HOSTEDCP-1688: Use operator namespace for openshift-config-managed-trusted-ca-bundle #4117
OCPBUGS-34801: remove weak cipher #4139
OCPBUGS-34773: Fix disconnected metadata inspection for nodepool #4137
OCPBUGS-34569, OCPBUGS-34602: Backports that should go in together #4114
OCPBUGS-34542: Reconcile KAS endpoints and endpoint slice #4096
OCPBUGS-34554: Fixed audit-logs sigterm failing to terminate gracefully #4090
OCPBUGS-34390: Add TrustedBundles to OAS container #4087
HOSTEDCP-1561: Move HCP Product CLI to STS #4092
HOSTEDCP-1556: Support Priority based expander for cluster-autoscaler #4068
OCPBUGS-34171: Make active & backup Azure KMS containers use different –metrics-addr #4079
NO-JIRA: Bump library-go dependency #4069
TRT-1672: e2e: proceed with teardown even if dump fails #4052
NO-JIRA: Update RHTAP references #4042
OCPBUGS-33729: Do not ignore single placeholder pods for a specific hosted cluster #4037
HOSTEDCP-1668: remove dns-operator leader-elect flags #4038
OCPBUGS-33595: Cluster sizing controller: do not error on not found HC #4023
HOSTEDCP-1655: Don’t Ignore SubnetID and Network Security Group ID flags when values are passed through #4021
HOSTEDCP-1518: Preserve container resource requests and limits #3864
HOSTEDCP-1310: use kms images from payload #3996
OCPBUGS-32257: Restrict image registry overrides to control plane components #3952
HOSTEDCP-1560: Create AWS STS Role for the hypershift/hcp cli #4003
HOSTEDCP-1566: Bump Azure SDK, IBM, AWS, ectd, & gomega dependencies #4012
HOSTEDCP-1566: Bump CAPI dependencies #4011
OCPBUGS-33320: Fix nil dereference in clustersizingconfig validation #4016
HOSTEDCP-1525: Fixed azure using incorrect kms socket #3981
HOSTEDCP-1563: Refine the Azure API in the NodePool Spec #4004
OCPBUGS-33320: Autoscaler for non request serving nodes #4007
HOSTEDCP-1557: Allow the NSG ID to drive the NSG Resource Group for the Azure Cloud Provider Config #4006
NO-JIRA: Remove CLI inspection of release image #3548
OCPBUGS-33237: Run haproxy to connect to kas from data plane if noproxy settings contain kas #3999
OCPBUGS-26762: Disable DNS resolving for CNO #3986
MULTIARCH-4637: Set arch to ppc64le within PowerVS platform func #4002
MULTIARCH-4637: Support ppc64le arch for Agent and PowerVS platform #3979
HOSTEDCP-1544: Allow user to specify subnet ID for Hosted Cluster & NodePool Creation #3945
CNV-36073: Set time out for external snapshotter on kubevirt csi driver #3968
HOSTEDCP-1523: Bump k8s to v0.29.3 #3878
OCPBUGS-25012: Updating ose-hypershift-container image to be consistent with ART #3303
OCPBUGS-33203, OCPBUGS-33274: Autoscaler: scale down unused machinesets #3988
NO-JIRA: chore(deps): update rhtap references #3973
HOSTEDCP-1513: Add operator scoping support to nodepool controller #3928
OCPBUGS-33132: Restore ingresscontroller rbac #3965
NO-JIRA: sizing: add logging for what we’re doing #3961
chore(deps): update rhtap references #3966
NO-JIRA: Minor doc updates to creating Azure HC on AKS #3964
OCPBUGS-29110: Reconcile over ICSP/IDMS #3933
OCPBUGS-33101: Fix nil pointer deref when effects not specified in CSC #3959
OCPBUGS-32110: disable OCM pull secret controller when imageregistry config managementstate is Removed #3906
HOSTEDCP-1552: Update RHTAP tekton files for 0.3 -> 0.4 migration #3956
OCPBUGS-31398: Recycler-pod image now points to the OCP Payload reference #3901
HOSTEDCP-1525: Support Azure KMS key rotation #3940
CNV-40687: Detect machine and cluster-network cidr collision #3880
OCPBUGS-32930: Allow specifying resource requests per cluster size #3941
OCPBUGS-32760: Request serving scheduler: omit deleting nodes #3929
OCPBUGS-14383: fix setting replicas on autoscaler #3947
OCPBUGS-32378: Ensure placeholder deployments are deleted #3931
OCPBUGS-32255: Remove kube-scheduler readiness probe #3889
HOSTEDCP-1484: Disaster recovery documentation with OADP #3950
OCPBUGS-32492: Set ImportMode for catalog #3937
HOSTEDCP-1522: Add API definitions and CEL for AzurePlatformSpec vars #3879
NO-JIRA: Kubevirt on Azure: Change KAS LB Port to 7443 #3821
chore(deps): update rhtap references (main) #3943
OCPBUGS-30260: Ignore subnet annotations for control plane load balancers #3944
OCPBUGS-32759: Fix invalid node selector in autosizing placeholder #3930
HOSTEDCP-1044: Add NodePool Size/Replicas to Telemetry #3593
NO-JIRA: remove obsolete konnectivity image code #3932
HOSTEDCP-1219: Add arch & multi-arch flags to HCP CLI #3926
NO-JIRA: reduce autoscaling test memory requests #3938
NO-JIRA: chore(deps): update rhtap references #3934
ACM-11259: Add mapping documentation for KubeVirt CSI driver snaphotting #3925
OCPBUGS-32496: Controller to assist autoscaling for placeholder nodes #3922
Revert “Revert “HOSTEDCP-1465: Create HCPs with externalDNS on AKS Clusters”” #3895
chore(deps): update rhtap references #3919
OCPBUGS-32487: Fix OLM intilization args #3918
OCPNODE-2096: Add ClusterImagePolicy to the list of valid config manifests #3894
CNV-36073: KubeVirt, Add snapshot side car and volumesnapshot class #3640
NO-ISSUE: placeholders: ignore auto-sizer placeholders #3877
OCPBUGS-32228: Fix failure to create a second hostedcluster in the same namespace #3900
OCPBUGS-32248: Replace periods with commas in subnet label value #3885
chore(deps): update rhtap references #3886
HOSTEDCP-1462: set HostPath.Type on volumesource in CloudNodeManagerD… #3892
NO-JIRA: fixed e2e teardown failing the outer test instead of subtest #3891
HOSTEDCP-1519: feat(api): Add ingress-controller-load-balancer-scope annotation #3848
NO-JIRA: remove ovnkube-control-plane from expected component token m… #3850
CNV-40622: Docs: Avoid cidr Collisions b/w Infra &Guest cluster #3863
NO-JIRA: Disable kubevirt-csi crash detection in e2e #3896
Revert “HOSTEDCP-1465: Create HCPs with externalDNS on AKS Clusters” #3890
HOSTEDCP-1465: Create HCPs with externalDNS on AKS Clusters #3688
chore(deps): update rhtap references #3872
OSD-19085: Replaced hypershift_cluster_cores metric with hypershift_cluster_vcpus metric #3697
NO-ISSUE: *: use the api package constant for the size label #3876
NO-JIRA: bump capk ci image #3830
NO-JIRA: chore(deps): update rhtap references (main) #3867
OCPBUGS-29466: Fix ICSP and IDMS inclusion as registriesOverrides #3862
STOR-1805: Set RUN_AS_USER if mgmt cluster doesn’t have SCC #3819
OCPBUGS-29494: Fix disconnected metadata inspection #3860
OCPBUGS-31012: Disable audit-log container in kas when profile is None #3765
NO-JIRA: [e2e test framework] Add a flag to add an annotation to HostedCluster #3854
NO-JIRA: update private cluster IAM policy doc #3851
NO-JIRA: chore(deps): update rhtap references (main) #3856
OCPBUGS-14383: disable autoscaler when no nodepool requires it #3846
NO-JIRA: Document additional known issues for the disconnected scenario #3611
NO-JIRA: Update RHTAP references (main) #3834
OCPBUGS-29391: Add new permission required in CAPA #3779
CNF-11885: nto: add events resources under operator Role #3827
OCPBUGS-31444: use dnsPolicy: Default for konnectivity-agent in data plane #3810
NO-JIRA: docs: fixing wrong key name #3833
NO-JIRA: Update expected condition to false for ValidAzureKmsConfig s… #3837
OCPBUGS-31725: include hostnetwork SCC CPO role for 4.13 and earlier #3838
HOSTEDCP-1511: enable and document kubevirt custom default network #3832
HOSTEDCP-1513: Support annotation scoping for hostedcluster resources #3702
OCPBUGS-31415: update desired image even when HCP doesn’t exist yet #3829
NO-JIRA: Added regression tests to ensure certain deployment fields do not get set. #2707
OCPBUGS-31585: disable http2 for ignition server and proxy #3817
OTA-1211: api/v1beta1/hostedcluster_types: Add spec.updateService #3576
HOSTEDCP-1365: kubevirt, Generate kccm lb endpointslices #3528
NO-JIRA: Add –auto-repair flag to hcp create nodepool #3163
NO-JIRA: Set control plane to HA by default #3788
NO-JIRA: Fix docs commands related to Azure ephemeral OS disks #3809
Update RHTAP references #3814
NO-JIRA: Documentation overview of HCP KubeVirt Storage #3763
OCPBUGS-31465: remove max function usage from deicated request serving nodes #3815
OCPBUGS-31106: Reduce log file size for hypershift apiservers #3781
HOSTEDCP-1462: Enable TestNodePool and CreateCluster tests on Azure #3732
OCPBUGS-31319: copy issuerCertificateAuthority configmap into HC openshift-config #3799
HOSTEDCP-1478: Request serving node scheduler that uses HC size label #3776
OCPBUGS-31076: Support other azure clouds #3804
OCPBUGS-31110: Fix empty RHCOSImage error when creating Azure Infrastructure #3782
HOSTEDCP-1104: Skip CPU Check on Render & Get Mgmt Cluster CPU from API Server #3797
OCPBUGS-13726: fix race between ignition payload generation and MCS configmap update #3795
NO-JIRA: Bump google.golang.org/protobuf from 1.32.0 to 1.33.0 in /hack/tools #3752
NO-JIRA: Bump github.com/go-jose/go-jose/v3 from 3.0.1 to 3.0.3 #3710
OCPBUGS-31089: Fix empty resourceGroupName error when deleting Azure infra #3775
OCPBUGS-31090: Fix empty subnet name error when creating Azure infrastructure #3778
OCPBUGS-31263: Add missing PodSecurityViolation alert #3733
OCPBUGS-31118: fix(ignition): Fix priority class override #3784
OCPBUGS-31088: Fix loopvar issue #3770
Update RHTAP references #3790
HOSTEDCP-1104, HOSTEDCP-1105: Validate multi-arch aspects in an AWS Hosted Cluster #3769
HOSTEDCP-1501: Create default ClusterSizingConfig CR on start #3787
NO-JIRA: Remove unused ref to hostnetwork in cpo role #3789
OCPBUGS-30930: Add CEL validation for NodePool autoScaling / replicas #3786
OCPBUGS-31102: inject built-in MCP selector for KubeletConfigs and ContainerRuntimeConfigs #3780
NO-JIRA: Adding Disable PKI Reconciliation annotation as an option #2989
OCPBUGS-30991: external OIDC: fix certificateAuthority field in structured auth config #3773
HOSTEDCP-1429: Add install flag to enable/disable size tagging #3766
OCPBUGS-30968: ibmcloud KMS: remove breaking image check and enable KMS v2 support #3760
HOSTEDCP-1487: Add managed service constants to HyperShift API #3762
OCPBUGS-30260: Support subnet labels separated by periods #3767
HOSTEDCP-1429: hypershift-operator: wire up placeholder pods for sizes #3749
NO-JIRA: Increase stability in autoscaled environments #3757
NO-JIRA: Bump HO read budget in e2e to 6000 #3761
HOSTEDCP-1220: Add multi-arch flag to CLI & associated validation #3743
HOSTEDCP-1467: ARO HCP - Add ability to specify subnet at nodepool level #3748
NO-JIRA: Update RHTAP references #3753
OCPBUGS-30260: Support specifying AWS LB subnets #3746
HOSTEDCP-1487: Add ability to set managed service type in HO #3736
NO-ISSUE: hypershift-operator: react to hosted cluster changes #3735
HOSTEDCP-1429: hypershift-operator: add a controller for t-shirt sizing #3686
HOSTEDCP-929: Add nodepool annotation to allow requesting IMDSv2 #3584
NO-JIRA:Bump CPO Read API budget to 4000 in EnsureApiBudget #3745
OCPBUGS-30320: speed up HCP rollout durations #3734
STOR-1805: Set env var when the mgmt cluster supports SCC #3701
HOSTEDCP-1488: Use regionalized STS endpoints in AWS #3742
NO-JIRA: Update RHTAP references #3737
OCPBUGS-30242: consider nigthly images in payoad version check #3727
OCPBUGS-28634: Update agentserviceconfig.md to remove PUBLIC_CONTAINER_REGISTRIES #3687
HOSTEDCP-1478: Support additional node selectors for request serving nodes #3729
Revert “HOSTEDCP-1220: Add multi-arch flag to CLI & associated validation” #3731
OCPBUGS-13726: honor HC image configuration #3714
HOSTEDCP-1220: Add multi-arch flag to CLI & associated validation #3689
OCPBUGS-30769: include node local client loadbalancer address in kube-apiserver signing ips #3699
NO-JIRA: Temporary remove promtool from hack/tools to unblock RHTAP pipeline #3728
HOSTEDCP-1460: Remove resource limits on azure-cloud-node-manager #3725
HOSTEDCP-1479: Update IBM/networking-go-sdk package #3722
HOSTEDCP-1480: Update TLS cert hash creation with sha512 #3718
NO-JIRA: Fixes Dependabot PR #3712 #3716
HOSTEDCP-1466: support/metrics: don’t filter HCCO metrics #3715
MCO-392: ignition-server/controllers: drop MCSIgnitionProvider #3709
HOSTEDCP-1469: Set GOMEMLIMIT annotation based on request serving node label #3708
OCPBUGS-30574: Update OLM Default Catalog Sources to 4.16 on main #3707
chore(deps): update rhtap references #3704
OCPBUGS-30242: Use cluster-config-operator for 4.14 payload #3685
NO-JIRA: Dependabot#3659 #3665
Revert “NO-JIRA: test/e2e: temporarily skip NTO machineconfig test” #3700
NO-JIRA: cleanup: nilness check failures #3698
HOSTEDCP-1464: Add pull secret to install CLI & create k8s secret #3682
OCPBUGS-30060: Set OPERATOR_IMAGE environment variable #3667
OCPBUGS-28370: Use correct return error when destroying AWS SG #3661
OCPBUGS-30301: [kubevirt] Fix virt-launcher netpol to allow missing access #3680
OCPBUGS-30124: do not set KAS OAuthMetadataFile with Authentication type OIDC #3678
NO-JIRA: Bump the misc-dependencies group in /hack/tools with 1 update #3658
NO-JIRA: Bump the golang-dependencies group with 1 update #3657
chore(deps): update rhtap references #3674
NO-JIRA: test/e2e: temporarily skip NTO machineconfig test #3683
NO-JIRA: chore(deps): update rhtap references #3671
NO-JIRA: Remove specific pull secret watch in HCCO #3605
OCPBUGS-30102: Support to disable machine management components #3570
NO-JIRA: Minor cleanup of Azure create cluster document #3663
NO-JIRA: chore(deps): update rhtap references #3650
OCPBUGS-29613: test: add a test for invalid CSRs #3612
NO-JIRA: test: skip CCO in pod crash check #3652
OCPBUGS-29773: set Konnectivity cipher suites #3618
OCPBUGS-30030: rollout kas on auth config change #3647
NO-JIRA: test: increase CPO mutate budget #3649
NO-JIRA: test: debug certificates on unauthz error #3642
NO-JIRA: Remove replace statements #3631
NO-JIRA: DEPENDABOT#3613 #3617
NO-JIRA: chore(deps): update rhtap references #3638
NO-JIRA: Bump the misc-dependencies group in /hack/tools with 2 updates #3636
NO-JIRA: Bump the misc-dependencies group with 5 updates #3634
OCPBUGS-28370: Skip SG deletion if it has dependancy violation #3622
NO-JIRA: Update RHTAP references #3621
NO-JIRA: Update RHTAP references (main) #3623
OCPBUGS-23457: Switch to use service endpoint for Konnectivity #3627
OCPBUGS-27180: Update the oauth API server’s shutdown delay duration #3608
NO-JIRA: Re-enable InPlace NodePool upgrade test for kubevirt (CNV-36608) #3600
OCPBUGS-29855: feat(ho): Add flag for dedicated request serving isolation #3601
OCPBUGS-28607: feat(config): Default RevisionHistoryLimit to 2 for deployments #3477
NO-JIRA: adjust pdb for oauth-apiserver #3619
OCPBUGS-29645: control-plane-pki-operator: fix CA used for SRE client credentials #3615
HOSTEDCP-1424: ARO HCP Support Disabling Outbound SNAT #3583
NO-JIRA: always set minAvailable on PDBs to 1 #3616
OCPBUGS-29723: CLI: create nodepool aws - remove sg requirement #3614
NO-JIRA: Bump the misc-dependencies group with 15 updates #3609
NO-JIRA: Ignore kubectl version mistmaches in Component Versions #3575
NO-JIRA: Bump the k8s-dependencies group in /api with 2 updates #3598
OCPBUGS-28538: Add an SCC for validation pods with Cilium SDN #3602
NO-JIRA: chore(deps): update rhtap references #3603
HOSTEDCP-1411: Add capability to specify additional tags to azure resource… #3490
NO-JIRA: chore(deps): update rhtap references #3590
OCPBUGS-29435: Use structured authentication config #3574
HOSTEDCP-1428: hcco: report node count on HCPs #3557
HOSTEDCP-1436: Make nodepool.spec.aws.subnet required #3581
OCPBUGS-29586: use 2040 for apiserver svc in IBM provider #3569
HOSTEDCP-1438: Preserve container resources for more hosted control plane components #3120
NO-JIRA: contrib/aws-tag-lb-service-webhook: JSONPatch improvements #3585
NO-JIRA: KubeVirt Platform Documentation for Additional Network, CPU Performance, and VM NodeSelector #3464
NO-JIRA: remove dead code from kas config #3578
OCPBUGS-29115: Default NodeUpgradeType on day2 nodepool creation #3572
Revert “CNV-36608: Enable InPlace NodePool upgrade test for kubevirt” #3547
NO-JIRA: Update RHTAP references #3577
OCPBUGS-28538: Added docs to get other sdn providers deployed with agent provider #3405
Update RHTAP references #3568
CNF-6516: NTO: Enable PerformanceProfile #1782
OCPBUGS-29209: hypershift-operator: don’t create PKI rbac when disabled #3544
OCPBUGS-29104: control-plane-pki-operator: add a signer for SRE break-glass #3542
NO-ISSUE: test: wait longer for certificate signing, revocation #3560
NO-JIRA: Reduce nodepool test cases for KubeVirt due to infra perf issues #3562
NO-JIRA: Developer namespace template for CI clusters #3561
HOSTEDCP-1419: Always include AWS default security group in worker security groups #3527
HOSTEDCP-1407: Add steps for seting up azure CI cluster #3545
Update RHTAP references (main) #3546
HOSTEDCP-1420: Set a fixed minimum supported version #3525
NO-JIRA: Update RHTAP references #3518
OCPBUGS-29103: control-plane-pki-operator: validate CN for CSR #3538
NO-JIRA: stevekuznetsov approver on CPPO and integration tests #3540
NO-JIRA: Fix issue with release note tool #3429
HOSTEDCP-336: Hypershift API separation #3390
HOSTEDCP-1344: control-plane-pki-operator: add a revocation controller #3339
CNV-36608: Enable InPlace NodePool upgrade test for kubevirt #3517
OCPBUGS-27282: Make ControllerAvailabilityPolicy immutable #3513
NO-JIRA: remove unneeded code to copy Authentication refs #3512
OCPBUGS-28659: Add ValidatingAdmissionPolicy to KAS config #3488
OCPBUGS-28741: Fix default release image lookup #3450
NO-JIRA: Add app labels to KubeVirt CCM component #3510
MULTIARCH-4084: Reduce the policy access scope to specific instance #3491
NO-JIRA: Bump the misc-dependencies group with 5 updates #3503
OCPBUGS-28625: cpo: honor user provided oauthmetadata configmap passed in Authentication config #3511
NO-JIRA: Bump github.com/go-resty/resty/v2 from 2.10.0 to 2.11.0 in /hack/tools #3505
Update RHTAP references (main) #3508
OCPBUGS-28763: Ensure cloud resources are destroyed for all platforms when –destroy-cloud-resources is used #3494
OCPBUGS-28601: Remove webhook validations that introduce resource ordering #3484
NO-JIRA: manifests: Skip pod anti affinity for nil labels #3507
MULTIARCH-3882: Support PER solution for powervs platform via transit gateway #3277
HOSTEDCP-1408: Update CAPZ Identity Type to Service Principal #3501
OCPBUGS-27161: reflect NodePool replica count nil in status #3472
NO-JIRA: Fix dependabot pr 3414 #3453
NO-JIRA: kubevirt, e2e, Add additional network test #3449
NO-JIRA: remove PrivateIngressController cleanup #3489
HOSTEDCP-1373: ARO HCP - Add capability for Azure VMs to be created with ephemeral disks #3483
NO-JIRA: contrib: add code for aws-tag-lb-service-webhook #3493
NO-JIRA: Bump the misc-dependencies group with 3 updates #3486
NO-JIRA: Bump the misc-dependencies group in /hack/tools with 1 update #3469
HOSTEDCP-1364: kubevirt, use selector less services for ingress #3343
OCPBUGS-22899: node spread anti-affinity for HA HCP #3286
NO-JIRA: Bump the misc-dependencies group with 17 updates #3476
HOSTEDCP-1401: Enable BYO NSG #3455
NO-JIRA: Update go-jose to the latest version to fix CVE #3475
HOSTEDCP-1344: re-revert api stuff #3463
OCPBUGS-26940: Include OperatorHubSpec sync with HC when Config is empty #3454
NO-JIRA: Simplified kubectl component version check #3458
NO-JIRA: Remove ‘–attach-default-network’ from productized cli #3462
NO-JIRA: Tolerate restarts for kubevirt external infra #3451
NO-ISSUE: .ci-operator.yaml: base off of RHEL 9 #3466
OCPBUGS-27366: indicate cluster profile to render the correct manifests #3443
OCPBUGS-26977: Required RBAC for network-node-identity is not created when hosted cluster networkType is set to Other. #3403
TRT-1456: Revert #3448 “api: move CSRA to a new group” #3460
HOSTEDCP-1344: api: move CSRA to a new group #3448
HOSTEDCP-1397: Add documentation on how to debug Azure nodes #3452
NO-JIRA: Update Dockerfiles to use publicly available RHEL9 images #3426
HOSTEDCP-1308: Add e2e to ensure SA token not mounted on mgmt workloa… #3301
NO-JIRA: Fix promql testdata missing issue #3438
NO-JIRA: Update RHTAP references (main) #3446
HOSTEDCP-1188: Add docs for control plane scheduling topologies #3434
HOSTEDCP-1283: Set outbound LoadBalancer name on AzureCluster #3445
NO-JIRA: Bump misc dependencies 21f825371d #3433
HOSTEDCP-1207: Automated etcd backup #3034
NO-JIRA: Document machine configuration in HyperShift #3331
HOSTEDCP-1382: [Subtask] Restore Ability to Create HCPs on Azure #3404
HOSTEDCP-1314: Ensure all e2e HCs use NLB for ingress controller #3293
OCPBUGS-26757: Change KAS bootstrap image to cluster-config-api #3400
NO-JIRA: Improve nodepool’s machine condition message #3354
OCPBUGS-23228: Add storage, csisnapshotcontroller and clustercsidrive… #3396
OCPBUGS-27027: availability-prober: wait for infrastructure name to be set #3409
NO-JIRA: remove non-existent v1beta2 from webhook #3407
HOSTEDCP-1376: Bump the sigs.k8s-dependencies group and update dependabot groupings #3392
OCPBUGS-25696: Apply Scheduling Configuration for kCCM #3382
OCPBUGS-26547: remove LoadBalancer filter from external-dns #3410
OCPBUGS-26547: fix up external-dns flags #3408
OCPBUGS-26547: reduce external-dns route53 call volume #3394
Update RHTAP references (main) #3401
OCPBUGS-25897: hcco: use manual mode for CCO #3375
HOSTEDCP-1309: Add GC knobs for KAS #3384
NO-JIRA: [KubeVirt] Fix external infra permissions documentation #3391
HOSTEDCP-1374: external OIDC: copy Authentication OIDC client secrets through to guest #3373
OCPBUGS-25974: Do not use CPO image from status if it’s not a valid image reference #3361
OCPBUGS-23518: consider HCP upgradeable if CVO has no upgradable condition #3239
OCPBUGS-26232: set KAS runtime-config in alignment with feature gates #3377
HOSTEDCP-1372: Bumps k8s to v0.29 #3360
OCPBUGS-25342: Add extra resources to be encrypted. #3341
OCPBUGS-26197: hostedcontrolplane: don’t start pki operator when disabled #3368
CNV-36656: Documenting the mimimum RBAC required for External Infra cluster with KubeVirt provider #3364
NO-JIRA: Update RHTAP references (main) #3365
HOSTEDCP-1371: Bump Golang to v1.21 #3359
HOSTEDCP-1328: Add Ability to Encrypt VM OS Disks #3281
HOSTEDCP-1122: Etcd defrag controller #2869
NO-JIRA: Update RHTAP references (main) #3275
HOSTEDCP-336: Move fixtures out of API #3342
OCPBUGS-23362: Set new condition on SG deletion. #3307
NO-JIRA: Bump the k8s-dependencies group in /hack/tools with 1 update #3251
NO-JIRA: Add rbac permission for kubevirt capi #3344
OCPBUGS-22399: Disable UWM Telemetry writer when telemeter-client cm not exists #3348
NO-JIRA: Approvers update #3347
HOSTEDCP-1262: Add additional CEL to Arch in NodePoolSpec #3333
NO-JIRA: Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /hack/tools #3334
NO-JIRA: Bump golang.org/x/crypto from 0.16.0 to 0.17.0 #3335
OCPBUGS-22399: Disable UWM Telemetry remote writer when MGMT cluster is disconnected #3332
HOSTEDCP-336: Move CAPI imports from /api package into support/api #3270
OCPBUGS-24308: Add PodDisruptionBudget for router deployment #3337
HOSTEDCP-1355: Remove unused functions from repo #3325
NO-JIRA: RHTAP Multi-Arch PipelineSpec #3340
HOSTEDCP-1329: Allow user to specify resource group for NodePool resources #3279
HOSTEDCP-1353: Improve description for agent APIServerAddress CLI flag #3314
ACM-8917: Add agentLabelSelector to nodepool agent create to CLI #3285
CCO-388: control-plane-operator: reconcile the CCO #2794
NO-JIRA: Bump github.com/prometheus/alertmanager from 0.25.0 to 0.25.1 in /hack/tools #3045
NO-JIRA: Bump github.com/docker/docker from 23.0.3+incompatible to 24.0.7+incompatible in /hack/tools #3145
HOSTEDCP-1344: use library-go crypto where we can #3326
OCPBUGS-25332: Force KMSv1 on #3318
HOSTEDCP-1273: Added support for OLM Disable default sources on HC creation #3320
HOSTEDCP-1327: Remove Old Azure SDKs from Azure Infra #3274
OCPBUGS-25306: Use k8s.io/kube-scheduler/config/v1 #3313
TRT-1406: Revert #3283 “HOSTEDCP-1273: Added support for OLM Disable default sources on HC creation” #3306
OCPBUGS-25103: Remove reference to v1alpha1 flowcontrol #3304
HOSTEDCP-1257: control-plane-pki-operator: add a CSR flow for break-glass creds #3267
NO-JIRA: Align kubevirt MinSupportedVersion with the default one (4.14.0) #3305
OCPBUGS-24261: Konnectivity agent update strategy #3294
CNV-36056: Expose NodeSelector for KubeVirt VMs in NodePool #3280
ACM-8466: Add Kubernetes SCC V2 options to HO containers #3284
OCPBUGS-23511: Remove IAM path when applying control-plane-operator ARN to VPC Endpoint Service allowed principals #3215
NO-JIRA: Update Latest Supported Version to 4.16 After Branch-out #3302
HOSTEDCP-1343: docs(ibmcloud): Add HC/HCP yamls for IBM Cloud #3287
HOSTEDCP-1273: Added support for OLM Disable default sources on HC creation #3283
HOSTEDCP-1272: Added CLI support to create DualStack clusters using default values #3276
OCPBUGS-20035: Add HostedCluster false conditions sumamry when cluste… #3190
Full changelog

ibm-cloud-controller-manager

OCPBUGS-22602, OCPCLOUD-2419: Merge https://github.com/IBM-Cloud/cloud-provider-ibm:release-1.29 (d1ca4a9) into master #59
OCPBUGS-25562: Updating ose-ibm-cloud-controller-manager-container image to be consistent with ART #62
OCPBUGS-25638: Add Snyk file to exclude vendor directory on scan #63
OCPBUGS-24921: Updating ose-ibm-cloud-controller-manager-container image to be consistent with ART #61
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-79964: Bump google.golang.org/grpc to v1.79.3 #145
OCPBUGS-77210: [release-4.16] standardize build paths #124
OCPBUGS-58737: bump github.com/golang/glog to version v1.2.4 #106
OCPBUGS-56063: tech debt: rework vendor patches #91
OCPBUGS-53910: bump github.com/golang-jwt/jwt/v4 to v4.5.2 #84
OCPBUGS-36067: CVE-2024-6104: bump github.com/hashicorp/go-retryablehttp to v0.7.7 #71
OCPBUGS-30514: CVE-2024-24786: bump google.golang.org/protobuf to v1.33.0 #65
STOR-1571: Chore: Update ibm-vpc-block-csi-driver to the latest release #64
OCPBUGS-25566: Updating ose-ibm-vpc-block-csi-driver-container image to be consistent with ART #63
STOR-1688: Chore: add .snyk file to ignore false positives #62
OCPBUGS-25049: Updating ose-ibm-vpc-block-csi-driver-container image to be consistent with ART #61
OCPBUGS-24930: Updating ose-ibm-vpc-block-csi-driver-container image to be consistent with ART #60
Full changelog

ibm-vpc-block-csi-driver-operator

OCPBUGS-102992: Use patched x/net fork v0.35.0-sec.4 #187
OCPBUGS-59727: [IBM VPC] set offlineExpansion to false in e2e test manifest #149
OCPBUGS-42286: Reorder static resources to create RBAC first #129
OCPBUGS-36073: CVE-2024-6104: bump github.com/hashicorp/go-retryablehttp to v0.7.7 #120
OCPBUGS-33329: [ibm-vpc] Scheduling issue on IBM Cloud Bare Metal nodes #115
OCPBUGS-28230: enforce termination message policy on all platform pods #114
OCPBUGS-29247: ibm-vpc-block-csi-driver is missing sidecar metrics #112
OCPBUGS-26924: Add healthcheck for node registrar #110
OCPBUGS-29578: Apply hypershift cluster-profile for ibm-cloud-managed #111
STOR-1574: Bump all deps #108
OCPBUGS-28938: Updating ose-ibm-vpc-block-csi-driver-operator-container image to be consistent with ART for 4.16 #109
STOR-1574: Bump library-go #107
STOR-1714: Release leadership on SIGTERM #105
OCPBUGS-25539: Updating ose-ibm-vpc-block-csi-driver-operator-container image to be consistent with ART #102
STOR-1688: Chore: add .snyk file to ignore false positives #101
OCPBUGS-23862: Bump go.opentelemetry.io/contrib/instrumentation/net/http/otelgrpc to v0.46 #100
OCPBUGS-25105: Updating ose-ibm-vpc-block-csi-driver-operator-container image to be consistent with ART #98
OCPBUGS-23306: Add annotation to CSI driver Pod preventing eviction from the cluster-autoscaler #97
OCPBUGS-24845: Updating ose-ibm-vpc-block-csi-driver-operator-container image to be consistent with ART #96
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-103009: Replace golang.org/x/net with openshift-sustaining/net #170
OCPBUGS-115544: Fetch envtest assets from the controller-tools releases #181
OCPBUGS-67288: [release-4.16] Fix incomplete vendor/ #138
OCPBUGS-51818: CVE-2025-22869 Update golang.org/x/crypto to patched OpenShift fork #109
OCPBUGS-43686: UPSTREAM: <carry>: Fix go-retryablehttp CVE - 4.16 #89
OCPBUGS-33170: All containers must fallback to logs on error #80
OCPBUGS-29590: Update golang.org/x/crypto module #77
OCPBUGS-24924: Updating ose-ibmcloud-cluster-api-controllers-container image to be consistent with ART #70
OCPBUGS-22604, OCPCLOUD-2454: Merge https://github.com/kubernetes-sigs/cluster-api-provider-ibmcloud:v0.7.0 (e51c61e) into main #74
OCPBUGS-26135: Fix formatting in snyk vendor exclusions #75
OCPBUGS-25631: Add Snyk file to exclude vendor directory on scan #71
Full changelog

ibmcloud-machine-controllers

OCPBUGS-103003: replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 #106
NO-JIRA: fix unit tests broken by deprecated kubebuilder-tools bucket #113
OCPBUGS-44870: Bump dependency for CVE #53
OCPBUGS-36698: IBMCloud: Handle pagination for subnets #42
OCPBUGS-27872: add an extra vendor exclude to snyk config #36
OCPBUGS-28965: update textlogger usage #35
OCPCLOUD-2426: Update to k8s 1.29 #34
OCPBUGS-26134: Add Snyk file to exclude vendor directory on scan #33
OCPBUGS-25574: Updating ose-ibmcloud-machine-controllers-container image to be consistent with ART #32
OCPBUGS-24962: Updating ose-ibmcloud-machine-controllers-container image to be consistent with ART #31
Full changelog

insights-operator

OCPBUGS-68370: Add filtering to add other possible pod status to QEMU gatherer #1200
OCPBUGS-67009: QEMU logs are not gathered if there are pending status virt-launcher pods #1197
And 49 elided commits (e.g. from squash or rebase merges)
Full changelog

ironic

OCPBUGS-85333: update ironic-image commit hash to address CVE-2026-43003 #912
OCPBUGS-100162: bump openstack-ironic pin for CVE-2026-44918 fix #908
OCPBUGS-104459: bump openstack-ironic pin for CVE-2026-54423 fix(release-4.16) #877
OCPBUGS-76457: Bump pyasn1 to 0.5.1-4 #828
OCPBUGS-69789: Bump eventlet version to 0.33.1-7 #763
METAL-1306: Do not use openstack packages #648
OCPBUGS-49895: Drop quiet option of grep to avoid race condition with pipefail #634
OCPBUGS-48151, OCPBUGS-48598: Bump jinja2 to 3.0.1-6.el9.2 #623
OCPBUGS-44895: Bump Ironic #610
OCPBUGS-43950, OCPBUGS-43958: Bump python-waitress [4.16] #604
OCPBUGS-43438: Include fixes for CVE-2024-5569 #599
OCPBUGS-42511: Include fix for CVE-2024-47211 #594
OCPBUGS-39017: Bump ironic-lib to fix utf8 decoding issue #569
OCPBUGS-38797: redfish-virtualmedia fails on XFusion nodes #564
OCPBUGS-42113: Update ironic-inspector to fix the memory leak #587
OCPBUGS-37758, OCPBUGS-39383: Include fixes for CVE-2024-44082 #579
OCPBUGS-38510: set min version for python3-webob #553
OCPBUGS-33376: bump werkzeug #534
OCPBUGS-36838: Update Jinja2 #521
OCPBUGS-36285: Read ironic and inspector htpasswds from files #517
Bug OCPBUGS-34985: Disable installation of .pyc files through pip #509
OCPBUGS-32304: Fix ironic-inspector permissions for creating /certs/ca directory #500
METAL-1005: [4.16] Update ironic projects and remove cinder and glance clients #493
NO-ISSUE: Merge from metal3-io/ironic-image #473
OCPBUGS-32366: [4.16] remove unused prometheus-exporter from OKD too #486
OCPBUGS-32366: [4.16] Remove unused prometheus exporter #484
OCPBUGS-32366: [4.16] Bump gunicorn version #480
NO-ISSUE: Use microversion-parse package #481
OCPBUGS-32350: Update to include fixes for ironic servicing feature #478
OCPBUGS-32390: Use unix sockets by default for reverse proxy communication #472
OCPBUGS-32162: Bump eventlet version #471
METAL-949: Force pysnmp-lextudio and pyasn1 min version #464
METAL-952: Install sushy from source #466
METAL-804: Bump ironic hash to include recent fixes and features #465
METAL-944: Install ironic-lib from source #463
METAL-923: pick-up non-bootable ISO fix #462
METAL-922: Add check requirements script #461
METAL-901: Update ironic dependencies for OCP 4.16 #457
NO-ISSUE: Merge from upstream metal3-io/ironic-image #459
METAL-909: Avoid context copy in CI or local builds #458
METAL-849: Install ironic and ironic-inspector from source #444
METAL-902: Split OKD and OCP packages list #456
NO-ISSUE: Updating openstack-ironic version #455
OCPBUGS-27967: Update packages for OCP 4.16 #451
METAL-850: Update packages for OCP 4.16 #449
OCPBUGS-22699: Fix Inspector iPXE config for IPv6 addresses #446
OCPBUGS-25605: Relax packages requirements #441
NO-ISSUE: Merge from metal3-io/ironic-image (33275f5) #443
NO-ISSUE: Add requirements placeholders for cachito #437
OCPBUGS-25392: Stuck deployment #440
OCPBUGS-24747: Updating ironic-container image to be consistent with ART #438
Full changelog

ironic-agent

OCPBUGS-85333: Update ironic-python-agent commit hash to address CVE-2026-43003 #316
OCPBUGS-99890: Bump ironic-python-agent pinned commit for CVE-2026-66138 #310
OCPBUGS-95070: Replace individual package removal with a single rpm -e loop #288
OCPBUGS-95070: Replace dnf remove with rpm -e to prevent dependency removal #276
OCPBUGS-61165: netutils: Use ethtool ioctl to get permanent mac address #215
OCPBUGS-69781: Bump eventlet version to 0.33.1-7 #232
METAL-1306: Do not use openstack packages #180
OCPBUGS-39017: Bump ironic-lib to fix utf8 decoding issue #156
OCPBUGS-39383: Include fixes for CVE-2024-44082 #161
OCPBUGS-38510: set webob and bump werkzeug #149
OCPBUGS-31549: update ironic-python-agent with latest fixes #128
OCPBUGS-32172: Fix name in setup.cfg #122
METAL-925: Fix permission of check reqs script #120
METAL-925: Add makefile with build and check reqs #119
METAL-925: Install ironic-python-agent from source #118
METAL-925: Add requirements placeholders for cachito #117
NO-ISSUE: Update openstack-ironic-python-agent version #110
METAL-913: drop dependency on python-hardware #113
OCPBUGS-30075: Fix tripleo url with commit hash for openstack repos config #114
OCPBUGS-19008: Always add ignition to set hostname on /etc/hostname #106
METAL-850: Update packages for OCP 4.16 #104
OCPBUGS-19950: pick up the heartbeat retry fix #101
OCPBUGS-16607: 502 Proxy Error #100
OCPBUGS-24781: Updating ironic-agent-container image to be consistent with ART #97
Full changelog

ironic-machine-os-downloader

OCPBUGS-25775: Updating ironic-rhcos-downloader-container image to be consistent with ART for 4.16 #96
OCPBUGS-25526: Updating ironic-rhcos-downloader-container image to be consistent with ART #95
OCPBUGS-24788: Updating ironic-rhcos-downloader-container image to be consistent with ART #94
Full changelog

ironic-static-ip-manager

OCPBUGS-49595: Fix subnet validation #48
OCPBUGS-24790: Updating ironic-static-ip-manager-container image to be consistent with ART #41
Full changelog

k8s-prometheus-adapter

OCPBUGS-30532: upgrade github.com/golang/protobuf to v1.5.4 for bette… #101
OCPBUGS-25583: Updating ose-prometheus-adapter-container image to be consistent with ART #100
OCPBUGS-24986: Updating ose-prometheus-adapter-container image to be consistent with ART #99
OCPBUGS-24986: Updating ose-prometheus-adapter-container image to be consistent with ART #98
MON-3584: Remove trailing spaces from Dockerfile.ocp #97
Full changelog

keepalived-ipfailover

OKD-219: add util-linux to base image #188
OKD-40: Revert #179 #180
OKD-40: Remove centos-openstack-zed and add in rdo repo to get python-cinderclient dependency #179
Add dnf-plugins-core in scos to help with OCP image compat #178
OKD-210: Add sig-cloud repository and enable rt repository #177
OKD-210: Add the sig-nfv repo in the CS9 base #176
OCPBUGS-24850: Bump OpenShift 4.16, RHEL9, and iptables package #175
OCPBUGS-24990: Updating openshift-enterprise-keepalived-ipfailover-container image to be consistent with ART #159
OCPBUGS-24800: Updating ose-egress-http-proxy-container image to be consistent with ART #156
NO-ISSUE: Add Scott and Mrunal as image approvers #170
NO-ISSUE: remove bparees from owners #169
OCPBUGS-29484: update unit tests in egress/dns-proxy #165
NE-1444: egress/dns-proxy: switch to haproxy28 RPM package #160
OCPBUGS-24861: Updating openshift-enterprise-egress-dns-proxy-container image to be consistent with ART #158
OCPBUGS-24751: Updating openshift-enterprise-base-rhel9-container image to be consistent with ART #155
OCPBUGS-24723: Updating openshift-enterprise-base-container image to be consistent with ART #154
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

kube-metrics-server

NO-ISSUE: synchronize OWNERS from main branch [release-4.16] #85
OCPBUGS-79929: Bump google.golang.org/grpc to v1.79.3 #66
: OCPBUGS-46663: Disable HTTP2 #41
OCPBUGS-41717: Wire server run options to flags. ([release-4.16] backport) #37
OCPBUGS-25164: Bump to 0.7.1 #25
OCPBUGS-31288: Updating ose-kube-metrics-server-container image to be consistent with ART for 4.16 #24
MON-3465: Sync metrics-server with upstream v0.7.0 #22
OCPBUGS-24858: Updating ose-kube-metrics-server-container image to be consistent with ART #21
Full changelog

kube-proxy, sdn

OCPBUGS-54457: Drop SYNACK as well in MCS side #658
OCPBUGS-44674: Handle openshift-host-network namespace as special when it modifies #648
OCPBUGS-46493: Raise the minSyncPeriod for NetworkPolicies to 10s during migration #649
OCPBUGS-46048: clean up containernetworking/plugins vendoring in sdn #645
OCPBUGS-45806: Stop checking ruleVersion [4.16] #643
OCPBUGS-44301: Use copy() to duplicate a net.IP #641
OCPBUGS-43344: OCPBUGS-42244: Implement namespaceSelectors on ingress with all pods IPs #635
OCPBUGS-42203: fix UDP conntrack cleanup #636
OCPBUGS-42159: fix redundant router-default iptables rule #633
OCPBUGS-30431: CVE-2024-24786: bump pkg golang protobuf #620
SDN-4404: Kube 1.29 bump #618
SDN-4114: Do per-pod MCS/metadata blocking with nftables rather than iptables #581
NO-JIRA: Update README to note that openshift-sdn is deprecated #611
NO-JIRA: Move sdn to RHEL9 base image #598
OCPBUGS-25740: Updating ose-node-container image to be consistent with ART for 4.16 #599
OCPBUGS-23666: Add Snyk file to exclude directories on scan #604
OCPBUGS-25779: Updating kube-proxy-container image to be consistent with ART for 4.16 #600
SDN-4179: Metrics: Add metric for multicast enabled netnamespaces #603
OCPBUGS-25015: Updating kube-proxy-container image to be consistent with ART #596
OCPBUGS-25036: Use openshift-clients rpm rather than cli image #593
Full changelog

kube-rbac-proxy

OCPBUGS-30447: protobuf bump [4.16] #111
OCPBUGS-31955: Merge upstream v0.17.1 release #98
AUTH-486: Add tests for the hardcoded-authorizer feature #90
OCPBUGS-29974: Updating kube-rbac-proxy-container image to be consistent with ART for 4.16 #91
OCPBUGS-24818: Updating kube-rbac-proxy-container image to be consistent with ART #88
Full changelog

kube-state-metrics

NO-ISSUE: synchronize OWNERS from main branch [release-4.16] #192
OCPBUGS-74875: Deduplicate CRS stores #133
NO-JIRA: Merge v2.11.0 and v2.12.0 tags #110
OCPBUGS-25585: Updating kube-state-metrics-container image to be consistent with ART #109
OCPBUGS-24993: Updating kube-state-metrics-container image to be consistent with ART #108
Full changelog

kube-storage-version-migrator

NO-JIRA: Add DOWNSTREAM_OWNERS (release 4-16). #227
OCPBUGS-27929: Updating ose-kube-storage-version-migrator-container image to be consistent with ART for 4.16 #203
OCPBUGS-24969: Updating ose-kube-storage-version-migrator-container image to be consistent with ART #202
Full changelog

kubevirt-cloud-controller-manager

OCPBUGS-95082: OWNERS: Update component to Cloud Compute / KubeVirt Provider #82
OCPBUGS-30518: Upstream rebase 18 04 2024 #41
OCPBUGS-24936: Updating ose-kubevirt-cloud-controller-manager-container image to be consistent with ART #30
OCPBUGS-26182: Upstream rebease 4 5 2024 #40
OCPBUGS-30303: Merge github.com/kubevirt 03 06 2024 #35
Full changelog

kubevirt-csi-driver

OCPBUGS-79930: Bump google.golang.org/grpc to v1.79.3 #108
OCPBUGS-54632: Ensure volume stays attached through reboots #57
OCPBUGS-44622: During detach don’t return error if VM is not found #49
CNV-36073: Enable snapshot tests #40
CNV-36073: Sync upstream kubevirt-csi 2024-04-19 #39
“NO-JIRA: Sync upstream kubevirt-csi 2024-04-08” #38
OCPBUGS-31276: Updating ose-kubevirt-csi-driver-container image to be consistent with ART for 4.16 #37
CNV-32073: Sync upstream 2024-03-15 #36
NO-JIRA: Address CVE-2024-1725: Restrict access to infrastructure PVCs by requiring matching infraClusterLabels on tenant PVCs #32
NO-JIRA: Snapshot backport #31
NO-JIRA: Auto sync upstream 2024 01 05 18 36 #27
OCPBUGS-24805: Updating ose-kubevirt-csi-driver-container image to be consistent with ART #26
Full changelog

libvirt-machine-controllers

OCPBUGS-77196: Fix incomplete vendor/ #302
OCPBUGS-26525: Updating ose-libvirt-machine-controllers-container image to be consistent with ART for 4.16 #283
OCPBUGS-26046: Replace genisoimage with xorriso in 4.15 to allow rhel9 bump #281
OCPBUGS-25630: Add Snyk file to exclude vendor directory on scan #276
OCPBUGS-25173: Updating ose-libvirt-machine-controllers-container image to be consistent with ART #275
OCPBUGS-25101: Updating ose-libvirt-machine-controllers-container image to be consistent with ART #274
OCPBUGS-24833: Updating ose-libvirt-machine-controllers-container image to be consistent with ART #273
Full changelog

machine-api-operator

OCPBUGS-103044: replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 #1547
OCPBUGS-98439: Use resource group when generating default Azure image #1516
OCPBUGS-76849: bumped logrus to v1.9.3 #1463
OCPBUGS-57210: Updates GCP CredentialsRequest #1378
OCPBUGS-55248, OCPBUGS-55249: Updates GCP credentials request #1355
OCPBUGS-53045: add image/read permissions #1348
OCPBUGS-52342: Drop oVirt support #1336
OCPBUGS-45947: vSphere klog initialization preventing verbose log messages #1312
OCPBUGS-45998: Ensure deletion annotation takes priority and oldestPolicy can distinguish longer ages #1313
OCPBUGS-39028: Updates message verbs to use %q where appropriate #1282
OCPBUGS-43433: Vsphere: Handle cloned instance with lost taskID #1298
CORS-3648: Add the hyperdisk-balanced disk type #1279
CFE-1051: Adding web-hook validation for capacityReservationGroupID #1263
AUTH-482: set required-scc for openshift workloads #1220
OCPCLOUD-2501: Update to set GpuType annotation to remove hardcoded value #1226
OCPCLOUD-2493: Bug fix in unit test #1232
OCPCLOUD-2493: Add unit tests for the functions handling ScaleFromZero annotations #1227
OCPBUGS-31962: Bump x/net to v.0.24.0 #1228
OCPBUGS-29956: Azure MAO CredentialsRequest Contains Unnecessary virtualMachines/extensions Permissions #1219
OCPBUGS-29874: Apply hypershift cluster-profile for ibm-cloud-managed #1218
SPLAT-1293: Bump IPAM types to v1beta1. #1205
OCPBUGS-26119: Add build tags to tools.go file to solve linting issues when running Snyk scans #1215
OCPBUGS-25193: Add additional vnet join permission for Azure #1212
SPLAT-1386: reconcile additional tags assigned to machine #1204
OCPBUGS-26119: Fix formatting in snyk vendor exclusions #1201
OCPBUGS-28230: add FallbackToLogsOnError for easier debugging #1211
CFE-684, OCPCLOUD-2430: Rebase k8s 1.29 and update dependencies #1208
CFE-684: Update GCPCloudCredentials with TagUser role #1158
OCPBUGS-27385: Add useExternalIp gcp permission #1206
OCPBUGS-23544: Set –max-concurrent-reconciles=10 for Azure machine controller #1203
OCPBUGS-23544: Add AddWithActuatorOpts to allow overriding Machine controller options #1202
OCPCLOUD-1725: Add GCP custom roles #1178
OCPBUGS-25580: Updating ose-machine-api-operator-container image to be consistent with ART #1190
OCPBUGS-25735: Add Snyk file to exclude vendor directory on scan #1192
OCPBUGS-24980: Updating ose-machine-api-operator-container image to be consistent with ART #1187
Full changelog

machine-config-operator

OCPBUGS-98960: Remove sensitive ControllerConfig logging #6315
OCPBUGS-98253: Bootstrap MCS logging entire ignition #6290
OCPBUGS-62171: Fix - NetworkManager restart or crash renders br-ex unusable #5354
OCPBUGS-60113: Enable debug logging for nodeip-configuration #5218
OCPBUGS-77253: Machine-config controller should not log about non-existent pull-secret changes #5694
OCPBUGS-77184: machine-config-daemon: openshift: Exposure of Sensitive Data in Log Files in the Machine Configuration Daemon. [openshift-4] #5685
OCPBUGS-63155: [release-4.16] Networking: reset ovn-remote config and allow ovnkube controller to set it #5359
OCPBUGS-60773: scope MCD node listers to current node #5260
OCPBUGS-63553: Add control-plane label for master nodes on legacy clusters #5376
OCPBUGS-57423: pkg/operator/status: Drop PoolUpdating as an Upgradeable=False condition #5119
OCPBUGS-63332: Recheck generatedByControllerVersion annotation prior to deleting a degraded MC #5364
OCPBUGS-56753: Support NODEIP_HINT in IPI deployments too #5079
OCPBUGS-62689: Add mcd_local_unsupported_packages recording rule #5328
OCPBUGS-59931, OPNET-681: Support migration to NMState #5205
OCPBUGS-61869: Override NMState service definition #5290
OCPBUGS-60621: Add workaround fix for static pod race #5252
OCPBUGS-56558: Log CRC MC deletion #5178
OCPBUGS-58270: Do not set cpu system reserve below the default value #5163
add missing vendors #4952
OCPBUGS-48283: Do not run resolv-prepender from NM dispatcher #4784
OCPBUGS-56868: daemon: fix ostree-finalize-staged race workaround for package mode RHEL workers #5090
OCPBUGS-56626: error from generateAndValidateRenderedMachineConfig function can be misleading #5075
OCPBUGS-54831: Make mtu-migration run after wait-for-primary-ip #4990
OCPBUGS-55684: MSBIC should not update windows machinesets #5028
OCPBUGS-35921: userCA and cloudCA certfiicates are not removed from nodes and ignition config #4419
OCPBUGS-53248: Enforce VIPs to be collocated at the same host #4923
OCPBUGS-53043: Enable nmstate-configuration on all platforms #4910
OCPBUGS-52952: Add ipsec connect wait service #4931
OCPBUGS-54163: Fixing typos for MachineConfigNode #4942
OCPBUGS-53434: Update ObservedGeneration in KubeletConfig #4935
OCPBUGS-53313: daemon: ensure ostree-finalize-staged is started before rebooting #4928
OCPBUGS-52421: Update format verbs for alert logs #4901
OCPBUGS-51347: Update the storage.conf configuration file template #4881
OCPBUGS-52593: Update cluster-reader ClusterRole permissions #4905
OCPBUGS-52404: create /run/nodeip-configuration before use #4897
OCPBUGS-52310: configure-ovs workaround for ovs-if-br-ex bug #4892
OCPBUGS-50862: Auto-recover from MC with invalid extension #4853
OCPBUGS-43680: Regenerate the rendered MC in use when deleted #4655
OCPBUGS-49976: Add clarification to invalid maxUnavailable alert #4837
OCPBUGS-39224: Do not enable on-prem-resolv-prepender.path for UPI #4573
OCPBUGS-48290: Pausing Master MCP results in Alerts #4786
OCPBUGS-43765: openstack: fix non-old systemd compatible unit #4660
OCPBUGS-43741: Soften haproxy timeout for kubeapi probe #4662
OCPBUGS-48116: OCPBUGS-47801: trying to wait for sub-controllers #4777
OCPBUGS-45974: Remove trailing periods from AWS provided hostnames #4744
OCPBUGS-44337: Removal of additionalTrustBundle CA does not remove certificate from node backport #4688
MCO-1342: Backport Telemetry to 4.16 #4649
OCPBUGS-44043: Disable ESP offload for OVS attached interfaces #4676
OCPBUGS-42109: Do not use ‘restart’ for ‘oneshot’ service #4616
OCPBUGS-42744: Check for kernel arg diff in updateOnClusterBuild #4628
OCPBUGS-42722: Panic seen in CI job for MCC pod #4626
OCPBUGS-42719: MCPs report wrong number of nodes when we move nodes from one custom MCP to another custom MCP #4625
OCPBUGS-41293: Enable the use of Linux Bridge as the ovs default port connection #4563
OCPBUGS-41256: Set ESP offloads off in bonds if slaves don’t support them #4627
OCPBUGS-41806: When newly built images rolled out, the update progress is not displaying correctly (went 0 –> 3) #4584
OCPBUGS-41518: CVE-2024-3727 ose-machine-config-operator-container: containers/image: digest type does not guarantee valid type #4569
OCPBUGS-38997: Machine-config daemon ListPools panic during tech-preview CI runs #4550
OCPBUGS-38711: SCC-pinning for openshift workloads #4539
OCPBUGS-36850: Port number 22623 exposing weak ciphers to external client from master node IP #4556
OCPBUGS-38373: Revert “MCD-pull: run after network-online.target in Azure” #4528
OCPBUGS-36171, OCPBUGS-36172: fix secret canonicalization #4432
OCPBUGS-37759: Guard MachineOSBuild & MachineOSConfig informers with feature gates #4505
OCPBUGS-37550: On-Prem resolv prepender to watch for NM changes #4498
OCPBUGS-37485: kubelet: boot without PSI for performance concerns #4486
OCPBUGS-37840: [release-4.16] Introduce versioning for Auto Node Sizing feature #4382
OCPBUGS-35891: Make logging configurable for on-prem components #4418
OCPBUGS-37470: Nodes are drained twice when an OCB image is applied #4484
OCPBUGS-37460: Openshift uncordoned compute-node that was intentionally cordoned #4483
OCPBUGS-37428: Machine-config operator should not hot loop generating ValidatingAdmissionPolicyUpdated events #4482
OCPBUGS-36775: templates: run disable-mglru conditionally #4462
OCPBUGS-36330: daemon: Handle correctly OS Version for 4.1 and 4.2 bootimages #4445
OCPBUGS-36536: MCD-pull: run after network-online.target in Azure #4453
OCPBUGS-35929: The MCD can override a restart crio action with a reload crio action #4420
OCPBUGS-36165, OCPBUGS-36166: CurrentImagePullSecret should be consumed by the MCD #4430
OCPBUGS-35753: Fix reference to $host_file #4413
OCPBUGS-36198: daemon/update: disable systemd unit before overwriting #4436
OCPBUGS-35806: Revert “Azure: add Azure specific dnsmasq ordering” #4414
OCPBUGS-35992: disable mglru service #4427
OCPBUGS-35291: Default ipv4 NODE_IP to 0.0.0.0 #4409
OCPBUGS-35364: Azure: add Azure specific dnsmasq ordering #4406
OCPBUGS-35299: Panic when we remove an OCB infra MCP and we try to create new ones with different names #4403
OCPBUGS-35042: ensure event handlers are registered after queue is configured #4394
OCPBUGS-34799: set required-scc for openshift workloads #4384
OCPBUGS-33901: machine-os-puller SA refreshes every hour, causing machine config regeneration #4374
OCPBUGS-10498: If multiple hostnames are returned, use the first one for the Node name #4368
OKD-212: Reference stream-coreos instead of centos-stream-coreos-9 #4349
OCPBUGS-25821, OCPBUGS-31381: certificate_writer: clean up disk-write logic #4343
MCO-1131: Merge implementation machineOSBuild and machineOSConfig in MCO #4327
OCPBUGS-33357: Check both ready and health ingress endpoints #4356
OCPBUGS-32583: daemon/pinned-image-set: refactor mirrored registry auth #4345
OCPBUGS-33046: improve status reporting for pinned image sets #4339
OPNET-282: Configure-ovs alternative implementation #4249
OCPBUGS-33018: pkg/daemon: Only re-bootstrap kubelet on X.509 errors #4351
OCPBUGS-33018: pkg/daemon: logSystem the Kube API errors that trigger a re-bootstrap #4342
OCPBUGS-29067: Fix CoreDNS pod definition on bootstrap nodes on cloud platforms #4238
OCPBUGS-11936: Wait for OpenStack Metadata service #4092
NO-ISSUE: API bump & reconcile feature gates move #4335
NO-ISSUE: Add NodeDisruptionPolicy docs #4336
OCPBUGS-32739: MachineConfigurations is only effective with name <cluster> #4332
MCO-1017: MCO-1018 MCO-1019: MCO-1020: MCO-1021: OCPBUGS-32583: OCPBUGS-32679: Implement PinnedImageSets #4303
OCPBUGS-33018: pkg/daemon: Ignore watch failure unless kubelet needs a rebootstrap #4337
MCO-1009: MCO-1008: MCO-905: Implement NodeDisruptionPolicy API #4267
OCPBUGS-32138: add cluster fleet evaluation support to mco #4316
MCO-424: cleanup: update references in docs from machine-os-contenet to rhel-coreos #4329
MCO-1029: MCO-678: Implement Boot Image update opt-in API #4281
MCO-1117: Make local MCO image builds faster #4296
OCPBUGS-32278: Fix configure-ip-forwarding.sh #4323
MCO-1102: OCPBUGS-32277: Add a ValidatingAdmissionPolicy for the boot images update opt-in API #4285
OCPBUGS-28230: enforce termination message policy on all platform pods #4318
MCO-1129: Re-land Adapting the MCO featuregate usage to new API #4315
OCPBUGS-28230: enforce termination message policy on all platform pods #4319
OCPNODE-1632: Support Cluster ImagePolicy CRD #4160
OCPBUGS-32028: Decrease logs of haproxy #4245
OCPBUGS-30192: Move StartLimitIntervalSec to Unit section #4304
OCPBUGS-28577: MCO-1030, MCO-910: Updating MCO base image to RHEL9 #4241
OCPBUGS-22910: Remove the condition for checking the multiple ovs-if-br-ex profiles #4016
OCPBUGS-18955: make sure CO degrades if OCL config is invalid #4294
OCPBUGS-31630: fix: resources were in the wrong indentation level #4299
TRT-1587: Revert #4275 “MCO-1092: Adapt the MCO’s featuregate usage to new API” #4295
OCPBUGS-31376: kubelet: restorecon necessary files on kubelet’s prestart #4287
MCO-1092: Adapt the MCO’s featuregate usage to new API #4275
OCPBUGS-31067: server: still serve kubeconfig with node-bootstrapper-token #4276
OCPBUGS-9108: OCPBUGS-24228: Make MCO operator always Available, add retry to applyManifests before degrading #4240
OCPBUGS-27316: configure-ovs: generate profiles directly in /run #4042
OCPBUGS-25744, OPNET-303: Remove weights from ingress check script #3698
OCPBUGS-31365: make verify should use MCO’s kube version #4280
MCO-760: add rebuild mechanism to ocb #4189
OCPCLOUD-2465: Updates GCR CredentialProviderConfig #4260
OCPBUGS-30852: add preferredduringscheduling annotation to kube-rbac-proxy-crio #4261
MCO-909: Openshift/Kubernetes 1.29 Rebase Updates #4256
OCPBUGS-30239: Prevent OVS-configuration to run before kdump #4213
OCPCLOUD-2514, OCPCLOUD-2516: Remove reliance on feature gates for cloud provider flags #4228
NO-JIRA: Sync CRI-O owners #4234
OCPNODE-2098: Add static pod for kube-rbac-proxy-crio #4175
OCPCLOUD-2462: Add Image Credential Provider flags for Kubelet on Azure #4222
OCPBUGS-25821: backportable version of api-int cert work #4106
MCO-898: OCPBUGS-29857: OCPBUGS-29819: Implement an alerting mechanism for boot image update failures #4194
OCPCLOUD-2465: Add Image Credential Provider flags for Kubelet on GCP #4224
OCPBUGS-30136: APIVersion and Kind sometimes are empty when listing objects #4231
OCPBUGS-29946: Prevent pull images in podmanCopy if they are present #4216
OCPBUGS-18670: OCPBUGS-18535: MCO-809: rendercontroller should also reconcile machineconfigs #4158
OCPBUGS-30090: add node owner to MCN #4223
OCPBUGS-29067: Add HostToContainer propogataion for coreDNS pods on cloud platforms #4218
NO-JIRA: ovs-configfuration, run after nmstate.service #4212
OCPBUGS-29713: set nodeStatusReportFrequency #4204
MCO-998: sets up MCO repository for Snyk CI scans #4197
OCPBUGS-29732: Always touch resolv-prepender file at end of script #4207
OCPBUGS-29659: Apply new DNS configuration only if changed #4196
OCPBUGS-29624: Restart resolv-prepender on failure #4201
OCPNODE-1877: Delete image openshift/openshift-proxy-pull-test #4047
NO-JIRA: nmstate, configure nmstate to keep service yamls #4190
NO-ISSUE: OWNERS: Remove myself from reviewers #3628
NO-ISSUE: add e2e-techpreview-shared, remove layering test target #4183
OCPBUGS-27162: Add dependency on crio-wipe to resolv-prepender #4146
OCPBUGS-22324: Revert “Revert “Merge pull request #4028 from cybertron/wait-for-br-ex”” #4079
OPNET-355: Use NM’s dns-change event for resolv.conf #4133
OCPBUGS-18940: Add keepalived healthcheck for machine-config-server #4129
MCO-774: Write e2e tests for bootimage management #4177
NO-JIRA: remove kube-rbac-proxy for crio port #4181
OCPBUGS-26951: annotate on-prem static pods for workload partitioning #4143
NO-JIRA: Fix patch comparison bug in test #4176
docs/HACKING: Update command for building customize OCP release #4023
OCPBUGS-18955, OCPBUGS-18989, OCPBUGS-18991: add capability to react to OCB ImageBuilderType changes #4127
OCPBUGS-29098: Revert “OCPNODE-2024: crio: migrate metrics port to localhost only” #4168
OCPBUGS-28969: On-prem coredns manifests should not be generated for GCP #4165
OCPBUGS-26557: Add existing kubeletconfig/ctrcfg mc-name-suffix annotation #4111
OCPNODE-2024: crio: migrate metrics port to localhost only #4164
OCPBUGS-24356: ovs-configure: fix vlan_parent calculation #4055
OCPBUGS-24705: consider currentImage and desiredImage annotations #4135
CORS-2814: Add support for in-cluster DNS on Cloud Platforms when cloud DNS cannot be used #4018
OCPBUGS-22721, OCPBUGS-25753: Run resolv-prepender entirely async #4102
OCPBUGS-26489: feat: enable nodeip service for single node #4142
OCPBUGS-28230: add FallbackToLogsOnError for easier debugging #4147
OCPBUGS-24366: Delete state files on reboot only #4124
OCPBUGS-17788: Improved error handling for missing MC #4096
OCPBUGS-27508: daemon: allow the user to override drains on IR changes #4139
MCO-831: added feature gate to mco for on cluster builds #4060
OCPNODE-2005: crio: add support for LinkLogs annotation by default #4116
OCPNODE-1632: Bump k8s api to v0.29.0 #4119
OCPBUGS-27190: Fix mirrorSourcePolicy error prompt imagecontentsourcepolicies #4125
OCPBUGS-25662: Add Image Credential Provider flags for Kubelet on AWS #4103
OCPNODE-2021: add crio-kube-rbac-proxy #4108
OCPBUGS-24831: Updating ose-machine-config-operator-container image to be consistent with ART #4070
OCPBUGS-22664: Mount /run/nodeip-configuration into coredns containers #4058
OCPBUGS-27261: Fix typo in AWS node env unit #4126
NO-ISSUE: Update the design doc dual support icsp and idms #4085
NO-ISSUE: pkg/operator/sync: Set ownerReferences on *-user-data-managed Secrets #4089
OCPBUGS-25725: ManagedBootImages: failed to fetch architecture type of machineset no linked machine found #4088
OCPBUGS-26605: use machine client instead of oc for teardown #4110
OCPBUGS-5452: If node is not in pool, error #4097
OCPBUGS-24416: Sync MCN with node creation and deletion #4062
NO-ISSUE: pkg: Deduplicate api/machineconfiguration/v1 imports #4091
MCO-679: MCO-830: Managed boot images MVP #4083
OCPBUGS-25406: Azure Run ovs-configuration.service before dnsmasq.service #4087
OCPBUGS-19628: Log network service output to console #3927
OCPBUGS-25362: kubelet: fix kubelet labels #4074
OCPBUGS-19427: Add source and mirror format regex validation #4064
docs/MachineOSBuilderDesign: ‘Known Limitations’ links #4086
OCPBUGS-25412: APIServer URL env should exist on all nodes #4076
OCPBUGS-25245: Add \n in cert_writer for old cert methods and skip cloudCA validation #4073
OCPBUGS-24030: add uncordon to mcn #4065
OCPBUGS-23085: MCO duplicates kernel arguments during firstboot #4046
OCPBUGS-25144: Remove MCN lister and informer from MCO struct #4071
OCPBUGS-24743: crio: drop automatic image cleanup on upgrades #4068
OCPNODE-1943: crio: add crun handler to template #4054
Full changelog

machine-image-customization-controller

OCPBUGS-68093: [4.16] uplift logrus #153
METAL-855: drop the default for inspector URL #124
OCPBUGS-28728: Updating ose-image-customization-controller-container image to be consistent with ART for 4.16 #122
OCPBUGS-24579: account for more cases when handling base URLs #120
METAL-834: Add –metrics-addr argument to controller #110
OCPBUGS-25538: Updating ose-image-customization-controller-container image to be consistent with ART #116
METAL-835: Get secret from mounted file when envvar empty #115
OCPBUGS-25099: Updating ose-image-customization-controller-container image to be consistent with ART #114
OCPBUGS-24832: Updating ose-image-customization-controller-container image to be consistent with ART #113
Full changelog

machine-os-images

OCPBUGS-87878: Add support for hermetic builds via Cachi2 prefetched CoreOS ISOs #102
OCPBUGS-54169: Change rhcos release browser url #57
CORS-2797: Image to rhel9 #36
OCPBUGS-24816: Updating ose-machine-os-images-container image to be consistent with ART #34
Full changelog

monitoring-plugin

NO-JIRA: [release-4.16] Sanitize alert runbook URLs #1292
Fix for OCPBUGS-113514: CVE-2026-18446 #1184
Fix for OCPBUGS-94001: CVE-2026-13676 #1049
Fix for OCPBUGS-90069 OCPBUGS-90073: CVE-2026-12151 CVE-2026-9697 #1007
OCPBUGS-79441: immutable bump #898
OU-1260: [release-4.16] feat: use npm instead of yarn #813
OCPBUGS-76807: fix for CVE-2025-69873 #849
OCPBUGS-54316: Fix “Export as CSV” #469
OU-559: fix log based alerts namespace for dev console #320
OCPBUGS-44395: remove unused package and upgrade vulnerable dependency #272
OCPBUGS-43239: upgrade dynamic plugin sdk to remove vulnerable dependencies 4.16 #217
OCPBUGS-42424: fix path-to-regexp dependency #197
NO-JIRA: Use rhel9 base image in Dockerfile #122
OU-416: throw an error when a custom datasource is not found #117
OCPBUGS-12857: Gracefully Handle NaN values in stacked graphs #111
OU-395: Alert detail page renders buttons and links from the plugin extension #114
OCPBUGS-31931: make createdBy mandatory and auto fill with the current user #113
OU-379: Add datasource parameter to handle metrics from custom datasources #112
OU-370: Split Dashboard Label and Line Chart Queries #109
OCPBUGS-31111: Disable nginx module for rhel9 #110
OCPBUGS-31111: Updating monitoring-plugin-container image to be consistent with ART for 4.16 #108
OCPBUGS-31111: Updating monitoring-plugin-container image to be consistent with ART for 4.16 #103
OCPBUGS-29947: upgrade sanitize-html vulnerable dependency #105
OCPBUGS-31291: Upgrade Webpack dev server #104
NO-ISSUE: Add peteryurkovich to OWNERS #102
OU-321: Fix monitoring-alert-list-item extension action to pass alert object #101
NO-ISSUE: Update README.md #100
OU-236: Add CSV export option to dashboards and metrics tables #98
OU-310: Add an extension point for alerts, to be able to add an inspect link #95
OU-309: consider all metric keys to display all results on dashboards tables #96
OCPBUGS-27201: upgrade follow-redirects parent dependency #92
OU-311: Add Dockerfile for local testing #91
OU-308: Revert “fix default nginx path to look for static files” #90
OCPBUGS-25313: On the alert details page, don’t require all alert labels in URL #88
OCPBUGS-24848: Updating monitoring-plugin-container image to be consistent with ART #86
OCPBUGS-24515: remove regex from console page route path so plugin pages are found #84
Full changelog

multus-admission-controller

OCPBUGS-58767: Update the github.com/golang/glog module to v1.2.4 #103
OCPBUGS-36341: Update owners #87
OCPBUGS-32303: Add .snyk file to fix SAST warning messages #84
OCPBUGS-32219: Upstream sync 2024 04 #83
OCPBUGS-24864: Updating ose-multus-admission-controller-container image to be consistent with ART #80
OCPBUGS-24864: Updating ose-multus-admission-controller-container image to be consistent with ART #79
OCPBUGS-24864: Updating ose-multus-admission-controller-container image to be consistent with ART #78
Full changelog

multus-cni

OCPBUGS-85251: Fix server url in kubeconfig #300
NO-ISSUE: [release-4.16] Bump Go to 1.21 and fix CI build root image #292
OCPBUGS-47472: adds getcontext (backport 4.16) #261
OCPBUGS-34910: Thick plugin should not wait for API readiness on CNI DEL #238
OCPBUGS-34924: Update owners file #239
OCPBUGS-33256: Fix CNI cache update function to prevent nil access #230
OCPBUGS-32440: Update snyk file to add exclude vendor #229
OCPBUGS-32393: April 2024 #228
OCPBUGS-30449: Bump google.golang.org/protobuf from 1.31.0 to 1.33.0 #226
USHIFT-2218: Dockerfile for MicroShift #222
OCPBUGS-29856: Upstream sync to 2024 02 22 #221
OCPBUGS-28270: Fix SAST scan issues for multus-cni-container #217
OCPBUGS-27429: Reload bootstrap kubeconfig if cert mgr failed to load valid certs #216
OCPBUGS-29162: Upstream sync to 20240207 #214
OCPBUGS-28270: Remove unused webhook related yamls #213
OCPBUGS-28583: Updating multus-cni-container image to be consistent with ART for 4.16 #212
OCPBUGS-26222: Adds a wait to account for the possiblity of a not ready unix socket #208
OCPBUGS-24863: Updating multus-cni-container image to be consistent with ART #204
OCPBUGS-26397: Revert #205 “Adds a wait on unix socket readiness” #207
OCPBUGS-26222: Adds a wait on unix socket readiness #205
OCPBUGS-24863: Updating multus-cni-container image to be consistent with ART #203
OCPBUGS-24863: Updating multus-cni-container image to be consistent with ART #202
Full changelog

multus-networkpolicy

Update owners (#57) #57
WIP: test for SAST security fix (#53) #53
OCPBUGS-32030: Upstream sync 2404 (#52) #52
Bump google.golang.org/protobuf from 1.30.0 to 1.33.0 (#61) (#50) #61
Updating ose-multus-networkpolicy-container image to be consistent with ART (#47) #47
Updating ose-multus-networkpolicy-container image to be consistent with ART (#46) #46
Updating ose-multus-networkpolicy-container image to be consistent with ART (#45) #45
Full changelog

multus-route-override-cni

OCPBUGS-37726: Update owners #58
OCPBUGS-28557: Updating ose-multus-route-override-cni-container image to be consistent with ART for 4.16 #54
OCPBUGS-24721: Updating ose-multus-route-override-cni-container image to be consistent with ART #53
OCPBUGS-24721: Updating ose-multus-route-override-cni-container image to be consistent with ART #52
OCPBUGS-24721: Updating ose-multus-route-override-cni-container image to be consistent with ART #51
Full changelog

multus-whereabouts-ipam-cni

OCPBUGS-70215: Prevent accidental IP deallocation in statefulsets #396
OCPBUGS-55618: Fixes leftover podref issue #365
OCPBUGS-50005: [Release-4.17]Kubeconfig loop #340
OCPBUGS-37707, OCPBUGS-37708: [release-4.16] align api calls timeout and skip pods marked for deletion #304
OCPBUGS-37723: Update owners #294
OCPBUGS-35923: [release-4.16] Return previous IP allocation for add cmd #293
OCPBUGS-34929: [release-4.16] Use IP to identify orphaned allocation to be deleted #286
OCPBUGS-33565: Upstream sync may24 #278
OCPBUGS-32931: Add .snyk file #254
OCPBUGS-28556: Updating ose-multus-whereabouts-ipam-cni-container image to be consistent with ART for 4.16 #242
OCPBUGS-26986: Downstream sync - includes configurable schedule for reconciler #227
OCPBUGS-26017: Updating ose-multus-whereabouts-ipam-cni-container image to be consistent with ART #223
OCPBUGS-24608: Downstream sync - includes assignment error fix #211
OCPBUGS-24720: Updating ose-multus-whereabouts-ipam-cni-container image to be consistent with ART #213
OCPBUGS-24720: Updating ose-multus-whereabouts-ipam-cni-container image to be consistent with ART #212
Full changelog

must-gather

OCPBUGS-86218: Collect object size with the object count #550
OCPBUGS-66106: Separate resources with comma to fix malformed inspect #515
OCPBUGS-42960: Gather OSUS data #455
OCPBUGS-48082: Update owners #473
OCPBUGS-46407: Support gathering IPsec data #469
OCPBUGS-42969: Collect etcd object count #454
OCPBUGS-43056: Open [Release-4.16] Multus is now a Pod and will be captured by normal #449
OCPBUGS-35357: Run ppc node collection in parallel #426
WRKLDS-1257: Switch must-gather to RHEL9 as base image #421
WRKLDS-1251: Use oc.rhel8 based on the target arch of image #420
NO-JIRA: Use oc rhel8 binary explicitly until base image is rhel9 #418
MON-3754: Enable metrics-server audit log collection #413
OCPBUGS-32210: Collect Assisted Installer Namespace Logs #417
CNF-9168: MetalLB: adjust to support frrk8s and small fix #412
OCPBUGS-31900: Updating ose-must-gather-container image to be consistent with ART for 4.16 #409
SDN-4597: Add cluster scoped ANP resource to collection #411
NO-JIRA: Add ARO support to must-gather client #392
OCPBUGS-30349: Updating ose-must-gather-container image to be consistent with ART for 4.16 #406
WRKLDS-950: use must-gather since and since time env vars on inspect cmds #400
OCPBUGS-25054: Updating ose-must-gather-container image to be consistent with ART #395
And 2 elided commits (e.g. from squash or rebase merges)
Full changelog

network-interface-bond-cni

OCPBUGS-61348: Bump github.com/containernetworking/plugins from to 1.7.1 #95
NO-JIRA: Updating ose-network-interface-bond-cni-container image to be consistent with ART for 4.16 #91
NO-JIRA: Add ci-operator.yaml file on release-4.16 #84
OCPBUGS-28578: Updating ose-network-interface-bond-cni-container image to be consistent with ART for 4.16 #62
OCPBUGS-24835: Updating ose-network-interface-bond-cni-container image to be consistent with ART #60
Full changelog

network-metrics-daemon

OCPBUGS-58777: Bump github.com/golang/glog to v1.2.4 (#113) #113
OCPBUGS-60186: Replace e2e test image (#122) #122
swtich golint install method (#123) #123
Correct 4.16 owners file (#98) #98
Updating ose-network-metrics-daemon-container image to be consistent with ART (#91) #91
Updating ose-network-metrics-daemon-container image to be consistent with ART (#89) #89
Full changelog

network-tools

add missing go vendors #140
OCPBUGS-33388: Updating ose-network-tools-container image to be consistent with ART for 4.16 #125
NO-JIRA: New label for CI flakes #124
NO-JIRA: Fix alphabetical ordering of packages in Dockerfiles #123
OCPBUGS-31699: replace wireshark with wireshark-cli #116
NO-JIRA:Add sdn-team-bot #115
NO-JIRA:Fix bug list formatting in verbose mode and remove metal lb component #114
NO-JIRA: add total and external rows + misc fixes #113
NO-JIRA: Remove SAST,ART,backport bugs from bug count & show them separately #112
NO-JIRA: ovn-db-run-locally: Make DB Type Param Optional #101
OCPBUGS-26490: Updating ose-network-tools-container image to be consistent with ART #108
NO-JIRA: jira-scripts: disable flavio #111
NO-JIRA: Update docs after adding a new command. #110
SDN-4194: Add a script to find OVN perf problems #107
OCPBUGS-25040: Updating ose-network-tools-container image to be consistent with ART #105
Full changelog

nutanix-cloud-controller-manager

OCPBUGS-30524: bump google.golang.org/protobuf to v1.33.0 #38
OCPCLOUD-2418: Merge https://github.com/nutanix-cloud-native/cloud-provider-nutanix:main (b009266) into main #21
OCPBUGS-22623: Bumps otehttp to v0.44.0 #29
OCPBUGS-25629: Add Snyk file to exclude vendor directory on scan #26
Full changelog

nutanix-machine-controllers

OCPBUGS-51854: CVE-2025-22868 #110
OCPBUGS-47266: fixing CVE-2024-45338 #93
AUTH-482: set required-scc for openshift workloads #73
OCPBUGS-27390: IPI install fails on Nutanix when using DHCP #66
OCPBUGS-27874: Update Snyk file to exclude other vendor folders #65
OCPCLOUD-2425: Rebase to k8s 129 #64
OCPBUGS-26184: Add Snyk file to exclude vendor directory on scan #63
OCPBUGS-24949: Updating ose-nutanix-machine-controllers-container image to be consistent with ART #58
Full changelog

oauth-apiserver

OCPBUGS-74112: UPSTREAM: <carry>: bump kubernetes-apiserver to pick up loopback cert expiration update #166
NO-JIRA: (chore): update OWNERS file #172
OCPBUGS-30525: Update dependencies to address CVE-2024-24786 #124
NO-ISSUE: openapiconfig: generate base config using DefaultOpenAPIConfig #111
OCPBUGS-30319: bump lib-go to fix SAs acting as OAuth2 clients #108
NO-ISSUE: oauth-apiserver: allow disabling PriorityAndFairness #106
NO-ISSUE: oauth-apiserver: apply GenericServerRunOptions to the server configuration #105
OCPBUGS-29176: Updating ose-oauth-apiserver-container image to be consistent with ART for 4.16 #101
OCPBUGS-28658: bump k8s.io and others (master) #98
OCPBUGS-24954: Updating ose-oauth-apiserver-container image to be consistent with ART #94
OCPBUGS-27094: UPSTREAM: <carry>: retry etcd Unavailable errors #95
Full changelog

oauth-proxy

OCPBUGS-112100: bugfix: rewrite open redirect strings to ‘/’ #386
OCPBUGS-61446: Update x/crypto to v0.31.0 #335
OCPBUGS-62707: Fix oauth-proxy e2e-component tests #338
OCPBUGS-24791: Updating golang-github-openshift-oauth-proxy-container image to be consistent with ART #270
Full changelog

oauth-server

OCPBUGS-87068: bugfix: default to english when Accept-Language header contains more than 1000 underscores #274
OCPBUGS-35374: p/o/handlers - fix nil-pointer, if ResStatus is nil #152
NO-JIRA: bump go-jose to a newer version #147
OCPBUGS-32331: Updating oauth-server-container image to be consistent with ART for 4.16 #145
OCPBUGS-24987, OCPBUGS-30319: bump lib-go to fix SAs acting as OAuth2 clients #142
Full changelog

oc-mirror

OCPBUGS-129584: v1 accept catalog root entries and relative symlink targets #1581
And 84 elided commits (e.g. from squash or rebase merges)
Full changelog

olm-catalogd

OCPBUGS-103064: [release-4.16] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #149
OCPBUGS-31286: Updating ose-olm-catalogd-container image to be consistent with ART for 4.16 #48
NO-ISSUE: UPSTREAM: <carry>: update owners #47
NO-ISSUE: Synchronize From Upstream Repositories #46
OCPBUGS-29453: UPSTREAM: 231: make garbage collection a runnable #42
NO-ISSUE: Remove ncdc from OWNERS #41
NO-ISSUE: Synchronize From Upstream Repositories #38
OCPBUGS-25172: Updating ose-olm-catalogd-container image to be consistent with ART #37
NO-JIRA: add tmshort to approvers #34
OCPBUGS-24806: Updating ose-olm-catalogd-container image to be consistent with ART #36
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

olm-operator-controller

NO-ISSUE: Synchronize From Upstream Repositories #102
NO-ISSUE: Synchronize From Upstream Repositories #101
NO-ISSUE: Synchronize From Upstream Repositories #99
OCPBUGS-31459: Synchronize From Upstream Repositories #97
OPRUN-3268: Add pointer to tooling README for downstreaming info #94
OCPBUGS-31285: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.16 #89
NO-ISSUE: Synchronize From Upstream Repositories #92
NO-ISSUE: UPSTREAM: <carry>: update owners #91
NO-ISSUE: Synchronize From Upstream Repositories #90
NO-ISSUE: Synchronize From Upstream Repositories #88
OCPBUGS-31285: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.16 #86
NO-ISSUE: Synchronize From Upstream Repositories #87
NO-ISSUE: Synchronize From Upstream Repositories #84
NO-ISSUE: Synchronize From Upstream Repositories #83
NO-ISSUE: Synchronize From Upstream Repositories #82
NO-ISSUE: Synchronize From Upstream Repositories #81
NO-ISSUE: Synchronize From Upstream Repositories #80
NO-ISSUE: Synchronize From Upstream Repositories #79
NO-ISSUE: Synchronize From Upstream Repositories #78
NO-ISSUE: Synchronize From Upstream Repositories #77
NO-ISSUE: Synchronize From Upstream Repositories #76
NO-ISSUE: Synchronize From Upstream Repositories #75
NO-ISSUE: Synchronize From Upstream Repositories #74
NO-ISSUE: Synchronize From Upstream Repositories #73
NO-ISSUE: Synchronize From Upstream Repositories #72
NO-ISSUE: Synchronize From Upstream Repositories #70
NO-ISSUE: Synchronize From Upstream Repositories #67
NO-ISSUE: Synchronize From Upstream Repositories #66
NO-ISSUE: Synchronize From Upstream Repositories #65
NO-ISSUE: Synchronize From Upstream Repositories #64
NO-ISSUE: Synchronize From Upstream Repositories #63
NO-ISSUE: Synchronize From Upstream Repositories #62
NO-ISSUE: Synchronize From Upstream Repositories #61
NO-ISSUE: Synchronize From Upstream Repositories #60
NO-ISSUE: Synchronize From Upstream Repositories #59
OCPBUGS-24795: Updating ose-olm-operator-controller-container image to be consistent with ART #51
NO-ISSUE: Synchronize From Upstream Repositories #56
NO-ISSUE: Synchronize From Upstream Repositories #55
NO-ISSUE: Synchronize From Upstream Repositories #54
NO-ISSUE: Synchronize From Upstream Repositories #53
And 5 elided commits (e.g. from squash or rebase merges)
Full changelog

olm-rukpak

NO-ISSUE: Synchronize From Upstream Repositories #84
NO-ISSUE: Synchronize From Upstream Repositories #83
NO-ISSUE: UPSTREAM: <carry>: update owners #82
OCPBUGS-31278: Updating ose-olm-rukpak-container image to be consistent with ART for 4.16 #81
NO-ISSUE: Synchronize From Upstream Repositories #80
NO-ISSUE: Synchronize From Upstream Repositories #78
NO-ISSUE: UPSTREAM: <carry>: Remove ncdc from OWNERS #74
OCPBUGS-27792, OCPBUGS-27796: Synchronize From Upstream Repositories #69
OCPBUGS-27792, OCPBUGS-27796: UPSTREAM: revert “UPSTREAM: <carry>: Update go-git to v5.11.0” #71
OCPBUGS-27792, OCPBUGS-27796: [Upstream]: <carry>: Update go-git to v5.11.0 #70
OCPBUGS-25535: Updating ose-olm-rukpak-container image to be consistent with ART #68
OCPBUGS-24825: Updating ose-olm-rukpak-container image to be consistent with ART #67
Full changelog

openshift-apiserver

OCPBUGS-82682: Address CVE-2026-35469 #649
OCPBUGS-68104: CVE-2025-65637 - Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.16] #610
OCPBUGS-74113: UPSTREAM: <carry>: bump kubernetes-apiserver to pick up loopback cert expiration update #595
OCPBUGS-63394: Wire dry run option to Image API server operations #566
OCPBUGS-61474: Skip blocked registry check for registries with mirrors #552
OCPBUGS-56612: Fix image reference in TestImageStreamImportQuayIO #516
OCPBUGS-49656: prevent panic when no image and error are set #494
OCPBUGS-49656: validate image property isn’t nil before using #493
OCPBUGS-49656: move on to the next digest/tag during failures #492
OCPBUGS-45010: Pass expected type to deploymentconfig/scale object validation. #461
OCPBUGS-42724: fail image import when both image and error are nil #455
OCPBUGS-33574: Bump library-go #434
OCPBUGS-31666: Bump openshift/api for Route API godoc fix #433
CFE-885: Feature route external certificate validation #407
AUTH-509: remove unauthenticated group from any cluster role binding #423
OCPBUGS-31957: Bump golang/x/net to v0.23.0 #427
OCPBUGS-22301: make GarbageCollection supported for ClusterResourceQuotas as it is backed by a CRD #405
CFE-1048: Bump Kubernetes to 1.29.2 #425
NO-ISSUE: go mod tidy && go mod vendor #420
OCPBUGS-30279: vendor upgrade runtime-utils #419
OCPBUGS-27927: Updating ose-openshift-apiserver-container image to be consistent with ART for 4.16 #415
OCPBUGS-27094: UPSTREAM: <carry>: retry etcd Unavailable errors #410
OCPBUGS-24895: Updating ose-openshift-apiserver-container image to be consistent with ART #409
Full changelog

openshift-controller-manager

OCPBUGS-61707: legacy image pull secret rollback controller #416
OCPBUGS-60233: ignore error failing to find pull/push secrets #409
OCPBUGS-57513: Set node-pullsecrets volume to read-only to protect image pull credentials #394
OCPBUGS-56354: Empty proxy variables are causing issues during the build #382
OCPBUGS-44186: user system:serviceaccount:openshift-infra:serviceaccount-pull-secrets-controller in ns/openshift-infra must not produce too many applies #351
OCPBUGS-48202: Add team members to the OWNERS file #358
NO-JIRA: cleanup root and app OWNERS #347
OCPBUGS-42420: Continuous pull-secret updates / slow initialization on build01 (test platform infrastructure) #343
OCPBUGS-39191: replaces deprecated square/go-jose wtih go-jose/go-jose #329
OCPBUGS-37526: Race condition when deleting ServiceAccount #324
OCPBUGS-36862: 4.16 “Bad” reconciliation loops can cause unbounded dockercfg secret creation #323
OCPBUGS-34825: Whitelists lower-case proxy envs to pod proxydefaults #314
OCPBUGS-33893: openshift-controller-manager overwriting/undoing changes to ServiceAccount imagePullSecrets #309
OCPBUGS-33876: filter delete events #308
OCPBUGS-33600: revert revert and fix for hypershift #305
Revert #288 “API-1644: Use bound service account tokens when generating pull secrets” #304
API-1644: Use bound service account tokens when generating pull secrets #288
OCPBUGS-33241: panic in image trigger controller #302
OCPBUGS-30688: bump go-jose to fix CVE-2024-28176 #297
OCPBUILD-9: Adds roleBinding controllers to the controllerInitializers #296
OCPBUGS-32729: Rollback state of managed image pull secrets after downgrade #300
TRT-1632: Revert #298 “OCPBUGS-32729: Rollback state of managed image pull secrets after downgrade.” #301
OCPBUGS-32729: Rollback state of managed image pull secrets after downgrade. #298
OCPBUGS-31213: Unable to look up the service account secrets for build #292
BUILD-725: Adds build & deployer controller #289
OCPBUGS-23848: Bumps otelgrpc version & dependencies #293
BUILD-854: Add adambkaplan as approver #290
WRKLDS-1016: bump k8s to 1.29.1 #283
OCPBUGS-28665: Replace ‘coreydaley’ with ‘sayan-biswas’ in OWNERS file #284
Full changelog

openshift-state-metrics

OCPBUGS-24878: Updating openshift-state-metrics-container image to be consistent with ART #112
Full changelog

openstack-cinder-csi-driver-operator

OCPBUGS-35730: Add config map hooks #174
OCPBUGS-34882: Correct out-of-bounds check #171
OCPBUGS-28230: enforce termination message policy on all platform pods #166
OCPBUGS-26924: Add healtcheck for node-registrar #161
OCPBUGS-30951: Relax requirement to enable topology #164
STOR-1574: Bump all deps #159
OCPBUGS-28937: Updating ose-openstack-cinder-csi-driver-operator-container image to be consistent with ART for 4.16 #160
STOR-1574: Bump library-go #158
STOR-1714: Release leadership on SIGTERM #155
OCPBUGS-25340: Updating ose-openstack-cinder-csi-driver-operator-container image to be consistent with ART #152
STOR-1688: Chore: add .snyk file to ignore false positives #151
OCPBUGS-24226: setting TLSSecurityProfile with no minTLSVersion crashes controller #150
OCPBUGS-25340: Updating ose-openstack-cinder-csi-driver-operator-container image to be consistent with ART #149
OCPBUGS-24844: Updating ose-openstack-cinder-csi-driver-operator-container image to be consistent with ART #145
OCPBUGS-23306: Add annotation to CSI driver Pod preventing eviction from the cluster-autoscaler #146
Full changelog

openstack-cluster-api-controllers

OCPBUGS-58028: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.10 into release-4.16 #346
OCPBUGS-44456: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.10 into release-4.16 #328
OCPBUGS-44990: Makefile changes for merge-bot #341
OCPBUGS-34931: rebase on release-0.10 (to fix trunks deletion) #321
OCPBUGS-37967: rebase CAPO for 4.16 #319
NO-JIRA: Bump to latest CAPO v0.10 #312
OCPBUGS-33170: openshift: Set FallbackToLogsOnError on infra-cluster controller #311
OSASINFRA-3437: Rebase on CAPO v0.10 #305
OCPBUGS-31277: Updating openstack-cluster-api-controllers-container image to be consistent with ART for 4.16 #301
🐛 Persist API FloatingIP immediately on creation #1831
:bug: Fix patching OpenstackMachine’s immutable spec during reconcile #1819
✨ Add flags for configuring rate limits #1817
:bug: Fix potential panic during instance create #1806
🐛 Revert “Move FloatingIP to Bastion spec” #1783
🌱 Import CAPI v1.6.0 #1780
🌱 Bump version artifacts for release-0.9 #1775
🐛 Verify success of parsing OpenStack cloud cacert #1770
📖 Fix network-related docs for API v1alpha7 #1764
🌱 Remove Containerfile and Dockerfile experimental #1760
🌱 Fix log message typo #1758
🐛 Update e2e testing image of CAPI version from 1.5.0 to 1.5.1 #1754
🐛Fix missing endpoint type in OpenStack endpoint clients configuration #1744
✨remove flavor check to relief restrictions to CPU #1745
⚠️ Move FloatingIP to Bastion spec #1739
⚠️ Bump Go to 1.20.10 #1740
✨ Add ephemeral storage support to the AdditionalBlockDevices #1696
✨ Use kustomize new syntax for patches #1735
✨ Add cache on provider scope #1688
🌱 deps: Bump dependencies #1733
🌱 Enable k8s upgrade in self hosted test #1732
🌱 Use k8s v1.28 in tests #1723
🐛 Don’t remove BYO api server loadbalancer floating IP #1728
🌱 Replace kustomize vars with replacements #1726
🌱 e2e: dump cinder volumes #1722
🌱 Ignore go workspaces #1724
🌱 E2e: Use pre-build node images #1699
✨ Add option to customize private network MTU #1701
:seedling: ci: bump Flatcar tested version #1713
🌱 ci: Several CI fixes #1718
✨ Add server name for the Machine InternalDNS #1715
🌱 Bump devstack image to ubuntu 22.04 #1716
🌱 Add explicit dependency on github.com/golang/mock/mockgen/model #1712
🌱 Allow custom KUBEBUILDER_ASSETS_DIR in tests #1710
🌱 Ignore vendor directories in boilerplate check #1709
🌱 Build setup-envtest in hack/tools #1707
🌱 Bump ginkgo #1705
:sparkles: Additional data volumes for machines #1668
🌱 gitignore: ignore vendor/ directory #1690
🌱 Move webhook CA injection into webhook resource #1686
Update Gophercloud to 1.7.0 #1682
🐛 Only delete all ports when deleting cluster network #1680
:book: Clarify release notes content for releases and pre-releases #1678
🌱 Remove defaulter-gen #1677
:book: doc/development: add devstack notes #1569
🌱 Add test for getOrCreate #1673
Set failure only on instance error when no nodeRef #1637
🌱Fix various issues with CRD generation #1669
✨Allow changing allowAllInClusterTraffic in a deployed cluster #1663
avoid duplicate error event #1655
🌱Bump CAPI to v1.5.1 #1666
And 16 elided commits (e.g. from squash or rebase merges)
Full changelog

openstack-machine-api-provider

OCPBUGS-78170: hermetic 4.16 #163
OCPBUGS-76794: Fix make test #155
OCPBUGS-34931: bump CAPO to v0.9.2 #124
OCPBUGS-34158: Failure to get bootstrap is non-fatal #115
OCPBUGS-34155: Fix panic deleting Machine in ERROR state #114
OCPBUGS-30855: Ensure portSecurity is correctly set in the Port #107
OCPBUGS-24904: Updating ose-machine-api-provider-openstack-container image to be consistent with ART #100
OSASINFRA-3368: Revendor CAPO #103
NO-JIRA: Stop setting logtostderr flag and rely on defaults #102
NO-JIRA: Add snyk configuration file #101
Full changelog

operator-lifecycle-manager, operator-registry

OCPBUGS-103065, OCPBUGS-103070, OCPBUGS-103078: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #1367
OCPBUGS-79980, OCPBUGS-79981, OCPBUGS-87898: Fix CVE-2026-33186 with openshift-sustaining/grpc-go v1.67.3-sec.1 [release-4.16] #1318
OCPBUGS-82057: Drop github.com/distribution/distribution dep #1302
OCPBUGS-77959: Remove the collect-profiles info from the microshift kustomization file #1251
OCPBUGS-77169: Remove the collect-profiles job #1235
OCPBUGS-58881: operatorgroup: ensure clusterroleselectors in clusterrole aggregation rules are sorted #1102
OCPBUGS-59647: Reduce Frequency of Update Requests for Copied CSVs (#3597) #1042
OCPBUGS-60847: Add NetworkPolicy as a supported kind #1050
OCPBUGS-61388: [4.16] e2e stability fixes #1083
OCPBUGS-57429: reduce cache expiry frequency [release-4.19] #1022
OCPBUGS-56358: fix(olm): improve error logging for missing olm.managed label (#3558) #1006
OCPBUGS-53395: Ensure that PSA label is latest instead of pinning versions #987
OCPBUGS-48696: Fix excessive catalog source snapshots cause severe performance regression #957
OCPBUGS-48661: Fix concurrent namespace resolution #947
OCPBUGS-46928, OCPBUGS-46935, OCPBUGS-47315: x/net bump to v0.34.0 [release-4.16] #939
OCPBUGS-47738: catalog-operator: Delete Pods that were evicted (#3459) #925
OCPBUGS-46434: CRD upgrade existing CR validation fix #916
OCPBUGS-44802: fix: call TokenRequest API when service account token secret is missing #900
OCPBUGS-41540: [4.16] add optional schema migrations; default to olm.bundle.object instead of olm.csv.metadata (#1384) #859
OCPBUGS-41677: [4.17] adds paginating lister for evaluating CRs’ upgrade fitness versus new CRDs. #863
OCPBUGS-41557: Fix e2e flake: upgrade CRD with deprecated version #861
OCPBUGS-41217: (fix) registry pods do not come up again after node failure (#3366) #854
OCPBUGS-38290: release-4.16 Resolver: list CatSrc using client, instead of referring to registry-server cache #838
OCPBUGS-38129: [release-4.16] Update junit report file name to show spec results on Test Grid #833
OCPBUGS-37456: Updating ose-operator-framework-tools-container image to be consistent with ART for 4.16 #826
OCPBUGS-37559: [release-4.16] Update e2e config and backport list of flakes #814
OCPBUGS-37018: Bump github.com/containers/image/v5 #822
OCPBUGS-36450: Can’t install operator on 4.15 after uninstalling it on a prior version #809
OCPBUGS-25019: fix xplat compile for of-tools image; hide utest files from git; use rhel8 art builder image #793
OCPBUGS-36137: fix sorting unpack jobs #799
OCPBUGS-34979: Updates default security context behavior for catalog source pods #788
OCPBUGS-36138: perform operator apiService certificate validity checks directly #798
OCPBUGS-35373: [release-4.16] Warn and allow CRD upgrade if validation fails but webhook is specified #781
OCPBUGS-35219: Unblock CI #767
NO-ISSUE: Synchronize From Upstream Repositories #741
NO-ISSUE: Synchronize From Upstream Repositories #739
AUTH-482: set required-scc for openshift workloads #703
OCPBUGS-31073: Synchronize From Upstream Repositories #737
NO-ISSUE: Synchronize From Upstream Repositories #735
OCPBUGS-28230: enforce termination message policy on all platform pods #733
NO-ISSUE: Synchronize From Upstream Repositories #734
NO-ISSUE: Synchronize From Upstream Repositories #732
NO-ISSUE: Synchronize From Upstream Repositories #729
NO-ISSUE: Synchronize From Upstream Repositories #727
NO-ISSUE: Synchronize From Upstream Repositories #723
NO-ISSUE: Synchronize From Upstream Repositories #722
OCPBUGS-31080, OCPBUGS-31438: Manual downstream sync #719
NO-ISSUE: UPSTREAM: <carry>: update owners #720
OPRUN-3221: rename from ‘clis’ to ‘tools’ #718
OCPBUGS-29553: Apply hypershift cluster-profile for ibm-cloud-managed #700
NO-ISSUE: Synchronize From Upstream Repositories #717
NO-ISSUE: Synchronize From Upstream Repositories #716
OPRUN-3221: image just as a cli source for mirror publishing #713
NO-ISSUE: Semver lastedge error (#1169) [sync] #714
OCPBUGS-25019: building rhel8/rhel9/static clis in payload image #704
OCPBUGS-30132: Synchronize From Upstream Repositories #709
OCPBUGS-23744: Wait for required RBAC before creating packageserver CSV #708
NO-ISSUE: Synchronize From Upstream Repositories #706
NO-ISSUE: Synchronize From Upstream Repositories #702
NO-ISSUE: Synchronize From Upstream Repositories #701
NO-ISSUE: Synchronize From Upstream Repositories #695
OCPBUGS-29553: Apply hypershift cluster-profile for ibm-cloud-managed #697
NO-ISSUE: Synchronize From Upstream Repositories #693
NO-ISSUE: Synchronize From Upstream Repositories #687
NO-ISSUE: Remove ncdc from OWNERS #68 #681
OCPBUGS-24587, OCPBUGS-28744: Synchronize From Upstream Repositories #679
NO-ISSUE: Synchronize From Upstream Repositories #678
NO-ISSUE: Synchronize From Upstream Repositories #676
NO-ISSUE: Synchronize From Upstream Repositories #667
OCPBUGS-27140: Updating operator-lifecycle-manager-container image to be consistent with ART for 4.16 #658
OCPBUGS-25989: Synchronize From Upstream Repositories #663
NO-ISSUE: Synchronize From Upstream Repositories #659
OCPBUGS-25262: Updating operator-registry-container image to be consistent with ART for 4.16 #657
OCPBUGS-24526, OPRUN-3182: Sync with upstream #654
OCPBUGS-24994: Updating operator-lifecycle-manager-container image to be consistent with ART #631
NO-ISSUE: Synchronize From Upstream Repositories #650
NO-ISSUE: Synchronize From Upstream Repositories #646
OCPBUGS-25673: NO-ISSUE: Synchronize From Upstream Repositories #641
NO-ISSUE: Synchronize From Upstream Repositories #627
NO-ISSUE: Update verified directories for microshift-manifests #638
OCPBUGS-25339: [CARRY] Fix panic issue when annotations map is nil #634
OCPBUGS-24942: Updating operator-registry-container image to be consistent with ART #630
Full changelog

operator-marketplace

OCPBUGS-68108, OCPBUGS-68109: CVE-2025-65637 fixed in logrus v1.9.3+ #722
OCPBUGS-62220: Remove Expect func so that the test case can use the retry logic #671
OCPBUGS-61920: Update memoryTarget on catalog source pods #664
OCPBUGS-49429: Upgrade golang.org/x/net [release-4.16] #587
OCPBUGS-24971: bump golang to 1.21 #560
AUTH-482: set required-scc for openshift workloads #561
OCPBUGS-28230: enforce termination message policy on all platform pods #559
OCPBUGS-29575: Apply hypershift cluster-profile for ibm-cloud-managed #556
OPECO-3031: Update community index to 4.16 #558
synching dco policy across v0 repos #557
OPECO-3029: Update image tag to 4.16 for all indexes except community-operators #555
Delete deploy dir #529
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-128828: node: fix serviceUpdateNotNeeded nil pointer comparison #3497
OCPBUGS-83497: External gateway: Remove routes for external gateway pods in terminating or not ready state #3140
OCPBUGS-78033: Add pperiyasamy to OWNERS for release-4.16 #3047
OCPBUGS-77685: Clear stale conntrack UDP entries for nodePorts #3038
OCPBUGS-77187: Fix conntrack reconciliation to use service port instead of endpoint port #2998
CORENET-6055, OCPBUGS-76277: [release-4.16] Dockerfile: Unpin OVN and consume the latest from FDP #2972
OCPBUGS-71219: [release-4.16] CVE-2025-65637 Bump github.com/sirupsen/logrus to v1.9.1 through indirect dependency conversion (go-controller module) #2906
OCPBUGS-72541: NetPol & MultiNetPol: Process update only when spec fields and/or related annotation are updated #2933
OCPBUGS-68349: Add ricky-rav to OWNERS for release-4.16 #2899
OCPBUGS-66155: Skip Pending pods in EgressIP status updates #2880
OCPBUGS-64944: [release-4.16]: Configure sec nic EIPv6 address with NODAD and maximum lifetime #2853
OCPBUGS-64858: Fix stale EIP assignments during failover and controller restart #2851
OCPBUGS-63155: Fix EgressIP stale GARP post reboot + pod restart #2809
OCPBUGS-63230: Fix dnsnameresolver address set #2812
OCPBUGS-60079: Always enable global IPv6 forwarding #2743
OCPBUGS-60494: Update OWNERS file: Add Patryk/Martin as approvers #2718
OCPBUGS-58161: Unpin OVS patch versions #2648
OCPBUGS-57396: Fix predicate for cluster subnet route to gateway router #2645
OCPBUGS-55282: Fix hybrid overlay node subnets collision with cluster subnets #2621
OCPBUGS-48121: Increase InformerSyncTimeout to 60s #2624
OCPBUGS-56242: Handles unspecified protocol in network policy port #2571
OCPBUGS-56812: egressfirewall: avoid nil dereference on node delete #2591
OCPBUGS-52503: Fixes unexpected mp0 route removal during start up #2479
OCPBUGS-54204: Update OVN to FDP25.A.1 24.03.5-40. #2497
OCPBUGS-50595: kubevirt, localnet: Reduce live migration downtime #2469
OCPBUGS-50594: fixes overzealous deletion of SNAT in egressIP #2456
OCPBUGS-47634: Let OVN-northd bind remote ports #2406
OCPBUGS-45958: bump OVS to 3.3.0-62.el9fdp for OCP 4.16 #2388
OCPBUGS-44457: Add static route to the hairpin masquerade IPs to pod #2346
OCPBUGS-45942: pin libreswan to 4.6-3.el9_0.3 #2386
OCPBUGS-45343: Dockerfile: Update OVN to the 24.03.2-32.el9fdp minor release. #2377
OCPBUGS-42244: Add hybird overlay pod IPs to the namespace address_set #2352
OCPBUGS-43344: Add SDN node subnet gateway IP to host-network address_set #2328
OCPBUGS-42942: Fix egress gateway pod cleanup for remote zone pods. #2341
OCPBUGS-36210: Implementation required to enable Forwarding if it is already disabled #2212
OCPBUGS-41551: Add subnet overlap check for transit switch subnet #2306
OCPBUGS-38697: Use more exact name match when deleting static routes to HO nodes. #2282
OCPBUGS-24386: [release-4.16] EgressService: Fix ETP=Local ingress reply for LGW #2278
OCPBUGS-38705: Delete EgressIP LRP stale nexthops when node is not found #2271
OCPBUGS-38054: Fix per-pod MCS/metadata blocking #2248
OCPBUGS-38699, OCPBUGS-38704: EgressIP VRF support & ignore localnet patch ports when bootstrapping #2267
OCPBUGS-37939: [release-4.16] Bump OVSDBTimeout and make it configurable. #2244
OCPBUGS-37362: Fix registering northd metrics on appropriate nodes #2232
OCPBUGS-36608: [release-4.16] ovspinning: Set affinity of each thread #2220
OCPBUGS-36486: Fix race condition when creating/deleting namespace address set #2218
OCPBUGS-35061: Allow ANPs at same priority #2205
OCPBUGS-35835: [release-4.16] bump OVN to ovn24.03-24.03.2-19.el9fdp #2209
OCPBUGS-34402: [release-4.16] dns: fix deadlock in case of error #2181
OKD-40: Add ovnver_okd and ovsver_okd to Dockerfile.base #2174
SDN-4157, SDN-4436: Downstream Merge 16th May 2024 #2171
OCPBUGS-30224, OCPBUGS-33328, SDN-4388: [DownstreamMerge] 10 may 2024 #2162
OCPBUGS-33080: Downstream Merge May 2nd 2024 #2152
OCPBUGS-32925, OCPBUGS-32985: Dockerfile: Bump OVS to 3.3.0-2 #2142
OCPBUGS-32985, SDN-4436: Dockerfile.base: Bump OVN to ovn24.03-24.03.1-36.el9fdp #2126
OCPBUGS-31419, OCPBUGS-32461, SDN-4243: Downstream Merge 22nd April 2024 #2136
SDN-4458: Do per-pod MCS/metadata blocking with nftables rather than iptables #1946
SDN-4606, SDN-4688: Downstream Merge April 18th 2024 #2132
OCPBUGS-31419: [DownstreamMerge] 4-16-24 #2129
SDN-4403: Downstream merge 20240415 #2124
OCPBUGS-25889, OCPBUGS-29952, SDN-3931: Downstream merge 12 04 24 #2120
OCPBUGS-27093, OCPBUGS-29511, SDN-4157: [DownstreamMerge] 4 April 2024 #2110
SDN-4157: DownstreamMerge 25th march 2024 #2100
OCPBUGS-31557: Revert “Remove unnecessary rhel8 build layer” #2104
OCPBUGS-24007: Remove unnecessary rhel8 build layer #2083
OCPBUGS-27821: [DownstreamMerge] 3-8-24 #2093
OCPBUGS-29350, OCPBUGS-29389, SDN-4542: Downstream Merge 29th Feb 2024 #2089
OCPBUGS-17207, OCPBUGS-28742: Downstream Merge 22nd Feb 2024 #2081
OCPBUGS-12876, OCPBUGS-13665, OCPBUGS-23519, OCPBUGS-28724: Downstream Merge 15th Feb 2024 #2073
OCPBUGS-27093: Dockerfile: Bump OVN to ovn-23.09.0-112.el9fdp #2066
OCPBUGS-27853: [DownstreamMerge] 9 Feb 2024 #2063
OCPBUGS-20336, OCPBUGS-28558: [DownstreamMerge] 7 Feb 2024 #2057
USHIFT-2256: updating ovn kubernetes microshift image to golang-1.21 #2051
OCPBUGS-20209, OCPBUGS-20220, OCPBUGS-22923, OCPBUGS-24271, OCPBUGS-26979, OCPBUGS-27215: Downstream Merge 2nd Feb 2024 #2048
OCPBUGS-22221, OCPBUGS-24219, OCPBUGS-25670: Downstream Merge 31st Jan 2024 #2038
OCPBUGS-27933: Updating ose-ovn-kubernetes-container image to be consistent with ART for 4.16 #2027
OCPBUGS-23430, OCPBUGS-24363, OCPBUGS-26023, OCPBUGS-27211: [DownstreamMerge] Merge 1-16-24 #2018
OCPBUGS-27285: Dockerfile: Bump OVS to openvswitch3.1-3.1.0-73.el9fdp #1995
OCPBUGS-25030: Updating ovn-kubernetes-microshift-container image to be consistent with ART #1979
OCPBUGS-18716: [DownstreamMerge] 1-5-24 #2010
OCPBUGS-24965: Updating ose-ovn-kubernetes-base-container image to be consistent with ART #1978
OCPBUGS-25810: CARRY: Updates owners and adds Surya #2000
OCPBUGS-25032: Updating ose-ovn-kubernetes-container image to be consistent with ART #1980
OCPBUGS-24055, OCPBUGS-25394, SDN-4194: [DownstreamMerge] 14 Dec 2023 #1990
OCPBUGS-24322, OCPBUGS-25357: Dockerfile: Bump OVN to ovn-23.09.0-91.el9fdp #1986
Full changelog

powervs-block-csi-driver

OCPBUGS-105268: Mitigate CVE-2025-30204 by bumping github.com/golang-jwt/jwt/v4 to v4.5.2 #139
OCPBUGS-36097: Fix CVE-2024-6104 by updating http-retryable to 0.7.7 #88
MULTIARCH-4631: Rebase with upstream: go modules updates #78
MULTIARCH-4581: Rebase with upstream: go modules updates #77
OCPBUGS-30530: fix govul with protobuf #76
MULTIARCH-4363: Rebase with upstream: go modules updates #75
MULTIARCH-4092: Rebase with upstream: v0.6.0 release #74
OCPBUGS-25513: CVE-2023-48795 Update crypto lib #73
MULTIARCH-4059: Rebase with upstream: Fix snyk code issue: Path Traversal #69
MULTIARCH-4058: Rebase with upstream: go modules updates #67
OCPBUGS-24950: Updating ose-powervs-block-csi-driver-container image to be consistent with ART #68
Full changelog

powervs-block-csi-driver-operator

OCPBUGS-28230: enforce termination message policy on all platform pods #70
OCPBUGS-28738: Fix 4.16 SAST scan issues for ose-powervs-block-csi-driver-operator-container #68
OCPBUGS-26924: Add node-registrar healtcheck #67
STOR-1574: Bump all deps #65
OCPBUGS-28933: Updating ose-powervs-block-csi-driver-operator-container image to be consistent with ART for 4.16 #66
STOR-1574: Bump library-go #64
STOR-1714: Release leadership on SIGTERM #63
OCPBUGS-24819: Updating ose-powervs-block-csi-driver-operator-container image to be consistent with ART #57
OCPBUGS-25710: snyk: ignore vendor dir #50
OCPBUGS-24819: Updating ose-powervs-block-csi-driver-operator-container image to be consistent with ART #55
OCPBUGS-23306: Add annotation to CSI driver Pod preventing eviction from the cluster-autoscaler #54
OCPBUGS-24819: Updating ose-powervs-block-csi-driver-operator-container image to be consistent with ART #53
Full changelog

powervs-cloud-controller-manager

OCPBUGS-36107: UPSTREAM: <carry>: Fix go-retryablehttp CVE 4.16 #73
MULTIARCH-4610: UPSTREAM: <carry>: Override service endpoints #65
OCPBUGS-30531: fix govul with protobuf #64
OCPBUGS-25013: Updating ose-powervs-cloud-controller-manager-container image to be consistent with ART #62
Full changelog

powervs-machine-controllers

OCPBUGS-61511: Use OS_GIT_VERSION in Makefile when found (for Konflux builds) #127
OCPBUGS-54752: Fix for CVE-2024-51744 in github.com/golang-jwt/jwt/v4 in release-4.16 #114
OCPBUGS-41976: Update go.mod to fix CVE - 4.16 #84
OCPBUGS-27881: Update Snyk file to exclude other vendor folders #74
MULTIARCH-4104: Update go and k8s versions #73
MULTIARCH-4066: PowerVS: Bump powervs-utils to v0.0.0-20240105123432-7588e9595c17 #71
OCPBUGS-25555: Updating ose-powervs-machine-controllers-container image to be consistent with ART #70
OCPBUGS-25047: Updating ose-powervs-machine-controllers-container image to be consistent with ART #68
OCPBUGS-24894: Updating ose-powervs-machine-controllers-container image to be consistent with ART #67
Full changelog

prom-label-proxy

NO-ISSUE: synchronize OWNERS from main branch [release-4.16] #404
OCPBUGS-29980: Updating prom-label-proxy-container image to be consistent with ART for 4.16 #365
MON-3725: add machine424 and rexagod to OWNERS #358
MON-3698: Update to upstream prom-label-proxy 0.8.1 #363
MON-3649: Bump openshift/prom-label-proxy to v0.8.0 #362
OCPBUGS-24742: Updating prom-label-proxy-container image to be consistent with ART #361
OCPBUGS-24742: Updating prom-label-proxy-container image to be consistent with ART #360
OCPBUGS-24742: Updating prom-label-proxy-container image to be consistent with ART #359
Full changelog

prometheus

OCPBUGS-93677: fix for CVE-2026-42151 #395
NO-ISSUE: synchronize OWNERS from main branch #387
OCPBUGS-88616: remote: validate snappy decoded length before allocation in read endpoint #349
OCPBUGS-79985: Bump google.golang.org/grpc #321
OCPBUGS-61856: chore: compute highestTimestamp at queryManager level #270
OCPBUGS-56739: BACKPORT: fix promtool analyze block shows metric name with 0 cardinality #255
OCPBUGS-54942: Scraping: Bump cache iteration after error to avoid false duplicate detection. #250
OCPBUGS-43668: fix(discovery): Handle cache.DeletedFinalStateUnknown in node informers’ DeleteFunc #231
OCPBUGS-39179: Restore Prometheus functionality to accept samples with different timestamps from the same series in a single scrape. #224
OCPBUGS-36918: cherry-pick upstream fix to make PrometheusRemoteWriteBehind fire when remote endpoint is never reached. #214
OCPBUGS-37446: backport of upstream fix #217
OCPBUGS-36854: cherry-pick upstream remote-write fix #212
MON-3856: Bump openshift/prometheus to v2.52.0 #202
MON-3856: Bump openshift/prometheus to v2.52.0 #201
MON-3825: Bump openshift/prometheus to v2.51.2 #200
MON-3825: Bump openshift/prometheus to v2.51.2 #199
MON-3794: Bump openshift/prometheus to v2.51.1 #198
MON-3794: Bump openshift/prometheus to v2.50.1 #196
OCPBUGS-29981: Updating golang-github-prometheus-prometheus-container image to be consistent with ART for 4.16 #197
MON-3673: [bot] Bump openshift/prometheus to v2.49.1 #193
MON-3676: move raptorsun out of reviewer list #194
MON-3673: Bump Prometheus to v2.49.1 #192
MON-3633: Bump openshift/prometheus to v2.48.1 #188
OCPBUGS-24745: Updating golang-github-prometheus-prometheus-container image to be consistent with ART #187
Full changelog

prometheus-alertmanager

NO-JIRA: synchronize OWNERS with main #188
OCPBUGS-103072: Use github.com/openshift-sustaining/net patch to fix CVE-2026-33814 #174
OCPBUGS-100357: Set testdata CA expiry to 20 years from issue date (#4112) #146
OCPBUGS-76536: Include go-verify-deps expected files in gitignore #116
OCPBUGS-33686: Dockerfile.ocp: use common-build target #91
OCPBUGS-29969: Updating golang-github-prometheus-alertmanager-container image to be consistent with ART for 4.16 #88
OCPBUGS-24718: Updating golang-github-prometheus-alertmanager-container image to be consistent with ART #86
OCPBUGS-24718: Updating golang-github-prometheus-alertmanager-container image to be consistent with ART #85
Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

OCPBUGS-103085, OCPBUGS-103089: [release-4.16] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #401
OCPBUGS-38399: feat: sync proxy settings in Alertmanager configuration #299
MON-3838: Bump openshift/prometheus-operator to v0.73.2 #286
OCPBUGS-31847: Bump openshift/prometheus-operator to v0.73.1 #285
MON-3793: Bump openshift/prometheus-operator to v0.73.0 #284
MON-3771: Bump openshift/prometheus-operator to v0.72.0 #281
OCPBUGS-29304: fix: don’t fail metadata transform on unknown types (#6298) #277
OCPBUGS-28251: fix: convert continue field between v1beta1 and v1alpha1 #275
MON-3689: Bump openshift/prometheus-operator to v0.71.2 #274
MON-3689: Bump openshift/prometheus-operator to v0.71.1 #273
MON-3676: move raptorsun out of reviewer list #272
MON-3661: Bump openshift/prometheus-operator to v0.71.0 #271
OCPBUGS-26147: configure Snyk scanner #269
OCPBUGS-25560: Updating prometheus-config-reloader-container image to be consistent with ART #270
OCPBUGS-24947: Updating prometheus-operator-admission-webhook-container image to be consistent with ART #266
OCPBUGS-24914: Updating prometheus-config-reloader-container image to be consistent with ART #268
OCPBUGS-24914: Updating prometheus-config-reloader-container image to be consistent with ART #265
OCPBUGS-24872: Updating prometheus-operator-container image to be consistent with ART #264
Full changelog

prometheus-node-exporter

OCPBUGS-103088: Use patched x/net fork v0.35.0-sec.4 #194
NO-ISSUE: synchronize OWNERS from main branch [release-4.16] #203
MON-3847: Bump openshift/node_exporter to v1.8.0 #145
OCPBUGS-20151: [CHERRY PICK FROM UPSTREAM]: Take optional attributes into account for fibre_channel metrics #144
OCPBUGS-29976: golang-github-prometheus-node_exporter-container image… #142
OCPBUGS-24722: Updating golang-github-prometheus-node_exporter-container image to be consistent with ART #140
Full changelog

route-controller-manager

OCPBUGS-79934: Bump google.golang.org/grpc to v1.79.3 #87
OCPBUGS-56152: Added error event for failed ingress to route conversion #61
OCPBUGS-55201: ingress: Reset metrics when ingress is deleted #58
OCPBUGS-30048: Fix OWNERS file to reflect the correct team #41
WRKLDS-1016: bump k8s to 1.29.1 #38
OCPBUGS-26088: Add .snyk file to exclude vendor and ignore unit tests #37
OCPBUGS-24839: Updating ose-route-controller-manager-container image to be consistent with ART #36
Full changelog

service-ca-operator

OCPBUGS-24916: Bump to rhel9 #240
OCPBUGS-29583: Apply hypershift cluster-profile for ibm-cloud-managed #234
AUTH-482: set required-scc for openshift workloads #235
OCPBUGS-28230: add FallbackToLogsOnError for easier debugging #230
Full changelog

telemeter

OCPBUGS-31552: fix issuer check during JWT authentication 4.16 #537
RHOBS-1036: Harden integration tests #529
MON-3819: Update tools go 1.21 #526
MON-3737: Update binaries to new version #525
OCPBUGS-30724: CVE-2024-28180 bump go-jose to v3.0.3 #524
OCPBUGS-30832: bump Go 1.21 #521
OCPBUGS-30544: CVE-2024-24786 Bump google.golang.org/protobuf to v1.33.0 #516
MON-3175: README.md: update deprecated link #512
MON-3715: remove obsolete targets from Makefile #513
OCPBUGS-24983: Updating telemeter-container image to be consistent with ART #497
OCPBUGS-24983: Force kill jobs after integration v2 test finish #514
MON-3715: chore: bump dependencies #511
RHOBS-995: Simplify cluster:capacity_effective_cpu_cores, add tests #506
MON-3708: fix test/integration.sh #509
MON-3669: fix join issue in cluster:capacity_effective_cpu_cores #505
OCPBUGS-16397: update nutanix filter #504
MON-3669: Removing newlines from the jsonnet configuration for the recording rules.libsonnet #503
MON-3669: Add rule for effective CPU cores for subscription usage purposes #501
Full changelog

tests

OCPBUGS-130858: stage the creation of test pods to minimize etcd impact #31742
OCPBUGS-105460: Use tagged version for openshift/kubernetes dependency #31541
OCPBUGS-74299: Update to latest openshift/kubernetes #30825
OCPBUGS-63395: Backport pr 29834 to release-4.18 #30409
OCPBUGS-62934: Fix bearer token exposure in exit condition as well #30365
OCPBUGS-61170: images/tests: Remove rteval #30203
NO-JIRA: Update extended/networking OWNERS #30091
OCPBUGS-60272: Bump kubernetes version to fix NFS ganesha version #30086
OCPBUGS-57311: Replace RunHostCmd with Exec function to censor bearer token being exposed #29908
OCPBUGS-57203: fix: remove un-needed test #29849
OCPBUGS-34163: Fix regex parser for censoring private key #29805
OCPBUGS-56704: aws/edge: prevent test using unschedulable nodes #29847
OCPBUGS-55476: support provider type external #29738
OCPBUGS-55636: [build] Ensure Git Clone Does Not Run Privileged #29746
OCPBUGS-54768: Fix egress firewall tests by updating the URL from docs.openshift.com to redhat.com #29663
OCPBUGS-52581: Use payload pullspec for image info test #29589
OCPBUGS-52343: Try also user CA for getting openshift-tests image #29578
OCPBUGS-44119: Ignore infra nodes on tap cni tests #29261
OCPBUGS-48448: Add team members to the OWNERS file for PR approvals #29443
OCPBUGS-48348: Fixing build s2i ruby test data inline with latest ruby version(>=3.0) #29431
OCPBUGS-44105: Adjust createDNSPod() to support hypershift dual-stack test #29258
OCPBUGS-39135: Bump timeout for the pod-network-service endpoints check #29052
OCPBUGS-41611: Disable:Broken for [sig-builds][Feature:Builds][Slow] can use private repositories as build input build using an HTTP token should be able to clone source code via an HTTP token [apigroup:build.openshift.io] #29079
OCPBUGS-38707: run vsphere driver config test on non techpreview clusters #28992
OCPBUGS-38788: [4.16] egressfirewall: skip ping tests in case of hypershift kubevirt on Azure infra #28938
OCPBUGS-38015: vertical scaling test should not rely on CPMS replicas #28981
OCPBUGS-37771: fix pod not returning success on ‘Managed cluster should verify that nodes have no unexpected reboots #28959
OCPBUGS-36744: Expand allowance for kubelet metrics api endpoint outages during node upgrades #28928
OCPBUGS-36182: Removes dependency on samples operator images #28904
OCPBUGS-36241: remove unused in-cluster monitoring code #28909
OCPBUGS-35842: add Proxy config #28894
TRT-1721: Add new intervals for kubelet metrics endpoints down #28901
TRT-1720: Filter must-gather and truncate system node users #28883
ETCD-578: remove Tech Preview check from etcd profiles e2e test #28819
OCPBUGS-35755: Fix etcd profiles e2e test to check returned status for updated values #28885
bump 4.16 to latest o/k 4.16 release branch #28888
OCPBUGS-34736: Add a “limit” exception for iptables-alerter #28859
OCPBUGS-34500: add manual etcd signer cert rotation e2e test #28830
OCPBUGS-33710: Bump k8s API to 1.29.5 #28831
NO-JIRA: quota.sh: 4.16 no longer creates legacy API tokens #28810
STOR-1838: add test for vsphere driver snapshot configuration #28717
OCPEDGE-1101: skip etcd test for hardware speed on sno #28800
SPLAT-1439: Ignore edge workers when listing nodes #28584
NO-ISSUE: Automated - Update synthetic test data #28795
NO-JIRA: oc template - set NS PSP level=privileged (hostPorts) #28803
USHIFT-3143: Skip metrics and adjust termination message policy monitor tests #28799
OCPBUGS-18534: Pass namespace in function checkHostnameReady for monitortest #28794
ETCD-488: Fix feature gate for etcd profiles e2e test #28782
OCPBUGS-31919: Use proper pull-secret for getting openshift-tests image #28764
OCPBUGS-33378: Verify Build Webhooks on Upgrade #28783
SDN-4168: Increase IPsec timeout parameters #28779
USHIFT-3142: Automatically exclude FeatureGate tagged tests #28786
USHIFT-3133: Skip cloud provider disruption monitors for MicroShift #28767
NO-JIRA: enforce termination policy #28777
TRT-1656: Revert #28750 “OCPBUGS-33041: Add RoleBinding for BuildConfig Webhooks” #28781
SDN-4783: Add e2e tests for NetworkDiagnosticsConfig featuregate #28719
API-1783: Update etcd test data for 1.30 release #28770
NO-JIRA: verify tls artifacts #28772
API-1809: Provide SCC access via RBAC #28771
OCPEDGE-812: feat: add tests for cpu limits on workload partitioning #28752
OCPBUGS-18534: monitor test fix to wait before connecting to a non-existent dns on PowerVS and IBMCloud platforms #28739
MON-3513: Add availability test for Metrics API #28737
SDN-4168: Add IPsec e2e tests #28658
OCPBUGS-33041: Add RoleBinding for BuildConfig Webhooks #28750
OCPBUGS-33317: use tokenrequest api #28769
OCPBUGS-31868: allow for some errors checking namespace delete #28761
OCPBUGS-26498: Add test for UpgradeValidation contention #28710
OCPBUGS-29373: test/extended/router/http2: Use unique certs #28757
OCPBUGS-33125: Allow flexible rhel in tests #28755
OCPBUGS-26440: feat: add buffer interval for SNO pathological events #28709
NO-JIRA: Adjust the method of get the apiServer #28756
NO-ISSUE: Automated - Update synthetic test data #28744
TRT-1610: Intervals, move over to new schema, finally… #28727
Revert “TRT-1625: Revert #28741 “OCPBUGS-32923: Fix allowed firing alerts not triggering”” #28748
NO-JIRA: bump library-go #28711
NO-JIRA: Use bound prometheus-k8s API tokens #28655
TRT-1625: Revert #28741 “OCPBUGS-32923: Fix allowed firing alerts not triggering” #28747
OCPBUGS-32923: Fix allowed firing alerts not triggering #28741
TRT-1618: Allow Upgradeable:False with OpenShiftSDN #28738
ETCD-588: Add e2e test for hardware speed profiles feature #28726
OCPBUGS-32477: Also rely on oomkilled exit code 137 in build test #28725
OCPBUGS-32293: Use In-Tree Template for Jenkins #28732
OCPBUGS-31589: e2e: use bound API token for prometheus-k8s SA #28679
AUTH-509: Remove system:anonymous test cases #28686
NO-JIRA: Drop unused images and OWNERS files #28736
OCPBUGS-20097: Migrate tools image to RHEL9 #28733
NO-JIRA: bump openshift/kubernetes #28712
NO-JIRA: Create autodl file for per user resource request audit entries #28715
OCPBUGS-28230: enforce termination message policy on all platform pods #28728
NO-JIRA: Record Kube event first/last timestamp in the resulting intervals #28722
OCPBUGS-32484: chart template: limit tooltip width to first word #27965
OCPBUGS-31030, OCPBUGS-31032: Reduce deploymentconfig test 3GBi memory size to reasonable #28680
NO-ISSUE: Automated - Update synthetic test data #28723
OCPBUGS-32485: upkeep: update test pinned workloads #28704
OCPBUGS-20097: Switch to use cli image, as the scratch image #28695
TRT-1545: Complete removal of non-structured locator/message use #28663
OCPBUGS-32320: revert: removing static pod skip for crio check #28708
Revert “OCPBUGS-28230: enforce termination message policy on all platform pods” #28721
OCPBUGS-31860: ppc64le without python-cinder #28692
OCPBUGS-28230: enforce termination message policy on all platform pods #28547
NO-JIRA: Unskip volume populator tests that were disabled in the test suite #28475
USHIFT-2985: Fix MicroShift crash and router tests skipping #28716
NO-JIRA: Remove test dir OWNERS file, rely on top-level instead #28714
NO-JIRA: split the per-user summary to include verbs for resources #28705
NO-JIRA: add to the operator list #28703
NO-ISSUE: Automated - Update synthetic test data #28701
NO-JIRA: need to make manifest dir to place content #28700
NO-JIRA: Record tests by feature #28694
OCPBUGS-31868: Add debug logging for SLB monitortest cleanup #28697
SO-121: Samples Release, fix test cases #28685
AUTH-483: Reapply #28589 #28660
no-jira: Ignore alerts on CustomNoUpgrade clusters #28678
NO-JIRA: bump golang to 1.21 and to latest o/k master #28672
NO-ISSUE: automated update synthetic test data #28693
NO-JIRA: add service accounts to resourcewatcher #28689
OCPBUGS-20097: Switch to use must-gather image in build multi-stage #28687
TRT-1545: Begin removing use of the legacy locator on intervals #28597
OCPBUGS-31513: feat: update regex for rt kernel version match #28665
OCPBUGS-31492: Add a test that will fail on over 10k etcd took too long messages #28674
OCPBUGS-31484: Use centos7 tag instead of latest for cmd images tests #28675
OCPBUGS-30267: Clarify a misleading message in patho event failures #28667
NO-JIRA: add conditional execution of featuregated tests #28670
TRT-1494: Add monitortest for cloud function on azure #28582
OSD-21709: Add temporary exceptions for managed services alerts #28669
TRT-1559: Remove two sets of logs to bring build-log.txt size down #28654
NO-JIRA: Add skip condition for Cluster-CSI-Snapshot-Controller-Operator feature #28635
TRT-1493: Add monitortest for cloud function on aws #28581
NO-JIRA: add simple test for server side apply to demonstrate field clearing #28491
OCPBUGS-31074: fix: add check for static container #28662
TRT-1567: Revert #28589 “AUTH-483: Add a monitor test to check the existence of required-scc annotation in platform workloads” #28659
AUTH-483: Add a monitor test to check the existence of required-scc annotation in platform workloads #28589
WRKLDS-1076: oc idle: Check idling annotation in services not endpoints #28619
OCPBUGS-30604: fix panic on non-standard node-role labels #28650
TRT-1557: Align three unknown tests to kube-apiserver #28649
MULTIARCH-4352: Censor private key from pod dump logs #28638
trt-1538: additional timeout bumps #28644
OCPBUGS-29614: update skipUnlessMachineAPIOperator function #28625
trt-1538: Bump context timeout to 20 minutes #28641
trt-1538: Wait for monitor resources cleanup #28626
OCPNODE-2099: add kube-rbac-proxy-crio toleration change #28636
OCPBUGS-29028: Add function back to execute commands via pod #28621
NO-ISSUE: Automated - Update synthetic test data #28600
OCPBUGS-27323: Skip tests for image-registry operator with single replica #28605
NO-JIRA: Handle release info output streams separately #28631
TRT-1539: Do not let loki alerts fail tests #28627
Delete unneeded stale owners file, defer to top level owners #28624
MULTIARCH-4160: Stop using the DetermineFromRelease function #28598
trt-1530: specify deployment id for unique log names #28613
TRT-1506: Restore the tests looking for excess single-second disruptions #28592
OCPBUGS-29858: Only extract node role from properly formatted node-role label #28585
OCPBUGS-29614: update control plane machine set test #28602
TRT-1476: Re-introduce the GCP liveness endpoint test #28608
TRT-1512: Add debug messages to debug openshift-tests hang #28604
NO-JIRA: Pass tail flag in adm node-logs to reduce log size #28607
NO-JIRA: Remove bare node-logs test to reduce logs size #28606
TRT-1522: Revert #28594 “TRT-1476: Re-introduce the GCP liveness endpoint test” #28603
TRT-1501: Add debug logging for decoding cluster provider #28593
TRT-1515: Revert #28587 “NO-JIRA: bump golang to 1.21 and to latest o/k master ” #28601
TRT-1493: Re-introduce the GCP liveness endpoint test #28594
OCPBUGS-29493: fix: updated unit test to look for topology not node count #28595
NO-JIRA: bump golang to 1.21 and to latest o/k master #28587
TRT-1499: Revert #28571 gcp-network-liveness until gcp resources are whitelisted #28586
TRT-1477: update IP for new gcp LB #28583
NE-1444: test/extended/router: HAProxy 2.8 Compatibility Enhancements for h2spec tests #28514
TRT-1445: Monitor test hangs during interrupt handling #28580
TRT-1491: Reorder interval groups to place most important/brief info higher up #28576
NO-JIRA: enforce only stable CRD versions accessible by default #28570
SPLAT-1427: fix/sig-net: ignoring edge when listing worker nodes #28486
TRT-1476: Add monitortest for cloud function on gcp #28571
OCPBUGS-28662: Replace ‘coreydaley’ with ‘sayan-biswas’ #28564
OCPBUGS-23115: Test builds with subscription content #28560
TRT-1452: Separate excessive Back-off restarting tests via namespace #28543
NO-JIRA: fix the static pod lifecycle failure test for more revisions #28553
OCPNODE-2029: migrate crio metrics to https #28536
TRT-1480: Fix disruption analysis on /payload jobs #28568
TRT-965: Add disruption to the risk analysis spyglass panel #28558
NO-JIRA: Skip external cloud provider test for HyperShift clusters #28562
MON-3449: Ensure monitoring statefulsets are not recreated after upgr… #28361
NO-JIRA: techpreview can install unstable CRDs #28532
OCPBUGS-18776: replace curl calls by net/http #28546
MON-3693: Adding slashpai and machine424 to Prometheus owners #28552
OCPBUGS-27892: fix panic in service-poller #28544
OCPBUGS-26594: pathologicalevents: fix regex in LeakyStatefulsetEvents matcher and add test #28538
NO-JIRA: remove unnecessary setup code from monitor #28534
trt-1141: bump timeout values #28527
NO-JIRA: collect certs on disk: rename prefix to rootfsmount, use new skip/rew… #28542
OCPBUGS-27465: Do not assume there is just a single kubelet systemd service #28529
OCPBUGS-27502: collect certs on disk: set pause image #28541
NO-ISSUE: Automated - Update synthetic test data #28537
OCPBUGS-27210: Restore HTTP/2 tests in test/extended/router #28540
OCPBUGS-20487: update egressFWTestE2E image which contains ping binary #28408
NO-JIRA: Update Omer to be the SNO lead #28451
TRT-1440: Automated - Update synthetic test data #28484
NO-JIRA: Update WinC team lead #28472
OCPBUGS-26594: pathologicalevents: Ignore leaky RecreatingTerminatedP… #28530
OCPBUGS-27341: pkg/monitortests/clusterversionoperator: Add an exception for ingress going Available=False on IngressUnavailable #28480
NE-1444: test/extended/router/http2: delete skipped tests #28522
NO-JIRA: Collect certs from disk #28444
TRT-1370: Track etcd leadership changes in etcd-leaders section of spyglass chart #28441
TRT-1440: Allow BestMatchDuration to pass even on fallback #28526
NO-JIRA: add kubernetes level to openshift tests image for payload #28521
TRT-1441: Stop uploading intervals to loki #28525
NP-877: Live migration suite e2e #28462
OCPNODE-1895: Bump k8s api to v1.29.0 #28473
trt-1430: Pass watchdog InvariantCheck when cluster stability is disruptive #28518
add test to ensure all accessible-by-default apis are stable #28467
TRT-1408: Disable TopologyAwareHintsDisabled check whenever NoExecuteTaintManag… #28517
OCPBUGS-18577: updated timeout to 3 seconds to account for network timing issues #28300
“NO-JIRA: Reduce top level origin approvers to TRT members only” #28439
watch the operator resources during resource watch #28513
add featureset into the raw-tls artifact names #28509
OCPBUGS-25730: Kuryr: Ignore Upgradeable=False on operators tests #28478
OCPBUGS-26025: Do not apply master label to make sure SNO jobs pass #28499
OCPBUGS-25142: Retry with different node port to make oc service test stable #28495
Refine explanation of meeting regenerate after expiry requirement #28502
Add README.md clarifying TLS registry purpose and processes #28434
OCPBUGS-26069: Update cluster-monitoring-operator request limits #28498
use the same collection options for tests so the certificate names wi… #28497
Update certs again #28489
e2e node label test to verify blocking forbidden labels #28296
OCPBUGS-25943: Adding test case for when exceed openshift.io/image-tags will ban to … #28464
OCPNODE-1895: Update etcd test data for 1.29 release #28485
OCPBUGS-25687: Increase timeout for pod-network-service #28474
PSAP-1210: Update code for automate OCPBUGS-18052 #28382
NO-JIRA: images: don’t log entire image status on failure #28469
OCPBUGS-25610: fix: update missing ruby 3.0 ref #28481
OCPBUGS-22438: feat: add extra check for ready state on resiliency test #28421
TRT-1403: Finish porting ALL intervals to structured #28463
OCPBUGS-25610: fix: lane e2e-gcp-ovn-builds perma fail #28471
NE-1477: Regenerate cert in 1024 key FIPs test to use SHA256 #28457
TRT-1359: Add mechanism for creating flake junit for a monitor test #28459
NO-JIRA: Fix issue 28445 #28446
OCPNODE-1892: Conditionally skip tests to help with k8s 1.29 #28465
Show how we can add new annotations using descriptions #28461
OCPNODE-1892: Update etcd test data for 1.29 release #28458
update-tls-artifacts: add AnnotationRequirement #28460
OCPBUGS-25045: Updating openshift-enterprise-tests-container image to be consistent with ART #28452
trt-1042: collect watch request counts #28431
TRT-786: Relax the per-job disruption tests and fix bugs/improve consistency #28453
fix jira components to match actual jira components #28454
OCPBUGS-24537: Properly ignore kube guard probe events #28448
add pacevedom to the team-leads alias #28449
TRT-1400: Automated - Update synthetic test data #28416
And 2 elided commits (e.g. from squash or rebase merges)
Full changelog

thanos

MON-3851: Bump openshift/thanos to v0.35.0 #145
MON-3799: Bump openshift/thanos to v0.34.1 #141
OCPBUGS-30537: CVE-2024-24786 Bump google.golang.org/protobuf to v1.33.0 #143
MON-3725: Update OWNERS: move raptorsun out of reviewer #140
MON-3753: Increase thanos tests timeout #144
OCPBUGS-29982: Updating ose-thanos-container image to be consistent with ART for 4.16 #142
MON-3703: Bump openshift/thanos to v0.34.0 #139
MON-3650: Bump openshift/thanos to v0.33.0 #136
OCPBUGS-24840: Updating ose-thanos-container image to be consistent with ART #135
OCPBUGS-24840: Updating ose-thanos-container image to be consistent with ART #134
Full changelog

vsphere-cloud-controller-manager

OCPBUGS-78028: hermetic migration 4.16 #107
OCPBUGS-46341: update check-fmt goimports command #83
OCPBUGS-37660: Bump otelgrpc to v0.53.0 #72
OCPBUGS-30538: Bump protobuf to v1.33.0 #67
OCPBUGS-27865: Add snyk exclusion file #63
OCPCLOUD-2420: Merge https://github.com/kubernetes/cloud-provider-vsphere:master (46a5796) into master #53
OCPBUGS-26125: Add Snyk file to exclude vendor directory on scan #61
OCPBUGS-25584: Updating ose-vsphere-cloud-controller-manager-container image to be consistent with ART #60
OCPBUGS-24991: Updating ose-vsphere-cloud-controller-manager-container image to be consistent with ART #59
Full changelog

vsphere-cluster-api-controllers

OCPBUGS-78020: hermetic migration 4.16 #86
OCPBUGS-61653: Fix unit tests #72
OCPBUGS-33170: Container fallback to logs on error #37
OCPBUGS-30539: Merge https://github.com/kubernetes-sigs/cluster-api-provider-vsphere:v1.9.3 (e50b9e2) into master #36
OCPCLOUD-1609: Update manager binary path #28
OCPBUGS-25627: Add Snyk file to exclude vendor directory on scan #31
OCPCLOUD-2447: Merge https://github.com/kubernetes-sigs/cluster-api-provider-vsphere:v1.9.0 (ea2dd15) into master #34
OCPBUGS-25514: Merge https://github.com/kubernetes-sigs/cluster-api-provider-vsphere:v1.8.7 (ba72420) into master #33
OCPBUGS-24873: Updating ose-vsphere-cluster-api-controllers-container image to be consistent with ART #29
Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

OCPBUGS-86874: Bump google.golang.org/grpc #182
OCPBUGS-68119: CVE-2025-65637: Bump github.com/sirupsen/logrus to v1.8.3 #158
OCPBUGS-43881: redact sensitive information when logging VCenter config #134
OCPBUGS-42878: Add compute resource entity to consider a standalone cluster for volu… #131
OCPBUGS-13551: FailedPrecondition volume does not appear staged #88
STOR-1698: Fix volume provisioning when duplicate region or zone tags exist #114
OCPBUGS-30545: CVE-2024-24786: bump google.golang.org/protobuf to v1.33.0 #115
STOR-1578: Rebase v3.1.2 #113
OCPBUGS-27242: fix or ignore snyk errors for ocp storage repos #112
OCPBUGS-24716: Revert “STOR-1396: Rebase to v3.1.1 for OCP 4.15” #101
OCPBUGS-22637, OCPBUGS-22648, OCPBUGS-23891: Fix CVE-2023-45142 and CVE-2023-47108 #108
OCPBUGS-24961: Updating vmware-vsphere-syncer-container image to be consistent with ART #105
OCPBUGS-25516: UPSTREAM: 2714: CVE-2023-48795: bump golang.org/x/crypto to v0.17.0 #106
STOR-1688: Chore: add .snyk file to ignore false positives #104
OCPBUGS-24968: Updating ose-vmware-vsphere-csi-driver-container image to be consistent with ART #103
OCPBUGS-24961: Updating vmware-vsphere-syncer-container image to be consistent with ART #102
Full changelog

vsphere-csi-driver-operator

OCPBUGS-103111: Bump golang.org/x/net to v0.35.0-sec.3 #358
OCPBUGS-51206: Set reconcile-sync to 10 minute for ListVolume #294
OCPBUGS-49862: List only linux nodes #289
OCPBUGS-24061: Keep CSI operators progressing=true during DaemonSet rollout #230
OCPBUGS-28230: enforce termination message policy on all platform pods #231
OCPBUGS-28230: enforce termination message policy on all platform pods #229
STOR-1804: use new snapshot options from ClusterCSIDriver #226
OCPBUGS-26924: Enable healthcheck for node-registrar containerPort #220
STOR-1574: Bump all deps #221
OCPBUGS-28936: Updating ose-vmware-vsphere-csi-driver-operator-container image to be consistent with ART for 4.16 #222
OCPBUGS-27159: Mark the operator as Disabled on connection error #218
STOR-1578: Revert “Merge pull request #195 from gnufied/revert-192-enable-new-fe… #212
OCPBUGS-27242: fix or ignore snyk errors for ocp storage repos #213
STOR-1574: Bump library-go #217
OCPBUGS-24421: Rerun checks on reconnect #215
STOR-1714: Release leadership on SIGTERM #206
OCPBUGS-24716: Enable new features to prevent CSI driver from crash looping (revert OCPBUGS-23970) #195
OCPBUGS-24838: Updating ose-vmware-vsphere-csi-driver-operator-container image to be consistent with ART #197
STOR-1688: Chore: add .snyk file to ignore false positives #202
OCPBUGS-23888: CVE-2023-47108: bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp to v0.46 #196
OCPBUGS-24226: setting TLSSecurityProfile with no minTLSVersion crashes controller #201
OCPBUGS-23306: Add annotation to CSI driver Pod preventing eviction from the cluster-autoscaler #198
Full changelog

vsphere-problem-detector

OCPBUGS-103110: Bump golang.org/x/net to v0.35.0-sec.4 #235
OCPBUGS-86445: fix concurrent map writes #219
OCPBUGS-37735: Drop event when CheckDefaultDatastore fails #168
OCPBUGS-35446: Fix missing failure-domains #160
OCPBUGS-30540: CVE-2024-24786: bump google.golang.org/protobuf to v1.33.0 #156
SPLAT-1209: Enhance datacenter not found to contain list of known datacenters #154
STOR-1574: Bump all deps #153
STOR-1574: Bump library-go #152
STOR-1714: Release leadership on SIGTERM #150
OCPBUGS-22994: Check if username contains a fully qualified domain name #143
OCPBUGS-25011: Updating ose-vsphere-problem-detector-container image to be consistent with ART #147
OCPBUGS-25372: Fix VPD crash when vm is not found #148
STOR-1688: Chore: add .snyk file to ignore false positives #146
OCPBUGS-25011: Updating ose-vsphere-problem-detector-container image to be consistent with ART #145
OCPBUGS-25011: Updating ose-vsphere-problem-detector-container image to be consistent with ART #144
Full changelog

View changelog in Markdown or change previous release:

Source code for this page located on github