5.0.0-ec.2

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:5.0.0-ec.2-s390x

Team Approvals:

No tests for this release

Upgrades from:

Untested upgrades: 4.22.0-rc.0, 4.22.0-rc.1, 4.22.0-rc.2, 4.22.0-rc.3, 4.22.0-rc.4, 5.0.0-ec.0, 5.0.0-ec.1

Loading changelog, this may take a while ...

Changes from 5.0.0-ec.1

Created: 2026-05-26 16:58:21 +0000 UTC

Image Digest: sha256:86207096dcf4a0fb23e00ad139bab3056ccda54c3bdaf86300070e8e9d65425d

Components

Kubectl 1.35.2
Kubernetes 1.35.3
Kubernetes Tests 1.35.1
Red Hat Enterprise Linux CoreOS upgraded from 10.2.20260423-0 to 10.2.20260513-0

The CoreOS links above are for the base CoreOS layer used to build the OpenShift node image and do not contain OpenShift components. This is normally only useful to devs working closely with the CoreOS team. For info about the node image, see the Node Image Info section.

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	OKD Hypershift	OKD SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
ConsolePluginContentSecurityPolicy (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
DRAPartitionableDevices (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
KMSEncryptionProvider (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
RouteExternalCertificate (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
EVPN (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled
MutatingAdmissionPolicy (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled
OLMLifecycleAndCompatibility (0 tests)				Enabled (New)				Enabled (New)

New images

aws-node-termination-handler git 341ed3a0 sha256:a3938418b6dc9591e7d3dc56b82f322fbbf9514ef7fa427f836f5f28806271ee

Rebuilt images without code change

aws-karpenter-provider-aws git f0be9c72 sha256:2ab93dbc7d74b88c2743f438a9b57624d24987955dc6689ca7b533ef40e76bc9
azure-service-operator git 0827c1fb sha256:63a93eecb3ac597cb29d65e8b5bbf2fa5dc2b952149d539760cbfbf5db098fc3
baremetal-machine-controllers git 8d863b95 sha256:5076f41a0b7e57f2e487f1ddbe18e4ca68cfbc317607b37945f8f861e4691a62
cloud-network-config-controller git 2d69ad95 sha256:72b1aa09276aa48f9687d37bf90aef91e565a2c0df324e285f3221c774152fe1
cluster-autoscaler-operator git 260ea1b5 sha256:59c4264d2624fadfa8294885f25ed41917e4af217e3039148853695b3f1c0373
cluster-csi-snapshot-controller-operator git 108f37f0 sha256:99e45f717417de68372d42307f564d4bdd15a8aa33b08f52b2b5ae7b0770e092
cluster-dns-operator git 3d214118 sha256:5bf66a47f7f28d8a1afe8a08a02ceb6ce8563b462671613e94e5e0fee23c6d52
cluster-kube-scheduler-operator git a0495853 sha256:206cf490c33701637465ce38972291053df92319cea83dfdd3c09eedeaed2265
cluster-openshift-controller-manager-operator git c941a99d sha256:c1f98d1e4d83693a15aa4adededfd92e376ea0651cc1543e511920fa3ddbc3fb
cluster-policy-controller git bb429f5b sha256:d717ca50d2b86b508dd7da5b44d6de551a17dd71580068bb884cadbe359e0563
cluster-samples-operator git 0bfb6b3c sha256:f2ce6b1cbd98c2bd1a48fd1bdfceaba1dcd3e6c9b1466dcc4896a9cb99291195
cluster-storage-operator git 8dfdf2ef sha256:fa065fa1e648fa48230842807707a5b85609829c6660dff5ddcf162b526244a1
cluster-update-keys git 3b5c59cc sha256:0e488eb6ba6b1dd2fae365de1df2091680027f836ea804b774e2565d4e8396b8
configmap-reloader git 94e41c4c sha256:2036f9cfeca370a8fd6de4a1e470ef42493dc573c5d8fbe4fbf5e304af848fb5
container-networking-plugins git 747ad66c sha256:40d22d5b96ef837a4e004cf40b6e55b444d995c38e693b4bb183888643127970
containernetworking-plugins-microshift git 747ad66c sha256:dac673b074f539c6f5686d824141b1c48ff50ce479055adbc5d8e9f5068904f8
coredns git 0dded2d2 sha256:293dedf378458abcb0237112e8810f061df88035476c4b441fc8b2f87241357b
csi-external-attacher git 98b1f4ac sha256:7210d4c12f9207fa02e5636abfa0ae870251bab332d89dd6c483923bdc9ed377
csi-external-resizer git 4e74a4aa sha256:a7c09ecc6ccc6d92232f838c19ce019f00bea8476c2f51de37434867c48ede80
csi-external-snapshot-metadata git 76523185 sha256:b6687122287bebd1869e6e3bb4c30716d170fb7da6618974eaa4aab27a20d8af
csi-livenessprobe git 4d5e959a sha256:8e63300901a6744575032d60f8180b11c3a03d39624249b27ba494cfe94f3d30
csi-node-driver-registrar git cf174b30 sha256:99b7854b30c3a70b0e7e456c8174c165c86878e30e2a0d6b3625a0d84989c503
docker-builder git fcd4ce2d sha256:4e46e136a2a72a7b7cef4da1d227e0cb1d4cd08ad2235d6d3012655f2464cf28
driver-toolkit git 7aa4007a sha256:703365b8bcf93387513a0e9622cdd992e162125e5e86e8ef922416c1bba24496
egress-router-cni git d37f51e0 sha256:056c4f99e6f39f35ee07a75496aed688a8bdba98cce90a5756a47b9b4521e85f
gcp-workload-identity-federation-webhook git d7675f31 sha256:762d3a77bef57f05198c6fd3aff5f7148cc6e41792029d35555094e9e1486671
ibm-cloud-controller-manager git 5fbabb90 sha256:2efadbc7fbc22066478c02c72e47763d6491c5829449dae76b93f999dcd95ec8
ibm-vpc-block-csi-driver-operator git f859eac9 sha256:0864561c673929fe87ef0714618af81b2f729017f10c5ce5d97e9c0f50e745de
ibmcloud-machine-controllers git 1f739771 sha256:0542d87b9403355a2022aa20ca6170eccc6badb9b2615ad39141cc910c388039
insights-runtime-exporter git 70256457 sha256:2100b748598533e9e79efa81633f724f622fb377af9539f74fe386d76e63f005
insights-runtime-extractor git 70256457 sha256:c7a2fa1feff81f6aae676dd18ed9e3b89d82cb07deded62af9decd9a77fc8c17
keepalived-ipfailover git edb8b1e6 sha256:cf8ad13102c2a2908785ad7272c4dcc5ab4e5989a7f7ba7efc8dc67d347c4075
kube-metrics-server git 38c16c46 sha256:1bb118a6c308cec0b08a65c9a84d9a596c928a0c03e145444ddcdd0ebb96660e
kube-rbac-proxy git d12e2746 sha256:5e78b06fcdfdc7ef24dea957ad6346807e5bc52659bbd277aa50cd8b3d69e62a
kube-state-metrics git 6fa06eac sha256:c7b77cda6b50f58c00546b5e64ea7b043d38f16ea3ef9da9e0b7778a77bb2810
kube-storage-version-migrator git 72835e43 sha256:c1d9959e8d3c66a853b6a36b0472b02fab3d7e0000efb9c769cbfe983fe49695
kubevirt-cloud-controller-manager git 76dd5a6f sha256:6064e164d49e608a195e6b9280977da27d11aa81f30a583deb7c41cbf2b4da7c
kubevirt-csi-driver git 771b562d sha256:7fe085dd367136cb2b6aa32da84dc012b80555b827591f85add4b6842e0586ed
multus-cni git b4ec7d82 sha256:27f83b13a13a085a306b58dae7cbb7a5a54cfc1911d0fa48fc488c2d3ac3b587
multus-cni-microshift git b4ec7d82 sha256:e366b4db0e1f4e7ade3c6141dbdd7d72ffb27992dc0874c70d674bdf891584f8
multus-networkpolicy git 43b16450 sha256:5dc84b6ee441af17689776c1a2f796e70c390dbc68ce7911a8f2248175b330a4
multus-route-override-cni git 08af4127 sha256:d9bfe568456c2416cd39ab33f283119bfd695acc5c6411bb98387bb1dc0a1dc1
multus-whereabouts-ipam-cni git d691040e sha256:36e473614570134b5a18d961f5ee39987ec63c4af808338fbb31ad97abb8df20
network-interface-bond-cni git 297eeb43 sha256:dcef853deaaffe8585cff0bffa86bd5bf318b290da8c32acdbf31000008aa388
network-metrics-daemon git 5b233ea1 sha256:e066f4aa555ebc3c5c4658ded60f38f0564bf8f8790f311b5303d550be30ff7c
oauth-proxy git 714292f5 sha256:1f060f17bfd0f9977ecc8d2a1c490a8d570e75b6eb5463510a67e2a8bc46f834
oauth-server git 3aa95c07 sha256:94b8cc304767694ce3d43bdc0a8e445a9f5eea23d4ed243e39f6c6a8448c0c61
openshift-state-metrics git e71e0996 sha256:28f942adff91fd9f306a31da14910f127f00b2a21a0be6b114a7593501f56494
openstack-machine-api-provider git 8a8c354b sha256:7e847826c6daa481e270b784ef51171667a1f1ad228fc25bc77e146e13daabb2
prometheus-node-exporter git b1b5423f sha256:7efacf1bf45d0b8c38fac76161b7505c457be7e8a989cd9cd691682972a699bd
rhel-coreos git f41264dc sha256:45cde39cea5f2c3276d5d77b64ea53772351de63f6ea4c9a9c898cebc4bf367c
rhel-coreos-extensions git f41264dc sha256:3f5bd0f7946705ece45a4ee101051e4b6d6be352a2e6a877ed709a2bbe7e6336
route-controller-manager git 624742d9 sha256:927d6f00946da82edec0c0d21aef998eaa196ad28cf86c123e0634e4aae711d0
thanos git 5d9d0f38 sha256:ac8b5ce5346e79c30f15c7b7e618891974b2c218790560097bf01613e289996a
volume-data-source-validator git 8e176cec sha256:9570de0b5adc07410c18bb594c55ab10306a6e55d53f175f40a19b6a60fa396b

agent-installer-api-server

NO-ISSUE: increase the timout waiting for assisted-image-service #10327
MGMT-20634: Revert mac-identifier and global DNS workarounds as RHEL-91250 and RHEL-72440 resolved #10318
ACM-33836: CVE-2026-35469 bump github.com/moby/spdystream #10314
NO-ISSUE: [master] Bump OCP versions: 4.22, 4.13, 4.16, 4.17 #10296
NO-ISSUE: [master] Bump OCP versions: 4.21, 4.20, 4.18, 4.19 #10287
MGMT-19930: upgrade PostgreSQL stack to pgx v5 and ocm-sdk-go v0.1.499 #10230
NO-ISSUE: [master] Bump OCP versions: 4.21 #10284
MGMT-24236: Exclude post-installation hosts from pending-user-action timeout #10266
MGMT-24138: Order network by bootstrap host #10257
NO-ISSUE: Remove unused RegisterAddHostsOCPCluster functions #10265
NO-ISSUE: [master] Bump OCP versions: 4.16, 5.0, 4.22 #10272
MGMT-24119: Correct the namespace to install Loki Operator as “openshift-operators-redhat” instead of “openshift-loki” #10209
MGMT-23755: Validate & trim MCS certificates when adding to ignition override #10262
NO-ISSUE: [master] Bump OCP versions: 4.21, 4.19 #10263
MGMT-23680: CVE-2026-32285 Bump github.com/buger/jsonparser to v1.1.2 #10240
NO-ISSUE: Update operator bundle channel to backplane-5.0 #10215
MGMT-24115: allow empty image checksum/url in getChecksumAndURL #10246
MGMT-23971: Add a timeout for installing-pending-user-action #10202
NO-ISSUE: Modify Konflux YAMLs to backplane-5.0 #10237
MGMT-23802: Fix manifest format in log bundles #10121
MGMT-23861: Fix oci detection for day2 clusters #10231
NO-ISSUE: [master] Bump OCP versions: 4.22 #10220
ACM-33186: Revert Renovate configuration for Hive updates #10203
MGMT-23553: Automate events table bloat cleanup #10140
MGMT-23665: fixing CVE-2026-33186 #10173
NO-ISSUE: Allow restoring soft deleted hosts #10185
NO-ISSUE: [master] Bump OCP versions: 4.20, 4.21, 4.22, 4.18 #10201
NO-ISSUE: Bump go modules and linters #10181
MGMT-23861: Revert MGMT-22385 for oci iscsi day2 #10170
ACM-32996: Missing nil check in BMACReconciler causes controller panic #10164
MGMT-23920: 4.22 SNO doesn’t support 4 cpu cores node #10153
NO-ISSUE: add shay23bra to owners #10163
NO-ISSUE: [master] Bump OCP versions: 4.13, 4.19 #10162
NO-ISSUE: Remove urlAuth from credentials endpoint #10161
MCO-2223: Add osImageStream install-config overrides #10156
NO-ISSUE: [master] Bump OCP versions: 4.21 #10152
NO-ISSUE: [master] Bump OCP versions: 4.22, 4.18, 4.20 #10146
OCPBUGS-79576: Mark raw FC/iSCSI multipath members as ineligible #10142
OCPBUGS-83401: Fix IRI patcher feature check #10141
MGMT-23227: Skip host operator validation for day2 clusters #10029
ACM-32735: Add better API docs to CRDs #10124
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

MGMT-23784: CVE-2026-34986 Bump github.com/go-jose/go-jose/v3 to v3.0.5 using replace directive #2121
NO-ISSUE: Modify Konflux YAMLs to backplane-5.0 #2119
ACM-33186: Revert Renovate configuration for Hive updates #2107
Full changelog

agent-installer-node-agent

NO-ISSUE: Modify Konflux YAMLs to backplane-5.0 #1431
Full changelog

agent-installer-utils

OCPBUGS-85524: update konflux references #286
AGENT-1476: Configure CI integration and add Prow e2e test to Konflux #245
Full changelog

apiserver-network-proxy

CNTRLPLANE-3380: Update OWNERS with HyperShift core team #107
CNTRLPLANE-3359: Rebase to v0.34.0 for OCP 4.23 #102
Full changelog

aws-cloud-controller-manager, aws-cluster-api-controllers, aws-ebs-csi-driver, aws-ebs-csi-driver-operator, aws-machine-controllers, aws-pod-identity-webhook, azure-cloud-controller-manager, azure-cloud-node-manager, azure-cluster-api-controllers, azure-disk-csi-driver, azure-disk-csi-driver-operator, azure-file-csi-driver, azure-file-csi-driver-operator, azure-machine-controllers, azure-workload-identity-webhook, csi-driver-manila, csi-driver-manila-operator, csi-driver-nfs, gcp-cloud-controller-manager, gcp-cluster-api-controllers, gcp-machine-controllers, gcp-pd-csi-driver, gcp-pd-csi-driver-operator, hyperkube, ironic, ironic-agent, ironic-machine-os-downloader, ironic-static-ip-manager, kube-proxy, machine-image-customization-controller, nutanix-cloud-controller-manager, nutanix-machine-controllers, pod, powervs-block-csi-driver, powervs-block-csi-driver-operator, powervs-cloud-controller-manager, powervs-machine-controllers, vsphere-cloud-controller-manager, vsphere-cluster-api-controllers, vsphere-csi-driver, vsphere-csi-driver-operator, vsphere-csi-driver-syncer, vsphere-problem-detector

OCPBUGS-78044: Improve WatchList test robustness #2622
CNTRLPLANE-2553: Update the KAS admission plugin for fields to be compilable at admission time #2627
OCPBUGS-83502: devicemanager: constrain topology hints to device NUMA nodes #2645
Full changelog

aws-kms-encryption-provider

CNTRLPLANE-3380: Update OWNERS with HyperShift core team #45
Full changelog

azure-kms-encryption-provider

CNTRLPLANE-3380: Update OWNERS with HyperShift core team #35
CNTRLPLANE-3204: feat: add workload identity support to Azure KMS plugin #33
CNTRLPLANE-3358: Sync with upstream Azure/kubernetes-kms #32
Full changelog

baremetal-cluster-api-controllers

NO-JIRA: manifests-gen: scope provider webhooks to capi namespace #79
OCPCLOUD-3359: Add TLS substitutions #74
NO-JIRA: Update manifests generator #75
Full changelog

baremetal-installer, installer, installer-artifacts

SPLAT-2452: Add SetSecurityGroups IAM permission to master nodes for BYO SG support for AWS NLBs #10512
MCO-2164: use machine-config-osimagestream to avoid hard-coding image tag names #10416
no-jira: images: bump UPI image dependencies to 4.22 #10538
MCO-2200: refactored node-joiner to use embedded rhcos data #10537
OCPBUGS-79536: Removing AWS security group OVNDB ports as they are no longer used #10441
OCPBUGS-85232: PowerVS: Add port 80 security group rule #10541
no-jira: tests: verify AWS instance type minimum cpu and mem requirement tests #10536
NO-JIRA: pkg/types/nutanix: warn about unused context #10430
SPLAT-2710: Added vSphere day 2 support #10529
OCPBUGS-67159: openstack: Reserve addresses for load balancer #10375
OCPBUGS-77760: verify FIPS mode after installation completes #10348
OCPBUGS-84873: Fix to agent integration test finding agent-tui files #10530
OCPBUGS-84335: vSphere - Missing unit tests to cover polarion workitems #10516
OCPBUGS-84548: add unit tests for Nutanix to replace polarion workitems #10520
Full changelog

baremetal-operator

NO-ISSUE: Merge upstream #483
Full changelog

baremetal-runtimecfg

NO-ISSUE: Bump go to fix security vulnerabilities #389
Full changelog

cli, cli-artifacts, deployer, tools

NO-JIRA: Bump go-jose dependency #2269
NO-JIRA: Making oc cli case blocking #2260
OCPBUGS-62799: Add required-scc annotation to node-joiner pod #2230
OTA-1817: Adding unit tests for the extend recommended alerts #2262
OCPBUGS-78768: Skip filter validation for RFC2307 group query when groupUIDAttribute is “dn” #2259
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

cloud-credential-operator

CCO-683: Remove go-autorest dependency for Azure Stack Cloud configuration #1024
CCO-845: use AlwaysAllow UnhealthyPodEvictionPolicy option in PDBs #1019
CCO-770: Docs: consolidate and simplify short-term token workflows #986
CCO-711: docs: improve the filter when getting the capi pod #1016
OCPBUGS-84712: github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3 #1021
OCPBUGS-84043: go.opentelemetry.io/otel v1.43.0 #1011
OCPBUGS-84044: github.com/go-jose/go-jose/v4 v4.1.4 #1012
Full changelog

cluster-authentication-operator

CNTRLPLANE-3237: Bump library-go and sync plugin changes #896
CNTRLPLANE-3237: Bump library-go and sync encryption tests with APIServerEncryption struct change #894
CNTRLPLANE-3431: enable tls config injection #892
NO-JIRA: Bump latest library-go changes #890
OCPBUGS-69977: Fix OAuth page showing OKD branding instead of OpenShift #887
OCPBUGS-84951: Fix terminationMessagePolicy on network policy e2e test pods #882
Full changelog

cluster-autoscaler

OCPBUGS-84130: UPSTREAM: 9458: fix(clusterapi): use kind-aware version discovery for infra references #418
Full changelog

cluster-baremetal-operator

OCPBUGS-85496: Fix webhook to validate the actual admission request object #601
OCPBUGS-82526: Fix webhook server not starting due to missing WithValidator #587
OCPBUGS-82531: Bind the plain HTTP 8080 metrics port to localhost #586
Full changelog

cluster-bootstrap

NO-JIRA: Add control-plane-approvers to OWNERS #127
Full changelog

cluster-capi-controllers

NO-JIRA: manifests-gen: scope provider webhooks to capi namespace #292
OCPCLOUD-3359: Add TLS substitutions #290
NO-JIRA: Update manifests generator #287
UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api:v1.12.7 (b5fa593) into master #286
Full changelog

cluster-capi-operator

NO-JIRA: Allow sustaining engineering to self serve dependency updates #553
OCPBUGS-84815: fix: scope webhook to capi namespace, remove unused webhook endpoints #543
OCPCLOUD-2664: Update operatorstatus to write correct sub-Conditions #552
OCPCLOUD-3429: Mount provider images with image volumes #527
NO-JIRA: manifests-gen: scope provider webhooks to capi namespace #544
OCPBUGS-84673: fix: remove retired Microsoft.ClassicStorage permission #547
NO-JIRA: bump controller-runtime-common to latest main #540
NO-JIRA: Updates gemini powered skills / agents #542
NO-JIRA: manifests-gen: set scc annotation in providers Deployments spec #524
NO-JIRA: Adds deep review skill #541
NO-JIRA: fix: re-enable setting/diffing httpProtocolIpv6, CAPA now supports it #537
NO-JIRA: fix: conversion: handle HTTPProtocolIPv6, temporarily disable its diffing #531
OCPBUGS-84378: Refactor e2e newAWSMachineTemplate to use mapi2capi #532
Full changelog

cluster-cloud-controller-manager-operator

OCPCLOUD-3436: use AlwaysAllow UnhealthyPodEvictionPolicy option in PDBs #457
SPLAT-2651: Added support to manage kube-cloud-config for vSphere in openshift-config-managed #442
NO-JIRA: fix: add pod annotation: openshift.io/required-scc: hostaccess #450
NO-JIRA: bump controller-runtime-common to latest main #456
Full changelog

cluster-config-api

OCPBUGS-74511: remove RouteExternalCertificate feature gate #2693
CNTRLPLANE-3361: update vault kms plugin validation #2836
OCPSTRAT-3036: Promote MutatingAdmissionPolicy feature to Default #2832
OPRUN-4590: Add OLMLifecycleAndCompatibility feature gate #2824
CNTRLPLANE-3237: Rename KMSConfig Struct to KMSPluginConfig #2833
SRVKP-11558: remove deprecated k8s.io/api packages removed in v0.36.0 #2834
CORENET-6861: Promote EVPN Feature Gate #2799
Revert “OCPBUGS-83492: Allow :ref suffix in additionalLayerStores path for stargz-store to support lazy image pulling” #2823
MON-4561: API: Add softirqs node-exporter collector to ClusterMonitoring CRD #2825
Clarify cluster operator Progressing condition #2829
OCPNODE-4498: features: drop DRAPartitionableDevices awareness #2828
OCPBUGS-43353: Add pattern validation for registry entries in image config #2787
SPLAT-2649: Added vSphere Day 2 logic to CRDs #2784
OCPBUGS-74506: Remove ConsolePluginSecurityPolicy featuregate #2683
CNTRLPLANE-2711: add vault kms plug configuration api #2805
Full changelog

cluster-config-operator

SPLAT-2717: Migrate vSphere sync of kube-cloud-config to 3CMO #481
Full changelog

cluster-control-plane-machine-set-operator

NO-JIRA: bump controller-runtime-common to latest main #403
Full changelog

cluster-etcd-operator

OCPEDGE-2604, OCPEDGE-2605: feat: add update-fencing-credentials.sh script for TNF fencing credentials rotation #1611
CNTRLPLANE-3392: Migrating etcd otp cases to ote #1612
NO-JIRA: Replace bash env var validator with go implementation #1606
NO-JIRA: separate grpc from http server #1598
NO-JIRA: fix CI failure #1599
NO-JIRA: Refactor render test validation #1597
Full changelog

cluster-image-registry-operator

NO-JIRA: fix flaky TestGlobalTLSCopy unit test #1341
OCPBUGS-84725: Fix stale config cache causing incorrect deployment #1329
OCPBUGS-63691: replace node-ca shell script with go implementation #1325
IR-486: use AlwaysAllow UnhealthyPodEvictionPolicy option in PDBs #1326
Full changelog

cluster-ingress-operator

NE-2662: use AlwaysAllow UnhealthyPodEvictionPolicy option in PDBs #1431
OCPBUGS-80966: Fix malformed PEM bundle when tls.crt lacks trailing newline #1405
OCPBUGS-84773: Allow host network connections to the ingress canary #1430
OCPBUGS-81442: TestUnsupportedConfigOverride: Ignore featuregate and defaults #1408
OCPBUGS-84551: isFIPSEnabled: Check FIPS_ENABLED env. var. first #1427
OCPBUGS-54702: change default timeout tunnel if using AWS NLB #1349
Full changelog

cluster-kube-apiserver-operator

CNTRLPLANE-3237: Bump library-go and sync plugin changes #2155
CNTRLPLANE-3237: pull https://github.com/openshift/library-go/pull/2220 #2150
OCPSTRAT-3036: Temporarily extend MutatingAdmissionPolicy runtime-config range to <1.37.0 #2148
CNTRLPLANE-3347: Migrate testKMSEncryptionOnOff to ote #2127
OCPBUGS-78016: Use SkipInClusterAuthenticationLookup in check-endpoints #2113
NO-JIRA: Removal of unuse suites #2132
OCPBUGS-76588: operator should not override authentication config serviceAccountIssuer with the default one during the operator initialization #2062
CNTRLPLANE-3327: Migrate TestEncryptionTypeAESCBC to OTE #2122
NO-JIRA: Add control-plane-approvers to OWNERS #2110
CNTRLPLANE-3326: Remove unstable TestBoundTokenOperatorSecretDeletion #2123
Full changelog

cluster-kube-controller-manager-operator

CNTRLPLANE-3107: e2e testing automation Create network network policy test cases #924
Full changelog

cluster-kube-storage-version-migrator-operator

OCPBUGS-65984: add PodDisruptionBudget for migrator deployment #172
OCPBUGS-62629: update library-go for deployment controller updates #159
NO-JIRA: Add control-plane-approvers to OWNERS #158
Full changelog

cluster-machine-approver

NO-JIRA: fix: add pod annotation: openshift.io/required-scc: restricted-v2 #297
NO-JIRA: bump controller-runtime-common to latest main #302
NO-JIRA: Deploy cluster-machine-approver without host networking #301
NO-JIRA: Migrate away from deprecated ioutil #284
Full changelog

cluster-monitoring-operator

NO-JIRA: [bot] Synchronize versions of the downstream components #2921
OCPBUGS-83284: validate more CMO configmap fields #2877
MON-4524: MetricsServerConfig resources merge #2907
NO-JIRA: [bot] Synchronize versions of the downstream components #2918
MON-4528: merge monitoringPluginConfig #2908
NO-JIRA: [bot] Synchronize versions of the downstream components #2893
MON-4520: follow up AlertManagerConfig and PrometheusOp PR changes #2900
TRT-2649: Revert “MON-4558: enable zoneinfo node-exporter collector via config” #2910
NO-ISSUE: chore(e2e): verify Prometheus Mantine UI is served on port 9090 and refactor ForwardPort helpers #2905
NO-ISSUE: Update AGENTS.md #2899
MON-4563: use AlwaysAllow UnhealthyPodEvictionPolicy option in PDBs #2892
MON-4558: enable zoneinfo node-exporter collector via config #2886
TRT-2644: Revert “MON-4517: Minimal and telemetry CP monitors” #2901
NO-ISSUE: [bot] Update jsonnet dependencies #2894
MON-4492: ClusterMonitoring alertmanagerConfig logic #2889
MON-4517: Minimal and telemetry CP monitors #2814
MON-4560: enable softirqs node-exporter collector via config #2887
Full changelog

cluster-network-operator

NVIDIA-596: Enable dpu healthcheck #2941
TRT-2657: Revert “add remaining CNO NetworkPolicies” (#2959) #2999
OCPBUGS-83800: add remaining CNO NetworkPolicies #2959
NVIDIA-554: DPU-host mode: use ConfigMap for OVN feature enablement instead of per-node script gating #2944
OCPBUGS-83406, OCPBUGS-83407: fix issue for managed mode of no-overlay #2960
OCPBUGS-53187: Update self-referencing URLs from master to main #2984
GCP-430: Wire GCP WIF credentials for CNCC in HyperShift HCP mode #2915
OCPBUGS-65631: Use dedicated service accounts for multus pods #2961
Full changelog

cluster-node-tuning-operator

OCPBUGS-62277: Requeue PerformanceStatus update when status write fails #1495
NO-JIRA: ote: embed extended testdata in cluster-node-tuning-operator-test-ext binary #1512
TRT-2659: Revert #1499 “NO-JIRA: ote: embed extended testdata in cluster-node-tuning-operator-test-ext binary” #1511
NO-JIRA: e2e: fix tuned deferred tests on Hypershift #1494
NO-JIRA: test/extended: scope oc process to NTO namespace #1508
NO-JIRA: ote: embed extended testdata in cluster-node-tuning-operator-test-ext binary #1499
OCPBUGS-84938: e2e: Add irqbalance StartLimitBurst >= 100 config test #1493
Full changelog

cluster-olm-operator

OPRUN-4599: dynamically resolve catalog image tag from OCP release version #203
OCPBUGS-62517: Scale to replicas=2 and enable PDB on HighlyAvailable topology #202
Full changelog

cluster-openshift-apiserver-operator

CNTRLPLANE-3237: Bump library-go and sync encryption tests with APIServerEncryption struct change #689
NO-JIRA: Bump latest library-go changes #688
API-1768: e2e network policy tests #675
NO-JIRA: Add control-plane-approvers to OWNERS #677
Full changelog

cluster-version-operator

OTA-1967: Take official CRDs from the OpenShift Lightspeed operator #1387
MON-4477: chore: add permissions on endpointslice to Prometheus Role and use serviceDiscoveryRole: EndpointSlice in ServiceMonitors #1305
OTA-1966: Init the Proprosal Lifecycle Controller #1381
NO-JIRA: OpenShiftUpdateRiskMightApply: bump pending to 15m from 10m #1372
OTA-1836: chore(deps): Bump general OpenShift dependencies #1377
Full changelog

console

OCPBUGS-82513: Enable Topology e2e tests #16273
CONSOLE-5200: add qa-verify skill for automated PR visual verification #16429
OCPBUGS-84669: Fix ProjectLink to update active namespace in Redux #16430
CONSOLE-5212: Fix ESM compatibility for Playwright e2e tests #16445
OCPBUGS-79521: Restore list page text and row filter functionality #16440
OCPBUGS-59404: Allow VolumeSnapshot restore when parent PVC is deleted #16447
OCPBUGS-83569: [main] CVE-2026-26996 Bump minimatch library #16301
CONSOLE-5211: Add Cypress-to-Playwright migration skills and context #16315
CONSOLE-5229: Enable RTL ESLint rules in Knative tests by removing file-level no-container / no-node-access suppressions #16405
CONSOLE-5197: Add Playwright E2E test infrastructure for Prow/CI #16374
CONSOLE-5034: Migrate tile-view-page and value-from-pair to TypeScript #16412
OCPBUGS-85242: Add Suspense boundary to LazyRoutePage for plugin routes #16409
OCPBUGS-77952: Fix devfile sample import by adding fallback for parent resolution failures #16149
OCPBUGS-70273: Prevent binary secret data corruption when editing #16053
OCPBUGS-65950: Update template whenever settings are updated #16143
CONSOLE-5212: Migrate Playwright setup to project dependencies #16408
CONSOLE-5285: remove corepack dep for build-(frontend/demos), bump yarn #16426
OCPBUGS-81518: Increase Resource Dropdown visible items cap to 250. #16398
CONSOLE-5273: Expose useToast in the SDK #16400
OCPBUGS-59353: Fix authentication redirect loop on repeated 401 responses #15814
CONSOLE-5015: Migrate NameValueEditor to TypeScript and PatternFly drag-drop #16406
NO-JIRA: Add approvers and reviewers to helm-plugin OWNERS #16361
OCPBUGS-85043: Remove @console imports from SDK dist #16399
OCPBUGS-77931: Loosen default img-src CSP #16388
OCPBUGS-84324: Update outdated documentation links and references #16362
CONSOLE-5212: Set up Playwright e2e test infrastructure #16320
OCPBUGS-84844: VSphere plugin changes broke i18n translations - missing strings in locales/en/ #16384
OCPBUGS-80940: Fix SDK publish workflow for Yarn Berry #16392
HELM-613: Reject basic auth over non-HTTPS for Helm chart repositories #16317
OCPBUGS-81519: Fix Search page state mutation and unnecessary component remounts #16266
OCPBUGS-84876: Add bottom pagination to ConsoleDataView for mobile responsiveness #16391
OCPBUGS-84856: Fix ESLint Testing Library plugin PR review feedback #16387
OCPBUGS-82140: Remove PII from events #16365
NO-JIRA: Align Dockerfile.dev with multi-arch Dockerfile structure #16390
OCPBUGS-79363: Move xterm to its own chunk #16370
NO-JIRA: zsh compatibility for microcopy-review #16389
NO-JIRA: Add fsgreco to frontend reviewers #16381
CONSOLE-5184: Enable ESLint Plugins for React Testing Library #16270
OCPBUGS-84710: Fix ConsoleDataView filter order: Name and Label should appear first #16375
OCPBUGS-84227: i18n upload/download routine task - version 4.22 #16318
OCPBUGS-84230: [release-4.22] - Re-enable cluster-settings/update-modal.cy.ts e2e test disabled for createRoot adoption #16319
OCPBUGS-81522: Reduce dashboard re-renders by memoizing cards and stabilizing prop references #16367
CONSOLE-5203: Remove old QE team from our repos #16312
OCPBUGS-81518: Fix ResourceListDropdown performance on large clusters #16252
OCPBUGS-79067: Fix crash when switching language to English #16366
NO-JIRA: Remove broken entrypoints and unused packages #16357
OCPBUGS-82511: re-enable helm-release.feature #16274
CONSOLE-5227: Upgrade ESLint from v6 to v8 and @typescript-eslint to v8 #16353
OCPBUGS-84338: Update resolveDynamicModuleMaps to skip unavailable packages #16340
OCPBUGS-84320: Use popover token in QS modal #16339
OCPBUGS-84296: fix Helm list page redirect after upgrade/rollback #16336
NO-JIRA: prepare for 4.22-prerelease.3 sdk publish #16338
CONSOLE-5144, OCPBUGS-81319, OCPBUGS-83823: 4.22 SDK fixes #15655
OCPBUGS-83812: Fix race conditions in OLM descriptors Cypress test #16304
OCPBUGS-83816: Fix race conditions in create-namespace Cypress tests #16306
NO-JIRA: enable multi-architecture yarn builds #16228
OCPBUGS-83813: Fix race conditions in debug pod Cypress tests #16305
OCPBUGS-81668: Fix User Preferences responsive breakpoints bug #16279
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

console-operator

OCPBUGS-85650: bump gRPC-Go package #1156
MON-4510: Migrate Prometheus targets discovering from Endpoints to EndpointSlices #1106
OCPBUGS-85060: feat: use 2 replicas for console on tnf #1151
Full changelog

csi-external-provisioner

NO-JIRA: OCPBUGS-82033: Bump google.golang.org/grpc to 1.79.3 #124
Full changelog

csi-external-snapshotter, csi-snapshot-controller

OCPBUGS-77492: UPSTREAM: 1392: Fix VolumeSnapshotContent deletion #207
Full changelog

docker-registry

OCPBUGS-84680: pin cloud.google.com/go/storage to v1.30.1 to fix blob deletion #469
Full changelog

etcd

OCPBUGS-85258: 5.0 rebase 3.6.11 #375
OCPBUGS-82495: 5.0/4.23 rebase 3.6.10 #368
Full changelog

haproxy-router

Reapply “OCPBUGS-55506: Prevent startup failures due to name resolution” #677
OCPBUGS-77263: create self-signed crt if failing to read default #740
OCPBUGS-62267: fix forwarded header for IPv6 on IPv4 stack #713
OCPBUGS-49738: fix handling of host conflict #736
Full changelog

hypershift

NO-JIRA: ci(deps): bump cloudflare/wrangler-action from 3.15.0 to 4.0.0 #8524
OCPBUGS-85763: Fix metrics-proxy deployment failure due to dots in volume names #8530
GCP-636: feat(gcp): support for managing GCP OIDC discovery documents #8413
OCPBUGS-84307: Clarify –base-domain flag default behavior #8381
AUTOSCALE-681: various karpenter and karpenterupgrade test fixes #8510
CNTRLPLANE-3329: Replace actions/cache with EFS-backed build cache in unit tests #8494
OCPBUGS-85577: Update external-dns image from 1.1.0-3 to 1.2.1 #8506
OCPBUGS-77827: fix(api): add missing has() guards to servingCerts CEL validation rule #8331
CNTRLPLANE-3380: docs: add aws-node-termination-handler to repositories list #8514
OCPBUGS-85580: Fix webhook TLS failure after service-ca to self-managed cert migration #8504
build(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.0 in /hack/tools #8481
OCPBUGS-85344: Add version gates for 4.22 backward compatibility in e2e tests #8466
AUTOSCALE-681: remove TechPreviewNoUpgrade gate from karpenter upgrade test #8498
CNTRLPLANE-3329: Mount EFS-backed Go build cache PV on ARC runner pods #8493
NO-JIRA: docs: add repositories page listing team-owned repos #8505
CNTRLPLANE-3329: Add nightly CronJob to warm EFS-backed Go build cache #8496
CNTRLPLANE-3324: Restore non-obvious comments after gocyclo refactor #8487
AUTOSCALE-558: Expose KubeletConfig on OpenShiftEC2Nodeclass as structured fields + preserveunknown/overflow #8192
NO-JIRA: Fix docs deploy preview by replacing gh CLI with curl #8488
CNTRLPLANE-2946: Move AWS NLB annotation inside LoadBalancer strategy block #7993
OCPBUGS-78539: re-add crash toleration for dns-operator during upgrades #8483
CNTRLPLANE-3384: Remove unconditional low-quality log messages from controllers #8428
OCPBUGS-84971: Gate AWSDefaultSecurityGroupDeleted condition to AWS platform #8415
CNTRLPLANE-3324: Enable gocyclo linter and reduce cyclomatic complexity #8309
NO-JIRA: fix(karpenter): resolve HCP karpenter finalizer when AutoNode is disabled #8404
OCPBUGS-62177: verify cert revocation against all KAS pods #8263
NO-JIRA: Document CEL over webhooks policy for AI agents #8478
NO-JIRA: docs(kubevirt): add how-to for configuring VMs with JSON patches #8473
CNTRLPLANE-1741: Migrate gomaxprocs-webhook pipelines to use common-operator-build #7122
NO-JIRA: docs: update api-sme agent and api/AGENTS.md conventions #8477
OCPBUGS-81686: fix(authentication): use v2 auth validation for CEL and expression support. #8246
OCPBUGS-85084: fix(ci): use explicit lease in dependabot commit fix push #8476
OCPBUGS-75887: fix(inplaceupgrader): include node name in degraded upgrade error message #8244
NO-JIRA: fix(e2e): prevent agent unbinding and node reboots during backup/restore #8356
NO-JIRA: Update GHA docs for reusable workflow pattern #8453
GCP-413: add image registry v2 e2e tests for hosted clusters #8412
NO-JIRA: docs: make CLAUDE.md a symlink to AGENTS.md across the repo #8444
CNTRLPLANE-2778: feat(tooling): overhaul pr-report skill and Python script #7754
ACM-33601: use the latest ubi9 nginx image #8432
GCP-414: add image registry operational guide #8455
OCPBUGS-84528: clarify pull secret in-place update behavior and add CP watches #8327
OCPBUGS-84955: Add render-sensitive flag to hypershift install render #8436
OCPBUGS-84857: bump go builder and ubi images #8437
GCP-410: fix(gcp): add registry SA WIF binding for image registry GCS access #8445
CNTRLPLANE-3381: CPO: Surface cloud resource deletion timeout as a status condition #8426
OCPBUGS-85084: fix(ci): rewrite dependabot commit messages to pass gitlint #8435
NO-JIRA: docs: detail release branch e2e config steps in branch-process guide #8441
CNTRLPLANE-3222: Migrate self-managed Azure e2e tests to v2 Ginkgo framework #8204
GCP-412: add envtest cases for GCP imageRegistry CEL validation #8411
CNTRLPLANE-2939: Coordinate CRD lifecycle with Cluster CAPI Operator #7996
OCPBUGS-77040: Add AWS ISO domains to konnectivity IsCloudAPI #8251
OCPBUGS-83328: fix skipProxyForKAS to use standard NO_PROXY matching #8254
OCPBUGS-84969: fix(e2e): wait for Karpenter node cleanup in parallel tests to prevent vCPU flake #8414
CNTRLPLANE-3343: Extract support/k8sutil package from support/util #8396
TRT-2653: Revert #8357 “OCPBUGS-84572: fix(cpo): generate EBS CSI driver operator serving cert in CPO” #8417
NO-JIRA: chore(deps): weekly dependabot consolidation #8410
NO-JIRA: Skip TestKarpenter for releases < 4.22 #8409
CNTRLPLANE-3351: e2e: add opt-in CPU resource request overrides for control plane components #8385
OCPBUGS-84509: Add AWS LB Controller cross-zone load balancing annotation #8344
OCPBUGS-84572: fix(cpo): generate EBS CSI driver operator serving cert in CPO #8357
OCPBUGS-81631: fix(metrics): remove noisy vCPU log for non-AWS platforms #8169
NO-JIRA: Extend timeout for CRD removal during integration tests #8366
NO-JIRA: chore(deps): weekly dependabot consolidation #8395
OCPBUGS-83868: prevent IAM resource leaks during cluster destroy #8303
GCP-635: feat(gcp): make JWKS file optional when OIDC issuer URL is provided #8339
OCPBUGS-83757: Remove network dependencies from unit tests #8277
ci(deps): bump actions/setup-go from 5.6.0 to 6.4.0 #8393
OCPBUGS-84508: Fix NLB name parsing for EKS Auto Mode hostnames #8343
AUTOSCALE-615: include Karpenter node vCPUs in billing metric #8265
CNTRLPLANE-3352: Convert GHA callers to use reusable workflows @main #8387
CNTRLPLANE-3342: Extract support/netutil package from support/util #8360
CNTRLPLANE-3352: Add reusable GHA workflow definitions #8386
GCP-410: feat(gcp): add HCCO credential propagation for GCP image registry #7896
OCPBUGS-84551: fix(ingress): set FIPS_ENABLED env var on ingress operator #8375
CNTRLPLANE-3307: add unit tests for Azure Private Link Service controllers #8285
CNTRLPLANE-3160: Drop AutoNodeKarpenter feature gate and promote EC2NodeClass to v1 #8166
NO-JIRA: Improve commit and PR guidance in AGENTS.md #8373
OCPBUGS-83790: change Azure workload identity webhook FailurePolicy from Fail to Ignore #8288
NO-JIRA: chore(deps): weekly dependabot consolidation #8334
NO-JIRA: Add API dependency import restriction tool #8364
SPLAT-2587: aws/ccm: introduce configuration to CCM managed Security Groups for NLB #7460
NO-JIRA: add –max-depth flag to nav order verification #8372
NO-JIRA: Do not import external dependencies into API packages #8355
CNTRLPLANE-3340: Extract support/podspec package from support/util #8354
OCPBUGS-84251: fix(azure): detect and replace stale role assignments on cluster re-creation #8322
OCPBUGS-84236: Guard Infrastructure CR lookup in AWSEndpointServiceReconciler #8315
fix: OCPBUGS-78575: create virt-launcher NetworkPolicy on external infra cluster #8056
CNTRLPLANE-3330: ci: improve unit test speed with sharding and parallelism #8330
CNTRLPLANE-3313: add Etcd Snapshot Backup (Tech Preview) DR documentation #8299
CNTRLPLANE-2834: add e2e test for etcd snapshot backup method on AWS #8231
docs: NO-JIRA: clarify serialization tag behaviour in api/AGENTS.md #8328
And 2 elided commits (e.g. from squash or rebase merges)
Full changelog

ibm-vpc-block-csi-driver

NO-JIRA: Bump gRPC library to v1.79.3 and replace golang.org/x/net/context with context #149
Full changelog

ibmcloud-cluster-api-controllers

NO-JIRA: manifests-gen: scope provider webhooks to capi namespace #160
OCPCLOUD-3359: Add TLS substitutions #158
NO-JIRA: Update manifests generator #159
Full changelog

insights-operator

OCPBUGS-85710: add trusted-ca-bundle to gatherin job #1289
CCXDEV-16348: tls metrics #1275
OCPBUGS-77351: fix: add terminationMessagePolicy to runtime extractor containers #1286
NO-JIRA: remove BaiyangZhou from OWNERS #1273
OCPBUGS-85201: Bump google.golang.org/grpc to v1.79.3 #1288
NO-JIRA: Update golang version #1277
NO-JIRA: add write-test claude skill #1274
Full changelog

machine-api-operator

OCPBUGS-85416: Enable actuators to set terminal failure on Exists and Update #1499
SPLAT-2745: Changed vSphere cloud config to be read from openshift-config-managed #1495
OCPBUGS-82584: Populate status label selector for scale subresource. #1490
NO-JIRA: machine-api-termination-handler: add scc annotation, terminationMessage: FallbackToLogsOnError #1494
NO-JIRA: bump controller-runtime-common to latest main #1493
NO-JIRA: fix: importing nutanix test to in the binary #1491
Full changelog

machine-config-operator

OCPBUGS-79502: Enable AutoSizingReserved for Hypershift workers #5847
NO-JIRA: daemon: expand os image presence check #6005
MCO-2212: MCO-2213: Migrate mco_observability and mco_daemon test-suite #5875
OCPBUGS-63650: configure-ovs: copy lldp mode to br-ex port #5698
OCPBUGS-85498: BareMetal skew e2e fails patching provisioning CR after CBO webhook fix #6031
OCPBUGS-85497: only check password hash in /etc/shadow #6030
NO-JIRA: Add fix for ossImagestream status #6018
MCO-2025: OCP-88366 and add OCP-88814 for osImageStream with osImageURL #6014
OCPBUGS-83830: Apply password only if changes exist #5889
AGENT-1514: Add ML-KEM verification test for IRI registry #6003
OCPBUGS-84516: Add terminationMessagePolicy to build pod containers #5993
OCPBUGS-85117: Fix 2 flakes happening in the ocl test suite #6004
OCPBUGS-84842: Bootloader update attempt should be conditional #5907
OCPBUGS-75894: use --delete-if-present for karg removal #5914
OCPBUGS-84661: Fix wrong early exit during kubelet MCs regeneration #5898
AGENT-1443: IRI Add certificate regeneration to MCS cert rotation controller #5721
OCPBUGS-84691: prom rules: add alert for nodes using runc #5874
MCO-1908, MCO-2213: Migrate MCD related MCO test-cases #5843
OCPBUGS-84867: Fix OCL test to handle temporarily empty current-machine-os-build annotation #5913
OCPBUGS-84832: daemon: don’t pull/extract extensions for all OS updates #5905
OCPBUGS-84852: Update AMI Whitelist #5910
OCPBUGS-84150: MachineOSConfig “build was not found” error #5878
OCPBUGS-84699: Custom pool booting must handle matchExpressions in nodeSelector #5899
OCPBUGS-84565: Fix CVE-2026-34986 #5890
OCPBUGS-83871: Support bootloader update #5868
OCPBUGS-84332: Fix ssh and password rollbacks #5884
MCO-2222: /automate-test skill for generating e2e tests from specifications #5864
OCPBUGS-84652: Include RootCA in the temporal CC #5896
OCPBUGS-83492: Auto-append :ref suffix to additionalLayerStores in storage.conf #5888
OCPBUGS-83826: deploy-from-self when skopeo < 1.22.2 #5867
OCPBUGS-84490: Bump image build timeout for status reporting test #5886
MCO-2201: Improve /migrate-tests skill: default labels and ordering verification #5879
OCPBUGS-83859: Fix encapsulated IGN version #5872
MCO-1494: Remove monolithic e2e-ocl test suite #5880
AGENT-1449: Add IRI registry authentication support to MCO #5765
Full changelog

machine-os-images

OCPBUGS-85476: Force rebuild for OCP 5.0 #87
METAL-1786: Include RHEL10 in image #82
Full changelog

metallb-frr

Bump to frr 10 #127
Full changelog

monitoring-plugin

OU-1269: Update monitoring-console-plugin for 4.22 #923
OU-1281: show disabled project bar while loading #936
OU-1351: prevent namespace and project desync #933
OU-1315: reset queries when namespace changes in dev perspective #932
OU-1348: fix: panel actions index so they are visible on click #928
OU-1347: fix: avoid throwing error to fallback to global datasource #920
OU-1203: upgrade perses dependencies #914
NO-JIRA: Revert “NO-JIRA: Bump to 4.22.0-prerelease.3 SDK” #915
NO-JIRA: Bump to 4.22.0-prerelease.3 SDK #903
OU-1323: Refactor dashboards state to prevent desync #912
OU-1341: pass label values to the filter #913
OU-1091: swap monitoring-plugin to use DataView #911
NO-JIRA: update perses and fix vulnerable dependencies #900
Full changelog

multus-admission-controller

OCPBUGS-85053: Bump Go version to 1.25.0 for ML-KEM/PQC support #115
Full changelog

must-gather

no-jira: chore: address the linting issues in the scripts #525
Full changelog

network-tools

NO-JIRA: Add mattedallo, marty-power, taanyas as reviewers #172
NO-JIRA: Refresh list of team members #176
NO-JIRA: Updates to handle changes after migrating to Atlasian cloud #174
Full changelog

networking-console-plugin

CONSOLE-5218: Add project documentation and rewrite README #417
CNV-74110: new translations #404
Full changelog

oauth-apiserver

CNTRLPLANE-2516: feat: externaloidc: add support for externally sourcing claims #195
CNTRLPLANE-2516: Add local configuration API for external oidc mode #194
NO-JIRA: Add control-plane-approvers to OWNERS #192
Full changelog

oc-mirror

CLID-623: Encapsulate unit test data into tests/unit #1407
CLID-479: OTE migration #1375
NO-JIRA: Update README.md for Enclave Support link #1404
CLID-612: Move integration tests within oc-mirror #1400
CLID-592: pkg/cli: add unit tests for environment setup #1391
Full changelog

olm-catalogd, olm-operator-controller

OCPBUGS-85508: Synchronize From Upstream Repositories #725
NO-ISSUE: Synchronize From Upstream Repositories #724
NO-ISSUE: Synchronize From Upstream Repositories #722
OCPBUGS-62517: Set replicas=1, PDB, and pod anti-affinity for HA topology #709
OCPBUGS-84943: fix(test): drop blocking namespace-deletion wait between both-watch-modes scenarios #712
OCPBUGS-62517: Synchronize from Upstream Repositories #710
NO-ISSUE: UPSTREAM: <carry>: remove dead e2e registry push job and related variables #711
OPRUN-4587: Make OTE local output easier to read #704
NO-ISSUE: Synchronize From Upstream Repositories #707
Full changelog

openshift-apiserver

OCPBUGS-38120: Ensure Project delete requests are passed through admission #632
NO-JIRA: Add control-plane-approvers to OWNERS #630
Full changelog

openshift-controller-manager

NO-JIRA: Add control-plane-approvers to OWNERS #438
Full changelog

openstack-cinder-csi-driver, openstack-cloud-controller-manager

UPSTREAM-SYNC: Sync main with latest upstream (release-1.35) #370
OCPBUGS-77578: Updating ose-openstack-cinder-csi-driver-container image to be consistent with ART for 4.22 #374
OCPBUGS-77755: Updating ose-openstack-cloud-controller-manager-container image to be consistent with ART for 4.22 #376
OCPBUGS-77592: Updating csi-driver-manila-container image to be consistent with ART for 4.22 #375
Full changelog

openstack-cinder-csi-driver-operator

OCPBUGS-85457: Add init container for Manila node daemonset #552
OCPBUGS-84052: Mount writable /tmp in SMB CSI driver #545
OSASINFRA-3675: Rework authentication in Manila CSI Driver Operator #373
Full changelog

openstack-cluster-api-controllers

NO-JIRA: manifests-gen: scope provider webhooks to capi namespace #416
OCPCLOUD-3359: Add TLS substitutions #408
UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.14 into main #390
NO-JIRA: Update manifests generator #411
OCPBUGS-77542: Updating openstack-cluster-api-controllers-container image to be consistent with ART for 4.22 #399
Full changelog

openstack-resource-controller

UPSTREAM-SYNC:Merge https://github.com/k-orc/openstack-resource-controller:release-1.0 into main #20
Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

NO-ISSUE: Synchronize From Upstream Repositories #1298
OPRUN-4601: use resource-based RBAC for lifecycle-server auth #1290
OCPBUGS-84642: Synchronize From Upstream Repositories #1291
OPRUN-4597: Fix lifecycle-server readiness probe to allow empty index #1288
OPRUN-4541, OPRUN-4544: add lifecycle-server for serving FBC catalog lifecycle metadata #1284
NO-ISSUE: Synchronize From Upstream Repositories #1286
NO-ISSUE: Synchronize From Upstream Repositories #1282
Full changelog

operator-marketplace

NO-ISSUE: Bump github.com/fsnotify/fsnotify from 1.9.0 to 1.10.1 #747
NO-ISSUE: Bump github.com/onsi/ginkgo/v2 from 2.28.1 to 2.28.3 #746
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

TRT-2652: Allow OTE info and list tests commands to work without KUBECONFIG #3170
NO-JIRA: DownStream Merge [04-30-2026] #3169
NO-JIRA: DownStream Merge [04-27-2026] #3159
NO-JIRA: OTE: run EVPN external traffic tests which use random subnet for VTEP #3148
Full changelog

prom-label-proxy

NO-ISSUE: [bot] Bump openshift/prom-label-proxy to v0.13.0 #394
Full changelog

prometheus

NO-JIRA: Upgrade Prometheus to 3.11.2 #305
Full changelog

prometheus-alertmanager

NO-ISSUE: remove ui/app/dist/.build_stamp #133
NO-ISSUE: [bot] Bump openshift/prometheus-alertmanager to v0.32.1 #132
Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

NO-ISSUE: [bot] Bump openshift/prometheus-operator to v0.91.0 #380
Full changelog

rhel-coreos-10, rhel-coreos-10-extensions

NO-JIRA: Revert “OCPBUGS-77244: 9.8: override runc package to pull in newer fixes” #1925
OCPBUGS-64841: post-process: Remove workaround for openvswitch additional group #1918
OCPBUGS-77244: 9.8: override runc package to pull in newer fixes #1923
NO-JIRA: extensions: Add rhel-9.8-server-ose-4.22 #1910
NO-JIRA: tests: add openshift tag #1906
COS-3912: denylist: drop rhcos.network.init-interfaces-test #1900
NO-JIRA: OWNERS: Add angelcerveraroldan #1883
NO-JIRA: Rename extensions/Dockerfile to Containerfile #1896
NO-JIRA: packages-openshift: Fix repo versions #1895
NO-JIRA: extensions: add a label for extensions image discovery #1894
COS-3900: Start using rhel-10.2 #1892
NO-JIRA: rhaos-pkgs-match-openshift: exclude known package mismatches #1891
No-JIRA: move the OKD SIG repo to 4.22 #1890
NO-JIRA: OWNERS: add user Rolv-Apneseth #1882
NO-JIRA: Update to track 4.22 and rhel-9.8 #1881
NO-JIRA: rhel-10.1: enable rhel-10.1-fast-datapath #1885
NO-JIRA: packages-openshift: enable rhel-10.1-fast-datapath #1884
OCPNODE-4010: package: add ose-crio-credential-provider #1879
OCPBUGS-70162: extensions/rhel-10.1: Re-enable ipsec #1878
NO-JIRA: drop use of rhel-9.6-appstream-containernetworking repo #1877
And 3 elided commits (e.g. from squash or rebase merges)
Full changelog

service-ca-operator

CNTRLPLANE-2894: e2e network policy test cases #338
NO-JIRA: Add control-plane-approvers to OWNERS #345
Full changelog

telemeter

OCPBUGS-85082: update google.golang.org/grpc #601
NO-ISSUE: add .coderabbit.yaml #603
NO-ISSUE: bump golangci-lint to v2.11.3 #602
NO-ISSUE: update OWNERS #604
OCPBUGS-84383: fix(deps): bump go-jose/v3 to v3.0.5 for JWE unwrap DoS #588
Full changelog

tests

OCPBUGS-85370: Raise OpenStack operator watch limits #31154
OCPBUGS-85363: Fixed flakiness of oc set image E2E tests #31152
OCPBUGS-85058: monitortests: allow etcd CO blips during TNF jobs on two-node upgrades #31138
OCPBUGS-85486: stage the creation of test pods to minimize etcd impact #31164
OCPNODE-4505: Automation creation of OCP-57401 #31142
OCPBUGS-83623: fix: add distruption tolerance for DualReplica (two-node) topology #31127
OCPBUGS-85531: Fixed flakiness in OCP E2E tests - oc debug image stream #31168
Revert “OPRUN-4569: test: remove OTE exceptions for OLM” #31171
OCPNODE-4108: add E2E tests for upstream dra-example-driver #31064
OPRUN-4569: test: remove OTE exceptions for OLM #31150
OCPEDGE-2386: Add tnf_etcd_disruption test with 5 new etcd resilience tests. #30880
NO-JIRA: Improve graceful shutdown LB test output with more details of late requests #31158
OCPNODE-4047: Implement kubelet TLS 1.3 via KubeletConfig on workers #31016
NO-ISSUE: Automated - Update synthetic test data #31146
CNTRLPLANE-3374: remove multus exception from monitor test #31130
CNTRLPLANE-3428: tls: extract annotation and ConfigMap update helpers #31156
OCPBUGS-83580: Skip dev fuse test on runc runtime #31140
OCPBUGS-84516: remove openshift-machine-config-operator exemption from terminationMessagePolicy monitor #31120
CNTRLPLANE-3387: Update list of pending namespaces in the required-scc monitor test #31135
NO-ISSUE: improve error reporting in cpumetriccollector #31132
no-jira: tls: deduplicate ConfigMap helpers into standalone functions #31136
OCPBUGS-84500: Verify dynamic revision bump for etcd during kernel crash #30915
OCPNODE-3983: Add e2e tests for KubeletEnsureSecretPulledImages feature gate #31102
OCPNODE-4381: Migrate OCP-38271 from openshift-tests-private #30960
OCPBUGS-85087: Allow OVN-Kubernetes CIDROverlap pathological events #31131
NO-JIRA: Increase pathological event thresholds for API server rollout scenarios #31122
CNTRLPLANE-2554: Add ExternalOIDCWithUpstreamParity e2e tests #31028
: no-jira: tls: extract injectTLSAnnotation constant #31125
OCPSTRAT-3036: Update etcd test data for k8s 1.36 release #31113
OCPNODE-4043: Fix NVIDIA DRA driver helm repo configuration #31104
TRT-2644: Run CP tests everywhere #31094
NO-JIRA: Remove fixed bugs on CO conditions #31081
OCPBUGS-84831: Optimize NetworkPolicy reconciliation test to reduce timeout #31114
NO-ISSUE: Automated - Update synthetic test data #31109
OCPBUGS-84809: Disable particular CSI tests if CSI driver is removed #31107
NO-JIRA: check jobname for upgrade #31106
OCPBUGS-84520: remove openshift-catalogd exemption from terminationMessagePolicy monitor #31100
OCPNODE-2994: Add ArtifactVolume tests and register artifact image #31017
NO-ISSUE: add QSEs as approvers #31087
SPLAT-2562: Added 3CMO OTE binary to extensionBinary list #31004
OCPCLOUD-3429: Ignore excessive image volume events from CAPI operator #31093
TRT-2622: copy OTE attrs to junit properties #31052
OCPBUGS-83580: Skip dev fuse test on runc runtime #31044
SREP-4676: add exception for managed cluster namespaces #31082
OCPBUGS-84257: fix openshift/network/third-party suite selecting zero tests #31084
TRT-2084: comment bugs filed for terminationMessage exemptions #31079
OCPBUGS-84504: retry transient kubeconfig read failures in GetClientConfig #31080
TRT-2565: Add simple benchmark for risk analysis HTTP requests #30965
NO-JIRA: Fix ListImages JSON parsing when extension binaries emit log lines #31009
OCPBUGS-84255: Fix project name error during wait #31062
NO-JIRA: Skip network policy cases on microshift and hypershift #31075
OCPBUGS-79544: test: add monitortest to detect pods stuck in Pending state #31045
OCPBUGS-79544: Add [Late] test to collect CRI-O goroutine dumps via SIGUSR1 #31013
NO-ISSUE: Automated - Update synthetic test data #31063
Full changelog

Node Image Info

Loading node image info, this may take a while ...

Unable to show node image info: too many concurrent oc adm release info --rpmdb/--rpmdb-diff operations (limit 16)

View changelog in Markdown or change previous release:

Source code for this page located on github