RHBA-2026:1481 - Bug Fix Advisory

Topic

Red Hat OpenShift Container Platform release 4.21.0 is now available with updates to packages and images that fix several bugs.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container Platform 4.21.0. See the following advisory for the RPM packages for this release:

https://access.redhat.com/errata/RHBA-2025:15963

Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/

Solution

For OpenShift Container Platform 4.21 see the following documentation, which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/

You can download the oc tool and use it to inspect release image metadata
for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests
can be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

(For x86_64 architecture)
The image digest is sha256:9f42dbb302232b32a7b07cc284eee1c7d1bddf79be4ad88dae0598cbad0bb23e

(For s390x architecture)
The image digest is sha256:ca9b5bb976cbca0566d642da48f5270125961fb3cf7c19ed35e85e6491021dc9

(For ppc64le architecture)
The image digest is sha256:fc35083f57689ae050e8309ebae3d8fd8c4df282373af8c2c3a55b747fbc46c5

(For aarch64 architecture)
The image digest is sha256:06750c2082e1ce4462ffee626aa8ab71b38be5855d156e6acf2df1cb6d426ceb

All OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli.

Fixes

• OCPBUGS-49769 - OCP 4.14 - Haproxy router pods reload failure after parsing route with invalid certificates - fatal error
• OCPBUGS-54385 - 3rd csi driver operator has "clustercsidrivers.operator.openshift.io \"xxxxxxxxx\" not found when the clustercsidriver resource is not installed
• OCPBUGS-56173 - OVN-Kubernetes does not have a way to understand if frrk8s is running on a node
• OCPBUGS-57523 - Component Readiness: pods should successfully create sandboxes by adding pod to network: expected pod UID "aa853924-c6c6-45b7-be56-e059960bc3c6" but got "ab26e0dc-d736-4945-aa02-91fa3f066cdc" from Kube API
• OCPBUGS-58326 - Event noise upon T-GM dual WPC clock locking from freerun
• OCPBUGS-59403 - 4.21: CPU Pinned not visible in IRQ after pod restart (follow up)
• OCPBUGS-59506 - Component Readiness: [sig-network][Feature:IPsec] when using openshift ovn-kubernetes check traffic with IPsec
• OCPBUGS-59885 - e2e flake: AdditionalTrustBundlePropagationTest failing with DisksNotLiveMigratable
• OCPBUGS-60027 - etcd cert rotation tests results in multiple failures
• OCPBUGS-60032 - Default-account ClusterRoleBinding still exists in cluster
• OCPBUGS-60257 - indentation issue of "frontend public" in haproxy
• OCPBUGS-60472 - Large batch of UDN NetworkSegmentation tests permafailing on hypershift kubevirt aws job
• OCPBUGS-60572 - BoundServiceAccountTokenVolume should be removed
• OCPBUGS-60610 - Component Readiness: [Networking / cluster-network-operator] Conntrack proxy implementation should not be vulnerable to the invalid conntrack state bug
• OCPBUGS-60765 - capv vm-host zonal add race
• OCPBUGS-60859 - CI fails on TestAll/serial/TestGatewayAPI/testGatewayAPIDNSListenerUpdate with a panic
• OCPBUGS-60937 - Hub cluster of HCP is showing Controller Manager REponse rate as unhealthy if the KCM of manged cluster is down
• OCPBUGS-61006 - cloud-provider-gcp: re-enable hermetic builds
• OCPBUGS-61142 - Hypershift Failures due to `openshift-insights/insights-operator` deployment failures
• OCPBUGS-61164 - Pattern of hypershift failures in e2e-aws-ovn job
• OCPBUGS-61228 - Route.metadata.generation is not updated on OpenShift
• OCPBUGS-61309 - Multiple storage tests failing in defunct volumeattributesclass job
• OCPBUGS-61451 - Make substitutions work for 4.21 in manifests of ose-ptp-operator
• OCPBUGS-61673 - O-Cloud Manager metal3 plugin gets stuck on deletion if allocated BMH has been deleted
• OCPBUGS-61828 - Hypershift test flake on FeatureGate / CVO version history mismatch
• OCPBUGS-62264 - Component Readiness: [Storage][sig-arch] events should not repeat pathologically for ns/openshift-cluster-csi-drivers
• OCPBUGS-62324 - Hypershift e2e binary: annotations flag not parsed correctly
• OCPBUGS-62325 - MAPI2CAPI: Watch Filters on MachineSync assume InfraMachine shares name with CAPI Machine
• OCPBUGS-62359 - Component Readiness: [sig-network] pods should successfully create sandboxes by writing network status
• OCPBUGS-62605 - Refactor GetSMTLevel function API
• OCPBUGS-62699 - AWS ECR credential provider in 4.20 is actually 4.19 build
• OCPBUGS-62704 - [iso_builder] Do not hard-code dependencies versions
• OCPBUGS-62719 - T-TSC/T-BC Holdover: Not all clock state metrics degrade after losing upstream clock
• OCPBUGS-62823 - Conmon needs 4.20 build with nvr higher than 4.19 build
• OCPBUGS-62942 - Using Boxcutter, existing ClusterExtension cannot be deleted
• OCPBUGS-63124 - Fix e2e-aws-operator e2e test failures
• OCPBUGS-63143 - ublox protocol version is hard coded
• OCPBUGS-63172 - HyperShift ingress operator PodMonitor metrics scrapes should work
• OCPBUGS-63205 - e2e EnsureReadOnlyRootFilesystem enforces RW filesystem for some pods
• OCPBUGS-63347 - Flaky single/own namespace tests after PR #524 – failure when namespace not deleted
• OCPBUGS-63354 - Node ISO Creation Fails with "context deadline exceeded"
• OCPBUGS-63383 - Component Readiness: [sig-network] pods should successfully create sandboxes by writing network status
• OCPBUGS-63477 - Component Readiness: [Node / Kubelet] [FeatureGate:InPlacePodVerticalScaling] test regressed
• OCPBUGS-63478 - Component Readiness: pods should successfully create sandboxes by adding pod to network: adds operator Progressing checks to the deleted pod branch
• OCPBUGS-63584 - vsphere - template and clusterosimage are mutually exclusive
• OCPBUGS-63622 - [HyperShift TPNU 4.20][OCPFeatureGate:ExternalOIDCWithUIDAndExtraClaimMappings]_Test_external_OIDC_userInfo_Extra and _UID tests regressed with 0% pass rate
• OCPBUGS-63709 - False positive kube-apiserver audit events for logging configmap from openshift-vsphere-infra project
• OCPBUGS-64650 - cluster configuration times out too early
• OCPBUGS-64939 - Custom logo image max-height constraint is ignored in Safari
• OCPBUGS-65502 - kube-controller-manager ClusterOperator relatedObjects missing ClusterRoleBinding
• OCPBUGS-65503 - kube-scheduler ClusterOperator relatedObjects missing ClusterRoleBinding
• OCPBUGS-65627 - Panic in openshift-cluster-csi-drivers_gcp-pd-csi-driver-controller
• OCPBUGS-65727 - Security context constraint pod admission is reporting wrong field path for spec.hostUsers errors
• OCPBUGS-65819 - ClusterMonitoring CRD uses incorrect singular resource path causing client-go generation failures
• OCPBUGS-65853 - ntpfailover does not handle chronyd process restarts
• OCPBUGS-65854 - linuxptp-daemon takes 2 seconds per ublxCmds
• OCPBUGS-65855 - chronyd startup delayed by ublxCmd execution
• OCPBUGS-65889 - linuxptp-daemon restarting due to thread exhaustion
• OCPBUGS-65892 - Events card has the divider border incorrectly postitioned
• OCPBUGS-65893 - Component Readiness: [Installer / openshift-installer] [Other] test regressed
• OCPBUGS-66352 - dpll switching between holdover and locked after GNSS recovery
• OCPBUGS-67011 - frrk8s status cleaner crash when debug config map is not specified

CVEs

(none)

References

(none)