RHSA-2024:3718 - Security Advisory

Topic

Red Hat OpenShift Container Platform release 4.17.0 is now available with updates to packages and images that fix several bugs and add enhancements.

This release includes a security update for Red Hat OpenShift Container Platform 4.17.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container Platform 4.17.0. See the following advisory for the RPM packages for this release:

https://access.redhat.com/errata/RHSA-2024:3722

Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:

https://docs.openshift.com/container-platform/4.17/release_notes/ocp-4-17-release-notes.html

Security Fix(es):

• hashicorp/vault: vault enterprise’s sentinel RGP policies allowed for

cross-namespace denial of service (CVE-2023-3775)

• hashicorp/vault: Google Cloud Secrets Engine Removed Existing IAM

Conditions When Creating / Updating Rolesets (CVE-2023-5077)

• hashicorp vault: inbound client requests can trigger a denial of service

(CVE-2023-5954)

• ssh: Prefix truncation attack on Binary Packet Protocol (BPP)

(CVE-2023-48795)

• containers/image: digest type does not guarantee valid type

(CVE-2024-3727)

• golang-protobuf: encoding/protojson, internal/encoding/json: infinite

loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON
(CVE-2024-24786)

• golang: archive/zip: Incorrect handling of certain ZIP files

(CVE-2024-24789)

• helm: Dependency management path traversal (CVE-2024-25620)
• jose-go: improper handling of highly compressed data (CVE-2024-28180)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.17/updating/updating_a_cluster/updating-cluster-cli.html

Solution

For OpenShift Container Platform 4.17 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.17/release_notes/ocp-4-17-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are

(For x86_64 architecture)
The image digest is sha256:fbad931c725b2e5b937b295b58345334322bdabb0b67da1c800a53686d7397da

(For s390x architecture)
The image digest is sha256:9054f1987c9a0128374f2e7fa91a0b9d074d9665ef48758e6f29a89c14edd8f6

(For ppc64le architecture)
The image digest is sha256:8a457e302eb66d06d17cb5cba491077b92a623217e05d486740969974b2aaef8

(For aarch64 architecture)
The image digest is sha256:c9c31f9120f1049b88b282be4589d1da504ee436dfa51487349d08fecd29dd1e

All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.17/updating/updating_a_cluster/updating-cluster-cli.html

Affected Products

• Red Hat OpenShift Container Platform 4.17 for RHEL 9 x86_64
• Red Hat OpenShift Container Platform 4.17 for RHEL 8 x86_64
• Red Hat OpenShift Container Platform for Power 4.17 for RHEL 9 ppc64le
• Red Hat OpenShift Container Platform for Power 4.17 for RHEL 8 ppc64le
• Red Hat OpenShift Container Platform for IBM Z and LinuxONE 4.17 for RHEL 9 s390x
• Red Hat OpenShift Container Platform for IBM Z and LinuxONE 4.17 for RHEL 8 s390x
• Red Hat OpenShift Container Platform for ARM 64 4.17 for RHEL 9 aarch64
• Red Hat OpenShift Container Platform for ARM 64 4.17 for RHEL 8 aarch64

Fixes

• BZ - 2241306 - CVE-2023-3775 hashicorp/vault: vault enterprise?s sentinel RGP policies allowed for cross-namespace denial of service
• BZ - 2241980 - CVE-2023-5077 hashicorp/vault: Google Cloud Secrets Engine Removed Existing IAM Conditions When Creating / Updating Rolesets
• BZ - 2249115 - CVE-2023-5954 hashicorp vault: inbound client requests can trigger a denial of service
• BZ - 2254210 - CVE-2023-48795 ssh: Prefix truncation attack on Binary Packet Protocol (BPP)
• BZ - 2264336 - CVE-2024-25620 helm: Dependency management path traversal
• BZ - 2268046 - CVE-2024-24786 golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON
• BZ - 2268854 - CVE-2024-28180 jose-go: improper handling of highly compressed data
• BZ - 2274767 - CVE-2024-3727 containers/image: digest type does not guarantee valid type
• BZ - 2292668 - CVE-2024-24789 golang: archive/zip: Incorrect handling of certain ZIP files
• OCPBUGS-25758 - router deployment fails on y-stream upgrade 4.13->4.14
• OCPBUGS-29510 - console pods are crashlooping in OIDC authentication configuration
• OCPBUGS-30986 - Removing old weak ciphers from security profile for Hypershift hosted cluster
• OCPBUGS-31343 - Oc-mirror should fail with error when operator not found
• OCPBUGS-31446 - HCP: imagesStreams on hosted-clusters pointing to image on private registries are failing due to tls verification although the registry is correctly trusted
• OCPBUGS-31575 - GNSS EVENT state is not following O-Ran spec defined values
• OCPBUGS-31727 - Invalid Pull-Secret when using password which contains a colon character
• OCPBUGS-32108 - `oc set env` command changes apiVersion for route and deploymentconfig
• OCPBUGS-32186 - The hypershift cli (hcp) reports an inaccurate OCP supported version
• OCPBUGS-32242 - The MCO makes a lot of API requests for ClusterOperator objects
• OCPBUGS-32304 - [4.17] metal3-ironic-inspector CrashLoopBackOff - /certs/ca/ironic permission denied
• OCPBUGS-32370 - Azure Disk CSI driver node metrics are not collected
• OCPBUGS-32405 - Create Serverless form does not create BuildConfig
• OCPBUGS-32476 - Import from Git allow users to import an app with Build option Pipeline also when no Pipeline is available
• OCPBUGS-32632 - Improve Pipeline list page performance
• OCPBUGS-32710 - virtual hosted-style doesn't work since 4.14
• OCPBUGS-32991 - multus-admission-controller stuck in CrashLoopBackOff when egress IPs are created at scale [4.17]
• OCPBUGS-33081 - oc-mirror v2 should be able to mirror operators that does not have standard versioning (incompatible with semver)
• OCPBUGS-33906 - ART requests updates to 4.17 image ose-metallb-container
• OCPBUGS-33908 - ART requests updates to 4.17 image openshift-enterprise-base-rhel9-container
• OCPBUGS-33961 - Remove vSphere Terraform providers and manifests
• OCPBUGS-33963 - [Upgrade] kube-apiserver stuck in updating versions when upgrade from old releases
• OCPBUGS-33974 - CAO not finding new upstream annotations on MachineSet as they're not being added in time due to a race condition
• OCPBUGS-33987 - 2 HostedClusters got the same serving node allocation[non-dynamic as well as in dynamic setup]
• OCPBUGS-33995 - Also fill out PlatformSpec for custom endpoints
• OCPBUGS-34021 - [v2] users should be able to configure timeouts, retries
• OCPBUGS-34028 - Update git submodules
• OCPBUGS-34039 - ART requests updates to 4.17 image telemeter-container
• OCPBUGS-34040 - monitor-add-nodes Error: open .addnodesparams: permission denied
• OCPBUGS-34054 - lots of churn during image registry managed/removed transition
• OCPBUGS-34056 - ART requests updates to 4.17 image dpu-operator-container
• OCPBUGS-34058 - ART requests updates to 4.17 image ose-kubevirt-csi-driver-container
• OCPBUGS-34065 - ART requests updates to 4.17 image ose-baremetal-cluster-api-controllers-container
• OCPBUGS-34067 - ART requests updates to 4.17 image ose-multus-networkpolicy-container
• OCPBUGS-34075 - ART requests updates to 4.17 image ose-cluster-ovirt-csi-operator-container
• OCPBUGS-34077 - Default Rolebindings Created on OCP 4.16 with No Capabilities
• OCPBUGS-34080 - ART requests updates to 4.17 image cluster-monitoring-operator-container
• OCPBUGS-34088 - ART requests updates to 4.17 image ose-thanos-container
• OCPBUGS-34095 - Autoscaler controller fails to kick off a reconcile even with a pod in pending state
• OCPBUGS-34103 - ART requests updates to 4.17 image openshift-enterprise-egress-dns-proxy-container
• OCPBUGS-34104 - ART requests updates to 4.17 image ose-vsphere-cloud-controller-manager-container
• OCPBUGS-34113 - ART requests updates to 4.17 image ose-openstack-cinder-csi-driver-container
• OCPBUGS-34115 - ART requests updates to 4.17 image openshift-enterprise-registry-container
• OCPBUGS-34116 - ART requests updates to 4.17 image dpu-cni-container
• OCPBUGS-34118 - ART requests updates to 4.17 image ose-insights-operator-container
• OCPBUGS-34119 - ART requests updates to 4.17 image ose-cluster-baremetal-operator-container
• OCPBUGS-34154 - ART requests updates to 4.17 image openshift-enterprise-cli-container
• OCPBUGS-34157 - ART requests updates to 4.17 image ose-kubevirt-cloud-controller-manager-container
• OCPBUGS-34169 - ART requests updates to 4.17 image coredns-container
• OCPBUGS-34170 - ART requests updates to 4.17 image openshift-enterprise-console-container
• OCPBUGS-34177 - ART requests updates to 4.17 image ose-machine-os-images-container
• OCPBUGS-34180 - [CONSOLE-PLUGIN] Update the Current Status Column text and fix the alignment issue observed in Firefox
• OCPBUGS-34181 - FIPS install not possible with agent-based installer
• OCPBUGS-34182 - ART requests updates to 4.17 image ose-machine-api-operator-container
• OCPBUGS-34184 - ART requests updates to 4.17 image ose-machine-api-provider-azure-container
• OCPBUGS-34187 - ART requests updates to 4.17 image ose-agent-installer-utils-container
• OCPBUGS-34200 - When editing a ConfigMap in the Form View from console, the value window/box is no longer resizable in OpenShift 4.15 versions.
• OCPBUGS-34202 - ART requests updates to 4.17 image kube-state-metrics-container
• OCPBUGS-34205 - ART requests updates to 4.17 image dpu-daemon-container
• OCPBUGS-34207 - ART requests updates to 4.17 image ose-tools-container
• OCPBUGS-34208 - ART requests updates to 4.17 image ose-azure-workload-identity-webhook-container
• OCPBUGS-34210 - ART requests updates to 4.17 image baremetal-machine-controller-container
• OCPBUGS-34215 - ART requests updates to 4.17 image ose-olm-operator-controller-container
• OCPBUGS-34219 - ART requests updates to 4.17 image ose-powervs-block-csi-driver-operator-container
• OCPBUGS-34221 - ART requests updates to 4.17 image ose-installer-altinfra-container
• OCPBUGS-34222 - Unable to run Cypress tests locally
• OCPBUGS-34243 - capi-based aws installs sometimes fail with HostedZoneAlreadyExists
• OCPBUGS-34258 - ART requests updates to 4.17 image ose-kube-metrics-server-container
• OCPBUGS-34262 - ART requests updates to 4.17 image ose-cluster-ingress-operator-container
• OCPBUGS-34284 - ART requests updates to 4.17 image ose-aws-efs-utils-container
• OCPBUGS-34286 - ART requests updates to 4.17 image ose-network-interface-bond-cni-container
• OCPBUGS-34298 - ART requests updates to 4.17 image openshift-state-metrics-container
• OCPBUGS-34304 - ART requests updates to 4.17 image ose-cluster-policy-controller-container
• OCPBUGS-34306 - ART requests updates to 4.17 image ose-cluster-kube-storage-version-migrator-operator-container
• OCPBUGS-34311 - ART requests updates to 4.17 image ose-installer-container
• OCPBUGS-34312 - ART requests updates to 4.17 image monitoring-plugin-container
• OCPBUGS-34354 - PowerVS: update capi ibmcloud to release 0 8 0
• OCPBUGS-34734 - HCP: hypershift-operator on disconnected clusters ignores RegistryOverrides inspecting for nodepool release image(setting hypershift.openshift.io/control-plane-operator-image is a workaround)
• OCPBUGS-34741 - Clusters created at a specific size (above small) are never scheduled
• OCPBUGS-34784 - Insights Operator to collect the 'prometheus' and 'alertmanager' instances
• OCPBUGS-34787 - [4.17] SCC pinning for all workloads in platform namespaces
• OCPBUGS-34788 - gather data about SDN to enable Insights recommendations
• OCPBUGS-34798 - [4.17] SCC pinning for all workloads in platform namespaces
• OCPBUGS-34805 - Send cnv_abnormal metric via telemetry
• OCPBUGS-18711 - The secrets-store-csi-driver with AWS provider integration does not work in HyperShift hosted cluster
• OCPBUGS-19855 - Watching singular namespaced resources should fail when no namespace is provided
• OCPBUGS-33580 - when use `shortestPath: true` for ocp release mirror for v2 , will lead to wrong counted images numbers
• OCPBUGS-33592 - Automatic scaling not always working because NodeGroup.GetOptions() not being implemented
• OCPBUGS-33597 - Dynamic update of leap file
• OCPBUGS-33615 - [vSphere CAPI install] installconfig.controlPlane.platform.vsphere.coresPerSocket does not work
• OCPBUGS-33631 - Show pod debug action for Succeeded pods
• OCPBUGS-33644 - kubelet-serving CSRs in Pending state on SNO with Telco DU with disabled capabilities
• OCPBUGS-33645 - "alertmanager-trusted-ca-bundle configmap not injected in alertmanager-user-workload pods
• OCPBUGS-33651 - oc command cannot be used with RHEL 8 based bastion on s390x
• OCPBUGS-33654 - oauth login page templates include old OpenShift favicon
• OCPBUGS-33686 - alertmanager Dockerfile.ocp broken
• OCPBUGS-33699 - 4.16 DTK image has same value for KERNEL_VERSION and RT_KERNEL_VERSION
• OCPBUGS-33733 - The s2i build strategy is not assumed for Serverless Functions
• OCPBUGS-33742 - External-dns pod by hypershift operator is running with lower Priority
• OCPBUGS-33747 - console always query 'openshift' CSVs when listing namespaced operator details
• OCPBUGS-33762 - upgrade status details formatting issue
• OCPBUGS-33776 - 4.15 AWS EFS CSI driver is not compatible with the 4.17 OCP
• OCPBUGS-33789 - Nutanix: installer intermittent failure to upload image data from local file when CAPI enabled
• OCPBUGS-33803 - machine-os-puller SA refreshes every hour, causing machine config regeneration
• OCPBUGS-33805 - Incorrect form of entrypoint used in Dockerfile.openshift for azure-kubernetes-kms
• OCPBUGS-33806 - Panic in MAPO deleting Machine in ERROR state
• OCPBUGS-33868 - Support "ChunkSizeMiB" feature gate via api bump
• OCPBUGS-33877 - [aws] timeout deleting ssh rule during bootstrap destroy
• OCPBUGS-33882 - Cluster Bootstrap does not account for capabilities in rendered manifests
• OCPBUGS-33888 - ART requests updates to 4.17 image ironic-agent-container
• OCPBUGS-33890 - Remove vSphere Terraform providers and manifests
• OCPBUGS-33896 - status: show upgrade-related alerts in update health section
• OCPBUGS-33898 - status: include information about version currently upgraded to
• OCPBUGS-33902 - ART requests updates to 4.17 image ironic-container
• OCPBUGS-33903 - Output unnecessarily cluttered when not updating
• OCPBUGS-33904 - ART requests updates to 4.17 image atomic-openshift-cluster-autoscaler-container
• OCPBUGS-33912 - CAPI: PowerVS: Use random subnet
• OCPBUGS-33925 - [AWS CAPI install] Installer is still using Terraform Variables validations
• OCPBUGS-33926 - [capi aws] failed to create IAM roles in ROSA
• OCPBUGS-33931 - Kube Controller Manager Operator should not set cloud provider flags
• OCPBUGS-33954 - infra machine going to failed status unexpectedly
• OCPBUGS-33955 - logtostderr is removed in the k8s upstream and has no effect any more
• OCPBUGS-34122 - ART requests updates to 4.17 image cluster-node-tuning-operator-container
• OCPBUGS-34123 - ART requests updates to 4.17 image ose-powervs-block-csi-driver-container
• OCPBUGS-34124 - ART requests updates to 4.17 image golang-github-prometheus-node_exporter-container
• OCPBUGS-34133 - ART requests updates to 4.17 image ose-cluster-api-container
• OCPBUGS-34138 - ART requests updates to 4.17 image ose-cluster-machine-approver-container
• OCPBUGS-34140 - ART requests updates to 4.17 image ose-oauth-apiserver-container
• OCPBUGS-34145 - ART requests updates to 4.17 image openshift-enterprise-cluster-capacity-container
• OCPBUGS-34146 - ART requests updates to 4.17 image ose-route-controller-manager-container
• OCPBUGS-34147 - ART requests updates to 4.17 image ose-aws-pod-identity-webhook-container
• OCPBUGS-34152 - ART requests updates to 4.17 image openshift-enterprise-egress-router-container
• OCPBUGS-34318 - ART requests updates to 4.17 image ose-baremetal-operator-container
• OCPBUGS-34329 - ART requests updates to 4.17 image ose-machine-api-provider-openstack-container
• OCPBUGS-34331 - geneve port not created for a set of nodes and causing POD to POD connectivity issue
• OCPBUGS-34338 - ART requests updates to 4.17 image ose-egress-http-proxy-container
• OCPBUGS-34389 - [AWS CAPI Install] SSH on private clusters is open to public internet
• OCPBUGS-34391 - vsphere failing to provision machines on certificate signed by unknown authority
• OCPBUGS-34395 - Build Cluster Config API Not Present when Build Capability Enabled
• OCPBUGS-34397 - Rename machine-config-operator CRDs
• OCPBUGS-34428 - ART requests updates to 4.17 image atomic-openshift-cluster-autoscaler-container
• OCPBUGS-34431 - ART requests updates to 4.17 image telemeter-container
• OCPBUGS-34437 - ART requests updates to 4.17 image cluster-monitoring-operator-container
• OCPBUGS-34444 - ART requests updates to 4.17 image ose-cluster-api-container
• OCPBUGS-34445 - ART requests updates to 4.17 image ose-cluster-machine-approver-container
• OCPBUGS-34446 - ART requests updates to 4.17 image ose-oauth-apiserver-container
• OCPBUGS-34450 - ART requests updates to 4.17 image ose-machine-api-operator-container
• OCPBUGS-34459 - ART requests updates to 4.17 image prometheus-operator-container
• OCPBUGS-34465 - ART requests updates to 4.17 image openshift-enterprise-deployer-container
• OCPBUGS-34467 - ART requests updates to 4.17 image ose-must-gather-container
• OCPBUGS-34469 - ART requests updates to 4.17 image ose-network-tools-container
• OCPBUGS-34472 - ART requests updates to 4.17 image ose-csi-driver-shared-resource-mustgather-container
• OCPBUGS-34479 - [console-plugin] Internet call happens in loop in PipelineRun list page
• OCPBUGS-34501 - [4.17] backport manual etcd signer cert rotation e2e test
• OCPBUGS-34521 - [v1] Disk to Mirror or use of targetCatalog requires access to internet for catalog images
• OCPBUGS-34531 - [console-plugin] Internet call happens in loop in PipelineRun list page
• OCPBUGS-34540 - RegistryMirrorProvider is modifying the cached image directly
• OCPBUGS-34541 - Migrate HyperShift KAS to none endpoint reconciler type
• OCPBUGS-34552 - Fix audit-logs container to respect SIGTERM
• OCPBUGS-34561 - [release-v1.15.x][console-plugin]Improve Pipeline list page performance
• OCPBUGS-34574 - [console-plugin]TaskRuns should not be fetched for Failed PLR's
• OCPBUGS-34578 - [release-v1.15.x][console-plugin]TaskRuns should not be fetched for Failed PLR's
• OCPBUGS-34593 - panic: "integer divide by zero" (runtime error: integer divide by zero), kube-scheduler
• OCPBUGS-34601 - Assisted-service fail to register cluster with "CPU architecture is not supported" error
• OCPBUGS-34639 - upi-conf-vsphere-platform-external reports "jq: error: Could not open file /var/run/vault/vsphere-config/subnets.json: No such file or directory"
• OCPBUGS-34659 - [4.17] Allow adding new node during live migration
• OCPBUGS-34661 - [4.17] Live migration pre-migration validation
• OCPBUGS-34664 - vsphere failing to provision machines on certificate signed by unknown authority
• OCPBUGS-34666 - API data in etcd not being stored in correct location in techpreview
• OCPBUGS-34689 - Nutanix CCM: SWEET32 "SSL Medium Strength Cipher Suites Supported" reported
• OCPBUGS-34692 - [4.17] Bootimage bump tracker
• OCPBUGS-34714 - No default region set in install-config survey
• OCPBUGS-34870 - Out-of-range error in AZ check
• OCPBUGS-33090 - UI inconsistency in topology when application grouping is collapsed
• OCPBUGS-33181 - Fix audit-logs container to respect SIGTERM
• OCPBUGS-33377 - NodePool not bringing up nodes due to: configmap is out of date, waiting for update 5c59871d != 48a6b276
• OCPBUGS-33383 - Admission webhook warning on Route and buildConfig creation
• OCPBUGS-33404 - Assisted installer reports installed SATA SDDs are removable and hangs the installation
• OCPBUGS-33410 - vsphere - The folder is not deleted after successfully destroying the capi cluster.
• OCPBUGS-33450 - BlueArrowCircleUpIcon on Dashboard details card is clipped
• OCPBUGS-33493 - baremetal operator not starting on assisted/agent installs
• OCPBUGS-33508 - [AWS CAPI install] custom AMI can not be applied to master machines
• OCPBUGS-33561 - [vSphere CAPI install] installconfig.platform.vsphere.diskType does not work
• OCPBUGS-33566 - Cloud credential operator logs two errors per second when awsSTSIAMRoleARN is empty
• OCPBUGS-33570 - [Nutanix CAPI install] IPI install with capi failed to set bootType
• OCPBUGS-33909 - ART requests updates to 4.17 image openshift-enterprise-base-container
• OCPBUGS-34355 - ART requests updates to 4.17 image configmap-reload-container
• OCPBUGS-34358 - ART requests updates to 4.17 image ose-image-customization-controller-container
• OCPBUGS-34359 - Network node identity uses unescaped IPv6 addresses in the ValidatingWebhookConfiguration
• OCPBUGS-34362 - ART requests updates to 4.17 image prom-label-proxy-container
• OCPBUGS-34364 - ART requests updates to 4.17 image openshift-enterprise-console-operator-container
• OCPBUGS-34372 - ART requests updates to 4.17 image ose-powervs-cloud-controller-manager-container
• OCPBUGS-34375 - ART requests updates to 4.17 image ose-openshift-apiserver-container
• OCPBUGS-34376 - ART requests updates to 4.17 image cluster-etcd-operator-container
• OCPBUGS-34379 - ART requests updates to 4.17 image ose-powervs-machine-controllers-container
• OCPBUGS-12699 - Proxy settings in buildDefaults preserved in image
• OCPBUGS-14613 - Don't fail integration due to too many goroutines
• OCPBUGS-1735 - [vsphere] Machine stuck in Provisioning status when machine is power off
• OCPBUGS-19048 - Can not identify "?perspective=acm" variable
• OCPBUGS-20061 - control-plane-machine-set goes Available=False with UnavailableReplicas during updates
• OCPBUGS-23000 - ClusterAutoscaler is evicting DaemonSet Pods
• OCPBUGS-32261 - metal3 pod's memory consumption seem to grow over time
• OCPBUGS-32467 - Ignition-server token secrets abandoned after hypershift-operator update
• OCPBUGS-32550 - UI is distorted for build labels in topology for Safari
• OCPBUGS-32696 - [4.16] - Data is not being loaded in Prometheus dashboard
• OCPBUGS-33005 - Pod stuck in creating state
• OCPBUGS-33082 - Data not obfuscated in hosted cluster with OVN when obfuscation is enabled
• OCPBUGS-33121 - oc-mirror v2 allows the usage of wrong flags
• OCPBUGS-33124 - After upgrading to 4.13 from 4.12 one of the worker node went into emergency mode.
• OCPBUGS-33129 - Panic when we remove an OCL infra MCP and we try to create new ones with different names
• OCPBUGS-33136 - Invalid filesystem query on compute nodes table
• OCPBUGS-33215 - Build Failure with BuildConfig from Git Repository Containing Nexus LFS Files
• OCPBUGS-33331 - nmstate-configuration.service failed due to wrong variable name $hostname_file
• OCPBUGS-33428 - Migrate HyperShift KAS to none endpoint reconciler type
• OCPBUGS-33453 - Need auth to access public images
• OCPBUGS-33524 - PTP Boundary HA configuration cannot handle spaced empty Phc2SysOpts and ptp4lOpts with
• OCPBUGS-33539 - Add default sorting column for VirtualizedTable component of dynamic plugin sdk
• OCPBUGS-33661 - aws: rename `preserverBootstrapIgnition` install-config option
• OCPBUGS-33671 - BuildController does not build multiple MachineOSBuilds that use canonicalized secrets
• OCPBUGS-34037 - GHSA-6wvf-f2vw-3425: ose-installer-container: containers/image allows unexpected authenticated registry accesses
• OCPBUGS-34050 - OpenShift won't start when instances shut down and restarted
• OCPBUGS-34066 - ART requests updates to 4.17 image ose-kube-storage-version-migrator-container
• OCPBUGS-34072 - ART requests updates to 4.17 image openstack-cluster-api-controllers-container
• OCPBUGS-34079 - Canonicalized pull secrets do not get updated when the original secret has changed
• OCPBUGS-34082 - Master network address collection fails in absence of hardware details
• OCPBUGS-34084 - ART requests updates to 4.17 image ose-cluster-kube-cluster-api-operator-container
• OCPBUGS-34085 - ART requests updates to 4.17 image ose-cluster-capi-operator-container
• OCPBUGS-34090 - ART requests updates to 4.17 image csi-driver-manila-operator-container
• OCPBUGS-34105 - ART requests updates to 4.17 image ose-gcp-cloud-controller-manager-container
• OCPBUGS-34106 - ART requests updates to 4.17 image ose-linuxptp-daemon-container
• OCPBUGS-34253 - ART requests updates to 4.17 image openshift-enterprise-helm-operator-container
• OCPBUGS-34381 - ART requests updates to 4.17 image ose-machine-api-provider-gcp-container
• OCPBUGS-34416 - [gcp] with N2D instance type, unexpectedly got error "Confidential Instance Config is only supported for compatible cpu platforms"
• OCPBUGS-34436 - ART requests updates to 4.17 image ose-multus-networkpolicy-container
• OCPBUGS-34442 - ART requests updates to 4.17 image openshift-enterprise-registry-container
• OCPBUGS-34461 - ART requests updates to 4.17 image openshift-enterprise-ansible-operator-container
• OCPBUGS-34462 - ART requests updates to 4.17 image ose-ovn-kubernetes-container
• OCPBUGS-34493 - ironic.service fails to start on bootstrap node when provisioning network is disabled
• OCPBUGS-34509 - Migrate HyperShift KAS to none endpoint reconciler type
• OCPBUGS-34516 - CatalogGrid Icons are sometimes stretched
• OCPBUGS-34524 - Post install featuregate enablement for egressfirewall doesn't work
• OCPBUGS-34534 - BM-IPI installation in FIPS mode failing with dev-scripts in OCP-4.16.0
• OCPBUGS-34538 - Deprecate PF4 and ReactRouter5 in SDK docs
• OCPBUGS-34544 - PersistentVolumeLabel admission plugin does not work
• OCPBUGS-34590 - Storage degraded by VSphereProblemDetectorStarterStaticControllerDegraded during uprading to 4.16.0-0.nightly
• OCPBUGS-34618 - vSphere UPI install fails during CAPI manifest creation
• OCPBUGS-34619 - Unit test TestImportOrdering fails in openshift/coredns
• OCPBUGS-34631 - ManagedField in YAML editor is not collapsed by default which is incorrect
• OCPBUGS-34649 - metal3-ironic-tls secret should have jira component annotation
• OCPBUGS-34650 - [HCP] Daemonset with attached PVC are not properly terminating when deleting nodes
• OCPBUGS-34653 - [4.17] Rebase openshift/etcd to 3.5.14
• OCPBUGS-34656 - [CI-Watcher] knative integration tests failing
• OCPBUGS-34959 - The PinnedImageSet controller can panic on techpreview clusters
• OCPBUGS-34969 - Power VS: Ports needed for private DNS are missing
• OCPBUGS-34975 - [internal] add spot instance support to control plane nodes
• OCPBUGS-34978 - Power VS: VPC network is not permitted for private DNS
• OCPBUGS-34986 - one OAuth.config.openshift.io item on Global Configuration page links to non-existing resource
• OCPBUGS-34987 - hypershift create iam cli-role missing Tag permissions
• OCPBUGS-35020 - [capi aws] don't use S3 stub ignition for masters
• OCPBUGS-35029 - linuxptp daemon taking almost 2 core with leap file updates
• OCPBUGS-35037 - [capi aws] delete S3 ignition bucket during bootstrap destroy
• OCPBUGS-35038 - [capi aws] missing interface implementation guard for BootstrapDestroyer
• OCPBUGS-35039 - PowerVS: Destroy DHCP in ERROR state
• OCPBUGS-35041 - [capi aws] installs fail with STS credentials
• OCPBUGS-35069 - Azure CPMS periodics are failing due to non-retryable API errors
• OCPBUGS-35073 - SNO Fix for API is unavailable after bootstrap server is destroyed
• OCPBUGS-35080 - replace global refresh sync lock in OIDC provider with per-refresh-token one
• OCPBUGS-35091 - ART requests updates to 4.17 image ose-ptp-operator-container
• OCPBUGS-35093 - ART requests updates to 4.17 image ose-kubevirt-csi-driver-container
• OCPBUGS-35096 - ART requests updates to 4.17 image ptp-operator-must-gather-container
• OCPBUGS-35097 - Add new regions that have added PER capabilities
• OCPBUGS-35099 - [gcp][CORS-2420] deploying compact 3-nodes cluster on GCP, by setting mastersSchedulable as true and removing worker machineset YAMLs, got panic
• OCPBUGS-35197 - [capi aws]Master is fetching ignition from the bootstrap MCS through proxy incorrectly
• OCPBUGS-35211 - metal3 pod produces too much logs and eats up the node disk space
• OCPBUGS-35215 - vsphere-problem-detector - checkDataStoreWithURL fails both in newly installed and freshly upgraded 4.14 clusters
• OCPBUGS-35218 - [4.17] v0 CI failures
• OCPBUGS-35801 - ocm-operator: panic detected in pod
• OCPBUGS-35833 - Misleading alert regarding high control plane CPU utilization in Single Node OpenShift (SNO) cluster
• OCPBUGS-35871 - ART requests updates to 4.17 image ose-powervs-block-csi-driver-operator-container
• OCPBUGS-35874 - Missing management cluster capabilities check on ovnkube-sbdb route removal
• OCPBUGS-35908 - [CI-Watcher] console-yaml-sample.cy.ts test flakes
• OCPBUGS-35948 - [console-plugin] Namespace spelling is wrong in task list page
• OCPBUGS-35952 - Autoscaler balance similar node groups failed on aws
• OCPBUGS-35971 - Workaround: Pods writing files larger than memory limit to PVCs tend to OOM frequently
• OCPBUGS-25331 - some events are missing time related infomration
• OCPBUGS-29744 - Alignment issue with the Breadcrumbs in the Task Selection QuickSearch
• OCPBUGS-29777 - [UI] RWOP accessMode is not available on OpenShift console UI
• OCPBUGS-30025 - missing pre-check for capabilities marketplace and OLM when setting basleineCapaiblitySet: v4.x (x<15)
• OCPBUGS-30218 - Console's pseudolocalization not working
• OCPBUGS-30860 - API is unavailable after bootstrap server is destroyed
• OCPBUGS-30948 - Cannot disable feature migration for egressIP during offline SDN migration
• OCPBUGS-30949 - CSI pods are not restarted when changing enable_topology value
• OCPBUGS-31522 - InstallPlan fails with "updated validation is too restrictive" when multiple CRD versions are served
• OCPBUGS-31848 - Clusterrolebindings remain in cluster if must-gather creation fails in the middle
• OCPBUGS-32141 - haproxy crashlooping fresh install Openshift 4.14.10
• OCPBUGS-33695 - [4.17] HCP oauth-openshift panics when anonymously curl'ed (not seen in OCP)
• OCPBUGS-33702 - dev-scripts fails bootstrapping OCP 4.16 and greater with MIRROR_IMAGES=true AND INSTALLER_PROXY=true
• OCPBUGS-33717 - UI should use type "bridge" instead of "cnv-bridge"
• OCPBUGS-33724 - 4.14.9 HCP cluster fails to update to any newer versions of OCP
• OCPBUGS-33735 - Delete GCP Bootstrap firewall rules as part of bootstrap deletion
• OCPBUGS-33745 - [CAPI install] failed to run command 'openshift-install destroy bootstrap'
• OCPBUGS-33756 - Display of "Auth Token GCP" filter in OperatorHub should be conditioned
• OCPBUGS-33775 - Do not generate idms & itms if nothing has been mirrored
• OCPBUGS-33787 - Console operator goes degraded on HyperShift HCP clusters with the ingress capability disabled
• OCPBUGS-33792 - Ingress Operator E2E test failing with prometheus service account not found
• OCPBUGS-33793 - Cluster Install with disabled Ingress capability does not disable Ingress
• OCPBUGS-33802 - Hosted cluster creation burst results in clusters taking a long time to get scheduled
• OCPBUGS-33897 - status: add an estimated time to complete the control plane update
• OCPBUGS-33907 - ART requests updates to 4.17 image ironic-static-ip-manager-container
• OCPBUGS-33910 - ART requests updates to 4.17 image ose-metallb-operator-container
• OCPBUGS-33913 - New registry pull secrets roll the control plane after 4.16 cluster updates
• OCPBUGS-33951 - IDMS/ICSP with only root registry are not propagated to the registry-override flag under ignition server
• OCPBUGS-34005 - Installer sometimes fails to attach the bootstrap FIP when additional networks are set
• OCPBUGS-34020 - When mirroring fails IDMS, ITMS resources are not generated
• OCPBUGS-34107 - ART requests updates to 4.17 image ose-cluster-image-registry-operator-container
• OCPBUGS-34109 - ART requests updates to 4.17 image ose-ovn-kubernetes-base-container
• OCPBUGS-34178 - ART requests updates to 4.17 image ose-cluster-config-operator-container
• OCPBUGS-34186 - ART requests updates to 4.17 image ose-ibm-cloud-controller-manager-container
• OCPBUGS-34196 - ART requests updates to 4.17 image ose-aws-cloud-controller-manager-container
• OCPBUGS-34199 - ART requests updates to 4.17 image ose-apiserver-network-proxy-container
• OCPBUGS-34250 - ART requests updates to 4.17 image ose-azure-cloud-node-manager-container
• OCPBUGS-34308 - ART requests updates to 4.17 image prometheus-config-reloader-container
• OCPBUGS-34316 - Manually Approve client CSR displays an unknown warning message
• OCPBUGS-34323 - must-gathers should import common.sh from the main repo
• OCPBUGS-34325 - ART requests updates to 4.17 image ose-baremetal-installer-container
• OCPBUGS-34327 - ART requests updates to 4.17 image openshift-enterprise-operator-sdk-container
• OCPBUGS-34339 - ART requests updates to 4.17 image ose-azure-cloud-controller-manager-container
• OCPBUGS-34341 - ART requests updates to 4.17 image ose-ibmcloud-machine-controllers-container
• OCPBUGS-34348 - ART requests updates to 4.17 image openshift-enterprise-keepalived-ipfailover-container
• OCPBUGS-34349 - ART requests updates to 4.17 image ose-cluster-openshift-apiserver-operator-container
• OCPBUGS-34360 - The must-gather took too long after upgrading to OpenShift 4.14
• OCPBUGS-34367 - ART requests updates to 4.17 image ose-cluster-kube-scheduler-operator-container
• OCPBUGS-34448 - MonitorTests erroring on hypershift cluster collection
• OCPBUGS-34778 - [4.16] Multicast packets got 100% loss
• OCPBUGS-34782 - kubelet-bootstrap-kubeconfig should have ownership annotations
• OCPBUGS-34791 - [CI-Watcher] add-flow-ci.feature is failing
• OCPBUGS-34819 - AWS bootstrapping failure due to missing MCS target groups
• OCPBUGS-34828 - [CI Watcher] Deploy git workload with devfile from topology page. Create the different workloads from Add page Deploy git workload with devfile from topology page
• OCPBUGS-34859 - Missing component in csr-signer-signer secret
• OCPBUGS-34862 - Inconsistent capitalization of "Import from git"
• OCPBUGS-34869 - PowerVS: fix AddIPToLoadBalancerPool
• OCPBUGS-34877 - oc adm prune deployments` does not work and giving panic when using --replica-set option
• OCPBUGS-34902 - CRIO test is failing on the RT Kernel
• OCPBUGS-34907 - TechPreviewNoUpgrade featureset should not be disabled
• OCPBUGS-34911 - Update owners file of multus repo
• OCPBUGS-34915 - [GCP CAPI install] network tags are not applied to control-plane machines
• OCPBUGS-34916 - Live migration still going on even though there is CIDR overlaps
• OCPBUGS-34918 - Bump go version from 1.21 to 1.22 of build_root image for the coredns-ocp-dnsnamresolver repo
• OCPBUGS-34920 - [TP] The extensions resource still exist
• OCPBUGS-34937 - Violation warning is not displayed for `minAvailable` in PDB Create/Edit form
• OCPBUGS-35400 - [GCP CAPI install] the optional "kmsKeyServiceAccount" is demanded for controlPlane unexpectedly
• OCPBUGS-35416 - Race condition in CPMS presubmits can cause not found error
• OCPBUGS-35420 - A non existant ID in additionalNetworkIDs causes an unhandled failure
• OCPBUGS-35426 - Non-existant additional network ID makes CAPO panic
• OCPBUGS-35450 - Remove KMS V1 provider support for IBM Cloud
• OCPBUGS-35462 - cloud-provider-openstack: TestNodeExpandVolume failure
• OCPBUGS-35464 - ART requests updates to 4.17 image cluster-version-operator-container
• OCPBUGS-35467 - Installer is ensuring userTags on subnets in BYO VPC deployments on AWS
• OCPBUGS-35469 - [Create for backport]add machine series 'A3' and 'C3D' to 'Tested instance types for GCP'
• OCPBUGS-35474 - infraID missing when creating aws hosted cluster
• OCPBUGS-35492 - Add info on obtaining preferred language tag
• OCPBUGS-35494 - ROSA STS Classic Cluster creation goes into error status sometimes with version 4.16.0-0.nightly-2024-06-14-072943
• OCPBUGS-35497 - build.sh now appears to require go v1.22
• OCPBUGS-35499 - update 4.16 CEO dev cert docs
• OCPBUGS-35504 - Feature parity with BYO Public IPv4 terraform in CAPA
• OCPBUGS-35511 - Reusing installer state causes HostedZoneAlreadyExists failure
• OCPBUGS-35519 - ARO-specific dnsmasq dependency causes dependency loop
• OCPBUGS-35528 - Load Red Hat keys in FIPS mode with Go 1.22
• OCPBUGS-35530 - aws bootstrap destroy due to awscluster modified
• OCPBUGS-35533 - Failed to deploy a cluster (failed to create security groups) when using 3 compact node cluster and dualstack IPv4
• OCPBUGS-35535 - network-edge Router case failed: not config proxy
• OCPBUGS-35547 - [vSphere] unexpected log traceback in terminal when installing cluster
• OCPBUGS-35727 - Ingress controller related certificates' validate dates gathering
• OCPBUGS-35754 - Metallb FRR-K8s: frr-k8s daemonset using quay.io/metallb/frr-k8s image
• OCPBUGS-25929 - Quick Start "next" button requires double click to move to next step
• OCPBUGS-29325 - CoreOS node stuck with message "A start job is running for CoreOS Trigger Multipath"
• OCPBUGS-29619 - Test for jira automation: Used as dummy bug for backports
• OCPBUGS-29729 - OLM - Set default CatalogSource pod SecurityContext as `restricted`
• OCPBUGS-33682 - The setting of NTO cloud provider doesn't work
• OCPBUGS-33840 - Warn before trimming a long cluster name
• OCPBUGS-33869 - i18n - Download and merge French and Spanish languages translations in the OCP Console
• OCPBUGS-33892 - ART requests updates to 4.17 image ironic-rhcos-downloader-container
• OCPBUGS-34144 - ART requests updates to 4.17 image ose-cluster-cloud-controller-manager-operator-container
• OCPBUGS-34151 - ART requests updates to 4.17 image ose-cluster-autoscaler-operator-container
• OCPBUGS-34153 - ART requests updates to 4.17 image prometheus-operator-admission-webhook-container
• OCPBUGS-34255 - ART requests updates to 4.17 image ose-machine-api-provider-aws-container
• OCPBUGS-34264 - ART requests updates to 4.17 image golang-github-prometheus-prometheus-container
• OCPBUGS-34274 - AWS - CPO can use incorrect CIDR range on the default worker security group
• OCPBUGS-34281 - ART requests updates to 4.17 image ose-cluster-kube-controller-manager-operator-container
• OCPBUGS-34287 - ART requests updates to 4.17 image cluster-version-operator-container
• OCPBUGS-34295 - CAPI installer fails to get ip addresses for bootstrap gather
• OCPBUGS-34297 - ART requests updates to 4.17 image golang-github-prometheus-alertmanager-container
• OCPBUGS-34299 - ART requests updates to 4.17 image ose-prometheus-adapter-container
• OCPBUGS-34302 - ART requests updates to 4.17 image ose-cloud-network-config-controller-container
• OCPBUGS-34368 - ART requests updates to 4.17 image ose-installer-artifacts-container
• OCPBUGS-34667 - Azure HostedClusters failing to complete due to cluster-storage-operator
• OCPBUGS-34683 - Illogical shared module warnings when building Kubevirt dynamic plugin
• OCPBUGS-34684 - i18n upload/download routine task - sprint 254
• OCPBUGS-34699 - cluster-network-operator role doesn't have access to root-ca
• OCPBUGS-34706 - IPv6 ingress VIP not configured in keepalived on vSphere Dual-stack
• OCPBUGS-34713 - [AWS] securityGroups and subnet don?t keep consistent in machine yaml and on aws console
• OCPBUGS-34720 - Add tier0 and tier1 tags to Non-reboot functional test cases
• OCPBUGS-34938 - Old resources in test environment lead to race condition
• OCPBUGS-34948 - [release-4.17] Upgrade distribution/distribution to a released version
• OCPBUGS-35236 - CVO fails to validate signatures: signatureStores is an empty array
• OCPBUGS-35252 - [4.17][HyperShift] don't enforce PSa
• OCPBUGS-35279 - Fix spelling in oc-mirror delete functionality (console ending)
• OCPBUGS-35293 - 4.16 CAPI installer is unable to create AWS V2 loadbalancer Security Groups
• OCPBUGS-35309 - 4.16 bootstrap AWS S3 bucket fails to be created with s3 bucket policy
• OCPBUGS-35315 - capi installer reconciliation takes longer than necessary
• OCPBUGS-35316 - Live migration gets stuck when the ConfigMap MTU is absent
• OCPBUGS-35335 - Failed to pull/push blob from/to image registry on external OIDC cluster
• OCPBUGS-35349 - ART requests updates to 4.17 image ose-powervs-block-csi-driver-container
• OCPBUGS-35356 - TestIngressControllerRouteSelectorUpdateShouldClearRouteStatus the object has been modified flake
• OCPBUGS-35368 - TestAllowedSourceRangesStatus expected the annotation to be reflected in status.allowedSourceRanges flake
• OCPBUGS-35376 - Fix console server's sessions pruning
• OCPBUGS-35397 - Add runbook_url for the PrometheusDuplicateTimestamps alert
• OCPBUGS-23922 - [HCP] APIServer CR is not synced to the hosted cluster
• OCPBUGS-25341 - [4.17] The certificate relating to operator-lifecycle-manager-packageserver isn't rotated after expired
• OCPBUGS-28974 - Machine stuck in Provisioned when the cluster is upgraded from 4.1 to 4.15
• OCPBUGS-29687 - metal3 reads secrets from environment variables, which is not CIS Compliant
• OCPBUGS-30276 - IBU x->y->z with no rhcos delta results in ostree corruption
• OCPBUGS-30603 - Bootstrap e2e test featuregate setup does not match the actual code
• OCPBUGS-30841 - PAC: PLRs log link is broken
• OCPBUGS-32439 - Can't install operator on 4.15 after uninstalling it on a prior version
• OCPBUGS-33060 - HCP missing audit log configuration for oauth-openshift (OAuth server)
• OCPBUGS-34173 - Catalog operator pod crashed during SNO cluster installation
• OCPBUGS-34225 - ART requests updates to 4.17 image ose-machine-config-operator-container
• OCPBUGS-34230 - ART requests updates to 4.17 image ose-nutanix-machine-controllers-container
• OCPBUGS-34242 - ART requests updates to 4.17 image ose-vertical-pod-autoscaler-container
• OCPBUGS-34283 - ART requests updates to 4.17 image ose-multus-admission-controller-container
• OCPBUGS-34351 - ART requests updates to 4.17 image ose-haproxy-router-base-container
• OCPBUGS-34413 - Cluster-ingress-operator logs an update when one didn't happen
• OCPBUGS-34820 - Removing imageContentSources from HostedCluster does not update IDMS
• OCPBUGS-34901 - Operand details page shows incorrect API version
• OCPBUGS-34906 - openshift/api verify-crd-schema job fails for IngressController CRD
• OCPBUGS-35190 - Add leap file management upstream documentation
• OCPBUGS-35342 - Implement e2e test for the connect timeout
• OCPBUGS-35347 - ovs-vswitchd is using isolated cpu pool instead of reserved pool
• OCPBUGS-35367 - ovnkube-node-* crashed when node deleted
• OCPBUGS-35382 - [GCP CAPI install] failed to create control-plane machines using GCP marketplace image
• OCPBUGS-35410 - Resizing LUKS on 512e disk causes ignition-ostree-growfs to fail with "Device size is not aligned to requested sector size."
• OCPBUGS-35436 - Tracker: RHEL-44418 - Pods writing files larger than memory limit to PVCs tend to OOM frequently
• OCPBUGS-35444 - Add promotion stanza in openshift/coredns-ocp-dnsnameresolver CI config for automated branching
• OCPBUGS-35521 - hcp cli does not contain --infra-volumesnapshot-class-mapping cli art
• OCPBUGS-35542 - [CAPI install] envtest.kubeconfig is not deleted when destroying cluster
• OCPBUGS-35559 - Firmware Update causes BMH to get stuck in Preparing
• OCPBUGS-35752 - OpenShift Installer on AWS: EKS CAPA is enabled by default
• OCPBUGS-35798 - PowerVS: Liveness probe error
• OCPBUGS-35804 - PTP operator showing high cpu utilization with steady workload on OCP 4.15
• OCPBUGS-35852 - [CAPI Install] Fail to collect applied cluster api manifests when setting ENV OPENSHIFT_INSTALL_PRESERVE_BOOTSTRAP
• OCPBUGS-35879 - Topology view shows "TypeError: Cannot read properties of null (reading 'metadata')"
• OCPBUGS-35882 - InsightsRecommendationActive description link invalid
• OCPBUGS-35905 - ca-bundle.crt is not injected in the global-ca configmaps from builds in HCP cluster
• OCPBUGS-35940 - Create RoleBinding will trigger Admission Webhook Warning
• OCPBUGS-35953 - [release-v1.15.x] Namespace spelling is wrong in task list page
• OCPBUGS-35968 - ironic-agent container build should support FIPS
• OCPBUGS-35970 - [release-4.17] no RHEL8 version of opm
• OCPBUGS-35979 - Old machines not deleted when rolling out a new config
• OCPBUGS-35994 - Block all z rollbacks again
• OCPBUGS-35996 - Orphaned i18n files in packages/kubevirt-plugin
• OCPBUGS-36140 - GCP cluster with CCO Passthrough mode failed to install due to CCO degraded
• OCPBUGS-36142 - [CAPI Azure] Fail to create cluster with only Gen2-supported instance type
• OCPBUGS-36169 - MultipleDefaultStorageClasses alert should deactivate immediately after being fixed
• OCPBUGS-36176 - PowerVS: Add ibmcloud plugins
• OCPBUGS-36183 - 'oc adm prune renderedmachineconfigs' dry-run wording
• OCPBUGS-36185 - [IBMCloud] MAPI only checks first set of subnets (no pagination support)
• OCPBUGS-36214 - [oc-mirror][v2]DiskToMirror should not require internet access
• OCPBUGS-36230 - Proxy is not taken into consideration when generating user data
• OCPBUGS-36260 - Tooltip on Pipeline when expression is not shows
• OCPBUGS-36276 - [knmstate] Need to update current master branch version to 4.17
• OCPBUGS-36284 - etcd data store is leftover when infrastructure provisioning fails
• OCPBUGS-36301 - [4.17] Should run health checks in parallel to avoid spurious Available=False EtcdMembers_NoQuorum claims
• OCPBUGS-36309 - The browser tab tile is incorrect when going to create new secret page
• OCPBUGS-36316 - [Power VS] Private DNS zone cannot be used if no permitted network is added
• OCPBUGS-36318 - [4.17] Bootimage bump tracker
• OCPBUGS-36339 - The option "Auto deploy when new image is available" becomes unchecked when editing a deployment from web console
• OCPBUGS-36344 - use-sigstore-attachments should cover relevant mirrors too
• OCPBUGS-36352 - baremetalds-ipi-pre workflows failed due to low GLIBC version.
• OCPBUGS-36363 - 4.14 PowerVS CI jobs are failing with error-" yq-v4: not found"
• OCPBUGS-36378 - [CAPI Azure] capi processes are still running when installer failed to start cluster-api-provider-azureaso and exited
• OCPBUGS-36399 - metal serial jobs failing tests due to etcd errors
• OCPBUGS-36402 - [azure-workload-identity] Rename Dockerfile
• OCPBUGS-36406 - PrometheusOperatorRejectedResources should link its runbook
• OCPBUGS-36407 - [cluster-etcd-operator] Rename Dockerfile
• OCPBUGS-36424 - DeploymentConfigs deprecation info alert should not present on the Edit deployment page
• OCPBUGS-36455 - [csi-external-attacher] Rename Dockerfile
• OCPBUGS-36456 - [csi-livenessprobe] Rename Dockerfile
• OCPBUGS-36458 - [ocp-release-operator-sdk] Rename Dockerfile
• OCPBUGS-36465 - OCP upgrade from 4.13 to 4.14 triggers the error "failed to update canary route openshift-ingress-canary/canary"
• OCPBUGS-36469 - [AWS] Use invalid placementGroupPartition 0 create machine success
• OCPBUGS-36528 - [cluster-csi-snapshot-controller-operator] Rename Dockerfile
• OCPBUGS-36651 - CRT Test Bug
• OCPBUGS-36672 - 3 etcd tests taking 40min in serial jobs
• OCPBUGS-36681 - Azure HC fails to create AzureMachineTemplate if a MachineIdentityID is not provided
• OCPBUGS-36684 - Disable cluster-olm-operator to fix merges
• OCPBUGS-36686 - Re-enable cluster-olm-operator to fix merges
• OCPBUGS-36687 - IO Enhancement: Start collecting haproxy_exporter_server_threshold metric
• OCPBUGS-36713 - [GCP CAPI install] failed to install with existing VPC/subnets
• OCPBUGS-36768 - Cherry-pick Prometheus remote-write bug fix up to 4.17
• OCPBUGS-36779 - 3rd master still not joining to the cluster on ABI
• OCPBUGS-14963 - [IBMCLOUD] New VPC regions not GA'd cause failures during resource lookup
• OCPBUGS-23758 - When switching from ipForwarding: Global to Restricted, sysctl settings are not adjusted
• OCPBUGS-31047 - Missing dependency warning error in console UI dev env
• OCPBUGS-31250 - alert for metrics endpoint at port 9537 shows connection refused for windows nodes
• OCPBUGS-31664 - IngressController status says "kube-controller-manager" when it should say "cloud-controller-manager"
• OCPBUGS-31685 - Cannot create web-terminals as kubeadmin on OpenShift 4.15+
• OCPBUGS-31840 - Failed to provision private HC on AWS
• OCPBUGS-33406 - scanners complaint about github.com/moby/buildkit version
• OCPBUGS-33486 - 4.14: Build Tests Reference EOL Ruby Image
• OCPBUGS-33490 - Update Docs links for "Learn More" in Display Warning Policy Notification
• OCPBUGS-33521 - [console-plugin] Update sorting in pipeline, pipelineRun and TaskRun list pages
• OCPBUGS-33715 - Reduce the number of calls to the subscriptions fetchOrganization endpoint from console-operator
• OCPBUGS-33801 - Running local console with authentication appears to no longer work
• OCPBUGS-33973 - Openstack UPI - Reintroduce unique resource names
• OCPBUGS-34126 - ART requests updates to 4.17 image ose-cluster-olm-operator-container
• OCPBUGS-34193 - ART requests updates to 4.17 image nmstate-console-plugin-container
• OCPBUGS-34451 - ART requests updates to 4.17 image ose-aws-ebs-csi-driver-operator-container
• OCPBUGS-34471 - ART requests updates to 4.17 image openshift-enterprise-haproxy-router-container
• OCPBUGS-34708 - [AWS] install failed with featureSet CustomNoUpgrade is configured
• OCPBUGS-35188 - [aws] remove terraform configs
• OCPBUGS-35484 - [GCP CAPI install] installing a private cluster created forwarding-rule / target-tcp-proxy / address "<infra id>-apiserver" unexpectedly
• OCPBUGS-35926 - Debounce not working in Import from Git form
• OCPBUGS-35928 - PatternFly warnings issued during webpack build of ODF Console Plugin
• OCPBUGS-35999 - Remove duplicate code in storage module
• OCPBUGS-36495 - better handling of deprecated parameter in cluster-monitoring-config
• OCPBUGS-36496 - Very high ts2phc offsets reported in linuxptp log while metrics show ts2phc clock_state is locked and GM clock_state is FREERUN
• OCPBUGS-36522 - [aws-pod-identity-webhook] Rename Dockerfile
• OCPBUGS-36523 - [api] Rename Dockerfile
• OCPBUGS-36801 - Disable serverless tests
• OCPBUGS-19537 - OCB pools with yum based RHEL nodes are degraded
• OCPBUGS-29705 - catalogd-controller-manager pod request CPU is high
• OCPBUGS-29838 - Ironic inspection fails with ipv6 and proxy
• OCPBUGS-30889 - No access to list pipelines.tekton.dev prevents from using Delete application form
• OCPBUGS-30955 - edit nncp to update dns nameserver failed
• OCPBUGS-32348 - No ability to debug node-ip detection logic
• OCPBUGS-32678 - Panic in cluster version operator code
• OCPBUGS-33134 - Nodes are drained twice when an OCB image is applied
• OCPBUGS-33895 - ART requests updates to 4.17 image ose-frr-container
• OCPBUGS-33959 - gather_network_logs_basics script when node is in the NotReady
• OCPBUGS-34216 - ART requests updates to 4.17 image ose-olm-catalogd-container
• OCPBUGS-34229 - ART requests updates to 4.17 image ose-cluster-dns-operator-container
• OCPBUGS-34246 - ART requests updates to 4.17 image ose-azure-cluster-api-controllers-container
• OCPBUGS-34288 - ART requests updates to 4.17 image ose-gcp-cluster-api-controllers-container
• OCPBUGS-34347 - ART requests updates to 4.17 image ose-cloud-credential-operator-container
• OCPBUGS-34382 - ART requests updates to 4.17 image ose-aws-cluster-api-controllers-container
• OCPBUGS-34387 - RHOCP Web Console - One inactive/idle tab causes session expiry for all other tabs.
• OCPBUGS-34638 - [GCP NVIDIA H100] "destroy cluster" will hang at "VM has a Local SSD attached but an undefined value for 'discard-local-ssd'" when trying to stop the A3 instance
• OCPBUGS-34953 - Log bundle analizer gives bogus analyze when failing to download bootstrap logs
• OCPBUGS-35016 - Update to azidentity v1.7.0
• OCPBUGS-35277 - openshift-config-user-ca-bundle.crt file is rebooting the nodes when techpreview is enabled
• OCPBUGS-35282 - GHSA-6wvf-f2vw-3425: ose-installer-container: containers/image allows unexpected authenticated registry accesses
• OCPBUGS-35301 - Pipelines -> Pipelines -> Add Trigger -> Git provider type: i18n misses
• OCPBUGS-35366 - UPI docs do not reference correct internal api name
• OCPBUGS-35440 - [aws capi] unnecessary revoke-authorize ingress rules loop
• OCPBUGS-35483 - `PrometheusRemoteStorageFailures` alert failed to trigger
• OCPBUGS-35587 - T-GM : ts2phc process restart doesn't update PTP syncState when the process recovered
• OCPBUGS-35906 - Featuregate taking invalid value
• OCPBUGS-35959 - [CAPI Azure] AcceleratedNetworking is always disabled whatever setting in install-config
• OCPBUGS-36175 - Several OPNET containers run privileged
• OCPBUGS-36195 - ovnkube-controller crash loop because of bad certificate
• OCPBUGS-36238 - NNCP bridge STP unchecked but stp enabled on node
• OCPBUGS-36361 - [CAPI Azure] Fail to create cluster by auth installer with managed identity from Azure VM
• OCPBUGS-36390 - [aws] "create" iam role permissions required even when BYO role
• OCPBUGS-36410 - Content mirrored with oc-mirror v2 does not push openshift/release images to registry
• OCPBUGS-36425 - HostFirmwareComponents doesn't show the new firmware information in Status Components
• OCPBUGS-36521 - [image-registry] Rename Dockerfile
• OCPBUGS-36678 - QuickStartContext should be exposed via the dynamic plugin SDK
• OCPBUGS-36689 - OLM resources partially deployed
• OCPBUGS-36750 - Use a specific branch/tag for the cloned coredns for build in openshift/coredns-ocp-dnsnameresolver
• OCPBUGS-36833 - 4.16 "Bad" reconciliation loops can cause unbounded dockercfg secret creation
• OCPBUGS-36865 - [UDN] Restarting ovn pods will break the primary network traffic
• OCPBUGS-36872 - Locales base path is not respected
• OCPBUGS-36897 - 4.16 NodePool CEL validation breaking existing NodePools
• OCPBUGS-36904 - Subnets created by the installer are tagged as shared
• OCPBUGS-36909 - [Power VS] Port 5000 is not added during restricted installation with Terraform
• OCPBUGS-36913 - RHOCP installation on Openstack fails with error "failed to tag the Control plane security group"
• OCPBUGS-36932 - Hosted control planes: IDP communication through Konnectivity does not respect outgoing HTTP/s PROXY in DataPlane
• OCPBUGS-36970 - Monitoring console alerting page Not found
• OCPBUGS-37100 - periodical check for SCA and cluster transfer doesn't work correctly due to informer resync
• OCPBUGS-37102 - Multiple KMS encryption providers specified in single element for IBM Cloud
• OCPBUGS-37104 - Setting controlPlanePort network without setting a subnet filter gives a confusing error message
• OCPBUGS-37107 - Power VS: CAPI - SNAT is not disabled when specifying imageContentSources
• OCPBUGS-37111 - Fix that PodIP field is temporarily removed for a terminal pod
• OCPBUGS-37154 - Missing permissions for Azure Reserved Capacity Group
• OCPBUGS-37161 - 4.13-upgrade-from-stable-4.12-gcp-ovn-rt job failing
• OCPBUGS-37201 - Triage: Low install success on vsphere
• OCPBUGS-37207 - Power VS: Image registry operator Endpoint override hooks are unreachable due to casing
• OCPBUGS-37217 - GCP CAPI - concurrent IAM policy errors
• OCPBUGS-37222 - hypershift ignition server uses RHEL major version mismatched MCO binaries
• OCPBUGS-37244 - update prometheus clone to 2.53.1
• OCPBUGS-37261 - wrong idrac-redfish management interface in BMO in redfish module
• OCPBUGS-37271 - PSI causing latency issues
• OCPBUGS-37291 - "S is not a function" error in the admin console graph
• OCPBUGS-37334 - Resolve snyk issue: k8s.io/client-go/transport [4.17]
• OCPBUGS-37345 - Open limited z rollbacks again
• OCPBUGS-37403 - Localnet NAD incorrectly displayed
• OCPBUGS-37427 - When vsphere bootstrap fails ipv6 address is used over ipv4 in gather
• OCPBUGS-37436 - ovn-techpreview job is failing continuously due to telemetry series count > 750
• OCPBUGS-37455 - Monitoring failing to install on vsphere
• OCPBUGS-37486 - Cannot reach to kubernetes.default.svc.cluster.local from workers of Hosted Cluster
• OCPBUGS-37544 - [OLMV1] the cluster-olm-operator doesn't output version info
• OCPBUGS-37620 - Bump to kubernetes 1.30.3
• OCPBUGS-37627 - TestMTLSWithCRLs E2E flake: failed to find host name
• OCPBUGS-37713 - iptables-alerter logs spurious events under heavy load
• OCPBUGS-37715 - Multiple MachineConfigs in one CM
• OCPBUGS-37718 - cluster-capi-operator: out-of-date openstack e2e branch
• OCPBUGS-37753 - discoverOpenIDURLs and checkOIDCPasswordGrantFlow fail if endpoints are private to the data plane
• OCPBUGS-37786 - HCP: nodes never become available when workers require a proxy to access KAS
• OCPBUGS-37802 - Build option is selected as Shipwright on edit if created the deployment using BuildConfig
• OCPBUGS-37832 - HCP CCMs attempt direct internet access with proxied management cluster
• OCPBUGS-37934 - Remove disruptive code from cpo
• OCPBUGS-37985 - Disk sizing issue for 4.17-upgrade-from-stable-4.16-e2e-metal-ipi-ovn-upgrade
• OCPBUGS-23332 - The Utilization of CPU and memory looks not correct on node overview page
• OCPBUGS-23957 - metal-ipi-ovn-dualstack-local-gateway perma failing since 4.14
• OCPBUGS-29660 - [Metal3] provisioning-configuration should ignore provisioning options when the provisioning network is disabled
• OCPBUGS-29664 - When node shutdown, the Pod whereabouts IP cannot be released (for a stateless application)
• OCPBUGS-33397 - Openshift uncordoned compute-node that was intentionally cordoned
• OCPBUGS-33750 - Sometimes dns name configured in EgressFirewall was not resolved
• OCPBUGS-33758 - Incorrect OVN-K alerts pre & post IC (was: There is no runbook url for alert OVNKubernetesNorthdInactive)
• OCPBUGS-35731 - Race condition when deleting ServiceAccount
• OCPBUGS-36289 - TestMCDGetsMachineOSConfigSecrets e2e test occasionally fails
• OCPBUGS-36296 - Cluster API should sort CredentialsRequest manifests after namespace
• OCPBUGS-36302 - [CAPI Azure] It does not take effect when enabling disk encryption set in install-config
• OCPBUGS-36614 - While upgrading from 4.12.55 to 4.13.42, the network operator goes in a degraded state due to the ovnkube-master pods ending up in a crashloopbackoff.
• OCPBUGS-36619 - Switch to use annotations as labels from PipelineRuns created through Pipelines as Code is deprecated
• OCPBUGS-36621 - Etcd operator degraded on etcd-all-bundles 404
• OCPBUGS-36654 - Machine-config operator should not hot loop generating ValidatingAdmissionPolicyUpdated events
• OCPBUGS-37054 - 'View all steps in documentation' link should be hidden for ROSA and OSD
• OCPBUGS-37055 - [v2] proxy configuration not respected when mirroring releases
• OCPBUGS-37071 - ART requests updates to 4.17 image ose-ptp-operator-container
• OCPBUGS-37084 - [ironic-image] update to latest ironic projects version
• OCPBUGS-37086 - [ironic-agent-image] update to latest ironic projects version
• OCPBUGS-37625 - DedicatedServingScheduler: creating HostedClusters greater than small size may not succeed
• OCPBUGS-37633 - vsphere-problem-detector-operator failed to list *v1.ClusterCSIDriver and restarted
• OCPBUGS-37686 - errors in Documentation/resources.md
• OCPBUGS-37698 - Lack of MCE-2.7 builds
• OCPBUGS-37709 - TechPreview Job Failing after ovn-kubernetes update
• OCPBUGS-17506 - Make ValidatePrometheus status more accurate and its logs clearer
• OCPBUGS-31298 - Machine-config controller should not make no-op makeMasterNodeUnSchedulable patches
• OCPBUGS-35209 - Centos8 is EOL Update to 9
• OCPBUGS-35256 - Creating GCP Private Cluster results in "wrongSubnetwork" error
• OCPBUGS-36462 - control-plane-machine-set goes Available=False with UnavailableReplicas during etcd scale testing
• OCPBUGS-36500 - Platform Prometheus unable to discover targets from openshift-operator-lifecycle-manager
• OCPBUGS-36660 - 4.17 default channel incorrectly points to stable-4.16
• OCPBUGS-37488 - [AWS EBS CSI Driver] could not provision ebs volume succeed on cco manual mode private clusters
• OCPBUGS-37540 - [CAPI Azure] Failed to connect to bootstrap machine when gathering bootstrap log
• OCPBUGS-37541 - No response from applications exposed via NodePort when client ephemeral port is 22623 or 22624
• OCPBUGS-37594 - [CAPI Azure] architecture for gallery image is still x64 when specifying controlPlane.architecture to arm64
• OCPBUGS-37667 - IBM Operator Index Image fails with "cache requires rebuild: cache reports digest as xxx, but computed digest is yyy"
• OCPBUGS-37821 - Installer support for GCP deployments using short-lived credential formats
• OCPBUGS-37822 - New permissions required to create labels with capg
• OCPBUGS-37837 - etcd vertical scaling test should not rely on CPMS status.readyReplicas
• OCPBUGS-37865 - Automate OCPBUGS-35347 (ovs-vswitchd is using isolated cpu pool instead of reserved pool)
• OCPBUGS-37991 - Network status annotations should be reflective of multiple interface returns in CNI results
• OCPBUGS-38009 - Infra nodes install with invalid security group filter for 4.14/4.15 managed clusters
• OCPBUGS-38036 - Cypress videos are missing in CI
• OCPBUGS-38041 - EnsureHostedClusterImmutability check does not handle 409 conflict
• OCPBUGS-38055 - installer/aws/edge-zones: Provisioning edge nodes is failing for 'parameter iamInstanceProfile.name is invalid'
• OCPBUGS-38079 - Bump cluster-ingress-operator to client-go v0.30 and controller-runtime v0.18
• OCPBUGS-38101 - Bump router to Kubernetes 1.30
• OCPBUGS-38119 - Potentially wrong junit test report name
• OCPBUGS-38176 - Add openshift-cnv ass CNO global namespaces
• OCPBUGS-38244 - [GCP CAPI install] installing into Shared VPC stuck in waiting for network infrastructure ready
• OCPBUGS-38257 - techpreview cluster image policy generator mismatch on bootstrap vs runtime - breaking installs
• OCPBUGS-38321 - 4.18 && 4.17 Payload Disruption Failures
• OCPBUGS-38334 - Update admins to add CFE members
• OCPBUGS-38356 - Failure: Operator progressing (NeedsUpdateReplicas): Observed 3 replica(s) in need of update
• OCPBUGS-38364 - [Pre-Merge-Testing] [UDN CRD API] Failed to create NetworkAttachmentDefinition for namespace scoped CRD in layer3
• OCPBUGS-38374 - 4.12 -> 4.13 upgrade using IPI on Azure does not work
• OCPBUGS-38387 - User should not be allowed to set different architectures for the worker and edge compute machine pools
• OCPBUGS-38389 - [release-4.17] "OpenShift LightSpeed" should be "OpenShift Lightspeed" on getting started resource card of overview page
• OCPBUGS-38393 - Update GCP userLabels and userTags configs description
• OCPBUGS-38438 - mce-2.7 and main HyperShift Operator Konflux builds need to be split post branch
• OCPBUGS-38439 - Power VS: Madrid cannot use e980 as a system type
• OCPBUGS-38453 - [release-4.17] Use RHEL8 for downstream ansible-operator image
• OCPBUGS-38501 - [4.17] Update git submodules
• OCPBUGS-38522 - One master node profile is degraded after cluster shudown and power on
• OCPBUGS-38540 - [Backport 4.17] CI TestAWSEIPAllocationsForNLB and TestAWSLBSubnets DNS flakes
• OCPBUGS-38562 - No error handling in iptables healthcheck
• OCPBUGS-8659 - The Catalog Operator attempts to connect to deleted catalogSources
• OCPBUGS-34057 - ART requests updates to 4.17 image kube-rbac-proxy-container
• OCPBUGS-34248 - ART requests updates to 4.17 image oauth-server-container
• OCPBUGS-36765 - When deleting private cluster backend-service is not getting removed
• OCPBUGS-37772 - Disable intree to CSI migration for multi-vcenter clusters
• OCPBUGS-38246 - [GCP CAPI install] Shared VPC installation using service account having all required permissions failed due to cluster operator ingress degraded
• OCPBUGS-38363 - 50-100% increase in watch count for all operators
• OCPBUGS-38375 - snyk: google.golang.org/grpc/metadata [4.17]
• OCPBUGS-38398 - Cannot use new proxy settings in Alertmanager configuration
• OCPBUGS-38410 - Update CPO and HO base images after branching
• OCPBUGS-38412 - Values entered into the Instantiate Template form are automatically cleared
• OCPBUGS-38415 - High rate of metal bm install failures on 4.17
• OCPBUGS-38423 - Unexpected stat errors can prevent creation of keepalived sentinel iptables file
• OCPBUGS-38442 - vSphere CSI driver does not restart on config file change
• OCPBUGS-38465 - [4.17] Name attribute should not be mandatory on StorageControllers using Redfish
• OCPBUGS-38469 - unable to build graph image in enclave environment
• OCPBUGS-38488 - Backport "AGENT-938: Enhance console logging to display node ISO expiry" date during addNodes workflow
• OCPBUGS-38539 - clusterresourceoverride deployment does not reconcile if the CR is edited inplace
• OCPBUGS-38560 - Invalid configuration for device 0 error with openshift-installer for vsphere
• OCPBUGS-38569 - vsphere: install-config allows configuration of multiple NICs
• OCPBUGS-38580 - [dpu-operator] fix manifests
• OCPBUGS-38600 - [gcp] Global apiserver address not removed on destroy
• OCPBUGS-38602 - [CAPI Azure] master instances are not created per zone when installing cluster with default configuration
• OCPBUGS-38605 - [Backport 4.17]Unexpected featuregate "ExternalRouteCertificate" added in openshift/api
• OCPBUGS-38616 - vsphere - when folder is undefined and datacenter is in a folder, entire folder path is incorrectly created
• OCPBUGS-38637 - [release-4.17] LDAP communication going through HTTP(S) proxy
• OCPBUGS-38643 - CPMS Periodics not waiting for etcd operator to complete rollouts
• OCPBUGS-38644 - [release-4.17] The troubleshooting panel trigger is not visible in the application launcher
• OCPBUGS-38646 - [Backport 4.17] the "classicLoadBalancer" is still in ingresscontroller status after changing LB type from CLB to NLB
• OCPBUGS-38653 - [4.17] EgressIP intermittent connection timeout while communicating with external services
• OCPBUGS-38677 - capv session timeout
• OCPBUGS-38691 - e2e test "Helm release status verification: HR-01-TC04" is failing
• OCPBUGS-38692 - Openshift Installer: create a cluster in AWS with public subnets only
• OCPBUGS-38700 - [CAPI Azure] installer storage account creation failed with long storageAccountName
• OCPBUGS-38710 - promote feature from Tech Preview to Accessible-by-default
• OCPBUGS-38730 - Fix typo in info message
• OCPBUGS-38736 - [4.17] Some driver containers missing terminationMessagePolicy
• OCPBUGS-38738 - [CAPI Azure] Fail to create cluster on AzureUSGovernmentCloud
• OCPBUGS-38790 - [4.17] Get hypershift-kubevirt conformance tests on Azure pass
• OCPBUGS-38804 - PTP events oran compliant API (v2) reports send error 400.
• OCPBUGS-38808 - Show deprecated operators in OperatorHub
• OCPBUGS-38815 - [4.17] aws-efs-csi-driver reads credentials from environment variables
• OCPBUGS-38829 - [release-4.17] Bump community.docker to 3.10.3
• OCPBUGS-38832 - [aws] add validation for public-only subnets workflows
• OCPBUGS-38846 - Machine-config daemon ListPools panic during tech-preview CI runs
• OCPBUGS-38867 - [release-4.17] Add support for downstream e2e cases for ansible-operator-plugins
• OCPBUGS-38885 - Image registry unable to run due to permissions error
• OCPBUGS-38917 - [release-4.17] Bump kubernetes.core to v2.4.2 for ansible-operator-plugins
• OCPBUGS-38932 - Backport networking-console-plugin to 4.17
• OCPBUGS-38941 - hypershift periodic conformance are failing due to coreos changes
• OCPBUGS-38950 - cloud events consumer reports error 400 and stops receiving events after modifying ptpconfig
• OCPBUGS-38954 - [CI-Watch]: pseudolocalizes navigation: Localization pseudolocalizes navigation
• OCPBUGS-38958 - [4.17] UserNamespacesSupport should mark a cluster tech preview
• OCPBUGS-39012 - Change the operator-sdk base image from rhel8 to rhel9
• OCPBUGS-33171 - Tag ENIs during ec2:RunInstance instead of after creation
• OCPBUGS-34305 - ART requests updates to 4.17 image networking-console-plugin-container
• OCPBUGS-34679 - revert "force cert rotation every couple days for development" in 4.17
• OCPBUGS-34942 - Update APIRemovedInNextReleaseInUse for kube 1.30 / ocp 4.17
• OCPBUGS-35054 - [AWS CAPI install] Network setting is not correct while install cluster into VPC which contains multi-CIDR subnets
• OCPBUGS-38427 - [release-4.17] In Cluster settings, version text is black when in dark mode on firefox
• OCPBUGS-38591 - Add support for GCP Workload Identity / Federated identity operator installs
• OCPBUGS-38615 - [release-4.17] Content and navigation improvements for OLS popup
• OCPBUGS-38690 - Prometheus no longer accepts samples of the same series with different timestamps
• OCPBUGS-38841 - openshift-installer shall fail when the arch in release payload mismatch with the VM
• OCPBUGS-38934 - Nutanix: failed to install OCP cluster with DHCP network (regression with the 4.16 installer)
• OCPBUGS-38937 - [4.17] Ironic issues soft power_off command during installation via ACM, preventing fakefish from working on certain configurations
• OCPBUGS-38952 - CCO GCP WIF bug roundup (see summary)
• OCPBUGS-39014 - Bump to kubernetes 1.30.4
• OCPBUGS-39029 - noProxy URL not available in Prometheus k8s CR after configuring remote-write
• OCPBUGS-39040 - Multipart upload issues with Cloudflare R2 using S3 api
• OCPBUGS-39088 - oc-mirror fails with out proceeding further if a release does not contain kubevirt coreos container image
• OCPBUGS-39092 - node-joiner add-nodes ignores infrastructure platform type
• OCPBUGS-39102 - [4.17] Add networking-console-plugin image to CNO as an env var
• OCPBUGS-39117 - Request to update openvswitch3.3 to openvswitch3.4 in OCP 4.17
• OCPBUGS-39127 - Automate OCPBUGS-34812: cgroupsv2: failed to write on cpuset.cpus.exclusive (OCPBUGS-34812)
• OCPBUGS-39164 - RPS settings fail to apply on AMD Genoa System
• OCPBUGS-39195 - unable to switch project successfully on network policies list page
• OCPBUGS-39220 - [Backport-4.17] co/ingress status cannot reflect the real condition
• OCPBUGS-39225 - [4.17] AdditionalTrustedCA in ImageConfig is not wired correctly
• OCPBUGS-39254 - OLM e2e smoke test failing because of the unavailable operator
• OCPBUGS-39296 - Fix doc links
• OCPBUGS-39297 - OLM catalog references need updates
• OCPBUGS-39302 - Fix Service 'Edit Pod selector'
• OCPBUGS-39309 - cluster-capi-operator: manifests-gen: missing metadata value
• OCPBUGS-39310 - Fix route page
• OCPBUGS-39321 - [e2e] wrong validation of reserved cpus in irqbalance file
• OCPBUGS-39365 - registryOverride doesn't take effect on azure-disk-csi-driver-controller
• OCPBUGS-39371 - NodePool Controller doesn't respect LatestSupportedVersion const
• OCPBUGS-39397 - Error key failed with : climanagers.operator.openshift.io "cluster" not found is being logged in the cli manager operator log
• OCPBUGS-39406 - [4.17] OVN-Kubernetes: failed to configure the policy based routes for network "default": invalid host address:
• OCPBUGS-39419 - [OCP 4.15] "error getting ignition payload: failed to download binaries"
• OCPBUGS-39425 - Error fetching networking-console-plugin locales
• OCPBUGS-39452 - HCP CLI not honoring setting multi-arch flag to false
• OCPBUGS-39465 - Pull release image command failed for podman error "cni support is not enabled in this build"
• OCPBUGS-25151 - SNO spoke fails to deploy without CloudCredential capability
• OCPBUGS-31040 - Enable techpreview flag doesn't work with single node
• OCPBUGS-34294 - ART requests updates to 4.17 image openshift-enterprise-hyperkube-container
• OCPBUGS-34333 - ART requests updates to 4.17 image ose-cluster-config-api-container
• OCPBUGS-37052 - LDAP communication going through HTTP(S) proxy
• OCPBUGS-38568 - [CAPI Azure] some resource created unexpected or missed when installing cluster with publish:Mixed
• OCPBUGS-38728 - Console sends ocm->organization.id instead organization.external_id
• OCPBUGS-38903 - Remove Networking section from console code
• OCPBUGS-38933 - install-status should show status of day2 services
• OCPBUGS-38963 - IngressController subnet selection in AWS
• OCPBUGS-39090 - node-joiner pod does not honour cluster wide proxy
• OCPBUGS-39109 - Need to allow blank for Project/namespace when setting SA Subject in 'Project access tab'
• OCPBUGS-39110 - List of default Camel K event sources disappears when adding a custom event source
• OCPBUGS-39204 - [release-4.17] Rebase downstream to upstream v1.36.1
• OCPBUGS-39239 - IPI vSphere disconnected installation fails to use template in 4.16
• OCPBUGS-39240 - vSphere: If the template platform spec parameter is set do not download the ova
• OCPBUGS-39313 - SingleReplica HCPs can not upgrade on cluster with nodes in a single zone
• OCPBUGS-39346 - ART requests updates to 4.17 image kube-compare-artifacts-container
• OCPBUGS-39387 - Console plugin missing required scc annotation
• OCPBUGS-39393 - [release-4.17] gather nmstate custom resources
• OCPBUGS-39427 - PTP events loses connectivity between producer and consumer when external interface is lost
• OCPBUGS-39458 - [4.17] opm creates FBCs which are incompatible with IIB catalogs
• OCPBUGS-39478 - No id found in /etc/groups inside container [openshift-4.17]
• OCPBUGS-39495 - [AWS CAPI install] Network setting is not correct while install cluster into VPC which contains multi-CIDR subnets
• OCPBUGS-39574 - OLM catalogsource pods do not recover from node failure when registryPoll is none
• OCPBUGS-41168 - [release-4.17] Should not panic when specify wrong loglevel for oc-mirror
• OCPBUGS-41233 - Failed to list secrets when a large number exist on the cluster [4.17]
• OCPBUGS-41283 - [4.17] Bootimage bump tracker
• OCPBUGS-41350 - Update Lightspeed logo to new standards
• OCPBUGS-41371 - [release-4.17] OpenID IDP endpoint verification fails when hostname can only be resolved by data plane
• OCPBUGS-41480 - Improve layout and findability of Hide Lightspeed preference
• OCPBUGS-41498 - [FLAKE] e2e: upgrade CRD with deprecated version
• OCPBUGS-41500 - Slow network causes metal IPI bootstrap to fail
• OCPBUGS-41503 - [release-4.17] oc-mirror throws error when performing delete operation with --generate
• OCPBUGS-41539 - [CAPI Azure] Failed to create second cluster in shared vnet
• OCPBUGS-41542 - [CAPI Azure] storage account created by installer has public access on fully private cluster
• OCPBUGS-41549 - [4.17] Install plan is unable to move forward and is stuck in Pending state when the amount of CRs is too high.
• OCPBUGS-41580 - Kube-aggregator reaching stale apiservice endpoints
• OCPBUGS-41624 - view Route details will wrongly put route name as selected project
• OCPBUGS-41633 - Ingresses list page doesn't show Ingresses from all projects when 'All Projects' selected
• OCPBUGS-41634 - 'Are you sure' pop-up windows does not closes automatically after triggering the 'Remove all' action
• OCPBUGS-41638 - container_network* metrics fail to report
• OCPBUGS-41640 - The data structure for services's label is flipped, with values acting as key and key as values
• OCPBUGS-41674 - Built-in join subnet "100.64.0.0/16" overlaps cluster subnet "100.64.0.0/15" even though internalJoinSubnet is configured
• OCPBUGS-41783 - Delay in provisioning master node
• OCPBUGS-41802 - When newly built images rolled out, the update progress is not displaying correctly (went 0 --> 3)
• OCPBUGS-41808 - errors when clicking on affected pods
• OCPBUGS-41820 - Install fails with error 'mac-interface mapping for interface xxxx is missing'
• OCPBUGS-41849 - Set psa version label to "latest"
• OCPBUGS-41850 - openshift-apiserver experiencing more disruption (4.17)
• OCPBUGS-41856 - Networking pages are always loading when user has no project
• OCPBUGS-41861 - No pagination on the NetworkPolicies table list
• OCPBUGS-41862 - Clicking label edit button on ingress details page will open annotation edit modal
• OCPBUGS-41863 - Remove alternate Service doesn't remove alternative service section
• OCPBUGS-41874 - kube-apiserver experiencing more disruption (4.17)
• OCPBUGS-41887 - The namespace value store in Ingress details page is incorrect
• OCPBUGS-41888 - Should show "404 not found" for non-existing resources under Networking menu
• OCPBUGS-38845 - Patternfly 5 components are missing their CSS
• OCPBUGS-39021 - oauth-apiserver experiencing more disruption in 4.17

CVEs

• CVE-2020-12762
• CVE-2021-29390
• CVE-2021-40153
• CVE-2021-41043
• CVE-2021-41072
• CVE-2021-43618
• CVE-2022-24963
• CVE-2022-40090
• CVE-2022-44638
• CVE-2022-48468
• CVE-2022-48554
• CVE-2022-48622
• CVE-2023-0666
• CVE-2023-0668
• CVE-2023-2855
• CVE-2023-2856
• CVE-2023-2858
• CVE-2023-2952
• CVE-2023-2975
• CVE-2023-3446
• CVE-2023-3618
• CVE-2023-3775
• CVE-2023-3817
• CVE-2023-4641
• CVE-2023-5077
• CVE-2023-5215
• CVE-2023-5678
• CVE-2023-5871
• CVE-2023-5954
• CVE-2023-6004
• CVE-2023-6129
• CVE-2023-6228
• CVE-2023-6237
• CVE-2023-6918
• CVE-2023-7104
• CVE-2023-22745
• CVE-2023-23931
• CVE-2023-25193
• CVE-2023-29491
• CVE-2023-31489
• CVE-2023-31490
• CVE-2023-32573
• CVE-2023-33285
• CVE-2023-33460
• CVE-2023-34410
• CVE-2023-37369
• CVE-2023-38197
• CVE-2023-38469
• CVE-2023-38470
• CVE-2023-38471
• CVE-2023-38472
• CVE-2023-38473
• CVE-2023-40745
• CVE-2023-41175
• CVE-2023-41358
• CVE-2023-41359
• CVE-2023-41360
• CVE-2023-41909
• CVE-2023-43785
• CVE-2023-43786
• CVE-2023-43787
• CVE-2023-43788
• CVE-2023-43789
• CVE-2023-45288
• CVE-2023-45289
• CVE-2023-45290
• CVE-2023-46316
• CVE-2023-46752
• CVE-2023-46753
• CVE-2023-47038
• CVE-2023-48795
• CVE-2023-52463
• CVE-2023-52801
• CVE-2024-0727
• CVE-2024-1488
• CVE-2024-1737
• CVE-2024-1975
• CVE-2024-2398
• CVE-2024-3651
• CVE-2024-3652
• CVE-2024-3727
• CVE-2024-4076
• CVE-2024-4418
• CVE-2024-5564
• CVE-2024-6104
• CVE-2024-6119
• CVE-2024-6345
• CVE-2024-6409
• CVE-2024-6923
• CVE-2024-22365
• CVE-2024-24783
• CVE-2024-24786
• CVE-2024-24789
• CVE-2024-24806
• CVE-2024-25062
• CVE-2024-25620
• CVE-2024-25629
• CVE-2024-26629
• CVE-2024-26630
• CVE-2024-26720
• CVE-2024-26886
• CVE-2024-26946
• CVE-2024-28180
• CVE-2024-28182
• CVE-2024-28834
• CVE-2024-28835
• CVE-2024-32002
• CVE-2024-32004
• CVE-2024-32020
• CVE-2024-32021
• CVE-2024-32465
• CVE-2024-32487
• CVE-2024-34397
• CVE-2024-35791
• CVE-2024-35797
• CVE-2024-35875
• CVE-2024-36000
• CVE-2024-36019
• CVE-2024-36883
• CVE-2024-36979
• CVE-2024-37370
• CVE-2024-37371
• CVE-2024-37891
• CVE-2024-38428
• CVE-2024-38476
• CVE-2024-38559
• CVE-2024-38619
• CVE-2024-39331
• CVE-2024-40927
• CVE-2024-40936
• CVE-2024-41040
• CVE-2024-41044
• CVE-2024-41055
• CVE-2024-41073
• CVE-2024-41096
• CVE-2024-42082
• CVE-2024-42096
• CVE-2024-42102
• CVE-2024-42131
• CVE-2024-45490
• CVE-2024-45491
• CVE-2024-45492

References

• https://access.redhat.com/security/updates/classification/#moderate