RHSA-2025:9562 - Security Advisory

Topic

Red Hat OpenShift Container Platform release 4.20.0 is now available with updates to packages and images that fix several bugs and add enhancements.

This release includes a security update for Red Hat OpenShift Container Platform 4.20.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container Platform 4.20.0. See the following advisory for the RPM packages for this release:

https://access.redhat.com/errata/RHEA-2025:4782

Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/

Security Fix(es):

• openshift-api: openshift-controller-manager/build: Build Process in OpenShift Allows Overwriting of Node Pull Credentials (CVE-2024-45497)
• helm.sh/helm/v3: Helm Chart Code Execution (CVE-2025-53547)
• golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (CVE-2025-22869)
• github.com/golang/glog: Vulnerability when creating log files in github.com/golang/glog (CVE-2024-45339)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

All OpenShift Container Platform 4.20 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/updating_clusters/index#updating-cluster-cli.

Solution

For OpenShift Container Platform 4.20 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

(For x86_64 architecture)
The image digest is sha256:d1dc76522d1e235b97675b28e977cb8c452f47d39c0eb519cde02114925f91d2

(For s390x architecture)
The image digest is sha256:bb2b07ca992b8c976341c145ccdcefbd57e946a590efaa5e10d60fc5a2cbe503

(For ppc64le architecture)
The image digest is sha256:678369ac0a189674b3d9f5779ee7042b39e625ee580579ec302d8899f8ddc613

(For aarch64 architecture)
The image digest is sha256:791079aeb081a9193cec139ba4dccbafbfc9437b6e5e39d70225b0e6d2f51b34

All OpenShift Container Platform 4.20 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/updating_clusters/index#updating-cluster-cli.

Fixes

• BZ - 2308673
• BZ - 2342463
• BZ - 2348367
• BZ - 2378905
• OCPBUGS-14051 - kubelet: do not set CPU quota for guaranteed pods
• OCPBUGS-18282 - External labels added to cluster monitoring config changes the source of the alerts
• OCPBUGS-18510 - Load-balancers created by CCM with BYON are not cleaned up
• OCPBUGS-18658 - [RFE] Agent Based Installation shows messages "installation is completed" even if there are issues with operators.
• OCPBUGS-19856 - Machine approver should log that failed lookups are on InternalDNS, not name
• OCPBUGS-23055 - [OLMv1] the --version of catalogd and operator-controller don't output the right code commit
• OCPBUGS-32157 - ResourceYAMLEditor header property doesn't take effact
• OCPBUGS-34993 - [CCO/Azure] Azure private cluster using Microsoft Entra Workload Identity should not require any DNS zone.
• OCPBUGS-35095 - `KubeCPUOvercommit` Alert Not Triggered Despite Node CPU is Overcommitment
• OCPBUGS-35855 - 'oc delete istag/$ISTAG --dry-run=server' is unexpectedly deleting the object from the server
• OCPBUGS-36859 - OCP 4: primary iface selection by br-ex is flapping between reboots, hint files are ignored
• OCPBUGS-37323 - MarkPersistentFlagRequired does not work since CLI refactoring
• OCPBUGS-37733 - br-ex has cluster network MTU cached on OCP nodes causing traffic outage.
• OCPBUGS-38735 - DNS Egress firewall should remove address_set entries after some time
• OCPBUGS-39089 - Prometheus pods indicates that NFS is not supported
• OCPBUGS-41851 - Waning info "setting componentGlobalsRegistry in SetFallback" in metrics-server logs
• OCPBUGS-42875 - clusteroperator/cluster-autoscaler blips Degraded=True during upgrade test
• OCPBUGS-42938 - imagestream import failed with remote image in aws-rosa-hcp-private-proxy cluster
• OCPBUGS-43406 - upgrade from 4.14 to 4.16 infra coredns static pod and rpm-ostree race condition
• OCPBUGS-43521 - uneven distribution of kube api traffic
• OCPBUGS-43777 - cluster-kube-apiserver-operator should use pod scheduling/rollout tests for auto-regenerate-after-offline-expiry annotation
• OCPBUGS-43783 - OpenStack root credential has not been updated with mode annotation
• OCPBUGS-43792 - Conflict in CreateProjectModal extension
• OCPBUGS-43824 - Follow up - Investigate and fix flaky TestNTOMachineConfigGetsRolledOut
• OCPBUGS-43966 - high snapshot rate on redhat-operators, OLM operator install hangs. RPC DeadlineExceeded while listing bundles.
• OCPBUGS-44128 - Azure CredentialsRequest for File Storage Operator may be missing some permissions
• OCPBUGS-44290 - worker MCP is degraded in Techpreview without reporting the actual reason of the degradation
• OCPBUGS-44462 - PlatformOperators should be removed from the FeatureGate
• OCPBUGS-44481 - [Pre merge Testing] [UDN] joinSubnets not take effect when config it
• OCPBUGS-44570 - improve scaling strategy error message
• OCPBUGS-44972 - CSP Violations are reported to telemetry too frequently
• OCPBUGS-45256 - ABI generated kubeconfig does not contain default-ingress-cert
• OCPBUGS-45265 - customizes the liveness probe on IBM Cloud
• OCPBUGS-45297 - Drag and Drop new file into Import YAML editor will copy old content then append
• OCPBUGS-45300 - Console oidcClient with "OIDC provider CA version not up to date in current deployment" and "status: Unknown" can confuse users in both HCP and OCP BYO external OIDC env
• OCPBUGS-45805 - [azure] get panic error when destroying cluster for long time
• OCPBUGS-46385 - layout issue on Overview page
• OCPBUGS-47719 - [Nutanix] nil error displayed when setting a not exist value in preloadedOSImageName field
• OCPBUGS-48318 - Nopreempt option doesn't work properly with Vsphere cluster
• OCPBUGS-48747 - openshift-state-metrics generates duplicate "openshift_route_status" metrics
• OCPBUGS-48833 - InvalidConfig Warning event for NAD created by SriovNetwork
• OCPBUGS-49291 - Improving the DevExp for passing the CSP directives to console per flag
• OCPBUGS-49386 - Netwoking - Services - Pods : Ellipsis menu missing
• OCPBUGS-49441 - HAProxy gRPC interop test fails with grpc 1.67.0 in origin
• OCPBUGS-49652 - Network policy with match expressions on applying creates a error in openshift console.
• OCPBUGS-49709 - Modals launched with `useModal` overwrite each other
• OCPBUGS-49728 - Fix up node_controller's OCL unit tests
• OCPBUGS-49824 - All namespace selector ( namespaceSelector: {} )does not work with user defined network
• OCPBUGS-49897 - node-image create changes directory permissions
• OCPBUGS-50489 - Missing endpoint slices for open ports the operator uses
• OCPBUGS-50663 - Some new network data type not obfuscated in hosted cluster with OVN when obfuscation is enabled
• OCPBUGS-50701 - [regression] Add test case for checking EgressFirewall DNS names in caps
• OCPBUGS-50992 - Pod Stuck on an Unschedulable Node Due to Broad Toleration (`operator: Exists`)
• OCPBUGS-51093 - OVN Gateway mode change does not reflect in ovn-control-plane pods unless restarted manually
• OCPBUGS-51157 - [v2] oc-mirror doesn't return an error when the specified OpenShift release version is unavailable
• OCPBUGS-51299 - CSI fails when KMS projectID not specified in installconfig
• OCPBUGS-52165 - Chinese log messages are garbled at RAW log page
• OCPBUGS-52193 - Unable to remove legacy pullsecret tokens after removing registry
• OCPBUGS-52448 - CPMS cannot generate a config when 3 masters are in a single-az and machines pools are in > 1az
• OCPBUGS-52462 - [BGP Isolation Break] two UDN pod can be accessed after BGP advertised to default VRF
• OCPBUGS-52466 - OpenShift Audit log showing sensitive data of machine config
• OCPBUGS-52556 - [4.14-4.19] 4.18-4.19 update stuck at crd consoleplugins.console.openshift.io
• OCPBUGS-52562 - [v2] oc-mirror release collection pulls release images multiple times
• OCPBUGS-52568 - [release-4.18] Forbidden errors during ClusterOperators collection
• OCPBUGS-52835 - console-telemetry-plugin: unable to track usage: Forbidden
• OCPBUGS-52838 - The msg description in the SCAAvailble condition isn't accurate enough when failing to parse the response
• OCPBUGS-52842 - Topology view shows "TypeError: Cannot read properties of null (reading 'metadata')"
• OCPBUGS-52853 - iommu.passthrough for Arm64 GH nodes
• OCPBUGS-52940 - [Custom DNS]AWS: CoreDNS pod was not running on control plane nodes
• OCPBUGS-53028 - EgressService's address not used when reaching external resources
• OCPBUGS-53062 - Missing ports Field in Container Spec
• OCPBUGS-53083 - CI flake: EnsureNoCrashingPods fails on pod that lose their leader lease
• OCPBUGS-53107 - Some systemd services cannot be stopped on agent ISO
• OCPBUGS-53116 - [AWS] destroyer will go into an infinite loop in mx-central-1 region
• OCPBUGS-53161 - olm-operator pod going to CLBO with a message "detected that every object is labelled, exiting to re-start the process"
• OCPBUGS-53217 - logs are being spammed with "E0317 15:28:09.035372 1 base_controller.go:279] "Unhandled Error" err="VSphereProblemDetectorController reconciliation failed: obj.Name must be provided to Apply"
• OCPBUGS-53259 - HostedCluster registry and release providers are recreated on every reconcile
• OCPBUGS-53265 - Get manifest and metadata caching does not support named tagged images
• OCPBUGS-53290 - Missing endpoint slices for open ports the operator uses
• OCPBUGS-53300 - Missing endpoint slices for open ports the operator uses
• OCPBUGS-53320 - Add a SERVER_FLAG to know if new devconsole proxy for results are available
• OCPBUGS-53390 - In OCL. Failing MOSBs cannot be interrupted
• OCPBUGS-53392 - Missing endpoint slices for open ports the operator uses
• OCPBUGS-53432 - CI fails on TestIngressControllerCustomEndpoints
• OCPBUGS-53473 - HostPrefix needs stricter validation in installer
• OCPBUGS-54185 - Helm resource list error in console
• OCPBUGS-54195 - Re-enable pipeline tests with install version as 1.17 (OSP)
• OCPBUGS-54208 - Backport UPSTREAM: 130047: adjusting loopback certificate validity in kube-apiserver
• OCPBUGS-54220 - [v2] when oc-mirror version 4.18.3, 4.18.4 and 4.18.5 graph image synchronization generates an error
• OCPBUGS-54229 - Bond-CNI pod failed to recover IPv6 address config after bond interface restart
• OCPBUGS-54234 - Impersonate Group doesn't work
• OCPBUGS-54237 - click resource dropdown button on Operand form page will always put use to page top when scrolling
• OCPBUGS-54318 - 4.20: CSI certification fails for RWX volumes
• OCPBUGS-54434 - vsphere cloud credentials not syncing correctly
• OCPBUGS-54443 - [v2] oc-mirror v2 generate non-unique archive file names
• OCPBUGS-54473 - [v2] incomplete error message for invalid helm chart
• OCPBUGS-54483 - hypershift deployment fails on disconnected- ipv6 deployment with ImageDigestMirrorSet
• OCPBUGS-54491 - Azure CSI File Missing Permissions in CredentialsRequest
• OCPBUGS-54502 - Installation 4.16 cluster in AWS (self manage) with two master subnets failed at bootstrap phase.
• OCPBUGS-54566 - [GCP] 'platform.gcp.defaultMachinePlatform.type: Invalid value: "": Machine type do not support Enabled', although both compute and controlPlane are specified valid machine types
• OCPBUGS-54587 - [v2] oc-mirror v2 retry-times parameter does not work when mirroring release images
• OCPBUGS-54622 - [v2] The delete workflow shown is MirrorToDisk for MirrorToMirror Delete Workflow
• OCPBUGS-54629 - Live firmware update with multiple images can trigger no-delta update
• OCPBUGS-54634 - BMH stuck in deleting state while performing IBBF
• OCPBUGS-54695 - Empty proxy variables are causing issues during the build
• OCPBUGS-54697 - error from generateAndValidateRenderedMachineConfig function can be misleading
• OCPBUGS-54705 - A new awsmachinetemplate should be created when changing mapi spec.template
• OCPBUGS-54720 - hcp payload doesn't respect multiple mirrors
• OCPBUGS-54726 - Layout of Welcome to the new OpenShift experience! buttons is wonky on mobile
• OCPBUGS-54745 - CI failure due to istios resource added to related objects before CRD is created
• OCPBUGS-54780 - Console operator does not clean up synced custom logo configmaps in openshift-console namespace
• OCPBUGS-54885 - Check that DiskEncryption values are valid
• OCPBUGS-54897 - [Azure-File-CSI-Driver] VolumeSnapshot in cross-subscriptions could not be deleted
• OCPBUGS-54965 - Prevent non-virtual-media drivers from being used with ProvisioningNetwork disabled
• OCPBUGS-54966 - [CI] GatewayAPI e2e: Intermittent failures due to missing Gateway DNSRecord
• OCPBUGS-54975 - openstack-cinder-csi-driver-controller-metrics prometheus target showing down for 9202 port
• OCPBUGS-55013 - Non-privileged Pod fails to mount /etc/docker via hostPath
• OCPBUGS-55020 - cache.DeletedFinalStateUnknown panic in vmware-vsphere-csi-driver pods
• OCPBUGS-55048 - `oc adm node-image create` command fails with the error messaging giving no feedback information even in the report.json.
• OCPBUGS-55051 - [OLMv1] fails with lots of "has unknown change, refusing to determine that change is safe" when upgrading argocd from v0.5.0 to v0.7.0
• OCPBUGS-55076 - [v2] Release signatures errors should stop the workflow during tar generation
• OCPBUGS-55078 - [v2] Original catalog signature should not be mirrored to the target
• OCPBUGS-55100 - Currently it is not possible to disable signature mirroring by registry / namespace / image
• OCPBUGS-55111 - TNF: initializating podman-etcd with meta causes OCF_RESKEY_CRM_meta_notify to be set to false
• OCPBUGS-55114 - [v2] manifest list catalog with 1 manifest fails due to invalid checksum digest format
• OCPBUGS-55135 - userDataSecret.name should be a Required value on AWS
• OCPBUGS-55157 - [BGP L2] disallow EIP advertisements for L2 networks
• OCPBUGS-55208 - Should show default OpenShift Logo for a theme when there is not custom logo set for the theme.
• OCPBUGS-55211 - [CI] should use regular user to create HTTPRoute
• OCPBUGS-55226 - HCP pods not running with terminationmessagepolicyfallbacktologsonerror
• OCPBUGS-55262 - e2e-aws-ovn-ipsec-upgrade job is failing with disruptive events
• OCPBUGS-55274 - Unexpected certificate duration in development mode
• OCPBUGS-55280 - e2e-metal-ipi-ovn-ipv6-ipsec job is failing at e2e test step
• OCPBUGS-55317 - Ingress operator cannot start without the "OperatorLifecycleManager" and "Marketplace" capabilities because of the status controller's watch on Subscription
• OCPBUGS-55323 - Add missing patternfly/react-topology to shared modules list of dynamic plugin sdk
• OCPBUGS-55340 - Not able to launch terminal window from OCP web console due to console plugin conflicts
• OCPBUGS-55350 - Missing NetworkManager logs for ironic-python-agent
• OCPBUGS-55357 - Missing main Konflux builds for CPO and HO
• OCPBUGS-55368 - [knative] Self-provisioner user can not access or create event sources via ODC
• OCPBUGS-55372 - Azure Capacity Reservation Group does not work across subscriptions
• OCPBUGS-55374 - [v2] oc-mirror v2 needs to inform user of bad umask settings on disk2mirror
• OCPBUGS-55375 - Quick create (+ icon) does not get highlight by quick start link
• OCPBUGS-55381 - Ramdisk logs are unreadable and unparseable
• OCPBUGS-55404 - SNO with Multiple address on the primary interface, apiserver while trying to contact etcd is using an IP which is not present in cert.
• OCPBUGS-55412 - Create CR button on CRD instances and Search page got extended to whole line
• OCPBUGS-55434 - BMH fails inspecting on ARM SNO due to incorrect boot order on SuperMicro
• OCPBUGS-55450 - Fix PIS edge case highlighted by blocking payload test failures
• OCPBUGS-55456 - Fix and enable webterminal e2e in console CI
• OCPBUGS-55461 - MAPI Vsphere Tests Merged Broken
• OCPBUGS-55465 - Phase out serving of admissionregistration/v1beta1 for 4.20
• OCPBUGS-55484 - panic in openshift-machine-api_machine-api-controllers pods
• OCPBUGS-55485 - [4.20] Statefull set pod stuck in a Terminating State when backend storage went down
• OCPBUGS-55488 - CNO still contains ARO HCP variables related to MIv2
• OCPBUGS-55499 - [GCP] with "confidentialCompute: Enabled" settings, the error message complains about "AMDEncryptedVirtualization" rather than "Enabled"
• OCPBUGS-55504 - Unavailability of bootstrap container is causing KAS pod to restart
• OCPBUGS-55514 - Performance issue - plugins pages increased loading time (10s) compared to ocp4.18
• OCPBUGS-55597 - MCO code owners list should be updated across repos
• OCPBUGS-55631 - Fix expansion of RWX volumes with recovery feature
• OCPBUGS-55632 - Fix node expansion when kubelet doesn't have recovery feature enabled
• OCPBUGS-55633 - Critical Alerts section in Notification Drawer cannot be collapsed
• OCPBUGS-55650 - Remove BuildCSIVolumes featuregate
• OCPBUGS-55652 - Remove PrivateHostedZoneAWS featuregate
• OCPBUGS-55653 - Remove GCPLabelsTags featuregate
• OCPBUGS-55662 - Remove BareMetalLoadBalancer featuregate
• OCPBUGS-55663 - Remove NodeDisruptionPolicy featuregate
• OCPBUGS-55664 - Remove VSphereDriverConfiguration featuregate
• OCPBUGS-55665 - Remove ChunkSizeMiB featuregate
• OCPBUGS-55666 - Unused MachineAPIProviderOpenStack feature gate should be removed
• OCPBUGS-55668 - API - Remove PersistentIPsForVirtualization featuregate
• OCPBUGS-55670 - revert "force cert rotation every couple days for development" in 4.20
• OCPBUGS-55671 - Remove MultiArchInstallAWS featuregate
• OCPBUGS-55672 - Remove MultiArchInstallGCP featuregate
• OCPBUGS-55674 - Remove AWSEFSDriverVolumeMetrics featuregate
• OCPBUGS-55678 - Openshift integration tests are failing on CEL tests
• OCPBUGS-55681 - chk_default_ingress perma-failing
• OCPBUGS-55683 - When using OVE UI prevent regeneration of kubeadmin-password
• OCPBUGS-55698 - Missing CSP FG lift in the console-operator
• OCPBUGS-55703 - PowerVS jobs are failing with error "Unexpected number of args"
• OCPBUGS-55708 - OVE ISOBuilder: RHEL 9 VMs fail to launch due to missing guest image in local registry
• OCPBUGS-55712 - OLMv1 origin tests regression: catalogd server tests pass % below accepted threshold
• OCPBUGS-55717 - Poor handling of incomplete Redfish URLs
• OCPBUGS-55720 - CPMS failing to rollout in AWS TechPreviewNoUpgrade
• OCPBUGS-55721 - [OCP on OSP][DualStack] failed at [sig-network][OCPFeatureGate:RouteExternalCertificate][Feature:Router] test
• OCPBUGS-55722 - CAPZ-based azurestack cloud provider should use standard LB
• OCPBUGS-55763 - MetalLB: stop listening for BGP connection in frr-k8s in CNO
• OCPBUGS-55769 - OVE ISOBuilder: Use internal image registry in appliance
• OCPBUGS-55770 - OS Validation check doesn't always work
• OCPBUGS-55772 - [azure] fail to create cluster on confidential vm size with ConfidentialComputingType:TDX
• OCPBUGS-55777 - Sync CA bundle from legacy location to root credential
• OCPBUGS-55788 - Update HyperShift control-plane-operator to use new uid and extra fields for structured authentication
• OCPBUGS-55790 - Update Authentication API to add UID and Extras claim mapping fields for external OIDC
• OCPBUGS-55803 - ROSA product name text lacks sufficient contrast in Light theme
• OCPBUGS-55804 - Expected error logs are not included in insights archive
• OCPBUGS-55805 - The error logs inside gather.json didn't include meaningful context
• OCPBUGS-55806 - OpenShift Console Alert severity icon does not match
• OCPBUGS-55808 - cy.createProject command is failing when matching project name
• OCPBUGS-55810 - Metal CI perma-fails on 4.20: workers do not boot
• OCPBUGS-55817 - Azure doc: add support for Lsv4, Lasv4, Dxv6, NDs and NV series
• OCPBUGS-55824 - OVN-Kubernetes flows caused OVS CPU Regression in 4.19.0 RC - component readiness
• OCPBUGS-55828 - Edit paralelism modal has unresponsive decrease button in the number spinner
• OCPBUGS-55832 - RouteExternalCertificate tests fail for HostedControlPlane (KubeVirt)
• OCPBUGS-55892 - Image registry managed identity should not be required when capability is disabled
• OCPBUGS-55896 - Alignment regression in ActionsMenu dropdown
• OCPBUGS-55910 - Component Readiness: [Networking / cluster-network-operator] [EgressIP] pods should have the assigned EgressIPs and EgressIPs can be deleted and recreated
• OCPBUGS-55913 - CPOv2 fails on 4.17 mgmt cluster
• OCPBUGS-55914 - [BGP][UDN]] UDN pod cannot access the service on the host/node after BGP advertised
• OCPBUGS-55919 - The web console still shows message about must resume updates for worker nodes within 60 days in 4.16 and later
• OCPBUGS-55945 - Bump to Kubernetes 1.32.4
• OCPBUGS-55946 - "acm" perspective should not have special treatment
• OCPBUGS-55947 - Cluster CAPI operator: should not use v1beta1 of the AdmissionRegistration API group
• OCPBUGS-55952 - Unused Terraform build artifacts in the installer
• OCPBUGS-55966 - oc-mirror v2 has no output while loading cache during disk2mirror function
• OCPBUGS-55967 - Add hot loop detection in MSBIC
• OCPBUGS-55968 - Applicable MCN & PIS origin tests should run on SingleNodeOpenshift
• OCPBUGS-55971 - Missing nodeip-configuration logs
• OCPBUGS-55985 - When .spec.authoritativeAPI: MachineAPI and spec.template.spec.authoritativeAPI: ClusterAPI , the CAPI-authoritative Machine cannot be scale down
• OCPBUGS-55989 - E2E: Functional tests for align cpus by UncoreCache Feature
• OCPBUGS-55994 - [4.20] e2e-aws-ovn-edge-zones is permafailing because of UDN tests permafailing
• OCPBUGS-56008 - Pull image from ACR failed
• OCPBUGS-56009 - [v2] oc-mirror Error: [GenerateReleaseSignatures] no signature found for image
• OCPBUGS-56010 - When authority is ClusterAPI mapi machineset template value should change based on the new awsmachinetempalte
• OCPBUGS-56011 - HCP operator should set Shared ClusterServiceLoadBalancerHealthProbeMode
• OCPBUGS-56018 - bootstrapping failed using GCP marketplace RHCOS image due to "Failed to start OSTree Prepare OS/"
• OCPBUGS-56028 - Don't report topology capability when --with-topology=False
• OCPBUGS-56029 - Spike: remove software RAID automatically?
• OCPBUGS-56037 - Stabilize custom MCP cleanup in MCN origin tests
• OCPBUGS-56039 - Update supported languages in Internationalization docs
• OCPBUGS-56044 - VirtualizedTable component is breaking if default sort column (sortColumnIndex) is not available
• OCPBUGS-56050 - Cannot read properties of undefined (reading 'filter') error while accessing nodes from console
• OCPBUGS-56051 - terminationMessagePolicy not set to FallbackToLogsOnError for CNO operands on HCP
• OCPBUGS-56060 - Shellcheck job failed
• OCPBUGS-56079 - yaml-lint job perma failing
• OCPBUGS-56087 - open Edit Secret modal but didn't change anything will throw error
• OCPBUGS-56088 - Signature mirroring default should be disabled for 4.19
• OCPBUGS-56091 - ingress operator pod logs have overlap when Wrap lines selected
• OCPBUGS-56095 - "Negative matcher" is checked by default on Create silence page
• OCPBUGS-56104 - [TPNU] No debuggability of CAPI resources (missing in the must-gather)
• OCPBUGS-56114 - ClusterVersion: The condition type is changed from "ImplicitlyEnabledCapabilities" to "ImplicitlyEnabled"
• OCPBUGS-56115 - Understand and eliminate noisy logs for MCN
• OCPBUGS-56117 - [v2] blockedImages doesn't behave as oc-mirror v1 and doesn't allow regular expressions
• OCPBUGS-56128 - Disable topology for Cinder CSI controller service also
• OCPBUGS-56134 - Extract listening state when transitioning from faulty
• OCPBUGS-56137 - Developer Getting Started card not shown on Project Overview
• OCPBUGS-56147 - For OVE UI Virtualization, the operator CRs must be applied after installation
• OCPBUGS-56148 - TargetDown Alert and TOKEN_REVIEW: 'GET /metrics' unauthorized, invalid user token in console pod logs
• OCPBUGS-56158 - [release-4.20] Excessive API calls by prometheus-operator ServiceAccount
• OCPBUGS-56159 - Edge node with custom KMS key may not be created in particular edge zones due to kms:ReEncrypt* permission is missing in Machine API.
• OCPBUGS-56174 - ConfigMap form stuck after making input errors.
• OCPBUGS-56179 - ALL_NAMESPACES_KEY should be exposed to console plugins
• OCPBUGS-56186 - All import flows should include “Select or create a project” field
• OCPBUGS-56196 - CI fails on [sig-devex] check registry.redhat.io is available and samples operator can import sample imagestreams run sample related validations
• OCPBUGS-56199 - TNF: tnf-after-setup- pod timeout
• OCPBUGS-56201 - PodStartupStorageOperationsFailing alert in RHOCP web console
• OCPBUGS-56205 - Konflux pipelines use base image from outside the Red Hat Catalog
• OCPBUGS-56210 - OVE builder: Remove RHEL9 image from additionalImages
• OCPBUGS-56211 - Boot Image Controller should not degrade when golden configmap is slow to update
• OCPBUGS-56220 - MOB doesn't update container image on upgrade
• OCPBUGS-56223 - Release image checks reoccur after exiting from nmtui configuration in install-interactive-disconnected workflow
• OCPBUGS-56245 - Remove dead code for deployment and deployment config menuItems
• OCPBUGS-56248 - [UI/Plugin] Error when using k8sGetResource from @openshift-console/dynamic-plugin-sdk
• OCPBUGS-56249 - lint-fix rule should ensure (depend on) golangci
• OCPBUGS-56262 - Enhance OCP Installer destroy logging for vSphere
• OCPBUGS-56268 - Remove leftover docs pointing to SystemAssigned Identities
• OCPBUGS-56353 - There is runtime error in output when bridge console
• OCPBUGS-56365 - CAPI Providers: should not use v1beta1 of the AdmissionRegistration API group
• OCPBUGS-56378 - Verification error during collection of operator catalog image
• OCPBUGS-56380 - OCP on Azure MachineSet scaling up fails after upgrade to 4.15.48+ on non zonal region
• OCPBUGS-56416 - E2E: modify RPS test to use 4 cpus for reserved from available cpus
• OCPBUGS-56425 - Empty remoteWrite to telemeter injected by hypershift on user-workload-monitoring-config cm
• OCPBUGS-56436 - 4.20 - Bump to Kubernetes 1.32.5
• OCPBUGS-56439 - Remove dead and duplicate sinkUri code
• OCPBUGS-56442 - OCP 4.18+ | Node Tuning Operator is marked as degraded during IPI wait-for-install process
• OCPBUGS-56446 - MCP is reported degraded in the upgrade from OCP 4.15.44 to 4.16.39 with error "Marking Degraded due to: "unexpected on-disk state validating against rendered-worker-XXXXX: content mismatch for file \"/etc/systemd/system/kubelet-dependencies.target\""
• OCPBUGS-56457 - Validate OCP API Server info only if reconciling KPI
• OCPBUGS-56466 - The warning msg 'CPU and memory resource requests must be set' still shows up after deployment has resource requests set.
• OCPBUGS-56486 - [v2] oc mirror - error when mirroring image name ends with the word 'delete'
• OCPBUGS-56487 - Sometime status.authoritativeAPI stuck in Migrating when changing AuthoritativeAPI from ClusterAPI to MachineAPI
• OCPBUGS-56492 - NodePool fails to start if a management cluster has ImageContentSourcePolicy with specific mirrors
• OCPBUGS-56506 - Avoid importing BGP routes for advertised UDN network host subnet
• OCPBUGS-56508 - The config-sync-controller does not log
• OCPBUGS-56512 - Fix e2e-aws-ovn-image-ecosystem test
• OCPBUGS-56546 - ISOBuilder: Remove default password for nodes
• OCPBUGS-56551 - Cluster doesn't come up after cert rotation
• OCPBUGS-56555 - openvswitch3.5-ipsec package not included with ipsec os extension
• OCPBUGS-56596 - AdditionalTrustBundlePolicy still cannot be set in ABI
• OCPBUGS-56598 - must-gather inspect fallback should include the openshift-cluster-version namespace
• OCPBUGS-56601 - installation failed when machineNetworks set same ip for api-vip and ingress vip.
• OCPBUGS-56604 - CAPI MachineSet should be created unpaused when it is authoritative
• OCPBUGS-56607 - ccoctl crashes with nil pointer exception when creating Azure managed identity role assignments that already exist
• OCPBUGS-56616 - In case of entering malformed SSH key to install-config.yaml file, cluster installation hangs for 1 hour and finally fails without clear error message
• OCPBUGS-56628 - Strange interaction with Modals and Drawers
• OCPBUGS-56629 - QuickStarts empty state is misaligned
• OCPBUGS-56658 - Failed to create install-config/cluster in interactivate way if AWS credential not set
• OCPBUGS-56698 - Component Readiness: [Networking / cluster-network-operator] [OCPFeatureGate:NetworkDiagnosticsConfig] multiple tests regressed
• OCPBUGS-56699 - ContainerResource metric data for HPAs isn't visible in the Details page
• OCPBUGS-56700 - UI for search by label is distorted in topology
• OCPBUGS-56707 - Normal user without project could only see parts of roles list.
• OCPBUGS-56709 - library-go: ApplyDirectly unable to handle ValidatingAdmissionPolicyV1, ValidatingAdmissionPolicyBindingV1
• OCPBUGS-56713 - [IBMCloud] add the VM type which install pass into the tested_instance_types
• OCPBUGS-56719 - Ensure the etc-entitlement-pki secret exists
• OCPBUGS-56720 - modify gitignore to not ignore files in vendor/
• OCPBUGS-56723 - CBO may show as Degraded briefly during Metal3 initialization
• OCPBUGS-56725 - HCP should fail before persisting if the kas lb hostname conflicts with the apiserver external certs
• OCPBUGS-56727 - Fix race in MCN test cleanup
• OCPBUGS-56743 - very flaky adm new-project test
• OCPBUGS-56744 - Fix typo in MCN's `MachineConfigNodePinnedImageSetsDegraded` message
• OCPBUGS-56768 - Node pending to reboot due to error in syncing cache for *v1.EgressFirewall informer in OCP with 300-500 worker nodes
• OCPBUGS-56778 - Disable PSA for 4.20
• OCPBUGS-56785 - kubelet podresources API incorrectly reports memory assignments of terminated pods
• OCPBUGS-56786 - Several [OCPFeatureGate:RouteExternalCertificate] tests are permafailing for periodic-ci-openshift-release-master-nightly-4.19-e2e-agent-single-node-ipv6-conformance
• OCPBUGS-56791 - Add Catalog Default Tests on 4.20
• OCPBUGS-56805 - cluster-capi-operator tries updating the clusteroperator status in a hot loop
• OCPBUGS-56809 - OVE builder appliance bump to 936210
• OCPBUGS-56813 - Component Readiness: [OLM] fix olm.maxOpenShiftVersion float parsing
• OCPBUGS-56814 - Automate PodSecurityConfiguration rendering from the feature gate status
• OCPBUGS-56818 - Ensure catalog consistency tests catch missing 'bin/opm' in built images
• OCPBUGS-56830 - CronTab list page returns error
• OCPBUGS-56849 - Sometimes mapi machine stuck in Provisioning when authoritativeAPI is ClusterAPI
• OCPBUGS-56850 - frr-k8s: disable SessionState E2Es on CI
• OCPBUGS-56853 - Ensure catalog consistency tests catch missing supported platforms
• OCPBUGS-56861 - Failed to add capacity blocks as nodepool with UnauthorizedOperation error
• OCPBUGS-56878 - whereabouts-config is a reserved name for user interaction
• OCPBUGS-56880 - agent-tui displays blank screen after exiting from nmtui
• OCPBUGS-56887 - P CI- Fix bearer token exposure in exit condition
• OCPBUGS-56902 - Not possible to use cluster-node-tuning-operator as a dependency because of its go.mod containing non existing references
• OCPBUGS-56903 - The error message of co olm Upgradeable is not correct
• OCPBUGS-56914 - OAuth Route not working using PublicAndPrivate access endpoint and no hostname defined
• OCPBUGS-56917 - Remove ExternalLink reexport
• OCPBUGS-56922 - Remove Timestamp reexport
• OCPBUGS-56923 - vm-host zonal e2e panics
• OCPBUGS-56934 - ESC key interferes with TAB key in agent-tui checks page
• OCPBUGS-56937 - workers-rhel8 jobs need ami update
• OCPBUGS-56956 - JUnit in XML format should be uploaded on ARTIFACT_DIR for Default Catalog Tests
• OCPBUGS-56960 - .gitignore shouldn't ignore files in /vendor/**/build
• OCPBUGS-56966 - Ignition server Route is continuously re-created
• OCPBUGS-56977 - OVE isobuilder fails on CentOS Stream 9 due to missing isoinfo dependency
• OCPBUGS-56986 - "Configure" button in AlertmanagerReceiversNotConfigured status errors out with "navigate is not a function"
• OCPBUGS-56998 - Need support feature-nfs-export-options for filestore csi driver
• OCPBUGS-56999 - Cannot read properties of undefined (reading 'node-role.kubernetes.io/master') error while accessing node logs from console
• OCPBUGS-57000 - Revert from removing user-assigned identity from Azure ARM template
• OCPBUGS-57018 - vsphere multi nic e2e panics on upi
• OCPBUGS-57021 - ABI sets /var/lib/etcd/member permissions to 0755 while deploying a SNO
• OCPBUGS-57024 - In OCL. Machine-os-builder pod does not release the lease when it is removed
• OCPBUGS-57032 - Component Readiness: ClusterUpgrade failing due to DaemonSet pod not running on all nodes
• OCPBUGS-57040 - Migration controller unable to retry unpause resource if it fails
• OCPBUGS-57041 - ClusterAutoscaler sometimes creates 2 cluster-autoscaler-default pods
• OCPBUGS-57065 - iptables: Switch PREROUTING REDIRECT rule to DNAT instead
• OCPBUGS-57072 - configure-ovs breaks when nmcli values have '\:'
• OCPBUGS-57074 - Incorrect property name `requests` in `ContainerSpec.resources` type
• OCPBUGS-57087 - Console images built with Dockerfile.dev crashloop
• OCPBUGS-57088 - console-demo-plugin has runtime errors when deployed using dynamic-plugin-demo/oc-manifest.yaml
• OCPBUGS-57115 - It is better to use v1 instead of still v1beta1 for PodSecurityConfiguration in hypershift hosted cluster
• OCPBUGS-57125 - HO/CPO fails to create monitoring resource when RHOBS is enabled
• OCPBUGS-57129 - capability.openshift.io/name: Console annotation not present in Hypershift-specific deployment manifest
• OCPBUGS-57130 - Azure HCP CAPI provider pod memory surge/leak on idle cluster
• OCPBUGS-57147 - Disable deploy image tests in add flow e2e
• OCPBUGS-57150 - E2E: Additional Functional tests for align cpus by UncoreCache Feature
• OCPBUGS-57169 - Perma failing tests of e2e-aws-ovn-tls-13
• OCPBUGS-57174 - Percent sign on creating HPA page doesn't align in the center of outer box.
• OCPBUGS-57179 - [4.20][upgrade] OCP4.18.X - Stale SNATs/LRPs due to failed sync to add metadata after upgrade
• OCPBUGS-57184 - Add alert and runbook for PrometheusPossibleNarrowSelectors
• OCPBUGS-57187 - Empty FeatureGate status enabled / disabled gates with CustomNoUpgrade
• OCPBUGS-57192 - [Nutanix] create install-config got panic on a new version Nutanix
• OCPBUGS-57195 - InfraMachineTemplate is not deleted when deleting machineset
• OCPBUGS-57202 - Installation failed with ShortCertRotation Featuregate on IBM and Azure
• OCPBUGS-57205 - i18n upload/download routine task - Sprint 270
• OCPBUGS-57215 - GCP Upgrades Failing Due to Monitoring Operator Degraded
• OCPBUGS-57222 - Unnecessary churn with OLMv0 operatorgroup clusterrole management
• OCPBUGS-57294 - Fix e2e-aws-ovn-image-ecosystem test - Part 2 - remove old nodejs 18,ruby 3.1 ubi9
• OCPBUGS-57296 - The cluster role manifest has unnecessary duplication
• OCPBUGS-57297 - OVE UI build is failing because of outdated mtv-operator
• OCPBUGS-57298 - cleanup hello-openshift yaml
• OCPBUGS-57316 - hypershift version in CLI returns "<unknown>" for Server Version when HyperShift operator is deployed
• OCPBUGS-57336 - HyperShift operator fails to clear user-ca-bundle when additionalTrustBundle no longer set
• OCPBUGS-57342 - [sig-arch][Late][Jira:"kube-apiserver"] [OCPFeatureGate:ShortCertRotation] all certificates should expire in no more than 8 hours [Suite:openshift/conformance/parallel] test is failing
• OCPBUGS-57346 - Bump iso-builder appliance dependency
• OCPBUGS-57348 - Cluster manages bootimages despite explicit bootimages in installconfig
• OCPBUGS-57349 - non-constant format string in call to fmt.Errorf
• OCPBUGS-57361 - OVE UI credentials generation occasionally fails due to host roles
• OCPBUGS-57370 - Reduce the default to avoid network issues
• OCPBUGS-57387 - Seeing "content filepath is tainted" error when running d2m
• OCPBUGS-57392 - Update unified perspective onboarding modal to match Virtualization
• OCPBUGS-57419 - Excessive CBO logs: new CO status (when the status is not new)
• OCPBUGS-57426 - Boot image controller should correctly handle marketplace boot images
• OCPBUGS-57433 - [4.20] OCP 4.18.15 - EgressIP appears to remove and re-allocate endpoints periodically leading to packet loss (no egressIP migration between hosts observed)
• OCPBUGS-57435 - The MCO should have it's own test suite in o/origin
• OCPBUGS-57450 - Support router PublishStrategy on IBM Cloud
• OCPBUGS-57454 - Fix Health Metrics reported on IPE
• OCPBUGS-57458 - machine-config ClusterOperator should include MachineConfiguration in relatedObjects
• OCPBUGS-57461 - oc-mirror errors out showing it trying to fetch from registry.redhat.io, in air-gapped env.
• OCPBUGS-57466 - Default name is comprised of '-' on 'Add to favorites' page when language is Korean/Japanese/Chinese.
• OCPBUGS-57472 - [BMaaS] No handling of validation errors for image
• OCPBUGS-57481 - OCP Console show huge negative CPU utilization values
• OCPBUGS-57484 - after OVN-K live migration br0 is still present
• OCPBUGS-57487 - Fix OAuth-Proxy tests
• OCPBUGS-57492 - Hypershift tests permafailing on kubevirt-aws
• OCPBUGS-57497 - Large proxy trust bundle in ignition stub results in failed machine creation
• OCPBUGS-57506 - MCO's falling back to the default region causes the invalid AMI image.
• OCPBUGS-57516 - CI jobs for Baremetal with Agent fail waiting for agents to appear
• OCPBUGS-57517 - Remove Python 3.8-ubi8 from Origin
• OCPBUGS-57519 - Console operator downloads pod restarting and pathlogical events
• OCPBUGS-57520 - Add E2E Last Level cache runtime sanity tests
• OCPBUGS-57524 - Improve stability of MCN slow tests MCO disruptive suite
• OCPBUGS-57535 - nip.io no longer is available causing installer vsphere unit tests to fail
• OCPBUGS-57581 - MachineSet annotation controller should respect status.authoritativeAPI
• OCPBUGS-57630 - openshift-console/download pods running on random nodes
• OCPBUGS-57635 - Component Readiness: [oc] [Other] multiple tests regressed on metal
• OCPBUGS-57643 - Network operator not updating due to missing release version annotation on whereabouts-controller and whereabouts-token-watcher
• OCPBUGS-57666 - Component Readiness: [Node / Kubelet] [PodLifecycleSleepAction] test regressed
• OCPBUGS-57732 - Panic error during the destruction of an OpenShift 4.18 on GCP using the OpenShift installer
• OCPBUGS-57736 - Console degraded with "claimMappings.extra: field not declared in schem" when set extra field in external oidc
• OCPBUGS-57746 - Console extension console.action/resource-provider do not customize default page actions
• OCPBUGS-57790 - KubeAPIServerDNSName not handled by shared ingress
• OCPBUGS-57803 - MCO manifest for disabling boot image management should consider edge nodes on AWS
• OCPBUGS-57862 - Update operators list in OVE ISO (4.19)
• OCPBUGS-57898 - Incorrect i18n translations in 4.19 batch
• OCPBUGS-57918 - CannotRetrieveServiceAccount when image registry is disabled
• OCPBUGS-57923 - Failed to create install-config/cluster in interactivate way if AWS_PROFILE is invalid
• OCPBUGS-57934 - Sync stable branch for cluster-api-provider-openstack release-0.12 into release-4.19
• OCPBUGS-57936 - Upgrades distribution/distribution to a stable version
• OCPBUGS-57954 - Replace deprecated Red Hat Marketplace link
• OCPBUGS-57957 - imagecontentsourcepolicy list max items is 25
• OCPBUGS-57962 - Incorrect Image references in dpu-operator 4.20 Branch
• OCPBUGS-57967 - ingress-node-firewall-operator-Incorrect image references in 4.20 branch - ART
• OCPBUGS-57969 - clusterresourceoverride-operator- Incorrect image references in 4.20 branch - ART
• OCPBUGS-57979 - KubeletConfig unsets TechPreviewNoUpgrade feature gates
• OCPBUGS-58031 - AKS: HCP operator should set Shared ClusterServiceLoadBalancerHealthProbeMode
• OCPBUGS-58036 - [sig-mco] MCN test is perma-failing on agent compact FIPS jobs
• OCPBUGS-58050 - Create PVC page + Clone PVC modal are missing PatternFly form styles
• OCPBUGS-58061 - Ignition Server token secret payload too long - over 1048576 bytes
• OCPBUGS-58094 - console pods are frequently redeployed
• OCPBUGS-58149 - HyperShift produces an error when providing an authentication OIDC client without a client secret
• OCPBUGS-58155 - CNO expects IngressController CRD even when Ingress capability is disabled
• OCPBUGS-58158 - Spike in service network disruption
• OCPBUGS-58166 - Signal Correlation Button Shouldn't be shown in non-admin perspectives
• OCPBUGS-58186 - oc-mirror v2 doesn't retry when timeout at mirroring a image
• OCPBUGS-58191 - Image Mode constantly creating new MOSBs when using a non-dockerconfigjson push secret
• OCPBUGS-58193 - [v2]diskToMirror on disconnected env --from option has not checked whether the folder exists, or the tar file in the folder
• OCPBUGS-58200 - hostedcluster version history causes resource to be invalid
• OCPBUGS-58208 - Runtime error page shows up when editing HPA with ContainerResource type from deployment action list
• OCPBUGS-58216 - SNO installation with UPI failed
• OCPBUGS-58226 - OVE ISOBuilder works only if and when the script is executed from the iso_builder directory
• OCPBUGS-58238 - Image Mode creates new MOSBs when osbuilder is drained and it results in degraded MCPs
• OCPBUGS-58254 - EFS CSI driver operator syncs CredentialsRequests when unmanaged
• OCPBUGS-58258 - Navigating away from plugin console.tab/horizontalNav to other tabs results in white tab page
• OCPBUGS-58267 - [fr] Login screen is in Spanish
• OCPBUGS-58273 - Passing Origin header when using console proxy
• OCPBUGS-58275 - Missing Microshift NetworkPolicy
• OCPBUGS-58299 - hypershift do not accept the "remove" json patch operation
• OCPBUGS-58307 - Nodes not approved when BMH contains blank NIC values
• OCPBUGS-58309 - [CI-WATCHER] topology-ci.feature tests are flaking
• OCPBUGS-58311 - Change start implementation of the terminal in web-terminal tests
• OCPBUGS-58320 - RHDH Quickstart in OCP console refers to deprecated v1alpha1 Backstage CRD version
• OCPBUGS-58334 - Namespace column should not show when one project is selected
• OCPBUGS-58336 - Description for leaderworkerset operator in console should update.
• OCPBUGS-58349 - bundle unpacking jobs do not tolerate master nodes
• OCPBUGS-58352 - GCP failed to provision resources during HIVE install
• OCPBUGS-58354 - [Jira:\"kube-apiserver\"] monitor test apiserver-incluster-availability setup
• OCPBUGS-58358 - Service Mesh 3 creates a podDisruptionBudget object that prevents nodes from upgrading
• OCPBUGS-58387 - karpenter / kas controlPlaneComponent dev breaks in 4.19
• OCPBUGS-58393 - "oc login -u" in external oidc env can succeed but misleadingly causes following oc commands fail
• OCPBUGS-58424 - Image registry failed to create with x509 error in azurestackhub platform
• OCPBUGS-58427 - Cluster monitoring operator resets annotations for metrics client CA
• OCPBUGS-58429 - MAO multi-nic e2e tests not cleaning up machines
• OCPBUGS-58443 - In OCL for reboot, after applying ssh/file/password based MC the MCP is stuck in updating state
• OCPBUGS-58448 - CNO - Remove PersistentIPsForVirtualization featuregate from CNO
• OCPBUGS-58449 - Add Php 8.2-ubi9 to Origin
• OCPBUGS-58467 - [v2] --parallel-images flag have not check the valid min and max value
• OCPBUGS-58469 - performance issue - Global configuration page
• OCPBUGS-58475 - Use of insecure cipher warning info in CMO logs
• OCPBUGS-58880 - CAPI Operator churning status
• OCPBUGS-58883 - Remove podman-etcd from MCO
• OCPBUGS-59099 - Bump documentationBaseURL to 4.20
• OCPBUGS-59104 - Dual-Stack Cluster Fails BMC Discovery Due to Missing IPv6 on Some Ironic-Proxy Pods
• OCPBUGS-59134 - whereabouts container defines limits where it's not allowed
• OCPBUGS-59135 - Workloads should be annotated correctly
• OCPBUGS-59139 - CI fails on TestGatewayAPI/testGatewayAPIDNS/gatewayListenersWithOverlappingHostname
• OCPBUGS-59159 - DNS availability for SNO is at ~98.8 instead of the required 99%
• OCPBUGS-59163 - Enum values are not shown in ExploreType component
• OCPBUGS-59187 - OVE ISOBuilder: invalid default channel configuration for package "mtv-operator"
• OCPBUGS-59194 - [ARO HCP] HostedCluster deletion fails due to Image Registry managementState validation
• OCPBUGS-59195 - Clicking on container dropdown button has no response when pod log is in fullscreen.
• OCPBUGS-59196 - [UIPlugin UI] can't assign to property "kind"
• OCPBUGS-59203 - MCN happy scope test should run as a serial test
• OCPBUGS-59204 - A '/' displayed on page after clicking 'Image Stream Tag' item on buildconfig creation page
• OCPBUGS-59210 - Backport OTE tests to 4.19 (dummy bug required for 4.19 backporting)
• OCPBUGS-59215 - Broken monitoring perspective switching for namespaced user
• OCPBUGS-59218 - many tests regressed on hypershift azure: failed to get load balancer
• OCPBUGS-59220 - Re-introduce IBMCloud as a platform that supports SNO installs
• OCPBUGS-59231 - Namespace column on Pipelines list has too limited width
• OCPBUGS-59251 - aws-cloud-controller-manager runs into failure after cluster upgrade due to 'cloud-conf' ConfigMap is missing
• OCPBUGS-59256 - CSI certification tests fail on "volumepopulators.populator.storage.k8s.io already exists"
• OCPBUGS-59269 - Role metrics are missing after restarting sidecar container in linuxptp-daemon
• OCPBUGS-59277 - 2nd step(Software Catalog) in Console Tour points to Helm menu when Ecosystem is collapsed
• OCPBUGS-59319 - vSphere Problem Detector: Unable to determine vCenter for VM
• OCPBUGS-59345 - OVE UI fails to install when using OCP 4.19.4 in TechPreview
• OCPBUGS-59349 - [4.20] VERIFIED branch sync bug
• OCPBUGS-59354 - E2E test to verify Guranteed pod is running after kubelet restart
• OCPBUGS-59376 - GCP scaling is slow when scaling large volumes of nodes
• OCPBUGS-59382 - OpenShift Console's "Start Job" action overrides configured "backoffLimit" to "6"
• OCPBUGS-59396 - oc-mirror "hangs" when the tar file is 0 bytes
• OCPBUGS-59400 - Include go-verify-deps expected files in gitignore for prometheus-alertmanager
• OCPBUGS-59418 - CronTab plugin extensions `flags` are invalidly nested inside `properties`
• OCPBUGS-59430 - although "create manifests" got fatal error of "no matching public DNS Zone found", the install-config is consumed unexpectedly
• OCPBUGS-59483 - New get started message takes up too much space and 'no **resources found' message can not be shown completely on the page.
• OCPBUGS-59526 - ROSA hypershift tests use variable part in the secret
• OCPBUGS-59527 - Invalid target signer validity is preventing from issuing node-system-admin-client for 2 years
• OCPBUGS-59533 - Bump to Kubernetes v1.33.3
• OCPBUGS-59541 - console-crontab-plugin integration tests fail in CI because of auth changes
• OCPBUGS-59542 - Nutanix MachineSets Not Generated for Autoscaling with Failure Domains
• OCPBUGS-59550 - console plugins table lacks data-test attributes
• OCPBUGS-59554 - console-crontab-plugin has build warning
• OCPBUGS-59555 - Add Ubi10 to ImageEcosystem tests
• OCPBUGS-59563 - Resolving API Version Conflicts in Tekton Pipeline Runs
• OCPBUGS-59586 - click adding env resource dropdown button on deploy from image page will always put user to page top
• OCPBUGS-59603 - Component Readiness: [Storage] [(delete policy)] test regressed
• OCPBUGS-59646 - oc mirror command produces no output when executed on RHEL 8 with /tmp mounted as noexec in /etc/fstab
• OCPBUGS-59672 - TestMCNPoolNameCustom should clean up resources properly
• OCPBUGS-59714 - oc-mirror unable to mirror Helm Chart with aliased sub-chart dependencies
• OCPBUGS-59723 - Add mechanism to delete MCN v1alpha1 CRD in 4.16+ clusters
• OCPBUGS-59724 - OVE ISO: Add back NodeHealthCheck (NHR) and FenceAgentsRemediation (FAR) operators
• OCPBUGS-59725 - registryPoll API route sometimes doesn't work
• OCPBUGS-59734 - Image registry operator is leaking inotify file descriptors
• OCPBUGS-59736 - shared user UID across all HostedClusters in hypershift
• OCPBUGS-59756 - High estimated costs for resource quantity in CEL expressions
• OCPBUGS-59771 - [ci-watcher] AlertManager config page does not load
• OCPBUGS-59776 - Machine-Config-Updater causes too many applies in techpreview tests
• OCPBUGS-59780 - ARO clusters cannot scale on upgrade to 4.19
• OCPBUGS-59781 - [openshift-dns] - readOnlyRootFilesystem should be explicitly to true and if required to false for security reason
• OCPBUGS-59794 - CCM pod panic in e2e-nutanix-operator jobs
• OCPBUGS-59839 - Enabling Gateway API causes 'unknown field "spec.values.global.trustBundleName"' errors
• OCPBUGS-59862 - normal user has no permission to install operator but we show "Discover and install Operators from the OperatorHub." message on Installed Operators page
• OCPBUGS-59880 - AWS Public Hypershift clusters cannot be restored automatically
• OCPBUGS-59882 - linuxptp-daemon image missing from ptp-operator.v4.20.0-202507221345 in brew
• OCPBUGS-59886 - Component Readiness: [Storage] [FeatureGate:SELinuxChangePolicy] test regressed
• OCPBUGS-59887 - OpenShift CAPZ is missing upstream bug fix kubernetes-sigs#5552.
• OCPBUGS-59894 - CI fails on testGatewayAPIIstioInstallation because Istiod has too many pods
• OCPBUGS-59913 - [v2] invalid value of mirror.helm.local.path in ImageSetConfiguration file causes panic when mirror
• OCPBUGS-59919 - Techpreview: ControlPlaneMachineSet goes into re-create loop after it is set inactive due to spec.AuthoritativeAPI
• OCPBUGS-59949 - [v2] oc-mirror displays incorrect mirrored image count for helm charts
• OCPBUGS-59959 - etcd should use a specific uid when no SCCs
• OCPBUGS-59967 - disableMP set to true in BGPPeer resource YAML is not effective, it set to false in the generated frrconfiguration
• OCPBUGS-59969 - curling for clock class terminates with exit code 7 after side car is restarted
• OCPBUGS-60008 - [CoreDNS] TestZoneExternalCNAMELookupWithProxy fails due to changed response for example.org domain
• OCPBUGS-60010 - ResourceEventStream hides errors
• OCPBUGS-60035 - After scale down the last node has ToBeDeletedByClusterAutoscaler taint if creating a new machineset
• OCPBUGS-60047 - Component Readiness: [Networking / DNS] [PerformanceDNS] test regressed
• OCPBUGS-60056 - Timestamp unit tests are flaky
• OCPBUGS-60060 - [marketplace-operator] Update IBM pod accordingly to have the same fixes done over the time
• OCPBUGS-60064 - Hypershift Workloads missing app label
• OCPBUGS-60118 - Remove check on snapshot create support for multi-writer HyperDisk-HA
• OCPBUGS-60119 - Invalid architecture value found in annotation during 4.19 update
• OCPBUGS-60122 - Ingress details page crash
• OCPBUGS-60130 - Remove X-XSS-Protection header
• OCPBUGS-60145 - Component Readiness: [OCPFeatureGate:VSphereMultiNetworks] test regressed
• OCPBUGS-60151 - Update `Guided tour` -> `Guided Tour` in help menus
• OCPBUGS-60173 - ci/prow/e2e-gcp job perm-failing for network-metrics-daemon repo
• OCPBUGS-60179 - Bump Kubernetes Version to v0.33.3
• OCPBUGS-60187 - Hypershift ShardIngress HAProxy config reloader issues
• OCPBUGS-60190 - no scc securitycontext uid should reuse released uids
• OCPBUGS-60198 - Observe dashboards legend is hidden behind horizontal scrollbar
• OCPBUGS-60219 - Hits UpdatePayloadResourceTypeMissing error "a required extension is not available to update" due to 'Could not update oauthclient "console" (626 of 1009): the server does not recognize this resource, check extension API servers'
• OCPBUGS-60237 - Singular etcdDatabaseQuotaLowSpace critical PrometheusRule isn't sufficient
• OCPBUGS-60238 - rteval package in openshift-tests image pulls in 82 rpms and 349 MiB
• OCPBUGS-60240 - Regression: Baremetal IPI installation fails when IPv6 only BMC Network
• OCPBUGS-60242 - Use protobuf when connecting to kube client
• OCPBUGS-60255 - 4.20: PTP Daemon won't publish openshift_ptp_process_status metrics after node soft reboot
• OCPBUGS-60258 - openshift-cluster-node-tuning-operator node-tuning-operator endpoint 60000 port should return 401 without auth
• OCPBUGS-60260 - [OLMv1] Enable layered operators to include and deploy tailored Network Policies within OLM bundles
• OCPBUGS-60264 - Error while validating NetworkAttachmentDefinition with empty spec
• OCPBUGS-60281 - panic with `oc describe templateinstance`
• OCPBUGS-60284 - Upgrade Clusterapi-Provider-Nutanix in installer to 1.7
• OCPBUGS-60287 - MOSB is not getting triggred.
• OCPBUGS-60302 - CI fails on TestGatewayAPI/testGatewayAPIResourcesProtection/Pod_binding_required
• OCPBUGS-60373 - [QuickStarts] Link buttons to other quickstarts are duplicate
• OCPBUGS-60375 - Remove Perl 5.32-ubi8
• OCPBUGS-60376 - AutoNode karpenter stops working after a token rotation
• OCPBUGS-60381 - Hostedcluster error about two DNS name in SAN certificate
• OCPBUGS-60399 - Wrap EnsureKubeAPIDNSNameCustomCert and EnsureGlobalPullSecret in their own test
• OCPBUGS-60428 - Multiple ExclamationCircleIcon icon in image stream field of container image form
• OCPBUGS-60435 - [OLMv0] Enable layered operators to include and deploy tailored Network Policies within OLM bundles
• OCPBUGS-60452 - k-nmstate deadlocks when environment state is complex
• OCPBUGS-60461 - llc test fix: Get updated Performance profile before modifying
• OCPBUGS-60463 - E2E Dynamic OVS Pinning test case fixes
• OCPBUGS-60545 - azure stack up install failed because api loadBalancer not available
• OCPBUGS-60547 - etcdHighCommitDurations firing on azure intermittently since
• OCPBUGS-60550 - Component Readiness: EgressFirewall] when using openshift ovn-kubernetes should ensure egressfirewall is created
• OCPBUGS-60559 - Update MCO-OCL OTE and QE tests for pool name matching
• OCPBUGS-60573 - E2E: RPS: Avoid multiple profile updates
• OCPBUGS-60600 - node-image create command fails with "99-worker-ssh not found"
• OCPBUGS-60602 - CPO is not caching KMS Azure authentication for ARO HCP
• OCPBUGS-60611 - Collect the command line logs from the virt-launcher containers
• OCPBUGS-60620 - CI fails on TestGatewayAPI/testGatewayAPIObjects
• OCPBUGS-60628 - Ensure that RefreshOnlyWhenExpired is set for every controlled resource
• OCPBUGS-60633 - The provisioning of multiple ProvisioningRequests fails
• OCPBUGS-60634 - Clean up potential leftover spbm entity configs
• OCPBUGS-60647 - T-BC Holdover: Clock Class is unable to upgrade back to Locked (6) after degrading
• OCPBUGS-60651 - Fix MCE 2.10 Konflux EC violation
• OCPBUGS-60653 - [HyperShift] aws-external-oidc teardown failing too often
• OCPBUGS-60655 - New Azure CSI SCSI LUN test is unstable
• OCPBUGS-60656 - MCO MachineConfigNodes Invalid PIS test flaky on metal
• OCPBUGS-60679 - OADP job with console permafail blocking 4.20 release
• OCPBUGS-60684 - Backup/Restore false positive issue
• OCPBUGS-60689 - Use kube_statefulset_replicas for KubeStatefulSetReplicasMismatch
• OCPBUGS-60691 - Improve KubeAggregatedAPIErrors alert in high availability scenarios
• OCPBUGS-60692 - Filter NodeReadiness to take cordoned nodes into account
• OCPBUGS-60753 - several issues on Builds Logs page
• OCPBUGS-60756 - "Delete PersistentVolumeClaim" action item is placed in the middle of action list
• OCPBUGS-60772 - GCP Internal loadbalancers not provisioning
• OCPBUGS-60844 - alert/OVNKubernetesResourceRetryFailure firing on GCP
• OCPBUGS-60851 - metal-ipi-upgrade-ovn-ipv6 permafailing on upgrades
• OCPBUGS-60877 - 'oc adm inspect-alerts' and relatives should respect --certificate-authority
• OCPBUGS-60883 - PIS tests using custom MCPs are not running as intended
• OCPBUGS-60891 - KAS config skew with standalone OCP on goaway-chance
• OCPBUGS-60941 - etcdmemberscontroller health check declares all members unhealthy
• OCPBUGS-60943 - [AWS][CAPI] machine get Running when set CapacityReservationsOnly on spot instance
• OCPBUGS-60945 - NewOLM catalog install test has regressed in 4.20
• OCPBUGS-60948 - SELinux metric is not reported via telemetry
• OCPBUGS-60989 - oc adm release info does not show some change log
• OCPBUGS-61016 - OCB test failling because of not ready pods in the MCO namespace
• OCPBUGS-61044 - Fix: CAPA rebase on top a proper release instead of main
• OCPBUGS-61051 - E2E: skip stalld test case checking sched_fifo
• OCPBUGS-61066 - AWS: vpc endpoints not created when LB subnets specified in private-router
• OCPBUGS-61120 - No Major.Minor.Patch elements found when installing Konflux built OCP on PowerVS
• OCPBUGS-61166 - rosa-sts-ovn job permafailing nightly payloads due to use of deprecated k8sPrometheusAdapter
• OCPBUGS-61174 - Hypershift Failures due to `openshift-insights/insights-operator` deployment failures
• OCPBUGS-61197 - [4.20] SELinux warning controller does not report conflicts with ""
• OCPBUGS-61207 - PrometheusRemoteWriteBehind alert firing when a remote-write queue drops all samples
• OCPBUGS-61230 - Enabling invalid or missing plugin causes console to crash loop
• OCPBUGS-61249 - Fix logging of CSO e2e tests
• OCPBUGS-61257 - Port 8089 used by Ironic and k-nmstate
• OCPBUGS-61321 - aws-cloud-controller-manager deployment orphaned in y-stream upgrade to 4.20
• OCPBUGS-61322 - control-plane-pki-operator reconciliation failure on 4.19->4.20 upgrade
• OCPBUGS-61323 - Fix arch issue on KCM operator
• OCPBUGS-61325 - Fix arch issue on cluster-kube-storage-version-migrator-operator
• OCPBUGS-61327 - Software Catalog side navigation category list is not listed alphabetically
• OCPBUGS-61333 - Bump to Kubernetes v1.33.4
• OCPBUGS-61347 - Kube API Server Crashes on Audit Log Event
• OCPBUGS-61370 - multus-networkpolicy daemonset rolls out one node at a time
• OCPBUGS-61374 - [release-4.20] CIFS/SMB CSI Driver is unable to use secrets with special characters
• OCPBUGS-61461 - [4.20] Revert the switch to local RPC on 4.21 and 4.20
• OCPBUGS-61478 - kubectl logs test flakes occasionally
• OCPBUGS-61494 - Component Readiness: [oauth-apiserver] [ProjectAPI] TestProjectWatch test regressed
• OCPBUGS-61516 - Machine-config controller should actively manage cordon while draining
• OCPBUGS-61517 - ptp sidecar log is spamming IsHAProfile messages (OC/BC HA config)
• OCPBUGS-61528 - [GCP] installing into GCP shared VPC with BYO hosted zone failed with error "failed to create the private managed zone"
• OCPBUGS-61540 - [Monitoring] New prometheus targets auth test failing too often
• OCPBUGS-61543 - ManagementState of jobset/lws operator doesn't take effect.
• OCPBUGS-61544 - kube-scheduler operator's some containers don't have ROFS
• OCPBUGS-61546 - [release-4.20] csi resizer: resizing PVC close to creation may result in dropped sync
• OCPBUGS-61552 - Fix shellcheck errors in Installer's 4.20 branch
• OCPBUGS-61553 - Show correct version for the jobset operator
• OCPBUGS-61563 - 'format exec' errors in serial techpreview tests on arm due to test images are not multi-arch
• OCPBUGS-61575 - KAS postStart hook doesn't respect hostedcluster.spec.networking.apiServer.port
• OCPBUGS-61586 - the default container on the cloud credential operator should not be the kube-rbac-proxy container
• OCPBUGS-61600 - Prow job failure: config-operator unstable when featureSet is DevPreviewNoUpgrade
• OCPBUGS-61647 - [release-4.20] CAPV unit tests not being run (no presubmits) and wrong path in script
• OCPBUGS-61667 - ignition-server pods are frequently restarting
• OCPBUGS-61670 - Kube controller manager fails to run when setting a large memory request
• OCPBUGS-61671 - i18n upload/download routine task for OCP version 4.20
• OCPBUGS-61680 - Excessive API calls by prometheus-operator ServiceAccount
• OCPBUGS-61705 - OLMv1 fail to use the custom CA: x509: certificate signed by unknown authority
• OCPBUGS-61720 - VolumeGroupSnapshot vac-protection finalizer test failing too often on metal
• OCPBUGS-61731 - [4.20] Update ExternalOIDC payload tests to use proper e2e image proces
• OCPBUGS-61732 - [4.20] ExternalOIDC tests - retry route creations
• OCPBUGS-61746 - oauth-openshift deployment is not HA
• OCPBUGS-61753 - [4.20] oauth and openshift-apiserver related disruptions around operator upgrade
• OCPBUGS-61770 - CAPI to MAPI Machine conversion failed
• OCPBUGS-61819 - Blocked Pod Terminal View in OCP Console
• OCPBUGS-61820 - [release-4.20] CAPA (downstream): revert carry for limiting tagging NetworkInterfaces in RunInstances
• OCPBUGS-61824 - NMState service failing in some deployments
• OCPBUGS-61830 - ptp sidecar is spamming error msg="Interface does not match Intel or Mellanox naming format, using original interface name"
• OCPBUGS-61853 - PinnedImageSets test failing often on vsphere
• OCPBUGS-61882 - Panic seen in CI job for MCO pod
• OCPBUGS-61884 - Enhance capi spot/dedicated cases for InsufficientInstanceCapacity error
• OCPBUGS-61886 - Fix could not delete placement group: InternalError: An internal error has occurred
• OCPBUGS-61889 - Fix api error Unsupported: The requested configuration is currently not supported. Please check the documentation for supported configurations.
• OCPBUGS-61906 - SSCSI driver operator: default make is broken on non-fips systems
• OCPBUGS-61963 - If there is still no capacity after retrying, skip instead of fail
• OCPBUGS-61966 - Service CA Operator Hotloops on Invalid serving-cert-secret-name
• OCPBUGS-61977 - MachineConfigNode objects should include age in additionalprintcolumns
• OCPBUGS-62007 - OCPFeatureGate:ExternalOIDCWithUIDAndExtraClaimMappings test regressed
• OCPBUGS-62015 - Help dropdown should be closed automatically after tour model opened
• OCPBUGS-62053 - The kube controller pods are showing some Panic errors
• OCPBUGS-62073 - MCN CRD clean up script should use legacy master node label and log all errors
• OCPBUGS-62096 - [azure-file] should not delete fileshare when deleting the volumesnapshot
• OCPBUGS-62146 - dpu operator CGO check failed
• OCPBUGS-62211 - [sig-api-machinery][Feature:ReadOnlyRootFilesystem] Explicitly set readOnlyRootFilesystem to true [OCP-83088][Timeout:50m][Skipped:Disconnected] [Suite:openshift/conformance/parallel]
• OCPBUGS-6508 - No validation prevents IPI installing only a single node
• OCPBUGS-7747 - autoSizingReserved allocating too low CPU reservation
• OCPBUGS-8881 - Deployment fail with Proxy mode enabled, IPv6 only

CVEs

• CVE-2024-45339
• CVE-2024-45497
• CVE-2025-22869
• CVE-2025-53547

References

• https://access.redhat.com/security/updates/classification/