RHSA-2026:2129 - Security Advisory

Topic

Red Hat OpenShift Container Platform release 4.21.1 is now available with updates to packages and images that fix several bugs and add enhancements.

This release includes a security update for Red Hat OpenShift Container Platform 4.21.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container Platform 4.21.1. See the following advisory for the RPM packages for this release:

https://access.redhat.com/errata/RHSA-2026:2082

Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/

Security Fix(es):

• helm.sh/helm/v3: Helm Chart JSON Schema Denial of Service (CVE-2025-55199)
• helm.sh/helm/v3: Helm YAML Parsing Panic Vulnerability (CVE-2025-55198)
• github.com/sirupsen/logrus: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload (CVE-2025-65637)
• python-eventlet: Eventlet HTTP request smuggling (CVE-2025-58068)
• qs: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284)
• golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

All OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli.

Solution

For OpenShift Container Platform 4.21 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

(For x86_64 architecture)
The image digest is sha256:7ca8870aa5e505f969aa26161594a3f99b65baf7d29bab8adaca0cade51b0bb6

(For s390x architecture)
The image digest is sha256:b33dc753fbb59cc939496922a7f65b3eaf145214f5635c9824790a5bc7a0b5a2

(For ppc64le architecture)
The image digest is sha256:46bd467d5cee3e80019ef25c8af7460dfee7e5ae376dd640b76251666eafc98a

(For aarch64 architecture)
The image digest is sha256:6d018f320d0ba0496fe3410470c2ea3c58e9d77a95fe0f64f3120bc1115f9bf1

All OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli.

Fixes

• BZ - 2388449
• BZ - 2388451
• BZ - 2391958
• BZ - 2407258
• BZ - 2418900
• BZ - 2425946
• OCPBUGS-14246 - Critical Alert Rules do not have runbook url
• OCPBUGS-15495 - telemeter-client logs at debug level by default
• OCPBUGS-33372 - HyperShift Has Usages of Azure Clients that Aren't Cloud Agnostic
• OCPBUGS-33487 - VScode cannot autocomplete imports in the console repo
• OCPBUGS-33879 - Alerts not available in status page from project in OCP web console
• OCPBUGS-34950 - Bootstrap log gathering fails on OpenStack platform
• OCPBUGS-35387 - Add permissions to the view default role for network CRDs
• OCPBUGS-36360 - [CAPI Azure] Fail to create cluster by using client certs to authenticate
• OCPBUGS-36389 - required label missing from the metric error sending metrics to Telemetry
• OCPBUGS-37215 - Pods in openshift-apiserver are unable to parse manifest due to unexpected end of JSON input
• OCPBUGS-38358 - hostedcontrolplane controller crashes when hcp.Spec.Platform.AWS.CloudProviderConfig.Subnet.ID is undefined
• OCPBUGS-38759 - The master node in MC cluster report insufficent memory due to MAPI controller used too much memory
• OCPBUGS-42303 - [release-4.21] egressIP GARP sent by incorrect node after reboot
• OCPBUGS-43919 - set ingresscontroller status.endpointPublishingStrategy and status.endpointPublishingStrategy.loadBalancer as null causes ingress operator panic
• OCPBUGS-44235 - When configuring CA certificates to HelmChartRepository or ProjectHelmChartRepository, the charts installation breaks down
• OCPBUGS-44436 - Hypershift operator pod crashes when a HC is created with no NodePort address
• OCPBUGS-45671 - remote_write - oauth2's tokenURL not using proxy settings
• OCPBUGS-49908 - [DCM] Service idling fails due to non disabled health check on server slot with clusterIP address
• OCPBUGS-51041 - Update nodeip-configuration.service service files to use SyslogIdentifier
• OCPBUGS-51136 - Data plane system pod reconciliation may fail due to SCC selection
• OCPBUGS-51305 - Vulnerability Identified: SSL Medium Strength Cipher Suites Supported (SWEET32) for tcp/10258
• OCPBUGS-52302 - Desired config version in MCN is being set in status before spec
• OCPBUGS-54490 - Missing Azure Permissions in Cloud Controller Manager CredentialsRequest
• OCPBUGS-54682 - NetworkManager restart or crash renders br-ex unusable
• OCPBUGS-54703 - CAPI to MAPI Machine conversion failed
• OCPBUGS-55192 - Improve API validation for .spec.domain
• OCPBUGS-55489 - [v2] oc-mirror sets unintended executable flag on some synchronized files.
• OCPBUGS-55625 - "cloud.network.openshift.io/egress-ipconfig" annotation set to the wrong prefix in azure if the subnet uses addressPrefixes field instead of addressPrefix
• OCPBUGS-55649 - Remove SetEIPForNLBIngressController featuregate
• OCPBUGS-55673 - Remove IngressControllerLBSubnetsAWS featuregate
• OCPBUGS-55746 - Operand details page not parsing operand status and grouping descriptors correctly
• OCPBUGS-56049 - ipi install if dell/AMD servers unable to build cluster because interface names are not being assigned correctly
• OCPBUGS-56281 - Higher CPU usage in 4.19 compared to 4.18
• OCPBUGS-56444 - Enable Structured Auth Config uid and extras fields
• OCPBUGS-56451 - Installer should parse the mirrorSourcePolicy field under imageDigestSources
• OCPBUGS-56568 - PrometheusRemoteWriteBehind alert firing when a remote-write queue drops all samples
• OCPBUGS-56594 - Kube API Server Crashes on Audit Log Event
• OCPBUGS-56599 - Service CA Operator Hotloops on Invalid serving-cert-secret-name
• OCPBUGS-56648 - layered image update loops on failure to find systemd unit files, MCP degraded
• OCPBUGS-56664 - Data disks defined in the machine set configuration are not being provisioned onto an Azure Stack Hub
• OCPBUGS-56691 - MustGather flag --volume-percentage does not enforce disk usage limits if EmptyDir sizeLimit is unset, risking filling up the node disk
• OCPBUGS-56701 - Creating hosted cluster from CLI fails due to invalid ReleaseImage
• OCPBUGS-56749 - Packets not being forwarded from pod to edge interface (OVS_DROP_LAST_ACTION)
• OCPBUGS-56892 - OpenShift Console can only show user name instead of full name as the display name
• OCPBUGS-56913 - ABI failures after cluster is registered are ignored
• OCPBUGS-56915 - Log In : Error message is in English
• OCPBUGS-57053 - [OCP4.21][OVN-Kubernetes] stale conntrack UDP entry when deleting openshift-dns pod
• OCPBUGS-57090 - CIFS/SMB CSI Driver is unable to use secrets with special characters
• OCPBUGS-57126 - Add node-image-pull to the list of services to check their logs in /etc/motd
• OCPBUGS-57191 - The kube controller pods are showing some Panic errors
• OCPBUGS-57364 - [AWS Custom DNS] Bootstrap process failed due to timeout
• OCPBUGS-57444 - If one master node stays down authentication the cluster fails due to stuck authentication pod revision rollout
• OCPBUGS-57474 - Component Readiness: [oauth-apiserver] [ProjectAPI] TestProjectWatch test regressed
• OCPBUGS-57482 - [CI][HCP][OpenStack] Failed to deploy lvms-operator at hypershift openstack-nested-conformance jobs
• OCPBUGS-57646 - Cluster Recommending Same Installed Version for Upgrade in Multi-Architecture Environment
• OCPBUGS-57797 - storage is not degraded on storage policy sync error
• OCPBUGS-58118 - Can't create Kueue CR in the form view of the OpenShift console
• OCPBUGS-58198 - MCP reporting wrong number of ready nodes when Image Mode is disabled
• OCPBUGS-58313 - apiserver-library-go shall be updated to include more safed sysctl to reflect upstream changes
• OCPBUGS-58462 - more enum values cannot be added for an existing field
• OCPBUGS-58501 - UDN service flows on br-ex are not correctly considering ip family
• OCPBUGS-59105 - Azure installation fail when v-net subnets are pre-configured.
• OCPBUGS-59477 - nodeip-configuration returns addresses in non-deterministic order
• OCPBUGS-59518 - [olmv1] ClusterExtension status and message cannot reflect the real state: Too long: may not be more than 32768 bytes
• OCPBUGS-59529 - Truncated topology context menus not readable
• OCPBUGS-59634 - Filter input dialogue takes up a whole line on events page
• OCPBUGS-59649 - Follow up changes for globalPullSecret
• OCPBUGS-59657 - pod(VM) on default network->pod on localnet (with VLAN & external router) on same node is broken
• OCPBUGS-59730 - The CRD field type changes prevent operator updates in OLMv1
• OCPBUGS-59763 - openshift-marketplace marketplace-operator-metrics endpoint 8081 port exposed all the information without any authorization
• OCPBUGS-59768 - openshift-operator-lifecycle-manager catalog-operator-metrics/olm-operator-metrics endpoints exposed all the information without any authorization
• OCPBUGS-59774 - oc adm must-gather not stopped after timeout reached
• OCPBUGS-59925 - Metal and Vsphere kube-api-new-connections Disruption Increase
• OCPBUGS-59951 - Must gather pkill fails when the running command is not the default
• OCPBUGS-59968 - Cert Controller should live fetch SAN IPs during cert rotation
• OCPBUGS-59972 - Observing error in the openshift web console after upgrading the cluster from 4.18 to 4.19.
• OCPBUGS-60059 - VerticalPodAutoScaler Operator Logs display version as "vertical-pod-autoscaler-operator v0.0.0-was-not-built-properly"
• OCPBUGS-60078 - ccoctl create-all incorrectly overwrites openid-configuration with S3 URL when CloudFront is in use
• OCPBUGS-60083 - Operator Reconciling Namespace Object
• OCPBUGS-60084 - Help dropdown should be closed automatically after tour model opened
• OCPBUGS-60108 - Remove info message logging for csi-driver-node deployment, csi-node-registrar container
• OCPBUGS-60120 - Panic seen in CI job for MCO pod
• OCPBUGS-60141 - OperatorHub resets to top of page when closing operator detail
• OCPBUGS-60144 - Component Readiness: [Networking / ovn-kubernetes] [EgressIP] test regressed
• OCPBUGS-60157 - MCO OCL Presubmits fail on various issues
• OCPBUGS-60210 - ESO metrics 8443 ports can't be connected
• OCPBUGS-60218 - [4.21]Improper namespace could affect PPC
• OCPBUGS-60245 - Annoations app.openshift.io/vcs-uri ignoring port
• OCPBUGS-60253 - opm validate is not failing when channel entry both replaces and skips the same bundle
• OCPBUGS-60254 - Semver template is producing invalid channel entries
• OCPBUGS-60273 - cold boot test both nodes ungraceful shutdown results in unresponsive cluster
• OCPBUGS-60385 - Missing Microsoft.Network/publicIPAddresses/delete permission in CCM
• OCPBUGS-60455 - Port 8089 used by Ironic and k-nmstate
• OCPBUGS-60468 - EgressIP Failover not working
• OCPBUGS-60498 - Missing service for port 6385
• OCPBUGS-60537 - Machine-config controller should actively manage cordon while draining
• OCPBUGS-60538 - Installer imports whole assisted-service module
• OCPBUGS-60571 - oc-mirror v2 should validate ImageSetConfiguration to reject duplicate YAML keys
• OCPBUGS-60593 - Component Readiness: [Serial] [sig-auth][Feature:OAuthServer] [RequestHeaders] [IdP] test RequestHeaders IdP
• OCPBUGS-60603 - 403 Forbidden: console service account cannot list resources like Knative channels and Event sources
• OCPBUGS-60636 - Pipelines navigation menu disappears in local development
• OCPBUGS-60637 - storage operands should honour securityContext UID
• OCPBUGS-60752 - Add type validation in installer for MTU and similar numeric fields in install-config.yaml
• OCPBUGS-60782 - Enabling invalid or missing plugin causes console to crash loop
• OCPBUGS-60790 - Cluster AutoScaler + CAPI Provider incorrectly interferes with MachineDeployment Replicas
• OCPBUGS-60806 - [AWS, EgressIP] CNCC and OVN-Kubernetes are not handling 0 capacity in cloud env's correctly (0 and unset is not differentiated - 0 capacity is mistaken for Unlimited capacity by OVNK
• OCPBUGS-60845 - Update OWNERS file for image-registry repository
• OCPBUGS-60868 - OLMv1 fail to use the custom CA: x509: certificate signed by unknown authority
• OCPBUGS-60870 - [PeriodicGathering] The periodic gathering job fails to run after updating the storagePath of IO conf
• OCPBUGS-60886 - use crypto-browserify for createHash function
• OCPBUGS-60901 - Missing default value for maxUnhealthy under machinehealthcheck CR
• OCPBUGS-60929 - oc-mirror creates tar file even after errors from image pull
• OCPBUGS-60939 - Forbidden errors in Insights Operator pod logs
• OCPBUGS-60946 - SELinux warning controller does not report conflicts with ""
• OCPBUGS-61056 - ValidatingAdmissionPolicy not working for openshift-apiserver resources
• OCPBUGS-61063 - Drop alert/accept feature gate environment variables from the 'recommend' subcommand
• OCPBUGS-61065 - OVNK downstream with DPF failing to run upstream script
• OCPBUGS-61085 - status of cacheless catalogsource is TRANSIENT_FAILURE
• OCPBUGS-61087 - Updation of label from edit label doesn't work
• OCPBUGS-61111 - [GCP] installing into GCP shared VPC with BYO hosted zone failed with error "failed to create the private managed zone"
• OCPBUGS-61112 - missing azure-disk-csi-driver-node-sa from managed identity
• OCPBUGS-61113 - Excessive API calls by prometheus-operator ServiceAccount
• OCPBUGS-61114 - MCP not updating when an invalid MOSC is applied after a valid MOSC in Image Mode
• OCPBUGS-61133 - Operator keywords are not correctly used in the catalog search relevance score and Metadata name should not be used in the score calculation
• OCPBUGS-61135 - rosa-sts-ovn job permafailing nightly payloads due to use of deprecated k8sPrometheusAdapter
• OCPBUGS-61139 - Software Catalog side navigation category list is not listed alphabetically
• OCPBUGS-61161 - Fix logging of CSO e2e tests
• OCPBUGS-61167 - Can't configuring custom OVN-Kubernetes internal IP address subnets at install time.
• OCPBUGS-61183 - "cluster in workload identity mode" isn't applied with the token-auth-azure annotation
• OCPBUGS-61193 - [Monitoring] New prometheus targets auth test failing too often
• OCPBUGS-61213 - 'format exec' errors in serial techpreview tests on arm due to test images are not multi-arch
• OCPBUGS-61215 - High CPU usage for iptables-alerter pods
• OCPBUGS-61219 - control-plane-pki-operator reconciliation failure on 4.19->4.20 upgrade
• OCPBUGS-61222 - VolumeGroupSnapshot vac-protection finalizer test failing too often on metal
• OCPBUGS-61237 - Unable to download kubeconfig file in Assisted Installer Disconnected with User Provisioned Infrastructure
• OCPBUGS-61282 - aws-cloud-controller-manager deployment orphaned in y-stream upgrade to 4.20
• OCPBUGS-61287 - kubectl logs test flakes occasionally
• OCPBUGS-61297 - revert "force cert rotation every couple days for development" in 4.21
• OCPBUGS-61299 - AWS: vpc share doesn't work with public-only when create hypershift aws cluster
• OCPBUGS-61311 - "oc login --exec-plugin oc-oidc" does not automatically open a browser window
• OCPBUGS-61324 - Fix arch issue on KCM operator
• OCPBUGS-61326 - Fix arch issue on cluster-kube-storage-version-migrator-operator
• OCPBUGS-61329 - Hypershift failing on read-only root filesystem issues
• OCPBUGS-61334 - KAS postStart hook doesn't respect hostedcluster.spec.networking.apiServer.port
• OCPBUGS-61349 - Installation on ARM baremetal has likely regressed
• OCPBUGS-61353 - The cluster-config-v1 cm of an IPI Nutanix cluster contains the Nutanix password, making it visible to anyone with access.
• OCPBUGS-61373 - Fix shellcheck errors in Installer's main branch
• OCPBUGS-61383 - Typo in Enable the Developer Perspective quick start
• OCPBUGS-61393 - Import YAML editor has tab default to 4 spaces
• OCPBUGS-61398 - [ARO HCP][AKS Conformance][4.20] Ginkgo panic in openshift/origin test runner (updateEnvVars / recordTestResultInLog)
• OCPBUGS-61410 - Make substitutions work for 4.21 in manifests of clusterresourceoverride-operator
• OCPBUGS-61435 - Make substitutions work for 4.21 in manifests of openshift-kubernetes-nmstate-operator
• OCPBUGS-61436 - Make substitutions work for 4.21 in manifests of ose-aws-efs-csi-driver-operator
• OCPBUGS-61437 - Make substitutions work for 4.21 in manifests of ose-gcp-filestore-csi-driver-operator
• OCPBUGS-61442 - Make substitutions work for 4.21 in manifests of ose-secrets-store-csi-driver-operator
• OCPBUGS-61450 - Make substitutions work for 4.21 in manifests of ose-smb-csi-driver-operator
• OCPBUGS-61458 - OCP Console provides an incorrect sample YAML for MachineSet creation with a non-existent versions field
• OCPBUGS-61459 - Revert the switch to local RPC on 4.21 and 4.20
• OCPBUGS-61462 - 4.21 catalogs have a filesystem permissions error causing HCP deployment failure
• OCPBUGS-61468 - i18n upload/download routine task for OCP version 4.20
• OCPBUGS-61475 - the default container on the cloud credential operator should not be the kube-rbac-proxy container
• OCPBUGS-61477 - x86 release payload now contains additional ARM ISO
• OCPBUGS-61483 - Bump documentationBaseURL to 4.21
• OCPBUGS-61490 - Node Joiner: Update code to retrieve ICSP instead of ICP for mirror registry
• OCPBUGS-61491 - Node Joiner: Update code to retrieve ICSP instead of ICP for mirror registry
• OCPBUGS-61492 - ManagementState of jobset/lws operator doesn't take effect.
• OCPBUGS-61497 - Not able to mirror specific version of 'redis-enterprise-operator-cert' operator
• OCPBUGS-61498 - CAPV unit tests not being run (no presubmits) and wrong path in script
• OCPBUGS-61499 - Kube controller manager fails to run when setting a large memory request
• OCPBUGS-61508 - IngressOperator not exposing some metrics for existing IngressController after Operator restart
• OCPBUGS-61509 - Supported AAP Operator is shown as a community operator
• OCPBUGS-61514 - GCP Destroy Firewall Rule not checked on firewall deletion
• OCPBUGS-61518 - Cloud event proxy for PTP operator doesn't parse the BF3 NIC names correctly
• OCPBUGS-61519 - additional status items disappear off the right hand side of the screen and all squashed up
• OCPBUGS-61531 - Hide "VirtualMachine networks" menu for normal user
• OCPBUGS-61536 - vSphere plugin - incorrect handling of settings.
• OCPBUGS-61538 - Prow job failure: config-operator unstable when featureSet is DevPreviewNoUpgrade
• OCPBUGS-61545 - Show correct version for the jobset operator
• OCPBUGS-61547 - csi resizer: resizing PVC close to creation may result in dropped sync
• OCPBUGS-61554 - Bump to Kubernetes v1.33.5
• OCPBUGS-61561 - Fix OVN-K deployment using Node Feature Discovery annotation in CNO
• OCPBUGS-61566 - Pod stuck in ContainerCreating state after upgrading to 4.18.16
• OCPBUGS-61571 - SSCSI driver operator: default make is broken on non-fips systems
• OCPBUGS-61587 - oauth-openshift deployment is not HA
• OCPBUGS-61625 - set up openshift-tests-extension for cluster-openshift-controller-manager-operator and add a sanity test
• OCPBUGS-61660 - BareMetalHosts menu doesn't show up on IPI BM cluster
• OCPBUGS-61661 - Metrics not visible in monitoring dashboard
• OCPBUGS-61668 - Cannot select IPv6 rendezvous IP at runtime
• OCPBUGS-61678 - Disable PSA for 4.21
• OCPBUGS-61687 - CAPI provider deployment is using 2 replicas instead of 1
• OCPBUGS-61689 - MachineConfigNode objects should include age in additionalprintcolumns
• OCPBUGS-61695 - NMState service failing in some deployments
• OCPBUGS-61719 - Propagate AWSLoadBalancerTargetNodesAnnotation to HCP
• OCPBUGS-61726 - OpenShift Console External OIDC regression
• OCPBUGS-61728 - PinnedImageSets test failing often on vsphere
• OCPBUGS-61734 - [oc] port forwarding test struggles on ROSA and some other platforms
• OCPBUGS-61754 - oauth and openshift-apiserver related disruptions around operator upgrade
• OCPBUGS-61768 - update pkg/image/OWNERS
• OCPBUGS-61776 - Ignition Server certificate secrets deleted if disable-pki-reconciliation annotation is present
• OCPBUGS-61780 - MCE HCP jobs failing to install MCE 2.10 in hypershift-mce-install stage
• OCPBUGS-61792 - Collect HAProxy coredumps during CI runs
• OCPBUGS-61800 - Warning message related to 4.21 updates is incorrect
• OCPBUGS-61825 - HyperShift kubevirt break glass credentials tests failing
• OCPBUGS-61829 - Pods in init and crashloop state for controlplane components if hosting cluster node is rebooted.
• OCPBUGS-61850 - KAS Bootstrap container seeing restarts within timeout period in AKS e2es with KMS enabled
• OCPBUGS-61858 - OCP 4.16.43 - HAProxy MaxConn Limit reached/exceeded after upgrade from 4.14 with no change to workload
• OCPBUGS-61870 - Software catalog does not show when All projects selected
• OCPBUGS-61872 - ClusterVersionOperator manifests are not applied in TechPreviewNoUpgrade
• OCPBUGS-61883 - Enhance capi spot/dedicated cases for InsufficientInstanceCapacity error
• OCPBUGS-61885 - Fix could not delete placement group: InternalError: An internal error has occurred
• OCPBUGS-61888 - Fix api error Unsupported: The requested configuration is currently not supported. Please check the documentation for supported configurations.
• OCPBUGS-61893 - Set extractor as default container
• OCPBUGS-61894 - [storage.k8s.io/v1beta1] should be served on TechPreviewNoUpgrade hosted clusters
• OCPBUGS-61899 - Fix Dockerfile.rhel: Add OTE binary build and packaging
• OCPBUGS-61901 - Missing "Mixed" value in explanation for installconfig.publish
• OCPBUGS-61905 - OCPFeatureGate:ExternalOIDCWithUIDAndExtraClaimMappings test regressed
• OCPBUGS-61933 - ptp sidecar is spamming error msg="Interface does not match Intel or Mellanox naming format, using original interface name"
• OCPBUGS-61935 - RendezvousIP template not replaced in /etc/assisted/rendezvous-host.env causing OVE cluster installation failure
• OCPBUGS-61937 - Missing period on the auth error page
• OCPBUGS-61941 - allowedCIDRBlocks bypassed when kube-apiserver uses Route publishing strategy with external DNS
• OCPBUGS-61946 - OVE UI container image should only contain ISO
• OCPBUGS-61956 - Filter agent-based-installer Konflux MintMaker PR updates
• OCPBUGS-61962 - If there is still no capacity after retrying, skip instead of fail
• OCPBUGS-62016 - 4.21: E2E: Create testing namespace before Runtime LLC tests
• OCPBUGS-62022 - 4.21 E2E: OVS Dynamic pinning test fixes
• OCPBUGS-62060 - periodic-ipi-deprovision-aws-osd-hypershift failing occasionally unable to delete openshift-ingress role
• OCPBUGS-62082 - Dummy 4.21 bug for fixing MCN CRD cronjob issue
• OCPBUGS-62091 - E2E: Add function to check control plane nodes are schedulable
• OCPBUGS-62099 - [HyperShift] TestAutoscalingBalancing is unstable
• OCPBUGS-62106 - [v2] show binary version in the output
• OCPBUGS-62108 - Lack Chinese/Japanese/Korean translations for 'On/Off' switch button on editor setting modal of yaml page.
• OCPBUGS-62109 - TestImageRegistryPods test failing in CMO end-to-end test suite
• OCPBUGS-62112 - Servicing does not work for externallyProvisioned hosts
• OCPBUGS-62121 - Cluster Storage Operator's allow-egress-to-api-server NetworkPolicy is not compatible with HyperShift's KAS port customization
• OCPBUGS-62125 - Installer should set baremetalhost architecture
• OCPBUGS-62126 - Unified perspective label Core platform not displayed consistently when additional operators are enabled (Virt, ACM, or Dev perspective).
• OCPBUGS-62128 - e2e flake: HCCO pod restart on CSISnapshotController not yet installed
• OCPBUGS-62130 - The node-encap-ips annotation should not be set when running in DPU host mode
• OCPBUGS-62132 - Marketplace e2e test failures blocking the PR merging
• OCPBUGS-62136 - Some bootstrap pods have duplicate logging
• OCPBUGS-62138 - OCPSTRAT-2045:Automating OCPSTRAT-2045 feature in upstream
• OCPBUGS-62142 - Cannot login to openshift console in external oidc env using Windows server ADFS provider due to "error constructing login state: failed to save refresh token cookie: securecookie: the value is too long: 6704"
• OCPBUGS-62147 - dpu operator CGO check failed for openshift-4.21
• OCPBUGS-62153 - E2E: skip SMT disabled test when L3 cache spans entire NUMA node
• OCPBUGS-62156 - Unique "key" prop warning in the UserPreferencePage
• OCPBUGS-62160 - After disabling local AlertMananager, there are still AlertManager alerts, and AlertManager related DNS queries
• OCPBUGS-62166 - Prometheus scraping: default to legacy validation/escaping scheme until utf-8 is fully supported by prom-operator
• OCPBUGS-62184 - AWS should not be using the iam endpoint override for all clients
• OCPBUGS-62201 - [4.21] OCP can't provision Dell with IDRAC 10
• OCPBUGS-62210 - BuildConfig inline Dockerfile fails with heredoc syntax
• OCPBUGS-62215 - IO is trying to update the immutable finishTime in DataGather
• OCPBUGS-62226 - Cilium: LoadBalancer services unreachable
• OCPBUGS-62227 - case "Alerts shouldn't exceed the series limit of total series sent via telemetry from each cluster" failed on e2e-aws-ovn-techpreview job
• OCPBUGS-62247 - cluster-csi-snapshot-controller-operator's allow-egress-to-api-server NetworkPolicy is not compatible with HyperShift's KAS port customization
• OCPBUGS-62255 - Optimistically update Kube Server and Client CA bundles
• OCPBUGS-62261 - Serverless - Eventing - Brokers and Channels tabs : UI has unwanted semicolon
• OCPBUGS-62262 - deleted nodes still present in egressfirewalls managed fields
• OCPBUGS-62281 - InsecureSkipVerify to true and skip the certification checks for Tekton results proxy endpoint
• OCPBUGS-62293 - GCP Upgrade causes DNS deletion of private zone failure
• OCPBUGS-62296 - Dynamic plugin routes with default perspective have subpath dropped
• OCPBUGS-62304 - Support CapacityReservationPreference in CAPI e2e automation
• OCPBUGS-62310 - Fix KSM deny-list typo
• OCPBUGS-62313 - Returning from any Secret Create page does not return to secret page
• OCPBUGS-62314 - nmstate-console-plugin is failed to load and it slows the entire UI
• OCPBUGS-62315 - Filter input dialogue takes up a whole line on 'Cluster Settings->Configuration' page
• OCPBUGS-62327 - [4.21] "ulimit -n" just 1024 (instead of 1048576)
• OCPBUGS-62341 - MCO may hang until timeout when cordoning a node
• OCPBUGS-62345 - vSphere 7 Deprecation
• OCPBUGS-62363 - agent-extract-tui runs continuously leaving host inaccessible
• OCPBUGS-62366 - remove enablement of the resource beta apis
• OCPBUGS-62430 - Installing dual stack SNO with primary IPv6 is blocked
• OCPBUGS-62445 - Create Node ISO command crashes when rootDeviceHints is invalid
• OCPBUGS-62446 - E2E AKS failing due to KAS not ready in time
• OCPBUGS-62474 - CNTRLPLANE-1308: Enable OTE for OCM and OCM Operator
• OCPBUGS-62483 - when viewing node logs in the console, performance issues occur
• OCPBUGS-62484 - Unit tests failing with GOOGLE_APPLICATION_CREDENTIALS missing
• OCPBUGS-62493 - [sig-arch] events should not repeat pathologically for ns/openshift-machine-config-operator
• OCPBUGS-62620 - cluster-api operator blips degraded every 35 minutes
• OCPBUGS-62645 - Update OVE UI Konflux task-rpm-signature-scan
• OCPBUGS-62646 - OVE UI Update Konflux references
• OCPBUGS-62703 - Exclude pathological events for Prometheus
• OCPBUGS-62714 - Create a temporary `policy.json` for MCD upgrades to merge transport policies
• OCPBUGS-62727 - node-exporter throws errors reading the InfiniBand class counter info
• OCPBUGS-62736 - CNTRLPLANE-1315:Add OpenShift Tests Extension (OTE) for cluster-etcd-operator
• OCPBUGS-62754 - Add Konflux files in .tekton
• OCPBUGS-62789 - [OCP][UI]:Rebranding in OCP Advisor widget in WebConsole
• OCPBUGS-62790 - ABI vSphere Installation Failing Due to “No Space Left on Device”
• OCPBUGS-62802 - Missing RBAC for Azure Disk CSI fall back mechanism
• OCPBUGS-62817 - Events do not clearly differentiate all "eno" interfaces for GNR-D
• OCPBUGS-62824 - Console message about UI URL is garbled
• OCPBUGS-62826 - Unconfigured ignition should not attempt to display cluster name on console
• OCPBUGS-62835 - E2E: llc: make sure to remove any trailing newspaces
• OCPBUGS-62836 - E2E: Pass pull secret path to pull cnf-tests
• OCPBUGS-62839 - E2E: Add test cases related to schedulable control plane nodes
• OCPBUGS-62861 - HyperShift ServiceMonitor for cluster-version-operator metrics: revert client auth
• OCPBUGS-62863 - 'hypershift dump' should collect ServiceMonitor resources
• OCPBUGS-62871 - [e2e]ExtOIDCConfig can't be set in aks hcp
• OCPBUGS-62892 - MAPO-CAPO conversion errors out on empty MAPO Machine filter
• OCPBUGS-62905 - Remove nested podman settings from ABI OVE Dockerfile
• OCPBUGS-62907 - ISOBuilder-Use agent-installer-ui image from release
• OCPBUGS-62912 - Violations of Konflux policy detected when using registry-standard tests
• OCPBUGS-62925 - RHCOS10 : kernelType: realtime fails due to missing kernel-rt-kvm package
• OCPBUGS-62930 - CI fails or flakes on "[sig-network][Feature:EgressFirewall] when using openshift ovn-kubernetes should ensure egressfirewall is created"
• OCPBUGS-62937 - Add telemetry events
• OCPBUGS-62941 - External oidc env upgrade is stuck at "748 of 954 done (78% complete), waiting on authentication over 30 minutes which is longer than expected"
• OCPBUGS-62949 - HCP ROSA cluster deletion can get stuck
• OCPBUGS-62972 - enhance case 66736
• OCPBUGS-62986 - Update OVE UI Konflux references
• OCPBUGS-62987 - Component Readiness: regression re [Feature:Idling] Idling with a single service and ReplicationController
• OCPBUGS-62989 - [jobsets] Surface cert-manager dependency error in JobSet CR status
• OCPBUGS-62990 - [lws] Surface cert-manager dependency error in LeaderWorkerSets CR status
• OCPBUGS-63006 - Updating MOSC doesn't cause new image to roll out
• OCPBUGS-63015 - [QEMUKubeVirtLauncherLogs]The VM pod that doesn't deliver any logs blocks the QEMU gathering
• OCPBUGS-63040 - Add imagestream update dryrun test
• OCPBUGS-63046 - [AWS][CAPI] The error message is inaccurate when both setting capacityReservationId and Open/None capacityReservationPreference
• OCPBUGS-63049 - Make the hypershift CLI binary FIPS compliant
• OCPBUGS-63056 - Add Favorite button missing in monitoring Alerting page
• OCPBUGS-63059 - Add the `testIdAttribute` configuration to RTL shared test utility
• OCPBUGS-63061 - Brand name not being appended in document title
• OCPBUGS-63130 - Control Plane Operator V2 creates unnecessay router deployment in case of IBM Cloud
• OCPBUGS-63131 - E2E Test `TestMCNScopeSadPath` is flaking
• OCPBUGS-63149 - must-gather gather_metrics high cpu / disruption failures
• OCPBUGS-63153 - [CAPI Agent] Missing volume when converting capi-provider deployments to CPO v2
• OCPBUGS-63158 - T-TSC/T-BC Holdover: With TR / T-TSC configuration only ts2phc metrics reports unlocked, ptp4l metric is reported
• OCPBUGS-63175 - Non-functional HostedCluster node-tuning-operator ServiceMonitor should be removed
• OCPBUGS-63189 - `oc image mirror` copy image to s3 failed when blob already exists in the target location
• OCPBUGS-63190 - Change hugepages: changing tests to use hugepages-allocator tool
• OCPBUGS-63237 - There should be no role ARN field as token-auth-aws/azure/gcp=false in csv annotations
• OCPBUGS-63238 - ccoctl aws commands not passing region when creating aws clients
• OCPBUGS-63240 - TNF transition job controller in CEO has a race condition at startup
• OCPBUGS-63242 - MustGather CR stuck when the caseManagementAccountSecretRef field points to a Secret that doesn’t exist
• OCPBUGS-63243 - [must-gather-operator] hard-coded dependency on namespace causes deployment failure and inability to correctly configure metrics
• OCPBUGS-63311 - Stronger warnings for ClusterVersion force and rollbacks
• OCPBUGS-63321 - PerformanceProfile stuck degraded "BadMachineConfigLabels"
• OCPBUGS-63322 - Update OVE UI Konflux references
• OCPBUGS-63333 - Add Dot Net 9.0 to Origin Tests
• OCPBUGS-63348 - [AWS, EgressIP] CNCC and OVN-Kubernetes assigns more EgressIPs than available capacity
• OCPBUGS-63353 - ValidAWSIdentityProvider HostedCluster status is inaccurate when KAS is not up
• OCPBUGS-63382 - Pod details environment view is missing environment values and className for styling
• OCPBUGS-63384 - eslint warnings should fail the frontend test
• OCPBUGS-63388 - breadcrumb link to imagestream returns not found
• OCPBUGS-63396 - [QEMUKubeVirtLauncherLogs]The logs from error QEMU pod were not gathered
• OCPBUGS-63401 - several issues on Search page
• OCPBUGS-63429 - Developer in Developer > Observe having a Forbidden error accessing to the metrics
• OCPBUGS-63433 - Turn on CSP reporting by default
• OCPBUGS-63436 - RHOCP OLM creates two InstallPlans with Manual approval strategy for same operator version
• OCPBUGS-63458 - Changing the unit to Kb Mb in ocp 4.20 results in value coming as Undefined
• OCPBUGS-63468 - [must-gather-operator] The internalUser parameter in MustGather CR cannot be specified as false
• OCPBUGS-63471 - UX: ActionsMenuDropdown should render a button when there is 1 action
• OCPBUGS-63473 - Rebase etcd to 3.5.24
• OCPBUGS-63480 - oc-mirror includes on the IDMS file a status line
• OCPBUGS-63481 - references to django repo now also refer to the branch
• OCPBUGS-63512 - [must-gather-operator] must-gather-operator CR spec should not be mutable
• OCPBUGS-63514 - CNTRLPLANE-1662: Migrate OCP-32383 to upstream
• OCPBUGS-63519 - Missing endpoint slices for open ports the operator uses
• OCPBUGS-63541 - ccoctl aws always generates new keys when the private key file is missing
• OCPBUGS-63561 - CloudFront Distribution not deleted by ccoctl aws delete
• OCPBUGS-63593 - Need to persist NIC device names on RHEL9
• OCPBUGS-63594 - Port 2041/TCP (used by konnectivity-agent) is exposed but should be internal-only.
• OCPBUGS-63598 - [vsphere-problem-detector] CheckComputeClusterPermissions being tested when VMs are created in a Resource Pool instead of the vSphere cluster's root folder
• OCPBUGS-63599 - "View it here" link in "Operator installing" message is broken
• OCPBUGS-63610 - Clicking 'Open terminal in new tab' doesn' t open terminal in new tab.
• OCPBUGS-63613 - `--image-generation Gen1` set not work even without marketplace flags
• OCPBUGS-63617 - The APIV1MetasHandler=true and APIV1MetasHandler=false at the same time
• OCPBUGS-63655 - [On-demand/Periodic Gathering]Gathering panics when the corresponding DataGather doesn't exist.
• OCPBUGS-63672 - cluster operator operator-lifecycle-manager-packageserver reported Progressing=True with reason="" for a node reboot
• OCPBUGS-63683 - Unit test is failing on golang v1.24.8+ and v1.25.2+
• OCPBUGS-63695 - Panic in dpu-host mode during start up
• OCPBUGS-63704 - Remove unneeded params in agent-installer-utils Makefile
• OCPBUGS-63705 - [must-gather-operator] Job pod is not created in the MustGather CR namespace
• OCPBUGS-63707 - [ci-watcher] Multiple other categories show up
• OCPBUGS-63711 - Remove Pending resources during destroy
• OCPBUGS-63714 - Azure custom role definitions can experience replication delays
• OCPBUGS-63717 - e2e flake: panic in EnsureGlobalPullSecret
• OCPBUGS-63724 - E2E: skip LLC tests on Virtual Machines
• OCPBUGS-63729 - CentralUSEAUP worker machine creation fails with error on platformUpdateDomainCount
• OCPBUGS-63734 - Empty error message when an invalid custom osImage is configured in Techpreview
• OCPBUGS-63738 - Multiple new sig-network tests permafailing on aws and gcp
• OCPBUGS-63743 - HostedCluster ovnkube-node and multus pods crashLooping after kubelet restart
• OCPBUGS-63747 - The archive may contain file names that could cause errors during processing
• OCPBUGS-64601 - Remove v1alpha1 ConsolePlugin version from CRDs status
• OCPBUGS-64652 - Duplicate words in Console UI "See breakdown breakdown"
• OCPBUGS-64669 - CNTRLPLANE-1722:Create separate Go module for test extension
• OCPBUGS-64670 - CNTRLPLANE-1721:Create separate Go module for test extension
• OCPBUGS-64675 - CI fails on TestGatewayAPI/testGatewayAPIDNS
• OCPBUGS-64676 - PerforamanceProfile: Setting hugepage sizes without also specifying defaultHugepagesSize breaks kernel commandline processing
• OCPBUGS-64685 - Console operator should not be progressing while MCO is
• OCPBUGS-64721 - [BoxCutter]A lot of clusterextensionrevision is created for one clusterextension
• OCPBUGS-64732 - CVO does not detect change in operator deployment spec for hostUsers
• OCPBUGS-64743 - oc adm must-gather with --node-name picking a worker is never scheduled
• OCPBUGS-64745 - OVE: Update mtv-operator channel name from "release-v2.8" to "release-v2.10"
• OCPBUGS-64792 - NodePool CRD validation fails with 'no such key: imageType' when creating AWS ARM64 clusters
• OCPBUGS-64810 - Sync main branch for cloud-provider-openstack with upstream
• OCPBUGS-64819 - Fix IPA external inspection callback url override
• OCPBUGS-64825 - Stabilize `Should properly report MCN conditions on node degrade` MCN test
• OCPBUGS-64839 - [Azure UPI] dropping support for field used in image gallery versions
• OCPBUGS-64845 - [4.21] Handle HTTP 400 and 409 race condition in Redfish power operations
• OCPBUGS-64851 - EndpointList components Warning: Each child in a list should have a unique "key" prop.
• OCPBUGS-64859 - API Explorer group filter doesn't show any text for when no results are found
• OCPBUGS-64936 - Progressing condition not updated after IO pod restart
• OCPBUGS-64943 - Runtime error when parsing user from request context
• OCPBUGS-65473 - Integration test failing
• OCPBUGS-65474 - csi-snapshot-controller ClusterOperator relatedObjects missing ClusterRole
• OCPBUGS-65512 - Remove Pending resources during destroy
• OCPBUGS-65518 - [4.21] Test advertised ip reachability before assigning it
• OCPBUGS-65528 - linuxptp-daemon container does not have chrony installed
• OCPBUGS-65535 - synce4l is not available within lunuxptp daemon container
• OCPBUGS-65544 - MCS and kube-rbac-proxy ports require service endpoints for documentation
• OCPBUGS-65546 - Adding ptp-operator must-gather to ART image references
• OCPBUGS-65549 - LeaderWorkerSet Operator always displays ReadyReplicas as 0
• OCPBUGS-65550 - JobSetOperator always displays 0 ReadyReplicas
• OCPBUGS-65555 - [Azure-file-CSI-Driver]CreateVolume response does not reflect actual file share size after rounding
• OCPBUGS-65598 - Projects list page link no longer links to project
• OCPBUGS-65600 - Fetch "misspell" binary upon invocation and fix typos
• OCPBUGS-65612 - pagination toolbar on API Explorer list and Access review page is at the bottom
• OCPBUGS-65617 - Conformance tests failing due to global-pull-secret-syncer pods missing priority class
• OCPBUGS-65628 - Permission error shows up when normal user search 'Pod' resource on 'Search' page.
• OCPBUGS-65638 - Update OLMv1 ClusterCatalog API group in console operator manifest
• OCPBUGS-65659 - Add StandardFXmdsv2Family to azure tested instance type list
• OCPBUGS-65661 - [Azure UPI] contine the fix in 02_storage.json
• OCPBUGS-65681 - Openshift installer fails to start provisioning IBM Cloud clusters
• OCPBUGS-65690 - Visiting Group Detail Page > RoleBindings will show error
• OCPBUGS-65696 - Perspective redirects have search params dropped
• OCPBUGS-65701 - conformance test about EnsureCNOOperatorConfiguration failed due to Networktype is not OVNKubernetes
• OCPBUGS-65702 - Test for control plane CNI operand rollout failure caused by networkType not being OVNKubernetes
• OCPBUGS-65712 - machine-api-provider-openstack fails to delete primary NIC before delete instance
• OCPBUGS-65713 - HC could't be ready when HostedControlPlane is 4.21, NodePool is 4.18./4.19
• OCPBUGS-65717 - Bump Kubernetes Version to the same as OpenShift API is using
• OCPBUGS-65726 - RUN --mount directives breaking MCO image builds
• OCPBUGS-65731 - Skip Azure Confidential Compute Clusters for boot image updates
• OCPBUGS-65748 - Set upi folder to infra id
• OCPBUGS-65776 - Terminal disconnected when pod YAML changes (without pod restart)
• OCPBUGS-65779 - Remove Php 8.0-ubi8, add Php 8.2-ubi8 to Origin
• OCPBUGS-65804 - Console backend showing failed to get new config for olm client error
• OCPBUGS-65818 - Need update hypershift cli to allow np support Y-3 version skew with hcp
• OCPBUGS-65858 - [AWS EFS CSI Driver Operator] efs_tags_controller failed to refresh cached credentials on hypershift hosted cluster
• OCPBUGS-65883 - Add missing sample for a ConsoleLink with mailto
• OCPBUGS-65890 - OpenShift AI link from Getting stated resources card 404s
• OCPBUGS-65925 - Must-gather logging image fails because oc client now runs gather command via setsid, which is missing in minimal images
• OCPBUGS-65938 - Component Readiness: [Installer / openshift-installer] [Other] test regressed
• OCPBUGS-65959 - all 4.21 machine-config-daemon targets are down
• OCPBUGS-65961 - BMH stuck in inspecting state with 404 errors inspection error in the ironic-agent logs
• OCPBUGS-65970 - `Should properly transition through MCN conditions on rebootless node update` test failing in two-node fencing
• OCPBUGS-65971 - The machine-os-images container writes to /coreos during runtime which will fail for readOnlyRootFS
• OCPBUGS-66039 - HyperShift multi nightly blocker failing on --e2e.n*-minor-release-image linking releases from the same 4.y
• OCPBUGS-66052 - Template placeholder {{name}} not resolved and runtime error shown on Add Users page and Impersonate Group option
• OCPBUGS-66060 - Marketplace operator creating more watch requests than previously
• OCPBUGS-66063 - [oc] Kubectl subresource GET test flaking
• OCPBUGS-66064 - monitoring-plugin pods fail TLS handshake after applying "modern" tlsSecurityProfile
• OCPBUGS-66067 - Setting allowedCIDRBlocks field + with externalDns + publicAndPrivate will hit error
• OCPBUGS-66137 - version metrics for ghcr.io/rhobs/prometheus-example-app:0.5.0 is v0.4.2
• OCPBUGS-66144 - CBO: enable readOnlyRootFilesystem for machine-os-images
• OCPBUGS-66166 - Tooltips and Sticky scroll don't have data-checked-state
• OCPBUGS-66214 - Error logs in tuned pod when configuring an ARM server
• OCPBUGS-66239 - Disable Dependabot in downstream bond-cni repository
• OCPBUGS-66252 - 4.21 PTP Daemon Dual card T-BC after reboot takes a long time to lock
• OCPBUGS-66254 - VAC on PVC details page is displayed for failed state
• OCPBUGS-66255 - OVE Agent Installer UI: Red Hat OCP logo not displaying correctly
• OCPBUGS-66256 - Bump Azure Marketplace Images to 4.20
• OCPBUGS-66258 - Quick starts are render-blocking on first load
• OCPBUGS-66337 - PPC:Use default worker mcp instead worker-cnf
• OCPBUGS-66345 - Ensure all exports in SDK are correct and point to something
• OCPBUGS-66354 - Component Readiness: [Storage / Kubernetes External Components] [Dynamic PV (default fs)] test regressed
• OCPBUGS-66385 - switching project on Create Helm Release page will return 404
• OCPBUGS-66402 - Need update path for browsing catalogs and operators in quickstarts.
• OCPBUGS-66423 - Update Konflux references
• OCPBUGS-66426 - Open Update quay.io/konflux-ci/konflux-vanguard/task-rpms-signature-scan:0.2 Docker digest to 13cf619
• OCPBUGS-66947 - OLM manifest configMap metadata names using incorrect tags
• OCPBUGS-66948 - GA IPAM CRDs require conversion webhook only available with TPNU
• OCPBUGS-67016 - OrderedNamespaceDeletion test regressed on techpreview jobs
• OCPBUGS-67169 - [4.21] Add MTV telemetry MON-3940
• OCPBUGS-67185 - AzureStackHub CI job does not run for Azure CSI driver rebases
• OCPBUGS-67279 - ART build failure for openshift-enterprise-ansible-operator: 4.21
• OCPBUGS-67294 - ACM 2.15.0: Worker node scale-in fails: BareMetalHost stuck in deleting due to Ironic cleaning error: missing uefi_esp.img
• OCPBUGS-67305 - [release-4.21] Azure CSI Driver fails to create disks on azure stack hub
• OCPBUGS-67314 - Backport AGENT-1357: remove AgentWorkflowTypeInstallInteractiveDisconnected workflow #10161
• OCPBUGS-67318 - Loss of APIServer networking, etcd quorum and high CPU causing mass test failures since Nov 27
• OCPBUGS-67943 - [Alertmanager] html field missing in generated pushover configuration
• OCPBUGS-68363 - installer azure image defaults break hive machinepool scaling
• OCPBUGS-68369 - BMO cannot abort inspection when deletion is requested
• OCPBUGS-68372 - Warning from Ignition about [Install] section of agent-extract-tui.service
• OCPBUGS-68375 - [4.21] e2e failure in "[sig-node] [Serial] Pod InPlace Resize Container (deferred-resizes) [FeatureGate:InPlacePodVerticalScaling]" during 1.34 kube rebase
• OCPBUGS-68377 - MCO degraded when an empty pull-secret is configured
• OCPBUGS-68403 - MCP is not correctly degraded when a pivotError happens
• OCPBUGS-68937 - network-dependent unit tests for image metadata causing failures
• OCPBUGS-69376 - [release-4.21] [ci-watcher] guidedTour not closed properly
• OCPBUGS-69388 - Application filter in Topology view is resetting to All Applications unexpectedly
• OCPBUGS-69389 - [OTE] should exclude the [Flaky] label tests for openshift/csi test suite by default
• OCPBUGS-69417 - [CAPI] e2e: machines conversion fails due to missing master-user-data secret
• OCPBUGS-69433 - [release-4.21] Installed icon is not fully visible
• OCPBUGS-69440 - Openshift/api dependency needs to be bumped to latest version
• OCPBUGS-69655 - [azure disk csi driver] static provision crashed caused by segmentation fault on Azure stack hub clusters
• OCPBUGS-69661 - Make substitutions work for 4.21 in manifests of ose-metallb-operator
• OCPBUGS-69669 - [release-4.21] systemd as container init with spc_t breaks configmap mount permissions
• OCPBUGS-69685 - [TechPreviewNoUpgrade] OCP vsphere cluster configured with static ips fails installation
• OCPBUGS-69722 - [azure] network security rule "allow_ssh" for port 22 should be deleted
• OCPBUGS-69752 - installing into GCP Shared VPC with minimal permissions failed due to "failed to create bootstrap firewall rules"
• OCPBUGS-69757 - E2E: Granular IRQ functional test cases
• OCPBUGS-69766 - [release-4.21] Add quickstart guides for secrets management operators
• OCPBUGS-69772 - [release-4.21] CCAPIO: deprecation warnings in CAPI conversion
• OCPBUGS-69804 - [release-4.21] Azure Stack Hub: Ingress controller degraded due to unsupported LoadBalancer API version 2024-07-01
• OCPBUGS-69877 - Update Konflux files for 4.21
• OCPBUGS-69878 - clusteroperator/machine-config blips Degraded=True in CI jobs
• OCPBUGS-69886 - WebConsole Home> Events Display Fails to Filter by Selected Namespace
• OCPBUGS-69903 - [release-4.21] add test for MutableCSINodeAllocatableCount feature
• OCPBUGS-69919 - There should be no role ARN field as token-auth-aws/azure/gcp=false in csv annotations
• OCPBUGS-69921 - ART build failure for ose-cluster-control-plane-machine-set-operator-container:4.21
• OCPBUGS-69931 - apiVersion is empty on YAML creation page
• OCPBUGS-69932 - Runtime error occurs when create MachineConfig with default yaml from console
• OCPBUGS-69941 - [4.21] Dual-stack HCP deployment fails: KubeVirt platform not recognized by clusteroperator/network Operator
• OCPBUGS-69965 - Multi job struggling to install due to AMI / arch mismatch
• OCPBUGS-69995 - [release-4.21] Navigation using tabs on Installed Operators > packageserver > PackageManifest details does not work
• OCPBUGS-69997 - event.sync.ptp-status.ptp-state-change is not showing LOCKED in cloud-event-proxy
• OCPBUGS-70132 - Routing labels column is showing a solid block when receivers doesn't have routing labels
• OCPBUGS-70139 - Observability tests are failing when restarting microshift-observability service
• OCPBUGS-70156 - Set the tls cacert path to writable mount when the IRONIC_CACERT_FILE is unset
• OCPBUGS-70163 - CBO: remove the writable ironic-ca-cert mount
• OCPBUGS-70216 - Portieris is broken with CPOv2
• OCPBUGS-70218 - metal3 pod fails due to unable to create directory in /shared/tmp
• OCPBUGS-70219 - [JobSet] - Create JobSetOperator seems to be created with wrong/missing information - Form view
• OCPBUGS-70266 - Edit application via Deploy image internal registry doesn't select correct image stream
• OCPBUGS-70318 - [release-4.21] volume-data-source-validator pod fails with ImagePullBackOff in disconnected environments due to imagePullPolicy: Always
• OCPBUGS-71186 - PTP BC HA The phc2sys command concatenation format is malformed
• OCPBUGS-71196 - Unable to enable systemd service on OCP 4.20
• OCPBUGS-71200 - Routing labels is marked as required field in Create Receiver form but user can still submit form without setting value for this field
• OCPBUGS-71204 - [4.21] PTP T-TSC cloud-event-proxy "Skipping PTP clock class change event for ens3fx/master - clockClass not populated yet"
• OCPBUGS-71205 - kube-state-metrics panic closing nil channel
• OCPBUGS-71229 - [release-4.21]Unrevert TLS 1.3 / Modern profile tests #29611 with fixes
• OCPBUGS-72386 - clusteroperator/image-registry blips Degraded=True during upgrade test
• OCPBUGS-72391 - Snapshot controller limits are low
• OCPBUGS-72415 - Evicted pod test failing due to cadvisor metrics outage
• OCPBUGS-72509 - Storage operator should configure kubernetes-k8s Role(Binding) for the openshift-cluster-csi-drivers namespace
• OCPBUGS-72521 - Nil pointer exception in azure mapiImage
• OCPBUGS-72523 - Machine creation is not fully covered during periods of inconsistent response from AWS
• OCPBUGS-72527 - [release-4.21] [test] Add SupportedSizeRange for azurefile-nfs manifest
• OCPBUGS-72550 - Missing console annotation on quickstarts
• OCPBUGS-72556 - CNO fails to start with "host must be a URL or a host:port pair"
• OCPBUGS-72578 - Update default CVO channel for 4.21
• OCPBUGS-73097 - Revert the console-shared.json to console-shared directory
• OCPBUGS-73620 - [release-4.21] Improve VAC field on PVC details page
• OCPBUGS-73727 - [release-4.21] the warning message in 'Disable CatalogSource' modal still mentions OperatorHub
• OCPBUGS-73770 - [release-4.21] ContainerImage information does not update when switching channels in OperatorHub
• OCPBUGS-73773 - [AWS] Control plane machines are created in wrong zone
• OCPBUGS-73808 - cluster-autoscaler-operator creating more watch requests than usual (vsphere)
• OCPBUGS-73809 - gnss to ntp failover not triggered by offset spikes
• OCPBUGS-73819 - In TechPreview, MCP is not reporting degradation when a node is degraded
• OCPBUGS-73870 - Update perspective name from Administrator to Core platform in guided tour
• OCPBUGS-73872 - CPMS boot image config should not override standard MachineSet configuration
• OCPBUGS-73881 - 10m catalog sync interval contributes to unbounded etcd growth
• OCPBUGS-73891 - Azure: add new detected machine series into azure tested instance types list
• OCPBUGS-73908 - cluster-api-operator is still in the OCP payload
• OCPBUGS-73910 - [release-4.21] cbor: exceeded max number of elements 1024 for CBOR array on custom resource decode
• OCPBUGS-73911 - TestNewAppRunAll unit test is perma-failing in oc
• OCPBUGS-74009 - Cluster-version operator should reconcile ConfigMap binaryData
• OCPBUGS-74094 - [release-4.21] [Networking / DNS] TopologyAwareHintsDisabled repeating over 20x per job run
• OCPBUGS-74102 - TestKubeletConfigMaxPods is permafailing
• OCPBUGS-74103 - bootstrap-e2e permafailing
• OCPBUGS-74131 - [4.21] oauth-proxy e2e tests fail due to ambiguous container image short names on RHEL 9
• OCPBUGS-74157 - [release-4.21] [RHOCP Console] Software Catalog in Developer View has no content and shows "Error loading Catalog items Could not fetch all data. This data are missing: Devfiles"
• OCPBUGS-74170 - OKD builds fail with invalid GOTOOLCHAIN 'gov1.24.11'
• OCPBUGS-74202 - RBAC permissions for the prometheus-k8s service account are not restrictive enough for endpointslice resources
• OCPBUGS-74227 - clockClass is missing for T-BC
• OCPBUGS-74233 - [release-4.21] The insights archive path doesn't respect the path that is set via storagePath
• OCPBUGS-74267 - [4.21] Upgrading causes VMs using a ovn-k8s-cni-overlay localnet NAD to lose connectivity due to a missing logical port
• OCPBUGS-74304 - Konflux build pipeline failing with memory issues
• OCPBUGS-74365 - [release-4.21] broken unit test in BMO
• OCPBUGS-74372 - release-4.21 Component Readiness: [Test Framework] [Pathological Events] ConfigDriftMonitorStopped and RemoveSigtermProtection
• OCPBUGS-74393 - update to Multi-arch compatible image
• OCPBUGS-74398 - [release-4.21][TechPreview] cluster-api-provider-azure: sync with released v1.22.0
• OCPBUGS-74428 - [release-4.21] bump eventlet version to latest bugfix
• OCPBUGS-74479 - [release-4.21]Cluster Operator insights did not report Progressing=True during a cluster update
• OCPBUGS-74493 - Azure: add support for NVIDIA H100 and H200 enabled machine series
• OCPBUGS-74499 - Update MCN tests to better handle condition transitions through the "Unknown" state
• OCPBUGS-74503 - [4.21] Pathological events emitted by vmware-vsphere-csi-driver-operator
• OCPBUGS-74542 - Stale machine-config-operator metrics Service and ServiceMonitor resources need to be deleted
• OCPBUGS-74577 - Mirroring to an enclave fails with duplicate channel error for operators
• OCPBUGS-74587 - '0 of pods' are shown in Status column on DaemonSets list page.
• OCPBUGS-74588 - [release-4.21][AWS] throughputMib doesn't work for controlplanemachineset
• OCPBUGS-74592 - kube-scheduler operator uses a wrong operator name to fetch initial state
• OCPBUGS-74621 - Static pods terminated early during graceful shutdown due to missing priority field
• OCPBUGS-74622 - AlertmanagerClusterFailedToSendAlerts never triggers
• OCPBUGS-74648 - HostedCluster reports Available before control plane components have successfully rolled out
• OCPBUGS-74650 - [release-4.21] CCAPIO: e2e test workaround for OCPBUGS-74571
• OCPBUGS-74672 - GCP installs should succeed if 'zones' is not specified and the region has an AI zone
• OCPBUGS-74706 - [4.21] vsphere-problem-detector-operator crash due to concurrent map writes
• OCPBUGS-74887 - [release-4.21] User Management - Rolebindings : Unexpected error
• OCPBUGS-74915 - [release-4.21][TechPreview] cluster-api-provider-gcp: sync with released v1.11.0
• OCPBUGS-74935 - OVE UI Update Konflux references

CVEs

• CVE-2025-15284
• CVE-2025-55198
• CVE-2025-55199
• CVE-2025-58068
• CVE-2025-58183
• CVE-2025-65637

References

• https://access.redhat.com/security/updates/classification/