# 4.21.0-okd-scos.ec.9

Created: 2025-11-24 05:00:43 +0000 UTC

Image Digest: `sha256:08fabb1dfee9401c7f62aa0b5b2ab434c74dc9b4088c131cae0df6dfa7ad8ad7`

Promoted from registry.ci.openshift.org/origin/release-scos:4.21.0-0.okd-scos-2025-11-23-192952


## Changes from 4.21.0-okd-scos.ec.8

### Components

* Kubectl 1.34.1
* Kubernetes 1.34.1
* Kubernetes Tests 1.34.1
* CentOS Stream CoreOS 10.0.20251113-0



### FeatureGate Changes
| FeatureGate | Default<br/>Hypershift | Default<br/>SelfManagedHA | DevPreviewNoUpgrade<br/>Hypershift | DevPreviewNoUpgrade<br/>SelfManagedHA | TechPreviewNoUpgrade<br/>Hypershift | TechPreviewNoUpgrade<br/>SelfManagedHA  |
| :------ | :---: | :---: | :---: | :---: | :---: | :---:  |
| NoRegistryClusterOperations <br/> (0 tests)| Unconditionally Enabled<br/>(Changed)| Unconditionally Enabled<br/>(Changed)| Unconditionally Enabled<br/>(Changed)| Unconditionally Enabled<br/>(Changed)| Unconditionally Enabled<br/>(Changed)| Unconditionally Enabled<br/>(Changed) |
| ClientsAllowCBOR <br/> (0 tests)| Disabled| Disabled| Disabled<br/>(Changed)| Disabled<br/>(Changed)| Disabled<br/>(Changed)| Disabled<br/>(Changed) |
| HyperShiftOnlyDynamicResourceAllocation <br/> (0 tests)| Enabled<br/>(New)|  | Enabled<br/>(New)|  | Enabled<br/>(New)|   |
| NewOLMBoxCutterRuntime <br/> (0 tests)|  |  |  | Enabled<br/>(New)|  | Enabled<br/>(New) |
| NoRegistryClusterInstall <br/> (0 tests)|  |  |  | Enabled<br/>(New)|  | Enabled<br/>(New) |
| OnPremDNSRecords <br/> (0 tests)|  |  | Enabled<br/>(New)| Enabled<br/>(New)| Enabled<br/>(New)| Enabled<br/>(New) |
| ProvisioningRequestAvailable <br/> (0 tests)|  |  | Enabled<br/>(New)| Enabled<br/>(New)|  |   |


### Rebuilt images without code change

* [cluster-cloud-controller-manager-operator](https://github.com/openshift/cluster-cloud-controller-manager-operator) git [6148c0cc](https://github.com/openshift/cluster-cloud-controller-manager-operator/commit/6148c0cca626bcf0bfebcc6dd0c77a41944cba87) `sha256:167f5c04a36219b64272e33329e33b8197ee2083b01c77b0643523c420237d20`
* [cluster-image-registry-operator](https://github.com/openshift/cluster-image-registry-operator) git [2212ae9c](https://github.com/openshift/cluster-image-registry-operator/commit/2212ae9c5d1b1dfeaf2036677428968a031335f5) `sha256:e8fa3a5ae66369f28a1c00c65e21a6a9ca8222b2a4f7239f27b4bfb1b72caa73`
* [etcd](https://github.com/openshift/etcd) git [806f690e](https://github.com/openshift/etcd/commit/806f690e1f140e0aea2eb05ef5f288b756b62895) `sha256:40fd9431daa58b2ffd99a41c541b56558683903b1d590e9e03d38ab61f676f9a`
* [installer-etcd-artifacts](https://github.com/openshift/etcd) git [806f690e](https://github.com/openshift/etcd/commit/806f690e1f140e0aea2eb05ef5f288b756b62895) `sha256:2927020849c44fd9ff805fe4d37e281d05f33c5cffeb2ee5d86022c8a2b9f8ea`


### [agent-installer-api-server](https://github.com/openshift/assisted-service/tree/e64cd9192e5159ca00109c6723222b16c720c121)

* [MGMT-22244](https://issues.redhat.com/browse/MGMT-22244): add AgentServiceConfig ctrl watch for mirror regsitry configmap changes [#8391](https://github.com/openshift/assisted-service/pull/8391)
* [MGMT-22246](https://issues.redhat.com/browse/MGMT-22246): Allow late binding for arbiter hosts [#8395](https://github.com/openshift/assisted-service/pull/8395)
* [MGMT-22263](https://issues.redhat.com/browse/MGMT-22263): Fix Image service health check timeout too short for onprem deployments [#8405](https://github.com/openshift/assisted-service/pull/8405)
* NO-ISSUE: [master] Bump OCP versions: 4.17, 4.21, 4.19 [#8404](https://github.com/openshift/assisted-service/pull/8404)
* [MGMT-21691](https://issues.redhat.com/browse/MGMT-21691): Reorder networks and VIPs after each DB fetch before install-config generation [#8400](https://github.com/openshift/assisted-service/pull/8400)
* [ACM-26371](https://issues.redhat.com/browse/ACM-26371): Update go.mod Hive dependency [#8392](https://github.com/openshift/assisted-service/pull/8392)
* [OCPBUGS-56913](https://issues.redhat.com/browse/OCPBUGS-56913): Retry incomplete cluster registration in ABI [#8241](https://github.com/openshift/assisted-service/pull/8241)
* NO-ISSUE: [master] Bump OCP versions: 4.20 [#8398](https://github.com/openshift/assisted-service/pull/8398)
* [MGMT-21982](https://issues.redhat.com/browse/MGMT-21982): Remove --interactive  flag from the unconfigured ignition [#8389](https://github.com/openshift/assisted-service/pull/8389)
* NO-JIRA: Add project documentation to CLAUDE.md [#8209](https://github.com/openshift/assisted-service/pull/8209)
* [MGMT-22154](https://issues.redhat.com/browse/MGMT-22154): return bad request when cluster or host are missing in v2uploadLogs [#8356](https://github.com/openshift/assisted-service/pull/8356)
* NO-JIRA: Fix database initialization in unit tests [#8353](https://github.com/openshift/assisted-service/pull/8353)
* [Full changelog](https://github.com/openshift/assisted-service/compare/db8943a16f67b5718ad3a7b4128b8a510c0d562a...e64cd9192e5159ca00109c6723222b16c720c121)


### [agent-installer-csr-approver, agent-installer-orchestrator](https://github.com/openshift/assisted-installer/tree/89557a2a120c217502814b97c33927507661ac3c)

* [AGENT-1072](https://issues.redhat.com/browse/AGENT-1072): Apply operator manifests from ConfigMap for agent-installer [#1175](https://github.com/openshift/assisted-installer/pull/1175)
* [Full changelog](https://github.com/openshift/assisted-installer/compare/146fd6668f4e98b6cbbb03fa58975dd86629319f...89557a2a120c217502814b97c33927507661ac3c)


### [agent-installer-node-agent](https://github.com/openshift/assisted-installer-agent/tree/ab4a37f273bb3d466c5c07683d116ebfb69cbddf)

* [MGMT-22042](https://issues.redhat.com/browse/MGMT-22042): add cve-automation github app to owners_aliases [#1171](https://github.com/openshift/assisted-installer-agent/pull/1171)
* [Full changelog](https://github.com/openshift/assisted-installer-agent/compare/311d0fbe253ebb0c3a3e3c4bf5f555b6a2487f8f...ab4a37f273bb3d466c5c07683d116ebfb69cbddf)


### [agent-installer-utils](https://github.com/openshift/agent-installer-utils/tree/e99b980bc6f1bf66cb16333b9a7269158b7fa948)

* NO-JIRA: Add project documentation to CLAUDE.md [#191](https://github.com/openshift/agent-installer-utils/pull/191)
* [Full changelog](https://github.com/openshift/agent-installer-utils/compare/9cefd6c9fa38a7ce070810b88a147b9b6af3e242...e99b980bc6f1bf66cb16333b9a7269158b7fa948)


### [aws-cloud-controller-manager](https://github.com/openshift/cloud-provider-aws/tree/3365bc9ca5b116c63c1c90130c017f3496a139a1)

* [SPLAT-2253](https://issues.redhat.com/browse/SPLAT-2253): tests/ote: fix parser issue when listing images [#122](https://github.com/openshift/cloud-provider-aws/pull/122)
* [Full changelog](https://github.com/openshift/cloud-provider-aws/compare/70b9392fae824fd8b5531203ee37d048cd961527...3365bc9ca5b116c63c1c90130c017f3496a139a1)


### [aws-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-aws/tree/47bf1f7464c4ae43ecf9d62e156f0795d8daab2f)

* NO-JIRA: openshift: rename manager binary [#581](https://github.com/openshift/cluster-api-provider-aws/pull/581)
* [Full changelog](https://github.com/openshift/cluster-api-provider-aws/compare/53939048ef278b09552b0640beb169c20aa1bd71...47bf1f7464c4ae43ecf9d62e156f0795d8daab2f)


### [aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator](https://github.com/openshift/csi-operator/tree/854504f36ad8d0a7c6081ab991ea4ef574935497)

* [OCPBUGS-65858](https://issues.redhat.com/browse/OCPBUGS-65858): allow all-egress for efs operator [#472](https://github.com/openshift/csi-operator/pull/472)
* [STOR-2538](https://issues.redhat.com/browse/STOR-2538): Migrate aws sdk to v2 [#442](https://github.com/openshift/csi-operator/pull/442)
* No-JIRA: Update owners [#471](https://github.com/openshift/csi-operator/pull/471)
* [STOR-2627](https://issues.redhat.com/browse/STOR-2627): Enable nodeAllocatableUpdatePeriodSeconds in AWS EBS [#435](https://github.com/openshift/csi-operator/pull/435)
* [Full changelog](https://github.com/openshift/csi-operator/compare/b69467bd7af58c49a4b45d80afbf3f7aad07acff...854504f36ad8d0a7c6081ab991ea4ef574935497)


### [aws-karpenter-provider-aws](https://github.com/openshift/aws-karpenter-provider-aws/tree/3fcdd6f905e505c998fb1a9a513313a52d5d6eca)

* [AUTOSCALE-446](https://issues.redhat.com/browse/AUTOSCALE-446): Downrev/pin Karpenter 1.8.2 deps to Kube 1.34 for Hypershift 4.21 integration [#19](https://github.com/openshift/aws-karpenter-provider-aws/pull/19)
* [Full changelog](https://github.com/openshift/aws-karpenter-provider-aws/compare/7f0513e0305e4ea70df0bc9bd6e23d130c9f87bc...3fcdd6f905e505c998fb1a9a513313a52d5d6eca)


### [aws-machine-controllers](https://github.com/openshift/machine-api-provider-aws/tree/ff23a968e68909eb67a1bd6d766c85f4ccbd5b8b)

* NO-JIRA: bump k8s 1.34: bump Makefile and Dockerfile [#158](https://github.com/openshift/machine-api-provider-aws/pull/158)
* [OCPCLOUD-3085](https://issues.redhat.com/browse/OCPCLOUD-3085): Bump k8s to 1.34 [#156](https://github.com/openshift/machine-api-provider-aws/pull/156)
* [Full changelog](https://github.com/openshift/machine-api-provider-aws/compare/444134d4ebc8e2845686d07f9e6462d4d81cdbee...ff23a968e68909eb67a1bd6d766c85f4ccbd5b8b)


### [azure-machine-controllers](https://github.com/openshift/machine-api-provider-azure/tree/b8b8cb1c5af7d2a3ef9a4a99a0739a2166a7932c)

* [OCPBUGS-63729](https://issues.redhat.com/browse/OCPBUGS-63729): Set updateDomainCount to one when faultDomainCount is one [#170](https://github.com/openshift/machine-api-provider-azure/pull/170)
* [Full changelog](https://github.com/openshift/machine-api-provider-azure/compare/ceda5b5fa89456fd170d803c32ae2e8c203306b5...b8b8cb1c5af7d2a3ef9a4a99a0739a2166a7932c)


### [baremetal-installer, installer, installer-artifacts](https://github.com/openshift/installer/tree/90b08c74a0a1a6f19860d042866a9409c4f7b678)

* [CORS-4249](https://issues.redhat.com/browse/CORS-4249): bump ARO marketplace images [#10117](https://github.com/openshift/installer/pull/10117)
* [CORS-4212](https://issues.redhat.com/browse/CORS-4212): AWS: Add the ability to configure throughput on GP3 volumes [#9945](https://github.com/openshift/installer/pull/9945)
* no-jira: Remove the GCP Custom Endpoints Feature Gate [#10114](https://github.com/openshift/installer/pull/10114)
* [CORS-3657](https://issues.redhat.com/browse/CORS-3657): Default Azure Installs to Marketplace Images [#10076](https://github.com/openshift/installer/pull/10076)
* [METAL-1105](https://issues.redhat.com/browse/METAL-1105): support specifying CA to verify BMC connections [#10072](https://github.com/openshift/installer/pull/10072)
* [CORS-4259](https://issues.redhat.com/browse/CORS-4259), [CORS-4260](https://issues.redhat.com/browse/CORS-4260), [CORS-4265](https://issues.redhat.com/browse/CORS-4265): Move the gcp permission check to a common file in install config. [#10018](https://github.com/openshift/installer/pull/10018)
* [OCPBUGS-65893](https://issues.redhat.com/browse/OCPBUGS-65893): CORS-4055: configure AWS SDK v2 clients with common config [#10112](https://github.com/openshift/installer/pull/10112)
* [OCPBUGS-42871](https://issues.redhat.com/browse/OCPBUGS-42871): pkg/infrastructure/network: update NumberOfProbes to ProbeThreshold [#9423](https://github.com/openshift/installer/pull/9423)
* [CORS-4188](https://issues.redhat.com/browse/CORS-4188): AWS - Add support to AMD SEV-SNP confidential VMs [#10012](https://github.com/openshift/installer/pull/10012)
* NO-JIRA: Add project documentation to CLAUDE.md [#10040](https://github.com/openshift/installer/pull/10040)
* [CORS-4064](https://issues.redhat.com/browse/CORS-4064), [CORS-4187](https://issues.redhat.com/browse/CORS-4187): Add support for multi zonal NAT gateways [#9773](https://github.com/openshift/installer/pull/9773)
* [OKD-279](https://issues.redhat.com/browse/OKD-279): Enabled secureboot for cs10 testing [#9959](https://github.com/openshift/installer/pull/9959)
* NO-JIRA: Update ShiftStack OWNERS [#10115](https://github.com/openshift/installer/pull/10115)
* no-jira: generate powervc deep copy [#10116](https://github.com/openshift/installer/pull/10116)
* [OSASINFRA-3965](https://issues.redhat.com/browse/OSASINFRA-3965): Bump cluster-api to v1.11.3 [#10110](https://github.com/openshift/installer/pull/10110)
* [CORS-4266](https://issues.redhat.com/browse/CORS-4266): Add generated DeepCopy implementations for pkg/types/installconfig [#10025](https://github.com/openshift/installer/pull/10025)
* no-jira: bump CAPA controller [#10107](https://github.com/openshift/installer/pull/10107)
* [MULTIARCH-5358](https://issues.redhat.com/browse/MULTIARCH-5358): PowerVC: Add new platform for PowerVC [#9806](https://github.com/openshift/installer/pull/9806)
* [OCPBUGS-65748](https://issues.redhat.com/browse/OCPBUGS-65748): vSphere upi - change to infra id for folders [#10106](https://github.com/openshift/installer/pull/10106)
* [AGENT-1303](https://issues.redhat.com/browse/AGENT-1303): Run agent-register-infraenv in interactive mode [#9960](https://github.com/openshift/installer/pull/9960)
* no-jira: add support for g2-standard* GCP instances [#10101](https://github.com/openshift/installer/pull/10101)
* [OCPBUGS-65659](https://issues.redhat.com/browse/OCPBUGS-65659): Add StandardFXmdsv2Family to azure tested instance type list [#10088](https://github.com/openshift/installer/pull/10088)
* [OCPBUGS-65661](https://issues.redhat.com/browse/OCPBUGS-65661): continue to update 02_storage.json using new property storageAccountId [#10089](https://github.com/openshift/installer/pull/10089)
* [OCPBUGS-56451](https://issues.redhat.com/browse/OCPBUGS-56451): Use the ImageDigest SourcePolicy to configure image registry on bootstrap host [#10073](https://github.com/openshift/installer/pull/10073)
* [OPNET-678](https://issues.redhat.com/browse/OPNET-678): Bump openshift/api [#10097](https://github.com/openshift/installer/pull/10097)
* [OCPBUGS-59105](https://issues.redhat.com/browse/OCPBUGS-59105): pkg/asset/manifests/azure: save cidr blocks [#10034](https://github.com/openshift/installer/pull/10034)
* [CORS-4282](https://issues.redhat.com/browse/CORS-4282): Remove the installer gcp service endpoints. [#10075](https://github.com/openshift/installer/pull/10075)
* NO-ISSUE: Generate the agent systemd diagrams from the unit files [#10052](https://github.com/openshift/installer/pull/10052)
* [TRT-2424](https://issues.redhat.com/browse/TRT-2424): Revert "Update the RHCOS 4.21 bootimage metadata to 9.6.20251113-0" [#10092](https://github.com/openshift/installer/pull/10092)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/installer/compare/5b7289b6dba77aaf3ea5ffc788f0c7b41411eb1f...90b08c74a0a1a6f19860d042866a9409c4f7b678)


### [baremetal-operator](https://github.com/openshift/baremetal-operator/tree/19806234e44b43dbb4255506c86a3d401c91207b)

* NO-ISSUE: Merge upstream [#436](https://github.com/openshift/baremetal-operator/pull/436)
* [Full changelog](https://github.com/openshift/baremetal-operator/compare/eaa8c4184d7fb1f2b2009e40ca372f84717e5b53...19806234e44b43dbb4255506c86a3d401c91207b)


### [cli, cli-artifacts, deployer, tools](https://github.com/openshift/oc/tree/8642d882f16de34a033ac4ac19dfde866c7a523f)

* [OCPBUGS-58038](https://issues.redhat.com/browse/OCPBUGS-58038): Clear defaultNodeSelector to run on any node [#2149](https://github.com/openshift/oc/pull/2149)
* [CNTRLPLANE-1538](https://issues.redhat.com/browse/CNTRLPLANE-1538): extend --auto-open-browser to work with --web [#2115](https://github.com/openshift/oc/pull/2115)
* [Full changelog](https://github.com/openshift/oc/compare/0c09391d89b24f45dc606eee749e67d9b52c9f70...8642d882f16de34a033ac4ac19dfde866c7a523f)


### [cluster-autoscaler](https://github.com/openshift/kubernetes-autoscaler/tree/73b87353dd524cc63932c58bab555a94d67bff1b)

* [OCPBUGS-57131](https://issues.redhat.com/browse/OCPBUGS-57131): update node info processors to include unschedulable nodes [#390](https://github.com/openshift/kubernetes-autoscaler/pull/390)
* [Full changelog](https://github.com/openshift/kubernetes-autoscaler/compare/5522170949ac45f4d2c56c859bc3fd1005ec2bad...73b87353dd524cc63932c58bab555a94d67bff1b)


### [cluster-baremetal-operator](https://github.com/openshift/cluster-baremetal-operator/tree/7131315601da58951c827e9cf7482c1957a5815f)

* NO-ISSUE: Parameterize Makefile container build tool [#520](https://github.com/openshift/cluster-baremetal-operator/pull/520)
* [METAL-1656](https://issues.redhat.com/browse/METAL-1656): Remove entity_id from PrometheusRule alert descriptions [#528](https://github.com/openshift/cluster-baremetal-operator/pull/528)
* [METAL-1238](https://issues.redhat.com/browse/METAL-1238): Add annotation to enable CBO install via CVO in Hosted Clusters [#493](https://github.com/openshift/cluster-baremetal-operator/pull/493)
* [METAL-1239](https://issues.redhat.com/browse/METAL-1239): Add ExternalIPs field to Provisioning CRD [#522](https://github.com/openshift/cluster-baremetal-operator/pull/522)
* [Full changelog](https://github.com/openshift/cluster-baremetal-operator/compare/a0a0c738016ba5bf786abf19fe48642653561a40...7131315601da58951c827e9cf7482c1957a5815f)


### [cluster-capi-controllers](https://github.com/openshift/cluster-api/tree/29f3510b6eafd2c817d91437979ec6bd6ec363a4)

* NO-JIRA: openshift: rename manager binary [#252](https://github.com/openshift/cluster-api/pull/252)
* [Full changelog](https://github.com/openshift/cluster-api/compare/3afd7503745f097c04a2884f8e53563353b9f11e...29f3510b6eafd2c817d91437979ec6bd6ec363a4)


### [cluster-capi-operator](https://github.com/openshift/cluster-capi-operator/tree/509ccfd2960cf884b03e7cda85680954bfd0c894)

* NO-JIRA: capiinstaller: drop manager replacement [#410](https://github.com/openshift/cluster-capi-operator/pull/410)
* [OCPCLOUD-2992](https://issues.redhat.com/browse/OCPCLOUD-2992): refactor: split machineset migration testing into multiple files [#390](https://github.com/openshift/cluster-capi-operator/pull/390)
* [OCPCLOUD-3188](https://issues.redhat.com/browse/OCPCLOUD-3188): Prevent MAPI MachineSet creation when CAPI MachineSet with same name exists [#405](https://github.com/openshift/cluster-capi-operator/pull/405)
* [Full changelog](https://github.com/openshift/cluster-capi-operator/compare/5f7410a43e30f666e5d41deee487a719ea8a7d27...509ccfd2960cf884b03e7cda85680954bfd0c894)


### [cluster-config-api](https://github.com/openshift/api/tree/88cca31a44c93d051a0c9dfee86dfb6b46d01f4a)

* [MCO-1927](https://issues.redhat.com/browse/MCO-1927): Add osImageStream to MCPs [#2555](https://github.com/openshift/api/pull/2555)
* Disable TPNU/DPNU ClientsAllowCBOR for large list decodes. [#2593](https://github.com/openshift/api/pull/2593)
* Move ProfileCustomizations under a new GA gate [#2590](https://github.com/openshift/api/pull/2590)
* [CORS-4250](https://issues.redhat.com/browse/CORS-4250): AWS: Add the ability to configure throughput on GP3 volumes [#2480](https://github.com/openshift/api/pull/2480)
* [OCPBUGS-60885](https://issues.redhat.com/browse/OCPBUGS-60885): Add ClosedClientConnectionPolicy to IngressController API [#2584](https://github.com/openshift/api/pull/2584)
* [CONSOLE-4882](https://issues.redhat.com/browse/CONSOLE-4882): Support mailto: links in ConsoleLink href field [#2592](https://github.com/openshift/api/pull/2592)
* [OCPBUGS-61858](https://issues.redhat.com/browse/OCPBUGS-61858): Use pointer type for HTTPKeepAliveTimeout in IngressController API [#2591](https://github.com/openshift/api/pull/2591)
* [AUTOSCALE-172](https://issues.redhat.com/browse/AUTOSCALE-172): add feature gate for ProvisioningRequest CRD [#2587](https://github.com/openshift/api/pull/2587)
* [OCPBUGS-61858](https://issues.redhat.com/browse/OCPBUGS-61858): Add HTTPKeepAliveTimeout to IngressController API [#2547](https://github.com/openshift/api/pull/2547)
* [OCPNODE-3874](https://issues.redhat.com/browse/OCPNODE-3874): Remove the unused constant CgroupModeV1 [#2579](https://github.com/openshift/api/pull/2579)
* [AGENT-1372](https://issues.redhat.com/browse/AGENT-1372): Rename NoRegistryClusterOperations to NoRegistryClusterInstall [#2586](https://github.com/openshift/api/pull/2586)
* [OPRUN-4246](https://issues.redhat.com/browse/OPRUN-4246): Add BoxCutterRuntime feature gate [#2577](https://github.com/openshift/api/pull/2577)
* [OPNET-678](https://issues.redhat.com/browse/OPNET-678): Add internalDNSRecords field [#2460](https://github.com/openshift/api/pull/2460)
* [Full changelog](https://github.com/openshift/api/compare/6711368ea523ea381dafeed164584cb78a7cd129...88cca31a44c93d051a0c9dfee86dfb6b46d01f4a)


### [cluster-control-plane-machine-set-operator](https://github.com/openshift/cluster-control-plane-machine-set-operator/tree/231a1fce79906e749269c72e13d937c683c1a305)

* [OCPCLOUD-3042](https://issues.redhat.com/browse/OCPCLOUD-3042): use go workspace [#376](https://github.com/openshift/cluster-control-plane-machine-set-operator/pull/376)
* [Full changelog](https://github.com/openshift/cluster-control-plane-machine-set-operator/compare/2220a43d9352e2f57c53e348ca61acb7209b79e7...231a1fce79906e749269c72e13d937c683c1a305)


### [cluster-csi-snapshot-controller-operator](https://github.com/openshift/cluster-csi-snapshot-controller-operator/tree/40c913a6a7745310e443592ba8d4cddd76176e09)

* No-JIRA: Update owners [#260](https://github.com/openshift/cluster-csi-snapshot-controller-operator/pull/260)
* [STOR-2560](https://issues.redhat.com/browse/STOR-2560): Add readOnlyRootFilesystem to hypershift and ibm-cloud-managed [#248](https://github.com/openshift/cluster-csi-snapshot-controller-operator/pull/248)
* [STOR-2534](https://issues.redhat.com/browse/STOR-2534): Remove v1beta1 group snapshot API [#259](https://github.com/openshift/cluster-csi-snapshot-controller-operator/pull/259)
* [STOR-2592](https://issues.redhat.com/browse/STOR-2592): Bump all deps for 4.21 [#253](https://github.com/openshift/cluster-csi-snapshot-controller-operator/pull/253)
* [Full changelog](https://github.com/openshift/cluster-csi-snapshot-controller-operator/compare/588e532f520b71a0ce995a48f38294b9c4bb1e26...40c913a6a7745310e443592ba8d4cddd76176e09)


### [cluster-dns-operator](https://github.com/openshift/cluster-dns-operator/tree/41a53fed36e6e99c7c9ceb3a699c3547ee5d9bb9)

* [NE-2245](https://issues.redhat.com/browse/NE-2245): Bump cluster-dns-operator to Kubernetes 1.34 for 4.21 [#453](https://github.com/openshift/cluster-dns-operator/pull/453)
* [Full changelog](https://github.com/openshift/cluster-dns-operator/compare/2ec8a3de79d73760abbccdbcbbf9951fc93097cd...41a53fed36e6e99c7c9ceb3a699c3547ee5d9bb9)


### [cluster-etcd-operator](https://github.com/openshift/cluster-etcd-operator/tree/f3716094e7176e8d046f4f07d56bdf05c2ac1ba9)

* [CNTRLPLANE-1769](https://issues.redhat.com/browse/CNTRLPLANE-1769): Update to v3.6.5 [#1507](https://github.com/openshift/cluster-etcd-operator/pull/1507)
* [Full changelog](https://github.com/openshift/cluster-etcd-operator/compare/336e1348334fe498752ffebb8c2d9ee649697c0d...f3716094e7176e8d046f4f07d56bdf05c2ac1ba9)


### [cluster-ingress-operator](https://github.com/openshift/cluster-ingress-operator/tree/b62dd27c901d495e6e78b11968872c002cc2416f)

* [CORS-4229](https://issues.redhat.com/browse/CORS-4229): Revert "dns/gcp: Allow configuring custom endpoints" [#1302](https://github.com/openshift/cluster-ingress-operator/pull/1302)
* [OCPBUGS-61858](https://issues.redhat.com/browse/OCPBUGS-61858): Implement HTTPKeepAliveTimeout tuning option [#1297](https://github.com/openshift/cluster-ingress-operator/pull/1297)
* [CORS-4174](https://issues.redhat.com/browse/CORS-4174): Azure: Add Ingress LB IPs to Infra CR when in-cluster DNS is enabled [#1256](https://github.com/openshift/cluster-ingress-operator/pull/1256)
* [OCPBUGS-60885](https://issues.redhat.com/browse/OCPBUGS-60885): Implement ClosedClientConnectionPolicy field [#1307](https://github.com/openshift/cluster-ingress-operator/pull/1307)
* [NE-2203](https://issues.redhat.com/browse/NE-2203): Add PrometheusRule for Gateway API [#1300](https://github.com/openshift/cluster-ingress-operator/pull/1300)
* [NE-2233](https://issues.redhat.com/browse/NE-2233): Bump to OSSM 3.2.0 and Istio 1.27.3 [#1306](https://github.com/openshift/cluster-ingress-operator/pull/1306)
* [NE-2161](https://issues.redhat.com/browse/NE-2161): Fix Gateway API CRD metadata updates during operator upgrades [#1309](https://github.com/openshift/cluster-ingress-operator/pull/1309)
* [OCPBUGS-64675](https://issues.redhat.com/browse/OCPBUGS-64675): Fix variable shadowing in testGatewayAPIDNS e2e [#1304](https://github.com/openshift/cluster-ingress-operator/pull/1304)
* [NE-2161](https://issues.redhat.com/browse/NE-2161): Bump Gateway API CRDs to v1.3.0 [#1303](https://github.com/openshift/cluster-ingress-operator/pull/1303)
* [Full changelog](https://github.com/openshift/cluster-ingress-operator/compare/8773f8f65be6da42fadbae9b358e082efec8fca5...b62dd27c901d495e6e78b11968872c002cc2416f)


### [cluster-kube-apiserver-operator](https://github.com/openshift/cluster-kube-apiserver-operator/tree/9182a526db6bfdb7badfbc4d175ecc34bc7647bf)

* [OCPBUGS-65755](https://issues.redhat.com/browse/OCPBUGS-65755): Stop serving VolumeAttributesClass v1beta1 [#1949](https://github.com/openshift/cluster-kube-apiserver-operator/pull/1949)
* [CNTRLPLANE-180](https://issues.redhat.com/browse/CNTRLPLANE-180): check for user-based SCCs causing PSA violations [#1881](https://github.com/openshift/cluster-kube-apiserver-operator/pull/1881)
* [CNTRLPLANE-1724](https://issues.redhat.com/browse/CNTRLPLANE-1724): Refactor OTE to single-module architecture [#1966](https://github.com/openshift/cluster-kube-apiserver-operator/pull/1966)
* [OCPBUGS-62366](https://issues.redhat.com/browse/OCPBUGS-62366): remove beta enablement for resource api [#1923](https://github.com/openshift/cluster-kube-apiserver-operator/pull/1923)
* [Full changelog](https://github.com/openshift/cluster-kube-apiserver-operator/compare/c5e43207ec4f1efa9fa2cdd069f9b314bae61845...9182a526db6bfdb7badfbc4d175ecc34bc7647bf)


### [cluster-monitoring-operator](https://github.com/openshift/cluster-monitoring-operator/tree/7261edb54a42a05349ec9775b7829015d45b85b6)

* [OCPBUGS-65630](https://issues.redhat.com/browse/OCPBUGS-65630): add monitoring-plugin service account to deployment. [#2748](https://github.com/openshift/cluster-monitoring-operator/pull/2748)
* [MON-4420](https://issues.redhat.com/browse/MON-4420): Enable Gateway API collection by telemeter [#2750](https://github.com/openshift/cluster-monitoring-operator/pull/2750)
* [MON-4420](https://issues.redhat.com/browse/MON-4420): Gateway API telemetry [#2734](https://github.com/openshift/cluster-monitoring-operator/pull/2734)
* [OCPBUGS-65600](https://issues.redhat.com/browse/OCPBUGS-65600): fetch misspell binary upon invocation and fix CHANGELOG typo [#2747](https://github.com/openshift/cluster-monitoring-operator/pull/2747)
* NO-JIRA: [bot] Synchronize versions of the downstream components [#2736](https://github.com/openshift/cluster-monitoring-operator/pull/2736)
* [Full changelog](https://github.com/openshift/cluster-monitoring-operator/compare/aa9190b0f33fcba5e8dbfcb52bb8ca7632b15219...7261edb54a42a05349ec9775b7829015d45b85b6)


### [cluster-node-tuning-operator](https://github.com/openshift/cluster-node-tuning-operator/tree/1c8b5ffa4b75b6d7957d18663058fdb57b299cd7)

* [PSAP-1655](https://issues.redhat.com/browse/PSAP-1655): Make machineConfigLabels-related misconfiguration more visible [#1316](https://github.com/openshift/cluster-node-tuning-operator/pull/1316)
* [OCPBUGS-63321](https://issues.redhat.com/browse/OCPBUGS-63321): Watch MCP changes including spec and labels [#1425](https://github.com/openshift/cluster-node-tuning-operator/pull/1425)
* [Full changelog](https://github.com/openshift/cluster-node-tuning-operator/compare/a3e9663933a2fc4e4d634c7bb33b4c3f8689c6ce...1c8b5ffa4b75b6d7957d18663058fdb57b299cd7)


### [cluster-policy-controller](https://github.com/openshift/cluster-policy-controller/tree/8b775487512fb543bff470ff1042bd3ac31b29be)

* [CNTRLPLANE-1676](https://issues.redhat.com/browse/CNTRLPLANE-1676): Update to Kubernetes v1.34.2 [#170](https://github.com/openshift/cluster-policy-controller/pull/170)
* [Full changelog](https://github.com/openshift/cluster-policy-controller/compare/ef703966fe6e82f5f255b06bc5c758f105bf8b28...8b775487512fb543bff470ff1042bd3ac31b29be)


### [cluster-samples-operator](https://github.com/openshift/cluster-samples-operator/tree/d83904effe3e6d99aa0067a5e79da403623fbad4)

* [CNTRLPLANE-1544](https://issues.redhat.com/browse/CNTRLPLANE-1544): manifests: Use restricted-v3 scc for the operator [#664](https://github.com/openshift/cluster-samples-operator/pull/664)
* [OCPBUGS-65840](https://issues.redhat.com/browse/OCPBUGS-65840): Periodic sync of supported OCP samples [#653](https://github.com/openshift/cluster-samples-operator/pull/653)
* [OCPBUGS-65756](https://issues.redhat.com/browse/OCPBUGS-65756): Periodic sync of OKD samples [#648](https://github.com/openshift/cluster-samples-operator/pull/648)
* [OCPBUGS-65717](https://issues.redhat.com/browse/OCPBUGS-65717): Update the k8s API version to v0.34.2 [#665](https://github.com/openshift/cluster-samples-operator/pull/665)
* [Full changelog](https://github.com/openshift/cluster-samples-operator/compare/14236f82a2cd11af091ed8ec7e6c437cb6bce092...d83904effe3e6d99aa0067a5e79da403623fbad4)


### [cluster-storage-operator](https://github.com/openshift/cluster-storage-operator/tree/0e358d15d10fa7e98f8ead3ea57509e65ae543aa)

* [STOR-2651](https://issues.redhat.com/browse/STOR-2651): Alert users for mismatching parameters in VolumeAttributesClasses [#646](https://github.com/openshift/cluster-storage-operator/pull/646)
* [STOR-2523](https://issues.redhat.com/browse/STOR-2523): Set OPERATOR_IMAGE_VERSION for ibm-powervs-block-csi-driver-operator [#641](https://github.com/openshift/cluster-storage-operator/pull/641)
* No-JIRA: Update owners [#647](https://github.com/openshift/cluster-storage-operator/pull/647)
* [Full changelog](https://github.com/openshift/cluster-storage-operator/compare/e9d369d96f7202b179b2e12f8eec0bfb93d313bc...0e358d15d10fa7e98f8ead3ea57509e65ae543aa)


### [cluster-update-keys](https://github.com/openshift/cluster-update-keys/tree/b3cae8f22b51d9062d0ceb6ac9cf2f7651b4ce8f)

* [TRT-2426](https://issues.redhat.com/browse/TRT-2426): Third run at default feature set cluster image policy [#89](https://github.com/openshift/cluster-update-keys/pull/89)
* [TRT-2426](https://issues.redhat.com/browse/TRT-2426): Revert #85 " \tOCPNODE-3611: promote openshift ClusterImagePolicy to default featureset" [#87](https://github.com/openshift/cluster-update-keys/pull/87)
* [OCPNODE-3611](https://issues.redhat.com/browse/OCPNODE-3611): promote openshift ClusterImagePolicy to default featureset [#85](https://github.com/openshift/cluster-update-keys/pull/85)
* [Full changelog](https://github.com/openshift/cluster-update-keys/compare/f4335a376852396a21e9f5b9b40d40b9b50640ed...b3cae8f22b51d9062d0ceb6ac9cf2f7651b4ce8f)


### [cluster-version-operator](https://github.com/openshift/cluster-version-operator/tree/df1ec5572195b56c2ece635fbb99c35e87ba7431)

* NO-JIRA: Move constants of ClusterStatusConditionType into one place [#1252](https://github.com/openshift/cluster-version-operator/pull/1252)
* NO-JIRA: Add fao89 to OWNERS [#1260](https://github.com/openshift/cluster-version-operator/pull/1260)
* [Full changelog](https://github.com/openshift/cluster-version-operator/compare/e3ba184ed8c832e8601b1253586c2b4fb99a8843...df1ec5572195b56c2ece635fbb99c35e87ba7431)


### [console](https://github.com/openshift/console/tree/802f3665b50b966cf40be214db24dd72b080d3c2)

* [CONSOLE-4840](https://issues.redhat.com/browse/CONSOLE-4840): Remove all plugin entry points + topology static extension cleanup [#15699](https://github.com/openshift/console/pull/15699)
* [OCPBUGS-65628](https://issues.redhat.com/browse/OCPBUGS-65628): Use `useActiveNamespace` in search page [#15730](https://github.com/openshift/console/pull/15730)
* [CONSOLE-4846](https://issues.redhat.com/browse/CONSOLE-4846): add Trusted Software Supply Chain to Getting Started card [#15744](https://github.com/openshift/console/pull/15744)
* [CONSOLE-4701](https://issues.redhat.com/browse/CONSOLE-4701): Add fontsize+theme control to YAML editor [#15735](https://github.com/openshift/console/pull/15735)
* [CONSOLE-4838](https://issues.redhat.com/browse/CONSOLE-4838): Improvements to Console DataView code [#15713](https://github.com/openshift/console/pull/15713)
* [CONSOLE-4729](https://issues.redhat.com/browse/CONSOLE-4729), [CONSOLE-4823](https://issues.redhat.com/browse/CONSOLE-4823): Enable OLMv1 Tech Preview [#15715](https://github.com/openshift/console/pull/15715)
* [CONSOLE-4814](https://issues.redhat.com/browse/CONSOLE-4814): Add UI for creating VACs and also applying VACs to PVCs [#15643](https://github.com/openshift/console/pull/15643)
* [OU-949](https://issues.redhat.com/browse/OU-949): change dev-monitoring links to monitoring with ns param [#15578](https://github.com/openshift/console/pull/15578)
* [CONSOLE-4605](https://issues.redhat.com/browse/CONSOLE-4605): Migrate OLM core "packages/operator-lifecycle-manager" unit tests to React Testing Library [#15704](https://github.com/openshift/console/pull/15704)
* [CONSOLE-4709](https://issues.redhat.com/browse/CONSOLE-4709): Remove kebab factory uses from default-resouce list and details pages [#15732](https://github.com/openshift/console/pull/15732)
* [OCPBUGS-33487](https://issues.redhat.com/browse/OCPBUGS-33487): Fix tsconfig so that VSCode can autocomplete imports correctly [#15734](https://github.com/openshift/console/pull/15734)
* [CONSOLE-4709](https://issues.redhat.com/browse/CONSOLE-4709): Remove kebab factory uses from OLM plugin [#15714](https://github.com/openshift/console/pull/15714)
* [OCPBUGS-65612](https://issues.redhat.com/browse/OCPBUGS-65612): API Explorer list and Access review tab pagination [#15728](https://github.com/openshift/console/pull/15728)
* [CONSOLE-4709](https://issues.redhat.com/browse/CONSOLE-4709): part 1 - Remove kebab factory uses from Public [#15721](https://github.com/openshift/console/pull/15721)
* [OCPBUGS-65598](https://issues.redhat.com/browse/OCPBUGS-65598): fix invalid project resource link in ProjectList [#15726](https://github.com/openshift/console/pull/15726)
* [OCPBUGS-65696](https://issues.redhat.com/browse/OCPBUGS-65696): Preserve query string in perspective switch [#15736](https://github.com/openshift/console/pull/15736)
* [CONSOLE-4709](https://issues.redhat.com/browse/CONSOLE-4709): Remove kebab factory uses from console-app plugin [#15719](https://github.com/openshift/console/pull/15719)
* [CONSOLE-4840](https://issues.redhat.com/browse/CONSOLE-4840): Remove static extensions used by metal3 [#15717](https://github.com/openshift/console/pull/15717)
* [CONSOLE-4709](https://issues.redhat.com/browse/CONSOLE-4709): part 2 - Remove kebab factory uses from Public [#15729](https://github.com/openshift/console/pull/15729)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/console/compare/a9c737906b128342c4852c33d69fd8dd1c31969b...802f3665b50b966cf40be214db24dd72b080d3c2)


### [console-operator](https://github.com/openshift/console-operator/tree/c052b8a27195a665e2d1eef57f4975813f0315bf)

* [CONSOLE-4882](https://issues.redhat.com/browse/CONSOLE-4882): Vendor API changes to support mailto: links in ConsoleLink href field [#1070](https://github.com/openshift/console-operator/pull/1070)
* [CONSOLE-4666](https://issues.redhat.com/browse/CONSOLE-4666): Vendor ConsolePluginCRD v1alpha1 removal [#1059](https://github.com/openshift/console-operator/pull/1059)
* [CONSOLE-4847](https://issues.redhat.com/browse/CONSOLE-4847): ADD TSSC Quickstarts [#1062](https://github.com/openshift/console-operator/pull/1062)
* [Full changelog](https://github.com/openshift/console-operator/compare/4cb3c653864ca70464906b906fb90ffa32e7ded0...c052b8a27195a665e2d1eef57f4975813f0315bf)


### [csi-driver-nfs](https://github.com/openshift/csi-driver-nfs/tree/c704fd9a335b068beee4b7b9d957265012b09013)

* NO-JIRA: Update ShiftStack OWNERS [#165](https://github.com/openshift/csi-driver-nfs/pull/165)
* [Full changelog](https://github.com/openshift/csi-driver-nfs/compare/87e2700a9249f3ac9a35cb3aed589c918c56cb94...c704fd9a335b068beee4b7b9d957265012b09013)


### [csi-external-snapshot-metadata](https://github.com/openshift/csi-external-snapshot-metadata/tree/af250fdbac8af84d9808a2892bfc911c04162115)

* [STOR-2586](https://issues.redhat.com/browse/STOR-2586): Rebase to v0.2.0 for OCP 4.21 [#7](https://github.com/openshift/csi-external-snapshot-metadata/pull/7)
* [Full changelog](https://github.com/openshift/csi-external-snapshot-metadata/compare/24faebef64fac7975f6556996c3c2a1388a479ff...af250fdbac8af84d9808a2892bfc911c04162115)


### [docker-registry](https://github.com/openshift/image-registry/tree/21af80e2a0484a5ac9daf660afd88d36d43f354d)

* [AGENT-1311](https://issues.redhat.com/browse/AGENT-1311): Add support for distribution/distribution registry binary [#450](https://github.com/openshift/image-registry/pull/450)
* [Full changelog](https://github.com/openshift/image-registry/compare/de5c64151fdfab6980919c7f9fc269e65bb259e6...21af80e2a0484a5ac9daf660afd88d36d43f354d)


### [gcp-cloud-controller-manager](https://github.com/openshift/cloud-provider-gcp/tree/8732386c3ddcb98dae624f7bb925ed0ef8d077d5)

* [CORS-4264](https://issues.redhat.com/browse/CORS-4264): Update the GCP provider to allow users to manage their own firewall rules [#94](https://github.com/openshift/cloud-provider-gcp/pull/94)
* [Full changelog](https://github.com/openshift/cloud-provider-gcp/compare/e9159d6b083b2a27eb4c99e805e7d45fc32de2ad...8732386c3ddcb98dae624f7bb925ed0ef8d077d5)


### [gcp-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-gcp/tree/22eb42731e57f7f3d9794f9da5aded48c7e82d87)

* NO-JIRA: openshift: rename manager binary [#252](https://github.com/openshift/cluster-api-provider-gcp/pull/252)
* [Full changelog](https://github.com/openshift/cluster-api-provider-gcp/compare/a476e2fcd2d4b422b176325e6dea91fc6868bc76...22eb42731e57f7f3d9794f9da5aded48c7e82d87)


### [gcp-pd-csi-driver-operator](https://github.com/openshift/gcp-pd-csi-driver-operator/tree/b4921233fbe67dcc73a77a8d830cf4d79d34e562)

* [CNTRLPLANE-1289](https://issues.redhat.com/browse/CNTRLPLANE-1289): enable readOnlyRootFilesystem [#149](https://github.com/openshift/gcp-pd-csi-driver-operator/pull/149)
* [Full changelog](https://github.com/openshift/gcp-pd-csi-driver-operator/compare/c88906d168c0b6a11c7bb1b27cdd6d5d9457e06b...b4921233fbe67dcc73a77a8d830cf4d79d34e562)


### [haproxy-router](https://github.com/openshift/router/tree/61979f48e686cdccdf61a2825d0c558a5a391df1)

* [OCPBUGS-60885](https://issues.redhat.com/browse/OCPBUGS-60885): Add option abortonclose to HAProxy configuration template [#688](https://github.com/openshift/router/pull/688)
* [Full changelog](https://github.com/openshift/router/compare/526b4d0ad4cd9d44b43e2585b3415e513fbaf3da...61979f48e686cdccdf61a2825d0c558a5a391df1)


### [hyperkube, installer-kube-apiserver-artifacts, kube-proxy, pod](https://github.com/openshift/kubernetes/tree/737c81eb7539786ccefc91ab54080c674c3ad78c)

* [OCPBUGS-65755](https://issues.redhat.com/browse/OCPBUGS-65755): Update CSI manifests [#2522](https://github.com/openshift/kubernetes/pull/2522)
* [STOR-2534](https://issues.redhat.com/browse/STOR-2534): UPSTREAM: 135069: Update group snapshot tests to v1beta2 [#2508](https://github.com/openshift/kubernetes/pull/2508)
* [Full changelog](https://github.com/openshift/kubernetes/compare/891f5bb0306166d5625b89fc8dc86bbc8c85f549...737c81eb7539786ccefc91ab54080c674c3ad78c)


### [hypershift](https://github.com/openshift/hypershift/tree/9f8fa75e226f97fa82969d35cdcba7f023f139a0)

* [CNTRLPLANE-1692](https://issues.redhat.com/browse/CNTRLPLANE-1692): feat: add disaster recovery restore command [#7252](https://github.com/openshift/hypershift/pull/7252)
* [GCP-238](https://issues.redhat.com/browse/GCP-238): add GCP Platform support to private-router NetworkPolicy [#7254](https://github.com/openshift/hypershift/pull/7254)
* [OCPBUGS-63353](https://issues.redhat.com/browse/OCPBUGS-63353): Fix ValidAWSIdentityProvider status when KAS is unavailable [#7151](https://github.com/openshift/hypershift/pull/7151)
* [OCPBUGS-65818](https://issues.redhat.com/browse/OCPBUGS-65818): fix(cli): align version validation with controller logic [#7266](https://github.com/openshift/hypershift/pull/7266)
* [OCPBUGS-65702](https://issues.redhat.com/browse/OCPBUGS-65702): test: Fix control plane components rollout failure when NetworkType is not OVNKubernetes [#7243](https://github.com/openshift/hypershift/pull/7243)
* [OCPBUGS-65701](https://issues.redhat.com/browse/OCPBUGS-65701): test: fix ovnKubernetesConfig forbidden when networkType is not OVNKubernetes [#7244](https://github.com/openshift/hypershift/pull/7244)
* [CNTRLPLANE-1015](https://issues.redhat.com/browse/CNTRLPLANE-1015): Add support for control plane autoscaling in request serving architecture [#6102](https://github.com/openshift/hypershift/pull/6102)
* [CNTRLPLANE-377](https://issues.redhat.com/browse/CNTRLPLANE-377): Add NodePool minor version compatibility check to HO [#5931](https://github.com/openshift/hypershift/pull/5931)
* [GCP-230](https://issues.redhat.com/browse/GCP-230): Add gcp-reviewers to OWNERS files [#7217](https://github.com/openshift/hypershift/pull/7217)
* NO-JIRA: Add claude cluster debugging skill [#7249](https://github.com/openshift/hypershift/pull/7249)
* [GCP-179](https://issues.redhat.com/browse/GCP-179): feat(gcp): add service account creation and IAM bindings to IAM infra [#7231](https://github.com/openshift/hypershift/pull/7231)
* [AROSLSRE-218](https://issues.redhat.com/browse/AROSLSRE-218): allow hypershift install cmd to accept env vars to be passed to the hypershift operator deployment [#7223](https://github.com/openshift/hypershift/pull/7223)
* [GCP-205](https://issues.redhat.com/browse/GCP-205): feat(gcp): ensure restricted PodSecurity compliance for control plane components [#7219](https://github.com/openshift/hypershift/pull/7219)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/hypershift/compare/e83d907270ba8545b371edfa7b69989da2903214...9f8fa75e226f97fa82969d35cdcba7f023f139a0)


### [ibm-vpc-block-csi-driver-operator](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/tree/00bc740728d9f8ec86fe04199884108c2a091b58)

* No-JIRA: Update owners [#158](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/pull/158)
* [CNTRLPLANE-1287](https://issues.redhat.com/browse/CNTRLPLANE-1287): enable readOnlyRootFilesystem [#155](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/pull/155)
* [Full changelog](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/compare/327e3b29a2b93c80008ca69c6f14ba29c46e1672...00bc740728d9f8ec86fe04199884108c2a091b58)


### [ibmcloud-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-ibmcloud/tree/7f6b8d6a00a60d3c46a6d26c66da9f2edfc4d639)

* NO-JIRA: openshift: rename manager binary [#132](https://github.com/openshift/cluster-api-provider-ibmcloud/pull/132)
* [Full changelog](https://github.com/openshift/cluster-api-provider-ibmcloud/compare/69ed5e056af689cb34fd099355c0c5534ede70be...7f6b8d6a00a60d3c46a6d26c66da9f2edfc4d639)


### [ibmcloud-machine-controllers](https://github.com/openshift/machine-api-provider-ibmcloud/tree/e72a84714e5fb8c3256def77f7d77ffdc4b9b82e)

* [OCPCLOUD-3090](https://issues.redhat.com/browse/OCPCLOUD-3090): Bump k8s dependencies to 1.34 [#72](https://github.com/openshift/machine-api-provider-ibmcloud/pull/72)
* [Full changelog](https://github.com/openshift/machine-api-provider-ibmcloud/compare/03d7a9679f70e4bc1c884ebb5d6577dd757b1553...e72a84714e5fb8c3256def77f7d77ffdc4b9b82e)


### [insights-operator](https://github.com/openshift/insights-operator/tree/7ad47e813adee777944c2cc4c1e40e8ee5924883)

* [CCXDEV-15544](https://issues.redhat.com/browse/CCXDEV-15544): nodefeature gathering [#1173](https://github.com/openshift/insights-operator/pull/1173)
* [Full changelog](https://github.com/openshift/insights-operator/compare/cb14df1950d420784099e08ba5450974be236dba...7ad47e813adee777944c2cc4c1e40e8ee5924883)


### [ironic](https://github.com/openshift/ironic-image/tree/11ab85575930fbd219c3dd9f4fa6c37355296ba4)

* [METAL-1569](https://issues.redhat.com/browse/METAL-1569): Use custom data directory to store the master iso images on ironic-conductor node [#722](https://github.com/openshift/ironic-image/pull/722)
* [METAL-1105](https://issues.redhat.com/browse/METAL-1105): support default bmc verify ca [#721](https://github.com/openshift/ironic-image/pull/721)
* NO-ISSUE: Update requirements.cachito with latest openshift forks commits [#717](https://github.com/openshift/ironic-image/pull/717)
* [Full changelog](https://github.com/openshift/ironic-image/compare/492e3f2c0f2e4afa4a04dc69a464f563464be758...11ab85575930fbd219c3dd9f4fa6c37355296ba4)


### [ironic-agent](https://github.com/openshift/ironic-agent-image/tree/a43921a10bfdaa2eeea0f43890630adfbbf00843)

* NO-ISSUE: Update requirements.cachito with latest ironic-python-agent [#209](https://github.com/openshift/ironic-agent-image/pull/209)
* [Full changelog](https://github.com/openshift/ironic-agent-image/compare/a30ba903caabfae104ecddad6e133095321c8441...a43921a10bfdaa2eeea0f43890630adfbbf00843)


### [kubevirt-cloud-controller-manager](https://github.com/openshift/cloud-provider-kubevirt/tree/daf5fba2d1a1514bcbe67edc0230a06136156094)

* Update OWNERS [#58](https://github.com/openshift/cloud-provider-kubevirt/pull/58)
* [Full changelog](https://github.com/openshift/cloud-provider-kubevirt/compare/c9d7405057a3399e45e3efd187c238dd4e8a0cc6...daf5fba2d1a1514bcbe67edc0230a06136156094)


### [machine-api-operator](https://github.com/openshift/machine-api-operator/tree/1d78f2ebcae5016f4db4f21f0465e05128a71399)

* [METAL-1655](https://issues.redhat.com/browse/METAL-1655): add port for Ironic Prometheus Exporter to NetworkPolicy [#1437](https://github.com/openshift/machine-api-operator/pull/1437)
* [SPLAT-2167](https://issues.redhat.com/browse/SPLAT-2167): Added logic to webhook for AWS dedicated host support [#1436](https://github.com/openshift/machine-api-operator/pull/1436)
* [Full changelog](https://github.com/openshift/machine-api-operator/compare/026e9dff6a1c85235641aafa560499a283be8994...1d78f2ebcae5016f4db4f21f0465e05128a71399)


### [machine-config-operator](https://github.com/openshift/machine-config-operator/tree/4a3b43b9ac4750af612c2cb748f0383ce7d47430)

* [OCPBUGS-62232](https://issues.redhat.com/browse/OCPBUGS-62232): Set -fin timeouts in HAProxy config [#5310](https://github.com/openshift/machine-config-operator/pull/5310)
* NO-JIRA: Update ShiftStack OWNERS [#5431](https://github.com/openshift/machine-config-operator/pull/5431)
* [MCO-1956](https://issues.redhat.com/browse/MCO-1956): Stream image utils [#5409](https://github.com/openshift/machine-config-operator/pull/5409)
* [MCO-1529](https://issues.redhat.com/browse/MCO-1529), [MCO-1530](https://issues.redhat.com/browse/MCO-1530): Implement install time support for Image Mode [#5318](https://github.com/openshift/machine-config-operator/pull/5318)
* [MCO-1976](https://issues.redhat.com/browse/MCO-1976): [Dev] Fix RHEL9-specific MCD Logic for RHEL10/CentOS10 Compatibility [#5415](https://github.com/openshift/machine-config-operator/pull/5415)
* [OCPBUGS-65544](https://issues.redhat.com/browse/OCPBUGS-65544): Add kube_rbac_proxy service [#5378](https://github.com/openshift/machine-config-operator/pull/5378)
* [MCO-1956](https://issues.redhat.com/browse/MCO-1956): Extract image utils from build package [#5400](https://github.com/openshift/machine-config-operator/pull/5400)
* [OCPNODE-3874](https://issues.redhat.com/browse/OCPNODE-3874): Remove the dead code of setting the operator status for cgroupv1 based clusters [#5399](https://github.com/openshift/machine-config-operator/pull/5399)
* [MCO-1714](https://issues.redhat.com/browse/MCO-1714): MCO-1715: MCO-1716: MCO-1717: MCO-1718: Add regression tests for the ImageModeStatusReporting FeatureGate [#5363](https://github.com/openshift/machine-config-operator/pull/5363)
* [OCPBUGS-56648](https://issues.redhat.com/browse/OCPBUGS-56648): fixes systemd unit creation for empty units [#5086](https://github.com/openshift/machine-config-operator/pull/5086)
* [OCPBUGS-65726](https://issues.redhat.com/browse/OCPBUGS-65726): Remove --mount directives [#5423](https://github.com/openshift/machine-config-operator/pull/5423)
* [MCO-1940](https://issues.redhat.com/browse/MCO-1940): Enhance MCS layered image serving safety during node scale-up by requiring node validation [#5382](https://github.com/openshift/machine-config-operator/pull/5382)
* [OCPBUGS-61114](https://issues.redhat.com/browse/OCPBUGS-61114): Fix ImageBuildDegraded Status updates [#5279](https://github.com/openshift/machine-config-operator/pull/5279)
* [Full changelog](https://github.com/openshift/machine-config-operator/compare/ca0c19decec85967d149661825b334d0fa5ad7a8...4a3b43b9ac4750af612c2cb748f0383ce7d47430)


### [monitoring-plugin](https://github.com/openshift/monitoring-plugin/tree/e37e1cd01d5d11b3c7852e725c312f85e85d99b6)

* [OU-356](https://issues.redhat.com/browse/OU-356): fix specific translations and items without translations [#651](https://github.com/openshift/monitoring-plugin/pull/651)
* [OU-949](https://issues.redhat.com/browse/OU-949): add namespace dropdown to dashboards page [#567](https://github.com/openshift/monitoring-plugin/pull/567)
* [OU-1076](https://issues.redhat.com/browse/OU-1076): unit testing instructions on AGENTS.md [#650](https://github.com/openshift/monitoring-plugin/pull/650)
* [OU-1076](https://issues.redhat.com/browse/OU-1076): monitoring-plugin E2E testing instructions to AGENTS.md [#649](https://github.com/openshift/monitoring-plugin/pull/649)
* [OU-356](https://issues.redhat.com/browse/OU-356): add translations from memsource [#646](https://github.com/openshift/monitoring-plugin/pull/646)
* [OBSINTA-777](https://issues.redhat.com/browse/OBSINTA-777): [Incidents] Regression tests for short incidents visualisation [#623](https://github.com/openshift/monitoring-plugin/pull/623)
* [OU-1083](https://issues.redhat.com/browse/OU-1083): /run-perses-dev [#645](https://github.com/openshift/monitoring-plugin/pull/645)
* [OU-991](https://issues.redhat.com/browse/OU-991): monitoring testings refactoring for reusability for admin and kubevirt [#603](https://github.com/openshift/monitoring-plugin/pull/603)
* NO-JIRA: add devspace setup [#642](https://github.com/openshift/monitoring-plugin/pull/642)
* [Full changelog](https://github.com/openshift/monitoring-plugin/compare/4e1f998d6466274b58371180936b1959c49b035f...e37e1cd01d5d11b3c7852e725c312f85e85d99b6)


### [multus-cni, multus-cni-microshift](https://github.com/openshift/multus-cni/tree/23ae18fb886e0a77c7177eb711cec7cfe2b55d9e)

* [CORENET-6354](https://issues.redhat.com/browse/CORENET-6354): Downstream merge for kube rebase 1.34.1 [#271](https://github.com/openshift/multus-cni/pull/271)
* [Full changelog](https://github.com/openshift/multus-cni/compare/cf0f68ec2b5fe9bc72d0da325e02cf63968747fe...23ae18fb886e0a77c7177eb711cec7cfe2b55d9e)


### [multus-whereabouts-ipam-cni](https://github.com/openshift/whereabouts-cni/tree/d691040e509bb20c26b5e8366c0d6f3bb45a5e02)

* [CORENET-6478](https://issues.redhat.com/browse/CORENET-6478): [DownstreamMerge] of Whereabouts repo from upstream [#391](https://github.com/openshift/whereabouts-cni/pull/391)
* [Full changelog](https://github.com/openshift/whereabouts-cni/compare/43c8959152a6ca8afdc73eaed624286628c2c22e...d691040e509bb20c26b5e8366c0d6f3bb45a5e02)


### [must-gather](https://github.com/openshift/must-gather/tree/b4b434c427ddde3dafd8518d1aa754e49b7bfef1)

* [OCPBUGS-64781](https://issues.redhat.com/browse/OCPBUGS-64781): Add olm v1 resources to default must-gather [#512](https://github.com/openshift/must-gather/pull/512)
* [STOR-2692](https://issues.redhat.com/browse/STOR-2692): Collect volume group snapshot objects [#510](https://github.com/openshift/must-gather/pull/510)
* [Full changelog](https://github.com/openshift/must-gather/compare/ba8e5fcbc4ce554f2871a1455cb32114a6fccc8a...b4b434c427ddde3dafd8518d1aa754e49b7bfef1)


### [networking-console-plugin](https://github.com/openshift/networking-console-plugin/tree/fb4d1cc9c04a4a69fa1cba5f5cbc57fd4e0e683e)

* [CNV-71965](https://issues.redhat.com/browse/CNV-71965): replacing the broken link to VirtualMachine network docs [#297](https://github.com/openshift/networking-console-plugin/pull/297)
* [Full changelog](https://github.com/openshift/networking-console-plugin/compare/f730a7e683819ee79a6bf46963864904278f9f08...fb4d1cc9c04a4a69fa1cba5f5cbc57fd4e0e683e)


### [oc-mirror](https://github.com/openshift/oc-mirror/tree/c5027f373697b22de26807818f407aa8df648677)

* [CLID-459](https://issues.redhat.com/browse/CLID-459): changes the flag remove-signatures default to false [#1290](https://github.com/openshift/oc-mirror/pull/1290)
* [OCPBUGS-63480](https://issues.redhat.com/browse/OCPBUGS-63480): Remove empty status field from generated IDMS/ITMS files [#1311](https://github.com/openshift/oc-mirror/pull/1311)
* [Full changelog](https://github.com/openshift/oc-mirror/compare/efa9f7a87f75fedf0c0b2adf99e361e0cb17d7e2...c5027f373697b22de26807818f407aa8df648677)


### [olm-catalogd, olm-operator-controller](https://github.com/openshift/operator-framework-operator-controller/tree/c310c423d3b35346f17a862407bc6b91d422f088)

* NO-ISSUE: Synchronize From Upstream Repositories [#561](https://github.com/openshift/operator-framework-operator-controller/pull/561)
* [OCPQE-30673](https://issues.redhat.com/browse/OCPQE-30673): migrate some clustercatalog cases to ote [#525](https://github.com/openshift/operator-framework-operator-controller/pull/525)
* [OCPQE-30672](https://issues.redhat.com/browse/OCPQE-30672): migrate jiazha test cases to OTE [#558](https://github.com/openshift/operator-framework-operator-controller/pull/558)
* [Full changelog](https://github.com/openshift/operator-framework-operator-controller/compare/009fb1922be173b2058253299f645c3f8e03d401...c310c423d3b35346f17a862407bc6b91d422f088)


### [openshift-apiserver](https://github.com/openshift/openshift-apiserver/tree/935bc0e58277b9bfeae96d3221f9658c1ff745d5)

* [OCPBUGS-61056](https://issues.redhat.com/browse/OCPBUGS-61056): Add ValidatingAdmissionPolicy and check for omissions next time. [#546](https://github.com/openshift/openshift-apiserver/pull/546)
* [Full changelog](https://github.com/openshift/openshift-apiserver/compare/6bca7ff2a5adb91ddc8db30b0f5c1c983027b7df...935bc0e58277b9bfeae96d3221f9658c1ff745d5)


### [operator-framework-tools, operator-lifecycle-manager, operator-registry](https://github.com/openshift/operator-framework-olm/tree/c2753896aecfd5b17c7cf5430b9a27abcbeab485)

* [OCPQE-30680](https://issues.redhat.com/browse/OCPQE-30680): Fix OPM test cases failure: Ensure container policy.json exists [#1144](https://github.com/openshift/operator-framework-olm/pull/1144)
* NO-ISSUE: Synchronize From Upstream Repositories [#1154](https://github.com/openshift/operator-framework-olm/pull/1154)
* [OCPQE-31108](https://issues.redhat.com/browse/OCPQE-31108): add disconnected support with custom prow job for migrated qe cases [#1155](https://github.com/openshift/operator-framework-olm/pull/1155)
* [Full changelog](https://github.com/openshift/operator-framework-olm/compare/d9496b7fafa32956655b40592761887bea8e9220...c2753896aecfd5b17c7cf5430b9a27abcbeab485)


### [operator-marketplace](https://github.com/operator-framework/operator-marketplace/tree/a754fc9aea31bd75c4fdf086dda49403a9c7f540)

* [OCPBUGS-59763](https://issues.redhat.com/browse/OCPBUGS-59763): enforce client side auth requirement for metrics endpoint [#684](https://github.com/operator-framework/operator-marketplace/pull/684)
* [Full changelog](https://github.com/operator-framework/operator-marketplace/compare/bc8be0c487ae70b5b268e3251a599265499101fa...a754fc9aea31bd75c4fdf086dda49403a9c7f540)


### [ovn-kubernetes, ovn-kubernetes-microshift](https://github.com/openshift/ovn-kubernetes/tree/6fab57dcf4bdabe77a1da826f32252767049bfb0)

* [OCPBUGS-57053](https://issues.redhat.com/browse/OCPBUGS-57053), [OCPBUGS-61285](https://issues.redhat.com/browse/OCPBUGS-61285): DownStream Merge [11-13-2025] [#2859](https://github.com/openshift/ovn-kubernetes/pull/2859)
* [Full changelog](https://github.com/openshift/ovn-kubernetes/compare/9a9b8929d7040ab7d8cf574c48c96d58991bf6f6...6fab57dcf4bdabe77a1da826f32252767049bfb0)


### [service-ca-operator](https://github.com/openshift/service-ca-operator/tree/f5a143a6e0d2110f8c0fc8b50dc8fa62ec26b291)

* [CNTRLPLANE-1544](https://issues.redhat.com/browse/CNTRLPLANE-1544), [OCPBUGS-65713](https://issues.redhat.com/browse/OCPBUGS-65713): Revert "controller deployment: Use user namespace" [#291](https://github.com/openshift/service-ca-operator/pull/291)
* [CNTRLPLANE-1260](https://issues.redhat.com/browse/CNTRLPLANE-1260): Simplify test infrastructure to single-module architecture [#290](https://github.com/openshift/service-ca-operator/pull/290)
* [Full changelog](https://github.com/openshift/service-ca-operator/compare/c5e7cf4a92ca76778c20defc14a823e097d0f15d...f5a143a6e0d2110f8c0fc8b50dc8fa62ec26b291)


### [tests](https://github.com/openshift/origin/tree/5b8861dd8a750b1de694acf71e549910f5d203e8)

* [OCPBUGS-63307](https://issues.redhat.com/browse/OCPBUGS-63307): Add ConfigDriftMonitorStoppedTooOften matcher [#30474](https://github.com/openshift/origin/pull/30474)
* [MCO-1870](https://issues.redhat.com/browse/MCO-1870): Skip MCN condition transition test in clusters with `ImageModeStatusReporting` FeatureGate is enabled [#30505](https://github.com/openshift/origin/pull/30505)
* [TRT-2429](https://issues.redhat.com/browse/TRT-2429): Revert "SPLAT-2337: Added OTE binary for ccm-aws" [#30513](https://github.com/openshift/origin/pull/30513)
* [OCPEDGE-2082](https://issues.redhat.com/browse/OCPEDGE-2082): Added TNF control-plane node replacement test. [#30494](https://github.com/openshift/origin/pull/30494)
* [MCO-1930](https://issues.redhat.com/browse/MCO-1930): Skip legacy-cvo-invariants for disruptive [#30499](https://github.com/openshift/origin/pull/30499)
* [OCPNODE-3877](https://issues.redhat.com/browse/OCPNODE-3877): Update grace period for cluster upgrade to 10 minutes [#30506](https://github.com/openshift/origin/pull/30506)
* [OCPBUGS-57523](https://issues.redhat.com/browse/OCPBUGS-57523): Handle Multus UID mismatch during rapid pod recreation [#30486](https://github.com/openshift/origin/pull/30486)
* NO-JIRA: Add docs about junits of a monitortest [#30428](https://github.com/openshift/origin/pull/30428)
* [OCPBUGS-65779](https://issues.redhat.com/browse/OCPBUGS-65779): Remove Php 8.0-ubi8, add Php 8.2-ubi8 to Origin [#30501](https://github.com/openshift/origin/pull/30501)
* [SPLAT-2337](https://issues.redhat.com/browse/SPLAT-2337): Added OTE binary for ccm-aws [#30235](https://github.com/openshift/origin/pull/30235)
* [CNTRLPLANE-180](https://issues.redhat.com/browse/CNTRLPLANE-180): rm renamed PSA condition [#30159](https://github.com/openshift/origin/pull/30159)
* [TRT-2275](https://issues.redhat.com/browse/TRT-2275): minor update for e2e_analysis test [#30492](https://github.com/openshift/origin/pull/30492)
* NO-ISSUE: Automated - Update synthetic test data [#30491](https://github.com/openshift/origin/pull/30491)
* [OTA-1643](https://issues.redhat.com/browse/OTA-1643): Add more exceptions for COs not reporting Progressing [#30489](https://github.com/openshift/origin/pull/30489)
* [OTA-1626](https://issues.redhat.com/browse/OTA-1626): Handle unknown operators [#30402](https://github.com/openshift/origin/pull/30402)
* [TRT-2292](https://issues.redhat.com/browse/TRT-2292): Update openshift-tests-extension [#30490](https://github.com/openshift/origin/pull/30490)
* [TRT-2350](https://issues.redhat.com/browse/TRT-2350): Include additional OTE metadata in JUnit results [#30431](https://github.com/openshift/origin/pull/30431)
* [Full changelog](https://github.com/openshift/origin/compare/111e2032a329ad0ebce4a98ad1520439c2d44088...5b8861dd8a750b1de694acf71e549910f5d203e8)


### [volume-data-source-validator](https://github.com/openshift/volume-data-source-validator/tree/8b9293323cf8fdce93824e37168573ca3f73de3a)

* [STOR-2604](https://issues.redhat.com/browse/STOR-2604): Rebase to upstream v1.5.0 for OCP 4.21 [#6](https://github.com/openshift/volume-data-source-validator/pull/6)
* [Full changelog](https://github.com/openshift/volume-data-source-validator/compare/241816559ead1a8b5d455827400888babb6ce352...8b9293323cf8fdce93824e37168573ca3f73de3a)


### [vsphere-csi-driver, vsphere-csi-driver-syncer](https://github.com/openshift/vmware-vsphere-csi-driver/tree/5e680186a305e1e0a11950630f7addcb1aa19e0e)

* [STOR-2593](https://issues.redhat.com/browse/STOR-2593): Rebase to upstream v3.6.0 for OCP 4.21 [#151](https://github.com/openshift/vmware-vsphere-csi-driver/pull/151)
* [Full changelog](https://github.com/openshift/vmware-vsphere-csi-driver/compare/133442c239c6ebfeec175f1620b5b08d887cbe90...5e680186a305e1e0a11950630f7addcb1aa19e0e)


### [vsphere-csi-driver-operator](https://github.com/openshift/vmware-vsphere-csi-driver-operator/tree/57c19630194a26e9e2338b0ba8a32e8922e74259)

* [STOR-2634](https://issues.redhat.com/browse/STOR-2634): Add code for degrading the cluster if node is not vsphere [#317](https://github.com/openshift/vmware-vsphere-csi-driver-operator/pull/317)
* No-JIRA: Update owners [#318](https://github.com/openshift/vmware-vsphere-csi-driver-operator/pull/318)
* [CNTRLPLANE-1286](https://issues.redhat.com/browse/CNTRLPLANE-1286): Enable readonlyRootFilesystem [#309](https://github.com/openshift/vmware-vsphere-csi-driver-operator/pull/309)
* [Full changelog](https://github.com/openshift/vmware-vsphere-csi-driver-operator/compare/c098581641c4a26d82e46fd2bc1a3fbc46cc0380...57c19630194a26e9e2338b0ba8a32e8922e74259)


### [vsphere-problem-detector](https://github.com/openshift/vsphere-problem-detector/tree/5ddf3f06b3c50c4500195d315cbea1688e45ba22)

* [OCPBUGS-63598](https://issues.redhat.com/browse/OCPBUGS-63598): Fixed logic for vSphere compute cluster permission [#196](https://github.com/openshift/vsphere-problem-detector/pull/196)
* [Full changelog](https://github.com/openshift/vsphere-problem-detector/compare/352125ea654157e73fe5bbab7965a81b70e2d90d...5ddf3f06b3c50c4500195d315cbea1688e45ba22)