Back to index

Download installer and client with:

oc adm release extract --tools quay.io/okd/scos-release:4.21.0-okd-scos.ec.10

Team Approvals:

Tests:

• Blocking jobs
  • upgrade Failed (2 retries) release-openshift-okd-scos-installer-e2e-aws-upgrade-from-scos-next
  • upgrade-minor Succeeded release-openshift-okd-scos-installer-e2e-aws-upgrade-from-scos-next

Upgrades from:

• 4.21.0-okd-scos.ec.9 - F F F
• 4.20.0-okd-scos.11 (changes) - Success

---

Loading changelog, this may take a while ...

Changes from 4.21.0-okd-scos.ec.9

Created: 2025-12-01 12:09:01 +0000 UTC

Image Digest: sha256:e63aa0e04bb4e8ba4a53cbfb91510838d1a57adf072373c5163634242a3abb55

Release 4.21.0-okd-scos.ec.10 was created from registry.ci.openshift.org/origin/release-scos:4.21.0-0.okd-scos-2025-11-30-090822

Components

• Kubectl 1.34.1
• Kubernetes upgraded from 1.34.1 to 1.34.2
• Kubernetes Tests 1.34.1
• CentOS Stream CoreOS 10.0.20251113-0

  The CoreOS links above are for the base CoreOS layer used to build the OpenShift node image and do not contain OpenShift components. This is normally only useful to devs working closely with the CoreOS team. For info about the node image, see the Node Image Info section.

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
ImageStreamImportMode (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled	Enabled
NewOLMBoxCutterRuntime (0 tests)	Disabled	Disabled	Disabled	Disabled (Changed)	Disabled	Disabled (Changed)

Rebuilt images without code change

• driver-toolkit git 5c53d757 sha256:d8a0b939f6ec6c9570e153d7af669e987529d0ac699507a71f5c51945de7ca15

agent-installer-api-server

• MGMT-22280: remove loki dependency from logging op #8458
• NO-ISSUE: [master] Bump OCP versions: 4.18 #8456
• NO-ISSUE: [master] Bump OCP versions: 4.20 #8454
• MGMT-22280: new logging operators (loki, logging) #8445
• NO-ISSUE: Update go.mod Hive dependency to 715614a9f379395dbb5b5091276ec59cacfd0599 #8450
• NO-ISSUE: [master] Bump OCP versions: 4.14, 4.19 #8442
• MGMT-22193: Fix dual-stack BMH NIC creation to support multiple NICs per interface #8426
• MGMT-22292: Add url label #8425
• And 1 elided commits (e.g. from squash or rebase merges)
• Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

• AGENT-1216: copy registry data to disk in ABI/Appliance flow #1359
• MGMT-22292: Add url label #1375
• Full changelog

agent-installer-node-agent

• MGMT-22292: Add url label #1208
• Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator

• NO-JIRA: Migrate away from deprecated ioutil #474
• CNTRLPLANE-1285: enable readOnlyRootFilesystem #419
• Full changelog

aws-machine-controllers

• CORS-4277: Ensure Throughput setting is honoured on gp3 volumes #155
• Full changelog

azure-file-csi-driver

• OCPBUGS-65555: UPSTREAM: 2860: fix: CreateVolume to return actual provisioned capacity after rounding #110
• Full changelog

baremetal-installer, installer, installer-artifacts

• OSASINFRA-3965: Update cluster-api-provider-openstack to v0.13.0 #10090
• TRT-2440: Revert #9945 “CORS-4212: AWS: Add the ability to configure throughput on GP3 volumes” #10131
• OCPBUGS-65938: increase IAM waiter timeout and remove custom delay options #10124
• Full changelog

baremetal-runtimecfg

• OCPBUGS-59477: Add deterministic sorting for addresses with identical priority #372
• OCPBUGS-63709: dynkeepalived: Watch debug logging ConfigMap #371
• Full changelog

cli, cli-artifacts, deployer, tools

• OCPBUGS-63189: Unify ErrAlreadyExists to correctly match #2155
• OCPBUGS-59774: Update documentation of oc adm must-gather timeout flag #2154
• Full changelog

cloud-credential-operator

• OCPBUGS-63714: ccoctl azure: retry custom role creation on consistency errors #944
• Full changelog

cluster-authentication-operator

• API-1835: test/oauth-server-configobserver: adds a test to show which input resources are required to run the operator and the configObserver controller #785
• NO-JIRA: om: add a test for the oauth-apiserver controller #811
• Full changelog

cluster-baremetal-operator

• METAL-1104: support specifying CA to verify BMC connections #527
• METAL-1351: Add readOnlyRootFilesystem flag to baremetal containers deployed using CBO #497
• METAL-1664: Remove regular cluster profile from hostedcluster CBO deployment #529
• Full changelog

cluster-capi-operator

• NO-JIRA: Update OWNERS, adding stephenfin #414
• Full changelog

cluster-config-api

• OCPBUGS-65819: fix ClusterMonitoring CRD plural name #2588
• CORS-4281: Remove the GCP Service Endpoints #2576
• MULTIARCH-5190: Promote ImageStreamImportMode to default #2266
• (OLMv1) Update EP link for SingleOwnNamespace feature #2572
• OPRUN-4281: Disable OLMv1 Boxcutter FeatureGate #2602
• AGENT-1330: machineconfiguration/v1alpha1: add InternalReleaseImage #2510
• Full changelog

cluster-config-operator

• NO-Jira:Update owners for November 2025 #453
• Full changelog

cluster-etcd-operator

• CNTRLPLANE-1315: Refactor OTE to single-module architecture #1510
• NO-JIRA: upkeep: add fonta and myself to owners file #1515
• OCPBUGS-65927: fix: tnf setup fails when ipv6 is present #1514
• Full changelog

cluster-kube-apiserver-operator

• CNTRLPLANE-1721: Ote infrastructure only #1977
• Full changelog

cluster-kube-controller-manager-operator

• CNTRLPLANE-1275: Refactor OTE to single-module architecture #891
• OCPBUGS-65502: manifests: Expand related objects in clusteroperator #894
• no-jira: Migrate away from deprecated ioutil #896
• Full changelog

cluster-kube-scheduler-operator

• OCPBUGS-65503: manifests: Expand related objects in clusteroperator #588
• CNTRLPLANE-1309: set up openshift-tests-extension for cluster-kube-scheduler-operator and add a sanity test #585
• Full changelog

cluster-monitoring-operator

• MON-3940: Add the collection of MTV migration metrics to Telemetry #2743
• MON-4424: update ghcr.io/rhobs/prometheus-example-app to 0.5.0 #2749
• MON-4444: thanos-ruler: set default retention from UWM Prometheus if present #2759
• OCPBUGS-61088: revert PR #2738, enhance test for config_test.go and let CVO manage CMO networkpolicies #2740
• MON-4435: EndpointSlice migration in UWM Prometheus Operator #2756
• NO-ISSUE: update prometheus operator dependencies to v0.87.0 #2752
• MON-4434: Migrate core monitoring ServiceMonitors to EndpointSlice #2745
• NO-ISSUE: Bump openshift/library-go #2751
• Full changelog

cluster-network-operator

• OCPBUGS-35387: rbac: Add network resources to cluster-reader role #2826
• CORENET-6348: rebase k8s to 1.34.1 #2832
• Full changelog

cluster-node-tuning-operator

• OCPBUGS-64676: components: validate defaultHugePagesSize #1424
• PSAP-2021: Vendor in latest dependencies and k8s 1.34.2 #1435
• Full changelog

cluster-openshift-controller-manager-operator

• CNTRLPLANE-1676: Rebase k8s 1.34 #402
• Full changelog

cluster-samples-operator

• Revert “CNTRLPLANE-1544: manifests: Use restricted-v3 scc for the operator” #670
• Full changelog

cluster-version-operator

• NO-JIRA: Remove $(BIN_DIR) in Makefile #1265
• OCPBUGS-57646: Unify capitalization when comparing architectures for available updates #1255
• Full changelog

console

• CONSOLE-4867: Move Helm nav option under Ecosystem nav section #15773
• CONSOLE-4709: Remove kebab factory uses from resourceQuota and pod-list pages #15772
• OCPBUGS-65690: Visiting Group Detail Page > RoleBindings will show error #15739
• CONSOLE-4877: console assist command #15731
• OCPBUGS-65883: Add missing sample for a ConsoleLink with mailto #15754
• CONSOLE-3769: More openshift/dynamic-plugin-sdk prep work #15738
• OCPBUGS-64943: Make GetUserFromRequestContext more nil safe #15711
• OCPBUGS-65948: Add SDK-webpack 4.20 changelogs #15767
• NO-JIRA: Add SDK 4.20 changelogs #15766
• CONSOLE-4709: Remove kebab factory uses from devconsole and Topology plugin #15720
• OCPBUGS-65776: Fix unnecessary rerenders with pod-connect #15745
• And 1 elided commits (e.g. from squash or rebase merges)
• Full changelog

console-operator

• CNTRLPLANE-947: Make oauthclients relatedObject dynamic depending on auth type #1048
• Full changelog

container-networking-plugins, containernetworking-plugins-microshift

• CORENET-6533: containernetworking-plugins Upstream sync #217
• Full changelog

coredns

• NE-2194: Rebase to v1.13.1 report & rebase work #157
• Full changelog

csi-driver-nfs

• Merge https://github.com/kubernetes-csi/csi-driver-nfs:master into main #158
• NO-JIRA: Revert “<CARRY> Use go 1.23 to align with openshift” #166
• Full changelog

gcp-machine-controllers

• CORS-4228: GCP revert custom endpoints #134
• Full changelog

gcp-pd-csi-driver-operator

• No-JIRA: Update owners #156
• Full changelog

haproxy-router

• NE-2249: Bump openshift/api to 4.21, and k8s.io to v0.34.1 #692
• Full changelog

hyperkube, installer-kube-apiserver-artifacts, kube-proxy, pod

• OCPBUGS-61376: move disabled HPA tests from Broken to DedicatedJob #2492
• OCPBUGS-65548: Bump to k8s 1.34.2 #2514
• Full changelog

hypershift

• CNTRLPLANE-1956: add logic to check control-plane to data-plane connectivity #7260
• NO-JIRA: build(deps): bump golang.org/x/crypto from 0.37.0/0.41.0 to 0.45.0 #7292
• NO-JIRA: fix(build): replace sysctl with getconf in Makefile #7282
• CNTRLPLANE-1387: Remove redundant RHCOSImage flag from Azure CLI #7261
• CNTRLPLANE-2050: feat(azure): update default VM size to Standard_D4s_v5 #7293
• CNTRLPLANE-1551: feat(nodepool): add HAProxy image override via annotation #7187
• CNTRLPLANE-1015: docs: add resource-based control plane autoscaling guide #7275
• GCP-196: Implement GCPPrivateServiceObserver controller #7207
• CNTRLPLANE-1893: Create an ARO HCP override test #7206
• CNTRLPLANE-1934: Add devguyio to core-approvers #7238
• NO-JIRA: test(e2e): extend timeouts for Azure and KubeVirt platforms #7288
• GCP-232: refactor(rbac): apply extension-apiserver-authentication rolebinding unconditionally #7259
• GCP-251: feat(install): Add GCP provider support for external-dns with Workload Identity #7274
• CNTRLPLANE-1661: Add endpointPublishingStrategy conf for ingress controller #6974
• Full changelog

insights-operator

• OCPBUGS-64936: update DataGather status after job failure #1178
• NO-JIRA: add AGENTS.md #1180
• CCXDEV-15601: Refactor wasDataProcessed function #1169
• NO-JIRA: update go version to 1.24.0 #1176
• Full changelog

insights-runtime-exporter, insights-runtime-extractor

• Ocp421 new tests #55
• Add runtime sample for JBoss EAP 8.1 #56
• Full changelog

ironic

• METAL-1659: Multi arch efi #723
• METAL-1104: Guard against empty BMC CA volume #726
• NO-ISSUE: Update requirements.cachito with latest openshift forks commits #719
• OKD-304: Fix python dependencies for OKD #718
• OKD-306: Adding the missing httpd-ironic-proxy.conf.j2 in OKD #729
• METAL-1598: Update ipe to latest #725
• Full changelog

ironic-agent

• NO-ISSUE: Update requirements.cachito with latest ironic-python-agent #213
• Full changelog

machine-api-operator

• OCPCLOUD-3268: Update cluster-api to v1.11.3 #1438
• CORS-4280: AWS: Add throughput validation for gp3 volumes #1430
• Full changelog

machine-config-operator

• MCO-1930, MCO-1967: migrate ControlPlaneMachineset tests #5391
• OCPNODE-3719: Default Enablement of Auto Sizing Reserved in OpenShift 4.21 #5390
• MCO-1956: Osimagestream fetching #5442
• OKD-294: Migrate runtime from runc to crun on an upgrade for OKD #5389
• OPNET-678: Allow disabling internal DNS records #5427
• Full changelog

machine-os-images

• OCPBUGS-65971: Use the writable mount /shared/html/images to store coreos iso images #72
• Full changelog

monitoring-plugin

• OBSINTA-857: implement grep tags for selective test execution #601
• OBSINTA-777: [Incidents] Regression tests for firing alerts in Incidents #622
• OU-1093: fix: add missing translation for incidents filters #653
• OBSINTA-858: configurable Cypress COO namespace and idempotent cleanup #633
• OCPBUGS-63458: add missing conversion units #648
• Full changelog

multus-cni, multus-cni-microshift

• OCPBUGS-66109: Updating multus-cni-container image to be consistent with ART for 4.21 #272
• Full changelog

multus-networkpolicy

• CORENET-6496: [multus-networkpolicy]Downstream merge kube rebase 1.34.1 #79
• Full changelog

network-metrics-daemon

• CORENET-6357: Bump network-metrics-daemon to kube 1.34 #139
• Full changelog

network-tools

• NO-JIRA:Add three new members #169
• Full changelog

olm-catalogd, olm-operator-controller

• OCPQE-30673: migrate olmv1 QE cases #569
• NO-ISSUE: Synchronize From Upstream Repositories #566
• OPRUN-4300: Use busybox/httpd to simulate probes #567
• NO-ISSUE: Synchronize From Upstream Repositories #565
• OCPQE-31152: migrate olmv1 QE stress cases #563
• Full changelog

openshift-apiserver

• CNTRLPLANE-1258: Migrate to single-module OTE test infrastructure #579
• Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

• OCPQE-30677: Migrate test cases 21080, 21953, 43135 from private repo #1161
• OPRUN-4250: Upgrade indirects and remove pinned because of incompatibility with k8s.io/apiserver #1149
• OCPQE-31151: Migrate OLM v0 stress test cases #1158
• OCPQE-30677: migrate jiazha’s OLMv0 test cases to OTE #1153
• Full changelog

prometheus

• MON-4446: update Prometheus to v3.7.3 #282
• OCPBUGS-65902: Revert “chore(scrape): default to legacy validation/escaping scheme until utf-8 is fully supported” #281
• Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

• NO-ISSUE: [bot] Bump openshift/prometheus-operator to v0.87.0 #348
• Full changelog

service-ca-operator

• CNTRLPLANE-1544, OCPBUGS-65713: Revert “manifests: Use user namespace for the deployment” #293
• Full changelog

telemeter

• NO-ISSUE: Migrate away from deprecated ioutil #570
• Full changelog

tests

• NO-JIRA: Simplify exceptionCallback’s signature #30531
• NO-JIRA: Add a new exception for CO’s Available=False in non-upgrade tests #30541
• NO-JIRA: Add exception for co/baremetal on Progressing #30542
• NO-JIRA: Fix highcpu intervals picking up the wrong e2etest intervals #30503
• OCPBUGS-62264: vSphere snapshot options test should wait for operator to settle #30336
• NO-JIRA: net(virt) remove virtctl if not correctly retrieved #30485
• TRT-2439: Revert “TLS 1.3 / Modern profile tests” #30533
• NO-JIRA: Add exception for co/kube-scheduler on Progressing #30521
• NO-JIRA: Use a more general exception for co/olm becoming unavailable #30514
• CORENET-6491: Delete test namesapces for UDN testing #30500
• OCPCLOUD-3042: Added OTE binary for cpmso #30452
• OTA-1585: Register the CVO tests extension #30316
• NO-JIRA: Add exception for co/authentication on scaling test #30517
• NO-JIRA: Add more exceptions for CO degraded #30515
• OCPNODE-3009: nested-podman test: use nested-containers SCC #30061
• OTA-1643: Skip a couple of ClusterOperator tests in a multi-upgrade test #30516
• And 1 elided commits (e.g. from squash or rebase merges)
• Full changelog

---

Node Image Info

Loading node image info, this may take a while ...

Unable to show node image info: node image info is still loading, check back later

View changelog in Markdown or change previous release: 4.21.0-okd-scos.ec.94.21.0-okd-scos.ec.84.21.0-okd-scos.ec.74.21.0-okd-scos.ec.64.21.0-okd-scos.ec.54.21.0-okd-scos.ec.44.21.0-okd-scos.ec.34.21.0-okd-scos.ec.24.21.0-okd-scos.ec.14.21.0-okd-scos.ec.0───4.22.0-0.okd-scos-nightly-2026-02-17-1711374.22.0-0.okd-scos-nightly-2026-02-12-0106474.22.0-0.okd-scos-nightly-2026-02-11-1306474.22.0-0.okd-scos-nightly-2026-02-10-1241374.22.0-0.okd-scos-nightly-2026-02-10-0041374.22.0-0.okd-scos-nightly-2026-02-09-1241374.22.0-0.okd-scos-nightly-2026-02-09-0041374.22.0-0.okd-scos-nightly-2026-02-08-124137───4.22.0-0.okd-scos-2026-02-17-1345214.22.0-0.okd-scos-2026-02-17-0145214.22.0-0.okd-scos-2026-02-16-1345214.22.0-0.okd-scos-2026-02-15-1131114.22.0-0.okd-scos-2026-02-14-212651───4.21.0-0.okd-scos-nightly-2026-02-17-1711374.21.0-0.okd-scos-nightly-2026-02-11-2258444.21.0-0.okd-scos-nightly-2026-02-11-1058444.21.0-0.okd-scos-nightly-2026-02-10-2258444.21.0-0.okd-scos-nightly-2026-02-10-1058444.21.0-0.okd-scos-nightly-2026-02-09-225844───4.21.0-0.okd-scos-2026-02-17-0732504.21.0-0.okd-scos-2026-02-16-1932504.21.0-0.okd-scos-2026-02-16-0732504.21.0-0.okd-scos-2026-02-13-2237274.21.0-0.okd-scos-2026-02-13-103727───4.20.0-0.okd-scos-2026-02-10-1309514.20.0-0.okd-scos-2026-02-07-0016394.20.0-0.okd-scos-2026-02-06-1216394.20.0-0.okd-scos-2026-02-06-0016394.20.0-0.okd-scos-2026-02-05-1216384.20.0-0.okd-scos-2026-02-05-0016374.20.0-0.okd-scos-2026-02-04-121636───4.19.0-0.okd-scos-2025-10-25-0018304.19.0-0.okd-scos-2025-10-24-1218294.19.0-0.okd-scos-2025-10-24-0018284.19.0-0.okd-scos-2025-10-23-1218284.19.0-0.okd-scos-2025-10-23-001828───4.18.0-0.okd-scos-2025-05-27-0825374.18.0-0.okd-scos-2025-05-26-2025374.18.0-0.okd-scos-2025-05-26-0825374.18.0-0.okd-scos-2025-05-23-0333574.18.0-0.okd-scos-2025-05-22-153357───4.17.0-0.okd-scos-2025-02-25-0904554.17.0-0.okd-scos-2025-02-24-2104554.17.0-0.okd-scos-2025-02-24-0904544.17.0-0.okd-scos-2025-02-23-2104544.17.0-0.okd-scos-2025-02-22-211215───4.16.0-0.okd-scos-2025-01-06-1432414.16.0-0.okd-scos-2025-01-04-1456004.16.0-0.okd-scos-2025-01-04-0142364.16.0-0.okd-scos-2025-01-03-1342364.16.0-0.okd-scos-2025-01-03-0142364.16.0-0.okd-scos-2024-12-17-0222464.16.0-0.okd-scos-2024-11-24-1100454.16.0-0.okd-scos-2024-11-23-1818454.16.0-0.okd-scos-2024-11-23-0618454.16.0-0.okd-scos-2024-11-22-1818454.16.0-0.okd-scos-2024-11-22-061845───4.15.0-0.okd-scos-2024-12-16-1913164.15.0-0.okd-scos-2024-01-18-1035224.15.0-0.okd-scos-2024-01-17-2235214.15.0-0.okd-scos-2024-01-17-1035204.15.0-0.okd-scos-2024-01-16-223519───4.15.0-0.okd-2025-06-27-1341344.15.0-0.okd-2025-06-17-1652194.15.0-0.okd-2025-05-02-1402244.15.0-0.okd-2025-04-03-2126204.15.0-0.okd-2025-04-02-1800124.15.0-0.okd-2024-03-27-1109014.15.0-0.okd-2024-03-26-2309014.15.0-0.okd-2024-03-23-1640104.15.0-0.okd-2024-03-23-0440104.15.0-0.okd-2024-03-22-164010───4.21.0-okd-scos.64.21.0-okd-scos.54.21.0-okd-scos.44.21.0-okd-scos.34.21.0-okd-scos.24.21.0-okd-scos.14.21.0-okd-scos.04.20.0-okd-scos.174.20.0-okd-scos.164.20.0-okd-scos.154.20.0-okd-scos.144.20.0-okd-scos.134.20.0-okd-scos.124.20.0-okd-scos.114.20.0-okd-scos.104.20.0-okd-scos.94.20.0-okd-scos.84.20.0-okd-scos.74.20.0-okd-scos.64.20.0-okd-scos.54.20.0-okd-scos.44.20.0-okd-scos.34.20.0-okd-scos.24.20.0-okd-scos.14.20.0-okd-scos.04.19.0-okd-scos.194.19.0-okd-scos.184.19.0-okd-scos.174.19.0-okd-scos.164.19.0-okd-scos.154.19.0-okd-scos.144.19.0-okd-scos.134.19.0-okd-scos.124.19.0-okd-scos.114.19.0-okd-scos.104.19.0-okd-scos.94.19.0-okd-scos.84.19.0-okd-scos.74.19.0-okd-scos.64.19.0-okd-scos.54.19.0-okd-scos.44.19.0-okd-scos.34.19.0-okd-scos.24.19.0-okd-scos.14.19.0-okd-scos.04.18.0-okd-scos.104.18.0-okd-scos.94.18.0-okd-scos.84.18.0-okd-scos.74.18.0-okd-scos.64.18.0-okd-scos.54.18.0-okd-scos.44.18.0-okd-scos.34.18.0-okd-scos.24.18.0-okd-scos.14.18.0-okd-scos.04.17.0-okd-scos.34.17.0-okd-scos.24.17.0-okd-scos.14.17.0-okd-scos.04.16.0-okd-scos.14.16.0-okd-scos.04.16.0-0.okd-scos-2024-09-24-1517474.16.0-0.okd-scos-2024-08-21-1556134.15.0-0.okd-scos-2024-01-18-223523───4.15.0-0.okd-2024-03-10-0101164.15.0-0.okd-2024-02-23-1634104.15.0-0.okd-2024-02-10-0355344.15.0-0.okd-2024-01-27-070424

Source code for this page located on github