Back to index

Download installer and client with:

oc adm release extract --tools quay.io/okd/scos-release:4.14.0-0.okd-scos-2023-12-21-073212

Team Approvals:

No tests for this release

Upgrades from:

• 4.14.0-0.okd-scos-2023-12-20-222839 (changes) - Failed Success

---

Changes from 4.14.0-0.okd-scos-2023-11-10-050846

Created: 2023-12-21 14:25:03 +0000 UTC

Image Digest: sha256:508a9b34d31983df8ce24718b9f29e01ad736e12ad86b4b6ef4a01e7405d48d1

Release 4.14.0-0.okd-scos-2023-12-21-073212 was created from registry.ci.openshift.org/origin/release-scos:4.14.0-0.okd-scos-2023-12-21-073212

Components

• Kubernetes upgraded from 1.27.6 to 1.27.8
• CentOS Stream CoreOS upgraded from 414.9.202311091933-0 to 414.9.202312201452-0 (diff)

Rebuilt images without code change

• agent-installer-node-agent git e438a5e9 sha256:85c91f106917d5b81514f5bffc604ff42d38a75c70dc3f2e621b3177d73828ef
• agent-installer-utils git ad853769 sha256:489284071d0c2589438a8ac95f59d0c771036e9b568d53bccc67429f6b3e74f2
• centos-stream-coreos-9 sha256:fb750c80d136ace9d651d9c0da8bac652f9f1d3d6492aaeac2228f7e4f6be0e8
• centos-stream-coreos-9-extensions sha256:4a6f14e14064d38d411be200c61b883adcddcbfd80e16a0738f5231cc841a765
• machine-os-content sha256:fb750c80d136ace9d651d9c0da8bac652f9f1d3d6492aaeac2228f7e4f6be0e8

agent-installer-api-server

• OCPBUGS-23069: Ignore hostPrefix validation for plugins other than OVN/SDN (#5676) #5676
• Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

• OCPBUGS-20049: Remove uninitialized taint for agent-based installs (#753) #753
• Full changelog

alibaba-disk-csi-driver-operator

• OCPBUGS-23078: CVE-2023-44487: bump github.com/openshift/library-go to release-4.14 #71
• Full changelog

apiserver-network-proxy

• HOSTEDCP-1323: Merge latest code into 4.14 branch #45
• Full changelog

aws-ebs-csi-driver-operator

• OCPBUGS-23078: CVE-2023-44487: bump github.com/openshift/library-go to release-4.14 #296
• Full changelog

aws-pod-identity-webhook

• OCPBUGS-21761: Backport the recent rebase to 4.14 #168
• NO-ISSUE: Sync OWNERS with team members #176
• Full changelog

azure-cloud-controller-manager, azure-cloud-node-manager

• OCPBUGS-21439: Bump golang.org/x/net to v0.18.0 #93
• Full changelog

baremetal-installer, installer, installer-artifacts

• OCPBUGS-22771: aws: use security groups from defaultMachinePlatform #7658
• OCPBUGS-24489: baremetal: populate customDeploy in advance #7802
• OCPBUGS-22770: destroy: gcp: fix destroying regional disks #7657
• Bug OCPBUGS-22776: OpenStack: Fix IPv6 address configuration for bootstrap #7660
• OCPBUGS-22978: IBMCloud: Add eu-es region #7684
• OCPBUGS-23399: Check if PER is enabled in the target PowerVS workspace #7736
• OCPBUGS-22688: Bump Fedora CoreOS to latest stable #7647
• OCPBUGS-22774: Add KMS encryption keys if provided #7659
• Full changelog

baremetal-operator

• OCPBUGS-24489: Do not update instance_info and deploy_interface for active nodes #325
• Full changelog

baremetal-runtimecfg

• OCPBUGS-23474: Use shorter IP label for keepalived VIP #288
• Full changelog

cli, cli-artifacts, deployer, tools

• OCPBUGS-24197: Add client version in must-gather summary #1607
• OCPBUGS-24460: Overwrite template’s namespace with the explicit one #1616
• Full changelog

cloud-credential-operator

• OCPBUGS-25275: Azure Workload Identity info in CredsRequests creates a Secret #643
• OCPBUGS-24346: Discover AWS dns suffix from partition and region. #635
• OCPBUGS-23986: Use per-project custom roles instead of per-cluster custom roles #631
• OCPBUGS-23426: Explicitly set the vsphere secret credential data on sync. #629
• OCPBUGS-21388: Upgrade golang/x/net for CVE-2023-39325 #622
• Full changelog

cluster-baremetal-operator

• OCPBUGS-23392, OCPBUGS-23393: fix IRONIC_EXTERNAL_URL_V6 #384
• Full changelog

cluster-cloud-controller-manager-operator

• OCPBUGS-21189: Bump golang.org/x/net to v0.18.0 #295
• Full changelog

cluster-csi-snapshot-controller-operator

• OCPBUGS-23078: CVE-2023-44487: bump github.com/openshift/library-go to release-4.14 #174
• Full changelog

cluster-etcd-operator

• Revert “[release-4.14] OCPBUGS-21802: remove revision stability check from bootstrap complet…” #1168
• Full changelog

cluster-kube-apiserver-operator

• OCPBUGS-25384: psa cluster fleet evaluation #1600
• : OCPBUGS-24022: Add workload partitioning annotation #1590
• Full changelog

cluster-machine-approver

• OCPBUGS-23150: Filter non node CSRs in metrics #209
• Full changelog

cluster-monitoring-operator

• OCPBUGS-21473: Set the new –disable-http2 flag for prometheus-adapter to disable HTTP2 #2147
• Full changelog

cluster-network-operator

• OCPBUGS-24320: Add apbroute/status patch rights for ovnkube-node to update status #2143
• OCPBUGS-22787, OCPBUGS-22788, OCPBUGS-22789: ovnkube: container scripts cleanup #2090
• OCPBUGS-23371: hypershift, hosted clusters: enable multi-homing and multi-net features #2117
• OCPBUGS-21717: Bump golang.org/x/net and github.com/openshift/library-go #2122
• OCPBUGS-24633: ipsec add pluto restart #2152
• OCPBUGS-22363: Added HCP label to CNO pods #2081
• OCPBUGS-22286: hypershift: adjust backoff on infrastructure name retry #2078
• OCPBUGS-23011: Block upgrades to 4.15 with Kuryr #2096
• OCPBUGS-23315: set automountServiceAccountToken to false for hypershift managed network-node-identity deploy #2107
• Full changelog

cluster-node-tuning-operator

• OCPBUGS-25671: rps: fix mask update for SR-IOV devices (#891) #891
• OCPBUGS-18640: Fix Racing Machine Configs and add Day 0 Support (#854) (#871) #854
• OCPBUGS-24638: Do not set default RPS sysctl twice (#880) #880
• OCPBUGS-21845: rps: trigger udev event per queue #832 (#832) #832
• OCPBUGS-21845: e2e:rps: improve logging (#831) #831
• render: change dir path (#826) #826
• Full changelog

cluster-olm-operator

• OCPBUGS-25481: NO-ISSUE: Bump k8s.io/apiextensions-apiserver #41
• OCPBUGS-22581: [release-4.14] OCPBUGS-24652: Bump k8s dependencies #38
• Full changelog

cluster-openshift-controller-manager-operator

• OCPBUGS-23490: Remove blockage of ConfigObserver by build informer has synced flag #318
• Full changelog

cluster-storage-operator

• OCPBUGS-23078: CVE-2023-44487: bump github.com/openshift/library-go to release-4.14 #416
• OCPBUGS-23210: [IBM ROKS] cluster-storage-operator does not set upgradeable=True #419
• Full changelog

cluster-update-keys

• OCPBUGS-10126: Updating ose-agent-installer-orchestrator images to be consistent with ART #48
• Full changelog

console

• OCPBUGS-25397: fix runtime error on Node details Overview when Machin… #13446
• OCPBUGS-23771: Fix for yaml editor that crashes with MCE and ACM plugins enabled #13360
• OCPBUGS-24667: Fix plugin proxy handler #13425
• OCPBUGS-24474: S2I Build Wizard should check for Containerfile in addition to Dockerfile #13415
• OCPBUGS-24432: fix filtering issues on Events #13413
• OCPBUGS-24352: add access review for impersonate #13400
• OCPBUGS-22240: Save also the location.search and .hash values in localStorage to restore them after login #13270
• OCPBUGS-24293: ConsolePlugin metrics must no longer be grouped by the vendor #13391
• OCPBUGS-24423: Searching for items in quick search is confusing #13412
• OCPBUGS-22375: Delete results.tekton.dev annotations before rerun the pipelineRun #13278
• OCPBUGS-22478: Extra space is in the translation text(Chinese) of ‘Create rolebinding’ and ‘replicate rolebinding’ #13290
• OCPBUGS-24196: ApiVersion displayed on console is v1alpha1 whereas we support v1beta1 #13402
• OCPBUGS-23423: Cannot Edit Shipwright Build #13343
• Full changelog

console-operator

• OCPBUGS-24293: ConsolePlugin metrics must no longer be grouped by the vendor #820
• Full changelog

container-networking-plugins

• OCPBUGS-20374: build(deps): bump golang.org/x/net from 0.10.0 to 0.17.0 [backport 4.14] #129
• Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

• OCPBUGS-22974: [release-4.14] manage-security-groups: Only add SGs to LB members (#2455) #244
• Full changelog

csi-driver-manila-operator

• OCPBUGS-23078: CVE-2023-44487: bump github.com/openshift/library-go to release-4.14 #209
• Full changelog

csi-driver-shared-resource, csi-driver-shared-resource-webhook

• OCPBUGS-23111: Should reference configmaps instead of secrets #152
• Full changelog

csi-driver-shared-resource-operator

• OCPBUGS-23078: CVE-2023-44487: bump github.com/openshift/library-go to release-4.14 #91
• Full changelog

gcp-cloud-controller-manager

• OCPBUGS-21321: Bump golang.org/x/net to v0.18.0 #42
• Full changelog

gcp-pd-csi-driver-operator

• OCPBUGS-23078: CVE-2023-44487: bump github.com/openshift/library-go to release-4.14 #96
• Full changelog

hyperkube, pod

• OCPBUGS-23566: followup to #1808 #1813
• OCPBUGS-23566: Update to kubernetes 1.27.8 #1808
• OCPBUGS-23286: UPSTREAM: 121881: Use golang library instead of mklink #1801
• Full changelog

hypershift

• OCPBUGS-12720: Updating hypershift images to be consistent with ART #2467
• OCPBUGS-24627: unset ServiceAccount on ignition-server-proxy #3295
• [Release 4.14] OCPBUGS-24556: Fix a bug on deletion of a hostedcluster #3290
• OCPBUGS-24269: add CLI oauthclient #3272
• OCPBUGS-23569: Added IPFamilyPolicy to services exposed at the HCP in DualStack mode #3224
• HOSTEDCP-1318: external OIDC enablement #3261
• OCPBUGS-23747: Added brackets to IPv6 KAS address on kubeconfig #3228
• OCPBUGS-24063: fix(cpo): Set restart annotation on network-node-identity #3248
• release-4.14, HOSTEDCP-1315: Improve NodePool CPU arch & platform check #3236
• OCPBUGS-22676: Make the OLMCatalogPlacement field immutable #3143
• OCPBUGS-23558: Let router use svc ips 4.14 #3221
• OCPBUGS-19678: Remove cluster name validation from HCC #3040
• ”[release-4.14] CNV-35326: unsupported escape hatch mechanism custom HS/KV vms” #3202
• OCPBUGS-23027: Configure HSTS for kube-apiserver #3169
• NO-JIRA: chore(deps): update rhtap references (release-4.14) #3085
• OCPBUGS-23142: adding permission to CNO RBAC Calico path for network-node-identity deploy #3182
• OCPBUGS-22295: Added brackets to the kubeconfig server address when IPv6 #3117
• Full changelog

ibm-cloud-controller-manager

• OCPBUGS-21149: Bump golang.org/x/net to v0.18.0 #55
• Full changelog

ibm-vpc-block-csi-driver-operator

• OCPBUGS-23078: CVE-2023-44487: bump github.com/openshift/library-go to release-4.14 #91
• Full changelog

ibmcloud-cluster-api-controllers

• OCPBUGS-21436: Bump golang.org/x/net to v0.18.0 #63
• Full changelog

insights-operator

• OCPBUGS-23962: adds helm information gather (#868) (#877) #868
• OCPBUGS-23445: DVO gatherer - add retry logic (#861) (#870) #861
• OCPBUGS-22958: adds cluster storageclasses gather (#858) (#865) #858
• Full changelog

ironic

• OCPBUGS-23903: Ironic side of external_http_url (METAL-163) is not wired in correctly #429
• OCPBUGS-23505: Uplift eventlet version #426
• OCPBUGS-23354: Upgrade markupsafe and werkzeug dependencies #421
• OCPBUGS-14926: Handle Eject DVD 4.14 #415
• Full changelog

ironic-agent

• OCPBUGS-25685: Relax packages requirements #103
• OCPBUGS-23751: Update packages with latest fixes #96
• Full changelog

k8s-prometheus-adapter

• OCPBUGS-21473: Add a toggle to disable HTTP/2 on the server to mitigate CVE-2023-44487 #89
• Full changelog

kube-proxy, sdn

• OCPBUGS-20790: update x/net to v0.17.0 #587
• Full changelog

machine-api-operator

• OCPBUGS-24047: Update reference URL #1186
• OCPBUGS-24047: Use docs URL instead of KCS article #1180
• OCPBUGS-17297: [release-4.14] Update x/net to fix CVE #1173
• Full changelog

machine-config-operator

• OCPBUGS-24596: [release-4.14] execute cert related processes to ensure proper rotation #4063
• OCPBUGS-24397: gcp-routes: don’t exit on crictl failures #4056
• OCPBUGS-20554: Ensure gcp-routes hack for internalLB hairpin traffic works for SGW #3973
• OCPBUGS-23474: Use shorter IP label for keepalived VIP #4041
• OCPBUGS-23208: workaround nmstate bug by configuring ipv{4,6} addresses #4031
• Full changelog

multus-networkpolicy

• Update vendor package (#40) #40
• OCPBUGS-21454: Update go.mod for CVE-2023-39325 (#33) #33
• Full changelog

multus-whereabouts-ipam-cni

• OCPBUGS-21518: update golang.org/x/net to v0.17.0 #207
• Full changelog

network-metrics-daemon

• Added METRIC_TEST_IMAGE var (#88) #88
• Full changelog

oauth-proxy

• OCPBUGS-20980: go.mod: bump golang.org/x/net to v0.17.0 #267
• Full changelog

oc-mirror

• OCPBUGS-23327: Fix MirrorToDisk of oci catalogs in hidden folders (#766) #766
• skipping prune failure if manifest not found (#735) #735
• Full changelog

olm-rukpak

• OCPBUGS-23358: [release-4.14] Address http2 vulnerability #53
• Full changelog

openshift-apiserver

• : OCPBUGS-21464: Enable HTTP/2 CVE mitigation #397
• Full changelog

openstack-cinder-csi-driver-operator

• OCPBUGS-23078: CVE-2023-44487: bump github.com/openshift/library-go to release-4.14 #142
• Full changelog

openstack-machine-api-provider

• OCPBUGS-23202: Don’t build InstanceSpec during delete operations #95
• Full changelog

operator-lifecycle-manager, operator-registry

• OCPBUGS-22538: otelhttp bump [release-4.14] #632
• OCPBUGS-20829: [releaser-4.14] Fix apiserver vulnerability #608
• OCPBUGS-23212: Do not derive installplan.spec.clusterServiceNames from bundle IDs #607
• OCPBUGS-18904: [release-4.14] Improve Leader Election Hand Off #605
• OCPBUGS-23508: [release-4.14] Use generated namespaces in e2e tests #614
• Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

• OCPBUGS-24320: APB status not updated when fails to process during the first reconciliations #1968
• OCPBUGS-23257: Update leaderelection config to allow retries #1955
• OCPBUGS-23387: Ignore completed virt-launcher pods #1954
• OCPBUGS-25087: Fragment oversized reply packets in LGW mode #1982
• OCPBUGS-22735: OVNK/GW: Ignore headless services in syncServices #1970
• OCPBUGS-24350: [release-4.14] fixes MTU configuration on gateway router #1969
• OCPBUGS-24209: Significantly reduce shared informer memory usage #1964
• Full changelog

powervs-block-csi-driver

• OCPBUGS-24713: synk: ignore vendor dir #60
• Full changelog

powervs-block-csi-driver-operator

• OCPBUGS-23078: CVE-2023-44487: bump github.com/openshift/library-go to release-4.14 #48
• Full changelog

powervs-cloud-controller-manager

• OCPBUGS-24727: UPSTREAM: <carry>: snyk code scan exclude vendor directory #54
• Full changelog

powervs-machine-controllers

• OCPBUGS-24730: snyk code scan exclude vendor directory #65
• Full changelog

prometheus

• OCPBUGS-22531: bump otel dependencies #183
• Full changelog

telemeter

• OCPBUGS-22647: go.mod: bump go.opentelemetry.io/contrib/instrumentation/net/http/ote… #494
• Full changelog

tests

• OCPBUGS-21774: backport #28316 to 4.14 release #28335
• Revert “[release-4.14] OCPBUGS-22720: Use Centos 8 Stream mysql image in tests” #28368
• OCPBUGS-23042: tolerate AWS edge nodes on monitor tests #28387
• OCPBUGS-23145: Bump watch requests for cluster-baremetal-operator #28385
• trt-1340: backport exact and disable monitor tests options to 4.14 #28391
• Full changelog

thanos

• OCPBUGS-22636: Bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.42.0 to 0.44.0 #130
• Full changelog

vsphere-cloud-controller-manager

• OCPBUGS-21520: Bump golang.org/x/net to v0.18.0 #54
• Full changelog

vsphere-csi-driver-operator

• OCPBUGS-23169: Fix vsphere csi controller pods from getting constantly restarted #193
• OCPBUGS-22430: disable http/2 server support in webhook #182
• Full changelog

vsphere-problem-detector

• OCPBUGS-23078: CVE-2023-44487: bump github.com/openshift/library-go to release-4.14 #138
• Full changelog

---

View changelog in Markdown or change previous release: 4.20.0-0.okd-scos-2025-09-01-0133154.20.0-0.okd-scos-2025-08-31-1333144.20.0-0.okd-scos-2025-08-31-0133134.20.0-0.okd-scos-2025-08-30-1333124.20.0-0.okd-scos-2025-08-30-0133114.20.0-0.okd-scos-2025-08-29-133310───4.19.0-0.okd-scos-2025-09-01-0957034.19.0-0.okd-scos-2025-08-31-1630454.19.0-0.okd-scos-2025-08-31-0430454.19.0-0.okd-scos-2025-08-30-1630454.19.0-0.okd-scos-2025-08-30-0124164.19.0-0.okd-scos-2025-08-29-132416───4.18.0-0.okd-scos-2025-05-27-0825374.18.0-0.okd-scos-2025-05-26-2025374.18.0-0.okd-scos-2025-05-26-0825374.18.0-0.okd-scos-2025-05-23-0333574.18.0-0.okd-scos-2025-05-22-153357───4.17.0-0.okd-scos-2025-02-25-0904554.17.0-0.okd-scos-2025-02-24-2104554.17.0-0.okd-scos-2025-02-24-0904544.17.0-0.okd-scos-2025-02-23-2104544.17.0-0.okd-scos-2025-02-22-211215───4.16.0-0.okd-scos-2025-01-06-1432414.16.0-0.okd-scos-2025-01-04-1456004.16.0-0.okd-scos-2025-01-04-0142364.16.0-0.okd-scos-2025-01-03-1342364.16.0-0.okd-scos-2025-01-03-0142364.16.0-0.okd-scos-2024-12-17-0222464.16.0-0.okd-scos-2024-11-24-1100454.16.0-0.okd-scos-2024-11-23-1818454.16.0-0.okd-scos-2024-11-23-0618454.16.0-0.okd-scos-2024-11-22-1818454.16.0-0.okd-scos-2024-11-22-061845───4.15.0-0.okd-scos-2024-12-16-1913164.15.0-0.okd-scos-2024-01-18-1035224.15.0-0.okd-scos-2024-01-17-2235214.15.0-0.okd-scos-2024-01-17-1035204.15.0-0.okd-scos-2024-01-16-223519───4.15.0-0.okd-2025-06-27-1341344.15.0-0.okd-2025-06-17-1652194.15.0-0.okd-2025-05-02-1402244.15.0-0.okd-2025-04-03-2126204.15.0-0.okd-2025-04-02-1800124.15.0-0.okd-2024-03-27-1109014.15.0-0.okd-2024-03-26-2309014.15.0-0.okd-2024-03-23-1640104.15.0-0.okd-2024-03-23-0440104.15.0-0.okd-2024-03-22-164010───4.15.0-0.okd-2024-03-10-0101164.15.0-0.okd-2024-02-23-1634104.15.0-0.okd-2024-02-10-0355344.15.0-0.okd-2024-01-27-070424───4.20.0-okd-scos.ec.134.20.0-okd-scos.ec.124.20.0-okd-scos.ec.114.20.0-okd-scos.ec.94.20.0-okd-scos.ec.84.20.0-okd-scos.ec.74.20.0-okd-scos.ec.64.20.0-okd-scos.ec.54.20.0-okd-scos.ec.44.20.0-okd-scos.ec.34.20.0-okd-scos.ec.24.20.0-okd-scos.ec.14.20.0-okd-scos.ec.0

Source code for this page located on github