Back to index

Download installer and client with:

oc adm release extract --tools quay.io/okd/scos-release:4.21.0-okd-scos.9

Team Approvals:

Tests:

• Blocking jobs
  • upgrade Pending release-openshift-okd-scos-installer-e2e-aws-upgrade-from-scos-stable
  • upgrade-minor Pending release-openshift-okd-scos-installer-e2e-aws-upgrade-from-scos-stable

Upgrades from:

• 4.21.0-okd-scos.ec.19 (changes) - Pending
• 4.20.0-okd-scos.17 (changes) - Pending

---

Loading changelog, this may take a while ...

Changes from 4.21.0-okd-scos.7

Created: 2026-03-18 19:56:58 +0000 UTC

Image Digest: sha256:fc6f478bfab4e4bc1b17738464e9a8671ed74cc82998c2968e93d8d2ef4d7e7b

Release 4.21.0-okd-scos.9 was created from registry.ci.openshift.org/origin/release-scos:4.21.0-0.okd-scos-nightly-2026-03-18-094927

Components

• Kubectl 1.34.1
• Kubernetes upgraded from 1.34.2 to 1.34.5
• Kubernetes Tests 1.34.1
• CentOS Stream CoreOS 10 upgraded from 10.0.20260211-0 to 10.0.20260307-0

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
IngressControllerDynamicConfigurationManager (0 tests)	Disabled	Disabled	Enabled	Enabled	Enabled (Changed)	Enabled (Changed)
KMSEncryptionProvider (0 tests)	Disabled	Disabled	Enabled	Enabled	Disabled (Changed)	Disabled (Changed)
KMSEncryption (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)

Rebuilt images without code change

• agent-installer-api-server git 1574e1fa sha256:5538bcb37330037da74d7dae11040741b00b8efe8e8ab6b675657e8be78d1176
• agent-installer-node-agent git e5713826 sha256:da28bd8b497c8106e6936ec34ac0ef5c8b6b01d5920d1667ca2d495037ec7451
• agent-installer-ui git 479a68f3 sha256:8e0ceb175b8010326f533c14a20df0dd0fda158cce3f9ca9324719d31947d506
• apiserver-network-proxy git 35ba137a sha256:bdd417206a8f2509261b9ce9ac2e27097c8f17d5aab715e972376eec6921a470
• aws-cluster-api-controllers git 10ceef5e sha256:ceee9eef0e32f372d1f7199f27be3a8f9931748de739c2247f2c44f5c4d1761e
• aws-ebs-csi-driver git 57eebffc sha256:315c03721a9ebdcb470847fbc963fcb0ceb11e227a2e09919008988d1a17e948
• aws-karpenter-provider-aws git ff9c8d4e sha256:6d3a5c65a9a0726659680829d2aa0e1c84c3f9dfacfd222b985bc3b9c18e4e36
• aws-kms-encryption-provider git 19e7b623 sha256:e81797d97678a4f0fc9bf1b6fcd5837b6eda5036a8d3d6757962b68b3eddb834
• aws-machine-controllers git 938565c9 sha256:ca558573dd768be7a85d82cf5bf1dbed5e72b123adefee65e81a39c5f4246b7c
• aws-pod-identity-webhook git 5cd42ed1 sha256:041c4ad25890b174fcfa9e7d3f91768176c758f2260355243a2503a0534f0d70
• azure-cloud-controller-manager git 83b3f9ec sha256:002949a8f2f2bbdc324462ce4b3a17545b5e5ea1fbbeecc28616b6e4b3708f66
• azure-cloud-node-manager git 83b3f9ec sha256:5c721957f1ddfd21fbabf06adb1ef8329932221c22218f8532ac97d839ff2f21
• azure-cluster-api-controllers git 5d6af81d sha256:72371a973c08fe5337329e2bbeaa3a24a467852e7adc37832deab693fdd618ce
• azure-disk-csi-driver git 3cfa501e sha256:818fca3e9c912985df5f29bfff4d96bc02e581afc7407e63188749765925f255
• azure-file-csi-driver git c77d75f9 sha256:2472c763881cfbb2f2cbc35c5511408d495ae34e1e298cee0e8345506296553e
• azure-kms-encryption-provider git fe1d311b sha256:92b903d8f9c5bf724af7b009f7e53d8df4aa68d22b89cd2c456ee47754359130
• azure-machine-controllers git b8b8cb1c sha256:4733f3b7aaad7373422273492a30aabf52077705ee023e714bef51affb8e3cb2
• azure-service-operator git 17e57462 sha256:5b96c9ac708aae01e988f322c773fc99075d1c8b04e480491739348e3fdfb2cb
• azure-workload-identity-webhook git 3f2a6e0d sha256:788b0b1d19ec9924aa5694749a9d005325b37f1878322253722fb9dd002e936c
• baremetal-cluster-api-controllers git 659138fe sha256:07134eeb173a13c46652491e3d62fa7b5ad1177d685e167033f4d60fcafbe836
• baremetal-machine-controllers git 4e6a729c sha256:cee1ccdb323d744a6f69a0516a9bc5f83543a2f4ed9b74d2be0643ba904d209e
• baremetal-operator git 906e2b88 sha256:e8bc3f2b06e38bc5811c1dc74b03150d4e5c5739d110ff1c879c1106ce0f7350
• cloud-credential-operator git 0c51a1b8 sha256:1f41eea0fbc58998fc1ac936d2fd98f5849a333d9af3011ee9322e1627fc3883
• cluster-autoscaler-operator git dec12ba6 sha256:a14177497c489dae2f87522d6576c5e7343ad4acdbf79a2d2eef15c17331a071
• cluster-bootstrap git dc0d4a5c sha256:416eda83feed538a48483fc1227b4898265c8f783e5634ce52202583f19cfbaf
• cluster-capi-controllers git a957484a sha256:d020942e2134745f834a1178c0540d416f8d5bd9c1bb4e8b0a2d955ffb3dc4bd
• cluster-capi-operator git 80728a61 sha256:4e882a49e9c1518d05e1ff66af6b73556796449daa0ea8c3a510ce159a53df37
• cluster-cloud-controller-manager-operator git 6148c0cc sha256:fb05883a874b7799a3cb21a2d006d00a4e5279543cfb98d2a6f8873331813cec
• cluster-config-operator git 1eb450a3 sha256:083e8e138e449579c1c772dab3ff75676e69084c93f74103f73e654e88217756
• cluster-control-plane-machine-set-operator git 2dde33fb sha256:f87dec2f7286bf5148fc9fb4ce8f878c10dff2f86a1e3605254c32b4f8a68cea
• cluster-csi-snapshot-controller-operator git 43ad01e8 sha256:5c695a44d0393abc72b1e46f0675ddb43b77c6fd4bd00fa05454db81a4acb62b
• cluster-dns-operator git 41a53fed sha256:f6938bd0efc570cb28cf576b03c279b3917813e6648aa38406b319c7cbfa1606
• cluster-image-registry-operator git b2dfc3bb sha256:4e6cb1ac17a4bc12ab501cfb6c83059645dc746a259f26b03cea5d0ebb1dce45
• cluster-kube-controller-manager-operator git 395de967 sha256:980ea43f197e5f62e49e8ec2724f3edb2dbe9dc6bccfbb900966ab3f6387ba0f
• cluster-kube-storage-version-migrator-operator git 8a42beeb sha256:47e47a5a85f2a218e6e93b393031aaa8fee4b976d508ff962ae2f964d772c7e8
• cluster-machine-approver git d864813c sha256:636683f613dedb36948b61afc1162dfdfc3b08540b94654259558a6c854724b5
• cluster-openshift-controller-manager-operator git 2617a201 sha256:b70907ee425e7543ddcd6c1ee9dd7c3600c7fbfa6e6ddf744d3adc436fbba17f
• cluster-policy-controller git 8b775487 sha256:ef89ce3c9201135b607d955931d1df4a931536cb56f61ce62ce8a51e5293a9ee
• cluster-samples-operator git 11ed1942 sha256:53000646740716db8ea0ebe14ef5974abbc34fb6faafad968562d4e5aa7fc922
• cluster-storage-operator git dd362d76 sha256:bfab1c33b03f646953114dcf2ab91212e009c809fe0f059b00d80ddce014aacd
• cluster-update-keys git b3cae8f2 sha256:a2ef7a7a59205d67a99790c4db1bcc87fb6d5fe2ee88f063428b49dea516b383
• configmap-reloader git 16114b8d sha256:c07cfda588c444f2100a5367fcd995642ba5c4735dce067911002f50fd8ae1ea
• container-networking-plugins git 747ad66c sha256:4c253e35e51171342ae536fad999189f9eea532f9cbc61b0646c2291b54a801f
• containernetworking-plugins-microshift git 747ad66c sha256:c370f1f93b45373a624eee7264ee0ccf459feca3ec675d61b17474fa56eba7a6
• coredns git 7486e9e4 sha256:d8415cc2255ea4f9a297243ed301d3a7e362f2122ca7ad34fab52d57f9a6557d
• csi-driver-manila git bf508c06 sha256:3e24bc3fe324bedbd25a41e99e647573b7b222e99148addaa35f75dcd6ec9d80
• csi-driver-nfs git 49f2d86f sha256:1663c754d466ffe407d509c66f8a0e0b5bf578807597303cee20851915659f9a
• csi-external-attacher git 344669a2 sha256:606457607b6f248d358014d1ba4596468712486b69fd937e7d73a27cff1db43c
• csi-external-provisioner git f18190fb sha256:b014520c5001ba273905fddd426433ce38d066c5ecdc9c3893077f5208a0c796
• csi-external-resizer git d880a1ec sha256:549418d3ab834d66ae5a237fff1d9ab519597a8724285fb358dbb5fe64d76f3e
• csi-external-snapshot-metadata git af250fdb sha256:3503fefeb326cc81a0fc7554d47de54edecf42e821efe6804c20db8e0a064aa5
• csi-external-snapshotter git 9098db0e sha256:61eb4b493c4a9f2aeffa56490dcbd29344142dd4e8e9f7fa6f796867e8d38505
• csi-livenessprobe git 78dacb7c sha256:60b3a8ba9d71c3ef24874c109880f7e63129d1ff8b85e691adbf556d2ce56638
• csi-node-driver-registrar git d29f3f7a sha256:a4d8ee052f73a3404a90f62ea02de8c8f5ae17b0da1f57c86c66c28f4193279e
• csi-snapshot-controller git 9098db0e sha256:b81cc0110773dbee8d9d8917f93871533afbd882412e83ed34f8b1a40b71803b
• docker-builder git 48fce231 sha256:c650167defc841ba8507eda0fe603e7082a9744b9837ad242f71c507fc1377c3
• docker-registry git 602f51c7 sha256:89eeff234567dfa05ff304f83cac88f99620cc7334ec5eacb515ef783000418e
• egress-router-cni git 5e0f8d1b sha256:8b5e5c4334eeb0c523366fd300e9134af6a7987eb891c171bb8997a4a851b74a
• etcd git 806f690e sha256:32adb5a6761c18aa8c8f84f253cd0ad334d95708edb090f963e88931d5f671df
• gcp-cloud-controller-manager git 8732386c sha256:9222e2f69a19fa10223320d8ac75dca48683fb0583ab9b968094cf91d000d81e
• gcp-cluster-api-controllers git e2d0c20e sha256:f6fb5e751b7aaa8bef3f1a23c1c103a9046e2bfb205cb2e500048c5392cb2cdb
• gcp-machine-controllers git 91f71c9a sha256:bee10ec96337b98e47675b93f23b585b668a09c268e954bd8cdff757b6e2a799
• gcp-workload-identity-federation-webhook git d481e5cb sha256:f6548a491a22793916d66672d8215af080c7c2390255bbf589affc667abb0d39
• haproxy-router git b231c65b sha256:34a51b2322c7cd8484cde3f79bb1744d9c0e755bdfbdd605dc7830db15d35799
• ibm-cloud-controller-manager git c566572b sha256:91503894206abbd20ee8608c4eea5fa751ddc58dcf2acaedbcf0727e057bef78
• ibm-vpc-block-csi-driver-operator git 00bc7407 sha256:04626fb34de3a759815a4ed369b5167fdf7b350383164d030c538bb14da6c91a
• ibmcloud-cluster-api-controllers git f7e3ec30 sha256:e7df2b93a15d8162c72fd2f96f4547ef9774f6515b002b4ca91fc7a1a2aa1169
• ibmcloud-machine-controllers git e72a8471 sha256:4be14dfa010616f021a67a39357a04c462f7fab0baaf78962da195892674a2f5
• ironic-agent git ff276c00 sha256:6f2e544fb2164f18acedd7fcd42dd2668517cef6c78366ee6db257fcc0b31ff7
• ironic-machine-os-downloader git 707c2262 sha256:7c00faa0508c17115a8e29fd431e106abc1b995493f3230a57cf0ec7cc43ef1c
• ironic-static-ip-manager git b95b05fe sha256:e0b3ee64f334f65d716250a9731672af682d05f7fded752676e0f69896d63fff
• kube-metrics-server git ed76a5e8 sha256:33dabd6d07390cfb52d7454c65ad06efe072c6e05c13737918ee91a0fc015bad
• kube-rbac-proxy git cd636680 sha256:cd24f1f683a23650d7920f0d6466e9d9ef23e40d8cb6909285115b495557ced5
• kube-state-metrics git cb0aa591 sha256:dc86ad019ae0770e7f0845c0592928af99b994b376ea2c6b19c5a3b2b07d6ec7
• kube-storage-version-migrator git ce5ff17e sha256:b82d2b8c6cffa2451d88ab810b808ab150c00adadf429f93716744ef5e7a2b17
• kubevirt-cloud-controller-manager git 1e6fdd66 sha256:ea31d45ff4f39599926711f7a9cdac93aa2f57fd7cffee9938ec69aef79f490b
• kubevirt-csi-driver git 9e2dbddf sha256:b2069903140fe4f8d79d2c34696804f794d440401195781fb406dfef96f26599
• libvirt-machine-controllers git 76effeca sha256:5de10d10d3aaf1fcbba823e87964d0f153a87654b1ba8d08a16692e6d01b91de
• machine-api-operator git 83936dde sha256:d18fead7ecb6d1b43c709aa1134183e66ed1e589cf417cb1bb339716417ee28f
• machine-os-images git 9a8e96a6 sha256:0bfde145d8c48e63316ec6a2ecb337336ebaa5607cb47aadca3805a4f19149d8
• metallb-frr git c82bfaad sha256:a137da9faa235a8e48330d95169bd3f35330d856632046b258a313c5f07b5337
• multus-admission-controller git d95feb67 sha256:0a258aaf291ecf454c9f885d508871bfe0aefd7aa132388b715d63da903b53f4
• multus-cni git 93556f99 sha256:dc2270435fd4b98f08a826002f24682a66e2e9dce28031998a78d28a8f3f5f3c
• multus-cni-microshift git 93556f99 sha256:5eee2642da6c9642db73a7a3a3662fffc5289dd186af8b5b359ad934595094e1
• multus-route-override-cni git 08af4127 sha256:919e8fe0ada2b5f604ffb40bf27436dbfd134604a1c02e9a4a7b39163413318e
• multus-whereabouts-ipam-cni git d691040e sha256:63733d291a96e702ad351d608d06ea2dc2fd0daea2e2645c7819d9c2fb776c4e
• must-gather git b4b434c4 sha256:97277dd09a5f91d162cc32070cfa23235408e2fa42ad8f7f00d173f7fe12f551
• network-interface-bond-cni git 297eeb43 sha256:ab9480b7b4ea7ca36412d8447502bffebe3c39a3ec2b0b31a35f19db4ac5ba77
• network-metrics-daemon git 844fa588 sha256:d7cde0f8eaa6564ce75ddaf92672b426ba25c6d1b3b7269dcad2a63802124190
• network-tools git d6717e45 sha256:c2b3066938654e47e31e3a767062cb61e46eba1afda09aef8579dfaf0852fab0
• nutanix-cloud-controller-manager git 33b7bec6 sha256:af18f515ef543d242ea1cd3a323b819ebceb0dd08227179a53c59d9ab7c5600a
• nutanix-machine-controllers git b15a665c sha256:0420bc5c8125142b59491f9087c8d26f4b4fc7b3288da531ed672920f8841103
• oauth-apiserver git 71c41b2d sha256:2b03e59f28ca35870e064f8be0dda3fd0e7070a4aae59866721289ae976380b7
• oauth-proxy git 7f518c02 sha256:a2ad4dac1ffda77dd4008d7d20ec309a27244886628abbd385ff00701f71465d
• olm-catalogd git dfc0e537 sha256:f2ad024e5af4f91b9745d286c0d9caf126ca238a04bb86b98d269f62c48d6d47
• olm-operator-controller git dfc0e537 sha256:60a8d2896e102c0340cfbbaddacfe7fe09ba6fc01ba4dc64406ffec77efca8fc
• openshift-apiserver git 64dea074 sha256:df38e3c26840b27b3491f5b904b8b5abeb99a8abab6bb05e1bbf41e4d0fa486e
• openshift-controller-manager git 438d52e7 sha256:a82d0b160fed6d0d35cbd04c00543977e875c9ea69e36f72d531f3684ec71f6f
• openshift-state-metrics git ab605a4b sha256:d0c72a488d1bd2f3e105aa2d089cdef41cb85b896e7ce8a23bf5de49cb5a3cd4
• openstack-cinder-csi-driver git bf508c06 sha256:71055251e4ea3b4d393677448b92d1240d974a57d8ad9149d7c448a4ef199b65
• openstack-cloud-controller-manager git bf508c06 sha256:4c866ec25a7620a47deab7b58b43fe9fe6fd74775e4d699c86751f1398b9a707
• openstack-cluster-api-controllers git e1c0f2f9 sha256:2da58c3117d76b5d8f8d92970f4cc2c3d0c4b06ffcc1fa7054f98b5b2b89f249
• openstack-machine-api-provider git b1fdb10f sha256:c8767f715546875ef538f254b62b3e0cb4b175baa71e80fc65d7760645c85fb8
• openstack-resource-controller git 70f5ad34 sha256:46daa300bbbd3d6d27b8fa1a705c3fc7e2e2860af22d206e0260f8593904930a
• powervs-block-csi-driver git 791e12ab sha256:a5ca900da14f13e45fe949e75b769a32054df82677eac3e8957ecd45b5fc2883
• powervs-block-csi-driver-operator git e22228ae sha256:45c6ce7357a71dca5b2a99fc624ce19365825b72d796c3524427feb61e85fcf5
• powervs-cloud-controller-manager git 969a04e9 sha256:4945c21ac05d571f08f1bff1eebaac57134199d87eb919e2267eb406d3115db9
• powervs-machine-controllers git 551974ef sha256:bf15b93a9dab57d25b41d64f87de8addde8d0368d1a43ab5fb4196e6acad6026
• prom-label-proxy git 610c11b5 sha256:6baa5ea2e01a9c1a3c7cb287630a57ccf090063f66efa3b259c3494124e8dd77
• prometheus-alertmanager git 3dbe0b64 sha256:5e83cb8fc86e0bd5378ec3d265e729e094e6be7bc5b108ee754f20930cc62ada
• prometheus-node-exporter git 39d72873 sha256:9f699ad7029454ef10446f502cbfec8793ec44c9afa80cba4ade4959875559f6
• route-controller-manager git 559b7122 sha256:e6c0f1f07f208d3e9796f3ab9242692eadc49da21c3f783d3bfba523937cce7a
• service-ca-operator git e9622ba1 sha256:c81d8ec58308926901e6023fb477f1b80d60945cd0eeb8db4a8874db8232de60
• telemeter git a54acdfe sha256:3546e04e409a4f05f7445b94fddf208093f89cc3e8d325bb609f1d1406f99fe0
• thanos git 6ea20ffa sha256:3aea1276cd7cfeb12ca978992a5abb63affc1dd687c9dd2f7425c44de4f6b46c
• volume-data-source-validator git 8b929332 sha256:f63defc13fbcf483ae0c4bf9bf8b302514a65e79b751f099d286b0c113b0a1eb
• vsphere-cloud-controller-manager git f69584d6 sha256:0fa83d3a41a6019fc61bf1cf6cdeeed3c5216db9bafa635f6c40682b84e1918b
• vsphere-cluster-api-controllers git 6626b299 sha256:3bfab1411cc0b5813dae0b522f82b006b0e066bac8a3cdeabd25a6f83938be24
• vsphere-csi-driver git 5e680186 sha256:f1761bc8d029768c3dcddae84836a342840fb7c42047b5b0fced95c46c744ccc
• vsphere-csi-driver-syncer git 5e680186 sha256:25c4f374e81006e5932800153f2a01f6c84bb7a179cf0ea93dfad50604adedcb
• vsphere-problem-detector git a35d685a sha256:f7ddb47d140a878d4629fba6e14e1a8ec924acf168bfd6a9ee7f7014fa1c3423

agent-installer-csr-approver, agent-installer-orchestrator

• OCPBUGS-77536: Fix root partition before copying IRI registry data #2038
• Full changelog

agent-installer-utils

• OCPBUGS-78393: Update Konflux release version to 4.21.5 #270
• OCPBUGS-78188: Add a flag to provide a custom appliance image #273
• OCPBUGS-78144: Update to use the 4.21 Catalog #271
• OCPBUGS-77538: (Backport) Override prefilled rendezvousIP #263
• OCPBUGS-77302: Remove multiple redhat-operator-index catalogs #262
• OCPBUGS-77236: Update quay.io/konflux-ci/konflux-vanguard/task-rpms-signature-scan:0.2 Docker digest to 2f3015a #222
• OCPBUGS-77220: Update Konflux references #251
• Full changelog

aws-cloud-controller-manager

• OCPCLOUD-3341: Updates ecr-credential-provider make target #134
• Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator

• OCPBUGS-78155: Add only to tags to volume object, if volume is not already tagged #521
• Full changelog

baremetal-installer, installer, installer-artifacts

• OCPBUGS-77504: fix wavelength zone name regex #10343
• OCPBUGS-77551: Increase size of /var/ostreecontainer mount #10346
• Full changelog

baremetal-runtimecfg

• OCPBUGS-77168: Install dbus-tools, needed in pkg/monitor/dnsmasqmonitor.go #383
• Full changelog

cli, cli-artifacts, deployer, tools

• OCPBUGS-77486: Makefile: Strip debugging symbols by default #2211
• OCPBUGS-77168: Install subscription-manager in required images #2208
• Full changelog

cloud-network-config-controller

• OCPBUGS-77154: Refrain from adding Egress IP to public LB backend pool #205
• Full changelog

cluster-authentication-operator

• OCPBUGS-74418: Bump library-go to get KMS #847
• OCPBUGS-74418: carry test assertion #848
• OCPBUGS-74418: Conditionally add the KMS plugin volume mount to the oauth-apiserver container #846
• OCPBUGS-74418: Add KMS test scenarios #844
• Full changelog

cluster-autoscaler

• OCPBUGS-76296: Pick upstream commits to Fix VPA recommender concurrent access panic #404
• Full changelog

cluster-baremetal-operator

• OCPBUGS-77418: Fix ironic-proxy service routing for port 6385 #560
• OCPBUGS-77035: Update kubebuilder tools to more latest version #558
• Full changelog

cluster-config-api

• OCPBUGS-74418: Introduce KMSEncryption feature gate #2670
• OCPBUGS-76408: Move DynamicConfigurationManager back to TPNU #2703
• Full changelog

cluster-etcd-operator

• OCPBUGS-77921: Prefer to remove members where they have another healthy machine in the same failure domain index #1563
• OCPBUGS-77097: Wait for revision stability before removing etcd members #1555
• Full changelog

cluster-ingress-operator

• OCPBUGS-77432, OCPBUGS-77433: Ensure canary cert matches the default ingress controller’s cert #1367
• Full changelog

cluster-kube-apiserver-operator

• OCPBUGS-74418: Bump library-go to get KMS #2063
• OCPBUGS-77969: Add support for event-ttl cases and go test cases in Kube API Server Operator #2066
• OCPBUGS-74418: Carry test assertion #2064
• OCPBUGS-74418: Conditionally add the KMS plugin volume mount to the kube-apiserver container #2061
• OCPBUGS-74418: Add KMS test scenarios #2054
• Full changelog

cluster-kube-scheduler-operator

• CNTRLPLANE-2843: chore: update OWNERS #619
• Full changelog

cluster-monitoring-operator

• OCPBUGS-74425: Include kube_pod_labels in minimal profile #2797
• OCPBUGS-77908: [release-4.21] add app.kubernetes.io/part-of=openshift-monitoring label to thanos-ruler pod #2840
• OCPBUGS-76541: Fix NodeRAIDDegraded & NodeRAIDDiskFailure alerts #2815
• OCPBUGS-77271: AlertingRule: fix duplicate PrometheusRules after MD5->SHA-224 naming change #2829
• Full changelog

cluster-network-operator

• OCPBUGS-76333: Silence ovnkube-lib.sh to avoid mass of logs to collectors #2900
• OCPBUGS-77147: Add config override for openflow-probe #2917
• Full changelog

cluster-node-tuning-operator

• OCPBUGS-78173: workloadhints: use IsVM to skip BM-only tests #1480
• Full changelog

cluster-olm-operator

• OCPBUGS-77826: cluster-olm-operator sets Progressing=True during upgrade #177
• Full changelog

cluster-openshift-apiserver-operator

• OCPBUGS-74418: Bump library-go to get KMS #666
• OCPBUGS-74418: Conditionally add the KMS plugin volume mount to the openshift-apiserver container #664
• OCPBUGS-74418: Add KMS test scenarios #656
• Full changelog

cluster-version-operator

• OCPBUGS-77256: Implement mTLS authentication and authorization for CVO metrics endpoint #1326
• Full changelog

console

• OCPBUGS-77029: Fixed Metrics page React error #306 by exporting QueryBrowser component #16038
• OCPBUGS-77251: Fix editing secrets with mixed text and binary data #16060
• OCPBUGS-77561: Fix ConsolePluginStatus icon #16090
• OCPBUGS-75000: Clean up old session cookies to prevent accumulation #15985
• OCPBUGS-77957: [CI] Fix the VolumeSnapshot CRUD flaky test failures #16118
• OCPBUGS-77882: Fix infinite recursion in project access form #16112
• OCPBUGS-65948: prep for 4.21 GA SDK publish #16116
• OCPBUGS-76385: Workloads - Edit pod count and Edit parallelism : Content is in English #16005
• OCPBUGS-76387: DataView Pagination page menus : i18n misses #16007
• OCPBUGS-76386: i18n upload/download routine task - 4.21 / 281 (Latest) #16006
• OCPBUGS-77430: run and enforce yarn dedupe #16075
• CONSOLE-5011: migrate to yarn berry #16059
• Full changelog

console-operator

• Sync Dockerfile.ocp image #1126
• OCPBUGS-72562: Add missing relatedObjects + small refactoring #1090
• OCPBUGS-74686: Add rhel8 and rhel9 oc binaries for Linux OS in CLI downloads #1104
• Full changelog

driver-toolkit

• OCPBUGS-78535: Support ubi minimal base image #186
• OCPBUGS-77887: Clean up cruft in /var/cache/dnf #183
• Full changelog

gcp-pd-csi-driver

• OCPBUGS-77716: Support Downward API node name #101
• Full changelog

gcp-pd-csi-driver-operator

• OCPBUGS-77494: Pass node name to csi-driver container #173
• OCPBUGS-77310: Add RBAC permission for node driver to get Node objects #171
• Full changelog

hyperkube, kube-proxy, pod

• OCPBUGS-77475: Bump v1.34.5 to release-4.21 #2601
• OCPBUGS-76516: Bump v1.34.4 #2590
• Full changelog

hypershift

• OCPBUGS-78484: fix(catalogs): update catalog image version cap to 4.21 #7956
• OCPBUGS-77456: Add dynamic NodePort range validation #7820
• OCPBUGS-77647: remove resource limits from Agent CAPI provider #7844
• OCPBUGS-78304: Fix context cancel accumulation in getMirrorFromICSPOrIDMS #7891
• OCPBUGS-78196: fix(sync-global-pullsecret): compare content ignoring trailing newlines #7914
• CNTRLPLANE-2812: feat(aro): Swift support #7826
• OCPBUGS-77365: Fix ignition-server pod restarts due to MIRRORED_RELEASE_IMAGE flapping #7834
• OCPBUGS-75930: [release-4.21] fix(cpo): Correct route labeling logic for HCP router infrastructure #7641
• OCPBUGS-75884: feat(updates): enable CVO metrics access with RHOBS monitoring flag #7632
• fix: OCPBUGS-74104: Fix CVE-2025-58183 #7545
• Full changelog

ibm-vpc-block-csi-driver

• OCPBUGS-77203: [release-4.21] standardize build paths #121
• Full changelog

insights-operator

• OCPBUGS-76960: Extends the time for the extractor liveness probe #1233
• Full changelog

insights-runtime-exporter, insights-runtime-extractor

• OCPBUGS-77491: remove dnf cache from the container images #64
• Fix EAP 8.1 e2e test #65
• Full changelog

ironic

• ART-14497: Fix ART builds with -minimal #809
• OCPBUGS-76934: Bump keystonemiddleware version to 10.9.0-0.20260216145500.557d173 for CVE-2026-22797 fix #791
• Full changelog

keepalived-ipfailover

• OCPBUGS-78048: openshift-enterprise-base: remove subscription-manager, dbus, systemd #226
• Full changelog

machine-config-operator

• OCPBUGS-78528: Fix e2e iri tests #5759
• OCPBUGS-78201: kubelet: Less aggressive low memory reservation #5756
• OCPBUGS-77833: Update AMI Whitelist #5743
• OCPBUGS-77689: Create admin-ack gates for azure/vsphere clusters upgrading to 4.22 #5735
• OCPBUGS-77577: Fix failure domain matching during vsphere boot image updates #5727
• OCPBUGS-77534: Update AMI Whitelist #5722
• OCPBUGS-77354: Clean up vsphere login error logging #5705
• OCPBUGS-76555: Remove MCD liveness probe #5651
• OCPBUGS-77072: mcd_config_drift not working properly #5675
• OCPBUGS-76823: reduce MCO image size #5657
• Full changelog

machine-image-customization-controller

• OCPBUGS-77031: Add IPA messages for console and SSH login #163
• OCPBUGS-77490: Clean up dnf cache to reduce container image size #164
• Full changelog

monitoring-plugin

• NO-JIRA: [release-4.21] e2e-monitoring fixing loop on legacy dashboard #828
• OCPBUGS-77227: [openshift-4.21] CVE-2026-25639 openshift4/ose-monitoring-plugin-rhel9:Axios affected by Denial of Service via proto Key in mergeConfig #795
• OU-1062: [release-4.21] feat: mark alert menu active for incidents tab #761
• NO-JIRA: [release-4.21] simplify frontend build in Dockerfile.art #808
• Full changelog

multus-networkpolicy

• OCPBUGS-77489: Clean up dnf cache #100
• Full changelog

networking-console-plugin

• OCPBUGS-77225: Fix NAD creation using default namespace instead of selected one #349
• Full changelog

oauth-server

• OCPBUGS-77454: groupmapper: avoid mutating original group users slice when removing user #213
• Full changelog

oc-mirror

• CLID-549, OCPBUGS-78458: Update Dockerfile.tests to run Go integration tests #1371
• OCPBUGS-77222: Fix registriesd “unknown userid” failure for arbitrary UIDs #1358
• Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

• OCPBUGS-77712: Update NetworkPolicy egress to support HyperShift custom API ports #1246
• OCPBUGS-77067: Remove the collect-profiles info from the microshift kustomization file #1234
• Full changelog

operator-marketplace

• OCPBUGS-77580: Update NetworkPolicy egress to support HyperShift custom API ports #729
• Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

• OCPBUGS-76472: OCPBUGS-72532: Branch Sync release-4.22 to release-4.21 [12-19-2025] #3022
• OCPBUGS-77147: Minimize ACLs by combining ipBlocks into single ACL #2995
• OCPBUGS-77309: Clear stale conntrack UDP entries for nodePorts #3002
• OCPBUGS-77046, OCPBUGS-77086: [release-4.21] combined backport PR for 2 escalations #2984
• Full changelog

prometheus

• OCPBUGS-78581: [release-4.21] chore(kubernetes): deduplicate warning logs from the API #298
• Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

• OCPBUGS-77295: backport upstream fix to reconcile resources with inconsistent status #365
• OCPBUGS-74477: Validate webhookURL secret for MSTeams receiver in AlertmanagerConfig CRD #359
• Full changelog

stream-coreos, stream-coreos-extensions

• COS-3946: Backport rhel-10.2 support to release-4.21 branch #1898
• NO-JIRA: rhaos-pkgs-match-openshift: exclude known package mismatches #1889
• And 1 elided commits (e.g. from squash or rebase merges)
• Full changelog

tests

• OCPBUGS-78485: run resource request/limit check early #30879
• OCPBUGS-78192: Exclude disruption during NoExecuteTaintManager serial tests #30857
• OCPBUGS-78064: Update optimized builds test to use rpm -qa instead of dnf #30856
• OCPBUGS-78064: Allow test to tolerate running on minimal images #30852
• OCPBUGS-77823: add the missing namespace from managed openshift #30838
• OCPBUGS-77826: Remove exception for monitoring OLM Progression condition #30839
• OCPBUGS-77097: Add test for CPMS OnDelete strategy with full master replacement #30802
• : OCPBUGS-76856:cert tests: mark TLS registry test as informing #30779
• OCPBUGS-76529: Fix flakiness in MutableCSINodeAllocatableCount test #30772
• Full changelog

vsphere-csi-driver-operator

• OCPBUGS-74701: Fix update of stable-generation annotation #330
• Full changelog

---

View changelog in Markdown or change previous release: 4.21.0-okd-scos.84.21.0-okd-scos.74.21.0-okd-scos.64.21.0-okd-scos.54.21.0-okd-scos.44.21.0-okd-scos.34.21.0-okd-scos.24.21.0-okd-scos.14.21.0-okd-scos.04.20.0-okd-scos.174.20.0-okd-scos.164.20.0-okd-scos.154.20.0-okd-scos.144.20.0-okd-scos.134.20.0-okd-scos.124.20.0-okd-scos.114.20.0-okd-scos.104.20.0-okd-scos.94.20.0-okd-scos.84.20.0-okd-scos.74.20.0-okd-scos.64.20.0-okd-scos.54.20.0-okd-scos.44.20.0-okd-scos.34.20.0-okd-scos.24.20.0-okd-scos.14.20.0-okd-scos.04.19.0-okd-scos.194.19.0-okd-scos.184.19.0-okd-scos.174.19.0-okd-scos.164.19.0-okd-scos.154.19.0-okd-scos.144.19.0-okd-scos.134.19.0-okd-scos.124.19.0-okd-scos.114.19.0-okd-scos.104.19.0-okd-scos.94.19.0-okd-scos.84.19.0-okd-scos.74.19.0-okd-scos.64.19.0-okd-scos.54.19.0-okd-scos.44.19.0-okd-scos.34.19.0-okd-scos.24.19.0-okd-scos.14.19.0-okd-scos.04.18.0-okd-scos.104.18.0-okd-scos.94.18.0-okd-scos.84.18.0-okd-scos.74.18.0-okd-scos.64.18.0-okd-scos.54.18.0-okd-scos.44.18.0-okd-scos.34.18.0-okd-scos.24.18.0-okd-scos.14.18.0-okd-scos.04.17.0-okd-scos.34.17.0-okd-scos.24.17.0-okd-scos.14.17.0-okd-scos.04.16.0-okd-scos.14.16.0-okd-scos.04.16.0-0.okd-scos-2024-09-24-1517474.16.0-0.okd-scos-2024-08-21-1556134.15.0-0.okd-scos-2024-01-18-223523───5.0.0-0.okd-scos-nightly-2026-03-18-1616215.0.0-0.okd-scos-nightly-2026-03-18-0416215.0.0-0.okd-scos-nightly-2026-03-17-1157065.0.0-0.okd-scos-nightly-2026-03-16-2357065.0.0-0.okd-scos-nightly-2026-03-12-145545───5.0.0-0.okd-scos-2026-02-24-143251───4.23.0-0.okd-scos-nightly-2026-03-09-153314───4.23.0-0.okd-scos-2026-03-09-153314───4.22.0-0.okd-scos-nightly-2026-03-18-1524164.22.0-0.okd-scos-nightly-2026-03-18-0324164.22.0-0.okd-scos-nightly-2026-03-17-1358234.22.0-0.okd-scos-nightly-2026-03-17-0005224.22.0-0.okd-scos-nightly-2026-03-16-1205224.22.0-0.okd-scos-nightly-2026-03-13-0922554.22.0-0.okd-scos-nightly-2026-03-12-2122554.22.0-0.okd-scos-nightly-2026-03-12-0922554.22.0-0.okd-scos-nightly-2026-03-11-1650104.22.0-0.okd-scos-nightly-2026-03-11-045010───4.22.0-0.okd-scos-2026-03-18-1919494.22.0-0.okd-scos-2026-03-18-0719494.22.0-0.okd-scos-2026-03-17-1919494.22.0-0.okd-scos-2026-03-17-0716344.22.0-0.okd-scos-2026-03-16-1916334.22.0-0.okd-scos-2026-03-16-0716324.22.0-0.okd-scos-2026-03-15-191631───4.21.0-0.okd-scos-nightly-2026-03-18-2149274.21.0-0.okd-scos-nightly-2026-03-18-0949274.21.0-0.okd-scos-nightly-2026-03-17-2149274.21.0-0.okd-scos-nightly-2026-03-17-0949274.21.0-0.okd-scos-nightly-2026-03-16-2149274.21.0-0.okd-scos-nightly-2026-03-16-005736───4.21.0-0.okd-scos-2026-03-18-1340014.21.0-0.okd-scos-2026-03-18-0140014.21.0-0.okd-scos-2026-03-17-1340014.21.0-0.okd-scos-2026-03-17-0140014.21.0-0.okd-scos-2026-03-16-134001───4.20.0-0.okd-scos-2026-02-10-1309514.20.0-0.okd-scos-2026-02-07-0016394.20.0-0.okd-scos-2026-02-06-1216394.20.0-0.okd-scos-2026-02-06-0016394.20.0-0.okd-scos-2026-02-05-1216384.20.0-0.okd-scos-2026-02-05-0016374.20.0-0.okd-scos-2026-02-04-121636───4.19.0-0.okd-scos-2025-10-25-0018304.19.0-0.okd-scos-2025-10-24-1218294.19.0-0.okd-scos-2025-10-24-0018284.19.0-0.okd-scos-2025-10-23-1218284.19.0-0.okd-scos-2025-10-23-001828───4.18.0-0.okd-scos-2025-05-27-0825374.18.0-0.okd-scos-2025-05-26-2025374.18.0-0.okd-scos-2025-05-26-0825374.18.0-0.okd-scos-2025-05-23-0333574.18.0-0.okd-scos-2025-05-22-153357───4.17.0-0.okd-scos-2025-02-25-0904554.17.0-0.okd-scos-2025-02-24-2104554.17.0-0.okd-scos-2025-02-24-0904544.17.0-0.okd-scos-2025-02-23-2104544.17.0-0.okd-scos-2025-02-22-211215───4.16.0-0.okd-scos-2025-01-06-1432414.16.0-0.okd-scos-2025-01-04-1456004.16.0-0.okd-scos-2025-01-04-0142364.16.0-0.okd-scos-2025-01-03-1342364.16.0-0.okd-scos-2025-01-03-0142364.16.0-0.okd-scos-2024-12-17-0222464.16.0-0.okd-scos-2024-11-24-1100454.16.0-0.okd-scos-2024-11-23-1818454.16.0-0.okd-scos-2024-11-23-0618454.16.0-0.okd-scos-2024-11-22-1818454.16.0-0.okd-scos-2024-11-22-061845───4.15.0-0.okd-scos-2024-12-16-1913164.15.0-0.okd-scos-2024-01-18-1035224.15.0-0.okd-scos-2024-01-17-2235214.15.0-0.okd-scos-2024-01-17-1035204.15.0-0.okd-scos-2024-01-16-223519───4.15.0-0.okd-2025-06-27-1341344.15.0-0.okd-2025-06-17-1652194.15.0-0.okd-2025-05-02-1402244.15.0-0.okd-2025-04-03-2126204.15.0-0.okd-2025-04-02-1800124.15.0-0.okd-2024-03-27-1109014.15.0-0.okd-2024-03-26-2309014.15.0-0.okd-2024-03-23-1640104.15.0-0.okd-2024-03-23-0440104.15.0-0.okd-2024-03-22-164010───4.15.0-0.okd-2024-03-10-0101164.15.0-0.okd-2024-02-23-1634104.15.0-0.okd-2024-02-10-0355344.15.0-0.okd-2024-01-27-070424───4.22.0-okd-scos.ec.104.22.0-okd-scos.ec.94.22.0-okd-scos.ec.84.22.0-okd-scos.ec.74.22.0-okd-scos.ec.64.22.0-okd-scos.ec.54.22.0-okd-scos.ec.44.22.0-okd-scos.ec.34.22.0-okd-scos.ec.24.22.0-okd-scos.ec.14.22.0-okd-scos.ec.04.21.0-okd-scos.ec.194.21.0-okd-scos.ec.184.21.0-okd-scos.ec.174.21.0-okd-scos.ec.164.21.0-okd-scos.ec.154.21.0-okd-scos.ec.144.21.0-okd-scos.ec.134.21.0-okd-scos.ec.124.21.0-okd-scos.ec.114.21.0-okd-scos.ec.104.21.0-okd-scos.ec.94.21.0-okd-scos.ec.84.21.0-okd-scos.ec.74.21.0-okd-scos.ec.64.21.0-okd-scos.ec.54.21.0-okd-scos.ec.44.21.0-okd-scos.ec.34.21.0-okd-scos.ec.24.21.0-okd-scos.ec.14.21.0-okd-scos.ec.0

Source code for this page located on github