Back to index

Download installer and client with:

oc adm release extract --tools quay.io/okd/scos-release:4.16.0-okd-scos.0

Team Approvals:

Tests:

• Blocking jobs
  • upgrade Succeeded release-openshift-okd-scos-installer-e2e-aws-upgrade-from-scos-stable

Upgrades from:

• 4.16.0-0.okd-scos-2024-09-24-151747 - Success

---

Changes from 4.16.0-0.okd-scos-2024-09-24-151747

Created: 2024-10-29 20:36:21 +0000 UTC

Image Digest: sha256:830fef3e885e0eb63b2a4fc5352cb1729506d5ec3ba21c71fd26247c3530312d

Release 4.16.0-okd-scos.0 was created from registry.ci.openshift.org/origin/release-scos:4.16.0-0.okd-scos-2024-10-29-062255

Components

• Kubectl 1.29.7
• Kubernetes upgraded from 1.29.8 to 1.29.9
• Kubernetes Tests 1.29.0
• CentOS Stream CoreOS upgraded from 418.9.202409241032-0 to 416.9.202410282248-0 (diff)

Rebuilt images without code change

• stream-coreos sha256:6ef24762433130a6993225964d9dea1306e2c03df5b27daacc13390c714d2920
• stream-coreos-extensions sha256:f9e85a6d1f779ad178a4268062a8d72f4027c31281f43eb61dc6334a53eb41a1

agent-installer-api-server

• OCPBUGS-43021: Update go-jose to v2.6.3 to mitigate CVE-2024-28180 (#6893) #6893
• OCPBUGS-42570: Libraries bump to mitigate CVE-2024-27289 (#6833) #6833
• Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

• OCPBUGS-43025: Pick up latest CVE changes by bumping service (#920) #920
• Full changelog

agent-installer-node-agent

• OCPBUGS-43028: Pick up latest CVE changes by bumping service (#804) #804
• OCPBUGS-42300: Switch to github.com/docker/distribution/reference to Mitigate CVE-2024-3727 (#785) #785
• Full changelog

aws-kms-encryption-provider

• OCPBUGS-33693: Updating aws-kms-encryption-provider-container image to be consistent with ART for 4.16 #18
• hack: display diff on verify-mod-tidy failure #26
• Full changelog

azure-kms-encryption-provider

• OCPBUGS-33692: Updating azure-kms-encryption-provider-container image to be consistent with ART for 4.16 #4
• Full changelog

baremetal-installer, installer, installer-altinfra, installer-artifacts

• OCPBUGS-41490: Update RHCOS 4.16 bootimage metadata to 416.94.202410172137-0 #9132
• OCPBUGS-42014: Update terraform provider for google #9077
• OCPBUGS-38732: vsphere, if secureboot is enabled, disable it in the template #8904
• OCPBUGS-39415: OpenStack: Install CI dependencies from rpm #8995
• OCPBUGS-41334: Fix IPv6 security group rule for schedulable master #8971
• OCPBUGS-38687: only allow a single network in failure domain topology #8875
• OCPBUGS-42062: OCPBUGS-41865: [release-4.16] vault version updated to 1.13.10 #9036
• Full changelog

cli, cli-artifacts, deployer, tools

• OCPBUGS-42720: Check cast result in adm prune deployments to prevent panic #1891
• Full changelog

cloud-credential-operator

• OCPBUGS-43645: Only attempt timed token credentials on supported platforms. #772
• OCPBUGS-43337: Update github.com/sirupsen/logrus v1.9.3 #767
• Full changelog

cluster-authentication-operator

• OCPBUGS-43367: manifests should not use APIs that are removed in upcoming releases #717
• Full changelog

cluster-cloud-controller-manager-operator

• OCPBUGS-42125: IBMCloud: Modify liveness probe for IBM Cloud CCM to use loopback address #366
• OCPBUGS-43473: update goimports targets #372
• Full changelog

cluster-etcd-operator

• OCPBUGS-33673: rename flowschema to avoid log noise in CVO #1348
• OCPBUGS-37820: ensure ordering in member health checks #1311
• Full changelog

cluster-image-registry-operator

• OCPBUGS-43555: pkg/storage/azure: also check for auth failure error code on deletion #1143
• OCPBUGS-42933: azureclient: stop validating credentials when creating the client #1134
• OCPBUGS-42420: Continuous pull-secret updates / slow initialization on build01 (test platform infrastructure) #1126
• Full changelog

cluster-monitoring-operator

• OCPBUGS-43826: Add runbook url for TelemeterClientFailures #2508
• Full changelog

cluster-network-operator

• OCPBUGS-43544: Use CNIConfDir for mounting directory to ovn-ipsec-host pod #2537
• OCPBUGS-43035: Configure narrowing=yes for IPsec connections #2528
• OCPBUGS-36594: Set mount propagation to HostToContainer for /var/lib/kubelet #2430
• Full changelog

cluster-storage-operator

• OCPBUGS-43315: assets: shared-resource: hypershift: add pull-secret to operator SA #521
• NO-JIRA: release-4.16: Run make update #512
• Full changelog

cluster-update-keys

• OCPBUGS-43467: keys: Update Red Hat keys to use SHA256 signatures #64
• Full changelog

console

• OCPBUGS-35204: replace global refresh sync lock in OIDC provider with per-refresh-token one #13950
• OCPBUGS-36556: Increase login flow state paramater length/entropy #14354
• OCPBUGS-42369: Console crashes when ssh is selected in add secret for starting a pipeline run #14320
• OCPBUGS-41904: fix annotation for ovn localnet #14366
• OCPBUGS-37615: Include PatternFly-4 chart styles so they are available for dynamic plugins that still use PF4 react-charts #14091
• OCPBUGS-37689: Switch to use annotations as labels from PipelineRuns created through Pipelines as Code is deprecated #14094
• OCPBUGS-42015: Topology screen crashes when completed pod is selected #14298
• OCPBUGS-35850: Fix: Quick Start “next” button requires double click to move to next step #13989
• OCPBUGS-42382: Allow operators to enable monitoring by default #14317
• OCPBUGS-41905: List of default Camel K event sources disappears when adding a custom event source #14290
• OCPBUGS-41709: Need to allow blank for Project/namespace when setting SA Subject in ‘Project access tab’ #14278
• OCPBUGS-42069: add Create button to Console plugins tab #14302
• Full changelog

csi-driver-manila-operator

• OCPBUGS-38458: Add missing healthchecks #241
• Full changelog

hyperkube, installer-kube-apiserver-artifacts, pod

• OCPBUGS-42168: Bump k8s api to 1.29.9 #2090
• release-4.16] OCPBUGS-42057: UPSTREAM: <drop>: bump(github.com/openshift/apiserver-library-go) #2096
• Full changelog

hypershift

• OCPBUGS-43840: add ValidIDPConfiguration condition to report IDP config issues #4985
• NO-JIRA: chore(deps): update konflux references (release-4.16) #4971
• OCPBUGS-43046: Do not send traffic to local audit-webhook through konnectivity #4883
• NO-JIRA: chore(deps): update konflux references (release-4.16) #4954
• NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.42 (release-4.16) #4947
• NO-JIRA: chore(deps): update konflux references (release-4.16) #4933
• OCPBUGS-43104: label routes only when HCP router used #4899
• OCPBUGS-43308: Use guest DNS resolution in Konnectivity HTTPS proxy by default #4905
• NO-JIRA: chore(deps): update konflux references (release-4.16) #4923
• NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.41 (release-4.16) #4919
• NO-JIRA: chore(deps): update konflux references to 674e70f (release-4.16) #4908
• NO-JIRA: chore(deps): update konflux references (release-4.16) #4896
• NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.40 (release-4.16) #4880
• OCPBUGS-42432: Use KubeClientCABundle for HostedClusterConfigOperator cluster-signer-ca #4799
• OCPBUGS-42342: Let payload generation pick the release for the NodePool #4787
• OCPBUGS-42431: Conditionally manage kubeconfig secrets for DNS and Ingress operators #4798
• NO-JIRA: chore(deps): update konflux references (release-4.16) #4853
• OCPBUGS-42608: Add Annotation to skip deleting hcp namespace #4830
• NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.39 (release-4.16) #4827
• chore(deps): update konflux references (release-4.16) #4816
• NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.38 (release-4.16) #4806
• NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.37 (release-4.16) #4796
• Full changelog

ibm-vpc-block-csi-driver-operator

• OCPBUGS-42286: Reorder static resources to create RBAC first #129
• Full changelog

ibmcloud-machine-controllers

• OCPBUGS-36698: IBMCloud: Handle pagination for subnets #42
• Full changelog

insights-operator

• OCPBUGS-39564: Not able to enable repositories during entitled build in OCP Cluster on IBM-Z (#1013) #1013
• Full changelog

ironic

• OCPBUGS-43438: Include fixes for CVE-2024-5569 #599
• OCPBUGS-42511: Include fix for CVE-2024-47211 #594
• OCPBUGS-39017: Bump ironic-lib to fix utf8 decoding issue #569
• OCPBUGS-38797: redfish-virtualmedia fails on XFusion nodes #564
• OCPBUGS-42113: Update ironic-inspector to fix the memory leak #587
• Full changelog

ironic-agent

• OCPBUGS-39017: Bump ironic-lib to fix utf8 decoding issue #156
• Full changelog

kube-proxy, sdn

• OCPBUGS-43344: OCPBUGS-42244: Implement namespaceSelectors on ingress with all pods IPs #635
• OCPBUGS-42203: fix UDP conntrack cleanup #636
• Full changelog

kube-rbac-proxy

• OCPBUGS-30447: protobuf bump [4.16] #111
• Full changelog

machine-api-operator

• OCPBUGS-43433: Vsphere: Handle cloned instance with lost taskID #1298
• Full changelog

machine-config-operator

• OCPBUGS-42109: Do not use ‘restart’ for ‘oneshot’ service #4616
• OCPBUGS-42744: Check for kernel arg diff in updateOnClusterBuild #4628
• OCPBUGS-42722: Panic seen in CI job for MCC pod #4626
• OCPBUGS-42719: MCPs report wrong number of nodes when we move nodes from one custom MCP to another custom MCP #4625
• OCPBUGS-41293: Enable the use of Linux Bridge as the ovs default port connection #4563
• OCPBUGS-41256: Set ESP offloads off in bonds if slaves don’t support them #4627
• Full changelog

monitoring-plugin

• OCPBUGS-43239: upgrade dynamic plugin sdk to remove vulnerable dependencies 4.16 #217
• OCPBUGS-42424: fix path-to-regexp dependency #197
• Full changelog

must-gather

• OCPBUGS-43056: Open [Release-4.16] Multus is now a Pod and will be captured by normal #449
• Full changelog

openshift-apiserver

• OCPBUGS-42724: fail image import when both image and error are nil #455
• Full changelog

openshift-controller-manager

• NO-JIRA: cleanup root and app OWNERS #347
• OCPBUGS-42420: Continuous pull-secret updates / slow initialization on build01 (test platform infrastructure) #343
• Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

• OCPBUGS-41551: Add subnet overlap check for transit switch subnet #2306
• Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

• OCPBUGS-42878: Add compute resource entity to consider a standalone cluster for volu… #131
• Full changelog

---

View changelog in Markdown or change previous release: 4.16.0-0.okd-scos-2024-09-24-1517474.16.0-0.okd-scos-2024-08-21-1556134.15.0-0.okd-scos-2024-01-18-223523───4.18.0-0.okd-scos-2024-11-21-0211394.18.0-0.okd-scos-2024-11-20-1411384.18.0-0.okd-scos-2024-11-20-0209584.18.0-0.okd-scos-2024-11-19-1409574.18.0-0.okd-scos-2024-11-19-0209564.18.0-0.okd-scos-2024-11-18-140955───4.17.0-0.okd-scos-2024-11-20-2214034.17.0-0.okd-scos-2024-11-20-1014034.17.0-0.okd-scos-2024-11-19-2214034.17.0-0.okd-scos-2024-11-19-1014034.17.0-0.okd-scos-2024-11-18-2214034.17.0-0.okd-scos-2024-11-18-101403───4.16.0-0.okd-scos-2024-11-21-0014434.16.0-0.okd-scos-2024-11-20-1214434.16.0-0.okd-scos-2024-11-20-0014434.16.0-0.okd-scos-2024-11-19-1214434.16.0-0.okd-scos-2024-11-19-0014434.16.0-0.okd-scos-2024-11-18-121443───4.15.0-0.okd-scos-2024-05-13-2236094.15.0-0.okd-scos-2024-04-25-1837084.15.0-0.okd-scos-2024-04-25-0637084.15.0-0.okd-scos-2024-04-24-1837084.15.0-0.okd-scos-2024-04-24-0637084.15.0-0.okd-scos-2024-01-18-1035224.15.0-0.okd-scos-2024-01-17-2235214.15.0-0.okd-scos-2024-01-17-1035204.15.0-0.okd-scos-2024-01-16-223519───4.15.0-0.okd-2024-11-14-2031284.15.0-0.okd-2024-11-09-0406444.15.0-0.okd-2024-11-08-1606444.15.0-0.okd-2024-11-05-1344204.15.0-0.okd-2024-11-05-0144204.15.0-0.okd-2024-03-27-1109014.15.0-0.okd-2024-03-26-2309014.15.0-0.okd-2024-03-23-1640104.15.0-0.okd-2024-03-23-0440104.15.0-0.okd-2024-03-22-164010───4.17.0-okd-scos.ec.34.17.0-okd-scos.ec.24.17.0-okd-scos.ec.14.17.0-okd-scos.ec.04.17.0-0.okd-scos-2024-09-30-1017394.17.0-0.okd-scos-2024-09-26-2248284.17.0-0.okd-scos-2024-09-24-1048284.17.0-0.okd-scos-2024-08-21-100712───4.15.0-0.okd-2024-03-10-0101164.15.0-0.okd-2024-02-23-1634104.15.0-0.okd-2024-02-10-0355344.15.0-0.okd-2024-01-27-070424

Source code for this page located on github