5.0.0-okd-scos.0

Manual Override Applied

This release was manually Accepted.

Reason: Manually accepted per TRT

Download installer and client with:

oc adm release extract --tools quay.io/okd/scos-release:5.0.0-okd-scos.0

Qualifiers (status api): None

Tests:

Blocking jobs
- upgrade Succeeded release-openshift-okd-scos-installer-e2e-aws-upgrade-from-scos-stable
- upgrade-minor Pending release-openshift-okd-scos-installer-e2e-aws-upgrade-from-scos-stable

Upgrades from:

5.0.0-okd-scos.ec.10 (changes) - Success
4.22.0-okd-scos.10 (changes) - Failed Success
4.22.0-okd-scos.9 (changes) - Failed Success
4.22.0-okd-scos.8 (changes) - Failed Success
4.22.0-okd-scos.7 (changes) - Failed Success
4.22.0-okd-scos.6 (changes) - Success
4.22.0-okd-scos.5 (changes) - Success
4.22.0-okd-scos.4 (changes) - Success
4.22.0-okd-scos.3 (changes) - Failed Success
4.22.0-okd-scos.2 (changes) - Failed Success
4.22.0-okd-scos.1 (changes) - Failed Success
4.22.0-okd-scos.0 (changes) - Failed Success
4.21.0-okd-scos.11 - Failed

Loading changelog, this may take a while ...

Changes from 4.21.0-okd-scos.11

Created: 2026-09-17 08:00:35 +0000 UTC

Image Digest: sha256:eca01dee0f0690a8149d58f0a8c7e3187f624d583c1b713dc660bd1b28c2dfbc

Release 5.0.0-okd-scos.0 was created from registry.ci.openshift.org/origin/release-scos:5.0.0-0.okd-scos-nightly-2026-09-16-204152

Components

Kubectl upgraded from 1.34.1 to 1.36.2
Kubernetes upgraded from 1.34.7 to 1.36.3
Kubernetes Tests upgraded from 1.34.1 to 1.36.2
CentOS Stream CoreOS 10 upgraded from 10.0.20260414-0 to 10.0.20260819-0

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	OKD Hypershift	OKD SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
AdditionalRoutingCapabilities (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
AdminNetworkPolicy (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
AlibabaPlatform (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
AzureClusterHostedDNSInstall (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
CPMSMachineNamePrefix (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ConsolePluginContentSecurityPolicy (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
GCPClusterHostedDNS (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
GCPClusterHostedDNSInstall (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
GatewayAPI (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
GatewayAPIController (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
HighlyAvailableArbiter (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ImageVolume (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
KMSEncryptionProvider (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
MachineConfigNodes (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ManagedBootImages (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ManagedBootImagesAWS (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ManagedBootImagesAzure (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ManagedBootImagesvSphere (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
NetworkDiagnosticsConfig (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
NetworkLiveMigration (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
NetworkSegmentation (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
NewOLMPreflightPermissionChecks (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
PinnedImages (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
PreconfiguredUDNAddresses (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ProcMountType (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
RouteAdvertisements (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
RouteExternalCertificate (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
TranslateStreamCloseWebsocketRequests (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
UserNamespacesPodSecurityStandards (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
UserNamespacesSupport (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
VolumeAttributesClass (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (New)	Unconditionally Enabled (New)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
AWSClusterHostedDNSInstall (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled (New)	Enabled (New)	Enabled	Enabled
AWSDualStackInstall (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled (New)	Enabled (New)	Enabled	Enabled
AWSServiceLBNetworkSecurityGroup (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled (New)	Enabled (New)	Enabled	Enabled
BootImageSkewEnforcement (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled (New)	Enabled (New)	Enabled	Enabled
DualReplica (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled (New)	Enabled (New)	Enabled	Enabled
EtcdBackendQuota (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled (New)	Enabled (New)	Enabled	Enabled
IngressControllerDynamicConfigurationManager (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled (New)	Enabled (New)	Enabled	Enabled
InsightsConfig (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled (New)	Enabled (New)	Enabled	Enabled
InsightsOnDemandDataGather (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled (New)	Enabled (New)	Enabled	Enabled
IrreconcilableMachineConfig (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled (New)	Enabled (New)	Enabled	Enabled
ManagedBootImagesCPMS (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled (New)	Enabled (New)	Enabled	Enabled
MutableCSINodeAllocatableCount (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled (New)	Enabled (New)	Enabled	Enabled
MutatingAdmissionPolicy (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled (New)	Enabled (New)	Enabled	Enabled
OSStreams (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled (New)	Enabled (New)	Enabled	Enabled
VSphereHostVMGroupZonal (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled (New)	Enabled (New)	Enabled	Enabled
VSphereMixedNodeEnv (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled (New)	Enabled (New)	Enabled	Enabled
VolumeGroupSnapshot (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled (New)	Enabled (New)	Enabled	Enabled
NoRegistryClusterInstall (0 tests)	Disabled	Enabled (Changed)	Disabled	Enabled		Enabled (New)	Disabled	Enabled
AdditionalStorageConfig (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
EVPN (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
ExternalOIDCWithUpstreamParity (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
GCPSovereignCloudInstall (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
GatewayAPIWithoutOLM (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
IngressControllerMultipleHAProxyVersions (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
SELinuxMountGAReadiness (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
ClusterAPIMachineManagementVSphere (0 tests)	Disabled	Disabled	Enabled	Enabled			Enabled (Changed)	Enabled (Changed)
ExternalSnapshotMetadata (0 tests)	Disabled	Disabled	Enabled	Enabled			Enabled (Changed)	Enabled (Changed)
NewOLMBoxCutterRuntime (0 tests)	Disabled	Disabled	Disabled	Enabled (Changed)			Disabled	Enabled (Changed)
CRIOCredentialProviderConfig (0 tests)		Enabled (New)		Enabled (New)		Enabled (New)		Enabled (New)
OLMLifecycleAndCompatibility (0 tests)		Enabled (New)		Enabled (New)		Enabled (New)		Enabled (New)
AWSEuropeanSovereignCloudInstall (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
AuthenticationComponentProxy (0 tests)				Enabled (New)				Enabled (New)
BGPBasedVIPManagement (0 tests)			Enabled (New)	Enabled (New)
ClusterAPIComputeInstall (0 tests)			Enabled (New)	Enabled (New)
ClusterAPIControlPlaneInstall (0 tests)			Enabled (New)	Enabled (New)
ClusterAPIMachineManagementAWS (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
ClusterAPIMachineManagementAzure (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
ClusterAPIMachineManagementBareMetal (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
ClusterAPIMachineManagementGCP (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
ClusterAPIMachineManagementOpenStack (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
ClusterAPIMachineManagementPowerVS (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
ClusterUpdateAcceptRisks (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
ClusterUpdatePreflight (0 tests)			Enabled (New)	Enabled (New)
ConfidentialCluster (0 tests)			Enabled (New)	Enabled (New)
ConfigurablePKI (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
ExternalOIDCExternalClaimsSourcing (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
GatewayAPIManagementMode (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
IngressComponentRouteLabels (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
KarpenterOperator (0 tests)				Enabled (New)
MachineAPIMigrationAWS (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
MachineAPIMigrationAzure (0 tests)
MachineAPIMigrationBareMetal (0 tests)
MachineAPIMigrationGCP (0 tests)
MachineAPIMigrationOpenStack (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
MachineAPIMigrationPowerVS (0 tests)
MachineAPIMigrationVSphere (0 tests)			Enabled (New)	Enabled (New)
MutableTopology (0 tests)				Enabled (New)
NetworkConnect (0 tests)			Enabled (New)	Enabled (New)
NetworkObservabilityInstall (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
NewOLMConfigAPI (0 tests)				Enabled (New)				Enabled (New)
NoOverlayMode (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
TLSAdherence (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
TLSGroupPreferences (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
VSphereMultiVCenterDay2 (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)

New images

aws-node-termination-handler git 9b33cce5 sha256:78bcd8ae33ed52dd3c768b44dbc65e95a94fad0ae7246caa8086be709eee1543
cluster-kube-cluster-api-operator git aec49344 sha256:7f80eb8bc334c89d862585495f1f3409617a53fe73fcb225170050662c9f34d2
haproxy-router-haproxy28 git 33812291 sha256:7572c0892ad921b55236e7bd9132b3196b8b94423873a287c9861b31bcb44e01
haproxy-router-haproxy32 git 33812291 sha256:7c469e2c4fb8a6b3ab86088f7e4720df542e222c34645506482a1ee8ed6bcddd
installer-etcd-artifacts git 609b11ed sha256:0012ec08597da27d28dfe283593debb411e77f1debaec4f4deb83261f5e0d5ef
installer-kube-apiserver-artifacts git b376ee7b sha256:51da52dbbec68775197367459ad1f932036280835d3721a334660303cbcb64d4
karpenter-operator git 56725605 sha256:4edbdd1a2c9376bdd4b0fde07e1fd7a3e7d44d03a7ab7df130422acf74e7f0c8
kube-vip git 1bb8a96e sha256:3538b78b71f646e6fcdaf7c12fd8bc3feb2caf84b6c7ecb701b91a88b6363ae5

agent-installer-api-server

OCPBUGS-87328: Updating ose-agent-installer-api-server-container image to be consistent with ART for 5.0 #10434
OCPBUGS-120841: Fix NUMAResourcesOperator CR name so it can be applied #10923
OCPBUGS-107941: Bump go.opentelemetry.io/otel to v1.44.0 for CVE-2026-41178 #10855
OCPBUGS-120739: added missing subscription name for lvms-operator #10916
NO-ISSUE: [master] Bump OCP versions: 4.21, 4.17, 4.22, 4.19, 4.18, 4.14, 4.16, 4.20 #10804
ACM-40452: CVE-2026-33815 Bump github.com/jackc/pgx/v5 to v5.9.0 #10783
ACM-40510: Fix infrastructure-operator NetworkPolicy egress to kubernetes API #10792
NO-ISSUE: Update oc-mirror locations to CGW following openshift release decoupling #10601
ACM-40436: Bump Go toolchain to go1.26.5 to fix stdlib CVEs #10770
OCPBUGS-93750: Bump github.com/moby/moby to v28.5.2 #10680
MGMT-24827: Resource-scoped auth for urlAuth endpoints #10667
MGMT-24831: Add ntpSources field to InfraEnv and AgentClusterInstall CRDs #10756
ACM-30180: Honor cluster TLS security profile in Infrastructure Operator #10734
NO-ISSUE: [master] Bump OCP versions: 4.22 #10735
MGMT-24939: (assisted-service) Upgrade operator-sdk from v1.10.1 to v1.42.3 (kubebuilder v3→v4 migration) #10716
NO-ISSUE: [master] Bump OCP versions: 4.16, 4.14, 5.0 #10733
MGMT-24903: Fall back to CoreOS image from worker ignition for day-2 persistent-boot #10717
MULTIARCH-6274: agent: Enable platform external s390x #10424
MGMT-24352: Reset finalizing timeout on transition from installing-pending-user-action #10293
OCPBUGS-97919: fix: use typed credentials key to support MAC-based fencing in ABI flow #10477
ACM-38238: Assisted-installer repos: Set Up Set up Renovate configuration to automatically create Hive API Synchronization PRs #10711
OCPBUGS-91733: manifest_generator add a label to LUKS root #10676
NO-ISSUE: [master] Bump OCP versions: 4.18, 4.19 #10724
NO-ISSUE: Refresh RPM lockfiles RPM lockfile refresh [SECURITY] #10718
NO-ISSUE: [master] Bump OCP versions: 4.20, 4.21, 4.22 #10715
NO-ISSUE: [master] Bump OCP versions: 4.13, 4.18, 4.19 #10710
ACM-35865: CVE-2026-39828 Bump golang.org/x/crypto to v0.52.0 using replace directive (client module) #10617
MGMT-23744: CVE-2026-33997 Bump docker/docker to v28.5.2 #10685
NO-ISSUE: [master] Bump OCP versions: 4.16, 4.14, 4.22, 4.21, 4.19, 4.20, 4.18 #10692
MGMT-24667: Fix disconnected ZTP spoke installs for OCP 5.0 OSImageStream images #10527
MGMT-24699: Assisted Service IPv6 CIDR comparison may fail with non-normalized CIDRs #10569
MGMT-24327: upgrade assisted-service postgresql from 15 to 16 #10519
ACM-35865: CVE-2026-39828 Bump golang.org/x/crypto to v0.52.0 using replace directive (api module) #10618
ACM-35865: CVE-2026-39828 Bump golang.org/x/crypto to v0.52.0 using replace directive (models module) #10616
NO-ISSUE: [master] Bump OCP versions: 4.18, 5.0, 4.20, 4.16, 4.22, 4.19, 4.21, 4.14, 4.17 #10622
MGMT-24786: Add resource-scoped authorization for local auth tokens #10603
NO-ISSUE: Refresh RPM lockfiles RPM lockfile refresh #10581
MGMT-18886: OS Streams #10428
NO-ISSUE: hive-operator was migrated from community-operators to upstream-community-operators #10600
MGMT-24682: Remove LSO and LVMS as CNV operator dependencies #10541
MGMT-24705: CVE-2026-53488 Bump github.com/containerd/containerd to v1.7.33 through indirect dependency conversion #10572
ACM-36420: CVE-2026-39821 Bump golang.org/x/net to v0.55.0 #10548
NO-ISSUE: [master] Bump OCP versions: 4.21, 4.22, 4.20 #10568
MGMT-24400: Document TestVersion API and usage guidance #10426
NO-ISSUE: [master] Bump OCP versions: 4.20, 4.21, 4.18, 4.19, 4.13, 4.22, 4.16, 5.0 #10546
MGMT-24673: PATCH /v2/clusters/{id} does not return updated operator_bundles #10536
NO-ISSUE: Update linter version #10509
APPSRE-14691: add monitoring.rhobs/v1 ServiceMonitors for COO compatibility #10540
OCPBUGS-93368: Simplify IRI api dependency #10528
NO-ISSUE: Refresh RPM lockfiles RPM lockfile refresh [SECURITY] #10523
MGMT-24443: watch configmap for CNI config update #10384
OCPBUGS-91974: Stop setting DevPreviewNoUpgrade for TNF clusters #10507
MGMT-24635: Incorrect grammar in OpenShift AI GPU validation message #10511
ACM-35864: CVE-2026-39828/39829/39830 Bump golang.org/x/crypto to v0.52.0 #10495
MGMT-24453: upgrade to golang 1.26 for assisted-service #10396
MGMT-24610: Get OCP lifecycle data via api/v2 and update the product’s name #10478
ACM-34978: apply disk encryption defaults on cluster create and update #10442
OCPBUGS-87099: Add sourcedir /run/chrony-dhcp to generated chrony.conf #10479
MGMT-21368: Log slow queries gorm #10457
MGMT-23234: [BE] Improve the UX around the amd/nvidia operators selection - add profile to selection #10387
MGMT-24398, MGMT-24399: Migrate test versions to OCP version builder #10412
MGMT-22787: Limit inventory output #10374
ACM-35140: CVE-2025-58058 Bump github.com/ulikunitz/xz to v0.5.15 #10450
NO-ISSUE: [master] Bump OCP versions: 5.0, 4.21 #10472
ACM-35141: CVE-2025-58058 Bump github.com/ulikunitz/xz to v0.5.15 through indirect dependency conversion #10461
MGMT-24571: Fix initrd PPI reboot loop by comparing correct image URL #10456
NO-ISSUE: [master] Bump OCP versions: 4.19 #10449
MGMT-24551: Add vNIC NFD rule and refine NIC subsystem matchers #10448
MGMT-24336: Bump LSO catalog fallback to v4.22 for OCP 5.0 #10437
MGMT-24410: Fixes for installer cache #10397
MGMT-24550: Migrate NFD NodeFeatureRule apiVersion to nfd.k8s-sigs.io #10444
OCPEDGE-2692: feat: support MAC address fencing credentials in ABI flow #10385
MGMT-24339: Prepare 4.22 stable versions assisted-service upstream #10440
NO-ISSUE: [master] Bump OCP versions: 4.22 #10445
NO-ISSUE: Update OCP 5.0 OS images to use released 4.22 RHCOS #10441
MGMT-24495: Fix S3 additional_name and file_name #10432
MGMT-24496: Allow spaces between the value and unit for installcache #10433
NO-ISSUE: [master] Bump OCP versions: 4.18, 4.22, 4.20, 4.13 #10436
MGMT-22787: Add enhancement doc to limit inventory size #10410
NO-ISSUE: [master] Bump OCP versions: 4.22, 4.21 #10427
MGMT-24397: Add OCP test version builder & PoC #10321
MGMT-23738: Flaky test: “Move Agent to another infraenv” fails with Kubernetes conflict error #10319
NO-ISSUE: [master] Bump OCP versions: 4.16 #10423
MGMT-19732: Add ntp_sources field for exclusive NTP configuration #10408
MGMT-22370: Add exponential backoff to agent image pull #10337
MGMT-24243: Add option for a delay when applying static network config on minimal ISO #10373
NO-ISSUE: [master] Bump OCP versions: 4.19, 4.22 #10402
NO-ISSUE: add Assisted-by commit trailer convention to CLAUDE.md #10400
NO-ISSUE: [master] Bump OCP versions: 4.21, 5.0 #10392
MGMT-21836: Allow external platform with non-standard HA control plane #10286
MGMT-23230: Add MachineConfig for AMD GPU kernel module blacklist #9920
MGMT-24457: Add MI350P PCI device IDs to NFD NodeFeatureRule #10388
MGMT-24393: Assisted Service IPv6 checks fails comparative #10340
NO-ISSUE: [master] Bump OCP versions: 4.17, 4.20, 4.18 #10383
NO-ISSUE: [master] Bump OCP versions: 4.21, 4.22 #10348
NO-ISSUE: Update registry.access.redhat.com/ubi9/go-toolset Docker tag to v1.26 #10354
NO-ISSUE: Fix resource leak and inconsistency in manifest download #10322
MGMT-21834: deprecate supported-platforms endpoint #10122
NO-ISSUE: [master] Bump OCP versions: 4.14, 4.19, 4.18, 4.21, 4.20, 4.16 #10342
NO-ISSUE: fix typo: ‘occured’ -> ‘occurred’ in main.go error wraps #10316
NO-ISSUE: increase the timout waiting for assisted-image-service #10327
MGMT-20634: Revert mac-identifier and global DNS workarounds as RHEL-91250 and RHEL-72440 resolved #10318
ACM-33836: CVE-2026-35469 bump github.com/moby/spdystream #10314
NO-ISSUE: [master] Bump OCP versions: 4.22, 4.13, 4.16, 4.17 #10296
NO-ISSUE: [master] Bump OCP versions: 4.21, 4.20, 4.18, 4.19 #10287
MGMT-19930: upgrade PostgreSQL stack to pgx v5 and ocm-sdk-go v0.1.499 #10230
NO-ISSUE: [master] Bump OCP versions: 4.21 #10284
MGMT-24236: Exclude post-installation hosts from pending-user-action timeout #10266
MGMT-24138: Order network by bootstrap host #10257
NO-ISSUE: Remove unused RegisterAddHostsOCPCluster functions #10265
NO-ISSUE: [master] Bump OCP versions: 4.16, 5.0, 4.22 #10272
MGMT-24119: Correct the namespace to install Loki Operator as “openshift-operators-redhat” instead of “openshift-loki” #10209
MGMT-23755: Validate & trim MCS certificates when adding to ignition override #10262
NO-ISSUE: [master] Bump OCP versions: 4.21, 4.19 #10263
MGMT-23680: CVE-2026-32285 Bump github.com/buger/jsonparser to v1.1.2 #10240
NO-ISSUE: Update operator bundle channel to backplane-5.0 #10215
MGMT-24115: allow empty image checksum/url in getChecksumAndURL #10246
MGMT-23971: Add a timeout for installing-pending-user-action #10202
NO-ISSUE: Modify Konflux YAMLs to backplane-5.0 #10237
MGMT-23802: Fix manifest format in log bundles #10121
MGMT-23861: Fix oci detection for day2 clusters #10231
NO-ISSUE: [master] Bump OCP versions: 4.22 #10220
ACM-33186: Revert Renovate configuration for Hive updates #10203
MGMT-23553: Automate events table bloat cleanup #10140
MGMT-23665: fixing CVE-2026-33186 #10173
NO-ISSUE: Allow restoring soft deleted hosts #10185
NO-ISSUE: [master] Bump OCP versions: 4.20, 4.21, 4.22, 4.18 #10201
NO-ISSUE: Bump go modules and linters #10181
MGMT-23861: Revert MGMT-22385 for oci iscsi day2 #10170
ACM-32996: Missing nil check in BMACReconciler causes controller panic #10164
MGMT-23920: 4.22 SNO doesn’t support 4 cpu cores node #10153
NO-ISSUE: add shay23bra to owners #10163
NO-ISSUE: [master] Bump OCP versions: 4.13, 4.19 #10162
NO-ISSUE: Remove urlAuth from credentials endpoint #10161
MCO-2223: Add osImageStream install-config overrides #10156
NO-ISSUE: [master] Bump OCP versions: 4.21 #10152
NO-ISSUE: [master] Bump OCP versions: 4.22, 4.18, 4.20 #10146
OCPBUGS-79576: Mark raw FC/iSCSI multipath members as ineligible #10142
OCPBUGS-83401: Fix IRI patcher feature check #10141
MGMT-23227: Skip host operator validation for day2 clusters #10029
ACM-32735: Add better API docs to CRDs #10124
MGMT-23548: Ensure tests w/ gomock controllers call Finish() #10024
MGMT-22849: Remove the nmconnection that the openshift-installer writes for the bootstrap. #10086
NO-ISSUE: Detect missing PostgreSQL client in development #10119
NO-ISSUE: Add assisted-service-writing-unit-tests agent skill #10123
MGMT-23451: Lower SNO vCPU min to 4 instead of 8 for assisted for OCP 4.22 and above #10040
MGMT-23141: Cluster creation returns SQL error rather than API error #10113
NO-ISSUE: [master] Bump OCP versions: 4.20, 4.18, 4.21, 4.14, 4.17, 4.19, 4.16 #10120
MGMT-23340: upgrade assisted-service postgresql from 13 to 15 #10096
NO-ISSUE: Replace github.com/golang/mock with go.uber.org/mock #10082
OCPBUGS-79576: Prefer multipath disk in ABI disk selection #10091
NO-ISSUE: BMAC: replace per-step Update calls with deferred Patch #10095
MGMT-22517: Change amd gpu operator namespace to openshift-amd-gpu #10007
MGMT-23228: Update NFD config for AMD Instinct GPU detection #9918
MGMT-23599: implement cluster and host validations for Kube API mode #10044
MGMT-23253: Reconcile stuck day2 agent status by checking spoke cluster #10087
NO-ISSUE: clarify error when interface in bond missing #10022
MGMT-23060: Make InfraEnv CpuArchitecture immutable after creation #9999
MGMT-23625: Remove pinned image version for nfd operator #10045
MGMT-23231: Replace AcceleratorProfile with HardwareProfile #9919
MGMT-23674: Remove controller-runtime dependency from api module #10071
MGMT-23650: Disable image policy in assisted service operator deployment #10070
MGMT-23300: Add missing permission for host reclaim pod #9934
MGMT-22939: Fix cache key to get mustgather image #9940
OCPBUGS-79470: Fix multi-document YAML parsing for NMStateConfig #10053
NO-ISSUE: [master] Bump OCP versions: 4.16, 4.17, 4.19, 4.21, 4.22 #10054
AGENT-1426: Add localhost mirror only when missing in IRI patcher #10028
MGMT-23446: TNA none platform on 4.19 (block for 4.21 and lower) #10013
MGMT-23045: toggle metal3 integration #9933
OCPBUGS-78989: Gate customDeploy on PreprovisioningImage having correct ISO #10032
MGMT-23339: Add url to release image comparison for Kube API versions #10030
MGMT-23550: Add feature usage for new CNI types #10027
NO-ISSUE: add skipper skill #10014
MGMT-23432: add third parties CNI support to KUBE API mode #10015
NO-ISSUE: [master] Bump OCP versions: 4.21 #10023
NO-ISSUE: Add Go workspace files to .gitignore #10000
NO-ISSUE: [master] Bump OCP versions: 4.18, 4.20 #10002
MGMT-22967: read MCS CA from machine-config-server-ca instead of kube-system/root-ca #9990
NO-ISSUE: [master] Bump OCP versions: 4.21 #9997
MGMT-22782: Add state root cleanup script to day-2 worker ignition #9942
NO-ISSUE: Add bluesort to OWNERS_ALIASES #9979
OCPBUGS-77767: OVE Above/Below-the-sea integration - Network configuration not persisted #9978
MGMT-23339: Use release image URL from ClusterImageSet for KubeAPI clusters #9957
NO-ISSUE: [master] Bump OCP versions: 4.19, 4.13 #9988
MGMT-22518: Adding RHOAI application endpoint to the list of known hosts for SNO #9936
OCPBUGS-77552: fix: min supported arbiter disk size should be 50GB #9977
NO-ISSUE: Update InfraEnv CR description #9938
MGMT-22905: Update LSO override for operator deployment #8824
NO-ISSUE: [master] Bump OCP versions: 4.17 #9975
NO-ISSUE: [master] Bump OCP versions: 4.22, 4.14, 4.21 #9968
NO-ISSUE: Refresh RPM lockfiles #9945
NO-ISSUE: Fix loki and logging #9939
NO-ISSUE: [master] Bump OCP versions: 4.18, 4.20 #9941
MGMT-23205: Reject empty MAC address in NMState static network config #9937
NO-ISSUE: [master] Bump OCP versions: 4.21 #9935
MGMT-21783: bundle cluster and host ignition endpoint CA certificates for day-2 hosts #8826
ACM-29247: Infrastructure Operator - Set up Renovate configuration to automatically create Hive API Synchronization PRs #9917
NO-ISSUE: Refresh RPM lockfiles #9915
ACM-29247: (Revert) infrastructure operator set up renovate configuration to automatically create hive api synchronization p rs #9865
NO-ISSUE: [master] Bump OCP versions: 4.17, 4.16, 4.19, 4.22, 4.21 #9752
MGMT-22907: Prepare 4.21 stable and 4.22 candidate versions assisted-service upstream #8831
NO-ISSUE: Use renovate to update rpms.lock.yaml #9619
ACM-29247: (FIX) infrastructure operator set up renovate configuration to automatically create hive api synchronization p rs #9505
NO-ISSUE: Update module github.com/go-logr/logr to v1.4.3 #9357
NO-ISSUE: [master] Bump OCP versions: 4.21, 4.20, 4.18, 4.19, 4.17 #8912
ACM-29247: infrastructure operator set up renovate configuration to automatically create hive api synchronization p rs #8870
MGMT-22942: Temporarily mirror CAPI image and OCP 4.20 release for disconnected CAPI CI #8819
MGMT-23047: Ensure cluster is installed when adding an osImageVersion… #8818
MGMT-22998: Add documentation to add node to an upgraded cluster #8810
MGMT-23164: Bug: Assisted Installer fails for OCP < 4.16 due to missing libvirt dependency #8869
MGMT-22406: Include primary_ip_stack in cluster event notifications #8846
MGMT-22385: Skip ip= kernel args for Day2 iSCSI/multipath with unknown network #8837
NO-ISSUE: Update setup-envtest version to release-0.22 #8856
MGMT-22885: Implement third-party CNI backend support #8797
NO-ISSUE: Modify Konflux YAMLs to ocm-2.17 #8850
NO-ISSUE: Update operator bundle channel to ocm-2.17 #8847
MGMT-23115: add FIPS feature usage tracking #8845
MGMT-23077: Revert “MGMT-21038: Prevent from inventory set host RequestedHostname directly” #8840
OCPEDGE-2367: Add support for platform none and external on TNA clusters topology #8830
MGMT-22731: Add To Renovate Tool - Update UBI-minimal Version Automatically #8802
MGMT-22523: Bump AMD DeviceConfig driver version to 6.4.3 #8823
MGMT-23000: Fix when a BMH is paused in non-converged flow #8812
MGMT-22287: Remove OCP 4.12 support from assisted-service #8794
MGMT-21038: Prevent from inventory set host RequestedHostname directly #7962
NO-ISSUE: [master] Bump OCP versions: 4.16, 4.14, 4.21 #8816
ACM-29153: Upgrade hive to e33d70 #8807
MGMT-21756: enable FIPS 140-3 crypto module in Go builds #8755
NO-ISSUE: [master] Bump OCP versions: 4.20 #8801
MGMT-22583: Implement Swagger Definitions for 3rd Party CNI / No CNI #8717
NO-ISSUE: [master] Bump OCP versions: 4.17, 4.20, 4.19, 4.13 #8795
NO-ISSUE: Clarify release images needed for ironic agent image #8778
NO-ISSUE: upgrade to 1.25 #8769
NO-ISSUE: [master] Bump OCP versions: 4.12, 4.18, 4.21, 4.16, 4.20 #8767
NO-ISSUE: Add parameter for pod disruption budget in openshift template #8765
MGMT-20701: host re-registration improvement #8737
MGMT-22189: Fix primary_ip_stack migration #8760
MGMT-22584: Create Enhancement Document for 3rd Party CNI / No CNI Support in Assisted Installer #8594
MGMT-22131: transitioning red hat operator base image to ubi minimal #8711
MGMT-22553: Partial cluster updates fail with false validation errors on dual-stack clusters #8704
MGMT-22297: fallback path for add-ntp-sources.sh #8742
NO-ISSUE: Update CONTRIBUTING.md #8745
MGMT-22189: Order dual-stack networks when fetching from DB #8488
MGMT-22656: Remove serviceMesh & kserve from DataScienceCluster spec #8741
NO-ISSUE: Add cpe label #8739
NO-ISSUE: bumping go version on branch master to v1.25 to solve CVE-2025-58183 #8708
AGENT-1407: add support for InternalReleaseImage related resources #8600
NO-ISSUE: [master] Bump OCP versions: 4.21 #8733
MGMT-16090: upgrade assisted-service postgresql from 12 to 13 #8602
MGMT-20499: Always generate iSCSI NIC reapply manifest for day2 host support #8705
NO-ISSUE: [master] Bump OCP versions: 4.17 #8725
MGMT-22278: Skip deleting spoke resources for an uninstalled agent #8608
MGMT-22186: Add kata runtime class to Assisted installer #8140
ACM-27859: Allow PreprovisioningImage finalizer to be removed once BMH finishes deprovisioning #8604
MGMT-20323: Prefer bootable disks for installation #8701
NO-ISSUE: add to owners_aliases #8703
MGMT-22545: Fix YAML marshaling for Kubernetes types in disconnected ignition #8619
OCPBUGS-68355: Fix Day-2 CSR approval race condition #8622
MGMT-22423: Fix race condition in ensureOwnerRef causing spec.installed to remain false #8621
ACM-27290: Fix policy.json not generated for InfraEnv mirror registry config #8609
ACM-27906: Fix container-image-availability check to use mirrored registries in disconnected environments #8611
NO-ISSUE: [master] Bump OCP versions: 4.21, 4.20 #8612
MGMT-22458: CVE-2025-65637 Bump github.com/go-openapi/loads, github.com/go-openapi/analysis, github.com/go-openapi/validate to fix CVE-2025-65637 through introducers update (models module) #8596
NO-ISSUE: Fix golangci-lint branch #8572
MGMT-22159: Add NFD operator to the list of OSC operator dependencies #8292
MGMT-22320: Expose GPU data in Agent CR inventory #8495
NO-ISSUE: Fix list bundle validation to check for feature incompatibilities #8571
MGMT-22273: reduce log amount #8565
MGMT-22396: CVE-2024-25621 Bump github.com/containerd/containerd to v1.7.29 through indirect dependency conversion #8555
And 6 elided commits (e.g. from squash or rebase merges)
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-87444: Updating ose-agent-installer-csr-approver-container image to be consistent with ART for 5.0 #2173
OCPBUGS-87377: Updating ose-agent-installer-orchestrator-container image to be consistent with ART for 5.0 #2172
OCPBUGS-101647: Bump golang.org/x/net to v0.56.0 #2251
MGMT-24598: CVE-2026-42306 Bump assisted-service dep to pick up docker v28.5.2 #2219
OCPBUGS-96799: Bump golang.org/x/net from v0.48.0 to v0.55.0 #2244
OCPBUGS-96696: Wait for all nodes to join before exiting for ABI #2230
ACM-38238: Assisted-installer repos: Set Up Set up Renovate configuration to automatically create Hive API Synchronization PRs #2224
MGMT-24702: CVE-2026-53488 Bump github.com/containerd/containerd to v1.7.33 #2204
NO-ISSUE: Bump linter #2199
MGMT-24453: upgrade to golang 1.26 #2171
NO-ISSUE: Refresh RPM lockfiles #2182
NO-ISSUE: Refresh RPM lockfiles #2160
MGMT-23784: CVE-2026-34986 Bump github.com/go-jose/go-jose/v3 to v3.0.5 using replace directive #2121
NO-ISSUE: Modify Konflux YAMLs to backplane-5.0 #2119
ACM-33186: Revert Renovate configuration for Hive updates #2107
NO-ISSUE: upgrade go.opentelemetry.io/otel/sdk to … #2097
MGMT-23789: CVE-2026-34986 Bump github.com/go-jose/go-jose/v4 to v4.1.4 through indirect dependency conversion #2081
NO-ISSUE: Refresh RPM lockfiles #2069
MGMT-23545: Mount pull secret token as a file #2053
MGMT-23191: Ensure MCO configs are present before rebooting the bootstrap node #2039
MGMT-23664: CVE-2026-33186 Bump google.golang.org/grpc to v1.79.3 through indirect dependency conversion #2058
OCPBUGS-70213: fix: allow workers to join TNA cluster when 1 master + arbiter are ready #2056
NO-ISSUE: Refresh RPM lockfiles [SECURITY] #2040
OCPBUGS-76382: Fix root partition before copying IRI registry data #2034
ACM-29247: Infrastructure Operator - Set up Renovate configuration to automatically create Hive API Synchronization PRs #2037
NO-ISSUE: Refresh RPM lockfiles [SECURITY] #2035
NO-ISSUE: Refresh RPM lockfiles #2027
ACM-29247: (Revert) infrastructure operator set up renovate configuration to automatically create hive api synchronization p rs #1998
NO-ISSUE: Update module github.com/jackc/pgtype to v1.14.4 #1664
NO-ISSUE: Use renovate to update rpms.lock.yaml #1515
NO-ISSUE: Update github.com/alecthomas/units digest to 0f3dac3 #1524
ACM-29247: infrastructure operator set up renovate configuration to automatically create hive api synchronization p rs #1511
MGMT-22731: Add To Renovate Tool - Update UBI-minimal Version Automatically #1487
NO-ISSUE: Modify Konflux YAMLs to ocm-2.17 #1498
Revert “NO-ISSUE: test for FF ACM 2.17” #1496
NO-ISSUE: test for FF ACM 2.17 #1495
ACM-29166: Upgrade hive to e33d70 #1491
MGMT-22499: CVE-2025-66506 Bump github.com/sigstore/fulcio to v1.8.3 using replace directive #1484
MGMT-22532: CVE-2025-52881 Bump github.com/opencontainers/selinux to v1.13.0 using replace directive #1483
MGMT-22393: CVE-2024-25621 Bump github.com/containerd/containerd to v1.7.29 using replace directive #1474
NO-ISSUE: upgrade go to 1.25 #1466
MGMT-22653: bump the required minimal go version to 1.24 #1459
NO-ISSUE: Add cpe label #1457
MGMT-22131: transitioning red hat operator base image to ubi minimal #1444
ACM-25812: bumping go version on branch master #1446
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

agent-installer-node-agent

MGMT-24597: CVE-2026-42306 Bump assisted-service dep to pick up docker v28.5.2 #1560
NO-ISSUE: Refresh RPM lockfiles RPM lockfile refresh #1578
MGMT-24903: Preserve encapsulated MachineConfig in filtered ignition #1568
NO-ISSUE: Refresh RPM lockfiles RPM lockfile refresh #1555
MGMT-24703: CVE-2026-53488 Bump github.com/containerd/containerd to v1.7.33 through indirect dependency conversion #1531
NO-ISSUE: Refresh RPM lockfiles RPM lockfile refresh [SECURITY] #1520
NO-ISSUE: Update module github.com/golangci/golangci-lint to v2.12.2 #1515
MGMT-24453: upgrade to golang 1.26 #1509
MGMT-22787: Log inventory when it’s too big #1510
MGMT-22787: Limit inventory output #1474
MGMT-24376: Report InfiniBand NIC speed from HCA sysfs path #1492
NO-ISSUE: Update registry.access.redhat.com/ubi9/go-toolset Docker tag to v1.26 #1461
NO-ISSUE: Upgrade linter #1453
NO-ISSUE: Modify Konflux YAMLs to backplane-5.0 #1431
ACM-31642: fix CVE-2026-33186 #1417
OCPBUGS-63472: add –copy-network when manual network config is detected #1374
MGMT-23790: CVE-2026-34986 Bump github.com/go-jose/go-jose/v4 to v4.1.4 through indirect dependency conversion #1404
NO-ISSUE: Refactor flag Parsing to avoid multiple calls #1401
NO-ISSUE: Refresh RPM lockfiles #1389
MGMT-23300: Ensure /boot dir has enough space during reclaim #1316
MGMT-23517: Bump go modules #1373
NO-ISSUE: Refresh RPM lockfiles #1355
NO-ISSUE: Refresh RPM lockfiles [SECURITY] #1351
NO-ISSUE: Use renovate to update rpms.lock.yaml #1343
MGMT-23123: fix bootkube.logs missing from bootstrap logs on success #1320
MGMT-22731: Add To Renovate Tool - Update UBI-minimal Version Automatically #1309
NO-ISSUE: Modify Konflux YAMLs to ocm-2.17 #1318
ACM-29167: Upgrade hive to e33d70 #1311
MGMT-22131: transitioning red hat operator base image to ubi minimal #1288
MGMT-22395: CVE-2024-25621 Bump github.com/containerd/containerd to v1.7.29 through indirect dependency conversion #1302
NO-ISSUE: Bump mockery to a go 1.25 compatible version #1295
NO-ISSUE: upgrade go to 1.25 #1289
NO-ISSUE: Add cpe label #1278
MGMT-21739: Skip log collection for non-existent services #1230
NO-ISSUE: add to owners_aliases #1268
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

agent-installer-ui

OCPBUGS-121378: Do not show IRI custom manifests in the disconnected UI (#4048) (#4053) #4048
Remove stale OCM_REFRESH_TOKEN code (#4024) #4024
OCPBUGS-115122: Show IPv6 Technology Preview badge in Subnets dropdown for single-cluster only (#4039) #4039
OCPBUGS-120719: Change reuse SSH key label in OVE (#4037) #4037
Add LVM as an operator for OVE (#4004) #4004
Allow LSO to be selected as a standalone operator (#4002) #4002
Update OWNERS file (#3995) #3995
OCPBUGS-104439: pin postcss resolution to >=8.5.23 (CVE-2026-69153) (#3957) #3957
AGENT-1570: Remove CustomNoUpgrade featureSet and NoRegistryClusterInstall feature gate (#3954) #3954
Bump js-yaml from 3.14.1 to 4.3.1 (#3951) #3951
Bump js-yaml from 4.3.0 to 4.3.1 (#3947) #3947
chore(deps): update dependency ws to ^8.21.2 (#3950) #3950
chore(deps): update dependency dompurify to ^3.4.13 (#3949) #3949
chore(deps): update konflux references (#3946) #3946
Add ‘Storage class’ option to Hypeshift details form (#3944) #3944
MGMT-24973: Fix missing padding on InfraEnv error alerts in the Add hosts modal (#3943) #3943
Bump ip-address from 10.2.0 to 10.3.1 (#3938) #3938
Add OptionalConfigurationStep (#3927) #3927
chore(deps): update konflux references (#3933) #3933
Bump undici from 7.28.0 to 7.29.0 (#3940) #3940
Bump fast-uri from 3.1.4 to 3.1.5 (#3939) #3939
chore(deps): update dependency minimatch to ^10.2.6 (#3936) #3936
NO-ISSUE: Silence TypeScript deprecation warning (#3937) #3937
chore(deps): update dependency brace-expansion to ^5.0.9 (#3935) #3935
Keep NMState resources when deleting BMC hosts (#3931) #3931
Block installation when custom-manifests-requirements-satisfied validation fails (#3923) #3923
Upgrade react-router to ^7.18.1 (#3925) #3925
MGMT-24641: Attempt to choose 5 masters for standalone cluster blocked (#3912) #3912
Bump tar from 7.5.20 to 7.5.22 (#3921) #3921
Bump postcss from 8.5.15 to 8.5.23 (#3920) #3920
Bump uuid from 8.3.2 to 14.0.1 (#3919) #3919
chore(deps): update dependency brace-expansion to ^5.0.8 (#3916) #3916
chore(deps): update dependency dompurify to ^3.4.12 (#3917) #3917
chore(deps): update konflux references (#3913) #3913
Bump shell-quote from 1.8.4 to 1.10.0 (#3909) #3909
Bump body-parser from 1.20.4 to 1.20.6 (#3911) #3911
Bump fast-uri from 3.1.2 to 3.1.4 (#3910) #3910
OCPBUGS-99039: Bump dompurify to 3.4.7+ in 5.0 (#3894) #3894
Update build_tools (#3901) #3901
Fix operator Learn more documentation links and remove duplicates (#3899) #3899
chore(deps): update dependency sanitize-html to ^2.17.6 (#3897) #3897
Bump websocket-driver from 0.7.4 to 0.7.5 (#3891) #3891
chore(deps): update dependency tar to ^7.5.20 (#3898) #3898
chore(deps): update konflux references (#3896) #3896
Upgrade node version in Containerfile (#3872) #3872
Apply patches (#3819) #3819
Upgrade path-to-regexp to ^8.4.2 (#3862) #3862
Upgrade sanitize-html to ^2.17.4 (#3861) #3861
Dedupe yarn.lock (#3863) #3863
Upgrade terser-webpack-plugin to ^5.6.1 (#3818) #3818
chore(deps): update typescript type definitions (non-major) (#3867) #3867
chore(deps): update dependency axios to ^1.18.1 (#3868) #3868
chore(deps): update konflux references (#3866) #3866
Upgrade brace-expansion to ^5.0.8 (#3855) #3855
OCPBUGS-96781: Bump webpack-dev-server to 5.2.5 (#3822) #3822
chore(deps): update dependency tar to ^7.5.19 (#3826) #3826
no-jira: Bump axios to latest (1.18.1) (#3856) #3856
OCPBUGS-97734: Increase default imageStorage to 100Gi and raise minimum to 50Gi (#3820) #3820
Show all operators on cluster installation page (#3849) #3849
Update OWNERS file (#3850) #3850
chore(deps): update dependency serialize-javascript to ^7.0.7 (#3825) #3825
chore(deps): update konflux references (#3824) #3824
Bump js-yaml from 3.14.1 to 4.3.0 (#3814) #3814
Fix dependency ordering (#3812) #3812
Fix machine network autoselect to work with IPv6 only clusters (#3813) #3813
Upgrade shell-quote to ^1.8.4 (#3800) #3800
ACM-35000: Update @openshift-assisted/ui-lib for dynamic plugin SDK 4.22 and react-router 7 compatibility (#3804) #3804
Reflect selected operators correctly (#3805) #3805
chore(deps): update dependency qs to ^6.15.3 (#3809) #3809
MGMT-24431: Add inventory truncation validation handling to Assisted Installer UI (#3807) #3807
chore(deps): update konflux references (#3794) #3794
chore(deps): update dependency ip-address to ^10.2.0 (#3808) #3808
Upgrade ip-address to ^10.1.1 (#3802) #3802
Upgrade ws to ^8.21.0 (#3803) #3803
Upgade tar to ^7.5.11 (#3801) #3801
AGENT-1519 | [Below-the-sea UI] Allow the user to select IPv6 in the Networking Stack Type field (#3732) #3732
Bump http-proxy-middleware from 2.0.9 to 2.0.10 (#3799) #3799
chore(deps): update dependency serialize-javascript to ^7.0.6 (#3797) #3797
Fix nested expandable sections (#3793) #3793
MGMT-23172: Improve the UX of the operators tab (#3780) #3780
Tweak discovery ISO modal sizing (#3792) #3792
Bump undici from 7.24.7 to 7.28.0 (#3795) #3795
Upgrade glob to ^11.1.0 (#3774) #3774
chore(deps): update dependency minimatch to ^10.2.5 (#3796) #3796
Bump form-data from 4.0.5 to 4.0.6 (#3788) #3788
Bump @babel/core from 7.29.0 to 7.29.7 (#3790) #3790
Bump launch-editor from 2.12.0 to 2.14.1 (#3789) #3789
Bump js-yaml from 4.1.1 to 4.2.0 (#3786) #3786
Bump vite from 8.0.10 to 8.0.16 (#3787) #3787
Bump tmp from 0.2.6 to 0.2.7 (#3785) #3785
Bump joi from 17.13.0 to 17.13.4 (#3783) #3783
Upgrade ajv to ^8.18.0 (#3778) #3778
Upgrade minimatch to ^10.2.3 (#3779) #3779
Upgrade axios to ^1.17.0 (#3773) #3773
fix(deps): update typescript type definitions (non-major) (#3764) #3764
Fix FeedbackCard types (#3776) #3776
Upgrade serialize_javascript to ^7.0.5 (#3775) #3775
Updating assisted-installer-ui-container image to be consistent with ART for 5.0 (#3771) #3771
Bump vitest from 0.34.6 to 3.2.6 (#3772) #3772
OCPBUGS-72598: Custom manifests are broken in local assisted UI (#3766) #3766
OCPBUGS-85310: Static ip prefill for ove below the sea (#3733) #3733
MGMT-24099: UI redirects to Custom Manifest page before host discovery when cluster is OCI platform (#3739) #3739
chore(deps): update konflux references (#3762) #3762
MGMT-24304: On disconnected environment no Openshift version is set by default on standalone cluster details page and no version is shown in the dropdown till Show all available are shown (#3723) #3723
Bump tmp from 0.2.5 to 0.2.6 (#3760) #3760
chore(deps): update testing packages (#3742) #3742
Revert “OCPBUGS-84038 | [Below the sea UI] Lack of visual feedback (spinner) …” (#3757) #3757
Fix disk encryption parsing for cluster details (#3737) #3737
Reset search field on ‘Clear all filters’ (#3736) #3736
MGMT-24444: Apply sentence case to networking management type labels … (#3747) #3747
Operators section should not be displayed on review and installation progress pages when no operators are selected (#3745) #3745
Remove Arbiter button (#3744) #3744
chore(deps): update typescript (#3743) #3743
chore(deps): update konflux references (#3741) #3741
Update Konflux Quay image address (#3740) #3740
Bump ws from 8.18.3 to 8.20.1 (#3726) #3726
fix monted pull secret parsing (#3692) #3692
chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.25.9-1778675823 (#3720) #3720
chore(deps): update dependency qs to ^6.15.2 (#3719) #3719
chore(deps): update konflux references (#3718) #3718
chore(deps): update dependency dpdm to v4 (#3555) #3555
Implement useAgents hook for the CIM wizard (#3711) #3711
Ugrade axios to 1.15.2 (#3710) #3710
chore(deps): update dependency qs to ^6.15.1 (#3678) #3678
chore(deps): update dependency eslint to ^8.57.1 (#3677) #3677
chore(deps): update konflux references (#3707) #3707
chore(deps): update dependency redux to ^4.2.1 (#3708) #3708
chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.25.9-1778171507 (#3709) #3709
Bump fast-uri from 3.1.0 to 3.1.2 (#3706) #3706
OCPBUGS-84038 | [Below the sea UI] Lack of visual feedback (spinner) on disabled “Next” button during background validation (#3687) #3687
MGMT-23490: Refactor Troubleshooting Web Console (#3688) #3688
Bump basic-ftp from 5.3.0 to 5.3.1 (#3698) #3698
Bump ip-address from 7.1.0 to 10.1.1 (#3689) #3689
Read from aipVIPs and ingressVIPs in getClusterProperties function (#3661) #3661
Memoize the wizard footer on CIM Review step (#3686) #3686
MGMT-19002: [nmstate] UI form view missing autoconf field for ipv6 (#3681) #3681
Add custom-manifests-requirements-satisfied to soft validations on networking wizard step (#3682) #3682
OCPBUGS-84147 | [Below the sea UI] Leaky Abstraction: Transient 500 errors exposed during host binding process (#3672) #3672
MGMT-21857: [UI] - Missing “No Matching Clusters” Message (#3667) #3667
Hide internally generated custom manifests on the Cluster Review page (#3646) #3646
chore(deps): update konflux references (#3675) #3675
MGMT-23950: [Staging] [UI] - Cluster name missing in page header for draft clusters (#3669) #3669
chore(deps): update dependency @reduxjs/toolkit to ^1.9.7 (#3647) #3647
chore(deps): update dependency axios to ^1.15.2 (#3648) #3648
MGMT-24152: UI allows editing pull secret in draft cluster (#3662) #3662
Remove 2 node arbiter option from the control plane dropdown option (#3644) #3644
Bump postcss from 8.5.6 to 8.5.10 (#3641) #3641
Update OWNERS file (#3643) #3643
chore(deps): update konflux references (#3640) #3640
chore(config): migrate config renovate.json (#3639) #3639
MGMT-23800: Upgrade Vite (#3589) #3589
chore(deps): update dependency msw to v2.13.5 (#3587) #3587
chore(deps): update dependency @vitejs/plugin-react-swc to v4 (#3553) #3553
chore(deps): update dependency happy-dom to v20.9.0 (#3591) #3591
Add renovate.json (#3637) #3637
chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.25.8-1776962329 (#3588) #3588
chore(deps): update dependency @redhat-cloud-services/eslint-config-redhat-cloud-services to v3.1.0 (#3577) #3577
chore(deps): update dependency @types/uuid to v11 (#3544) #3544
chore(deps): update yarn to v3.8.7 (#3495) #3495
Add cursor rules for imports (#3595) #3595
NO-ISSUE: Cursor rules for comments and variables (#3592) #3592
Add CLAUDE.md (#3632) #3632
Bump uuid from 8.3.2 to 14.0.0 (#3629) #3629
Bump follow-redirects from 1.15.11 to 1.16.0 (#3586) #3586
ACM-30344: ACM Console should support ClusterImageSets with by-digest pullspecs (#3609) #3609
Allow to install SNO topology (#3578) #3578
Support third party CNI in CIM (#3600) #3600
Fix Cisco Intersight editing (#3523) #3523
Pull secret appears editable in draft cluster but changes are not applied (#3597) #3597
fix operators list in ABI below the sea (#3590) #3590
MGMT-23913: Missing breadcrumbs in on-prem Assisted Installer (#3598) #3598
Update build-tools (#3593) #3593
Upgrade lodash to 4.18.1 (#3566) #3566
Bump basic-ftp from 5.2.1 to 5.3.0 (#3594) #3594
OCPBUGS-83428: bump axios to ^1.15.0 for fixing CVE-2026-40175 (#3585) #3585
chore(deps): update dependency @redhat-cloud-services/frontend-components to v7.3.1 (#3568) #3568
chore(deps): update dependency @redhat-cloud-services/tsc-transform-imports to v1.0.58 (#3570) #3570
chore(deps): update dependency @redhat-cloud-services/frontend-components-config to v6.8.4 (#3569) #3569
MGMT-23090: Support single stack IPv6 (#3414) #3414
NO-ISSUE: Remove orphan files (#3460) #3460
MGMT-23328: remove breadcrumbs for OCM and use logo as a link (#3510) #3510
NO-ISSUE: Update translation files to match new i18next format (#3567) #3567
chore(deps): update dependency rimraf to v6 (#3564) #3564
chore(deps): update konflux references (#3562) #3562
chore(deps): update konflux references (#3561) #3561
chore(deps): update module golang.org/x/sys to v0.43.0 (#3492) #3492
chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.25.8-1775724628 (#3560) #3560
chore(deps): update dependency qs to v6.15.1 (#3559) #3559
chore(deps): update dependency @redhat-cloud-services/eslint-config-redhat-cloud-services to v3 (#3539) #3539
chore(deps): update dependency msw to v2 (#3557) #3557
chore(deps): update dependency concurrently to v9 (#3554) #3554
chore(deps): update dependency @openapitools/openapi-generator-cli to v2.31.1 (#3534) #3534
chore(deps): update dependency typescript to v5.9.3 (#3489) #3489
chore(deps): update dependency @types/node to v24 (#3543) #3543
chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.25.8-1775651161 (#3548) #3548
chore(deps): update dependency i18next-parser to v9 (#3556) #3556
Bump basic-ftp from 5.2.0 to 5.2.1 (#3552) #3552
chore(deps): update dependency axios to v1.15.0 (#3551) #3551
chore(deps): update dependency @redhat-cloud-services/frontend-components to v7.3.0 (#3550) #3550
MGMT-23313: long text breaks table layout (#3545) #3545
Bump vite from 5.4.21 to 6.4.2 (#3547) #3547
chore(deps): update dependency eslint-plugin-import to v2.32.0 (#3475) #3475
fix(deps): update dependency monaco-editor to v0.55.1 (#3505) #3505
fix(deps): update dependency cypress to v13.17.0 (#3500) #3500
fix(deps): update dependency react-monaco-editor to v0.59.0 (#3537) #3537
chore(deps): update dependency dpdm to v3.15.1 (#3473) #3473
chore(deps): update dependency @redhat-cloud-services/frontend-components-config to v6.8.3 (#3471) #3471
chore(deps): update dependency axios to v1.14.0 (#3536) #3536
chore(deps): update dependency @types/eslint to v9 (#3541) #3541
Updating assisted-installer-ui-container image to be consistent with ART for 4.22 (#3340) #3340
chore(deps): update lodash monorepo to v4.18.1 (#3538) #3538
chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.25.8-1775042950 (#3533) #3533
chore(deps): update dependency eslint-plugin-react to v7.37.5 (#3476) #3476
Bump @xmldom/xmldom from 0.8.10 to 0.8.12 (#3532) #3532
chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.25.8-1774968108 (#3531) #3531
Upgrade @openshift-console/dynamic-plugin/sdk (#3522) #3522
Update translation files (#3524) #3524
chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.25.8-1774618347 (#3519) #3519
Add support for release branches in PR workflow (#3527) #3527
chore(deps): update dependency @redhat-cloud-services/tsc-transform-imports to v1.0.57 (#3407) #3407
Add feature branch to pull request workflow (#3520) #3520
NO-ISSUE: Add cursor rules (#3515) #3515
chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.25.7-1774499506 (#3494) #3494
fix(deps): update module github.com/sirupsen/logrus to v1.9.4 (#3441) #3441
Revert abi abov the sea new flow (#3517) #3517
Bump happy-dom from 20.0.2 to 20.8.9 (#3516) #3516
chore(deps): update dependency swr to v2.4.1 (#3486) #3486
Bump node-forge from 1.3.3 to 1.4.0 (#3513) #3513
chore(deps): update konflux references (#3514) #3514
Bump picomatch from 2.3.1 to 2.3.2 (#3507) #3507
Bump brace-expansion from 1.1.11 to 1.1.13 (#3512) #3512
add pull secret auto populate logic to ABI local UI (#3508) #3508
chore(deps): update dependency tslib to v2.8.1 (#3487) #3487
populate default values in local ui from infraEnv (#3502) #3502
MGMT-23648: Removing the manifests using the toggle (#3498) #3498
Add cursor rules for generated files (#3497) #3497
chore(deps): update konflux references (#3472) #3472
chore(deps): update dependency start-server-and-test to v2.1.5 (#3484) #3484
Set customManifestsUpdated when users remove a manifest (#3482) #3482
Red Hat Konflux update assisted-ui-chatbot-saas-main (#3478) #3478
MGMT-23515: Use Network type support level (#3465) #3465
Red Hat Konflux purge assisted-installer-chatbot-main (#3477) #3477
fix(deps): update dependency @patternfly/react-core to v6.4.1 (#3438) #3438
chore(deps): update dependency nodemon to v3.1.14 (#3435) #3435
chore(deps): update dependency @vitejs/plugin-react-swc to v3.11.0 (#3444) #3444
chore(deps): update dependency @openapitools/openapi-generator-cli to v2.30.2 (#3442) #3442
chore(deps): update dependency @redhat-cloud-services/frontend-components to v7.1.1 (#3470) #3470
fix(deps): update dependency @patternfly/react-code-editor to v6.4.1 (#3437) #3437
fix(deps): update dependency @patternfly/react-table to v6.4.1 (#3440) #3440
chore(deps): update dependency @redhat-cloud-services/frontend-components-config to v6.7.54 (#3406) #3406
chore(deps): update dependency @sentry/browser to v7.120.4 (#3443) #3443
chore(deps): update dependency eslint to v8.57.1 (#3432) #3432
chore(deps): update dependency axios to v1.13.6 (#3431) #3431
chore(deps): update dependency @types/node to v18.19.130 (#3429) #3429
chore(deps): update dependency @types/lodash to v4.17.24 (#3428) #3428
Bump ajv from 6.12.6 to 6.14.0 (#3411) #3411
chore(deps): update dependency prettier to v2.8.8 (#3436) #3436
chore(deps): update dependency msw to v1.3.5 (#3434) #3434
chore(deps): update dependency eslint-config-prettier to v8.10.2 (#3433) #3433
chore(deps): update dependency @types/react-redux to v7.1.34 (#3430) #3430
chore(deps): update dependency @types/eslint to v8.56.12 (#3427) #3427
chore(deps): update dependency @tsconfig/recommended to v1.0.13 (#3426) #3426
Bump flatted from 3.3.1 to 3.4.2 (#3469) #3469
fix validations for NTP and Proxy in above sea level ABI flow (#3464) #3464
Add identifiers and checked state attribute to custom manifests switch (#3466) #3466
MGMT-23516: Left navigation menu is cut off (#3463) #3463
UI doesnt save the data filled by the user (#3452) #3452
fix ISO file name (#3462) #3462
Tech Preview badge should appear at the end of the line (#3461) #3461
AGENT-1136: Add USER_AUTH_TOKEN support to disconnected UI proxy (#3454) #3454
Bump rollup from 4.50.1 to 4.59.0 (#3421) #3421
Bump immutable from 3.8.2 to 3.8.3 (#3451) #3451
MGMT-23131: Third-Party CNI Support (#3457) #3457
Fix CVE-2026-27904: Bumping minimatch to latest versions via yarn resolutions (#3459) #3459
Fix CVE-2025-15284: bump qs to ^6.14.1 via yarn resolutions (#3456) #3456
MGMT-23293: duplicate helper-text selector issue (#3446) #3446
Above-the-sea UI QE test second phase (#3453) #3453
above sea level QE test fix (#3450) #3450
Update chatbot readme (#3447) #3447
Make use of PF Icon component (#3439) #3439
Red Hat Konflux update assisted-installer-chatbot-main (#3424) #3424
MGMT-22748: Setup insights-frontend-builder-common build tools (#3419) #3419
MGMT-23299: Make secondary VIP fields optional (#3417) #3417
Include additional operators in OVE UI ISO config (#3413) #3413
Update OCM setup docs (#3418) #3418
fix: bump lodash to ^4.17.23 to address CVE-2025-13465 (#3410) #3410
fix: bump react-router-dom-v5-compat to ^6.30.3 to address CVE-2026-22029 (#3409) #3409
OCPBUGS-76280: Next button is disabled on optional configurations page (#3402) #3402
change axios version (#3403) #3403
UI freezes when clicking Select button without version (#3401) #3401
OCPBUGS-75072 | OVE UI: Above-the-sea UI QE test (#3383) #3383
Hypershift – allow infra envs with no hosts in namespace dropdown (#3373) #3373
MGMT-22544: update latest doc version to 4.20 (#3392) #3392
Bump axios from 1.12.2 to 1.13.5 (#3389) #3389
Make lint:all serial instead of parallel (#3400) #3400
fix: prevent form submission on cluster details step for existing clusters (#3372) #3372
fix major.minor version extraction (#3377) #3377
NO-ISSUE: Localise validation messages (#3379) #3379
Fix Infinite Loader while Getting Empty Versions List (#3378) #3378
Bump preact from 10.26.9 to 10.28.2 (#3356) #3356
Bump lodash-es from 4.17.21 to 4.17.23 (#3364) #3364
Bump lodash from 4.17.21 to 4.17.23 (#3365) #3365
OCPBUGS-74421 | OVE UI: Fix rendezvousIP field name in error message (#3376) #3376
MGMT-22941: ABI: add version dropdown (#3370) #3370
Do not delete disconnected cluster/infraenv. (#3368) #3368
MGMT-21058: Expose BareMetalHost (BMH) Status and Events in the Assisted Installer / CIM Console (#3363) #3363
Clean up git conflict artefacts (#3325) #3325
MGMT-21991: Add Primary IPv6 Support-cim (#3346) #3346
Stop using deprecate Modal component in CIM (#3343) #3343
Add additional new fields to the above the sea UI (#3337) #3337
MGMT-20673: Improve OpenShift AI bundle requirements tooltip (#3352) #3352
Fix React 18 types (#3361) #3361
MGMT-22746: Add chatbot app (#3350) #3350
Refactor LabelsField component (#3354) #3354
Use PF Dropdown component for namespace select (#3345) #3345
Make Cisco Intersight URL editable in CIM config modal (#3357) #3357
Fix mass hostname change content alignment (#3344) #3344
Adapt PrismCode for dark mode (#3348) #3348
Fix FileUpload component (#3355) #3355
Assisted Installer OVE UI shows transient blank page with Technology Preview spinner (#3341) #3341
API/Ingress IP fields lack character limit (#3342) #3342
Use conversationId from props for feedback. (#3336) #3336
use old release process (#3333) #3333
MGMT-20727: Cisco Intersight URL should be configurable (#3332) #3332
MGMT-22465: Merge the contents of releases/v2.17-cim into master (#3319) #3319
change ABI above sea level iso size (#3322) #3322
Openshift AI Bundle on SNO enables ODF and LVM which are uncompatible (#3320) #3320
remove external platforms field from below sea level UI (#3316) #3316
Fix Cluster summary styling (#3216) #3216
Bump js-yaml from 4.1.0 to 4.1.1 (#3310) #3310
provides parameters for the GET /v2/operators/bundles route (#3306) #3306
Bump mdast-util-to-hast from 13.2.0 to 13.2.1 (#3287) #3287
Bump zx from 7.2.3 to 8.8.5 (#3273) #3273
Bump js-yaml from 4.1.0 to 4.1.1 (#3264) #3264
Full changelog

agent-installer-utils

OCPBUGS-105450: Update Konflux references #334
OCPBUGS-101759: Update Konflux references #331
OCPBUGS-99905: Update Konflux references #303
OCPBUGS-99745: Use Operator catalog in 4.22 for OVE #323
OCPBUGS-87367: Updating ose-agent-installer-utils-container image to be consistent with ART for 5.0 #308
OCPBUGS-99425: Use agent-preinstall-image-builder from quay-proxy #319
OCPBUGS-98692: Update cluster-logging and loki operator versions #315
AGENT-1552: Add lvms-operator to config #311
OCPBUGS-98101: Use build platform with more disk space #312
AGENT-1536: bump mtv-operator channel to release-v2.12 #309
OCPBUGS-86036: Filter out link-local IPv6 addresses #305
OCPBUGS-85524: update konflux references #286
AGENT-1476: Configure CI integration and add Prow e2e test to Konflux #245
AGENT-1193: Add mirror-path and registry-cert support for OVE ISO builder #218
OCPBUGS-83575: Remove Konflux cert-preflight test #290
NO-JIRA: Add 4.23 appliance-config #289
NO-JIRA: Add 5.0 appliance-config.yaml for iso_builder #288
OCPBUGS-82537: update konflux references #274
NO-JIRA: enable xtrace in build-ove-image.sh for debugging #281
OCPBUGS-81585: Update operator versions #280
NO-JIRA: Pass environment through to podman #279
AGENT-1429: Pass OPENSHIFT_INSTALL_EXPERIMENTAL_DISABLE_IMAGE_POLICY #278
OCPBUGS-78042: Update Konflux references #266
OCPBUGS-77956: Update to use the 4.21 Operator Catalog #268
OCPBUGS-77611: Updating ose-agent-installer-utils-container image to be consistent with ART for 4.22 #267
AGENT-1453: Add a flag to provide a custom appliance image #264
AGENT-1447: Override prefilled rendezvousIP #256
OCPBUGS-77270: Remove multiple redhat-operator-index catalogs #261
OCPBUGS-77235: Use mtv-operator from 4.20 catalog #259
OCPBUGS-77233: Update Konflux references #250
OCPBUGS-77235: Update mtv-operator version #257
NO-ISSUE: Fix linting issues #255
OCPBUGS-76367: Include additional operators in OVE config #252
OCPBUGS-76343: Add lso operator to appliance config #249
OCPBUGS-74933: Update quay.io/konflux-ci/konflux-vanguard/task-rpms-signature-scan:0.2 Docker digest to 2f3015a #221
OCPBUGS-74932: Update Konflux references #219
OCPBUGS-74242: Increase Konflux build pipeline memory #242
AGENT-1313: enable MCO IRI registry #232
OCPBUGS-71231: bump github.com/sirupsen/logrus to v1.9.3 #233
OCPBUGS-72420: Increase capabilities passed via buildah #229
NO-ISSUE: Add 4.22 isobuilder configs #213
AGENT-1334: Examples of golden snapshot and release for OVE ISO image #202
NO-ISSUE:Updating ose-agent-installer-utils-container image to be consistent with ART for 4.22 #216
OCPBUGS-69438: Remove operator manifests; now applied by assisted-installer #211
OCPBUGS-69406: Update quay.io/konflux-ci/konflux-vanguard/task-rpms-signature-scan:0.2 Docker digest to 20eb21c #210
OCPBUGS-69405: Update Konflux references #209
Full changelog

apiserver-network-proxy

NO-JIRA: Merge https://github.com/kubernetes-sigs/apiserver-network-proxy:master (cc6bc61) into main #114
NO-JIRA: Merge https://github.com/kubernetes-sigs/apiserver-network-proxy:master (6eff182) into main #111
NO-JIRA: Update OpenShift carry patches for Go 1.26 / OpenShift 5.0 #113
CNTRLPLANE-3380: Merge https://github.com/kubernetes-sigs/apiserver-network-proxy:master (588e629) into main #109
CNTRLPLANE-3380: Update OWNERS with HyperShift core team #107
CNTRLPLANE-3359: Rebase to v0.34.0 for OCP 4.23 #102
OCPBUGS-77615: Updating ose-apiserver-network-proxy-container image to be consistent with ART for 4.22 #90
OCPBUGS-73992: Updating ose-apiserver-network-proxy-container image to be consistent with ART for 4.22 #89
OCPBUGS-69889: Updating ose-apiserver-network-proxy-container image to be consistent with ART for 4.22 #88
Full changelog

aws-cloud-controller-manager

OCPCLOUD-3643: Merge https://github.com/kubernetes/cloud-provider-aws:master (63ec440) into main #160
UPSTREAM-SYNC: Fix merge https://github.com/kubernetes/cloud-provider-aws:master (c34d66e) into main #158
OCPBUGS-87372: Updating ose-aws-cloud-controller-manager-container image to be consistent with ART for 5.0 #157
OCPBUGS-85643: UPSTREAM: <drop>: bump google.golang.org/grpc to v1.79.3 #154
NO-JIRA: Update OWNERS #145
OCPCLOUD-3215: Add support for dual networking stack services #135
OCPBUGS-69888, OCPBUGS-76344, OCPCLOUD-3276: Merge https://github.com/kubernetes/cloud-provider-aws:master (ea961d6) into main #131
OCPBUGS-76344, OCPCLOUD-3276: Merge https://github.com/kubernetes/cloud-provider-aws:master (dc94f58) into main #120
OCPCLOUD-3341: Updates ecr-credential-provider make target #130
SPLAT-2220: tests/ote: extend tests for gate AWSServiceLBNetworkSecurityGroup #129
SPLAT-2220: tests/ote: introduce openshift-only e2e to validate feature by feature gate #126
TRT-2536: UPSTREAM: <carry>: Fix OTE list tests when SingleReplica #125
Full changelog

aws-cluster-api-controllers

🌱 OCPBUGS-119953: UPSTREAM: <carry>: Remove upstream .github files unused in OpenShift CI #634
✨ OCPCLOUD-3513: feat: add gh-summary target to download manifests from GitHub #617
✨ OCPCLOUD-3513: add a tool to generate manifests-summary #616
🐛OCPBUGS-104496: UPSTREAM: <carry>: Add projected bound SA token volume for OpenShift #624
✨ OCPCLOUD-3538,OCPCLOUD-3556: Exclude unsupported CAPI CRDs and scope ClusterRole #618
🌱 OCPCLOUD-3599: Merge https://github.com/kubernetes-sigs/cluster-api-provider-aws:v2.13.0 (a84670f) into main #623
:seedling: OCPBUGS-95028: bump golang.org/x/net to v0.55.0 for CVE-2026-25681 #622
:rocket: UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-aws:v2.12.1 (13af066) into main #621
🐛 OCPBUGS-85337: set imagePullPolicy IfNotPresent on provider workloads #619
:bug: OCPBUGS-87525: Updating ose-aws-cluster-api-controllers-container image to be consistent with ART for 5.0 #612
OCPBUGS-85567: Bump github.com/go-jose/go-jose/v4 to 4.1.4 #607
NO-JIRA: manifests-gen: scope provider webhooks to capi namespace #605
OCPCLOUD-3359: Add TLS substitutions #598
NO-JIRA: Update manifests generator #604
UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-aws:v2.11.1 (eaa4c99) into main #602
UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-aws:v2.11.0 (815a1b0) into main #600
NO-JIRA: Update OWNERS #599
OCPBUGS-77748: Updating ose-aws-cluster-api-controllers-container image to be consistent with ART for 4.22 #597
NO-JIRA: Merge https://github.com/kubernetes-sigs/cluster-api-provider-aws:v2.10.2 (999ac9a) into main #588
NO-JIRA: Remove dead RELEASE_DIR ref #596
OCPCLOUD-3326: Update to use new manifests-gen #584
NO-JIRA: UPSTREAM: <carry>: Add manifests verify target #586
OCPBUGS-70053: Updating ose-aws-cluster-api-controllers-container image to be consistent with ART for 4.22 #585
Full changelog

aws-ebs-csi-driver

OCPBUGS-87394: Updating ose-aws-ebs-csi-driver-container image to be consistent with ART for 5.0 #324
OCPBUGS-87394: UPSTREAM: <carry>: Updating ose-aws-ebs-csi-driver-container image #326
NO-ISSUE: UPSTREAM: 2911: CVE-2026-33186: bump google.golang.org/grpc v1.80.0 #315
TRT-2576: Revert #301 “STOR-2766: Rebase to upstream v1.55.0 for OCP 4.22” #303
STOR-2766: Rebase to upstream v1.55.0 for OCP 4.22 #301
OCPBUGS-77628: Updating ose-aws-ebs-csi-driver-container image to be consistent with ART for 4.22 #302
OCPBUGS-74521: UPSTREAM: 2806, 2816: Remove VolumeAttributesClass FeatureGate #300
OCPBUGS-69918: Updating ose-aws-ebs-csi-driver-container image to be consistent with ART for 4.22 #296
OCPBUGS-69918: UPSTREAM: <carry>: do not require license in OCP files (follow-up) #298
OCPBUGS-69918: UPSTREAM: <carry>: do not require license in OCP files #297
Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator

OCPBUGS-114002: GCP-1074: feat(gcp-pd): enable HyperShift support for GCP PD CSI driver operator #607
OCPBUGS-111893: Add proxy hook for HyperShift CSI driver controller deployments #599
OCPBUGS-100071: csi-driver-smb: DeleteVolume call fails to mkdir under /tmp #593
STOR-2998: Remove legacy gcp-pd-csi-driver-operator #592
STOR-3060, STOR-3061: implement TLS adherence for AWS EFS and SMB CSI driver operator #587
STOR-2998: Copy the test manifests from the legacy dir to a top-level test dir #589
STOR-2997: Auto generate assets for gcp pd csi driver #585
OCPBUGS-99199: Add networking.k8s.io group policy #579
STOR-2914: Bump all deps for 5.0.0 #582
OCPBUGS-99200: Add networking.k8s.io group policy #581
OCPBUGS-99490: Apply some static assets earlier, before starting controllers #584
STOR-2997: Minimal implementation of GCP PD CSI driver operator #576
STOR-3030: feat(operator): detect GCP Dedicated and use hyperdisk-balanced StorageClass #573
STOR-2996: Sync gcp pd csi driver operator to legacy subdir (2) #575
STOR-2996: Run unit-tests in /legacy subdir #574
OCPBUGS-85106: Add required-scc annotation to EFS and SMB operator deployments #569
OCPBUGS-90151: hack/update-metadata.sh: allow MAX_OCP_VERSION override #571
STOR-2996: Sync gcp pd csi driver operator to legacy subdir #570
OCPBUGS-87449: Updating ose-openstack-cinder-csi-driver-operator-container image to be consistent with ART for 5.0 #566
STOR-2920: Bump OLM metadata to 5.0 #568
STOR-2996: Add gcp pd csi driver operator to legacy subdir #562
OCPBUGS-87270: Updating csi-driver-manila-operator-container image to be consistent with ART for 5.0 #563
OCPBUGS-87236: Updating ose-smb-csi-driver-operator-container image to be consistent with ART for 5.0 #561
OCPBUGS-87387: Updating ose-azure-file-csi-driver-operator-container image to be consistent with ART for 5.0 #565
OCPBUGS-87368: Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART for 5.0 #564
OCPBUGS-87470: Updating ose-azure-disk-csi-driver-operator-container image to be consistent with ART for 5.0 #567
OCPBUGS-87219: Updating ose-aws-efs-csi-driver-operator-container image to be consistent with ART for 5.0 #560
OCPBUGS-42363: Re-enable Azure Disk load test #558
OCPBUGS-86023: Add memory limits to SMB CSI sidecar containers #557
OCPBUGS-85457: Add init container for Manila node daemonset #552
OCPBUGS-84052: Mount writable /tmp in SMB CSI driver #545
OSASINFRA-3675: Rework authentication in Manila CSI Driver Operator #373
OCPBUGS-80930: Add VolumeAttributesClass e2e test manifests for Azure disk #538
OCPBUGS-78291: Allow azure-disk sidecars to read VolumeAttributeClasses #525
STOR-2762: Bump all deps for 4.22 #526
OCPBUGS-77674: Updating ose-openstack-cinder-csi-driver-operator-container image to be consistent with ART for 4.22 #516
OCPBUGS-77553: Updating csi-driver-manila-operator-container image to be consistent with ART for 4.22 #513
OCPBUGS-77612: Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART for 4.22 #514
STOR-2884: Add service to generate a TLS cert for EFS operator #522
STOR-2884: Add service to generate a TLS cert for SMB operator #520
NO-JIRA: Inherit any OpenShift global CodeRabbit setting #519
OCPBUGS-77623: Updating ose-azure-file-csi-driver-operator-container image to be consistent with ART for 4.22 #515
OCPBUGS-77571: Add only to tags to volume object, if volume is not already tagged #518
OCPBUGS-77497: Fix readonly root fs in Azure init containers #512
NO-JIRA: Add coderabbit, including instructions #509
STOR-2752: Early chore: update OCP version in OLM metadata #505
Updating ose-azure-disk-csi-driver-operator-container image to be consistent with ART for 4.22 #517
OCPBUGS-77378: Updating ose-aws-efs-csi-driver-operator-container image to be consistent with ART for 4.22 #510
OCPBUGS-77405: Updating ose-smb-csi-driver-operator-container image to be consistent with ART for 4.22 #511
OCPBUGS-76298: missing readOnlyRootFilesystem in AWS init containers #506
OCPBUGS-74971: Fix azure-disk secret namespace/name args #502
OCPBUGS-74521: Remove VolumeAttributesClass FeatureGate #503
STOR-2523: hypershift: Add desired-version annotation to controller Deployments and use DeploymentVersionController in csi driver operators #457
OCPBUGS-70304: Fix azure-file secret namespace/name #500
OCPBUGS-66113: Some containers do not have readOnlyRootFilesystem #476
OCPBUGS-70085: Updating ose-openstack-cinder-csi-driver-operator-container image to be consistent with ART for 4.22 #483
OCPBUGS-70339: deploy prometheus role and binding on hypershift guest #488
OCPBUGS-63698: fix(azure): add token-minter for self-managed hosted clusters #461
OCPBUGS-69739: Updating csi-driver-manila-operator-container image to be consistent with ART for 4.22 #480
OCPBUGS-69907: Updating ose-azure-file-csi-driver-operator-container image to be consistent with ART for 4.22 #482
OCPBUGS-69710: Updating ose-smb-csi-driver-operator-container image to be consistent with ART for 4.22 #479
NO-JIRA: Add /sniff-test claude command #486
OCPBUGS-69883: Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART for 4.22 #481
OCPBUGS-69982: Updating ose-azure-disk-csi-driver-operator-container image to be consistent with ART for 4.22 #484
OCPBUGS-69695: Updating ose-aws-efs-csi-driver-operator-container image to be consistent with ART for 4.22 #478
STOR-2543: add VAC manifest for tests in AWS EBS #475
STOR-1945: STOR-2056: Add SupportedSizeRange for azurefile-nfs #477
Full changelog

aws-karpenter-provider-aws

OCPBUGS-115308: default max-pods to 250 for Custom AMI family #42
OCPBUGS-100043: Updating aws-karpenter-provider-aws-container image to be consistent with ART for 5.0 #34
AUTOSCALE-644: Release chores 5.0 for Karpenter #33
NO-JIRA: add finalizers resources to chart rbac #31
OCPBUGS-87402: Updating aws-karpenter-provider-aws-container image to be consistent with ART for 5.0 #30
AUTOSCALE-485: rebase to 1.9.0 #26
AUTOSCALE-485: rebase to 1.8.6 #25
AUTOSCALE-293: partially ignore drift on ec2nodeclass userdata field #21
Full changelog

aws-kms-encryption-provider

CNTRLPLANE-4011: Rebase aws-encryption-provider repo to upstream/master (8c16f8c) for OCP 5.0 #52
CNTRLPLANE-3380: Update OWNERS with HyperShift core team #45
Full changelog

aws-machine-controllers

OCPCLOUD-3615: Bump k8s to 1.36 and Go to 1.26 #197
OCPBUGS-47508: Add max-concurrent-reconciles flag to machine actuator #195
NO-JIRA: Bump golang.org/x/crypto to fix CVE #194
NO-JIRA: Cache region validation response and close AWS sessions #190
OCPBUGS-87410: Updating ose-machine-api-provider-aws-container image to be consistent with ART for 5.0 #193
NO-ISSUE: Add opt-in pprof endpoint to machine-controller-manager #189
OCPBUGS-83873: Changed timeout for node ready logic in OTE #185
SPLAT-2715: Fixed broken test and simplified some logic #182
NO-JIRA: Update OWNERS #183
SPLAT-2627: Created OTE Tests for dedicated hosts #174
SPLAT-2700: Added shared tags for BYO DH #181
OCPCLOUD-3283: K8s 1.35 bump #179
CORS-4166: enable IPv6 IMDS endpoint and private DNS configuration for dualstack #177
CORS-4315: enable primary IPv6 when infrastructure ipFamily is DualStackIPv6Primary #171
SPLAT-2617: Added dynamic dedicated host support #172
SPLAT-2558: Add AWS Dedicated Host support #160
OCPBUGS-72390: Fix reconciler consistency checks in Update and Exists #162
OCPBUGS-69950: Updating ose-machine-api-provider-aws-container image to be consistent with ART for 4.22 #161
Full changelog

aws-pod-identity-webhook

OCPCLOUD-3583: Update aws-pod-identity-webhook to k8s 1.36 #220
OCPBUGS-87337: Updating ose-aws-pod-identity-webhook-container image to be consistent with ART for 5.0 #218
NO-ISSUE: Update OWNERS: remove 2uasimojo, suhanime, lleshchi #219
CCO-784: update to pick up tls-min-version and tls-cipher-suites #207
OCPBUGS-74165: Fix GOTOOLCHAIN env var #211
CCO-728: merge upstream changes v0.6.11 #209
OCPBUGS-69825: Updating ose-aws-pod-identity-webhook-container image to be consistent with ART for 4.22 #208
Full changelog

azure-cloud-controller-manager, azure-cloud-node-manager

OCPBUGS-122326: skip public ip check for azure stack #216
OCPBUGS-100185: fix: use PATCH when refreshing failed VMs #201
OCPCLOUD-3591: Merge https://github.com/kubernetes-sigs/cloud-provider-azure:master (4128235) into main #164
OCPBUGS-87408, OCPBUGS-87500: Art consistency openshift 5.0 azure fix #194
OCPBUGS-88486: UPSTREAM: 10458: CVE-2026-39821: x/net v0.55.0 #191
OCPBUGS-85641, OCPBUGS-85642: UPSTREAM: <drop>: bump google.golang.org/grpc to v1.79.3 #184
NO-JIRA: Update OWNERS #174
OCPCLOUD-3281: Merge https://github.com/kubernetes-sigs/cloud-provider-azure:master (314ccf1) into main #155
OCPBUGS-65654: Merge https://github.com/kubernetes-sigs/cloud-provider-azure:master (765f435) into main #152
Full changelog

azure-cluster-api-controllers

🚀 OCPCLOUD-3600: Merge https://github.com/kubernetes-sigs/cluster-api-provider-azure:v1.26.0 (19ff821) into main #388
🐛 OCPBUGS-85337: set imagePullPolicy IfNotPresent on provider workloads #393
NO-JIRA: Don’t specify rules in aggregated cluster role #392
OCPBUGS-87401: Updating ose-azure-cluster-api-controllers-container image to be consistent with ART for 5.0 #391
NO-JIRA: manifests-gen: scope provider webhooks to capi namespace #387
OCPCLOUD-3359: Add TLS substitutions #379
NO-JIRA: Update manifests generator #382
OCPBUGS-84694: Merge https://github.com/kubernetes-sigs/cluster-api-provider-azure:v1.23.1 (dbeb413) into main #380
NO-JIRA: Update OWNERS #376
OCPCLOUD-3294: Merge https://github.com/kubernetes-sigs/cluster-api-provider-azure:v1.23.0 (ac446a1) into main #371
OCPCLOUD-3294: Merge https://github.com/kubernetes-sigs/cluster-api-provider-azure:main (bc68ad9) into main #370
OCPBUGS-77637: Updating ose-azure-cluster-api-controllers-container image to be consistent with ART for 4.22 #369
OCPCLOUD-3324: Update to new manifests-gen #357
OCPBUGS-53004: Remove references to master branch #336
OCPCLOUD-3101: Merge https://github.com/kubernetes-sigs/cluster-api-provider-azure:v1.22.0 (4523016) into master #350
NO-JIRA: UPSTREAM: <carry>: Add manifests verify target #358
OCPBUGS-69934: Updating ose-azure-cluster-api-controllers-container image to be consistent with ART for 4.22 #356
Full changelog

azure-disk-csi-driver

OCPBUGS-121351: UPSTREAM: 3754: chore: upgrade Azure cloud provider lib- #181
OCPBUGS-101779: UPSTREAM: 3756: fix: optionally skip reading the config from the API server #159
OCPBUGS-96820: Bump golang.org/x/net from v0.52.0 to v0.55.0 #156
STOR-2923: Rebase to upstream v1.34.4 for OCP 4.²³⁄₅.0 #149
NO-ISSUE: Bump spdystream to v0.5.1 #151
OCPBUGS-87284: Updating ose-azure-disk-csi-driver-container image to be consistent with ART for 5.0 #152
OCPBUGS-78197: check for node name in waitForDiskManagedByTobeRemoved #144
UPSTREAM: 3569: OCPBUGS-83733: Bump grpc to v1.79.3 #135
OCPBUGS-77248: Rebase to v1.34.2 for OCP 4.22 #124
OCPBUGS-77575: Updating ose-azure-disk-csi-driver-container image to be consistent with ART for 4.22 #123
STOR-2768: Rebase v1.34.1 #120
OCPBUGS-69754: Updating ose-azure-disk-csi-driver-container image to be consistent with ART for 4.22 #119
OCPBUGS-69390: fix ASH static provision segmentation fault #117
OCPBUGS-67186: fix: disk creation failure in AzureStack env #114
Full changelog

azure-file-csi-driver

STOR-2928: Rebase to v1.35.5 for OCP 5.0 #143
OCPBUGS-93742: Bump golang.org/x/crypto/ssh to v0.53.0 #141
OCPBUGS-89331: Bump github.com/kata-containers/kata-containers/src/runtime to address CVE-2026-41326 #138
OCPBUGS-87533: Updating ose-azure-file-csi-driver-container image to be consistent with ART for 5.0 #136
NO-ISSUE: Bump spdystream to v0.5.1 #135
UPSTREAM: 3023: OCPBUGS-83329: Bump grpc to v1.79.3 #124
STOR-2761: Rebase to upstream v1.35.0 for OCP 4.22 #116
OCPBUGS-77798: Updating ose-azure-file-csi-driver-container image to be consistent with ART for 4.22 #117
OCPBUGS-70304: UPSTREAM: 2940: fix: optionally skip reading the config from the API #114
OCPBUGS-70060: Updating ose-azure-file-csi-driver-container image to be consistent with ART for 4.22 #111
OCPBUGS-70060: fix failing unit tests in azure-file-csi-driver #112
Full changelog

azure-kms-encryption-provider

CNTRLPLANE-4025: support sovereign Managed HSM endpoints #55
CNTRLPLANE-4022: Rebase azure-kubernetes-kms to v0.11.0 for OCP 5.1 #52
OCPSTRAT-3549: Correct Managed HSM endpoints #51
CNTRLPLANE-3660: Add AGENTS.md, ARCHITECTURE.md, CLAUDE.md, update CONTRIBUTING.md #49
CNTRLPLANE-3380: Merge https://github.com/Azure/kubernetes-kms:master (126fb87) into main #42
CNTRLPLANE-3380: Add rebasebot-compatible commit prefixes #41
CNTRLPLANE-3380: Update OWNERS with HyperShift core team #35
CNTRLPLANE-3204: feat: add workload identity support to Azure KMS plugin #33
CNTRLPLANE-3358: Sync with upstream Azure/kubernetes-kms #32
OCPBUGS-69961: Updating azure-kms-encryption-provider-container image to be consistent with ART for 4.22 #26
Full changelog

azure-machine-controllers

OCPCLOUD-3616: Bump k8s to 1.36 and Go to 1.26 #206
OCPBUGS-92024, OCPBUGS-98075: bump golang.org/x/crypto to v0.54.0 to fix CVEs #203
OCPBUGS-96854: bump golang.org/x/net to v0.55.0 #204
CORS-4501: azure: Detach frontend count from backend #192
OCPBUGS-87361: Updating ose-machine-api-provider-azure-container image to be consistent with ART for 5.0 #197
PIXAA-7: Leverage SpotRebalanceRecommendation for instance termination when available #196
OCPBUGS-85416: Don’t permanently fail Machines after provisioning #193
NO-JIRA: Update OWNERS #190
OCPCLOUD-3280: Bump k8s 1.35 #189
OCPBUGS-74076: Fix: Enable boot diagnostics for Azure Stack Hub VMs #182
OCPBUGS-74573: Add validation for AzureManaged boot diagnostics on Azure Stack Hub #183
OCPBUGS-77607: Updating ose-machine-api-provider-azure-container image to be consistent with ART for 4.22 #186
OCPCLOUD-3252: Add AGENTS configuration #181
OCPBUGS-69864: Updating ose-machine-api-provider-azure-container image to be consistent with ART for 4.22 #179
Full changelog

azure-service-operator

OCPBUGS-87382: Updating ose-azure-service-operator-container image to be consistent with ART for 5.0 #33
OCPBUGS-83613: Bump grpc package for CVE fix #21
OCPBUGS-69898: Updating ose-azure-service-operator-container image to be consistent with ART for 4.22 #16
NO-JIRA: UPSTREAM: <carry>: add openshift/e2e-tests.sh #22
NO-JIRA: Update OWNERS #20
Full changelog

azure-workload-identity-webhook

OCPBUGS-87379: Updating ose-azure-workload-identity-webhook-container image to be consistent with ART for 5.0 #56
NO-ISSUE: Update OWNERS: remove 2uasimojo, suhanime, lleshchi #57
OCPBUGS-84709: github.com/go-jose/go-jose/v4 v4.1.4 #46
CCO-785: add flag to configure TLS cipher suites #44
OCPBUGS-73994: Updating ose-azure-workload-identity-webhook-container image to be consistent with ART for 4.22 #43
CCO-729: merge upstream changes #42
OCPBUGS-69895: Updating ose-azure-workload-identity-webhook-container image to be consistent with ART for 4.22 #41
Full changelog

baremetal-cluster-api-controllers

OCPBUGS-98546: Remove dangling symlink #87
🐛 OCPBUGS-85337: set imagePullPolicy IfNotPresent on provider workloads #85
OCPBUGS-98329: Grant capi-installer permission on ConfigMap #86
OCPBUGS-87254: Updating ose-baremetal-cluster-api-controllers-container image to be consistent with ART for 5.0 #84
OCPBUGS-86476: Adopt existing Metal3 Remediation CRDs on upgrade #82
NO-JIRA: manifests-gen: scope provider webhooks to capi namespace #79
OCPCLOUD-3359: Add TLS substitutions #74
NO-JIRA: Update manifests generator #75
OCPBUGS-74161: fix: pin metal3remediations CRDs storage version to v1beta1, deploy separate manifests in Default #68
Updating ose-baremetal-cluster-api-controllers-container image to be consistent with ART for 4.22 #67
OCPBUGS-74161: manifests-gen: include IPAM CRDs #65
Merge upstream #63
OCPBUGS-73951: Updating ose-baremetal-cluster-api-controllers-container image to be consistent with ART for 4.22 #58
Update to new manifests-gen #64
Revert “NO-JIRA: Add manifests verify target” #60
NO-JIRA: UPSTREAM: <carry>: Do not ignore files in vendor #59
NO-JIRA: Add manifests verify target #57
OCPBUGS-69724: Updating ose-baremetal-cluster-api-controllers-container image to be consistent with ART for 4.22 #56
METAL-1703: Add AGENTS and “merge-upstream” slash command #55
Full changelog

baremetal-installer, installer, installer-artifacts

OCPBUGS-120677: vsphere: retry and throttle vCenter lookups during UPI VM creation #10849
OCPBUGS-115147: Missing ability to not install Network Observability during installation #10822
OCPBUGS-114620: bump openshift api for gcd feature gate #10845
OCPBUGS-119104: gcp: allow GCD load balancer health-check firewall ranges #10852
Revert “TRT-2925: Revert “CORS-4441: Bump Azure Marketplace Images” (#10802)” #10819
TRT-2925: Revert “CORS-4441: Bump Azure Marketplace Images” (#10802) #10814
OCPBUGS-113634: images: add BUILD_VERSION arg #10801
CORS-4441: Bump Azure Marketplace Images #10802
OCPBUGS-113641: Update timeout in GetMarketplaceImage to 5 minutes #10803
CORS-4549: gcp: set universe domain in Infrastructure status for GCD #10759
OCPBUGS-105449: update GCP auth functions & validations #10694
OCPBUGS-105456: fix KMS service agent domain for sovereign clouds #10752
OCPBUGS-88511: Disable apps DNS validation for add-nodes #10737
NO-JIRA: openstack: pin argcomplete for yq on Python 3.9 #10757
NO-ISSUE: Render OSImageStream in OKD too #10730
OCPBUGS-105407: Remove VSphereMultiNetworks feature gate #10760
OCPBUGS-74510: vsphere: remove VSphereMultiDisk feature gate references #10753
no-jira: Update GCD ability to identify project #10745
no-jira: vendor: update o/api to the latest after several Feature promotions to default #10746
OCPBUGS-101695: bump golang.org/x/net to v0.56.0 #10749
OCPBUGS-85296: export Azure Metadata.Region for state file serialization #10736
CORS-4406: CORS-4407: CORS-4408: CORS-4410: CORS-4411: CORS-4413: Installer use customer managed kms keys to encrypt S3 for Ignition and Internal Registry #10553
OCPBUGS-100189: Patch GCP Load Balancer Health Checks #10731
OCPBUGS-98700: Azure: delete bootstrap ignition storage during bootstrap destroy #10701
OCPBUGS-78995: Azure Machines: Accept explicit image ID #10712
OCPBUGS-104455: Add a 10sec restart interval for ICC service, so that there is enough time for CRDs to become available #10739
no-jira: Update hack scripts to set min go version to 1.26 #10738
CORS-4516: GCP: Configure cloud provider to use mounted creds #10733
OCPBUGS-98102: Add validations Azure Dualstack #10677
CORS-4537: GCP: gracefully handle 503 in disk type check #10732
CORS-3898: azure: Fix the dualstack errors #10656
OCPEDGE-2788: agent: split fencing credentials placement by identification key #10684
OCPBUGS-99164: bootstrap: replace envsubst with sed in konnectivity.sh #10728
CORS-4542: restrict ClusterAPI machine management to only supported platforms #10717
CORS-4425: gcp: add OS image validation for sovereign clouds #10709
CNTRLPLANE-2012: Wire signer certs to read PKI config via SignerKeyParams #10595
OCPBUGS-63133: PowerVS: Error out if VPC does not exist #10137
OCPBUGS-98696: baremetal: fix provisioning ISO kernel arguments #10702
no-jira: bump k8s packages to v0.36 #10713
CORS-4428: gcp: reject PSC endpoint overrides for sovereign clouds #10708
CORS-4514: Set sovereign cloud defaults for machine types #10706
CORS-4537: Add API-backed disk type availability validation #10687
no-jira: azure: Disable shared access key by default #10574
CORS-4507: aws: support edge machine pool management with ClusterAPI #10625
CNTRLPLANE-2847: bootstrap: pass rendered manifests and payload version to etcd render #10679
CORS-3997: azure: update default instance types from v3 to AMD Dasv5 #10565
OCPBUGS-98141, OCPBUGS-99018: bump golang.org/x/crypto to v0.52.0 #10690
CORS-4539: Support sovereign cloud service account email format for gcp/gcd #10691
CORS-4538: Use metadata project ID for sovereign cloud gather #10688
NO-ISSUE: Remove workaround for boot image version mismatch #10665
OCPBUGS-98586: Don’t wait on oc delete in konnectivity_cleanup #10682
OCPBUGS-98529: cluster-api: disable diagnostics endpoint for local CAPI controllers #10681
CORS-4423: GCP: Use WithCredentialsJSON when Possible #10624
OCPBUGS-98157: redact machineconfigs.json from “gather bootstrap” #10678
CORS-4518: Migrate containers libs to new mono repo #10599
CNTRLPLANE-2012: Refactor TLS cert generation to support configurable key algorithms #10594
CORS-4334: konnectivity: remove hostNetwork from konnectivity agent #10662
OCPCLOUD-3368: bumping o/api for new crdcompatibilitychecker and capi capabilities #10618
CORS-4528: Remove OPENSHIFT_INSTALL_EXPERIMENTAL_DUAL_STACK #10654
no-jira: fix vCenter validation error to use correct field name #10663
OCPBUGS-92792: vsphere - fix CNS volume destroy to aggregate errors #10658
CORS-4466: aws: expand public subnet CIDR in public-only mode #10542
CNTRLPLANE-2012: Add PKI config types, validation, and CR manifest generation #10593
OCPBUGS-87841: gather: redact pull-secret auth tokens from machineconfigs.json #10660
OCPBUGS-93627: destroy/aws: delete vpc endpoints earlier #10661
OCPBUGS-91975, OCPBUGS-91976: Include bootstrap gather in agent-gather archive #10501
no-jira: dynamically set CVO upgrade version #10655
CORS-4334: Konnectivity #10344
OCPBUGS-88303: pkg/types/gcp: apply defaultMachinePlatform values #10617
NO-ISSUE: Add AI skill for modifying install-config #10645
OCPBUGS-90537: allow agent TUI to be shown also for rhcos10 base ISO #10640
OCPBUGS-43501: fix kargs handling in ABI Minimal ISO #10578
OCPBUGS-88562: Use yum install vs yum update tzdata #10623
OCPBUGS-89645: Revert: Ensure ssh keys strict permissions after bootstrap pivot #10633
OCPBUGS-89645: Ensure ssh keys strict permissions after bootstrap pivot #10631
OCPBUGS-88701: Exclude bind-mounted crypto policies from rsync #10627
no-jira: add rochacbruno to owners file #10619
CORS-3893: Create nat rule and associate to NIC #10361
MCO-2181: Fix linter error #10622
MCO-2181: Fix ART build version parsing panic in removeGoVersionPrefix #10621
MCO-2181: Default version switchover #10533
OCPBUGS-86498: openstack: add tzdata dependency to CI image #10573
SPLAT-2795: Enhanced vSphere cloud config to include node network cidr information #10614
no-jira: coderabbit: fix tools format #10616
OCPBUGS-87493: Updating ose-baremetal-installer-container image to be consistent with ART for 5.0 #10602
CORS-4503: bump cluster-api to v1.12.8 #10587
OCPBUGS-87484: Updating ose-installer-container image to be consistent with ART for 5.0 #10601
CORS-3898: Add IPv6 DNS records for dual-stack #10330
OCPBUGS-87519: Updating ose-installer-artifacts-container image to be consistent with ART for 5.0 #10603
CORS-4404: pkg/quota: GCP, allow unauthenticated #10611
CORS-3895: Add IPv6 backend pools and load balancing rules for dual-stack #10329
CORS-4236: aws: support worker machine pool management with ClusterAPI #10577
OCPBUGS-76928: Remove workaround to normalize ISO files extensions #10315
OCPBUGS-86471: baremetal: fix hostSelector for default stream #10571
OCPBUGS-85509: Add omitempty to vSphere and Nutanix MachinePool slice fields #10551
fix: OCPBUGS-86012: reset associatedVCenter in failure domain validation loop #10559
OCPBUGS-87169: CVE-2026-34986: Bump go-jose/v4 to 4.1.4 #10596
MCO-2296: Remove OSImageStreams v1 replace #10592
MCO-2296: OSImageStreams v1 promotion #10566
no-jira: remove reference to altinfra #10585
no-jira: improve AI agent readiness with guidelines and AGENTS.md #10474
OCPBUGS-85352: aws: fix Route 53 resource leak during cluster destroy in China regions #10544
MCO-2200: Add day-0 dual streams support for ABI install flow #10481
no-jira: logging: log invoked openshift-install command #10490
NO-ISSUE: Use types.OSImageStreamValues for validation #10576
CORS-4495: Populate RHCOS10 Marketplace Stream #10556
MCO-2181: Set OSImageStream default in install-config #10570
OCPBUGS-84656: Update RHCOS-release-4.22 bootimage metadata to 10.2.20260423-0 / 9.8.20260428-0 #10524
no-jira: PowerVS: Remove unrequired logging #10552
CORS-4005: refactor worker manifest serialization #10407
OCPEDGE-2115: types: support MAC address as alternative identifier for fencing credential #10513
METAL-1731: baremetal: Add coreos.openshift.io/stream label to BMH and hostSelector #10502
OCPBUGS-78126: baremetal: fix gather bootstrap failing with provisioningNetwork Disabled #10395
SPLAT-2452: Add SetSecurityGroups IAM permission to master nodes for BYO SG support for AWS NLBs #10512
MCO-2164: use machine-config-osimagestream to avoid hard-coding image tag names #10416
no-jira: images: bump UPI image dependencies to 4.22 #10538
MCO-2200: refactored node-joiner to use embedded rhcos data #10537
OCPBUGS-79536: Removing AWS security group OVNDB ports as they are no longer used #10441
OCPBUGS-85232: PowerVS: Add port 80 security group rule #10541
no-jira: tests: verify AWS instance type minimum cpu and mem requirement tests #10536
NO-JIRA: pkg/types/nutanix: warn about unused context #10430
SPLAT-2710: Added vSphere day 2 support #10529
OCPBUGS-67159: openstack: Reserve addresses for load balancer #10375
OCPBUGS-77760: verify FIPS mode after installation completes #10348
OCPBUGS-84873: Fix to agent integration test finding agent-tui files #10530
OCPBUGS-84335: vSphere - Missing unit tests to cover polarion workitems #10516
OCPBUGS-84548: add unit tests for Nutanix to replace polarion workitems #10520
no-jira: update to Google Cloud SDK 563.0.0 #10460
MULTIARCH-5824: PowerVS: Fix supported system types retrieval for PowerVS regions #10268
CORS-3933: Add a retry backoff for checking storage in progress #10463
SPLAT-2719: vsphere - remove HostGroup zonal feature gate checks #10497
OCPEDGE-2255: baremetal: reject SNO installation on baremetal platform #10420
OCPBUGS-78932: Improved DHCP network deletion reliability by proactively cleaning up attached network interfaces before retrying deletion #10325
OCPBUGS-83327: PowerVS: update CAPI to v0.12.2 #10488
OCPBUGS-83335: dont save CAPI secrets #10498
AGENT-1417: Add kind verification in InternalReleaseImage check #10332
MULTIARCH-5854: implements retry-after logic to limit failures #10421
OCPBUGS-78151: Add provisioningNetworkGateway field to install-config #10387
OCPBUGS-77965: Update RHCOS-release-4.22 bootimage metadata to 10.2.20260405-0 / 9.8.20260403-0 #10482
OCPBUGS-77917: PowerVS: Use short regions and provide a default resource group in survey #10369
CORS-3900: Add IPv6 frontend IP configurations for dual-stack #10328
MCO-2135: Label Machines, MachineSets, and ControlPaneMachineSets with OSStream labels #10426
OCPBUGS-81509: fix ASO CRD duplication #10451
OCPBUGS-76468: PowerVS:: SSH key must be RSA #10289
no-jira: PowerVS: add mjturek and hamzy to approvers list #10483
OCPEDGE-2072: bump(ocp/api): pull in latest for DualReplica promotion #10471
OCPBUGS-77830: skip redirect when validating endpoint accessibility #10360
OCPBUGS-81622: Collect bootstrap service records in agent-gather #10457
AGENT-1448: Add IRI registry authentication support #10389
OCPBUGS-81635: AWS: Increase cluster bootstrap timeout with userProvisioned DNS #10459
CORS-4373: Remove checks for AzureClusterHostedDNSInstall featuregate #10455
CORS-4316: Update the Installer GCP UPI documentation. #10235
OCPBUGS-81309: Fix vSphere with static IPs on TPNU #10442
OCPBUGS-79542: Mount pullsecret manifest to UI container #10411
OCPBUGS-81470: Restart sshd after applying node-image to bootstrap #10452
OCPBUGS-37587: Sign blob container using user delegated creds #9851
SPLAT-2622: Bump govmomi to v0.53.0 #10431
OCPBUGS-78935: Fix bootstrap VM on non-x86 platforms #10419
CORS-4352: aws: validations to ensure install-config is valid for dualstack install #10380
OCPBUGS-74528: upkeep: remove tna feature gate #10403
NO-JIRA: Add Ella, Daniel to openstack-reviewers #10434
CORS-4324: Update default release image to 4.22 #10429
OCPBUGS-78589: baremetal: add serial console logging for bootstrap VM #10400
CORS-4359: feature gate install into EU Sovereign Cloud #10412
OCPBUGS-59514: redacted install config for baremetal #9972
AGENT-1461: Do not discard NMStateConfig when agent-config is on disk for unconfigured-ignition #10393
AGENT-1471: Fix race condition: wait for agent-register-infraenv before showing UI URL #10422
MCO-2116: Generate OSImageStream manifest #10357
AGENT-1136, AGENT-1229: Add auth to unconfigured-ignition #10381
SPLAT-2172: AWS dedicate host support #10079
MCO-2133: Select bootimages based on OSImageStream #10321
CORS-4336: Support for AWS European Sovereign Cloud #10303
OCPBUGS-74390: Allow all instance types in the install config for GCP #10271
no-jira: fix SC2328 shellcheck errors #10413
AGENT-1458: Don’t auto-calculate RendezvousIP in unconfigured-ignition #10405
CORS-4358: aws: add ICMPv6 ingress rule for dual-stack clusters #10408
CORS-4235: Machine Management API Field & Feature Gate #10402
no-jira: bump golangci-lint to v2.10.1 for Go 1.25 support #10397
OCPBUGS-57603: Disallow cross subscription encryption sets #10335
OCPBUGS-64842: Disable LoadBalancer in cloud config when Octavia is unavailable #10326
CORS-4288: docs(azure): Restructure tested VM families with Series-based organization #10314
CORS-4072: dualstack support for AWS #10353
CORS-4355: define required permissions for dualstack install #10371
CORS-3897: Dual stack support for cluster manifest & VNet #10319
CORS-4078: aws: standardize AWS client setup in the destroy code #10340
OCPBUGS-75250: Use correct Project ID with GCP Shared VPC #10297
METAL-1668: simplify BMC CA assets #10243
METAL-1750: baremetal: use q35 machine type with EFI firmware for bootstrap VM #10349
OCPEDGE-2383: feat: update sno minimum to 4vcpu #10283
CNTRLPLANE-2847: bump Go 1.25, openshift/api, and k8s.io dependencies #10376
OCPBUGS-77717: Updating ose-installer-container image to be consistent with ART for 4.22 #10351
OCPBUGS-78190: Pass image policy env setting to assisted #10379
OCPBUGS-77261: Increase timeout for waiting control plane #10370
OCPBUGS-77742: Updating ose-installer-artifacts-container image to be consistent with ART for 4.22 #10354
NO-JIRA: aws: validate instance type and AMI compatibility for SEV-SNP #10126
CORS-4345: aws: config must be created with install region #10374
OCPBUGS-77722: Updating ose-baremetal-installer-container image to be consistent with ART for 4.22 #10352
no-jira: Golangci config #10372
METAL-156: Use Live ISO for baremetal bootstrap VM #9814
no-jira: Bump openshift api #10347
no-jira: OCPBUGS-77255: wait for node-image-overly to restart sshd #10363
OCPBUGS-77683: Add c8g* to tested_instance_types_aarch64 #10356
OCPBUGS-77440: Image in worker machineset is auto-updated when user specifies the osImage #10341
OCPBUGS-66941: aws: throughput/iops validation for machine pools #10222
no-jira: [OCPBUGS-77255]: kludge: restart sshd server #10345
OCPBUGS-70168: Increase size of /var/ostreecontainer mount #10304
no-jira: ibmcloud: fix region survey default value #10336
OCPBUGS-77355: fix wavelength zone name regex #10338
CORS-4345: remove AWS SDK v1 unused code and go deps #10339
CORS-4244: adjust validations to allow dual-stack CIDRs on AWS #10241
CORS-3954: Enable strict unmarshaling for user invocations #10287
CORS-4076: bump capa version to support dualstack network infrastructure #10337
OTA-1861: data/bootstrap/files/usr/local/bin/bootkube: Pass CVO render –cluster-version-manifest-path #10295
OCPBUGS-77182: PowerVC: Add default LB #10333
OKD-259: Add Validatation for the OKD Featureset to Prevent it From Being Enabled on OCP Clusters #10260
OCPBUGS-54298: Installer should validate mirror registry pull secret #10239
OCPBUGS-56846: validate azure user-assigned identity existence #10220
CORS-4055: migrate CCO permission check to AWS SDK v2 #10262
OCPBUGS-63065: Expand Azure userTags to support Azure Government Cloud #10015
OCPBUGS-55407: set DNS zone for Azure Stack Hub private clusters #10233
CORS-4302: Add N4A instance types to accepted in Installer #10292
CORS-4142: ensure lbType is NLB when dual-stack is configured #10256
MCO-2031: OS Image Stream to install-config schema #10192
CORS-4055: migrate EC2 API calls to AWS SDK v2 #10244
OCPBUGS-60162: reject byo vpc/subnets with CAPI owned cluster tag #9913
OCPBUGS-41570: Ensure correct mask for bootstrap external IP #8987
OCPEDGE-2276: Add support for platform None and External in TNA clusters #10286
OCPEDGE-2276: Add support for platform None in TNA (Two-Node Arbiter) clusters #10236
CORS-4055: migrate credential provider check to AWS SDK v2 #10261
CORS-4328: configure AWS CCM NodeIPFamilies for dual-stack support #10257
CORS-4055, CORS-4078: migrate ELB/ELBv2 API calls to AWS SDK v2 #10258
OCPBUGS-74631: Add validation to reject userProvisionedDNS on Azure Stack Hub #10279
CORS-4055: migrate default region check to AWS SDK v2 #10267
OCPBUGS-74625: gcp: skip AI zones #10269
CORS-4055: migrate IAM API calls to AWS SDK v2 #10245
CORS-4055: migrate S3 API calls to AWS SDK v2 #10242
OCPBUGS-63305: Make SimulatePrincipalPolicy optional #10081
OCPBUGS-67816: Revert storage account API version for client #10224
OCPBUGS-74078: add support for NVIDIA H100 and H200 enabled machine series #10234
CORS-4299, CORS-4300: Allow N4A Instance Types in the installer #10211
no-jira: add trace-config Claude command for installconfig field usage analysis #10190
AGENT-1309: Increase disk size requirements for master and SNO #10254
OSDOCS-17769: Add AWS m7 instance types #10246
CORS-4073: validate instance type support IPv6 in dual-stack #10238
OCPBUGS-74363: Remove region option for the GCP Private Service Connect Endpoint #10249
NO-JIRA: use v2 config for go-lint #10240
AGENT-1425: Fix stale dependency in agent-register-infraenv #10237
AGENT-1309: Modify NoRegistryClusterInstall storage requirements #10176
OCPBUGS-56770: Honor user-specified bootDiagnostics on Azure Stack Hub #10223
OCPBUGS-63028: filtering only PEs from cluster list #10193
CORS-4075, CORS-4113: Install-config and Infra manifest updates for DualStack for AWS and Azure #10207
OCPBUGS-72525: add newly detected instance types for Azure during 4.21 regression test #10202
OCPBUGS-69735: handle SSH rule deletion for Azure private #10213
OCPBUGS-69734: Fix destroy bootstrap command for Azure #10212
NO-JIRA: add user Rolv-Apneseth to coreos-maintainers and coreos-reviewers #10206
OCPBUGS-69923: ensure deterministic zone ordering for control plane machines #10188
NO-JIRA: Add angelcerveraroldan to coreos approvers and reviewers #10209
OCPBUGS-72577: bump default channel to stable-4.22 for main(4.22) branch #10205
OCPBUGS-71232: Fix nil pointer exception in azure mapiImage #10200
OCPBUGS-70013: Updating ose-installer-container image to be consistent with ART for 4.22 #10182
no-jira: Platform Experts Claude Command #10186
no-jira: Add barbacbd for gcp owners #10189
OCPBUGS-70021: Updating ose-baremetal-installer-container image to be consistent with ART for 4.22 #10183
OCPBUGS-70047: Updating ose-installer-artifacts-container image to be consistent with ART for 4.22 #10184
no-jira: Fix linting issues for golangci-lint v2 #10138
NO-JIRA: remove pod-infra-container-image flag from kubelet #10145
OCPBUGS-69870: rename “var-ostree\x2dcontainer.mount” to something more computer-friendly #10171
OCPBUGS-69840: PowerVC: fix PostProvision #10175
OCPBUGS-69434, SPLAT-2584: Added ability to install different IPAM version when in TP. #10169
OCPBUGS-65859: Fix set-hostname dependency for interactive console services #10118
OCPBUGS-17667: Validate vCenter datacenters in failure domain topology #10086
OCPBUGS-61344: skip deleting snapshots managed by AWS Backup service #9964
OCPBUGS-62870: installing into GCP Shared VPC with minimal permissions #10157
OCPBUGS-64775: use CAPZ to provision ssh rule #10162
OCPBUGS-66295: Fix ignition warning about agent-extract-tui.service #10146
AGENT-1357: remove AgentWorkflowTypeInstallInteractiveDisconnected workflow #10020
And 8 elided commits (e.g. from squash or rebase merges)
Full changelog

baremetal-machine-controllers

OCPBUGS-87380: Updating baremetal-machine-controller-container image to be consistent with ART for 5.0 #256
OCPCLOUD-3346: Bump deps + Add centralized TLS configuration to Metal3Remediation webhook server #248
OCPBUGS-77619: Updating baremetal-machine-controller-container image to be consistent with ART for 4.22 #250
OCPBUGS-74161: manifests: remove metal3remediation, now deployed from o/cluster-api-provider-metal3 #249
NO-ISSUE: Update fetch_ext_bins.sh to use setup-envtest for kubebuilder binaries #251
OCPBUGS-73995: Updating baremetal-machine-controller-container image to be consistent with ART for 4.22 #242
NO-ISSUE: Synchronize OWNERS with CAPM3 #241
OCPBUGS-69896: Updating baremetal-machine-controller-container image to be consistent with ART for 4.22 #240
Full changelog

baremetal-operator

NO-ISSUE: Merge upstream 2026-07-30 #516
NO-ISSUE: Merge upstream 2026-07-25 #513
METAL-1900: Merge upstream #510
OCPBUGS-64617: Merge upstream #499
NO-ISSUE: Merge upstream #489
OCPBUGS-87490: Updating ose-baremetal-operator-container image to be consistent with ART for 5.0 #488
NO-ISSUE: Merge upstream #483
OCPBUGS-66071: Fix PPI for ACM #456
OCPBUGS-64617: Merge upstream #473
METAL-1720: Merge upstream #467
METAL-1708: Merge upstream 2026-03-09 #466
NO-ISSUE: Merge upstream #465
Updating ose-baremetal-operator-container image to be consistent with ART for 4.22 #464
NO-ISSUE: Merge upstream #455
Bug OCPBUGS-75006: BMO fails to start servicing despite updates to HFC spec #457
OCPBUGS-65571: Fix deletion hang when aborting inspection during power-off #447
NO-ISSUE: Fix invalidDNSNameinvalidipv6 test for Go 1.24+ #448
OCPBUGS-70265: Fix errors.As usage for NoDataInSecretError #444
NO-ISSUE: Merge upstream #442
OCPBUGS-70018: Updating ose-baremetal-operator-container image to be consistent with ART for 4.22 #441
METAL-1693: Add “merge-upstream” slash command #437
OCPBUGS-65571: Abort inspection/cleaning before powering off during deletion #438
Full changelog

baremetal-runtimecfg

OCPBUGS-112466: Cloud Platforms: Filter out node’s own IP from Upstreams #400
OPNET-785: Add FRR peer-file rendering for BGP-based VIP management #395
OCPBUGS-99496: Detect bootstrap apiserver shutdown via /readyz #396
OCPBUGS-87329: Updating ose-baremetal-runtimecfg-container image to be consistent with ART for 5.0 #393
NO-ISSUE: Bump go to 1.25.10 and x/net to v0.55.0 to fix CVE-2026-33814 #392
NO-ISSUE: Bump go to fix security vulnerabilities #389
OPNET-709: Migrate from iptables to nftables #387
OCPBUGS-77301: Remove VIP leasing feature #385
Updating ose-baremetal-runtimecfg-container image to be consistent with ART for 4.22 #386
OCPBUGS-76394: Install dbus-tools, needed in pkg/monitor/dnsmasqmonitor.go #380
OCPBUGS-42805: Add node caching with Kubernetes watch API to reduce API load #374
NO-ISSUE: Add agents.md and slash command for reviewing #375
MGMT-22546: Fix TNA and TNF dummy ip for ipv6 #369
NO-ISSUE: Migrate away from deprecated ioutil #373
OCPBUGS-69812: Updating ose-baremetal-runtimecfg-container image to be consistent with ART for 4.22 #376
Full changelog

cli, cli-artifacts, deployer, tools

OTA-1959: oc adm upgrade recommend works with accepted risks #2370
OCPBUGS-85019: oc login: Fix polluting KUBECONFIG file #2357
NO-JIRA: Fix issues collection when CVO handles the risks #2352
OCPBUGS-99013: inspect: Redact OAuthClient secrets #2354
OTA-1959: Case 1 - oc adm upgrade recommend shows both Cincinnati-sourced and alert-sourced risks in output #2349
NO-JIRA: Update docs.openshift.com base URL to point to OCP docs #2353
OCPBUGS-101781: Isolate OCP-42982 kubeconfig writes #2337
OTA-1814: Handle accept risks with different commands #2336
OCPBUGS-100310: oc login –exec-plugin oc-oidc fails to refresh expired token against Microsoft Entra ID #2332
Revert “TRT-2817: Revert “Merge pull request #2279 from nbottari9/1814-duplicate-warning”” #2322
OCPBUGS-99757: Include extra scopes in OIDC token cache key #2323
TRT-2817: Revert “Merge pull request #2279 from nbottari9/1814-duplicate-warning” #2320
NO-JIRA: Bump k8s dependencies to 1.36 along with openshift #2318
OTA-1814: fix(alerts): Remove duplicate information in the recommend command #2279
NO-JIRA: Handle wrapped ENOTSUP error #2311
NO-JIRA: First try newer iotop-c and fallback to older one #2317
NO-JIRA: Register the e2e tests for accept in the subfolder #2300
NO-JIRA: Fix staticcheck warnings in pkg/cli/admin/mustgather #2306
NO-JIRA: Fix go vet warning in process.go #2304
NO-JIRA: Bump gitignore dependency #2303
CNTRLPLANE-3786: bump x/crypto to the latest version #2301
NO-JIRA: Move test/e2e/accept.go to its own folder #2294
CNTRLPLANE-3665: Add ARCHITECTURE.md, adopt shared CONTRIBUTING.md, slim README #2293
NO-JIRA: Fix tar slip path traversal in codesign archive extraction #2291
NO-JIRA: accept risks e2e becomes blocking #2280
OTA-1956: oc adm release new: Include base image’s image-references in pruning #2287
OCPBUGS-88342: openshift-clients RPM has a hard dependency on bash-completion #2289
OCPBUGS-87534: Updating openshift-enterprise-deployer-container image to be consistent with ART for 5.0 #2284
OCPBUGS-87198: Fix windows builds of oc rpm #2281
NO-JIRA: Switch container dependencies to Podman monorepo #2277
NO-JIRA: Bump go-jose dependency #2269
NO-JIRA: Making oc cli case blocking #2260
OCPBUGS-62799: Add required-scc annotation to node-joiner pod #2230
OTA-1817: Adding unit tests for the extend recommended alerts #2262
OCPBUGS-78768: Skip filter validation for RFC2307 group query when groupUIDAttribute is “dn” #2259
RFE-3594: Add group membership info #2255
NO-JIRA: claude: Change learn-* agents into skills #2257
NO-JIRA: claude: Improve AGENTS.md and add agents for storing project knowledge #2251
NO-JIRA: claude: Split tester agent away from code-reviewer #2250
OCPBUGS-77845: Fix extraction of gated manifests using –install-config #2249
NO-ISSUE: recover the context in upgrade #2248
NO-JIRA: claude: Turn pr-review skill into code-reviewer agent #2245
OCPBUGS-59311: must-gather: Handle signals properly #2237
OTA-1548: set up accepted risks #2170
MCO-1961: Allow multiple machine-os versions #2157
Revert “TRT-2587: Revert #2219 “CNTRLPLANE-2769: Bump k8s dependencies to 1.35”” #2241
TRT-2587: Revert #2219 “CNTRLPLANE-2769: Bump k8s dependencies to 1.35” #2236
TRT-2585: pkg/cli/admin/release/extract: Support zero-output extraction #2233
OCPBUGS-78701: adm policy add-role-to-user: Fix –dry-run=server #2231
OCPBUGS-77845: Update release extract inclusion to support feature gates and major version #2222
NO-ISSUE: pkg/cli/admin/release/extract: Read manifests into memory #2232
NO-JIRA: Add .coderabbit.yaml and AGENTS.md configurations #2229
CNTRLPLANE-2769: Bump k8s dependencies to 1.35 #2219
NO-JIRA:Fixing manifest ci failure #2228
OCPBUGS-64840: image extract: Use Explicit strategy for ICSP/IDMS #2202
NO-JIRA: fix: reduce the amount of resources for debug pod #2225
NO-JIRA: oc fips ci fix #2224
OTA-1856: pkg/cli/admin/release/mirror: Deprecate in favor of oc-mirror #2195
OTA-1864: Extend update recommend precheck alerts #2210
COS-4005: Allow periods in display name labels for version validation #2215
NO-ISSUE: images/tools/Dockerfile: Install iotop, if that fails fall back to iotop-c #2216
OCPBUGS-76318: pkg/helpers: Print the right error object #2197
OKD-322: Update OC-tools Dockerfile to work on CentOS/RHEL 10 #2205
CNTRLPLANE-2656: fixing oc cli failures #2199
OCPBUGS-76319: Makefile: Strip debugging symbols by default #2196
OCPBUGS-76958: inspect: Allow resource group to be specified in the namespace resources list #2204
OCPBUGS-76394: Ignore group ownership on rpm -V #2206
OCPBUGS-76394: Install subscription-manager in cli image #2200
Revert “CNTRLPLANE-2656: Fixing oc client cases for microshift and metal ipv6 profiles” #2198
CNTRLPLANE-2656: Fixing oc client cases for microshift and metal ipv6 profiles #2192
OCPBUGS-74543: expose: Fix labels not being added to route #2189
Revert “CNTRLPLANE-2656:Migrating oc cli tests to ote” #2191
CNTRLPLANE-2656: Migrating oc cli tests to ote #2181
OSDOCS-18071: Updating CLI docs templates to include a required abstract/short description #2190
OCPBUGS-73893: Fix unit test failure by updating ruby version to 3.3 #2184
NO-ISSUE: add SecurityContext to node image creation and monitor containers #2139
CNTRLPLANE-2167: Adding oc ote sanity test #2180
CNTRLPLANE-2167: Integrate OpenShift Test Extension (OTE) into oc #2177
CNTRLPLANE-2167: Integrate OpenShift Test Extension (OTE) into oc #2176
OCPBUGS-64619: oc login: Respect insecure flag from kubeconfig #2134
NO-JIRA: Bump library-go to update selinux and x/crypto #2169
OCPBUGS-70063: Updating ose-cli-artifacts-container image to be consistent with ART for 4.22 #2168
OCPBUGS-70061: Updating openshift-enterprise-deployer-container image to be consistent with ART for 4.22 #2167
OCPBUGS-69894: Updating ose-tools-container image to be consistent with ART for 4.22 #2166
OCPBUGS-69835: Updating openshift-enterprise-cli-container image to be consistent with ART for 4.22 #2164
NO-JIRA: Bump docker/docker to 28.5.2 to drop containerd/containerd dependency #2162
And 6 elided commits (e.g. from squash or rebase merges)
Full changelog

cloud-credential-operator

CORS-4544: WIF Support on GCD #1073
CCO-848: Add tls-min-version and tls-cipher-suites CLI flags to CCO #1063
OCPBUGS-83624: Embed credentials_request.yaml template in test binary #1072
CCO-837: Replace deprecated golang/mock with go.uber.org/mock #1069
NO-ISSUE: Add patrickdillon to OWNERS #1071
CCO-834, CCO-835, CCO-836: Upgrade to Kubernetes 1.36 with CI and e2e tests #1066
CORS-4524: Enable GCP custom universe domain support for CCO #1068
MULTIARCH-5990: IBM Cloud Staging Endpoint Support for ccoctl #1062
CCO-847: Resolve ci/prow/security job failures #1048
OCPBUGS-96892: Revert “OCPBUGS-87829: Scope minted AWS IAM policies to cluster-owned resources” #1057
OCPBUGS-95187: Reclassify ec2:ModifyNetworkInterfaceAttribute as unscoped #1053
OCPBUGS-33994: Don’t unnecessarily re-reconcile when secrets are externally managed #1042
OCPBUGS-87505: Updating ose-cloud-credential-operator-container image to be consistent with ART for 5.0 #1037
OCPBUGS-87829: Scope minted AWS IAM policies to cluster-owned resources #1043
OCPBUGS-87029: nutanix: fix ccoctl to accept directory for –credentials-source-filepath #1036
NO-ISSUE: Update OWNERS: remove 2uasimojo, suhanime #1038
OCPBUGS-82165: Add retry logic for concurrent IAM policy changes in GCP #1014
OCPBUGS-58181: Fix nil pointer dereference in ensureRolesAssignedToManagedIdentity #987
CCO-683: Remove go-autorest dependency for Azure Stack Cloud configuration #1024
CCO-845: use AlwaysAllow UnhealthyPodEvictionPolicy option in PDBs #1019
CCO-770: Docs: consolidate and simplify short-term token workflows #986
CCO-711: docs: improve the filter when getting the capi pod #1016
OCPBUGS-84712: github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3 #1021
OCPBUGS-84043: go.opentelemetry.io/otel v1.43.0 #1011
OCPBUGS-84044: github.com/go-jose/go-jose/v4 v4.1.4 #1012
OCPBUGS-83449: test-ext: hypershift skip CCO metrics endpoint validation #1010
CCO-738, CCO-739, CCO-740: Overhaul status logic to correctly match spec #1008
CCO-787: use apiserver tls config #965
CCO-824: feat(gcp): add key-storage-method flag for workload identity providers #1004
CCO-779: e2e for removing kube-rbac-proxy container (CCO-779) #991
OCPBUGS-81584: Skip CCO health check test for PowerVS platform #1006
OCPBUGS-81328: tests-ext: Fix MicroShift gating in CCO tests #1005
Revert #978: CCO-738, CCO-739: Set operator condition to Progressing when pod identity webhook pod are updating #1007
CORS-4361: aws: add aws-eusc partition support for OIDC S3 buckets #995
CCO-738, CCO-739: Set operator condition to Progressing when pod identity webhook pod are updating #978
OCPBUGS-79360: google.golang.org/grpc v1.79.3 #992
CCO-788: Remove kube-rbac-proxy container from metrics #983
OCPBUGS-74627: Fix infrastructure resource name filtering in watch predicate #985
CCO-688: test-ext: enable test-extension cases for CI #984
CCO-788: test-ext: Update extend tests to adapt to CCO-788 #981
MON-4475: chore: add permissions on endpointslice to Prometheus Role and use serviceDiscoveryRole: EndpointSlice in ServiceMonitors #964
TRT-2568: Revert “CCO-788: Remove kube-rbac-proxy container from metrics” #982
CCO-788: Remove kube-rbac-proxy container from metrics #976
OCPBUGS-77550: cloud-credential-tests-ext to support multiple architectures #979
CCO-726: Update go modules #974
CCO-767: test-ext: Migrate openshift-tests-private E2E cases #961
CCO-813: Update kubernetes v1.35 and golang v1.25 #967
OCPBUGS-74384: Resolve nil pointer exception in hasResourceTags #966
CCO-805: Ability to use featureGates #962
OCPBUGS-71221: test-ext: remove kubernetes module dependency #957
OCPBUGS-70033: Updating ose-cloud-credential-operator-container image to be consistent with ART for 4.22 #956
CCO-789: Add Agentic AI helper files #953
Full changelog

cloud-network-config-controller

OCPBUGS-87249: on AWS, select associated IPv6 CIDR block for egress IP subnet #228
CORS-4523: support GCP custom universe domain #249
NO-JIRA: Update OWNERS file #229
CORENET-7047: CNCC K8s rebase to 1.36.2 #223
CORENET-7297: Add CodeRabbit AI review configuration #227
OCPBUGS-87475: Updating ose-cloud-network-config-controller-container image to be consistent with ART for 5.0 #224
OCPBUGS-74496: Add UserAgent to Azure SDK client telemetry options #208
GCP-429: feat: Add GCP Workload Identity Federation (WIF) credential support #206
CORENET-6562: CNCC rebase k8s to 1.35.0 #202
OCPBUGS-77711: Updating ose-cloud-network-config-controller-container image to be consistent with ART for 4.22 #207
CORENET-6500: fix lint job and linting failures #201
OCPBUGS-69998: Updating ose-cloud-network-config-controller-container image to be consistent with ART for 4.22 #196
OCPBUGS-45056, OCPBUGS-57447: Refrain from adding Egress IP to public LB backend pool #180
Full changelog

cluster-authentication-operator

NO-JIRA: Remove rh-roman from OWNERS #970
NO-JIRA: Retry conflict errors on UpdateKMSEncryptionStatus function #968
CNTRLPLANE-3237: kms key controller preflight support- #747 #965
CNTRLPLANE-2589: Migrate test/e2e-oidc to OTE + bug fixes(imagestream,scc,Pathological Event Monitor) #945
CNTRLPLANE-3762: Watch openshift-config ConfigMaps in OAuth route health check controller #964
NO-JIRA: bump library-go api and client-go #963
NO-JIRA: Bump library-go #962
CNTRLPLANE-3762: Include system cert pool in proxy resolver transport #961
CNTRLPLANE-3762: Clear IdP validation hash when all identity providers are removed #960
NO-JIRA: Update openshift/* #959
CNTRLPLANE-3762: Add support for component-scoped proxy #946
CNTRLPLANE-3237: creates the kms status provider from the operator client- #741 #958
NO-JIRA: add KMS preflight deploy e2e to encryption-kms-2 #956
CNTRLPLANE-3375: bugfix: make switched controller clear status conditions on delegate controller shutdown #955
CNTRLPLANE-3361: Update openshift/* #957
NO-JIRA: Automatic agentic rebase: Update library-go to d8f45c2 #954
CNTRLPLANE-3237: encryptionstatusprovider: implement UpdateKMSEncryptionStatus #953
CNTRLPLANE-3237: encryptionstatusprovider: use AuthenticationInterface instead of Clientset #952
CNTRLPLANE-3237: intro authenticationEncryptionStatusProvider #951
NO-JIRA: kms to kms key identifier check #941
NO-JIRA: Bump library-go to sync #948
CNTRLPLANE-3234: wire KMS health reporter status writer #947
OCPBUGS-87480: Updating ose-cluster-authentication-operator-container image to be consistent with ART for 5.0 #934
CNTRLPLANE-2589: Migrate test/e2e-encryption to OpenShift Tests Extension framework #944
CNTRLPLANE-2589: Migrate test/e2e-encryption-rotation to OpenShift Tests Extension framework #943
NO-JIRA: Automatic agentic rebase: Update library-go to fd74bb5 #940
CNTRLPLANE-2589: Migrate test/e2e-encryption-perf to OpenShift Tests Extension framework #926
NO-JIRA: bump library-go funcs #935
NO-JIRA: Add test for KMS to KMS migration #938
NO-JIRA: Bump library-go for sync #936
CNTRLPLANE-3720: Add human and agent context files #933
NO-JIRA: Bump library-go #932
NO-JIRA: Update openshift dependencies #931
NO-JIRA: add kms preflight to NP to allow egress #928
NO-JIRA: Store authentication-operator image as OPERATOR_IMAGE #927
NO-JIRA: Automatic agentic rebase: Update library-go to b0f5231 #923
CNTRLPLANE-3210: Update external OIDC config generation to support external claims sourcing #880
NO-JIRA: add preflight command #920
CNTRLPLANE-3363: Register health monitor as command #918
NO-JIRA: kms: bump library-go to get KMS plugin security context #916
CNTRLPLANE-3545: bump library-go to get CA bundle wiring #913
NO-JIRA: Automatic agentic rebase: Update library-go to 7fd5f33 #915
NO-JIRA: Automatic agentic rebase: Update library-go to 0469313 #912
OCPBUGS-86221: Update the well-known readiness controller to properly set cluster-operator conditions #901
CNTRLPLANE-3226: switch to real Vault KMS plugin in CI #909
CNTRLPLANE-3226: bump library-go to get KMS plugin credentials #903
NO-JIRA: Automatic agentic rebase: Update library-go to d8750ed #908
NO-JIRA: Automatic agentic rebase: Update library-go to 0cf249e #907
CNTRLPLANE-3364: remove the old go lib std tests #906
NO-JIRA: bump latest library-go changes #904
NO-JIRA: remove old mock plugin deployment #902
CNTRLPLANE-3236: support deploying Vault mock KMS plugin #899
CNTRLPLANE-3431: restart operator upon config change #897
NO-JIRA: Bump auth with latest library-go changes #900
CNTRLPLANE-3210: Refactor externaloidc controller to support different configuration generation logic #893
CNTRLPLANE-3364: add the kms suite and migrate the kms tests of auth-o to ote #895
CNTRLPLANE-3237: Bump library-go and sync plugin changes #896
CNTRLPLANE-3237: Bump library-go and sync encryption tests with APIServerEncryption struct change #894
CNTRLPLANE-3431: enable tls config injection #892
NO-JIRA: Bump latest library-go changes #890
OCPBUGS-69977: Fix OAuth page showing OKD branding instead of OpenShift #887
OCPBUGS-84951: Fix terminationMessagePolicy on network policy e2e test pods #882
NO-JIRA: Update library-go for latest changes #873
CNTRLPLANE-2523: deploy oauth-apiserver in new OIDC mode when authentication type is OIDC #858
NO-JIRA: Add control-plane-approvers to OWNERS #871
CNTRLPLANE-2625: Add Auth network policy e2e cases #831
OCPBUGS-78403: Do not return error when an IdP returns 500 during a grant check #856
Revert “CNTRLPLANE-2589: Migrate test/e2e-encryption to Ginkgo v2 framework” #857
CNTRLPLANE-2589: Migrate test/e2e-encryption to Ginkgo v2 framework #839
NO-JIRA: OWNERS: add everettraven as reviewer/approver add ibihim as approver #842
CNTRLPLANE-2610: Create network policies for AUTH components #825
CNTRLPLANE-2990: Update CAO to no longer write to the Authentication.spec.webhookTokenAuthenticator field #854
CNTRLPLANE-2996: dependencies: k8s 1.35 rebase #853
CNTRLPLANE-2552: Add support for CEL expression claim mappings for username and groups #850
MON-4473: Migrate Prometheus targets discovering from Endpoints to EndpointsSlices #823
OCPBUGS-74039: Updating ose-cluster-authentication-operator-container image to be consistent with ART for 4.22 #851
CNTRLPLANE-312: Add generation logic for new API fields in the Authentication CR #810
CNTRLPLANE-2589: update cases to execute as serial/parallel #833
CNTRLPLANE-2241: Update library-go to get KMS encryption #837
CNTRLPLANE-2247: Add Test encryption provider migration #838
CNTRLPLANE-2247: Adding KMS TestKMSEncryptionOnOff test for AUTH #834
CNTRLPLANE-2241: Conditionally add the KMS plugin volume mount to the oauth-apiserver container #827
CNTRLPLANE-2589: Migrate serial e2e tests to Ginkgo framework #828
CNTRLPLANE-2247: Add KMS encryption test target #829
CNTRLPLANE-2589: Migrate RouterCerts e2e test to Ginkgo framework #826
CNTRLPLANE-2589: OTE infrastructure #822
API-1835: test/oauth-server-payloadConfigController: adds a test to show which input resources are required to run the operator and the payloadConfigController #786
OCPBUGS-70005: Updating ose-cluster-authentication-operator-container image to be consistent with ART for 4.22 #819
API-1835: adds an integration test for the oauth-server deployment controller #784
CNTRLPLANE-2196: set up openshift-tests-extension for cluster-authentication-operator #816
NO-JIRA: Add agents.md file #818
Full changelog

cluster-autoscaler

OCPBUGS-99660: Fix VPA checkpoint overwrite bug #433
OCPBUGS-92799: UPSTREAM: 10001: chore(clusterapi): add machine phase check for failed machines #430
AUTOSCALE-637: Fix VPA E2E vendoring #429
AUTOSCALE-555: adding openshift provider #417
NO-JIRA: add coderabbit configuration file #422
OCPBUGS-84130: UPSTREAM: 9458: fix(clusterapi): use kind-aware version discovery for infra references #418
NO-JIRA: ignore tool and hack files in .snyk scans #416
OCPBUGS-78152: allow clusterapi provider to skip paused resources #409
OCPBUGS-77631: Updating ose-vertical-pod-autoscaler-container image to be consistent with ART for 4.22 #408
AUTOSCALE-482: VPA E2Es: switch from docker.io ubuntu to k8s-hosted image #406
OCPBUGS-66405: Pick upstream commits to Fix VPA recommender concurrent access panic #403
AUTOSCALE-482, AUTOSCALE-483: 1.35.0 Upstream rebase #401
OCPBUGS-74005: Updating ose-vertical-pod-autoscaler-container image to be consistent with ART for 4.22 #399
OCPBUGS-70023: Updating atomic-openshift-cluster-autoscaler-container image to be consistent with ART for 4.22 #397
OCPBUGS-69928: Updating ose-vertical-pod-autoscaler-container image to be consistent with ART for 4.22 #396
Full changelog

cluster-autoscaler-operator

NO-JIRA: Add /release-chores chore cycle skill #382
OCPBUGS-100034: Dump kube RBAC proxy and do metrics endpoint authn & authz in process #381
AUTOSCALE-642: Release chores 5.0 #380
NO-JIRA: add coderabbit configuration file #375
NO-JIRA: update owners file with autoscale team members #379
AUTOSCALE-555: change default cloud provider to openshift #368
OCPBUGS-87827: only use central TLS profile when the cluster says to #378
OCPBUGS-87339: Updating ose-cluster-autoscaler-operator-container image to be consistent with ART for 5.0 #377
OCPBUGS-52155: Add machinesets to cluster operator related objects #369
AUTOSCALE-660: add enforce node group min size flag #374
OCPBUGS-65578: report Progressing=True on version upgrade #366
AUTOSCALE-560: Add support for using centralized cluster TLS profile for webhook service #367
OCPBUGS-78797: update rbac to include DRA-related resources #365
MON-4498: Migrate Prometheus targets discovering from Endpoints to EndpointSlices #363
OCPBUGS-65471: Add rbac related objects to clusteroperator #364
AUTOSCALE-172: add kube api content type flag to autoscaler #362
AUTOSCALE-483: Prepare for 4.22 #361
OCPBUGS-69828: Updating ose-cluster-autoscaler-operator-container image to be consistent with ART for 4.22 #358
Full changelog

cluster-baremetal-operator

OCPBUGS-123600: Add bmo_validations and ncsi_reject_poweroff OTE test #657
OCPBUGS-115281: Increase firmware e2e timeouts and add HPE Mellanox NIC bastion mapping #651
OCPBUGS-114007: Add batched firmware update tests (bmc+bios+nic) #648
OCPBUGS-111889: drop IRONIC_INSECURE from BMO #644
OCPBUGS-105455: Fix infinite reconciliation loop in EnsureMirrorConfig #641
OCPBUGS-86888: Mount IDMS mirror config into machine-os-images init container #636
OCPBUGS-100033: Migrate metrics from kube-rbac-proxy sidecar to controller-runtime’s SecureServing #638
OCPBUGS-66101: set Progressing=True during cluster update #599
OCPQE-32094: Address review feedback from PR #622 #637
METAL-1922: Bump BMO to latest downstream main branch, update the supported TLS groups for BMO #639
METAL-1833: Add host_fw_components tests to CBO test extension #622
METAL-1795: Add TLS group/curve support #632
OCPBUGS-99278: Apply cluster TLS profile to ironic-proxy container #633
OCPBUGS-99220: static-ip-manager should be optional #631
OCPBUGS-66101: Set Progressing=True during cluster update #629
METAL-1833: Add nic_validation OTE test #627
METAL-1833: Add multi_arch_worker OTE test #625
METAL-1833: Add cbo OTE test #619
METAL-1833: Fix ironic auth tests to run inside metal3-ironic pod #626
METAL-1833: Fix hermetic build compatibility for go-bindata #623
Bug OCPBUGS-90496: Remove metadata.namespace from cluster-scoped ClusterRoleBinding #616
METAL-1833: Add otp tags to ironic tests #624
METAL-1833: Remove openshift-tests-private from vendor directory #621
METAL-1833: Add ironic_* tests to CBO test extension #615
METAL-1833: Add self-contained OTE tests #612
METAL-1833: Add OTE framework and deployment_sanity tests #609
METAL-1730: Pass IMAGE_SHARED_DIR to image-customization-controller #590
OCPBUGS-87290: Updating ose-cluster-baremetal-operator-container image to be consistent with ART for 5.0 #611
OCPBUGS-84934: Add watcher for both TLS Adherence policy and profile changes #597
OCPBUGS-85824: Fix empty IRONIC_BASE_URL #603
OCPBUGS-85496: Fix webhook to validate the actual admission request object #601
OCPBUGS-82526: Fix webhook server not starting due to missing WithValidator #587
OCPBUGS-82531: Bind the plain HTTP 8080 metrics port to localhost #586
OCPBUGS-83612: Fix image-cache to use HTTPS for metal3-state downloads #592
OCPBUGS-78151: Add provisioningNetworkGateway field to CBO #575
METAL-1715: Enforce 1-year validity and 30-day auto-rotation for Ironic TLS certs #570
METAL-1780: Gate TLS profile enforcement on APIServer tlsAdherence field #582
METAL-1720: Add IRONIC_ROOTFS_URL env var for multi-arch rootfs override #583
METAL-1716: Handle IPv6/dual-stack addresses in certificate SANs #573
NO-ISSUE: Update envtest version #580
METAL-1720: Add DEPLOY_KERNEL env var for image-customization-controller #581
METAL-1734: Add support for centralized tls #572
METAL-1714: Populate complete SANs in Ironic TLS certificate #569
OCPBUGS-69399: Allow ProvisioningCIDR for unmanaged network #553
Updating ose-cluster-baremetal-operator-container image to be consistent with ART for 4.22 #568
OCPBUGS-65472: Add ClusterRole to baremetal ClusterOperator relatedObjects #544
OCPBUGS-73970: Updating ose-cluster-baremetal-operator-container image to be consistent with ART for 4.22 #545
OCPBUGS-77027: Update kubebuilder tools to more latest version #556
OCPBUGS-72548: Fix ironic-proxy service routing for port 6385 #546
OCPBUGS-71233: Fix libguestfs /tmp access in machine-os-downloader init container #549
OCPBUGS-70157: Add sharedVolumeMount to machine-os-downloader init container #540
OCPBUGS-67216: Remove the writable ironic CA cert volume mount at /certs/ca/ironic path, ironic will use the writable /conf mount if needed #535
NO-ISSUE: Add AGENTS.md #538
OCPBUGS-69769: Updating ose-cluster-baremetal-operator-container image to be consistent with ART for 4.22 #537
Full changelog

cluster-bootstrap

OCPBUGS-87218: Updating ose-cluster-bootstrap-container image to be consistent with ART for 5.0 #132
OCPBUGS-73886: Fix typo in logs #125
NO-JIRA: Add control-plane-approvers to OWNERS #127
OCPBUGS-69694: Updating ose-cluster-bootstrap-container image to be consistent with ART for 4.22 #124
Full changelog

cluster-capi-controllers

OCPCLOUD-3434: fix REPO_NAME #307
OCPCLOUD-3434: add gh-summary target to download manifests from GitHub #306
OCPCLOUD-3434: Generating manifests-summary #305
OCPCLOUD-3434, OCPCLOUD-3556: Exclude unsupported CAPI CRDs and scope ClusterRole #304
🚀 OCPCLOUD-3598: Merge https://github.com/kubernetes-sigs/cluster-api:v1.13.4 (27f4644) into main #298
CORS-4534: UPSTREAM: <carry>: Enable MachineTaintPropagation feature gate #303
OCPBUGS-85337: set imagePullPolicy IfNotPresent on provider workloads #302
OCPBUGS-87327: Updating ose-cluster-api-container image to be consistent with ART for 5.0 #301
OCPBUGS-53005: Remove references to master branch #235
NO-JIRA: manifests-gen: scope provider webhooks to capi namespace #292
OCPCLOUD-3359: Add TLS substitutions #290
NO-JIRA: Update manifests generator #287
UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api:v1.12.7 (b5fa593) into master #286
OCPCLOUD-3419: Adopt IPAM CRDs on upgrade #274
OCPBUGS-83513: Merge https://github.com/kubernetes-sigs/cluster-api:v1.12.5 (efc7142) into master #275
NO-JIRA: Update OWNERS #278
NO-JIRA: IPAM CRDs: Use negated feature-gate: -ClusterAPIMachineManagement instead of feature-set: Default #273
OCPCLOUD-3291: Merge https://github.com/kubernetes-sigs/cluster-api:v1.12.4 (8c01d2f5) into master #255
OCPCLOUD-3320: Fix continuous reconciliation of cluster-api manifests #269
OCPBUGS-73976: Updating ose-cluster-api-container image to be consistent with ART for 4.22 #262
OCPCLOUD-3320: Use new manifests-gen #259
OCPBUGS-74426: CAPI IPAM CRDs override storage version to v1beta1 #263
NO-JIRA: UPSTREAM: <carry>: Add manifests verify target #261
OCPBUGS-69810: Updating ose-cluster-api-container image to be consistent with ART for 4.22 #258
OCPBUGS-69434: openshift: CAPI IPAM TechPreviewNoUpgrade: set webhooks failurepolicy: Ignore #256
Full changelog

cluster-capi-operator

OCPBUGS-85063: Fix CredentialsRequest capability annotations #630
OCPBUGS-104496: aws: use capa-controller-manager as service account #644
OCPCLOUD-3513: Generate the manifests summary #643
OCPCLOUD-2664: Aggregate controller statuses in clusteroperator controller #574
OCPCLOUD-3647: Consolidate install-time object processing in toBoxcutterRevision #633
NO-JIRA: resolve placeholder version for k8s.io/autoscaler APIs #642
OCPBUGS-100143: e2e: skip CRD Compatibility Checker tests on External topology clusters #638
NO-JIRA: go.mod: pin k8s.io/cri-streaming to v0.36.2 #639
OCPBUGS-100246: Fix e2es on CAPI-native clusters #641
OCPCLOUD-3571: Add OTE e2e tests for ClusterAPIMachineManagementAWS feature gate #613
OCPCLOUD-3538, OCPCLOUD-3556: manifests-gen: enable KRM plugins and add exclude/rename-resources transformers #621
OCPBUGS-84321: ClusterAPIMachineManagement: capi-controllers: excessive restarts of during cluster installation #614
OCPCLOUD-3507: Add OTE e2e tests for ClusterAPIMachineManagement feature gate #606
NO-JIRA: Fix buildComponentList godoc #632
CORS-4512: aws: allow privateDNSName and assignPrimaryIPv6 field on CAPI machines in dual-stack clusters #592
CORS-4512: aws: set IPv6 block on AWSCluster in dual-stack clusters #593
OCPCLOUD-3607: Bump K8S to 1.36 #628
OCPCLOUD-3368: Adding annotations to manifests for CVO to identify #588
OCPCLOUD-3366: crdcompatibility: add validation for CRDData.Type field #625
OCPCLOUD-3542: Add CRD Compatibility Checker OTE e2e tests #599
OCPBUGS-98329: Add aggregated cluster role for extended per-provider RBAC #623
OCPCLOUD-3539: add topology-aware operator for CRD Compatibility Checker #600
OCPCLOUD-3553: change webhook failurePolicy to Fail #620
OCPCLOUD-1645: Scope capi-controllers RBAC to least-privilege #585
OCPCLOUD-3451: Scope capi-operator and capi-installer RBAC to least-privilege #607
OCPBUGS-88035: Add e2e test verifying CAPI EC2 instance ownership tag #594
OCPBUGS-92817: delete MAPI MachineSets before CAPI in e2e cleanup #611
NO-JIRA: Bump golang.org/x/net to 0.56.0 to fix CVE #617
OCPBUGS-85337: fix(manifests-gen): set imagePullPolicy IfNotPresent on provider workloads #618
OCPBUGS-87268: Updating ose-cluster-capi-operator-container image to be consistent with ART for 5.0 #582
NO-JIRA: fix machine sync e2e test flake #612
OCPCLOUD-3569: Initial import of rough provider tooling documentation #609
OCPCLOUD-3570: e2e skip Cluster API authoritative MachineSets in GetFirstMAPIMachineSet #610
NO-JIRA: Fix races in machineset sync units #551
NO-JIRA: Fix a race in MachineSet e2es #605
OCPCLOUD-3455: refine AWS CredentialsRequest permissions #601
OCPBUGS-91667: Bump capi-installer resync to 12 hours #608
OCPCLOUD-3009: Bootstrap OTE framework #597
NO-JIRA: Bump cluster-api-actuator-pkg to fix MachineSet scale tests #598
OCPBUGS-87001: Move installer and revision controllers to their own deployment #576
NO-JIRA: Fix continous reconciliation of VAPs due to server-side defaulting #581
OCPBUGS-86770: Fix OpenStack identityRef conversion and add e2e test #575
NO-JIRA: build: add podman support to container image targets #580
NO-JIRA: Fix flake in infracluster test #578
NO-JIRA: fix shell compatibility in Makefile #572
OCPBUGS-85530: Fix failure to start on arm64 #571
NO-JIRA: Remove stale TODO comment for HostPlacement conversion #569
NO-JIRA: Allow sustaining engineering to self serve dependency updates #553
OCPBUGS-84815: fix: scope webhook to capi namespace, remove unused webhook endpoints #543
OCPCLOUD-2664: Update operatorstatus to write correct sub-Conditions #552
OCPCLOUD-3429: Mount provider images with image volumes #527
NO-JIRA: manifests-gen: scope provider webhooks to capi namespace #544
OCPBUGS-84673: fix: remove retired Microsoft.ClassicStorage permission #547
NO-JIRA: bump controller-runtime-common to latest main #540
NO-JIRA: Updates gemini powered skills / agents #542
NO-JIRA: manifests-gen: set scc annotation in providers Deployments spec #524
NO-JIRA: Adds deep review skill #541
NO-JIRA: fix: re-enable setting/diffing httpProtocolIpv6, CAPA now supports it #537
NO-JIRA: fix: conversion: handle HTTPProtocolIPv6, temporarily disable its diffing #531
OCPBUGS-84378: Refactor e2e newAWSMachineTemplate to use mapi2capi #532
OCPBUGS-84340: Fix e2e flake when workers are in us-west-2b #529
NO-JIRA: fix: tolerate not-found upon infra machine deletion #528
NO-JIRA: Update e2e diagnostics #488
OCPCLOUD-3345, OCPCLOUD-3359: Add support for TLS envsubst substitution #519
OCPBUGS-83601: Bump grpc package for CVE fix #523
NO-JIRA: Fix crdcompatibility flakes after webhook creation #525
NO-JIRA: Update OWNERS #522
NO-JIRA: Optimize envtest CRD loading by specifying necessary files explicitly #520
OCPCLOUD-3319: Remove capiinstaller controller #507
OCPCLOUD-3419: Add adopt-existing annotation #514
NO-JIRA: Fix flake in object pruning envtests #516
OCPBUGS-80922: Add CVO proxy injection annotation to capi-operator Deployment #518
OCPBUGS-81683: fix: remove Microsoft.Resourcehealth/healthevent permission #515
NO-JIRA: Add ClusterAPI singleton to related objects #508
OCPCLOUD-3365, OCPCLOUD-3384: Implement admission action Warn and ensure validations not active when not configured #492
OCPCLOUD-3321, OSASINFRA-3980: Add openstack-resource-controller image to images.json #506
OCPCLOUD-3319: Create installer controller #494
NO-JIRA: Fix 2 failures in ci jobs #485
SPLAT-2167: Added dedicated host support for AWS #374
OCPCLOUD-3319: Convert ReconcileResult to use a builder pattern #501
OCPCLOUD-3319: Simplify RelatedObjects on the cluster-api ClusterOperator #497
NO-JIRA: Common provider manifest fixtures #498
NO-JIRA: Drop unused replace manifests-gen #504
OCPBUGS-77188: Fix CRD Requirement deployment on SNO #502
NO-JIRA: Move ProviderMetadata into manifests-gen #503
NO-JIRA: Fix malformed VAP #499
NO-JIRA: Instruct agents more forcefully to run tests with make unit #496
OCPCLOUD-3319: Bump controller-runtime to v0.23 #495
OCPCLOUD-3290: Dependency bumps for release 4.22 #491
OCPCLOUD-3184: Implement object schema pruning for compatibility requirements #464
OCPCLOUD-3350: Revision controller #469
NO-JIRA: Add CodeRabbit inheritance for org-wide rules #489
OCPCLOUD-3005, OCPCLOUD-3186, OCPCLOUD-3367: Implement validation webhook for custom resource admission #461
NO-JIRA: Remove duplicated vnet delete permission #252
NO-JIRA: improve unit test performance and CI flakiness #487
OCPCLOUD-3369: Implement RequiredVersions functionality for CompatibilitySchema #471
OSASINFRA-3980: Re-add openstack credentials request #478
NO-JIRA: e2e: improve failure diagnostics #484
OCPCLOUD-3386: Implement feature-gate support in capi-operator endpoint #475
OCPCLOUD-3364: Implement ExcludedPaths functionality for CRD validation webhook #467
NO-JIRA: Add missing CVO annotations to RBAC #480
NO-JIRA: Set admission failure policy to Ignore #479
OCPCLOUD-3329: Manifests gen all the VAPs #470
NO-JIRA: Update HaveCondition to version from revision controller branch #481
OCPBUGS-77363: manifests-gen: fix nil deref for non-webhook CRDs #482
NO-JIRA: e2es improvements #473
NO-JIRA: coderabbit: Tell it not to warn about old Go #474
NO-JIRA: Add timeout to all eventually entries with contexts #472
OCPCLOUD-3005: Add CRD admission time validation implementation #459
OCPCLOUD-3262: MAPI & CAPI MachineSet VAP #440
OCPCLOUD-3005: Add MWC/VWC to compatibility requirements RBAC #466
NO-JIRA: Adds test-standards skill for claude #468
OCPCLOUD-3005: Initial implementation of CompatibilityRequirement reconciler and webhook #458
OCPBUGS-77036, OCPCLOUD-3342: provider images disconnected support #463
OCPCLOUD-3005: Bootstrap compatibility requirements deployment #457
OCPCLOUD-3327: Rewrite manifests-gen to support upgrade safety #434
NO-JIRA: Fix NetworkPolicy for openshift-capi-operator namespace #453
OCPCLOUD-3327: Fix up related objects #452
OCPBUGS-74295: Move installer controller to independent manager #447
NO-JIRA: fix: e2e: workaround for flakes caused by OCPBUGS-74571, until it is fixed #449
OCPBUGS-61949: Remove references to cluster-api-operator image #384
OCPCLOUD-3315: Add AWS CPUOptions to conversion #438
OCPCLOUD-3017: add SHARD_ARGS #442
OCPCLOUD-2566: tests with VAP msgs #386
NO-JIRA: Fix AWS fuzz tests by constraining Volume throughput to int32 range #441
OCPCLOUD-3263: CAPI MachineSet creation validation #437
OCPBUGS-69737: Updating ose-cluster-capi-operator-container image to be consistent with ART for 4.22 #436
NO-JIRA: Update openshift/api #439
OCPCLOUD-3172: machinesetsync: refactor to a generalized differ which can work independent of types #382
OCPCLOUD-2640: CAPI Machine creation validation #412
NO-JIRA: Write provider version to openshift/provider-version.mk #424
OCPCLOUD-3105: make use of sigs.k8s.io/cluster-api’s v1beta2 #428
OCPBUGS-63524: fix: e2e: CAPI creation issue/scale-down wait issue/machine nodeRef comparison issue #429
Full changelog

cluster-cloud-controller-manager-operator

OCPBUGS-112453: Moved node sync job creation from manifest to operator controller #506
OCPBUGS-112077: Bump cloud-provider-aws to fix NLB e2e occasional timeout failures #505
CORS-4551: GCP: mount bound sa token volume #502
OCPBUGS-100052: Created new job to update vSphere nodes to have vsphere label #497
OCPBUGS-105409: chore: remove AWSServiceLBNetworkSecurityGroup feature gate references #500
CORS-4516: GCP: Update Required Permissions #493
OCPCLOUD-3610: Update to K8s 1.36.3 dependencies #496
OCPBUGS-99755: OTE: fix AWS endpoint resolution for non-standard partitions #494
SPLAT-2713: Reapply “Merge pull request #476” to bring in e2e for BYO SG for AWS NLB #492
OCPBUGS-98617: Fixes daemonset Progressing=True logic #490
Revert #476 “SPLAT-2713: Update AWS CCM e2e test module version” #491
SPLAT-2713: Update AWS CCM e2e test module version #476
OCPBUGS-64852: Fixes progressing=True condition reporting #488
TRT-2777: Revert #479 “Revert ‘TRT-2754: Revert Updates clusteroperator_controller progressing’” #487
OCPBUGS-64852: Revert “TRT-2754: Revert “Updates clusteroperator_controller progressing”” #479
OCPBUGS-87334: update Dockerfile base image to ocp/5.0 #483
NO-JIRA: manifests: Shift operator Deployment and ClusterOperator after CredentialsRequests #478
TRT-2754: Revert “Updates clusteroperator_controller progressing” #477
OCPBUGS-64852: Updates clusteroperator_controller progressing #473
OCPBUGS-64852: Progressing fix #467
SPLAT-2792: Fixed issue where old vCenters not removed from new cloud config #469
OCPBUGS-86303: e2e/ote-ccm-aws: enhance tests to run hybrid in hypershift HC #464
NO-JIRA: update owners for CCM-AWS OTE path for SPLAT teeam #468
OCPBUGS-42837: Do not set Degraded=True on transient errors #436
OCPBUGS-86299: e2e/ccm-aws-ote: support to dual-stack IPv6 primary #466
OCPBUGS-85414: fix ote ccm aws e2e resiliency on HCP #462
OCPCLOUD-3436: use AlwaysAllow UnhealthyPodEvictionPolicy option in PDBs #457
SPLAT-2651: Added support to manage kube-cloud-config for vSphere in openshift-config-managed #442
NO-JIRA: fix: add pod annotation: openshift.io/required-scc: hostaccess #450
NO-JIRA: bump controller-runtime-common to latest main #456
SPLAT-2562: Refactored OTE and added new 3CMO OTE binary #446
OCPBUGS-83399: e2e/ote/ccm-aws fix hairpin traffic on NLB and CLB in EUSC #449
NO-JIRA: Update OWNERS #448
NO-JIRA: fix: report all degraded controller conditions instead of first only#444 #444
OCPCLOUD-3348: Honor TLSAdherence #440
SPLAT-2672: e2e/ote/ccm-aws: moving OTE binary from CCM-AWS #437
OCPBUGS-78118: Add delete permission for Azure load balancers in credentials request #438
OCPCLOUD-3287: Update to k8s 1.35.1 dependencies #439
OCPBUGS-73979: Updating ose-cluster-cloud-controller-manager-operator-container image to be consistent with ART for 4.22 #432
CORS-4209: ensure NodeIPFamilies field is kept as-is after transforming #426
OCPBUGS-62176, OCPCLOUD-3348: tls: use centralized TLS profile #433
OCPBUGS-16728: Add admission policy to deny changing an AWS LB type on an existing service #362
OCPBUGS-69820: Updating ose-cluster-cloud-controller-manager-operator-container image to be consistent with ART for 4.22 #430
Full changelog

cluster-config-api

OCPBUGS-114877: move empty CRIOCredentialProviderConfig CR to run-level 0000_10 #3019
OCPBUGS-114620: Promote GCD to Default #3017
OCPBUGS-83412: Disable PSA for placeholder for 5.0 #3002
OCPBUGS-112657: Handle Sippy date-only format in featuregate-test-analyzer #3007
CNTRLPLANE-3871: promote OSStreams feature gate to Default for Hypershift #2997
TRT-2908: Revert openshift/api#2986 #2992
CNTRLPLANE-3609: graduate etcdBackendQuota to GA #2987
CNTRLPLANE-3871: promote OSStreams feature gate to Default for Hypershift #2986
MON-4608: add interrupts to NodeExporterCollectorConfig CRD types #2955
STOR-3014: Promote SELinuxMountGAReadiness to GA #2964
Promote ExternalOIDCWithUpstreamParity to Default feature set #2915
STOR-2959: Promote VolumeGroupSnapshots to GA #2965
Move GCD to TechPreview #2970
OCPNODE-4521: Promote AdditionalStorageConfig feature gate to Default #2858
MON-4625: add support for the nvmesubsystem collector #2960
Promote IrreconcilableMachineConfig to GA #2929
NE-2777, NE-2778: Implement Gateway API management knob #2890
Use regex instead of format help for KMS secret name validation #2966
OCPBUGS-74511: Remove RouteExternalCertificate feature gate #2962
MON-4607: add zoneinfo to NodeExporterCollectorConfig CRD types #2948
AGENT-1493: Promote NoRegistryClusterInstall Feature to Default #2859
MON-4620: expose remote-write protocol version #2958
CORS-4417: Add UniverseDomain field to GCPPlatformStatus #2963
OCPNODE-4622: Promote CRIOCredentialProviderConfig feature gate Default #2844
NE-2823: Promote Multi HAProxy Versions feature to default #2947
MON-4616: add support for dmmultipath collector #2956
CORS-4387: Promote AWS DualStack to Default #2797
CNTRLPLANE-3237: Kms plugin health report clean up #2931
OPRUN-4705: Remove NewOLMPreflightPermissionChecks FeatureGate #2957
SPLAT-2827: Added vSphere failure domain to vcenter check #2932
Check all hypershift variants when the featuregate is not platform specific #2951
OCPBUGS-80958: NodeUID in status to detect replaced node with same name #2821
OPRUN-4691: Promote OLMLifecycleAndCompatibility feature gate to Default #2920
OPNET-780: Add BGPBasedVIPManagement feature gate and BGP VIP management fields #2923
CNTRLPLANE-3361: Align with latest beta API of Vault #2936
Update KAL to latest #2939
NE-2569: Promote Dynamic Configuration Manager to Default #2788
Adapt publish kubebuilder tools to ocp5 + publish k8s v1.36 kubebuilder tools #2941
CNTRLPLANE-3237: Add KMS preflight check API to operator/v1 #2916
CORS-4435: GCP Sovereign Cloud Feature Gate #2810
OCPSTRAT-3036: Rebase 1.36.2 #2813
OCPBUGS-91634: CAPI: Fix ImageDigestFormat validation to allow deep registry paths #2918
Sippy timestamp filter should use Millisecond unix timestamp for proper filtering #2928
Remove AzureClusterHostedDNSInstall Featuregate #2902
OCPNODE-4604: Upgrade v1 criocp payload resource #2900
CONSOLE-5163: Add labels field to Ingress componentRoutes #2845
tooling: Update verify-feature-promotion logic for installer-focused features #2903
CNTRLPLANE-3751: osin: Add ProxyTrustedCA field to OAuthConfig #2917
Integrate models-schema into codegen and fix openapi verify issues #2904
CNTRLPLANE-3629: features: promote ExternalOIDCExternalClaimsSourcing to TechPreviewNoUpgrade #2893
CNTRLPLANE-3745: Add AuthenticationComponentProxy API for component-scoped proxy #2909
NE-2217: Add haproxyVersion in IngressController API #2895
SSCSI-245: Rename rotationPollIntervalSeconds to minimumRefreshAge #2906
OCPBUGS-94869: fix(crd): adjust storage settings for CRIOCredentialProviderConfig #2913
AGENT-1522: Graduate InternalReleaseImage from v1alpha1 to v1 #2880
PIXAA-16: Updates API review skill #2910
NE-2729: Add feature gate for multiple HAProxy versions #2852
CORENET-6714 Adding documentation #2907
MON: rename remote write SafeAuthorization to Authorization #2901
AUTOSCALE-827: add KarpenterOperator feature gate #2898
Add Protobuf generation to the codegen utility #1385
SPLAT-2718: Promote VSphereMixedNodeEnv to GA #2798
SPLAT-2588: Promoting AWSServiceLBNetworkSecurityGroup on hypershift #2838
STOR-2771: Add SELinuxMountGAReadiness FG #2882
OCPEDGE-2746: Add MutableTopology feature gated infra spec.controlPlaneTopology #2891
OCPNODE-4125: Introduce to v1 CRIOCredentialProviderConfig #2725
STOR-2966: Promote ExternalSnapshotMetadata feature gate to TechPreviewNoUpgrade #2887
OCPBUGS-63219: Add protocol to AWS NLB parameters #2661
SSCSI-245: Add Secrets Store CSI driver configuration to ClusterCSIDriver API #2846
OCPCLOUD-3368: Adding cabilities for crdcompatibilitychecker and capi CRs #2884
SPLAT-2588: fix hypershift topology variant to match Sippy classification #2899
CNTRLPLANE-2449: feat: implement OpenAPIModelNamer interface #2856
OCPBUGS-90053: add new serviceAccountToken fs type #2894
operator/v1: replace anyOf with CEL XValidation for maxConnections #2861
CNTRLPLANE-3513: add kms health reports #2881
NE-2278: Move ingresscontroller api file to proper name #2892
CORS-4029: Promote AWS ClusterHostedDNSInstall to Default #2775
Revert “TRT-2701: Revert “SPLAT-2793: Promoted VSphereMultiVCenterDay2 feature gate to TP”” #2886
NO-JIRA: tools: fix verify-codegen in git worktrees #2888
OCPCLOUD-3540: Add MachineAPIMigration platform-specific featuregates for Azure, BareMetal, GCP, and PowerVS #2889
PIXAA-13: evals for api review command #2606
MCO-2294: promote OSStreams to GA in self-managed clusters #2849
TRT-2701: Revert “SPLAT-2793: Promoted VSphereMultiVCenterDay2 feature gate to TP” #2885
Monitoring API: remove maximum retention days prometheus #2851
SPLAT-2793: Promoted VSphereMultiVCenterDay2 feature gate to TP #2879
OCPBUGS-87497: Updating ose-cluster-config-api-container image to be consistent with ART for 5.0 #2878
CNTRLPLANE-3395: Lower maximum allowed etcd quota from 32 to 16GiB #2840
OCPEDGE-2410: feat: add mutable topology featuregate #2872
Add KubeletConfigAccepted const in ‘machineconfiguration/v1/types.go’ #2853
MON-4029: Add KubeStateMetricsConfig to ClusterMonitoring API #2778
MCO-2296: Promote OSImageStreams to v1 #2854
MON-4565: Add enableUserAlertmanagerConfig to ClusterMonitoring API #2855
Update getLatestReleases to ignore non OCP releases #2868
NE-2334: Implement enhancement in OpenShift API to support for TLS curves in TLSProfile #2583
Revert “Merge pull request #2693 from jcmoraisjr/OCPBUGS-74511-remove… #2862
CNTRLPLANE-2521: feat: configv1/authentication: add fields for sourcing claims from external sources #2827
MON-4578: Add new fields to ThanosQuerierConfig #2835
CNTRLPLANE-3361: make transitMount required #2847
MON-4579: Remove NodeSelector and Tolerations from NodeExporterConfig #2837
CORENET-6714: Enable Network Observability on Day 0 #2752
OCPBUGS-74511: remove RouteExternalCertificate feature gate #2693
CNTRLPLANE-3361: update vault kms plugin validation #2836
OCPSTRAT-3036: Promote MutatingAdmissionPolicy feature to Default #2832
OPRUN-4590: Add OLMLifecycleAndCompatibility feature gate #2824
CNTRLPLANE-3237: Rename KMSConfig Struct to KMSPluginConfig #2833
SRVKP-11558: remove deprecated k8s.io/api packages removed in v0.36.0 #2834
CORENET-6861: Promote EVPN Feature Gate #2799
Revert “OCPBUGS-83492: Allow :ref suffix in additionalLayerStores path for stargz-store to support lazy image pulling” #2823
MON-4561: API: Add softirqs node-exporter collector to ClusterMonitoring CRD #2825
Clarify cluster operator Progressing condition #2829
OCPNODE-4498: features: drop DRAPartitionableDevices awareness #2828
OCPBUGS-43353: Add pattern validation for registry entries in image config #2787
SPLAT-2649: Added vSphere Day 2 logic to CRDs #2784
OCPBUGS-74506: Remove ConsolePluginSecurityPolicy featuregate #2683
CNTRLPLANE-2711: add vault kms plug configuration api #2805
OCPBUGS-74525: OCPBUGS-74526: Remove UserNamespacesPodSecurityStandards and UserNamespacesSupport #2762
OCPBUGS-82584: Add labelSelector to MachineSet status for scale subresource #2807
OCPBUGS-83754: fix(config/v1): define constants for authentication types as typed constants #2814
OCPBUGS-83492: Allow :ref suffix in additionalLayerStores path for stargz-store to support lazy image pulling #2806
MON-4037: Add MonitoringPluginConfig to ClusterMonitoring API #2768
fix: small typos in comments in types.go #2804
OCPBUGS-82292: extend supported values for MCN IRI image status field #2800
MON-4036: Add NodeExporterConfig to ClusterMonitoring API #2744
OCPCLOUD-3359: Add component names, manifestSubstitutions, and observedGeneration to CAPI revisions #2786
MON-4035: Add ThanosQuerierConfig to ClusterMonitoring API #2769
NE-2520: Promote GatewayAPIWithoutOLM to GA #2772
OCPEDGE-2197: Promote TNF (Dual Replica) to default #2723
OCPBUGS-81627: Load ClusterResourceQuota CRD before CVO manifests #2796
OCPEDGE-2492: feat: promote pacemaker to v1 in prep for tnf #2792
Update verify-feature-promotion HTML output to sort entries and fix overflow #2793
Include candidate tier in default sippy queries for feature promotion #2789
CNTRLPLANE-2796: promote the event-ttl feature #2722
OCPBUGS-74533: Remove GCPClusterHostedDNSInstall featuregate #2776
NO-ISSUE: Fixes KubeletConfig API doc, adds tests and kubebuilder validation #2651
CORS-4365: Promote AzureClusterHostedDNSInstall to default #2774
Add ConfidentialCluster feature gate #2779
SPLAT-2664: Added new feature gate VSphereMultiVCenterDay2 #2783
CNTRLPLANE-3115: Add envtest releases for 4.15 and 4.16 #2785
CNTRLPLANE-2777: add TypeMeta to GenericControllerConfig #2780
tools: codegen: increase sippy request timeout for feature promotion verification #2782
MON-4036: Add TelemeterClientConfig to ClusterMonitoring API #2755
Allow JobTier=candidate in featuregate-test-analyzer with warning #2781
SPLAT-2320: vsphere vm-host zonal ga #2731
NE-2512: operator/ingress: Add configurationManagement option #2757
CORS-4337: allow AWS Europe Sovereign Cloud partition #2708
AGENT-1473: add InternalReleaseImageDegraded state type for MachineConfigNodeStatus Conditions field #2777
CNTRLPLANE-3010: Add API-side validation to enforce prefixPolicy is not set when username expression is used #2771
OCPBUGS-74528: upkeep: HighlyAvailableArbiter has been GA for 2 releases #2759
Improve feature-gated CEL validation merge semantics #2770
OPRUN-4513: Move OLMv1 Single/Own Namespace support back to TP #2766
CORENET-6390: API changes and feature gate for OVN-Kubernetes no-overlay mode #2537
OPRUN-4466: Add NewOLMConfigAPI feature gate #2756
Add TLS adherence feature gate #2680
TRT-2518: Add variant OS and JobTier to promotion check #2763
MCO-2142: Avoid OSImageStream defaultStream unset #2764
OCPBUGS-74513: OCPBUGS-74519: OCPBUGS-78487: Remove MachineConfigNodes and PinnedImages feature gates and v1alpha1 references #2715
CORS-4348: feature gate for EU Sovereign Cloud support #2740
NO-ISSUE: config/v1alpha1: Drop (Cluster)ImagePolicy since the hard cut to v1 #2760
Add prometheusConfig API #2653
OCPBUGS-74531: Remove ImageVolume #2689
MCO-1985: Move boot image skew enforcement to Default #2758
SPLAT-2637: Promoting gate AWSServiceLBNetworkSecurityGroup to GA #2717
MON-4033: Add OpenShiftMetricsConfig #2726
envtest-releases: add v1.35.1 to index #2748
Fix MachineConfiguration BootImage Enum for MachineSets/ControlPlaneMachineSets #2750
OCPBUGS-74514: OCPBUGS-74515: OCPBUGS-74516: OCPBUGS-74517: remove bootimage update feature gates #2733
OTA-253: Add cluster update preflight mode API #2684
OCPBUGS-74508: Remove GatewayAPI featuregates #2742
NO-ISSUE: Update dev go image #2735
Add CodeRabbit inheritance for org-wide rules #2746
CNTRLPLANE-2522: features: add ExternalOIDCExternalClaimsSourcing feature gate #2743
MCO-2142: OSImageStream.spec.defaultStream validation #2736
CNTRLPLANE-2550: Add support for CEL expression claim mappings for username and groups #2719
NO-JIRA: Add MachineAPIMigrationVSphere feature gate for DevPreview #2739
CNTRLPLANE-1752: Add PKI API to config.openshift.io/v1alpha1 #2645
NO-JIRA: LabelSelector should have omitzero #2741
OCPNODE-4060: Add additional storage configuration fields to ContainerRuntimeConfig #2681
AI: Adds a new /generate-tests Claude command that automates the generation of integration tests #2706
OCPSTRAT-2728: Rebase 1.35 #2578
OCPCLOUD-3386: Add platform-specific feature gates for CAPI Operator features #2730
ClusterAPI revision components can be empty #2728
NO-JIRA: feat: add link to sippy for tests #2732
SPLAT-2410: Promote ClusterAPIMachineManagementVSphere to TechPreview #2724
Require APIExcludedFields Versions to be set #2727
OCPBUGS-32275: Add ingress.spec.domain immutability validation #2695
MON-4032: Add PrometheusOperatorAdmissionWebhookConfig to ClusterMonitoringSpec #2716
refactor: use deepcopy-gen style in DeepCopyInto functions #2721
OCPNODE-3880: Add empty CRIOCredentialProviderConfig resource #2711
NO-JIRA: feat: update the html for feature promotion #2714
Ensure unique paths for excluded fields in compatibility requirement #2720
OCPBUGS-76919: add listtype atomic #2713
CNTRLPLANE-2586: postpone the removal of the DeploymentConfig API #2646
CCXDEV-15605: Promote InsightsOnDemandDataGather and InsightConfig feature gate to default #2473
OCPSTRAT-2876: Enable major version segmentation of enabled feature gates #2637
MCO-2126: Add defaultStream field to OSImageStream spec #2709
Prefer feature-gate manifest inclusion for merged CRDs #2712
CORS-4096: Add DNS Record Type for IPv6 Domain mapping #2361
OCPBUGS-74512: Remove CPMSMachineNamePrefix featuregate #2677
OCPCLOUD-3214: Add ClusterAPI config #2564
SPLAT-2615: Added support for dynamic AWS dedicated hosts #2650
config/v1: TLSSecurityProfile: align with Mozilla v5.7 guidelines for Go by removing unsupported go ciphers #2697
NE-2480: Add featuregate for Gateway API without OLM #2691
Feature gate CVO application of CompatibilityRequirement CRD #2701
Update integration test timeout and make parallel where possible #2702
STOR-2878: Graduate MutableCSINodeAllocatableCount to GA #2673
OCPBUGS-67232: Move DynamicConfigurationManager back to TPNU #2621
OCPNODE-4078: Add DRAPartitionableDevices to TechPreviewNoUpgrade #2694
OCPBUGS-74521: Remove VolumeAttributesClass FeatureGate #2675
MON-4031: Add prometheusOperatorConfig API #2481
Remove graduated SDN feature gates #2672
OCPNODE-3863: Add CRIOCredentialProviderConfig API #2557
add Insights capability to Insights CRDs #2682
CodeRabbit should not be looking at openapi generated content #2688
MCO-1931: Promote ManagedBootImagesCPMS feature gate to the Default featureset #2679
OCPBUGS-74527: Remove ProcMountType #2676
OCPBUGS-55654: Remove AlibabaPlatform FeatureGate #2671
Re-enable NewOLMBoxcutterRuntime featuregate in TPNU #2659
OCPBUGS-68343: Introduce KMSEncryption feature gate #2669
Fix payload CRD/FetaureGate ordering #2667
OCPEDGE-2084: Add PacemakerStatus CRD for two-node fencing #2544
OCPBUGS-56851: make multiline comments for oidc one line for better crd gen and better oc explain description format #2655
no-jira: Validate AWS resource tag keys with aws: prefix #2183
NO-JIRA: Fix Infrastructure PlatformType comment #2660
OCPEDGE-2084: chore(tools): bump controller-tools with XValidation ordering fix #2658
Update KAL to latest and configure new linters #2662
OCPCLOUD-2998: Add synchronizedAPI to Machine and MachineSet status #2642
CORENET-6609: Add EVPN featuregate #2649
OCPBUGS-73855: Permit other machine managers when skew enforcement is in Automatic mode #2648
CONSOLE-4986: Add Guided Tour capability flag to Console API and vendor it into console-operator #2644
OCPCLOUD-3166: machine-api: disallow unsetting authoritativeAPI #2091
Add insights v1 to payload #2632
CNTRLPLANE-1750: Add FeatureGate: ConfigurablePKI #2545
NO-JIRA: update TLS security profile documentation for clarity and consistency #2595
OPRUN-4226: [OLMv1]: Promote NewOLMOwnSingleNamespace to GA #2527 #2527
SPLAT-2603: Added support for legacy AWS dedicated hosts #2643
Extend ClusterVersion for accepted risks #2360
CNTRLPLANE-311: adding auth config missing fields to API #2487
NO-JIRA: Rename ImagePolicy nested types to prevent PKI collision #2626
Reapply “Merge pull request #2448 from opokornyy/CCXDEV-15259-io-v1” #2631
OCPBUGS-70025: Updating ose-cluster-config-api-container image to be consistent with ART for 4.22 #2634
Add configuration for coderabbit #2635
DevPreview: NetworkConnect feature gate #2629
OCPCLOUD-3164: Add CompatibilityRequirement #2479
Disable the statusoptional linter #2633
Migrate away from deprecated ioutil #2603
OKD-259: Support an “OKD” featureset to be enabled by default on OKD clusters #2451
NO-JIRA: remove beta enabled TranslateStreamCloseWebsocketRequests feature from gates #2613
And 2 elided commits (e.g. from squash or rebase merges)
Full changelog

cluster-config-operator

OCPBUGS-104562: Mark kube-cloud-config recreation test disruptive #497
MON-4499: Migrate Prometheus targets discovering from Endpoints to EndpointSlices #468
CNTRLPLANE-2270: Update README with operator responsibilities #496
CNTRLPLANE-2270: OTE scaffolding and E2E tests #492
CNTRLPLANE-3423: feat: have CVO inject the centralized TLS configuration into the operator’s config #491
SPLAT-2747: Updated kube cloud config controller to react to feature gate updates #489
SPLAT-2717: Migrate vSphere sync of kube-cloud-config to 3CMO #481
CNTRLPLANE-1544: manifests: Use restricted-v3 scc for deployment #451
OCPEDGE-2071: bump(ocp/api): pull in latest for DualReplica promotion #480
OCPBUGS-74528: bump: ocp/api ocp/libray-go #475
API-1646: Add config-operator workload and namespaces network policies #463
OCPSTRAT-2876: Teach config operator to filter feature gate manifests by major version inclusion #459
NO-JIRA: OWNERS: remove engineer who has left Red Hat #466
OCPBUGS-73988: Updating ose-cluster-config-operator-container image to be consistent with ART for 4.22 #460
CORS-4340: add NodeIPFamilies configuration field #472
NO-JIRA: bump: pull in latest ocp/api #471
OKD-320: Migrate to OKD featureset for OKD clusters #462
OKD-259: Allow the OKD feature set to upgrade #461
CNTRLPLANE-2272: Refactor tests-ext initialization to improve error handling #457
OCPBUGS-69859: Updating ose-cluster-config-operator-container image to be consistent with ART for 4.22 #456
CNTRLPLANE-1311: Simplified test infrastructure to single-module architecture #452
Full changelog

cluster-control-plane-machine-set-operator

OCPBUGS-115467: Guard against empty workspace field on vsphere #419
OCPBUGS-105222: GCP e2e: bump only memory for E2 custom machine types #417
NO-JIRA: Fix flaky unit-test harness races and tight timeouts #416
OCPCLOUD-3611: Bump Kubernetes dependencies to 1.36 #414
OCPBUGS-87338: Updating ose-cluster-control-plane-machine-set-operator-container image to be consistent with ART for 5.0 #408
OCPBUGS-86860: Fixed issue where nameserver is not set when recreating cpms #406
NO-JIRA: bump controller-runtime-common to latest main #403
NO-JIRA: Update OWNERS #399
OCPCLOUD-3349: Honor TLS adherence, allow TLS overrides via flags #398
OCPCLOUD-3284: Bump to k8s 1.35 and associated deps. #397
OCPBUGS-77596: Updating ose-cluster-control-plane-machine-set-operator-container image to be consistent with ART for 4.22 #396
OCPBUGS-77259: e2e: improve formatting of cluster operators stabilization timeouts, bump suite timeout #394
OCPCLOUD-3349: tls: use centralized TLS profile #381
TRT-2542: Revert Fix framework initialization #391
OCPBUGS-74343: Fix framework initialization #384
OCPBUGS-74512: Remove CPMSMachineNamePrefix feature gate #387
NO-JIRA: mockgen deprecated: use uber-go/mock instead #374
OCPBUGS-74478: Bump openshift/api to get latest AWSMachineProviderConfig type #385
OCPBUGS-67230: Fix Makefile to use vendor mode #377
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

cluster-csi-snapshot-controller-operator

STOR-3005: Remove v1beta2 group snapshot API #283
STOR-2914: Bump all deps for 5.0.0 #285
STOR-2967: Update SnapshotMetadataService CRD asset from v1alpha1 to v1beta1 #279
STOR-2954: feat: have CVO inject the centralized TLS configuration into the operator’s config #276
STOR-3003: Update group snapshot CRDs to support both v1 and v1beta2 APIs #282
OCPBUGS-87354: Updating ose-cluster-csi-snapshot-controller-operator-container image to be consistent with ART for 5.0 #277
OCPBUGS-87252: Fix group snapshots on HyperShift #278
OCPBUGS-82535: Fix PDB unhealthyPodEvictionPolicy field name #271
STOR-2762: Bump all deps for 4.22 #270
OCPBUGS-77601: Updating ose-cluster-csi-snapshot-controller-operator-container image to be consistent with ART for 4.22 #269
STOR-2523: Add desired-version annotation to controller Deployment and use DeploymentVersionController in csi-snapshot-controller-operator #251
OCPBUGS-73791: Re-add serving cert volume mount to hypershift guest cluster manifest #264
OCPBUGS-66390: Set client throttling parameters #261
OCPBUGS-69854: Updating ose-cluster-csi-snapshot-controller-operator-container image to be consistent with ART for 4.22 #262
Full changelog

cluster-dns-operator

OCPBUGS-86009: Fix dns operator reporting Progressing=True on scale up #477
NE-2817: Gate operator metrics TLS on tlsAdherence via ShouldHonorClusterTLSProfile #484
NE-2765: Bump Kubernetes to 1.36.2 and Go to 1.26 #483
NE-2743: Support centralized TLS security profiles for CDO metrics #482
NO-JIRA: Add aswinsuryan (asuryana@redhat.com) to OWNERS #479
OCPBUGS-87391: Updating ose-cluster-dns-operator-container image to be consistent with ART for 5.0 #478
NE-2391: Add progressive disclosure AI agent context #471
OCPBUGS-77532: Fix premature node schedulability marking in taint checking #470
OCPBUGS-78085: Fix dual-stack service update by preserving IP families #467
NE-2500: Added network policies for DNS #468
OCPBUGS-62178: Dynamically set kube-rbac-proxy TLS args #466
OCPBUGS-14346: Fix when DNS operator reports Degraded #373
NE-2469: Migrate away from deprecated ioutil #454
NE-2482: bump k8s libraries to v0.35.0 and cr to v0.23.1 #459
CNTRLPLANE-1544: manifests: Enable user namespaces #451
OCPBUGS-69912: Updating ose-cluster-dns-operator-container image to be consistent with ART for 4.22 #463
OCPBUGS-65498: Add openshift-dns-operator ClusterRole to ClusterOpera… #455
NO-JIRA: Add NI&D team members to OWNERS #465
NE-2414: Use trafficDistribution: PreferSameNode for openshift-dns Service #457
Full changelog

cluster-etcd-operator

OCPBUGS-121354: feat: add cert-watcher DaemonSet to restart etcd on CA bundle rotation #1702
OCPBUGS-111703: Fix tnf_cluster_in_service during per-node maintenance #1681
OCPBUGS-114671: fall back to intermediate ciphers during etcd bootstrap #1690
OCPBUGS-111300: Derive console notification docs URL from cluster version #1679
CNTRLPLANE-4136: update api to pull in etcd db ga #1682
OCPEDGE-2118: Fix pcs stderr handling #1674
CNTRLPLANE-3460: Refactor defrag controller to lower impact of defrag #1618
OCPBUGS-81500: fix: udpate healthcheck previous state only after successful operator status update #1614
OCPBUGS-105357: Fix TNF fencing skip for IPv6 bracketed stonith IPs. #1669
CNTRLPLANE-3403: reduce default snapshot-count to 5000 #1666
OCPBUGS-84695: feat(tnf): TNF job controller framework and lifecycle management #1655
NO-JIRA: add ceo disruptive suite to sippy’s disruptive #1667
OCPBUGS-100294: fix TNFNodeInMaintenance PromQL label mismatch #1664
OCPBUGS-94106: Add APIServer informer to EnvVarController cache sync #1659
OCPBUGS-100072: Revert ‘OCPBUGS-88490: fix etcd operator deadlock when etcd-endpoints configmap is stale’ #1660
OCPEDGE-2094: Add console notifications for pacemaker health events #1654
CNTRLPLANE-3609: update TestEtcdDBScaling to also include the validation check for BackendQuotaGiB #1656
OCPEDGE-2118: Record Kubernetes events for etcd transition lifecycle #1653
OCPEDGE-2707: Add TNF Pacemaker PrometheusRule alerts #1650
CNTRLPLANE-2847: render: Read FeatureGate CR from rendered manifests #1648
OCPEDGE-2705: Add TNF Pacemaker metrics controller #1634
CNTRLPLANE-2847: Support PKI customization #1593
CNTRLPLANE-3727: Agentic context docs and contributing guide #1639
OCPBUGS-66334: remove version check from guard precheck #1520
OCPBUGS-87522: Updating cluster-etcd-operator-container image to be consistent with ART for 5.0 #1629
NO-JIRA: update build-machinery-go to pull in updated verify #1642
NO-JIRA: quote bootstrap IP in bootkube etcd endpoints manifest #1640
OCPEDGE-2770: fix: handle default-port BMC URLs in Phase 3 address matching #1638
OCPBUGS-88318: fix cluster-restore-tnf.sh IP auto-detection when hostname diverges from node name #1633
OCPBUGS-88490: fix etcd operator deadlock when etcd-endpoints configmap is stale #1631
OCPEDGE-2736: feat: support MAC-based fencing secrets in update-fencing-credentials.sh #1630
NO-JIRA: Update vendored openshift/api and test for backendQuotaGiB max=16 #1635
ETCD-704: cluster-restore.sh: move extra /var/lib/etcd files to backup #1628
OCPBUGS-77345: validate snapshot before destructive operations in cluster-restore-tnf.sh #1626
OCPEDGE-2116: feat: support MAC-address based fencing credentials lookup #1600
OCPBUGS-83332: fix cluster-restore-tnf.sh for FQDN hostnames #1622
NO-JIRA: Fixed spelling in files and file names #1624
OCPEDGE-2604, OCPEDGE-2605: feat: add update-fencing-credentials.sh script for TNF fencing credentials rotation #1611
CNTRLPLANE-3392: Migrating etcd otp cases to ote #1612
NO-JIRA: Replace bash env var validator with go implementation #1606
NO-JIRA: separate grpc from http server #1598
NO-JIRA: fix CI failure #1599
NO-JIRA: Refactor render test validation #1597
NO-JIRA: Add control-plane-approvers to OWNERS #1594
NO-JIRA: Apply go fix changes #1589
NO-JIRA: Remove unused lib/resourcemerge package #1590
OCPEDGE-2495: upkeep: bump ocp/api ocp/client-go #1591
OCPBUGS-81340: pacemaker CronJob: tune history limit and Job TTL #1581
OCPEDGE-2495: feat: update pacemaker in preparation for DualReplica promotion #1587
OCPBUGS-81341: fix: add correct annotations to stop update events #1580
CNTRLPLANE-2621: Restart operator when TLS config changes #1556
OCPBUGS-80959: fix(tnf): align Pacemaker kubelet and etcd retry pacing #1578
CNTRLPLANE-2668: Migrating go standard etcd cases to ote #1575
NO-JIRA: add Lance as a reviewer #1576
OCPBUGS-78956: Disable member cache for quorum checker in TNF #1568
OCPBUGS-65626: upgrade library-go to latest changes #1566
OCPBUGS-78930: add tnf jobs to network policy exceptions #1574
ETCD-557: Add e2e Network policy test cases #1543
Revert “OCPBUGS-77947: fix(tnf): do not block on stable revision after external etcd transition” #1572
OCPBUGS-74679: fix: tweaking kubelet resource config to allow automatic fencing recovery #1561
OCPBUGS-70050: Updating cluster-etcd-operator-container image to be consistent with ART for 4.22 #1569
MON-4484: chore: add permissions on endpointslice to Prometheus Role and use serviceDiscoveryRole: EndpointSlice in ServiceMonitors #1536
OCPBUGS-77947: fix(tnf): do not block on stable revision after external etcd transition #1562
OCPBUGS-76538: Removed unneeded ETCDCTL_API environment variable #1560
OCPBUGS-76331: fix: truncate job names to respect k8s 63-char limit #1554
NO-JIRA: fix unit-test flake in revision tests #1558
NO-JIRA: update cert injection annotations to beta #1551
NO-JIRA: Clean up stale Pacemaker attributes before TNF cluster restore #1553
OCPBUGS-74151: Wait for revision stability before removing etcd members #1540
NO-JIRA: fix: add missing priority class from status checker #1552
OCPEDGE-2097: Add pacemaker health check for ExternalEtcd clusters #1487
OCPEDGE-2231: [TNF] feat: Allow podman-etcd and kubelet resource-agent to restart on start failure #1513
NO-JIRA: [TNF] disable etcd member management after etcd handover #1534
OCPBUGS-66152: split grpc requests slow into read/write alerts #1532
OCPBUGS-73857: Prefer to remove members where they have another healthy machine in the same failure domain index #1528
OCPBUGS-68371: fix bootstrap race condition #1524
OCPBUGS-38659: bump inertia from 5-10 minutes #1531
OCPBUGS-38659: configure inertia for all controllers #1527
OCPBUGS-60588: [TNF] support restore for pacemaker-managed etcd #1521
OCPBUGS-62422: deps: Update library-go to update pruner #1526
And 5 elided commits (e.g. from squash or rebase merges)
Full changelog

cluster-image-registry-operator

OCPBUGS-121350: imageconfig: Preserve ImageStreamImportMode during upgrade race #1367
OCPBUGS-100042: Updating ose-cluster-image-registry-operator-container image to be consistent with ART for 5.0 #1359
CORS-4520: GCP Universe Domain Support #1356
OCPBUGS-99257: Improve GCS KMS encryption error handling and documentation #1344
CORENET-7355: Remove redundant ingress rule from image-registry netpol #1354
OCPBUGS-96818: bump golang.org/x/net #1353
OCPBUGS-85107: fix required-scc annotation on image-pruner pods #1351
CNTRLPLANE-3658: Add AGENTS.md, ARCHITECTURE.md, CLAUDE.md, update CONTRIBUTING.md #1352
OCPBUGS-66225: Fix image-registry Degraded=True blips during upgrades #1350
OCPBUGS-73768: bugfix: podtemplatespec: update topology spread constraints #1347
NO-JIRA: fix flaky TestGlobalTLSCopy unit test #1341
OCPBUGS-84725: Fix stale config cache causing incorrect deployment #1329
OCPBUGS-63691: replace node-ca shell script with go implementation #1325
IR-486: use AlwaysAllow UnhealthyPodEvictionPolicy option in PDBs #1326
NO-JIRA: Add control-plane-approvers to OWNERS #1324
OCPBUGS-83282: Allow longer window before going Degraded #1318
CNTRLPLANE-2660: e2e testing automation: Image Registry network policy #1320
OCPBUGS-66225: ImageConfigController: add inertia before ImageConfigC… #1319
CNTRLPLANE-3184: Create network policies for image-registry components #1301
OCPBUGS-81750: Use deterministic S3 bucket naming to prevent orphaned buckets #1317
OCPBUGS-66225: ImageConfigController: wait for ClusterVersion informe… #1316
OCPBUGS-66225: fix degraded blip on stale config caches #1304
OCPBUGS-66225: migrate to go 1.25 #1305
IR-350: make metrics server tls configuration file-based #1297
OCPBUGS-74495: Fix Azure Stack Hub compatibility with dual SDK approach #1287
OCPBUGS-62626: only report Progressing=True when progressing towards new configuration #1293
OCPBUGS-66225: bump deployment ProgressDeadlineSeconds to 120s #1298
CNTRLPLANE-2651: Fix OTE suite qualifiers to use proper CEL expressions #1300
CNTRLPLANE-2651: OTE infrastructure #1283
IR-350: keeps registry tls config in sync with cluster #1278
OCPBUGS-62626: only report Progressing=True when progressing towards new configuration #1286
NO-JIRA: fix TestImageRegistryRemovedWithImages flake #1288
OCPBUGS-74495: Migrate Azure storage management to new ARM SDK #1281
IR-350: bump library-go to the latest version #1276
OCPBUGS-69751: Updating ose-cluster-image-registry-operator-container image to be consistent with ART for 4.22 #1275
OCPBUGS-66203: clear affinities on an individual API call #1273
Full changelog

cluster-ingress-operator

OCPBUGS-114134: Preserve server-defaulted fields on init containers and volumes #1563
OCPBUGS-109738: Add BackendTLSPolicy and ReferenceGrant e2e test coverage helpers #1550
OCPBUGS-99921: Annotate GatewayClass when istiod is available to fix startup race #1540
OCPBUGS-100424, OCPBUGS-104205: Harden DNS duplicate-domain ownership checks #1543
OCPBUGS-99920: Vendor sail-operator from OSSM release-3.4.1 #1527
OCPBUGS-100435: Set Accepted=False and Prometheus alert for ListenerSets on managed Gateways #1539
TRT-2874: Revert #1513 “NE-2836: Set Accepted=False and Prometheus alert for ListenerSets on managed Gateways” #1537
NE-2833: Replace deprecated io/ioutil usage #1531
NE-2823: Bump API to promote Multi HAProxy Versions feature #1535
OCPBUGS-85680: Re-fetch infraConfig on every periodic loop iteration #1458
OCPBUGS-31521: Don’t publish duplicate DNS records #1229
NE-2836: Set Accepted=False and Prometheus alert for ListenerSets on managed Gateways #1513
OCPBUGS-63219: Support NLB protocol to configure proxy protocol and client IP preservation #1426
OCPBUGS-100186: Rename network policy in TestContainerLoggingMinLength #1532
NE-2585: Bump GWAPI to v1.5.1 and Istio v1.30.1 #1530
NE-2796: Respect OpenShift TLS Profiles during Istio/GatewayAPI installation #1480
NE-2742: Apply cluster TLS security profile to operator metrics and canary endpoints #1501
OCPBUGS-86841: Add BackendTLSPolicy to Gateway API e2e CRD test coverage #1523
CORS-4451: GCP: Set Universe Domain #1515
NE-2809: Add upgradeable logic for HAProxy version #1517
OCPBUGS-99775: Update TestHTTPHeaderBufferSize for HAProxy 3.2 response code change #1524
OCPBUGS-90616: Add GRPCRoute to Gateway API e2e CRD test coverage #1482
NE-2737: Add support for TLS curves in router deployment configuration #1478
NE-2764: Bump Kubernetes to 1.36.2 and Go to 1.26 #1505
OCPBUGS-98310: Bump sail-operator install library to OSSM 3.4.0 #1508
NE-2219: Select HAProxy version from IngressController API #1498
TRT-2793: Revert Bump sail-operator install library to OSSM 3.4.0 #1507
OCPBUGS-98310: vendor sail-operator install library from OSSM 3.4 #1456
NE-2218: Add new HAProxy 2.8 and 3.2 image references #1499
NE-2664: deploy haproxy as sidecar #1484
OCPBUGS-86833: Detect orphaned OSSM subscription after noOLM migration #1475
Revert “NE-2664: deploy haproxy as sidecar (#1439)” #1483
NE-2664: deploy haproxy as sidecar #1439
OCPBUGS-90505: Guard OLM watches with capability check in gatewayclass controller #1479
OCPBUGS-65476: Add openshift-ingress-operator ClusterRole to ClusterO… #1313
OCPBUGS-87445: Updating ose-cluster-ingress-operator-container image to be consistent with ART for 5.0 #1463
NO-JIRA: Add aswinsuryan (asuryana@redhat.com) to OWNERS #1466
OCPBUGS-87205: Add configuration override for X-SSL strip #1465
NE-2692: Replace iptables with nftables in TestConnectTimeout e2e test #1443
OCPBUGS-36723: Add missing include annotations to IBM Cloud and PowerVS ingress CredentialsRequests #1457
NE-2723: Migrate to aws-sdk-go-v2 #1445
OCPBUGS-85679: Improve e2e tests reliability #1434
OCPBUGS-85676: Harden CRD permission RBAC in operator ClusterRole #1454
OCPBUGS-74497: Add UserAgent to Azure SDK client telemetry options #1400
OCPBUGS-85690: Add referencegrants and backendtlspolicies to Gateway API RBAC #1453
OCPBUGS-84491: Set terminationMessagePolicy on gateway proxy containers #1428
OCPBUGS-83923: Update grpc-go and x/net #1447
NE-2662: use AlwaysAllow UnhealthyPodEvictionPolicy option in PDBs #1431
OCPBUGS-80966: Fix malformed PEM bundle when tls.crt lacks trailing newline #1405
OCPBUGS-84773: Allow host network connections to the ingress canary #1430
OCPBUGS-81442: TestUnsupportedConfigOverride: Ignore featuregate and defaults #1408
OCPBUGS-84551: isFIPSEnabled: Check FIPS_ENABLED env. var. first #1427
OCPBUGS-54702: change default timeout tunnel if using AWS NLB #1349
OCPBUGS-81192: Fix race condition in internal-to-external LB migration test #1407
NE-2390: Adding AGENTS.md file #1341
OCPBUGS-25739: Fix PDB MaxUnavailable for 2-replica ingress controllers #1380
OCPBUGS-81550: AWS, Azure and GCP ClusterHostedDNS: Add Ingress LB IPs to Infra CR after masters up #1411
OCPBUGS-76609: Do not take over OSSM subscription #1398
NE-2332: Implement ROUTER_CURVES environment variable #1409
OCPBUGS-3917: filter non-FIPS TLS 1.3 ciphers from ROUTER_CIPHERSUITES on FIPS clusters #1401
NE-2501: Add network policies for ingress resources #1392
OCPBUGS-79376: Bump to OSSM 3.3.1 and Istio v1.28.5 #1406
OCPBUGS-78541: Move TestIngressControllerCustomEndpoints to run last #1388
OCPBUGS-79467: Change default log level from DEBUG to INFO #1402
NE-2519: Move Sail Library to official release branch #1404
NE-2523: Implement configurationManagement API #1385
OCPBUGS-79667: Use feature-gate annotation for Sail Library RBAC #1393
NE-2396: gatewayclass: Enable Horizontal Pod Autoscaling #1326
CORS-4335: Add support for AWS European Sovereign Cloud #1360
NE-2421: Support dual-stack IngressController on AWS #1376
OCPBUGS-62237: Apply APIServer TLS security profile to canary daemonset #1386
OCPBUGS-78523: gatewayapi_controller: Replace sync.Once with retry for GatewayClass field indexer setup #1382
OCPBUGS-62627: cluster operator ingress reported Progressing=True wit… #1299
OCPBUGS-62238: configure tls profile for router metrics #1378
NE-2285: Bump to OSSM 3.3.0 and Istio v1.28.4 #1396
OCPBUGS-77457: Respect proxy configuration on gwapi provisioning #1383
NE-2471: Replace OLM-based Istio install with Sail Library #1354
NE-2501: Add RBAC to allow operator to manage network policies #1389
OCPBUGS-78555: Increase Gateway E2E timeout to 5 minutes #1390
NE-2131: tests-extension: Append suite names to OTE test specs to preserve original test names #1387
NE-2418: Add e2e test for haproxy_max_connections metric #1361
NE-2183: Implement GatewayAPI status controller #1294
NE-2131: tests-extension: restore test names and remove metadata tracking #1379
OCPBUGS-77493: e2e: Increase GatewayClass acceptance timeout to 5m #1372
OCPBUGS-77704: Update annotations in gatewayclass to use the istio version #1375
NE-2131: Add OpenShift Tests Extension scaffolding with GatewayAPI CRD tests #1371
OCPBUGS-74508: Remove the GatewayAPI feature gate #1366
NO-JIRA: enable inheritance on coderabbit #1373
OCPBUGS-74511: remove RouteExternalCertificate feature gate #1355
OCPBUGS-65629: ensure canary daemon set uses its own service account. #1310
OCPBUGS-77305: Bump to OSSM 3.2.2 and Istio 1.27.5 #1350
NO-JIRA: Add coderabbit to CIO #1348
OCPBUGS-58145: reload serving cert on rotation #1285
NE-2481: bump k8s libraries to v0.35.0 #1356
NE-2434: E2E test for internal LoadBalancer Annotations #1353
OCPBUGS-64565, OCPBUGS-9037: Ensure canary cert matches the default ingress controller’s cert #1334
NE-2395: Fix e2e tests to work on platforms with unmanaged DNS #1342
NE-2374: Add e2e test for Gateway API infrastructure annotations #1331
NE-2435: Bump Gateway API CRDs to v1.4.1 #1343
OCPBUGS-16728: Require Service Deletion for LB Type Updates #1142
NO-JIRA: add jcmoraisjr to owners #1346
OKD-259: Bump openshift/api and add support for OKD featureset specific CRDs #1324
OCPBUGS-65482: Add e2e test for secure redirect port stripping #1316
NE-1743: Add documentation for pre-release script for OSSM testing #1315
OCPBUGS-70212: testGatewayAPIDNS: Fix nil gateway in cleanup #1330
OCPBUGS-70211: Fix logging for unmanaged controllers #1329
OCPBUGS-69954: Updating ose-cluster-ingress-operator-container image to be consistent with ART for 4.22 #1328
OCPBUGS-65939: Update command to get Konflux index image #1325
OSSM-10865: set trustBundleName in Istio global values #1288
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-83400: revert dev cert rotation #2272
NO-JIRA: update KMS tests with bump library-go changes #2264
OCPBUGS-85181: Remove MutatingAdmissionPolicy from defaultGroupVersionsByFeatureGate #2141
NO-JIRA: Retry conflict errors on UpdateKMSEncryptionStatus function #2265
NO-JIRA: Update KMStoKMS scenario to multi provider #2261
CNTRLPLANE-3237: kms key controller preflight support #2252
NO-JIRA: bump library-go api and client-go #2257
NO-JIRA: Add parallelism KMS OnOff Scenarios #2251
NO-JIRA: Bump library-go #2255
NO-JIRA: Update openshift/* #2249
CNTRLPLANE-3237: creates the kms status provider from the operator client #2248
MON-4502: Migrate Prometheus targets discovering from Endpoints to EndpointSlices #2036
NO-JIRA: add KMS preflight deploy e2e to encryption-kms-2 #2246
CNTRLPLANE-3361: Update openshift/* #2247
CNTRLPLANE-3861: Add KMS plugin sidecar revision readiness check #2220
NO-JIRA: Automatic agentic rebase: Update library-go to d8f45c2 #2238
NO-JIRA: Add KMS key ID identifier #2237
CNTRLPLANE-3237: encryptionstatusprovider: use KubeAPIServersGetter instead of Clientset #2235
NO-JIRA: Refactor KMS cases #2229
CNTRLPLANE-3237: intro kubeAPIServerEncryptionStatusProvider #2230
NO-JIRA: Remove old test files #2232
OCPSTRAT-3036: Rebase 1.36.2 #2129
NO-JIRA: Bump library-go to sync #2227
NO-JIRA: Remove old helper and assertion func #2223
OCPBUGS-38661: Add 10-minute degraded inertia for StaticPodsDegraded #2221
CNTRLPLANE-3234: wire KMS health reporter status writer #2224
OCPBUGS-38661: Add 10-minute degraded inertia for NodeControllerDegraded #2219
NO-JIRA: Automatic agentic rebase: Update library-go to fd74bb5 #2216
CNTRLPLANE-3721: Add developer/agent documentation: CONTRIBUTING.md, AGENTS.md, ARCHITECTURE.md #2213
API-1768: e2e network policy tests #2097
NO-JIRA: Add test for kms to kms migration #2215
NO-JIRA: Bump library-go for sync #2214
NO-JIRA: Bump library-go #2212
NO-JIRA: Update openshift dependencies #2211
NO-JIRA: add kms preflight to NP to allow egress #2209
CNTRLPLANE-3518: add openshift/kms parent to kms test suites #2195
NO-JIRA: Automatic agentic rebase: Update library-go to b0f5231 #2205
NO-JIRA: add preflight command #2201
CNTRLPLANE-3363: Register health monitor as command #2198
NO-JIRA: kms: bump library-go to get KMS plugin security context #2188
CNTRLPLANE-3545: bump library-go to get CA bundle wiring #2189
NO-JIRA: Automatic agentic rebase: Update library-go to 7fd5f33 #2191
OCPBUGS-86699: Fix kube-apiserver-to-kubelet-signer refresh interval #2174
NO-JIRA: Automatic agentic rebase: Update library-go to 0469313 #2184
CNTRLPLANE-3226: switch to real Vault KMS plugin in CI #2180
CNTRLPLANE-3226: bump library-go to get KMS plugin credentials #2169
NO-JIRA: Automatic agentic rebase: Update library-go to d8750ed #2177
NO-JIRA: Automatic agentic rebase: Update library-go to 0cf249e #2176
NO-JIRA: Bump latest libray-go changes #2173
NO-JIRA: remove old mock plugin deployment #2168
NO-JIRA: kms: use DefaultFakeVaultEncryptionProvider to ensure AppRole secret setup #2167
OCPBUGS-86057: render: fall back to Authentication CR #2166
CNTRLPLANE-3236: support deploying Vault mock KMS plugin #2146
NO-JIRA: Add KMS dummy case #2161
NO-JIRA: Bump latest library-go changes #2160
CNTRLPLANE-3238: Add New kms suite #2156
CNTRLPLANE-3237: Bump library-go and sync plugin changes #2155
CNTRLPLANE-3237: pull https://github.com/openshift/library-go/pull/2220 #2150
OCPSTRAT-3036: Temporarily extend MutatingAdmissionPolicy runtime-config range to <1.37.0 #2148
CNTRLPLANE-3347: Migrate testKMSEncryptionOnOff to ote #2127
OCPBUGS-78016: Use SkipInClusterAuthenticationLookup in check-endpoints #2113
NO-JIRA: Removal of unuse suites #2132
OCPBUGS-76588: operator should not override authentication config serviceAccountIssuer with the default one during the operator initialization #2062
CNTRLPLANE-3327: Migrate TestEncryptionTypeAESCBC to OTE #2122
NO-JIRA: Add control-plane-approvers to OWNERS #2110
CNTRLPLANE-3326: Remove unstable TestBoundTokenOperatorSecretDeletion #2123
NO-JIRA: Update library-go changes #2107
OCPBUGS-79663: Allow setting the oauthMetadata when auth type is None #2105
CNTRLPLANE-3228: Implement 5.0 EUS schedule in KAS-O #2101
CNTRLPLANE-2991: Do not configure KAS with Structured Authentication when authentication type is OIDC #2075
CNTRLPLANE-2935: Enable configurable PKI for managed certificate rotation #2051
CNTRLPLANE-2698: add network policies for apiserver operator and operands #2029
OCPBUGS-23366: bindata/bootkube: Remove configmap-csr-controller-ca.yaml #2076
OCPBUGS-76952: scc: fix uid{Min,Max}Range for nested-container #2053
NO-JIRA:Fix TestBoundTokenOperatorSecretDeletion stability and monitor failures #2080
CNTRLPLANE-2622: Restart operator when TLS config changes #2059
CORS-4363: set bindAddress/bindNetwork for dual-stack clusters #2079
CNTRLPLANE-2992: Update CKASO to use a default webhook authenticator secret when authentication type is not None #2074
OCPBUGS-65626: update library-go to latest #2026
CNTRLPLANE-2223: Migrate TestBoundTokenSignerController to ginkgo #2067
CNTRLPLANE-2622: config tls on check-endpoints container #2058
OCPBUGS-46086: Always set service-account-jwks-uri to LB URL even with custom issuer #1919
OCPBUGS-78146: move event-ttl test to its own suite #2069
OCPBUGS-78117: Update the deprecated usage alerts for 1.35 #2068
OCPBUGS-77509: Add support for event-ttl cases and go test cases in Kube API Server Operator #2060
OCPSTRAT-2728: Rebase 1.35 #2003
CNTRLPLANE-2223: Test bound token signer controller fix #2050
TRT-2561: Revert #2032 “CNTRLPLANE-2622: config tls on check-endpoints container” #2057
CNTRLPLANE-2622: config tls on check-endpoints container #2032
CNTRLPLANE-2241: Update library-go to get KMS encryption #2033
NO-JIRA: Test encryption provider migration #2028
OCPBUGS-70298: remove kube-apiserver user from crb #2012
CNTRLPLANE-2247: Adding KMS TestKMSEncryptionOnOff test #2027
CNTRLPLANE-2241: Conditionally add the KMS plugin volume mount to the kube-apiserver container #2015
CNTRLPLANE-2563: update wording for major upgrades #2010
CNTRLPLANE-2648: Migrating user_cors_test to OTE #2011
CNTRLPLANE-2247: Add empty KMS encryption test case for CI job validation #2014
CNTRLPLANE-2585: Migrating user_client_ca_test to ginkgo #2008
OCPBUGS-65807: SCC: allow image volume type for all SCCs #1968
CNTRLPLANE-2492: Migrating user_certs_test to ote #2005
NO-JIRA:Refactor serviceaccountissuer ginkgo test #2002
NO-JIRA: clean up the OWNER files #2001
NO-JIRA: Add API server stabilization wait to serviceaccountissuer tests #1997
OCPBUGS-62422: deps: Update library-go to update pruner #1994
NO-JIRA: ote: a small cleanup #1995
CNTRLPLANE-2286: Migrating serviceaccountissuer test to ote #1992
CNTRLPLANE-2280: Migrating deprecated_api_test to ote #1990
CNTRLPLANE-2281: Migrating operator_test to ote #1991
OCPBUGS-70323: bump library-go #1986
OCPBUGS-69758: CNTRLPLANE-2222:Migrate go test cert-rotation-tests.go to OTE #1983
CNTRLPLANE-2158: Migrating TestTokenRequestAndReview to ginkgo #1978
NO-JIRA: increases termination timeouts for GCP #1982
Full changelog

cluster-kube-controller-manager-operator

OCPBUGS-111832: Updating ose-cluster-kube-controller-manager-operator-container image to be consistent with ART for 5.0 #954
OCPBUGS-112788: fix CVE-2026-41178 #957
OCPBUGS-99770: Remove unnecessary namespace informers from kubeInformersForNamespaces #950
OCPBUGS-99770: remove duplicate wrappings of core_getters #952
CNTRLPLANE-3778: Migrate openshift-test-private kcm cases to OTE #943
OCPSTRAT-3036: Rebase 1.36.2 #930
OCPBUGS-38662: Add 10-minute degraded inertia for StaticPodsDegraded #948
OCPBUGS-38662: Add 10-minute degraded inertia for NodeControllerDegraded #947
NO-JIRA: Use %w for error wrapping consistently #946
NO-JIRA: fix lock failure cases #939
CNTRLPLANE-3349: Migrate KCM-O cases to ote #935
CNTRLPLANE-3107: e2e testing automation Create network network policy test cases #924
NO-JIRA: Add control-plane-approvers to OWNERS #926
CNTRLPLANE-3211: enable configurable PKI for managed certificate rotation #925
OCPBUGS-23366: bindata: Import configmap-csr-controller-ca.yaml from KAS-O #918
CNTRLPLANE-2623: Restart operator when TLS config changes #915
OCPBUGS-65626: update library-go to latest #905
MON-4503: Migrate Prometheus targets discovering from Endpoints to EndpointSlices #907
OCPSTRAT-2728: Rebase 1.35 #902
OCPBUGS-74023: Updating ose-cluster-kube-controller-manager-operator-container image to be consistent with ART for 4.22 #903
CORS-4220: pass dualstack cluster cidrs as an comma-separated list argument #889
OCPBUGS-69964: Updating ose-cluster-kube-controller-manager-operator-container image to be consistent with ART for 4.22 #901
OCPBUGS-62422: dep: Update library-go to update pruner #895
OCPBUGS-60568: Use BoundServceAccountTokenVolume dy default #858
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

cluster-kube-scheduler-operator

OCPBUGS-113761: bump otel to v1.44.0 to fix CVE-2026-41178 #663
OCPSTRAT-3036: Rebase 1.36.2 #646
OCPBUGS-38663: Add 10-minute degraded inertia for StaticPodsDegraded #655
OCPBUGS-38663: Add 10-minute degraded inertia for NodeControllerDegraded #654
WRKLDS-1126: e2e network policy tests #637
NO-JIRA: Add control-plane-approvers to OWNERS #639
OCPBUGS-82503: add /var/run/kubernetes as emptyDir #638
CNTRLPLANE-3219: vendor: bump library-go, api, client-go for configurable PKI #636
CNTRLPLANE-2756: Add operator and operand network policies #629
CNTRLPLANE-2810: Restart operator when TLS config changes #617
OCPBUGS-65626: update library go to latest #610
MON-4504: Migrate Prometheus targets discovering from Endpoints to EndpointSlices #614
OCPBUGS-70046: Updating ose-cluster-kube-scheduler-operator-container image to be consistent with ART for 4.22 #592
OCPSTRAT-2728: Rebase 1.35 #602
CNTRLPLANE-2843: chore: update OWNERS #618
CNTRLPLANE-2649: Add 30-minute timeout to preferred host e2e test #616
CNTRLPLANE-2649: Migrate to Ginkgo-based e2e serial and parallel test suite #611
CNTRLPLANE-2649: OTE infrastructure #608
OCPBUGS-65941: Add OPERATOR_IMAGE_VERSION to recovery container #600
NO-JIRA: pkg/operator: Remove staleConditions controller #597
NO-JIRA: pkg/operator: Fix wrong ClusterOperator name #596
no-jira: test(TargetConfigController): exercise –tls-cipher-suites and –tls-min-version injection #595
OCPBUGS-62422: deps: Update library-go to update pruner #593
no-jira: refactor(pkg/operator/targetconfigcontroller): code deduplication and improvements #594
Full changelog

cluster-kube-storage-version-migrator-operator

OCPBUGS-87479: Updating ose-cluster-kube-storage-version-migrator-operator-container image to be consistent with ART for 5.0 #178
STOR-2954: feat: have CVO inject the centralized TLS configuration into the operator’s config #176
OCPBUGS-65984: add PodDisruptionBudget for migrator deployment #172
OCPBUGS-62629: update library-go for deployment controller updates #159
NO-JIRA: Add control-plane-approvers to OWNERS #158
OCPBUGS-51091: schedule migrator pods on control-plane nodes #157
CNTRLPLANE-3055: Migrate go standard casee to ote #156
CNTRLPLANE-2706: add network policy e2e tests for operator and operand #151
OCPBUGS-65984: Revert TRT-2577: Revert #139 “OCPBUGS-65984: scale migrator deployment” #149
OCPBUGS-74038: Updating ose-cluster-kube-storage-version-migrator-operator-container image to be consistent with ART for 4.22 #137
TRT-2577: Revert #139 “OCPBUGS-65984: scale migrator deployment” #148
OCPBUGS-65984: scale migrator deployment #139
NO-JIRA: OWNERS: remove engineers who have left Red Hat #147
OCPBUGS-65984: Prevent AvailableReplicas from dropping to 0 during deployment rollout #138
OCPBUGS-70004: Updating ose-cluster-kube-storage-version-migrator-operator-container image to be consistent with ART for 4.22 #136
OCPBUGS-65984: Prevent AvailableReplicas from dropping to 0 during deployment rollout #135
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

cluster-machine-approver

OCPBUGS-113529: Always validate EgressIPs #315
OCPBUGS-100160: Fix status controller unit-test teardown race #312
NO-JIRA: Bump envtest to 1.36.2 #314
OCPCLOUD-3612: Bump k8s v1.36, go 1.26 #311
OCPBUGS-87331: Updating ose-cluster-machine-approver-container image to be consistent with ART for 5.0 #306
NO-JIRA: fix: use feature-gate annotation for CAPI manifests #304
NO-JIRA: fix: add pod annotation: openshift.io/required-scc: restricted-v2 #297
NO-JIRA: bump controller-runtime-common to latest main #302
NO-JIRA: Deploy cluster-machine-approver without host networking #301
NO-JIRA: Migrate away from deprecated ioutil #284
OCPCLOUD-3347: tls: use centralized TLS profile (unrevert) #292
NO-JIRA: Update OWNERS #296
OCPCLOUD-3286: Bump k8s v1.35, go 1.25 #295
Revert “OCPCLOUD-3347: tls: use centralized TLS profile” #291
OCPCLOUD-3347: tls: use centralized TLS profile #286
OCPBUGS-69815: Updating ose-cluster-machine-approver-container image to be consistent with ART for 4.22 #289
MON-4476: chore: add permissions on endpointslice to Prometheus Role and use serviceDiscoveryRole: EndpointSlice in ServiceMonitors #288
NO-JIRA: Fix expired test certificate in csr_check_test.go #287
Full changelog

cluster-monitoring-operator

OCPBUGS-112571: Makefile: version-stamp golangci-lint binary to prevent stale linter #3061
MON-4548, MON-4549, MON-4550, MON-4551: Enforce Thanos grpc tls parameters #3018
MON-4612: log Phase 1 dual ConfigMap/CRD configuration notice #2995
MON-4559: enable interrupts node-exporter collector via config #2888
NO-JIRA: [bot] Synchronize versions of the downstream components #3049
MON-4629: support the nvmesubsystem collector in the config CRD #3046
NO-JIRA: update OWNERS #3050
NO-JIRA: feat: validate systemd units #3048
OCPBUGS-105438: feat: support ogx api adoption metrics #2984
OCPBUGS-105389: enable read-only rootfs for all containers #3039
MON-4637: implement merge logic to support the new MessageVersion field in the config CRD #3036
NO-JIRA: Add test descriptions #3037
MON-4577: restrict alertmanager gossip mesh ports to same-instance pods #3032
NO-JIRA: [bot] Synchronize versions of the downstream components #3035
NO-JIRA: Allow to pass custom arguments to e2e test command #3033
NO-JIRA: tasks: pass context to MetricsServerTask methods instead of storing it #3025
NO-JIRA: [bot] Synchronize versions of the downstream components #3017
NO-JIRA: chore: update Prometheus-operator to v0.93.0 #3010
MON-4630: support the dmmultipath collector in the config CRD #3015
: OCPBUGS-91735: fix: watch cluster wide proxy changes and apply changes accordingly #3004
NO-JIRA: test: make TestDocExamples and TestNetworkPolicy more stable #3013
NO-JIRA: add metrics for the validating webhook #2838
NO-JIRA: e2e: defer subtest resource cleanup in TestPrometheusRemoteWrite #3016
NO-JIRA: [bot] Synchronize versions of the downstream components #3014
NO-JIRA: chore: pin GOTOOLCHAIN in update-go-deps + update Go dependencies #3006
NO-JIRA: increase golangci-lint timeout #3011
MON-4624: enable the nvmesubsystem collector by default #3005
NO-JIRA: [bot] Synchronize versions of the downstream components #2994
MON-4413: support MessageVersion v2.0 for remote-write #2977
OCPBUGS-85522: disable kubelet Endpoints in prometheus-operator #2931
NO-JIRA: test: adjust e2e tests on retention settings #2999
MON-4615: add option to disable the dmmultipath collector #2996
NO-JIRA: Revert “MON-3697: use maximumStartupDurationSeconds instead of container patch” #2982
MON-4558: enable zoneinfo node-exporter collector via config #2986
OCPBUGS-98450: fall back to kube-system/global-pull-secret for telemeter-client token #2985
NO-ISSUE: Update prometheus-operator dependencies #2966
OU-1389: manually pass features to monitoring plugin #2987
OCPBUGS-99019: jsonnet: exclude AlertmanagerClusterFailedPeers from shipped rules #2993
MON-4523: ClusterMonitoring prometheusConfig #2953
OU-1389: config path to point to correct directory #2981
OCPBUGS-93756: update github.com/prometheus/prometheus #2979
OCPBUGS-92085: set Prometheus shards value explicitly #2972
MON-4527: ClusterMonitoring NodeExporterConfig logic #2919
NO-JIRA: [bot] Synchronize versions of the downstream components #2971
NO-JIRA: [bot] Synchronize versions of the downstream components #2967
NO-JIRA: test: add alertmanager test to catch broken UI embeds during automated bumps #2968
NO-JIRA: test: merge UWM tests and improve resilience #2964
OCPBUGS-90089: chore(test): clean up remote write config in TestPrometheusRemoteWrite #2962
OCPBUGS-90090: chore(test): wait for full config restore in TestTelemeterRemoteWrite cleanup #2961
OCPBUGS-90100: chore(TestPrometheusMetrics): use targets API instead of promQL #2963
NO-JIRA: [bot] Synchronize versions of the downstream components #2960
OCPBUGS-87800: fix(TestDocExamples) flake: use internal registry for test pods #2957
OCPBUGS-87799: fix TestTelemetryReport flake by waiting for rate() on raw metrics #2958
MON-4485: Use EndpointSlices SD for KSM #2879
OCPBUGS-86782: fix: wait for SCC use before creating Alertmanager operands #2938
MON-4486: Use EndpointSlices SD for OSM #2880
MON-4581: Update component minimal profiles #2950
MON-4522: manifests: merge KubeStateMetricsConfig from ClusterMonitoring CRD #2951
NO-ISSUE: Fix typo in KubeDeploymentReplicasMismatch alert description #2955
NO-JIRA: [bot] Synchronize versions of the downstream components #2954
MON-4524: manifests: merge OpenShiftStateMetricsConfig from ClusterMonitoring CRD #2952
OCPBUGS-87267: Updating cluster-monitoring-operator-container image to be consistent with ART for 5.0 #2949
NO-ISSUE: Update golangci-lint version #2941
OCPBUGS-86989: increase lookup interval #2943
MON-4583: adding NVIDIA H200 GPU device to accelerators configmap #2942
MON-4555: migrate federate tests to e2e suite #2902
NO-ISSUE: improve logging for doc example tests #2936
MON-4526: manifests: merge ThanosQuerierConfig from ClusterMonitoring CRD #2924
NO-JIRA: [bot] Synchronize versions of the downstream components #2937
Update jsonnet dependencies #2927
NO-ISSUE: manifests: remove unused NewConfigMapList method #2935
OCPBUGS-86352: jsonnet: exclude ReplicationController from catch-all … #2932
NO-ISSUE: chore: remove unused function #2934
MON-4525: manifests: merge TelemeterClientConfig from ClusterMonitoring CRD #2928
MON-4566: chore: add telemetry_report tool to help with telemetry change review #2885
MON-4529: manifests: merge PrometheusOperatorAdmissionWebhookConfig from ClusterMonitoring CRD #2923
OCPBUGS-85709: fix: use numeric ports in NetworkPolicies and add enforcement e2e test #2925
NO-JIRA: [bot] Synchronize versions of the downstream components #2921
OCPBUGS-83284: validate more CMO configmap fields #2877
MON-4524: MetricsServerConfig resources merge #2907
NO-JIRA: [bot] Synchronize versions of the downstream components #2918
MON-4528: merge monitoringPluginConfig #2908
NO-JIRA: [bot] Synchronize versions of the downstream components #2893
MON-4520: follow up AlertManagerConfig and PrometheusOp PR changes #2900
TRT-2649: Revert “MON-4558: enable zoneinfo node-exporter collector via config” #2910
NO-ISSUE: chore(e2e): verify Prometheus Mantine UI is served on port 9090 and refactor ForwardPort helpers #2905
NO-ISSUE: Update AGENTS.md #2899
MON-4563: use AlwaysAllow UnhealthyPodEvictionPolicy option in PDBs #2892
MON-4558: enable zoneinfo node-exporter collector via config #2886
TRT-2644: Revert “MON-4517: Minimal and telemetry CP monitors” #2901
NO-ISSUE: [bot] Update jsonnet dependencies #2894
MON-4492: ClusterMonitoring alertmanagerConfig logic #2889
MON-4517: Minimal and telemetry CP monitors #2814
MON-4560: enable softirqs node-exporter collector via config #2887
NO-JIRA: refactor config merging #2890
OCPBUGS-54806: Add telemetry for user-defined networks #2596
CNTRLPLANE-3217: Enable configurable PKI for GRPC TLS certificates #2882
NO-ISSUE: [bot] Update jsonnet dependencies #2878
MON-4115: expose label metrics for jobs and cronjobs #2553
MON-4480: set minimum TLS version for Thanos ruler #2862
MON-4442: Add AGENTS.md to CMO #2761
NO-JIRA: [bot] Synchronize versions of the downstream components #2884
MON-4493: add MetricsServerConfig support to ClusterMonitoring CRD #2809
MON-4543, OPNET-765: Add kubernetes-nmstate telemetry metrics to allowlist #2855
OCPBUGS-74645: delay alert dispatch in Alertmanager #2848
OCPBUGS-81554: CVE-2026-33186 - bump google.golang.org/grpc to v1.79.3 #2872
NO-ISSUE: exclude hack/tools/vendor from shellcheck #2873
NO-JIRA: [bot] Synchronize versions of the downstream components #2865
OCPBUGS-81159: reject invalid collection profile in webhook #2860
NO-ISSUE: [bot] Update jsonnet dependencies #2861
MON-4481, MON-4482: set minimum TLS version for Thanos sidecars #2859
NO-JIRA: update jsonnet dependencies #2858
OCPBUGS-78976: configure repair policy to ‘evict’ #2856
MON-4542: update Prometheus operator CRDS to v0.90.0 #2854
NO-JIRA: update github.com/openshift/library-go #2852
NO-JIRA: change ClusterRolefailed to ClusterRole failed #2853
NO-JIRA: [bot] Synchronize versions of the downstream components #2857
NO-JIRA: [bot] Synchronize versions of the downstream components #2851
NO-JIRA: add unit tests for admission webhook’s TLS configuration #2850
MON-4479: use TLS profile to configure CMO server #2841
NO-JIRA: [bot] Synchronize versions of the downstream components #2849
MON-4535: Add .coderabbit.yaml to reduce review noise #2845
NO-JIRA: [bot] Synchronize versions of the downstream components #2847
OCPBUGS-48578: chore(metrics-server): prefer control-plane nodes and tolerate their taints #2801
OCPBUGS-78221: fix return value format #2846
NO-JIRA: fix wrong string formatter in tests #2839
NO-ISSUE: fix typo #2837
OCPBUGS-77543: Updating cluster-monitoring-operator-container image to be consistent with ART for 4.22 #2836
NO-JIRA: [bot] Synchronize versions of the downstream components #2830
MON-4533: Bump prometheus-operator to v0.89.0 #2822
OCPBUGS-74524: Remove MetricsCollectionProfiles feature-gate #2812
MON-4494: add kubernetes-mcp-server metrics to allowed list #2818
MON-4491: Implement Logic for User Defined #2807
OCPBUGS-61262: AlertingRule: fix duplicate PrometheusRules after MD5->SHA-224 naming change #2820
NO-JIRA: [bot] Synchronize versions of the downstream components #2800
OCPBUGS-73957: Updating cluster-monitoring-operator-container image to be consistent with ART for 4.22 #2790
NO-ISSUE: test/e2e: add Func suffix to assertion helpers for consistency #2803
OCPBUGS-74673: Fix NodeRAIDDegraded & NodeRAIDDiskFailure alerts #2799
OCPBUGS-69397: Move console control plane health queries to their own… #2778
OCPBUGS-74347: config: add bond device to default node-exporter ignore list #2806
NO-ISSUE: merge case 67008,68958 to node-exporter e2e test #2788
NO-ISSUE: test: TestUserWorkloadWithAlertmanager|TestNetworkPolicy: fix a no-op check #2802
OCPBUGS-67162: update expr for AlertmanagerClusterFailedToSendAlerts to exclude value 0 #2796
NO-JIRA: Upgrade golangci-lint from v1 to v2 #2789
OCPBUGS-66069: Include kube_pod_labels in minimal profile #2777
MON-4470: ship collector:node_scrape_collector_success:avg to Telemetry #2794
NO-JIRA: [bot] Synchronize versions of the downstream components #2791
OCPBUGS-66180: create networkpolicy settings for user workload monitoring #2765
NO-ISSUE: move endpointslice RBAC to Role #2786
MON-4466: enable ethtool collector #2779
NO-ISSUE: add app.kubernetes.io/part-of=openshift-monitoring label to thanos-ruler pod #2787
MON-4343: Reapply “MON-4343: Cleanup deprecate pa config” #2782
NO-ISSUE: remove test case 74734 #2785
OCPBUGS-61088: revert PR #2766 #2769
OCPBUGS-69733: Updating cluster-monitoring-operator-container image to be consistent with ART for 4.22 #2781
MON-4406: watch ClusterMonitoring config resource #2770
NO-JIRA: [bot] Synchronize versions of the downstream components #2780
NO-JIRA: [bot] Synchronize versions of the downstream components #2776
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

cluster-network-operator

OCPBUGS-115428: Adds rendering of enable-multi-network-policy in ovnkube-node #3149
OCPBUGS-107980: CVE-2026-41178 - bump go.opentelemetry.io/otel to v1.44.0 #3133
OCPBUGS-115064: Install NOO using OLMv0 instead of OLMv1 #3143
OCPBUGS-115900: CNF-26697: [release-5.0] CORENET-7330: Allow per-node OVN encap IP override via env-overrides #3124
OCPBUGS-105887: [cherry-pick 5.0] Filter unsupported cipher suites to prevent ovnkube-identity crash #3128
OCPBUGS-111097: Drop strategy.rollingUpdate and switch strategy.type to Recreate via pre-patch in frr-k8s-statuscleaner deployments on SNO #3129
NO-ISSUE: Drop github.com/pkg/errors #3112
OCPBUGS-64582: frr-k8s: use Recreate strategy for statuscleaner deployment #3104
OCPBUGS-98918: Use service-ca certificates for network-check-source metrics #3097
OCPBUGS-99460: Fix connectivity check for nodes named with IP address #3083
CORENET-5658: Bump ovn-controller CPU request to 50m to prevent CPU starvation #3051
CORENET-6714: Enable Network Observability on Day 0 #3087
CORENET-7054: Use TLS profile to render CLI args for deployed components #3043
CORENET-5972: Consume openvswitch-ipsec systemd service for OVN IPsec deployment #2662
NO-JIRA: vendor: bump github.com/openshift/api to latest master #3089
OCPBUGS-88063: ovn-kubernetes: Move MNP from ConfigMap to CLI flags #3072
CNTRLPLANE-3213: Enable configurable PKI for managed certificate rotation #2958
CORENET-6581: Add transport label to CUDN telemetry recording rule #2978
OCPBUGS-98619: Bump frr-k8s MAX_FDS from 1024 to 65536 #3054
Revert “Enable Network Observability on Day 0” (#2925) #3086
CORENET-6714: Enable Network Observability on Day 0 #2925
OCPBUGS-99074: Align frr-k8s 5.0 CRDs #3070
CORENET-7046: Bump Kubernetes to 1.36.2 and OCP to 5.0 #3017
CORENET-7125: iptables to nftables #3038
NO-JIRA: Refresh Reviewers & Approvers lists #3048
OCPBUGS-62144: Makes sure rendering for egress IP reachabilityTimeout triggers restart of ovnkube (node/control) pods #2955
CORENET-7267: Add pre-merge and custom checks to CodeRabbit configuration #3037
NVIDIA-882: DPU host: add configurable mgmt-port-resource-count #3024
OCPBUGS-88531: Propagate restart-date annotation to CNO operand pod templates #3030
NO-JIRA: Update OWNERS file #3045
OCPBUGS-87977: Bump github.com/containernetworking/cni v0.8.0 -> v1.3.0 #3031
CORENET-7114: Add OCP centralized TLS profile support #3014
CORENET-7266: Add path-specific review instructions to CodeRabbit config #3039
OCPBUGS-83800: add remaining CNO NetworkPolicies [take 2] #3001
OCPBUGS-81741: Watch Network and Infrastructure in proxyconfig controller #2968
CORENET-7297: Add CodeRabbit configuration for automated PR reviews #3035
NO-JIRA: Update openshift/api and openshift/client-go to latest #3023
CORENET-7116: Fix security job - exclude vendor and upgrade to SHA256 #3019
OCPBUGS-66159: Add openshift.io/node-selector annotation to openshift-network-console namespace #2848
CORENET-7154: Fix debounce timer for OperatorConfig level being incorrectly cleared #3011
NO-JIRA: Remove –enable-interconnect flag from OVN-K manifests #3008
OCPBUGS-83863: Remove version-specific CNI binary copy logic #2967
OCPBUGS-84519: Add terminationMessagePolicy to missing ovn-kubernetes containers #3004
NVIDIA-596: Enable dpu healthcheck #2941
TRT-2657: Revert “add remaining CNO NetworkPolicies” (#2959) #2999
OCPBUGS-83800: add remaining CNO NetworkPolicies #2959
NVIDIA-554: DPU-host mode: use ConfigMap for OVN feature enablement instead of per-node script gating #2944
OCPBUGS-83406, OCPBUGS-83407: fix issue for managed mode of no-overlay #2960
OCPBUGS-53187: Update self-referencing URLs from master to main #2984
GCP-430: Wire GCP WIF credentials for CNCC in HyperShift HCP mode #2915
OCPBUGS-65631: Use dedicated service accounts for multus pods #2961
NO-JIRA: cleanup unused code and refactor for allowlist controller #2846
CORS-4332: Add GCP to the allowed platforms for dual stack #2894
OCPBUGS-82973: Frrk8s tls manifests #2963
KONFLUX-11591: Fix ovn-acl-logging CrashLoopBackOff due to startup race condition #2923
CORENET-6572: only report Progressing for active network rollouts #2937
CORENET-6543: Align VTEP CRD additionalPrinterColumns with upstream #2957
CNF-21001: multus: MultiNetworkPolicy nftables #2883
CORENET-6816: Add NetworkPolicies for CNO and its operands #2892
CORENET-6933: Update VTEPs/CUDN APIs #2952
OCPBUGS-78974: Fix ManagementState being reset on operator restart #2942
CORENET-6613: ClusterNetworkConnect DevPreview FG #2880
no-jira: Update OWNERS_ALIASES to include myself + “taanyas” and “marty-power” #2908
CORENET-6813: Add config override for allow-icmp-network-policy #2920
CORENET-6100: Add support for no-overlay mode #2844
CORENET-6561: CNO Rebase k8s to 1.35.0 #2887
OCPBUGS-78731: Revert “NVIDIA-554: DPU-host mode: use ConfigMap for OVN feature enablement instead of per-node script gating” #2938
OCPBUGS-77015: wait for patch port to apply drop garp flows #2910
OCPBUGS-70016: Updating cluster-network-operator-container image to be consistent with ART for 4.22 #2863
OCPBUGS-65633: add network-check-target + networking-console-plugin service accounts #2868
CORENET-6871: Handle zero-worker HyperShift clusters in daemonset rollout #2897
NVIDIA-554: DPU-host mode: use ConfigMap for OVN feature enablement instead of per-node script gating #2907
OCPBUGS-76500: Add config override for openflow-probe #2916
OCPBUGS-60670: Add ValidatingAdmissionPolicy for EgressIP #2837
CORENET-6605: fix more transient error condtions caused Degraded #2896
CORENET-6417: Drop remaining openshift-sdn code #2882
CORENET-6610: Add EVPN APIs #2881
OCPBUGS-60077: Silence ovnkube-lib.sh to avoid mass of logs to collectors #2761
CNF-20883: Align templates frrk8s #2874
OCPBUGS-74401: Remove duplicated openssl parameter #2889
NO-JIRA: Remove references to AdminNetworkPolicy, NetworkSegmentation, RouteAdvertisements and PreconfiguredUDNAddresses featuregates #2891
CORENET-6561: Update the golangci-lint configuration for v2 compatibility and fix all resulting lint issues. #2893
CORENET-6605: avoid flapping Degraded on transient failures #2862
CORENET-6416: drop networkType migration support #2456
CNF-21001: mnp: Set hostname using downward API #2840
CORS-4180: Allow AWS and Azure as platforms that support dual-stack on Day-0 #2804
NO-JIRA: set ovnkube-cluster-manager as default container #2798
OCPBUGS-72411: fix(hypershift): use net.JoinHostPort for URL construction #2871
OCPBUGS-66417: Add kubevirt platform to dual-stack supported platforms #2849
OCPBUGS-49662: Prevent resetting masquerade subnet #2641
Full changelog

cluster-node-tuning-operator

OCPBUGS-119931: add optional –ovs-dpdk-cpu-count flag (default 0) #1630
OCPBUGS-114934: Disable timer.migration on RHCOS 10 #1625
OCPBUGS-114144: Update PPC help description #1617
OCPBUGS-104311: Bump golang.org/x/net #1600
OCPBUGS-112580: unconditionally disable fwupd-refresh.timer #1602
NO-JIRA: ci: disable smt alignment for ovsDpdk tests #1599
OCPBUGS-112279: Use Add() instead of AddRateLimited() for routine Profile enqueues #1595
CNF-26546: tuned:irqs: set default_smp_affinity using irqaffinity= #1572
CNF-20633: Enable nohz_full and skew_tick by default #1564
OCPBUGS-98060: BUG-FIX Latency Test #1566
OCPBUGS-99461: Add missing annotations to NetworkPolicy manifests #1569
MON-4506: Migrate Prometheus targets discovering from Endpoints to EndpointSlices #1468
OCPBUGS-100115: E2E: LLC: Restore uncore cache annotation to true #1570
NO-JIRA: owners: update #1563
OCPBUGS-97809: e2e: fix broken checks and rework netqueue tests to avoid ARM ethtool blackout flakes #1557
OCPBUGS-98915: E2E: LLC: Pass fresh ctx variable to DeferCleanup functions #1562
CNF-23471: Dedicate cpus for dpdk vswitch #1546
OCPBUGS-98399: E2E: Add functional test cases checking GOMAXPROCS #1556
OCPBUGS-93863: E2E: Fix tuned active profile check for wrapped performance profiles #1549
CNF-24293: Let cri-o manage the GOMAXPROC for burstable pods #1547
NO-JIRA: cleanup: remove utils/errors #1536
OCPBUGS-91745: e2e: fix: clear hugepages before switching kernelPageSize to 4k #1550
NO-JIRA: E2E: Remove checking of container runtime since crun is default #1545
OCPBUGS-83863: Strip debug symbols from Go binaries #1525
NO-JIRA: Update upstream build image #1541
OCPBUGS-87293: Updating cluster-node-tuning-operator-container image to be consistent with ART for 5.0 #1540
OCPBUGS-86541: Enable timer migrations for all use-cases #1534
OCPBUGS-87132: E2E: Remove ovs-vswitchd from platform services #1526
OCPBUGS-86803: e2e: Remove unnecessary len(numa) < 2 skip gates #1528
NO-JIRA: Bump github.com/moby/spdystream from v0.5.0 to v0.5.1 #1527
OCPBUGS-86480: E2E: Refactor OVS affinity tests into shared helpers and add new workload-partitioning and control-plane reboot test cases. #1509
OCPBUGS-83865: Revert stalld backend to sched_debug #1515
NO-JIRA: E2E: remove obsolete ContainerRuntimeConfig runtime-switch test #1510
OCPBUGS-80952: perf: latency: compute memory resources dynamically #1517
OCPBUGS-62277: Requeue PerformanceStatus update when status write fails #1495
NO-JIRA: ote: embed extended testdata in cluster-node-tuning-operator-test-ext binary #1512
TRT-2659: Revert #1499 “NO-JIRA: ote: embed extended testdata in cluster-node-tuning-operator-test-ext binary” #1511
NO-JIRA: e2e: fix tuned deferred tests on Hypershift #1494
NO-JIRA: test/extended: scope oc process to NTO namespace #1508
NO-JIRA: ote: embed extended testdata in cluster-node-tuning-operator-test-ext binary #1499
OCPBUGS-84938: e2e: Add irqbalance StartLimitBurst >= 100 config test #1493
NO-JIRA: Bump ghw dependency #1492
NO-JIRA: E2E: move dra resource test to reboot tests directory #1486
PSAP-2185: Support centralized TLS security profile configuration #1483
CNF-18941: e2e: PP: cover ExecCPUAffinity support in tests #1432
CNF-20404: DRA: disable Kubelet resources and topology managers #1445
OCPBUGS-78470: e2e: fixed flaky test_id:32646 CPU load balancing on cgroupv1 #1457
PSAP-2229: Prevent multiple reboots via MachineConfig creation/update sync #1474
NO-JIRA: workloadhints: use IsVM to skip BM-only tests #1478
OCPBUGS-77200: Remove hardcoded nf_conntrack_hashsize from performance profile tuned configuration #1477
OCPBUGS-62702: AA: latency-e2e: skip tests on HT-disabled systems #1386
OCPBUGS-77377: E2E: Add test case to check Infrastructure pods affinity #1470
NO-JIRA: Eliminate expensive and unnecessary MachineConfig updates #1473
NO-JIRA: Bump Kubernetes, OpenShift and other dependencies #1475
OCPBUGS-74027: AA: E2E: LLC: Add tests related to odd cpus #1458
CNF-20755: e2e: Add housekeeping IRQ load balancing tests #1456
CNF-18941: perfprof: enable exec-cpu-affinity by default (annotation) #1426
NO-JIRA: Make changes for migrating to OTE in Dockerfile #1453
OCPBUGS-62632: Do not report Progressing=True during cluster scaleup or node reboot #1447
NO-JIRA: Bump upstream containerfile to 4.22 #1452
OCPBUGS-62496: hypershift:e2e:status: check for duplicated configmap status #1413
OCPBUGS-69802: Updating cluster-node-tuning-operator-container image to be consistent with ART for 4.22 #1450
OCPBUGS-69391: E2E: Granular IRQ functional test cases #1441
Full changelog

cluster-olm-operator

NO-ISSUE: Add dependabot configuration #225
OPRUN-4665: Update k8s dependencies from v0.35.1 to v0.36.2 and OpenShift dependencies to latest #217
OCPBUGS-95475: chore: bump containerd to 1.7.33 #223
OPRUN-4676: support service account deprecation for OCP 5.0 #222
OPRUN-4696: fix upgrade block message and add 5.0 cluster unit tests #216
NO-ISSUE: Remove stale reviewers/approvers, add trgeiger #220
OCPBUGS-88736: Apply cluster TLS security profile to the metrics server #214
OCPBUGS-87296: Updating ose-cluster-olm-operator-container image to be consistent with ART for 5.0 #212
OPRUN-4640: Update to golang 1.26.3 and openshift-4.23 builders #211
OPRUN-4627: override catalog tag to 4.x when RELEASE_VERSION is 4.x and catalogd.yaml pins v5.0 #210
OPRUN-4599: dynamically resolve catalog image tag from OCP release version #203
OCPBUGS-62517: Scale to replicas=2 and enable PDB on HighlyAvailable topology #202
OPRUN-4521: handle OCP 4.²³⁄₅.0 upgrade boundary #184
OCPBUGS-77899: Fix wait logic to handle NewOLM enabled on Default Feature #193
NO-ISSUE: remove no-op os.Remove call in TestRenderHelmTemplate #192
OCPBUGS-77899: Wait for operator-controller resources before verifyig #181
OPRUN-4518: Rename ClusterExtensionRevision to ClusterObjectSet #191
NO-ISSUE: Add fgiudici as reviewer #190
NO-ISSUE: return semver conversion errors #183
OCPBUGS-81188: Update grpc and other dependencies #182
OPRUN-4502: Use FratureGateNewOLMConfigAPI from openshift/api #180
OPRUN-4502: Add feature-gate for DeploymentConfig #176
NO-ISSUE: Update to go 1.25.7 #175
OCPBUGS-65623: cluster-olm-operator sets Progressing=True during upgrade #173
OPRUN-4230, OPRUN-4440: Enable Boxcutter in TPNU #163
NO-ISSUE: Bump golangci to v2 #174
NO-ISSUE: Add pedjak as reviewer and approver #171
OCPBUGS-65505: add resources to clusterOperator relatedObjects #166
OPRUN-4408: Update upgrade message to mention both 4.23 and 5.0 upgrade paths #164
OCPBUGS-69807: Update image locations to be consistent with ART for 4.22 #158
OPRUN-4360: Remove references to operator-framework/catalogd #155
OPRUN-4352: Update to golang 1.25/ocp 4.22 #156
Full changelog

cluster-openshift-apiserver-operator

OCPBUGS-112074: Revert “Revert “NO-JIRA: Disable WatchList feature gate due to the missing support of Project watch”” #755
NO-JIRA: update KMS tests changes with latest library-go bump #753
NO-JIRA: Retry conflict errors on UpdateKMSEncryptionStatus function #752
OCPBUGS-98618: Add HostToContainer mountPropagation to node-pullsecrets volume mount #744
CNTRLPLANE-3237: kms key controller preflight support #747
NO-JIRA: bump library-go api and client-go #746
Revert “NO-JIRA: Disable WatchList feature gate due to the missing support of Project watch” #681
NO-JIRA: Bump library-go #745
NO-JIRA: Update openshift/* #742
CNTRLPLANE-3237: creates the kms status provider from the operator client #741
NO-JIRA: add KMS preflight deploy e2e to encryption-kms-2 #739
CNTRLPLANE-3361: Update openshift/* #740
NO-JIRA: Automatic agentic rebase: Update library-go to d8f45c2 #737
CNTRLPLANE-3237: encryptionstatusprovider: implement UpdateKMSEncryptionStatus #736
CNTRLPLANE-3237: encryptionstatusprovider: use OpenShiftAPIServerInterface instead of Clientset #735
NO-JIRA: kms to kms key identifier check #728
OCPBUGS-87507: Updating ose-cluster-openshift-apiserver-operator-container image to be consistent with ART for 5.0 #705
CNTRLPLANE-3237: intro openShiftAPIServerEncryptionStatusProvider #734
NO-JIRA: Bump library-go to sync #732
CNTRLPLANE-3234: wire KMS health reporter status writer #730
OCPBUGS-86583: Allow Prometheus to scrape check-endpoints metrics on port 17698 #729
NO-JIRA: Automatic agentic rebase: Update library-go to fd74bb5 #727
NO-JIRA: update func from library-go #724
NO-JIRA: Add test for KMS to KMS migration #726
NO-JIRA: Bump library-go for sync #725
NO-JIRA: Bump library-go #723
NO-JIRA: Update openshift dependencies #722
NO-JIRA: add preflight command #714
NO-JIRA: add kms preflight to NP to allow egress #720
NO-JIRA: Automatic agentic rebase: Update library-go to b0f5231 #716
CNTRLPLANE-3363: Register health monitor as command #713
NO-JIRA: kms: bump library-go to get KMS plugin security context #711
CNTRLPLANE-3545: bump library-go to get CA bundle wiring #709
NO-JIRA: Automatic agentic rebase: Update library-go to 7fd5f33 #710
NO-JIRA: Automatic agentic rebase: Update library-go to 0469313 #707
CNTRLPLANE-3226: switch to real Vault KMS plugin in CI #704
CNTRLPLANE-3226: bump library-go to get KMS plugin credentials #699
CNTRLPLANE-3364: remove old go std tests #703
NO-JIRA: Automatic agentic rebase: Update library-go to d8750ed #702
NO-JIRA: Automatic agentic rebase: Update library-go to 0cf249e #701
NO-JIRA: bump latest library-go changes #700
NO-jIRA: Remove old mock plugin deployment #698
NO-JIRA: kms: use DefaultFakeVaultEncryptionProvider to ensure AppRole secre setup #697
CNTRLPLANE-3236: support deploying Vault mock KMS plugin #693
NO-JIRA: Bump latest library-go changes #692
CNTRLPLANE-3364: add the kms suite and migrate the kms tests of oas-o to ote #690
CNTRLPLANE-3237: Bump library-go and sync encryption tests with APIServerEncryption struct change #689
NO-JIRA: Bump latest library-go changes #688
API-1768: e2e network policy tests #675
NO-JIRA: Add control-plane-approvers to OWNERS #677
NO-JIRA: Update library-go for latest changes #678
CNTRLPLANE-2619: Restart operator when TLS config changes #662
CNTRLPLANE-2450: bump(k8s.io): 1.35.2 #669
CNTRLPLANE-2619: make checkendpoints use apiserver config #657
NO-JIRA: OWNERS: remove engineers who have left Red Hat #646
NO-JIRA: Disable WatchList feature gate due to the missing support of Project watch #667
CNTRLPLANE-2241: Update library-go to get KMS encryption #647
NO-JIRA: Create test namespace for KMS migration scenario #650
CNTRLPLANE-2247: Adding KMS TestKMSEncryptionOnOff test for OAS #649
CNTRLPLANE-2247: Adding KMS TestKMSEncryptionOnOff test for Routes #644
CNTRLPLANE-2241: Conditionally add the KMS plugin volume mount to the openshift-apiserver container #641
CNTRLPLANE-2247: Add KMS encryption test target #642
NO-JIRA: update to Kubernetes v1.34.1 #640
OCPBUGS-70035: Updating ose-cluster-openshift-apiserver-operator-container image to be consistent with ART for 4.22 #635
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

cluster-openshift-controller-manager-operator

OCPBUGS-112448: Bump kubernetes dependencies to v1.36 #444
CNTRLPLANE-2907: e2e network policy tests #428
NO-JIRA: Add control-plane-approvers to OWNERS #427
OCPBUGS-81472: Prevent possibility of running controllers against empty informer caches #426
CNTRLPLANE-2620: Restart operator when TLS config changes #412
CNTRLPLANE-2769: bump kubernetes dependencies to v1.35 #415
no-jira: Migrate away from deprecated ioutil #401
no-jira: refactor: use the configured clock source during startup #411
CNTRLPLANE-2620: propagate global tls config to operand #407
OCPBUGS-70032: Updating ose-cluster-openshift-controller-manager-operator-container image to be consistent with ART for 4.22 #404
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

cluster-policy-controller

OCPBUGS-87476: Updating ose-cluster-policy-controller-container image to be consistent with ART for 5.0 #188
OCPSTRAT-3036: Bump to Kube v1.36.2 #197
NO-JIRA: update OWNERS file #190
OCPBUGS-90053: add serviceAccountToken volume type to psalabelsyncer #189
NO-JIRA: Add control-plane-approvers to OWNERS #179
CNTRLPLANE-2769: bump k8s 1.35 #174
Full changelog

cluster-samples-operator

OKD-425: Revert openliberty back to 26.0.0.6 #711
OCPBUGS-111886: Fix python:latest and nodejs template references after UBI 8 tag removal - #707 #707
OCPBUGS-106188: Periodic sync of supported OCP samples #695
OCPBUGS-106187: Periodic sync of OKD samples #683
OCPSTRAT-3578: Add NetworkPolicy manifests for openshift-cluster-samples-operator namespace #703
OCPBUGS-105319: update kubernetes api to v0.36.3 #704
OCPBUGS-87454: Updating ose-cluster-samples-operator-container image to be consistent with ART for 5.0 #700
CNF-23044: Migrate away from deprecated ioutil #668
CNTRLPLANE-3176: implements operator tls config compliance #684
OCPBUGS-77919: Periodic sync of OKD samples #666
MON-4508: Migrate Prometheus targets discovering from Endpoints to EndpointSlices #673
OCPBUGS-77918: Periodic sync of supported OCP samples #667
OCPBUGS-77879: update kubernetes api to v0.35.2 #676
OCPBUGS-77678: Updating ose-cluster-samples-operator-container image to be consistent with ART for 4.22 #675
OCPBUGS-74024: Updating ose-cluster-samples-operator-container image to be consistent with ART for 4.22 #672
OCPBUGS-69966: Updating ose-cluster-samples-operator-container image to be consistent with ART for 4.22 #671
Full changelog

cluster-storage-operator

OCPBUGS-111892: Pass management cluster proxy env vars to CSI driver operator deployments #725
STOR-3011: Implement CSO upgrade check and Prometheus alerts for SELnuxMount readiness, updated runbook URL #724
OCPBUGS-101758: Fix SELinuxMountGAReadiness on HyperShift #721
STOR-2918: update AWS EBS CSI credentials request policy to mirror upstream #717
STOR-3056: inject TLS adherence from API to vsphere problem detector configmap #718
OCPBUGS-99492: NetworkPolicies should use numeric ports instead of named ports #720
STOR-3013: Add e2e test for SELinuxMount upgrade readiness #715
STOR-2914: Bump all deps for 5.0.0 #719
STOR-3011: Implement CSO upgrade check and Prometheus alerts for SELinuxMount readiness #714
STOR-2954: Inject TLS from CVO to operators, update hypershift TLS based on CVO #712
OCPBUGS-88299: Let gcp-pd csi driver operator to use SCC hostnetwork-v2 #713
STOR-2954: feat: have CVO inject the centralized TLS configuration into the operator’s config #703
OCPBUGS-87464: Updating ose-cluster-storage-operator-container image to be consistent with ART for 5.0 #706
NO-JIRA: Add initial Agent Guide #682
STOR-2770: Mount metrics certs of azure-disk and azure-file CSI driver operator for Hypershift #686
STOR-2762: Bump all deps for 4.22 #684
OCPBUGS-74232: volume-data-source-validator should run on master nodes #659
OCPBUGS-78291: Allow azure-disk operator to read VolumeAttributeClasses #683
MON-4509: Migrate Prometheus targets discovering from Endpoints to EndpointSlices #665
MON-4496: metrics: migrate Prometheus SD from Endpoints to EndpointSlices #668
NO-JIRA: Add a comment to sync AWS EBS IAM role into HyperShift #676
STOR-2758: Update rbac from provisioner rebase #674
OCPBUGS-77686: Updating ose-cluster-storage-operator-container image to be consistent with ART for 4.22 #671
TRT-2542: Revert #661 “OCPBUGS-74530: Remove featuregate StoragePerformantSecurityPolicy” #664
OCPBUGS-74530: Remove featuregate StoragePerformantSecurityPolicy #661
OCPBUGS-66212: Remove VSS permissions #649
STOR-2523: hypershift: Add desired-version annotation to operand Deployments and use DeploymentVersionController in CSO #638
OCPBUGS-60159: add vsphere permissions for checking if users is authorized to see metrics #642
OCPBUGS-69978: Updating ose-cluster-storage-operator-container image to be consistent with ART for 4.22 #651
OCPBUGS-63698: feat(azure): add HYPERSHIFT_IMAGE env var for token-minter #643
OCPBUGS-62634: Fix deployment controller Progressing=true on node drain #648
OCPBUGS-67012: volume-data-source-validator must use IfNotPresent image pull policy #650
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

cluster-update-keys

OCPBUGS-87492: Updating ose-cluster-update-keys-container image to be consistent with ART for 5.0 #101
OCPNODE-3978: Third run at expanding the default ClusterImagePolicy for openshift component images #97
revert ‘OCPNODE-3978: Second run at expanding the default ClusterImagePolicy for openshift component images #96
OCPNODE-3978: Second run at expanding the default ClusterImagePolicy for openshift component images #95
TRT-2537: Revert “OCPNODE-3978: Extend the default ClusterImagePolicy for openshift component images” #94
OCPNODE-3978: Extend the default ClusterImagePolicy for openshift component images #75
OCPBUGS-70020: Updating ose-cluster-update-keys-container image to be consistent with ART for 4.22 #91
Full changelog

cluster-version-operator

OCPBUGS-122172: pkg/readiness/cluster_conditions: Conditionally include Upgradeable #1468
OCPBUGS-112659: Remove the CRB for the default openshift-cluster-version SA #1454
OCPBUGS-111971: pkg/agenticrun/controller: Pivot to cluster-update-advisor directory #1448
OCPBUGS-14392: make sync status Failure logs human-readable #1440
OCPBUGS-79358: pkg/cvo/egress: Disable Proxy respect on HyperShift #1357
NO-JIRA: fix(pkg/cincinnati): log the correct root CA pool size #1413
OTA-1997: Allow the CVO to use the agentic-skills payload image when creating proposals #1433
OTA-2084: Register agenticrunv1alpha1 in the Runtime client scheme #1434
OTA-2084: pkg/agenticrun/controller: Inline AgenticRun prompt, dropping the ConfigMap #1432
TRT-2842: Revert #1427 “OTA-1997: Allow the CVO to use the agentic-skills payload image when creating proposals.” #1431
OTA-1997: Allow the CVO to use the agentic-skills payload image when creating proposals. #1427
OTA-2084, OTA-2097: pkg/agenticrun/controller: Additional logging to AgenticRun CRD detection #1428
OTA-2084: Conditionally deploy console plugin when AgenticRun CRD is present #1425
NO-JIRA: Fix make build target cd issue #1404
OTA-2064: Rename Proposal API to AgenticRun #1422
OTA-1967: install: Drop Lightspeed CustomResourceDefinitions (Proposal, etc.) #1412
OTA-1956: install: Split multi-document YAML and add missing annotations #1423
OCPCLOUD-3368: bumping with o/api changes to reflect new capabilities (crdcompatibilitychecker+capi) #1403
TRT-2776: Revert #1398 “install: Split multi-document YAML and add missing annotations” #1420
OTA-1956: install: Split multi-document YAML and add missing annotations #1398
OTA-1966: AGENTS: Drop ‘Deploying CVO with Lightspeed Proposals’ section #1414
OTA-1836: Fix empty lister for API server (simplified a bit) #1397
OCPBUGS-84513: set terminationMessagePolicy on update-payload pods #1417
NO-JIRA: CONTRIBUTING.md: Improve the review process wording #1419
OTA-1966: pkg/readiness/crd_compat: Drop unnecessary CustomResourceDefinition check #1415
NO-JIRA: Handle the tests on Microshift environment #1416
OCPBUGS-87461: Updating cluster-version-operator-container image to be consistent with ART for 5.0 #1400
CNTRLPLANE-3429: Respect configured cipher order for inject-tls #1386
OTA-1966: Add readiness checks and wire into proposal controller #1395
OCPBUGS-60579: install: Remove manual BoundServiceAccountTokenVolume configuration #1411
OTA-1956: pkg/payload: Add Images map and tolerate unknown template fields during upgrades #1410
OCPBUGS-36246: Improve resource merge diffs #1409
NO-JIRA: Add coverage for syncAvailableUpdates #1375
NO-JIRA: Add thread-safe AddSchemes() to fix concurrent map writes #1401
OTA-1996: Add e2e tests for TLS profile update #1393
NO-JIRA: Risk from alert e2e blocking #1399
NO-JIRA: chore: exclude e2e tests from make test unconditionally #1321
OTA-1836: Honor the centralized TLS configuration #1338
NO-JIRA: refactor: simplify redundant error checking conditions #1320
OTA-1966: Install namespace/openshift-lightspeed only when TechPreview is enabled #1394
OTA-1966: Manage proposals #1382
OTA-1935: pkg: Use risk.Source framework to feed Upgradeable #1368
OTA-1967: Take official CRDs from the OpenShift Lightspeed operator #1387
MON-4477: chore: add permissions on endpointslice to Prometheus Role and use serviceDiscoveryRole: EndpointSlice in ServiceMonitors #1305
OTA-1966: Init the Proprosal Lifecycle Controller #1381
NO-JIRA: OpenShiftUpdateRiskMightApply: bump pending to 15m from 10m #1372
OTA-1836: chore(deps): Bump general OpenShift dependencies #1377
OTA-1979: Revert “lightspeed: Add a new image holding Lightspeed skills” #1378
NO-JIRA: how-to: troubleshoot bootstrap CVO #1369
OTA-1965: Add Lightspeed CustomResourceDefinitions #1380
NO-ISSUE: Fix TestOperator_upgradeableSync #1373
OTA-1962: lightspeed: Add a new image holding Lightspeed skills #1376
OTA-1813: Extend alert risk e2e #1371
OTA-1933: pkg/risk: Refactor alerts into a generic update-risk interface #1367
NO-JIRA: All CVO manifests in payload should be included #1337
OTA-1813: Drop a local label on alert-risk e2e #1363
NO-ISSUE: Add CodeRabbit config with review rules from PR analysis #1360
NO-JIRA: use scrape class which is more succinct #1365
CNTRLPLANE-2777: feat(resource builder): allow to inject tls configuration into annotated config maps #1322
OTA-1813: Populate risks from alerts #1329
OCPBUGS-78997: Do not discard ListOptions in waitForPodCompletion. #1361
OCPBUGS-65621: add dedicated service account to crb, cvo and version pod #1266
NO-JIRA: Add test migration guide for openshift-tests-private to CVO #1336
NO-JIRA: Try not to block by informing #1356
OCPSTRAT-2876: Allow inclusion/exclusion of manifests based on the OCP major version #1282
TRT-2581: Revert “NO-ISSUE: OTA-1605 Automate OCP-42543” #1353
NO-ISSUE: OTA-1605 Automate OCP-42543 #1309
CNTRLPLANE-2777: refactor(lib/resourcebuilder): generate interface for client instead of their specific types #1344
OTA-1546: Evaluate conditional updates if accept risks change #1348
OTA-1546: Skip an accept-risk case on network-restricted environment #1332
NO-ISSUE: Update fake clientsets to NewClientset #1340
TRT-2569: (fix) hypershift-e2e-aks and hypershift-e2e-aws failing with CVO bootstrap deadlock in ci amd64 payload #1342
OCPBUGS-78061: Fix invalid ClusterVersion.Spec.DesiredUpdate #1345
OTA-1860: Stop blocking patch updates when cluster version overrides are set #1314
TRT-2569: Revert “OTA-1546: Add a metric and an alert for conditional risk conditions” #1339
OTA-1546: Add a metric and an alert for conditional risk conditions #1318
OCPBUGS-77762: Add an e2e to check the default network polocy #1334
OTA-1546: Generate riskConditions in a better way #1324
NO-JIRA: Allow for risks only desired update #1335
OCPBUGS-77762: install/0000_00_cluster-version-operator_02_networkpolicy: Add inclusion annotations #1333
NO-JIRA: Use github.com/daixiang0/gci to sort imports #1330
NO-JIRA: Sort and verify imports #1328
Revert “TRT-2549: Revert “Add a serial e2e for accept-risks”” #1323
NO-JIRA: Mention the fauxinnati in the developer documentation #1308
OCPBUGS-66898: Implement mTLS authentication and authorization for CVO metrics endpoint #1271
OTA-1861: cmd/cluster-version-operator/render: Add –cluster-version-manifest-path option #1315
TRT-2549: Revert “Add a serial e2e for accept-risks” #1319
OTA-1546: Add a serial e2e for accept-risks #1310
NO-JIRA: Add docs about places running e2e tests #1312
OCPBUGS-74028: Updating cluster-version-operator-container image to be consistent with ART for 4.22 #1296
OCPSTRAT-2485: Introduce feature gate based inclusion/exclusion of manifests #1273
NO-JIRA: More flexible timeout option for oc-cli #1311
OTA-1546: Reconcile cv.spec.desiredUpdate.acceptRisks #1284
NO-JIRA: Add a serial e2e test #1306
TRT-2511: Reapply “OTA-1604: migrate ocp-46922 from otp to cvo repo” #1301
NO-JIRA: Fix linter issues on dot-imports #1304
OTA-1546, OTA-1833: Add OKD feature set filtering logic, Bump openshift/api #1302
NO-JIRA: Fix some lint issues #1299
Revert “OTA-1604: migrate ocp-46922 from otp to cvo repo” #1297
OTA-1787: pkg: Update Upgradeable condition to explicitly mention major version updates #1276
NO-JIRA: hack/build-image.sh: Update Dockerfile reference #1272
OCPBUGS-73929: lib/resourcemerge/core: Reconcile ConfigMap binaryData too #1294
NO-JIRA: Bump to builder:rhel-9-golang-1.25-openshift-4.22 #1293
OTA-1604: migrate ocp-46922 from otp to cvo repo #1279
NO-JIRA: Introduce oc-cli for e2e tests #1267
OTA-1786: pkg/payload/precondition/clusterversion/gianthop: Allow updates to 5.0 #1275
NO-ISSUE: .claude/commands/update-godocs: New command for Go doc updates #1278
NO-ISSUE: OTA-1605 Adding descriptions for building the binary and running the tests #1263
NO-JIRA: Create AGENTS.md file #1268
OCPBUGS-17007: vendor: Update openshift/library-go to get new default TLS configuration #1270
Full changelog

configmap-reloader

OCPBUGS-87510: Updating configmap-reload-container image to be consistent with ART for 5.0 #83
NO-JIRA: disable automatic coderabbit reviews #79
OCPBUGS-77734: Updating configmap-reload-container image to be consistent with ART for 4.22 #78
OCPBUGS-70038: Updating configmap-reload-container image to be consistent with ART for 4.22 #76
Full changelog

console

OCPBUGS-120694: Installed Operators page fails with catalogsources “forbidden … at the cluster scope” error #17142
OCPBUGS-121974: Migrate OLM Cypress tests to Playwright #17149
OCPBUGS-120712: Update stale comment #17143
OCPBUGS-115209: Fix webhook creation in Git for PAC #17123
OCPBUGS-120668: improve playwright reliability #17138
OCPBUGS-115402: Rename e2e scripts so playwright is the main one #17129
OCPBUGS-115155: move yarn install to prow scripts #17122
OCPBUGS-112307: Show CPU/Memory metrics for non-admin users on Projects page #17053
OCPBUGS-114388: display operators in catalog when Tech Preview enabled #17100
OCPBUGS-113650: Helm chart is created in incorrect namespace #17085
OCPBUGS-113704: Helm test setup: revert silent skip and restore panic on infrastructure failure #17087
OCPBUGS-112325: ‘Edit Machine count’ from action list doesn’t work #17061
OCPBUGS-112467: Remove empty integration-tests package from CI #17068
OCPBUGS-111972: Fix plugin entrypoint failing to load #17033
OCPBUGS-112288: Migrate app/ Cypress e2e tests to Playwright #17049
OCPBUGS-112327: Helm backend tests flake due to chartmuseum/zot failing to bind ports in CI #17062
OCPBUGS-112268: Keep OLS cluster-update prompts within OpenAI 32k limit #17044
OCPBUGS-112088: Migrate secrets e2e tests from Cypress to Playwright #17043
OCPBUGS-111928: Shared Playwright e2e context and test generation skill #17023
OCPBUGS-111921: make cloud provider fields optional during operator install #17022
OCPBUGS-112009: Fix flaky TestAsyncCache backend test due to timing-dependent assertions #17037
Fix for OCPBUGS-104441: CVE-2026-69152 #16937
CONSOLE-5040: Detangle TableColumn and ConsoleDataViewColumn #16984
CONSOLE-5451: Display projected volume sources with navigable links in Volumes table #16924
OCPBUGS-109592: Bump to @rspack/core 2.1.10 #16978
CONSOLE-5132: Migrate console plugins table to DataView #16942
OCPBUGS-106132: fix gap in data view checkbox col #16964
CONSOLE-5438: Expose ResourceYAMLEditor onCancel to the SDK #16941
OCPBUGS-105598: Bump to @rspack/core 2.1.9 and drop “megahard” packages #16950
OCPBUGS-70112: Add Cache-Control headers to console responses #16923
OCPBUGS-105519: Fix flaky e2e tests missing warmupSPA #16939
OCPBUGS-98943: Make developerCatalog.types matching case-insensitive #16876
OCPBUGS-105517: Fix flaky search.spec.ts Playwright e2e tests #16938
OCPBUGS-95592: Humanize memory and storage values in ResourceQuota display #16874
CONSOLE-5428: follow up la migration du i18next-cli #16926
OCPBUGS-67295: Fix icon display for duplicate operator names from different catalogs #16898
OCPBUGS-81511: Remove unscoped CSV watch from ClusterNotUpgradeableAlert #16904
NO-JIRA: Add ReadWriteOncePod support for Cinder CSI driver #16870
OTA-2035: Address ProdSec findings for OLS Helper Buttons #16910
CONSOLE-5414: Migrate dev-console Cypress tests to Playwright (batch 2) #16741
OCPBUGS-105314: Fix xterm ResizeObserver crash on uninitialized dimensions #16918
OCPBUGS-105273: Fix nested interactive controls on Search page #16914
CONSOLE-5228: re-enable eslint rules and autofix + bump prettier #16915
OCPBUGS-105318: Fix node-groups-filter test to use correct page-heading test ID #16912
OCPBUGS-102342: Dismiss Quick Start drawer in Playwright e2e tests #16903
OCPBUGS-90514: Fix CVE-2026-12143 form-data CRLF injection #16865
NO-JIRA: Prepare for publishing new 4.23 prerelease plugin SDK packages #16905
CONSOLE-5424: Add minimize action for toast notifications #16762
CONSOLE-5118: Improve AI assessment prompts #16880
CONSOLE-5241: Migrate knative-ci.feature Cypress tests to Playwright #16658
CONSOLE-5065: Bump @openshift/dynamic-plugin-sdk to 9.1.0 #16897
CONSOLE-5425: Add rspack native bindings for linux/s390x and linux/ppc64le #16890
CONSOLE-5196: Fix Playwright e2e flakes across multiple test suites #16881
CONSOLE-5196: Increase Playwright CI retries and abort after 10 failures #16887
OCPBUGS-99434: Show toast notification for invalid Helm Chart repositories #16792
CONSOLE-5417: Migrate dev-console Cypress tests to Playwright (batch 4) #16767
CONSOLE-5065: Align Console useResolvedExtensions hook with upstream plugin SDK #16815
OCPBUGS-99491: Fix Installed Operators table row cells ignoring column management #16817
CONSOLE-5439: Migrate to eslint 9 #16878
CONSOLE-5409: Add Playwright e2e test for operator lifecycle metadata UI #16701
CONSOLE-5196: Replace page.locator with getByTestId in Playwright tests #16873
OCPBUGS-90080: Validate chart URL in /api/helm/verify to prevent SSRF #16786
CONSOLE-5400: Make Node management enhancements flagged by OpenShift 5 #16797
CONSOLE-5196: Fix Playwright e2e flakes and CI reliability #16863
NO-JIRA: Remove generated plugin manifest JSON schema files #16875
CONSOLE-5428: i18next-cli migration follow up #16864
RFE-4925: Fix inconsistent Search page filter default (use Name) #16601
HELM-763: Add secrets for Helm release upgrade #16787
CONSOLE-5397: Log perspective overrides when starting Bridge #16838
NO-JIRA: Remove plugin sdk build from yarn dev #16850
OCPBUGS-33836: quickstart page i18n misses (Fix Quick Starts i18n bundle lookup for zh-CN) #16819
OCPBUGS-99418: Bump protobufjs to 7.6.5 to fix CVE-2026-59877, CVE-2026-48712, CVE-2026-41242 #16813
OCPBUGS-84564: remove block volume mode in case of ocs-storagecluster-ceph-nfs #16397
OCPBUGS-86280: Guard against null plugin route components #16587
CONSOLE-5434: Replace Popper with PF components #16831
CNTRLPLANE-3423: feat: inject centralized TLS into console operand #16804
NO-JIRA: Make regular notification icon outlined by default #16811
OCPBUGS-94168: Fix CVE-2026-13149 brace-expansion DoS vulnerability #16812
OCPBUGS-72369: i18n format missing for Request/limit unit labels on deploy image page #16805
OCPBUGS-57309: ‘0 B’ is shown on details page when create pvc with ‘EiB’ unit #16800
OCPBUGS-77379: Incorrect translations for ‘CatalogSources’ and ‘OperatorGroups’ in l… #16801
OCPBUGS-99475: Fix virtualized table row overlap after react-virtualized 9.22.6 upgrade #16798
CONSOLE-5428: migrate to i18next-cli #16796
NO-JIRA: Move jest config out of package.json #16799
CONSOLE-5425: Migrate to rspack #16761
OCPBUGS-99226: Disable Knative e2e cypress test #16782
OCPBUGS-99052: recover from reverse proxy panic on browser disconnect #16776
OTA-2066: AIA mitigations #16763
CONSOLE-5065: Clean up Console extension code reference processing #16115
CONSOLE-5426: remove GraphQL proxy endpoint #16769
OCPBUGS-79520: Fix kebab actions on Installed Operators list page #16682
HELM-731: Upgrade helm in console #16607
OCPBUGS-98489: CVE-2026-59869 bump js-yaml #16760
CONSOLE-5415, OCPBUGS-94037: Bump react-router to ~7.18.1 #16726
NO-ISSUE: Add empty Prow techPreview e2e entrypoint scripts #16766
NO-ISSUE: Match operator lifecycle versions by major.minor only #16698
CONSOLE-3956: Replace custom Shortcut components with PF ShortcutGrid #16207
NO-ISSUE: Skip OLMv0-specific e2e tests when techPreview is enabled #16759
CONSOLE-5423: Add rspack support for dynamic plugins #16752
CONSOLE-5421: Rename “Self-support” to “Unsupported” and stack support phase date #16742
CONSOLE-5196: Fix flaky Playwright e2e tests caused by OAuth redirect timing #16740
CONSOLE-5306: Surface Playwright report link in Prow Spyglass #16743
OCPBUGS-50016, OCPBUGS-86587: Bump to PF 6.6.0 #16750
OCPBUGS-88715: Bump follow-redirects from 1.15.3 to 1.16.0 to remediate CVE-2026-40895 #16590
CONSOLE-5356: Add optional onSubmit parameter to useLabelsModal hook #16560
CONSOLE-5124: Multi-domain console backend support #16686
NO-ISSUE: Return self-support when date is before all lifecycle phases #16699
CONSOLE-5398: Remove events card from node overview dashboard #16697
OCPBUGS-84721: Fix WebSocket InvalidStateError in pod terminal #16377
CONSOLE-5306: Add Prow-compatible JUnit reporter for Playwright e2e tests #16501
NO-JIRA: Prepare for publishing new 4.23 prerelease plugin SDK packages #16713
OCPBUGS-78980: Update @graphql-codegen packages for Node.js 25 compatibility #16240
CONSOLE-5271: Gate lifecycle metadata on server-side OLM lifecycle flag #16668
OCPBUGS-94089: Fix helm backend test setup reliability #16687
CONSOLE-5361: Add toast overflow and notification drawer integration #16636
CONSOLE-5183: Add persistent pod terminal sessions to Cloud Shell drawer #16269
OCPBUGS-83817: Fix orphaned shell processes in pod terminal on WebSocket disconnect #16307
CONSOLE-5238: Remove unused telemetry Cypress integration tests #16685
CONSOLE-5283: Migrate dashboard Cypress tests to Playwright #16669
CONSOLE-5158: Add filter by group for nodes #16253
OCPBUGS-83799: Fix Workloads sidebar ordering when DeploymentConfig capability is disabled #16351
CONSOLE-4954: Add Workload tab to Node view #16574
OCPBUGS-87353: Updating openshift-enterprise-console-container image to be consistent with ART for 5.0 #16558
CONSOLE-5235: Migrate basic app Cypress e2e tests to Playwright #16431
CONSOLE-4951: Add Health tab to Node View, remove events tab #16581
CONSOLE-5271: Address docs review feedback from PR #16551 #16655
OCPBUGS-85485: Append id_token_hint to OIDC logout redirect URL #16548
CONSOLE-5315: Get Node inventory card items from extensions #16582
OCPBUGS-90555: [release-5.0] webpack-dev-server: Information disclosure and denial of service via improper proxy configuration #16667
OCPBUGS-81749: Add SSAR checks to gate OLM actions #16554
HELM-728: Persist secrets for Helm upgrade #16432
CONSOLE-4950: Add high availability section to Configuration #16555
CONSOLE-5277: Improve ResourceName data-test uniqueness and fix e2e test patterns #16679
CONSOLE-5277: Migrate console e2e CRUD tests to Playwright #16556
OCPBUGS-91965: Add catalog item-type for OLMv1 operator catalog #16666
OCPBUGS-59569: Disable create button until CRD is available #16633
OCPBUGS-87201: Fix RoleBindings tab error for non-cluster-admin users #16639
CONSOLE-5271, CONSOLE-5272: Improve operator lifecycle UI #16551
CONSOLE-5118: Add OLS integration for cluster update workflows #16131
NO-JIRA: Small updates post #16585 changes #16624
OCPBUGS-88739: Projects cannot be filtered by display name #16632
OCPBUGS-69920: use RFC 5737 documentation IP in PV template #16641
OCPBUGS-86182: Fix ColumnManagementModal not showing NamespaceColumnHelpText #16637
OCPBUGS-88450: Use fixed artifacts directory to prevent stale temp dir accumulation #16606
OCPBUGS-89230: Fix sidebar not toggling at small viewport widths #16634
OCPBUGS-87864: CVE-2026-4800 #16595
OCPBUGS-88451: Remove redundant waitFor calls in Playwright e2e tests, re-enable flaking tests after getting started fix #16583
CONSOLE-5037, CONSOLE-5354: Migrate useTranslation to pass namespace explicitly #16609
OCPBUGS-87996: Bump fast-uri to 3.1.2 to fix CVE-2026-6322 #16604
CONSOLE-5355, OCPBUGS-88319: Allow customizing skipImportPrefixes when building Console plugins and begin adoption of api types package #16585
OCPBUGS-87930, OCPBUGS-87982: Bump protobufjs and shell-quote #16586
OCPBUGS-85545: Fix guided tour modal flash on page reload #16462
OCPBUGS-87969: Directly use RhUi icons where possible #16591
OCPBUGS-87904: Good faith application of docs reviews #16584
OCPBUGS-86894: reduce startup API calls and prioritize critical fetches #16533
CONSOLE-5271, CONSOLE-5272: Add operator lifecycle metadata to installed operators table #16428
OCPBUGS-86338: Bump immutable.js to v3.8.3 #16480
CONSOLE-5336: Add CreateContainerError filter to pod list status filters #16559
CONSOLE-5242: Remove shipwright-plugin Cypress integration tests #16553
CONSOLE-4946: Add Configuration tab to Node view #16124
NO-JIRA: Improve cypress-migration skill #16550
OCPBUGS-82506, OCPBUGS-82507: Re-enable OLM Cypress tests disabled for createRoot #16531
OCPBUGS-86564: Use stable username hash for user-settings ConfigMap names #16512
OCPBUGS-86875: Always use RHUI icons #16528
OCPBUGS-86755: use a clip path instead of overlapping triangles #16520
CONSOLE-5037: Add knip-based dead code detection in CI #16523
CONSOLE-5284: Put new node inventory items behind tech-preview #16414
CONSOLE-5307: Remove dead code 2: electric boogaloo #16513
NO-JIRA: Update Console 4.23 plugin SDK CHANGELOG #16516
CONSOLE-5091: Add bulk selection and schedulable actions to Nodes page #16203
CONSOLE-5296: Add non-scalable image warning when scaling workloads #16436
OCPBUGS-82508, OCPBUGS-82509: Fix and re-enable operator e2e tests disabled for createRoot #16517
OCPBUGS-86614: prep for 4.22 GA SDK publish #16507
CONSOLE-5308: Centralize ResizeObserver polyfill in Jest setup for unit tests #16506
CONSOLE-5286: Block snapshot tests via ESLint and migrate existing tests to explicit assertions #16427
CONSOLE-5307: Remove unused exports and dead code #16502
NO-JIRA: Update plugin SDK core package CHANGELOG #16496
NO-JIRA: Capitalize “Basic” in secret dropdown label #16490
OCPBUGS-83767: Helm upgrade — preserve release values when changing chart version #16364
OCPBUGS-86491: Fix macOS Option key in pod terminal #16492
CONSOLE-5293: Update Dockerfile.downloads for 4.22 and add RHEL ⁸⁄₉ oc binaries #16455
CONSOLE-5298: enable http2 on the backend #16471
CONSOLE-5253: Extend Unit Tests: Console-App - Core Navigation & Orchestration #16452
OCPBUGS-86488: Bump to PatternFly 6.5.1 #16491
CONSOLE-5244: Migrate webterminal-plugin Cypress tests to Playwright #16461
CONSOLE-5110: update to PatternFly 6.5.0 #16172
OCPBUGS-82512: Fix knative e2e test failures caused by createRoot timing #16289
CONSOLE-5300: Parallelize context detection to reduce initial load time #16477
HELM-703: Add authentication for Helm chart URLs #16360
CONSOLE-5194: Audit and fix Claude Code skills for accuracy #16316
OCPBUGS-84876: Remove DataViewToolbar wrapper from bottom pagination #16479
NO-JIRA: Add eslint-plugin-no-barrel-files #16476
OCPBUGS-84214: Fix Shipwright detail pages crashing with React error #310 #16474
CONSOLE-5197: Improve Playwright artifact collection and add safety checks #16463
OCPBUGS-71878: Show empty state instead of 403 error for users without projects #16464
OCPBUGS-82505: Re-enable add-flow-ci.feature e2e tests disabled for createRoot adoption #16285
NO-JIRA: Update Console plugin SDK CHANGELOG files #16465
CONSOLE-5280: Migrate cluster-settings Cypress tests to Playwright #16444
OCPBUGS-81521: Adapt dashboard Prometheus polling interval based on query response time #16441
CONSOLE-5245: Install and configure eslint-plugin-playwright for e2e directory #16433
CONSOLE-5197: Collect Playwright test artifacts for Prow CI #16453
OCPBUGS-85649: bump gRPC-Go package #16442
OCPBUGS-82513: Enable Topology e2e tests #16273
CONSOLE-5200: add qa-verify skill for automated PR visual verification #16429
OCPBUGS-84669: Fix ProjectLink to update active namespace in Redux #16430
CONSOLE-5212: Fix ESM compatibility for Playwright e2e tests #16445
OCPBUGS-79521: Restore list page text and row filter functionality #16440
OCPBUGS-59404: Allow VolumeSnapshot restore when parent PVC is deleted #16447
OCPBUGS-83569: [main] CVE-2026-26996 Bump minimatch library #16301
CONSOLE-5211: Add Cypress-to-Playwright migration skills and context #16315
CONSOLE-5229: Enable RTL ESLint rules in Knative tests by removing file-level no-container / no-node-access suppressions #16405
CONSOLE-5197: Add Playwright E2E test infrastructure for Prow/CI #16374
CONSOLE-5034: Migrate tile-view-page and value-from-pair to TypeScript #16412
OCPBUGS-85242: Add Suspense boundary to LazyRoutePage for plugin routes #16409
OCPBUGS-77952: Fix devfile sample import by adding fallback for parent resolution failures #16149
OCPBUGS-70273: Prevent binary secret data corruption when editing #16053
OCPBUGS-65950: Update template whenever settings are updated #16143
CONSOLE-5212: Migrate Playwright setup to project dependencies #16408
CONSOLE-5285: remove corepack dep for build-(frontend/demos), bump yarn #16426
OCPBUGS-81518: Increase Resource Dropdown visible items cap to 250. #16398
CONSOLE-5273: Expose useToast in the SDK #16400
OCPBUGS-59353: Fix authentication redirect loop on repeated 401 responses #15814
CONSOLE-5015: Migrate NameValueEditor to TypeScript and PatternFly drag-drop #16406
NO-JIRA: Add approvers and reviewers to helm-plugin OWNERS #16361
OCPBUGS-85043: Remove @console imports from SDK dist #16399
OCPBUGS-77931: Loosen default img-src CSP #16388
OCPBUGS-84324: Update outdated documentation links and references #16362
CONSOLE-5212: Set up Playwright e2e test infrastructure #16320
OCPBUGS-84844: VSphere plugin changes broke i18n translations - missing strings in locales/en/ #16384
OCPBUGS-80940: Fix SDK publish workflow for Yarn Berry #16392
HELM-613: Reject basic auth over non-HTTPS for Helm chart repositories #16317
OCPBUGS-81519: Fix Search page state mutation and unnecessary component remounts #16266
OCPBUGS-84876: Add bottom pagination to ConsoleDataView for mobile responsiveness #16391
OCPBUGS-84856: Fix ESLint Testing Library plugin PR review feedback #16387
OCPBUGS-82140: Remove PII from events #16365
NO-JIRA: Align Dockerfile.dev with multi-arch Dockerfile structure #16390
OCPBUGS-79363: Move xterm to its own chunk #16370
NO-JIRA: zsh compatibility for microcopy-review #16389
NO-JIRA: Add fsgreco to frontend reviewers #16381
CONSOLE-5184: Enable ESLint Plugins for React Testing Library #16270
OCPBUGS-84710: Fix ConsoleDataView filter order: Name and Label should appear first #16375
OCPBUGS-84227: i18n upload/download routine task - version 4.22 #16318
OCPBUGS-84230: [release-4.22] - Re-enable cluster-settings/update-modal.cy.ts e2e test disabled for createRoot adoption #16319
OCPBUGS-81522: Reduce dashboard re-renders by memoizing cards and stabilizing prop references #16367
CONSOLE-5203: Remove old QE team from our repos #16312
OCPBUGS-81518: Fix ResourceListDropdown performance on large clusters #16252
OCPBUGS-79067: Fix crash when switching language to English #16366
NO-JIRA: Remove broken entrypoints and unused packages #16357
OCPBUGS-82511: re-enable helm-release.feature #16274
CONSOLE-5227: Upgrade ESLint from v6 to v8 and @typescript-eslint to v8 #16353
OCPBUGS-84338: Update resolveDynamicModuleMaps to skip unavailable packages #16340
OCPBUGS-84320: Use popover token in QS modal #16339
OCPBUGS-84296: fix Helm list page redirect after upgrade/rollback #16336
NO-JIRA: prepare for 4.22-prerelease.3 sdk publish #16338
CONSOLE-5144, OCPBUGS-81319, OCPBUGS-83823: 4.22 SDK fixes #15655
OCPBUGS-83812: Fix race conditions in OLM descriptors Cypress test #16304
OCPBUGS-83816: Fix race conditions in create-namespace Cypress tests #16306
NO-JIRA: enable multi-architecture yarn builds #16228
OCPBUGS-83813: Fix race conditions in debug pod Cypress tests #16305
OCPBUGS-81668: Fix User Preferences responsive breakpoints bug #16279
OCPBUGS-77864: Add gRPC probe support to container details view #16245
CONSOLE-5176: Refactor RTL Tests from fireEvent to userEvent #16294
OCPBUGS-82504: Re-enable cluster-settings/update-modal.cy.ts e2e test disabled for createRoot adoption #16283
NO-JIRA: Replace deprecated io/ioutil pkg #15902
OCPBUGS-81630: Fix unnecessary error on Node Terminal tab #16263
OCPBUGS-78365: Fix create visual connector in Topology #16241
OCPBUGS-83532: Add empty state visibility check to CRD test #16303
CONSOLE-5204: Merge PR templates #16287
OCPBUGS-82510: Fix web-terminal-adminuser e2e tests broken by createRoot #16284
OCPBUGS-83446: Fix Cypress test timeouts by using correct timeout option #16280
OCPBUGS-83532: Fix race condition in CRD Cypress test #16288
NO-JIRA: enable Cypress Cloud in CI #16277
CONSOLE-4809: Extend RTL Test Coverage for Components Migrated from Enzyme #16249
CONSOLE-4512, OCPBUGS-82473: Switch from legacy render to createRoot #16202
OCPBUGS-77113: remove dev to admin links as dev monitoring views are enabled #16163
NO-JIRA: Update Dockerfile.dev to use latest base images #16264
CONSOLE-5065: Refactor dynamic module import transform code #16224
OCPBUGS-76556: fix Developer Sandbox telemetry #16020
NO-JIRA: Add stefanonardo to frontend reviewers#16267 #16267
OCPBUGS-78904: Mark notification drawer title for translation #16229
CONSOLE-3955: Migrate LogSnippet to PatternFly component #16190
OCPBUGS-81654: Filter out isActionCell prop to fix React warning #16247
CONSOLE-5152: bump cypress to latest #16244
OCPBUGS-81744: Convert cluster update status integration test to unit test #16260
OCPBUGS-81506: Add missing i18n translations for Pagination component #16233
CNV-62016: add description to ResourceQuota page title #16086
OCPBUGS-80989: Skip to fetch resource if model not found and load the other resources in list-page #16230
CONSOLE-5110: Assorted fixes and improvements #16250
OCPBUGS-79355: Fix and enable OLM Package E2E tests disabled during the public/ directory useK8sWatchResource refactoring #16220
OCPBUGS-74156: Prevent pod log search from shifting page layout #16223
Revert “OCPBUGS-74156: Prevent pod log viewer from shifting page layout when searching” #16218
OCPBUGS-74506: Remove ConsolePluginSecurityPolicy featuregate #16013
CONSOLE-5151: Replace showdown with marked #16239
CONSOLE-5094: cypress test improvements #16046
OCPBUGS-81331: Storage > VolumeSnapshots and VAC throws error #16219
CONSOLE-4447: Additional modals switched to use ModalFooterWithAlerts for consistency #16171
OCPBUGS-80939: Add robots.txt policy to console #16205
OCPBUGS-79315: fix analyze.sh/react-icons treeshake #16188
CONSOLE-5015: Remove drag-and-drop from TextColumnField #16204
CONSOLE-5065: Update list of PatternFly packages that support dynamic modules #16182
NO-ISSUE: frontend/packages/console-dynamic-plugin-sdk/README: 4.22 doesn’t support PatternFly 5 #16206
OCPBUGS-62700: Fix VolumeSnapshot table sorting #16200
OCPBUGS-79581: Fix Deprecated Operator Warnings E2E tests Skipped in the Firehose Public Folder PR #16197
OCPBUGS-74156: Prevent pod log viewer from shifting page layout when searching #16193
OCPBUGS-79678: Align the search input so that its next to the select menu toggle #16198
OCPBUGS-78584: Preserve query params in CatalogRedirect #16165
OCPBUGS-79525: Fix null reference error in subscription action menu #16196
OCPBUGS-72526: Impersonating user loads extra pages that user not authorized to view #16088
OCPBUGS-79000: Fix perspective switcher icon suspending the whole app #16183
CONSOLE-5015: Refactor pinned nav to react-drag-drop #16146
CONSOLE-5031: Remove Firehose Component and Fix and Cleanup Impacted Types #16096
CONSOLE-4983: Add Groups to node details #15981
NO-JIRA: prep for 4.22.0-prerelease.2 SDK publish #16201
OCPBUGS-74140: Prevent Chinese characters from rendering as unicode escape sequences in alert messages #16156
OCPBUGS-77814: Add E2E tests for VolumeAttributesClass UI #16085
CONSOLE-5073: Update redux-related packages to latest #16087
OCPBUGS-78543: Hide filter category selector when only one filter exists #16153
CONSOLE-5015: Replace react-dnd with PF MultipleFileUpload in topology #16179
CONSOLE-5134: Update to Go 1.25, K8s 1.35, and Helm 3.20 #16147
CONSOLE-5135: add deprecation warning for react-router-dom #16178
OCPBUGS-79462: Skip flaky Data Grid operator E2E tests #16191
CONSOLE-5027: Refactor public/ Directory Components to useK8sWatchResource(s) #15954
OCPBUGS-63391: Replace DataViewTextFilter with existing custom TextFilter #16151
OCPBUGS-73803: Fix incorrect OLMv1 documentation URL #16052
OCPBUGS-74346: Fix useOperatorCatalogCategories hook. #16093
OCPBUGS-78534: Make E2E test create helper idempotent and improve test cleanup #16148
OCPBUGS-66147: Make folder field optional for vsphere #16142
OCPBUGS-77912: Fix TypeError in OLS code import to console #16119
OCPBUGS-44612: Remove useUserPreferenceCompatibility and withUserPreferenceCompatibility #16076
CONSOLE-5073: Bump i18next to latest #16150
CONSOLE-4447: Update SecretFormWrapper modal to use ModalFooterWithAlerts #16167
RFE-7965: add basic auth support for helm repositories #15624
CONSOLE-5094: Add pesudo CSP violation detection to Cypress #16048
NO-JIRA: Update demo plugin README #16166
CONSOLE-5093: Remove support for deprecated extensions #16043
CONSOLE-4447: Remove deprecated modal components and CSS #16126
CONSOLE-5018: Refactor UNSAFE_ class components to FC #16062
CONSOLE-5129: Theme context cleanup #16155
OCPBUGS-78390: Reset pagination page when changing namespace #16138
OCPBUGS-78253: Fix InstallPlan > Components layout issue #16127
CONSOLE-4447: Migrate @console/shared modals to PatternFly v6 Modal components #16079
NO-JIRA: Remove cursor context #16106
CONSOLE-5087: Refactor console-shared-package from Firehose to useK8sWatchResource #16077
CONSOLE-4447: Migrate modal hooks from useModal to useOverlay #16061
CONSOLE-5114: Clean up React Router imports and dependencies #16139
OCPBUGS-78499: Fix curly quote in operator-hub-community-provider-modal #16145
NO-JIRA: Update PageHeading types #16095
NO-JIRA: Add a progress bar when building #16099
CONSOLE-4447: Migrate knative-plugin modals to PatternFly 6 #16065
OCPBUGS-78404: Fix flaky secret integration tests #16140
CONSOLE-4447: Migrate core modals to PatternFly 6 Modal components (part 2) #16123
CONSOLE-4439: Upgrade to React Router 7 #14957
OCPBUGS-78361: Fix flaky popover-status-button integration test #16135
CONSOLE-4447: Migrate core modals to PatternFly v6 modal components (part 1) #16100
CONSOLE-4447: Migrate console-app modals to modern PatternFly Modal components #16037
OCPBUGS-69853: Updating openshift-enterprise-console-container image to be consistent with ART for 4.22 #15865
CONSOLE-4447: Migrate legacy PatternFly Modals to PatternFly v6 #16054
HELM-609: Fix upgrade failure for URL-installed charts #16049
CONSOLE-5068: Remove createModalLauncher from modal factory #16066
CONSOLE-4990: History object migration for #15961 / unit test fixes #16120
OCPBUGS-77867: Fix perspective switcher E2E test flake that causes 6-hour CI timeout #16114
HELM-609: Frontend for Installation of Helm Charts via URL #15961
NO-JIRA: Enforce no yarn.lock changes at build time #16107
OCPBUGS-77658: Azure Provisioning Fields are not mandatory #16092
CONSOLE-5049: Migrate DeleteResourceModal to useOverlay pattern #16022
CONSOLE-4827: make software catalog work with all projects #15804
OCPBUGS-77848: [CI] Fix the VolumeSnapshot CRUD flaky test failures #16110
CONSOLE-4447: Migrate modals to modern PatternFly Modal components #16015
OCPBUGS-77804: prep for 4.21 GA SDK publish #16109
CONSOLE-4990: Replace history object navigation with useNavigate hook #15959
CONSOLE-5030: Refactor remaining firehose impacted components #16039
CONSOLE-4945: Add Disk, Network, CPU and VM counts to node overview #16000
OCPBUGS-77415: Fix infinite recursion in project access form #16069
CONSOLE-5019: Consistently use FC and memo type param #16098
OCPBUGS-77423: Fix extra space in PageHeading when no actions present #16072
OCPBUGS-77044: Fix topology node labels disappearing when moving cursor to kebab menu #16042
NO-JIRA: Context improvements #16068
OCPBUGS-44612: Deprecate useUserSettings and expose useUserPreference #16057
CONSOLE-5100: Remove support for PatternFly 5 #16056
CONSOLE-5094: Delete Dockerfile.product.nodejs #16047
OCPBUGS-77016: fix type as K8sResourceKind assertion in createKnatifyPage #16044
CONSOLE-5063: Remove AppInitSDK #16019
OCPBUGS-76945: Add Azure Resource Group in OCP console for ODF STS installation #16030
OCPBUGS-76378: fix display of Lightspeed button #16012
OCPBUGS-77000, OCPBUGS-77013: OLM prompts for GCP Workload Identity parameters during Kiali Operato… #16051
NO-JIRA: /microcopy-review improvements #16026
CONSOLE-4991: Reenable all unit tests #16025
CONSOLE-5021: Enable consistent-type-imports #16031
HELM-598: Add new server endpoint for installing OCI charts without Helm repository #15863
CONSOLE-5011: migrate to yarn berry #15986
OCPBUGS-76554: Ban CJS imports of PF react-icons #16023
OCPBUGS-76283: Show modal when downloading pod logs #16014
NO-JIRA: New microcopy-review skill and context simplification #16009
CONSOLE-5055: AsyncComponent type improvements #16002
OCPBUGS-76553: i18n miss in CustomIconModal #16021
CONSOLE-5012: Create shared error modal launcher using React Context #15946
CONSOLE-4991, ODC-6264: Jest 30 followup #16010
CONSOLE-5064: Properly mock PluginStore in unit tests #16017
CONSOLE-5012: Migrate remaining modals to useOverlay pattern #15990
CONSOLE-4976: Add ClusterExtension creation form and unit tests #15955
CONSOLE-3769: Phase 2 of using OpenShift Dynamic Plugin SDK #15904
CONSOLE-4990: Migrate from history object to React Router v6/v7 hooks #15956
OCPBUGS-73871: i18n upload/download routine task - 4.21 / 281 (Latest) #15976
OCPBUGS-74974: Use Actions button instead of kebab menu on Subscription details page #15983
CONSOLE-5043: Remove defaultProps from operator-hub-item-details #16003
OCPBUGS-74538: User without access on causes NamespaceBar to reset to All projects when used via dynamic plugin #15996
CONSOLE-5044: TypeScript port of events.jsx #15944
CONSOLE-4987: Conditionally render Guided Tour based on capability and disable it for Console E2E tests #15926
OCPBUGS-74639: Number links for failed pods/nodes on ‘Cluster inventory’ card are not linked to filtered table list #15979
NO-JIRA: Convert useTechPreviewFlagProvider to static function #15960
CONSOLE-5015: Refactor file-input to use PF #15952
OCPBUGS-74137: DataView Pagination page menus : i18n misses #15982
OCPBUGS-74349: Worklodas - Edit pod count and Edit parallelism : Content is in English #15980
CONSOLE-5029: Refactor withDashboardResources in with-dashboard-resources.tsx into … #15927
CONSOLE-5012: Additional modal migrations to overlay pattern #15940
NO-JIRA: Add guidance for avoiding deprecated components #15969
OCPBUGS-74647: Fix referenceFor parameter in SubscriptionDetailsPage #15957
OCPBUGS-65967: Clean up old session cookies to prevent accumulation #15837
CONSOLE-5012: Migrate modals to overlay pattern #15939
OCPBUGS-65828: Reduce log noise from transient async cache failures #15821
OCPBUGS-70329: Auto-linkify URLs in status card alert messages #15880
CONSOLE-5039: Remove useSafetyFirst #15937
CONSOLE-4943: Add Machine Set, MachineConfigPool, and VMs columns to Nodes list view #15909
OCPBUGS-74241: Add null checks to CRB subject #15943
OCPBUGS-72585: Do not resolve disabled catalog type extensions #15908
CONSOLE-5012: Migrate delete modals and PVC modals to overlay pattern #15932
OCPBUGS-74369: Bump lodash to latest #15947
NO-JIRA: Suppress ResizeObserver-related windowError #15958
OCPBUGS-72260: ‘0 of pods’ are shown in Status column on DaemonSets list page. #15928
NO-JIRA: Suppress ResizeObserver-related e2e errors #15950
CONSOLE-5041: Replace testHook with renderHook from RTL #15936
NO-JIRA: SDK post-publish tasks #15942
OCPBUGS-74178: Direct AI agents to AGENTS.md documentation hub #15938
NO-JIRA: Moving the oc and kubectl delete,apply,create commands from deny to ask permissions #15941
NO-JIRA: Prepare for 4.22-prerelease.1 release #15933
CONSOLE-5050: Make shared modules peerDeps in SDK #15934
CONSOLE-3769: Refactor weird getResourceSidebarSamples #15915
CONSOLE-5042: Remove React.FCC #15929
OCPBUGS-70340: Ensure OpenAPI in monaco stays fresh #15890
CONSOLE-4402, CONSOLE-4510: React 18 upgrade - phase 1 #14869
NO-JIRA: Add /pre-push review command for comprehensive local code analysis #15800
OCPBUGS-65891: Follow up on fixing the remaining issues in the multi-group impersonation feature #15916
CONSOLE-4630: @types/react 18 prep work #15893
OCPBUGS-73766: Configure coderabbit.yaml for only major reviews and disable multiple summaries #15919
CONSOLE-5035: cache lazy route components to prevent navigation freeze #15924
CONSOLE-4865: Remove @openshift-console/plugin-shared #15921
NO-JIRA: Update dynamic demo plugin OWNERS and lock files #15920
NO-JIRA: Refactor - consolidate K8s client creation into new function #15897
OCPBUGS-70011: i18n upload/download routine task - 4.21 / 281 #15905
OCPBUGS-69377: Update the perspective name in dev-console guided tour #15852
OCPBUGS-69380: Fixed loaded page no roles error upon render #15878
OCPBUGS-72571: remove “OperatorHub” from OLM integration tests where … #15911
OCPBUGS-69387: update operator details when changing channels #15853
OCPBUGS-70344: change OperatorHub strings to Software Catalog #15891
CONSOLE-4844: merge secret scenarios #15684
CONSOLE-4912: update machine config tests #15759
OCPBUGS-63120: Home -> Overview page returns error during upgrade process #15831
OCPBUGS-62611: Fix editing secrets with mixed text and binary data #15820
OCPBUGS-65946: Fix search component to not pass ALL_NAMESPACES_KEY to… #15789
OCPBUGS-65831: Fix catalog service swapping description and markdownDescription fields #15750
OCPBUGS-68332: Improve VAC field on PVC details page #15843
OCPBUGS-70330: remove support for Windows 8 Live Tiles and IE “standards mode” #15886
OCPBUGS-70324: Revert the console-shared.json to console-shared directory #15885
CONSOLE-4989: bump to react-redux 8 #15854
CONSOLE-3769: Update OpenShift Dynamic Plugin SDK + webpack-related deps #15892
CONSOLE-4969: Configure a coderabbit.yaml file for console repo #15818
NO-JIRA: Fix incorrect syntax for claude settings #15899
CONSOLE-4971: Add AGENTS.md and structured AI documentation #15896
OCPBUGS-66247: make cloudCredentials optional so operators load when … #15803
CONSOLE-3769: Even more openshift/dynamic-plugin-sdk prep work #15778
OCPBUGS-63389: Remove asterisk from Routing label field in alertManager receiver form #15825
CONSOLE-4631, CONSOLE-5005: Manually rewrite remaining namespace/default imports #15884
CONSOLE-4631: Run react/update-react-imports #15872
OCPBUGS-68376: fix routing issues on packageserver PackageManifest de… #15844
CONSOLE-4916: add auto scenario about yaml sidebar #15790
OCPBUGS-65678, OCPBUGS-65765: apiVersion is empty on YAML creation page - Runtime error occurs when create MachineConfig with default yaml from… #15763
OCPBUGS-63159: Prevent the display of events from projects other than the currently selected project #15836
OCPBUGS-63237: There should be no role ARN field as token-auth-aws/azure/gcp=false in csv annotations #15813
OCPBUGS-60426: Fix edit application via Deploy image internal registry doesn’t select correct image stream #15795
NO-JIRA: Add /gen-rtl-tests Claude code slash command for generating React Testing Library tests for React components #15668
CONSOLE-4970: Upgrade Jest from 22 to 30 #15817
CONSOLE-4979: Speed up check-patternfly-modules + add dedupe step to CI #15835
OCPBUGS-67002: fix bug where Installed badge is not fully visible #15828
OCPBUGS-63390: show DASH to routing labels column when receiver doesn’t have routing labels #15824
CONSOLE-4630: Fix 67 react 18 type errors #15779
CONSOLE-4106: Add ClusterExtension creation page #15741
OCPBUGS-62713: Prevent application filter in Topology view from resetting to all applications unexpectedly #15812
NO-JIRA: disable guided tour when cypress is running #15841
And 64 elided commits (e.g. from squash or rebase merges)
Full changelog

console-operator

OCPBUGS-112264: Console Operator Fails to Recover from DEGRADED State After OIDC Configuration Removal #1213
OCPBUGS-109419: Bump documentationBaseURL to 5.0 #1207
OCPBUGS-77026: DNS optimization, add trailing dots #1112
OCPBUGS-95602: Add OpenShift Quickstart for JBoss EAP 8 #932
CNTRLPLANE-3423: Revert “TRT-2858: Revert “Merge pull request #1196 from ingvagabund/tls-injection-to-console”” #1205
OSDOCS-20110: Add Helm 3 CLI download links alongside Helm 4 #1197
OCPBUGS-99943: set API-server-defaulted fields on deployment specs to prevent excessive update events #1201
CONSOLE-5431: Add allow-all NetworkPolicy to openshift-console namespace #1199
TRT-2858: Revert “Merge pull request #1196 from ingvagabund/tls-injection-to-console” #1200
CONSOLE-5432: Add NetworkPolicy manifests for openshift-console-operator namespace #1198
CNTRLPLANE-3423: feat: inject centralized TLS into console operand #1196
NO-JIRA: Revert “Merge pull request #1170 from logonoff/http2” #1194
CONSOLE-5433: Add default-deny NetworkPolicy for openshift-console-user-settings namespace #1195
OCPBUGS-93982: gate Progressing on version transition and operand rollout status #1188
HELM-639: Update Helm download manifests for Helm 3 and Helm 4. #1175
CONSOLE-5122: Multi-domain console route, ConfigMap, and OAuth support #1184
OCPBUGS-67134: add grace period before reporting Available=False #1179
TRT-2780: Revert #1178 #1186
OCPBUGS-93982: skip generation check when deployment was just updated #1178
CONSOLE-5271: Set olmLifecycleEnabled based on OLMLifecycleAndCompatibility FeatureGate #1174
OCPBUGS-87517: Updating openshift-enterprise-console-operator-container image to be consistent with ART for 5.0 #1171
OCPBUGS-91663: Clean up old temp directories in downloads pod #1176
OCPBUGS-64688: use ObservedGeneration to determine Progressing status #1169
OCPBUGS-38676: Add retry for transient API errors to prevent Degraded blips #1164
CONSOLE-5298: Auto-generate throwaway TLS cert for HTTP/2 support #1170
NO-JIRA: feat: have CVO inject the centralized TLS configuration into the operator’s config #1167
OCPBUGS-74872: Sort plugin list to make them deterministic #1107
OCPBUGS-86117: Add unit and e2e test coverage for cert rotation redeployment #1160
OCPBUGS-85650: bump gRPC-Go package #1156
MON-4510: Migrate Prometheus targets discovering from Endpoints to EndpointSlices #1106
OCPBUGS-85060: feat: use 2 replicas for console on tnf #1151
CONSOLE-5204: Add PR template #1141
OCPBUGS-79068: Fix HelmChartRepository YAML format #1129
CONSOLE-5138: Enable readOnlyRootFilesystem for console and download pod #1123
OCPBUGS-78477: Bump API to support ExternalOIDCWithUpstreamParity new API fields #1125
OCPBUGS-63502: Redeploy console pods upon cert rotation #1093
OCPBUGS-65622: add controller for downloads service account deletion logic #1111
Sync Dockerfile.ocp image #1127
NO-JIRA: Add linked repository for cross-repo CodeRabbit reviews #1120
OCPBUGS-74506: Remove ConsolePluginSecurityPolicy featuregate #1108
OCPBUGS-77741: Updating openshift-enterprise-console-operator-container image to be consistent with ART for 4.22 #1121
OCPBUGS-65622: add service account to downloads deployment #1087
OCPBUGS-62307: Remove orphaned console-conversion-webhook deployment and related resource #1053
OCPBUGS-57468: Add rhel8 and rhel9 oc binaries for Linux OS in CLI downloads #1102
OCPBUGS-72387: Update the downloads manifest #1101
OCPBUGS-72387: Fix PDB blocking node drains during cluster upgrades #1099
CONSOLE-4986: Vendor API changes for GuidedTourFeature capability #1091
NETOBSERV-2296: add missing annotations on netobserv quickstart #1080
OCPBUGS-65496: Add missing relatedObjects + small refactoring #1075
NO-JIRA: Fix claude syntax #1088
OCPBUGS-68367: Add missing console annotation to the quickstart #1082
OCPBUGS-70045: Updating openshift-enterprise-console-operator-container image to be consistent with ART for 4.22 #1086
CONSOLE-4871: Add AI context documentation files #1077
CM-821, ESO-277, SSCSI-235: Add quickstart guides for secrets management operators #1073
And 3 elided commits (e.g. from squash or rebase merges)
Full changelog

container-networking-plugins, containernetworking-plugins-microshift

OCPBUGS-114407: Remove rhel8 build stage #247
OCPBUGS-85826: rebase to pick up dependency updates #237
Full changelog

coredns

NE-2744: UPSTREAM: 8227: fix(tls): use Go TLS defaults #194
OCPBUGS-87352: Updating coredns-container image to be consistent with ART for 5.0 #189
NO-JIRA: Add aswinsuryan (asuryana@redhat.com) to OWNERS #188
OCPBUGS-83943: Bump gRPC to v1.79.3 to resolve CVE-2026-33186 #183
OCPBUGS-77600: Updating coredns-container image to be consistent with ART for 4.22 #170
OCPBUGS-69852: Updating coredns-container image to be consistent with ART for 4.22 #159
NO-JIRA: Add team members to the OWNERS file #162
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-96822: Bump golang.org/x/net to v0.55.0 #405
UPSTREAM-SYNC: Sync main with latest upstream (release-1.36) #393
UPSTREAM-SYNC: Sync main with latest upstream (release-1.35) #370
OCPBUGS-77578: Updating ose-openstack-cinder-csi-driver-container image to be consistent with ART for 4.22 #374
OCPBUGS-77755: Updating ose-openstack-cloud-controller-manager-container image to be consistent with ART for 4.22 #376
OCPBUGS-77592: Updating csi-driver-manila-container image to be consistent with ART for 4.22 #375
NO-JIRA: Update DOWNSTREAM_OWNERS #373
OCPBUGS-69813: Updating csi-driver-manila-container image to be consistent with ART for 4.22 #369
OCPBUGS-70057: Updating ose-openstack-cloud-controller-manager-container image to be consistent with ART for 4.22 #360
OCPBUGS-70072: Updating ose-openstack-cinder-csi-driver-container image to be consistent with ART for 4.22 #358
Full changelog

csi-driver-nfs

OCPBUGS-97795: Bump golang.org/x/crypto to v0.53.0 #197
OCPBUGS-87515: Updating csi-driver-nfs-container image to be consistent with ART for 5.0 #196
NO-JIRA: CVE-2026-35469: Bump github.com/moby/spdystream@v0.5.1 #189
UPSTREAM-SYNC: Merge https://github.com/kubernetes-csi/csi-driver-nfs:master into main #179
UPSTREAM-SYNC: Merge https://github.com/kubernetes-csi/csi-driver-nfs:master into main #175
UPSTREAM-SYNC: Merge https://github.com/kubernetes-csi/csi-driver-nfs:master into main #170
OCPBUGS-77740: Updating csi-driver-nfs-container image to be consistent with ART for 4.22 #169
NO-JIRA: Merge https://github.com/kubernetes-csi/csi-driver-nfs:master into main #167
OCPBUGS-70043: Updating csi-driver-nfs-container image to be consistent with ART for 4.22 #168
Full changelog

csi-external-attacher

STOR-2931: Rebase to upstream v4.12.0 for OCP 5.0 #110
OCPBUGS-87274: Updating csi-attacher-container image to be consistent with ART for 5.0 #109
OCPBUGS-77562, STOR-2758: Rebase to upstream v4.11.0 for OCP 4.22 #94
OCPBUGS-69744: Updating csi-attacher-container image to be consistent with ART for 4.22 #91
Full changelog

csi-external-provisioner

STOR-2931: Rebase to upstream v6.3.0 for OCP 5.0 #146
NO-ISSUE: Bump github.com/moby/spdystream to v0.5.1 #138
OCPBUGS-87526: Updating csi-provisioner-container image to be consistent with ART for 5.0 #137
NO-JIRA: OCPBUGS-82033: Bump google.golang.org/grpc to 1.79.3 #124
STOR-2758: Rebase to upstream v6.2.0 for OCP 4.22 #121
OCPBUGS-77752: Updating csi-provisioner-container image to be consistent with ART for 4.22 #120
OCPBUGS-70054: Updating csi-provisioner-container image to be consistent with ART for 4.22 #118
Full changelog

csi-external-resizer

STOR-2931: Rebase to upstream v2.2.1 for OCP 5.0 #198
OCPBUGS-87511: Updating ose-csi-external-resizer-container image to be consistent with ART for 5.0 #197
STOR-2758: Rebase to upstream v2.1.0 for OCP 4.22 #183
OCPBUGS-77735: Updating ose-csi-external-resizer-container image to be consistent with ART for 4.22 #182
OCPBUGS-70039: Updating ose-csi-external-resizer-container image to be consistent with ART for 4.22 #180
Full changelog

csi-external-snapshot-metadata

OCPBUGS-104319: Bump golang.org/x/net to v0.53.0 and Go to 1.25.10 #23
STOR-2965: Rebase to v1.0.0 for OCP 5.0 #18
OCPBUGS-87248: Updating csi-external-snapshot-metadata-container image to be consistent with ART for 5.0 #17
OCPBUGS-77411: Updating csi-external-snapshot-metadata-container image to be consistent with ART for 4.22 #10
OCPBUGS-69720: Updating csi-external-snapshot-metadata-container image to be consistent with ART for 4.22 #8
Full changelog

csi-external-snapshotter, csi-snapshot-controller

OCPBUGS-99009: [external-snapshotter] SnapshotContentObjectDeleteError event fired when VolumeSnapshotContent is already deleted #226
STOR-3004: Rebase external-snapshotter to v8.6.0 #224
TRT-2702: Revert “STOR-3004: Rebase external-snapshotter to v8.6.0” #220
STOR-3004: Rebase external-snapshotter to v8.6.0 #219
OCPBUGS-87250: Updating ose-csi-external-snapshotter-container image to be consistent with ART for 5.0 #217
OCPBUGS-87466: Updating ose-csi-snapshot-controller-container image to be consistent with ART for 5.0 #218
NO-JIRA: Bump google.golang.org/grpc to v1.79.3 #215
OCPBUGS-77492: UPSTREAM: 1392: Fix VolumeSnapshotContent deletion #207
STOR-2758: Rebase to upstream v8.5.0 for OCP 4.22 #202
OCPBUGS-77687: Updating ose-csi-snapshot-controller-container image to be consistent with ART for 4.22 #201
OCPBUGS-69935: UPSTREAM: <drop>: restore log level of the group snapshot reconciler #200
OCPBUGS-77413: Updating ose-csi-external-snapshotter-container image to be consistent with ART for 4.22 #199
OCPBUGS-66967: UPSTREAM: 1354: UPSTREAM: 1359: Fix for cases where the resource is already present on the cluster #193
OCPBUGS-69979: Updating ose-csi-snapshot-controller-container image to be consistent with ART for 4.22 #195
OCPBUGS-66967: UPSTREAM: <drop>: bump log level of the group snapshot reconciler #192
OCPBUGS-69721: Updating ose-csi-external-snapshotter-container image to be consistent with ART for 4.22 #194
Full changelog

csi-livenessprobe

OCPBUGS-107993: Bump go.opentelemetry.io/otel to v1.44.0 to address CVE-2026-41178 #95
STOR-2931: Rebase to upstream v2.19.0 for OCP 5.0 #94
OCPBUGS-87448: Updating csi-livenessprobe-container image to be consistent with ART for 5.0 #93
OCPBUGS-77672, STOR-2758: Rebase to upstream v2.18.0 for OCP 4.22 #81
OCPBUGS-69958: Updating csi-livenessprobe-container image to be consistent with ART for 4.22 #78
Full changelog

csi-node-driver-registrar

STOR-2931: Rebase to upstream v2.17.0 for OCP 5.0 #108
NO-ISSUE: Bump github.com/moby/spdystream to v0.5.1 #107
OCPBUGS-87513: Updating csi-node-driver-registrar-container image to be consistent with ART for 5.0 #106
OCPBUGS-77738, STOR-2758: Rebase to upstream v2.16.0 for OCP 4.22 #95
OCPBUGS-70041: Updating csi-node-driver-registrar-container image to be consistent with ART for 4.22 #92
Full changelog

docker-builder

OCPBUGS-95492, OCPBUGS-98108: Bump golang.org/x/crypto to fix CVE-2025-22869,CVE-2025-47913,CVE-2026-46597,CVE-2026-39829,CVE-2026-39832 #550
OCPBUGS-87365: Updating openshift-enterprise-builder-container image to be consistent with ART for 5.0 #539
OCPBUGS-77610: Updating openshift-enterprise-builder-container image to be consistent with ART for 4.22 #503
OKD-322: Update Dockerfile to work on CentOS/RHEL 10 #500
OCPBUGS-70150: bump buildah to 1.39.7 to fix CVE-2025-52881 #494
OCPBUGS-69871: Updating openshift-enterprise-builder-container image to be consistent with ART for 4.22 #493
Full changelog

docker-registry

CORS-4520: GCP: Support Alternate Universe Domain #474
OCPBUGS-96818: bump golang.com/x/crypto #473
OCPBUGS-84680: pin cloud.google.com/go/storage to v1.30.1 to fix blob deletion #469
CNTRLPLANE-3073: bump kubernetes to v1.35 #467
IR-350: bump library-go to the latest version #460
IR-350: fix cipher suite configuration conflict with docker distribution #459
OCPBUGS-69762: Updating openshift-enterprise-registry-container image to be consistent with ART for 4.22 #457
Full changelog

driver-toolkit

OCPBUGS-82502: Fix e2e test duplicate output from oc run -i –rm #198
MGMT-24788: Fix pod deletion message contaminating RHCOS kernel version string #197
OCPBUGS-69851: Fix e2e test failure caused by TTY carriage returns in oc run output #196
OCPBUGS-69851: Updating Dockerfile.rhel10 base image from base-rhel9 to base-rhel10. #195
OCPBUGS-69851: Adding driver-toolkit-10 as a new payload component for RHEL 10. #193
OCPBUGS-69851: Parameterizing the e2e test to validate both DTK and DTK-10. #194
OCPBUGS-69851: Updating the e2e job to also work on Openshift-5 payloads. #192
OCPBUGS-87225: Updating driver-toolkit-container image to be consistent with ART for 5.0 #191
OCPBUGS-69851: Adding support for payload multiple-stream. #180
OCPBUGS-77868: Clean up cruft in /var/cache/dnf #182
NO-ISSUE: Add autoconf, automake and libtool packages #181
NO-ISSUE: Support ubi minimal base image #179
OCPBUGS-69699: Updating driver-toolkit-container image to be consistent with ART for 4.22 #178
Full changelog

egress-router-cni

OCPBUGS-83863: Update Dockerfiles #113
NO-JIRA: Remove dead code, drastically shrink vendored deps #110
NO-JIRA: Update OWNERS file #104
OCPBUGS-87977: bump containernetworking/cni to v1.3.0 #102
OCPBUGS-83286: Fix swallowed errors in cmdAdd/cmdDel causing empty CNI result #95
NO-JIRA: Update OWNERs file #96
Full changelog

etcd

DOWNSTREAM: carry: OCPBUGS-103516: Replace bbolt with patched fork to remove MADV_RANDOM #395
CNTRLPLANE-3461: refactor defrag to minimize database lock time #378
OCPBUGS-94014: Rebase v3.6.13 on main (5.0/4.23) #392
OCPBUGS-87363: Updating ose-etcd-container image to be consistent with ART for 5.0 #384
OCPBUGS-85258: 5.0 rebase 3.6.11 #375
OCPBUGS-82495: 5.0/4.23 rebase 3.6.10 #368
OCPBUGS-74168: Remove unused ART dockerfiles #356
OCPBUGS-69868: Updating ose-etcd-container image to be consistent with ART for 4.22 #353
Full changelog

gcp-cloud-controller-manager

CORS-4516: Support setting universe domain in client options #131
OCPCLOUD-3592: Merge https://github.com/kubernetes/cloud-provider-gcp:master (b01dfd6) into main #104
OCPBUGS-84569: Fix node.kubernetes.io/exclude-from-external-load-balancers on masters #121
OCPBUGS-87279: Updating ose-gcp-cloud-controller-manager-container image to be consistent with ART for 5.0 #120
OCPBUGS-85551, OCPBUGS-85552: Upgrade spdystream and grpc to fix CVEs #115
NO-JIRA: Remove custom vendor scripts in favour of standard tooling #111
NO-JIRA: Update OWNERS #105
OCPBUGS-78471: Fix OSD ILB bug #103
OCPCLOUD-3274: Merge https://github.com/kubernetes/cloud-provider-gcp:master (378730f) into main #99
OCPBUGS-77570: Updating ose-gcp-cloud-controller-manager-container image to be consistent with ART for 4.22 #98
Full changelog

gcp-cluster-api-controllers

OCPCLOUD-3601: Merge https://github.com/kubernetes-sigs/cluster-api-provider-gcp:v1.13.0 (be0534e) into main #300
🐛 OCPBUGS-85337: set imagePullPolicy IfNotPresent on provider workloads #299
OCPBUGS-87462: Updating ose-gcp-cluster-api-controllers-container image to be consistent with ART for 5.0 #298
OCPBUGS-53005: Remove references to master branch #297
UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-gcp:v1.12.0 (b9b055d) into master #295
OCPBUGS-85101: Merge https://github.com/kubernetes-sigs/cluster-api-provider-gcp:v1.11.2 (14609a0) into master #273
NO-JIRA: manifests-gen: scope provider webhooks to capi namespace #292
OCPCLOUD-3359: Add TLS substitutions #284
NO-JIRA: Update manifests generator #285
OCPBUGS-77684: Updating ose-gcp-cluster-api-controllers-container image to be consistent with ART for 4.22 #272
NO-JIRA: Update OWNERS #280
NO-JIRA: Remove dead RELEASE_DIR ref #263
NO-JIRA: Remove old manifest-gen assets #264
OCPCLOUD-3325: Update to new manifests-gen #258
OCPBUGS-74913: Merge https://github.com/kubernetes-sigs/cluster-api-provider-gcp:v1.11.0 (1cb204d) into master #261
NO-JIRA: UPSTREAM: <carry>: Add manifests verify target #259
Updating ose-gcp-cluster-api-controllers-container image to be consistent with ART for 4.22 #257
Full changelog

gcp-machine-controllers

OCPCLOUD-3617: Update to Kubernetes 1.36 dependencies #182
CORS-4521: Support Alternate Universe Domain #180
OCPBUGS-91738: golang.org/x/net bumped from v0.51.0 to v0.55.0 #172
OCPBUGS-87524: Updating ose-machine-api-provider-gcp-container image to be consistent with ART for 5.0 #170
NO-JIRA: Update OWNERS #157
OCPBUGS-81576: Bump gRPC-Go package for CVE fix #155
OCPCLOUD-3279: Rebase to Kube 1.35 for Machine API Provider GCP #145
OCPNODE-4168: Empty disk should be ignored for gcp additional disk #141
OCPBUGS-77746: Updating ose-machine-api-provider-gcp-container image to be consistent with ART for 4.22 #144
CORS-4296: Add the N4A machine type #138
OCPBUGS-70052: Updating ose-machine-api-provider-gcp-container image to be consistent with ART for 4.22 #137
OCPCLOUD-3255: Add AGENTS configuration #136
Full changelog

gcp-pd-csi-driver

STOR-3064: Add Universe Domain Support (for Google Cloud Dedicated) #126
STOR-2915: Update go.opentelemetry.io/otel and otel/sdk to v1.43.0 #125
STOR-2915: Rebase to upstream v1.26.0 for OCP 5.0 #124
OCPBUGS-87399: Updating ose-gcp-pd-csi-driver-container image to be consistent with ART for 5.0 #123
UPSTREAM: 2297: OCPBUGS-83423: Bump google.golang.org/grpc to v1.79.3 #121
STOR-2751: Rebase to upstream v1.24.1 for OCP 4.22 #98
OCPBUGS-77632: Updating ose-gcp-pd-csi-driver-container image to be consistent with ART for 4.22 #100
OCPBUGS-77602: Support Downward API node name override #99
OCPBUGS-74521: UPSTREAM: 2175: Move VAC storage API to v1 from v1beta1 #97
OCPBUGS-69930: Updating ose-gcp-pd-csi-driver-container image to be consistent with ART for 4.22 #87
Full changelog

gcp-pd-csi-driver-operator

OCPBUGS-114002: GCP-1074: feat(gcp-pd): enable HyperShift support for GCP PD CSI driver operator #607
OCPBUGS-111893: Add proxy hook for HyperShift CSI driver controller deployments #599
OCPBUGS-100071: csi-driver-smb: DeleteVolume call fails to mkdir under /tmp #593
STOR-2998: Remove legacy gcp-pd-csi-driver-operator #592
STOR-3060, STOR-3061: implement TLS adherence for AWS EFS and SMB CSI driver operator #587
STOR-2998: Copy the test manifests from the legacy dir to a top-level test dir #589
STOR-2997: Auto generate assets for gcp pd csi driver #585
OCPBUGS-99199: Add networking.k8s.io group policy #579
STOR-2914: Bump all deps for 5.0.0 #582
OCPBUGS-99200: Add networking.k8s.io group policy #581
OCPBUGS-99490: Apply some static assets earlier, before starting controllers #584
STOR-2997: Minimal implementation of GCP PD CSI driver operator #576
STOR-3030: feat(operator): detect GCP Dedicated and use hyperdisk-balanced StorageClass #573
STOR-2996: Sync gcp pd csi driver operator to legacy subdir (2) #575
STOR-2996: Run unit-tests in /legacy subdir #574
OCPBUGS-85106: Add required-scc annotation to EFS and SMB operator deployments #569
OCPBUGS-90151: hack/update-metadata.sh: allow MAX_OCP_VERSION override #571
STOR-2996: Sync gcp pd csi driver operator to legacy subdir #570
OCPBUGS-87449: Updating ose-openstack-cinder-csi-driver-operator-container image to be consistent with ART for 5.0 #566
STOR-2920: Bump OLM metadata to 5.0 #568
STOR-2996: Add gcp pd csi driver operator to legacy subdir #562
OCPBUGS-87270: Updating csi-driver-manila-operator-container image to be consistent with ART for 5.0 #563
OCPBUGS-87236: Updating ose-smb-csi-driver-operator-container image to be consistent with ART for 5.0 #561
OCPBUGS-87387: Updating ose-azure-file-csi-driver-operator-container image to be consistent with ART for 5.0 #565
OCPBUGS-87368: Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART for 5.0 #564
OCPBUGS-87470: Updating ose-azure-disk-csi-driver-operator-container image to be consistent with ART for 5.0 #567
OCPBUGS-87219: Updating ose-aws-efs-csi-driver-operator-container image to be consistent with ART for 5.0 #560
OCPBUGS-42363: Re-enable Azure Disk load test #558
OCPBUGS-86023: Add memory limits to SMB CSI sidecar containers #557
OCPBUGS-85457: Add init container for Manila node daemonset #552
OCPBUGS-84052: Mount writable /tmp in SMB CSI driver #545
OSASINFRA-3675: Rework authentication in Manila CSI Driver Operator #373
OCPBUGS-80930: Add VolumeAttributesClass e2e test manifests for Azure disk #538
OCPBUGS-78291: Allow azure-disk sidecars to read VolumeAttributeClasses #525
STOR-2762: Bump all deps for 4.22 #526
OCPBUGS-77674: Updating ose-openstack-cinder-csi-driver-operator-container image to be consistent with ART for 4.22 #516
OCPBUGS-77553: Updating csi-driver-manila-operator-container image to be consistent with ART for 4.22 #513
OCPBUGS-77612: Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART for 4.22 #514
STOR-2884: Add service to generate a TLS cert for EFS operator #522
STOR-2884: Add service to generate a TLS cert for SMB operator #520
NO-JIRA: Inherit any OpenShift global CodeRabbit setting #519
OCPBUGS-77623: Updating ose-azure-file-csi-driver-operator-container image to be consistent with ART for 4.22 #515
OCPBUGS-77571: Add only to tags to volume object, if volume is not already tagged #518
OCPBUGS-77497: Fix readonly root fs in Azure init containers #512
NO-JIRA: Add coderabbit, including instructions #509
STOR-2752: Early chore: update OCP version in OLM metadata #505
Updating ose-azure-disk-csi-driver-operator-container image to be consistent with ART for 4.22 #517
OCPBUGS-77378: Updating ose-aws-efs-csi-driver-operator-container image to be consistent with ART for 4.22 #510
OCPBUGS-77405: Updating ose-smb-csi-driver-operator-container image to be consistent with ART for 4.22 #511
OCPBUGS-76298: missing readOnlyRootFilesystem in AWS init containers #506
OCPBUGS-74971: Fix azure-disk secret namespace/name args #502
OCPBUGS-74521: Remove VolumeAttributesClass FeatureGate #503
STOR-2523: hypershift: Add desired-version annotation to controller Deployments and use DeploymentVersionController in csi driver operators #457
OCPBUGS-70304: Fix azure-file secret namespace/name #500
OCPBUGS-66113: Some containers do not have readOnlyRootFilesystem #476
OCPBUGS-70085: Updating ose-openstack-cinder-csi-driver-operator-container image to be consistent with ART for 4.22 #483
OCPBUGS-70339: deploy prometheus role and binding on hypershift guest #488
OCPBUGS-63698: fix(azure): add token-minter for self-managed hosted clusters #461
OCPBUGS-69739: Updating csi-driver-manila-operator-container image to be consistent with ART for 4.22 #480
OCPBUGS-69907: Updating ose-azure-file-csi-driver-operator-container image to be consistent with ART for 4.22 #482
OCPBUGS-69710: Updating ose-smb-csi-driver-operator-container image to be consistent with ART for 4.22 #479
NO-JIRA: Add /sniff-test claude command #486
OCPBUGS-69883: Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART for 4.22 #481
OCPBUGS-69982: Updating ose-azure-disk-csi-driver-operator-container image to be consistent with ART for 4.22 #484
OCPBUGS-69695: Updating ose-aws-efs-csi-driver-operator-container image to be consistent with ART for 4.22 #478
STOR-2543: add VAC manifest for tests in AWS EBS #475
STOR-1945: STOR-2056: Add SupportedSizeRange for azurefile-nfs #477
NO-JIRA: Migrate away from deprecated ioutil #474
CNTRLPLANE-1285: enable readOnlyRootFilesystem #419
OCPBUGS-65858: allow all-egress for efs operator #472
STOR-2538: Migrate aws sdk to v2 #442
No-JIRA: Update owners #471
STOR-2627: Enable nodeAllocatableUpdatePeriodSeconds in AWS EBS #435
OCPBUGS-65606: adds the csi-external-resizer to the image-references #469
STOR-2592: Bump all deps for 4.21 and remove hypershift client #468
STOR-2523: Add hypershift managed-by labels for csi driver operators #446
OCPBUGS-62802: Add RBAC ClusterRole and Binding for driver node #443
NO-JIRA: add ai-helpers claude marketplace #451
NO-JIRA: Normalize generation of driver metrics RBAC proxy sidecar #380
OCPBUGS-61436, OCPBUGS-61450, STOR-2600: Bump OLM metadata to 4.21 #430
OCPBUGS-62404: Updating ose-openstack-cinder-csi-driver-operator-container image to be consistent with ART for 4.21 #438
STOR-1945: STOR-2056: add Azure File NFS test manifest #445
OCPBUGS-62374: Updating ose-azure-file-csi-driver-operator-container image to be consistent with ART for 4.21 #437
MULTIARCH-5554: update smb-csi-driver-operator support to add ppc64le #428
OCPBUGS-62427: Updating ose-azure-disk-csi-driver-operator-container image to be consistent with ART for 4.21 #439
OCPBUGS-62348: Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART for 4.21 #436
OCPBUGS-61955: Add withCABundleDaemonSetHook() to AWS EFS operator #433
OCPBUGS-60637: add runAsUser hook for operator deployment controller #431
NO-JIRA: Centralize injection of hosted-kubeconfig volume #311
NO-JIRA: Updating ose-smb-csi-driver-operator-container image to be consistent with ART for 4.21 #429
OCPBUGS-54385: Avoid informer resync #432
NO-JIRA: Updating ose-smb-csi-driver-operator-container image to be consistent with ART for 4.21 #427
NO-JIRA: Updating ose-aws-efs-csi-driver-operator-container image to be consistent with ART for 4.21 #425
NO-JIRA: azure-disk, azure-file sync code de-duplication #303
STOR-2477: Correct efs single-zone storageclass #404
OCPBUGS-60655: Disable LUN stress test for azure-file #418
OCPBUGS-60464: Bump library-go to fix panic #417
STOR-2394: Bump all deps for 4.20 #408
STOR-2479: Add CredentialsRequest for the EFS node DaemonSet #389
STOR-2330: Add labels to subscribe openstack cinder and manila CSI driver controllers to NPs #409
OCPBUGS-57395: Remove stale conditions #406
OCPBUGS-58254: Bump library-go #405
STOR-2331: Add labels to subscribe SMB CSI driver operator and controller to NPs #400
STOR-2330: Add labels to subscribe Azure disk and file CSI driver controllers to NPs #396
OCPBUGS-57768: Updating ose-azure-disk-csi-driver-operator-container image to be consistent with ART for 4.20 #399
OCPBUGS-57739: Updating ose-openstack-cinder-csi-driver-operator-container image to be consistent with ART for 4.20 #398
OCPBUGS-57700: Updating ose-azure-file-csi-driver-operator-container image to be consistent with ART for 4.20 #397
OCPBUGS-57565: Updating csi-driver-manila-operator-container image to be consistent with ART for 4.20 #394
STOR-2331: Add labels to subscribe AWS-EFS CSI driver operator to NPs #391
OCPBUGS-57680: Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART for 4.20 #395
STOR-2477: create-efs-volume: add single-zone support #390
OCPBUGS-57545: Updating ose-smb-csi-driver-operator-container image to be consistent with ART for 4.20 #393
Updating ose-aws-efs-csi-driver-operator-container image to be consistent with ART for 4.20 #392
STOR-2330: Add labels to subscribe AWS-EBS CSI driver controller to NPs #387
NO-JIRA: create-efs-volume: print files to log as a fallback #388
NO-JIRA: Update openstack approvers #385
OCPBUGS-54975: Fix Cinder, Manila driver metrics #379
OCPBUGS-56128: openstack-cinder: Set –with-topology flag for node driver also #383
STOR-2408: Bump OLM metadata to 4.20 #382
OCPBUGS-50493: Use 127.0.0.1 for healtz http-endpoints #364
NO-JIRA: build only needed cmd in container image #329
OCPBUGS-54382: Correct ASH driver inject env config #376
OSASINFRA-3652: openstack-cinder: Use new –with-topology flag #345
STOR-2126: Enable readOnlyFileSystem #370
OCPBUGS-54447: Enable required driver services #369
OCPBUGS-54180: Disable remove-not-ready-taint for azure disk csi driver #371
OCPBUGS-54230: Bump library-go #372
STOR-1877: Run operators without root user control #368
STOR-1880: Role and ClusterRole with too wide permissions #367
OCPBUGS-41827: update injector to use a secret rather than an environment variable #357
NO-JIRA: Fixed typo in README.md #348
STOR-2252: Bump all deps #361
NO-JIRA: NO-JIRA: Remove bertinatto from OWNERS #363
CFE-1132: EFS Access Point Tags Update DAY2 #313
CFE-1131: AWS Tags DAY2 Update #297
STOR-2263: correct smb csi driver test manifest #360
NO-JIRA: Remove inject-proxy annotations for aws-ebs, aws-efs node daemonsets #308
OCPBUGS-48507: openstack-manila: update PodDisruptionBudget name #353
STOR-2078: Enable VolumeAttributesClass on AWS EBS for resizer + provisioner #314
NO-JIRA: Update golang.org/x/net to v0.34.0 #352
OCPBUGS-45073: Support HCP labels #332
STOR-2260: Bump OLM metadata to 4.19 #351
OCPBUGS-45591: Updating ose-openstack-cinder-csi-driver-operator-container image to be consistent with ART for 4.19 #342
OCPBUGS-44723: remove EFS driver metrics #330
OCPBUGS-45374: Updating ose-smb-csi-driver-operator-container image to be consistent with ART for 4.19 #337
OCPBUGS-45622: Updating ose-azure-disk-csi-driver-operator-container image to be consistent with ART for 4.19 #343
Updating ose-azure-file-csi-driver-operator-container image to be consistent with ART for 4.19 #341
OCPBUGS-45508: Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART for 4.19 #340
OCPBUGS-45395: Updating csi-driver-manila-operator-container image to be consistent with ART for 4.19 #339
OCPBUGS-45352: Updating ose-aws-efs-csi-driver-operator-container image to be consistent with ART for 4.19 #336
OCPBUGS-45267: openstack-manila: modify assets selectors #335
OCPBUGS-43357: support hcp tolerations #326
OSASINFRA-3626: Resize support with the OpenStack Manila CSI Driver #322
STOR-2017: Bump library-go and API #325
AUTH-482: set required-scc for openshift workloads #306
NO-JIRA: ignore cmd/generator/main.go in .snyk #295
OSASINFRA-3535: openstack-cinder: Watch management cluster for cloud-provider config #321
OCPBUGS-44340: Fix error handling for starter controller #318
OSASINFRA-3638: Add support for Hypershift to Manila CSI #312
OSASINFRA-3535: Add support for Hypershift to Cinder CSI #302
NO-JIRA: Add openstack-approvers to root OWNERS #315
OSASINFRA-3621: Remove legacy csi-driver-manila-operator #317
OSASINFRA-3618: Add Cinder CSI support (part 3) #298
OSASINFRA-3654: Include OpenStack test manifest to test/e2e #316
OSASINFRA-3620: Add manila csi #288
NO-JIRA: Add OWNERS files for OpenStack-specific components/assets #299
HOSTEDCP-2032: Set azure disk & file Secrets Store CSI Volume #309
STOR-1844: remove config/samba/manifests/preview symlink #305
OCPBUGS-42325: Set separate secrets for file and disk config on HyperShift #290
OCPBUGS-43562: Add missing proxy hook for openstack-cinder driver #304
OCPBUGS-43653: Add missing credentials secret hook #307
OSASINFRA-3628: Make guest namespace configurable #294
STOR-1844: update OLM manifests to use stable channel #300
OSASINFRA-3618: Add Cinder CSI support (part 2) #275
OCPBUGS-42939: Correct aws efs csi driver config as removable #293
OCPBUGS-38922: add tag matching to Azure File storage class #272
OCPBUGS-41365: add ability to control kube rbac proxy container image… #289
NO-JIRA: Add SidecarConfig.WithPatches #285
NO-JIRA: Remove generated assets before generation #287
NO-JIRA: List all supported operators in README #277
OSASINFRA-3611: Add legacy csi-driver-manila-operator #280
NO-JIRA: Move doc on migrating CSI Driver in-tree #279
OCPBUGS-41265: Disable LUN stress test for azure-disk #282
OSASINFRA-3609: Update legacy/openstack-cinder-csi-driver-operator #281
OSASINFRA-3609: Add Cinder CSI support (part 1) #278
STOR-1422: Bump(openshift/api): to get EFS volume metrics GA #273
OCPBUGS-40526: Updating ose-azure-file-csi-driver-operator-container image to be consistent with ART for 4.18 #270
OCPBUGS-41149: Updating ose-azure-disk-csi-driver-operator-container image to be consistent with ART for 4.18 #271
OCPBUGS-39591: Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART for 4.18 #269
OCPBUGS-39445: Updating ose-smb-csi-driver-operator-container image to be consistent with ART for 4.18 #268
Updating ose-aws-efs-csi-driver-operator-container image to be consistent with ART for 4.18 #267
OCPBUGS-38578: Update aws-efs-csi-driver-operator image-references name #264
STOR-1819: Distribute OCP specific test manifest with create-efs-volume #260
OCPBUGS-38620: Some CSI driver containers missing terminationMessagePolicy #262
STOR-2009: Bump OLM metadata to 4.18 #259
OCPBUGS-38578: efs: fix tools image reference #261
STOR-1993: add init container in EFS CSI controller pod #252
STOR-1819: Add manifest with OCP specific test config #258
STOR-1422: Volume Metrics for EFS CSI Driver #255
STOR-1819: Add manifest with OCP specific test config #254
NO-JIRA: use service account namespace placeholder for smb role bindings #250
STOR-2002: add Azure File snapshot support #253
OCPBUGS-37488: add init container in EBS CSI controller pod #248
STOR-1856: add STS hook for EFS credentials request controller #251
STOR-1874: Use real HyperShift API #236
OCPBUGS-37274: Add FIPS_ENABLED to env vars for aws-efs-csi-driver (2) #249
STOR-1856: remove aws efs operator legacy dir #244
STOR-1596: Bump all deps for 4.17 #240
STOR-1856: STOR-1606: migrate legacy AWS EFS operator code to csi-operator #237
OCPBUGS-36936: Updating ose-smb-csi-driver-operator-container image to be consistent with ART for 4.17 #241
OCPBUGS-36948: Updating ose-azure-disk-csi-driver-operator-container image to be consistent with ART for 4.17 #243
OCPBUGS-36942: Updating ose-azure-file-csi-driver-operator-container image to be consistent with ART for 4.17 #242
STOR-1606: Bump OLM metadata to 4.17 #239
OCPBUGS-34451: Bump go version to be consistent with ART #238
STOR-1290: don’t pass credentials via environment variables in AWS EBS #202
STOR-1856: migrate AWS EFS operator to csi-operator #232
NO-JIRA: keep smb test storageclass consistent with official doc #234
OCPBUGS-34667: Ensure Node Metric Service is created in the openshift-cluster-csi-drivers namespace for both OpenShift and Hypershift #233
OCPBUGS-34189: Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART for 4.17 #227
OCPBUGS-32370: Configure scraping of node metrics #223
OCPBUGS-33776: Adjust port for registrar sidecar in aws-ebs csi driver container #225
OCPBUGS-32785: add token audience for Azure File #224
STOR-1726: auto-generate assets for CIFS/Samba driver #217
OCPBUGS-28230: Add terminationMessagePolicy to all containers #216
STOR-1726: Delete static resources when ClusterCSIDriver is removed #215
AUTH-482: set required-scc for openshift workloads #170
NO-JIRA: Remove unused assests for azure-file #213
OCPBUGS-31044: Add cluster-wide proxy in the azure-file driver node container #207
OCPBUGS-31306: Azure Disk: Add cluster-wide proxy in the driver container in the node #206
OCPBUGS-28230: enforce termination message policy on all platform pods #214
STOR-1726: Add OLM metadata for SMB operator #210
STOR-1726: Add test manifest for SMB CSI driver #212
STOR-1818: enable pvcDataSource capability for tests #204
STOR-1726: Simple rename of objects in assets/overlays/samba/generated/standalone/ #211
STOR-1726: Add Dockerfile for Samba operator #209
Bump github.com/prometheus/client_model from 0.5.0 to 0.6.0 #168
STOR-1726: Minimal implementation of CIFS/Samba CSI driver operator #205
Bump google.golang.org/grpc from 1.61.0 to 1.62.1 #190
Bump github.com/go-openapi/swag from 0.22.9 to 0.23.0 #198
Bump github.com/emicklei/go-restful/v3 from 3.11.2 to 3.12.0 #203
Bump github.com/felixge/fgprof from 0.9.3 to 0.9.4 #185
STOR-1794: add location for azcopy logs #200
OCPBUGS-23260: Explicitly reserve 1 attachment for the root disk #199
Bump go.uber.org/zap from 1.26.0 to 1.27.0 #173
Bump the opentelemetry-dependencies group with 8 updates #177
Bump the golang-dependencies group with 6 updates #191
OCPBUGS-30620: remove legacy directory and duplicate Dockerfile.*.test files #196
OCPBUGS-30469: CVE-2024-24786: bump google.golang.org/protobuf to v1.33.0 #197
NO-JIRA: Configure dependabot for security updates only #174
OCPBUGS-30620: move test manifests to top-level directory #194
STOR-1464: Enable RWOP tests in CI #187
STOR-1762: Add azure file hypershift #163
Bump the k8s-dependencies group with 6 updates #172
STOR-1726: Bump openshift/api dependency #169
STOR-1750: Build image from legacy folder #162
Bump the opentelemetry-dependencies group with 8 updates #161
STOR-1574: Bump all deps #156
OCPBUGS-26924: Add healthcheck for node-driver-registrar container #155
Bump github.com/grpc-ecosystem/grpc-gateway/v2 from 2.19.0 to 2.19.1 #149
STOR-1750: Add legacy azure file driver #154
Bump go.etcd.io/etcd/client/v3 from 3.5.11 to 3.5.12 #150
Bump github.com/evanphx/json-patch from 5.8.1+incompatible to 5.9.0+incompatible #148
Bump github.com/go-openapi/swag from 0.22.8 to 0.22.9 #147
Bump github.com/google/uuid from 1.5.0 to 1.6.0 #144
Bump google.golang.org/grpc from 1.60.1 to 1.61.0 #145
Bump the k8s-dependencies group with 3 updates #146
STOR-1574: Bump library-go #137
Bump github.com/go-openapi/swag from 0.22.7 to 0.22.8 #142
Bump github.com/pkg/profile from 1.3.0 to 1.7.0 #138
Bump github.com/emicklei/go-restful/v3 from 3.11.0 to 3.11.2 #141
Bump go.uber.org/zap from 1.24.0 to 1.26.0 #139
Bump github.com/go-openapi/jsonreference from 0.20.2 to 0.20.4 #140
Bump github.com/go-openapi/swag from 0.22.4 to 0.22.7 #136
Bump github.com/prometheus/common from 0.45.0 to 0.46.0 #135
Bump the opentelemetry-dependencies group with 4 updates #134
Bump github.com/go-openapi/jsonpointer from 0.19.6 to 0.20.2 #128
Bump github.com/evanphx/json-patch from 5.6.0+incompatible to 5.8.1+incompatible #125
Bump the k8s-dependencies group with 5 updates #133
Bump go.etcd.io/etcd/client/v3 from 3.5.9 to 3.5.11 #124
STOR-1722: Add support hypershift for azure-disk #73
Bump github.com/go-logr/logr from 1.3.0 to 1.4.1 #129
OCPBUGS-27267: Updating ose-azure-disk-csi-driver-operator-container image to be consistent with ART for 4.16 #132
Bump the opentelemetry-dependencies group with 2 updates #122
Bump github.com/sirupsen/logrus from 1.9.0 to 1.9.3 #123
Bump go.etcd.io/etcd/client/pkg/v3 from 3.5.9 to 3.5.11 #119
Bump github.com/fsnotify/fsnotify from 1.6.0 to 1.7.0 #120
NO-JIRA: Bump github.com/go-errors/errors from 1.4.2 to 1.5.1 #106
NO-JIRA: Bump google.golang.org/grpc from 1.59.0 to 1.60.1 #104
NO-JIRA: Bump github.com/spf13/cobra from 1.7.0 to 1.8.0 #103
NO-JIRA: Bump github.com/google/uuid from 1.3.1 to 1.5.0 #101
OCPBUGS-27056: Update to RHEL9 and go 1.21 #117
NO-JIRA: Bump the golang-dependencies group with 5 updates #109
NO-JIRA: Bump github.com/prometheus/client_golang from 1.17.0 to 1.18.0 #108
STOR-1714: AWS EBS operator: Release leadership on SIGTERM #94
NO-JIRA: Bump google.golang.org/protobuf from 1.31.0 to 1.32.0 #107
NO-JIRA: Add valid-reference label to dependabot PRs #116
OCPBUGS-27050: Updating ose-azure-disk-csi-driver-operator-container image to be consistent with ART for 4.16 #114
STOR-1713: Don’t ignore azure-disk-csi-driver-operator #110
NO-JIRA: Add dependabot configuration #97
STOR-1696: Add legacy azure disk #88
OCPBUGS-24245: Add selinux #89
OCPBUGS-25125: Add test AssetOrderer #86
OCPBUGS-25557: Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART #87
OCPBUGS-25125: Create RBAC objects first #84
OCPBUGS-24226: setting TLSSecurityProfile with no minTLSVersion crashes controller #76
NO-JIRA: Add “Quick start” section to README.md #80
STOR-1688: Chore: add .snyk file to ignore false positives #85
OCPBUGS-25147: Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART #81
OCPBUGS-23827: CVE-2023-47108: bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp to v0.46 #77
OCPBUGS-23306: Add annotation to CSI driver Pod preventing eviction from the cluster-autoscaler #79
OCPBUGS-24905: Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART #78
STOR-1500: Switch to the new operator #69
Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART #75
STOR-1402, STOR-1453: update libraries and specify TLS_MIN_VERSION #71
STOR-1400: Add support for Batch DescribeVolume #74
STOR-1400: Sync sidecar arguments with upstream #72
STOR-1500: Add log for the new operator #70
Pull the latest AWS EBS operator #67
Fix vendoring of golang.org/x/net #68
hack: remove existing path from .gitignore #65
Drop Guest prefix from client names #64
Update all generated assets in a single run #63
Verify generated assets in make verify #62
Move operator config into pkg/drivers #61
Add AWS EBS CSI driver operator starter #58
OCPBUGS-21593: CVE-2023-44487: bump golang.org/x/net to v0.17.0 #59
STOR-1455: Add asset generator #53
Delegate to aws-ebs-csi-driver-operator for tests and verify #57
Add aws ebs operator legacy #56
Add ci-operator config #54
Clean the repository, it will be reused for all CSI driver operators #52
Obsolete the operator #51
Fix hostpath image sample to support dynamic registration #47
Add kubelet-registration-path flag to csi-driver-registrar #44
Fix golint error #45
Output error message when failed to get CSIDriverDeployment and requeued #46
Add -nometadata to go-bindata to stop updating generated files by every build #43
Disable automatic installation of the operator in OpenShift #41
Pass SecurityContext to sidecar containers #40
Move EBS deployment sample to the right place #39
Use correct context timeouts #38
Add EBS sample deployment file #37
Add leader election to the operator #36
Embed git version into the operator binary #35
Generate bindata during build #34
Add more unit tests #33
Add controller unit tests #32
Fix deletion of non-namespaced objects #31
Fix e2e test #30
Add e2e test #29
Update to operator-sdk 0.1.1 #28
Fix liveness probe version #27
ADd a RHEL7 dockerfile and standardize format #26
Documentation update #23
Add unit test for validation #14
Fix status.conditions json name #11
Add CRD printer columns #12
Add configuration of liveness probe. #9
Increase resync period #10
Add /var/lib/kubelet HostPath directory to node drivers #8
Fix role bindings #7
Add liveness probe. #6
Fix operator images #5
Add OpenShift manifests to operator image #4
Use label selector for informers. #3
Use constants where appropriate #2
Add initial operator #1
And 27 elided commits (e.g. from squash or rebase merges)
Full changelog

gcp-workload-identity-federation-webhook

OCPCLOUD-3585: Update gcp-workload-identity-federation-webhook to k8s 1.36 #21
OCPBUGS-87344: Updating gcp-workload-identity-federation-webhook-container image to be consistent with ART for 5.0 #19
NO-ISSUE: Update OWNERS: remove 2uasimojo, suhanime, lleshchi #20
CCO-786: update to pick up tls-cipher-suites and tls-min-version #16
CCO-730: Revendor upstream changes #14
OCPBUGS-69839: Updating gcp-workload-identity-federation-webhook-container image to be consistent with ART for 4.22 #13
Full changelog

haproxy-router

OCPBUGS-77056: Make external cert validation asynchronous (v3 — fix re-admission after secret deletion) #828
NE-2826: Fix staticcheck warnings across multiple packages #815
“NO-JIRA: Add AGENTS.md” #710
NE-2829: images/router/f5: Delete F5 router Dockerfile #826
OCPBUGS-77056: Revert #825 “Make external cert validation asynchronous (v2 — race condition fixes)” #829
OCPBUGS-77056: Make external cert validation asynchronous (v2 — race condition fixes) #825
NO-JIRA: Add default coderabbit for the repo #798
TRT-2841: Revert “OCPBUGS-77056: Make external cert validation asynchronous (Resurrection)” #824
OCPBUGS-77056: Make external cert validation asynchronous (Resurrection) #822
NE-2220: Update HAProxy RPM in the router container to 3.2.19 #792
NE-2741: Implement TLS Curves Support for Metrics Endpoints #811
TRT-2813: Revert “Make external cert validation asynchronous” #817
NE-2766: Bump Kubernetes to 1.36.2 and Go to 1.26 #814
OCPBUGS-77056: Make external cert validation asynchronous #745
OCPBUGS-87204: Prevent SSRF via FQDN-typed EndpointSlices #812
NE-2218: Add HAProxy standalone images for 2.8 and 3.2 #780
OCPBUGS-87552: Updating openshift-enterprise-haproxy-router-container image to be consistent with ART for 5.0 #791
NE-2664: add option to separate router and haproxy containers #772
OCPBUGS-87508: Updating ose-haproxy-router-base-container image to be consistent with ART for 5.0 #790
OCPBUGS-87205: Strip X-SSL-Client-* headers for plain HTTP #787
OCPBUGS-87208: Adding escapeHAProxySingleQuotes for sanitize #785
NE-2572: use add/del haproxy api calls #763
OCPBUGS-86168: Bump google.golang.org/grpc to v1.79.3 #777
Reapply “OCPBUGS-55506: Prevent startup failures due to name resolution” #677
OCPBUGS-77263: create self-signed crt if failing to read default #740
OCPBUGS-62267: fix forwarded header for IPv6 on IPv4 stack #713
OCPBUGS-49738: fix handling of host conflict #736
NE-2332: Add support for TLS curves in HAProxy configuration #755
TRT-2597: Revert “NE-2333: Add support for configurable SSL curves in HAProxy configuration” #754
NE-2333: Add support for configurable SSL curves in HAProxy configuration #678
OCPBUGS-77773: fix backend server health check if DCM is enabled #747
OCPBUGS-62238: configure TLS profile for metrics endpoint #748
NO-JIRA: Do not install weak dependencies such as logrotate #687
NE-2418: Add haproxy_max_connections metric #728
OCPBUGS-75009: sort list of map entries on DCM #738
OCPBUGS-75010: Change how DCM identifies state changes #725
OCPBUGS-67161: Replace HTTP backend liveness check with admin socket check #737
OCPBUGS-77412: reload router if route is changed on DCM #739
NO-JIRA: hack: steps to run router locally #712
NE-2468: Migrate away from deprecated ioutil #693
OCPBUGS-74511: remove RouteExternalCertificate feature gate #730
NE-2483: bump k8s libraries to v0.35.0 #729
OCPBUGS-72591: Lower verbosity for parseIPList empty list logging #709
NO-JIRA: hack: update image without push #711
NO-JIRA: add jcmoraisjr to owners #717
OCPBUGS-70068: Updating openshift-enterprise-haproxy-router-container image to be consistent with ART for 4.22 #707
OCPBUGS-65482: Fix HAProxy redirect: strip port from Host header #696
Full changelog

hyperkube, kube-proxy, pod

OCPBUGS-108014: UPSTREAM: <carry>: bump otel to v1.44.0 to fix CVE-2026-41178 #2762
NO-JIRA: Make graceful-termination-duration flag required for the watch-termination command #2763
OCPBUGS-100170: Rebase master to v1.36.3 #2746
OCPBUGS-64847: kubelet: don’t use non-admitted pods in calculation #2667
OCPBUGS-85262: Re-enable kubectl kuberc commands e2e tests #2731
OCPBUGS-92798: Add NodeSelectorAdjuster admission plugin for standalone clusters (part 2) #2717
STOR-2961: UPSTREAM: 138768: move VolumeGroupSnapshot to V1 #2723
CNTRLPLANE-3323: Update openshift-hack/rebase.sh #2701
OCPBUGS-98100: e2e: storage snapshot tests should read custom timeouts from manifest #2719
OCPBUGS-92836: UPSTREAM: <carry>: upkeep cpu partitioning admission webhook #2713
STOR-2963: Save SELinuxWarningController upgradeability to a ConfigMap #2720
OCPBUGS-90520: UPSTREAM: 140211: Promote regression-issue-74839 to 1.5 #2709
OCPBUGS-99058: Disable DRA extended resource test that requires dedicated DRA infrastructure #2721
OCPSTRAT-3036: Rebase 1.36.2 #2653
OCPBUGS-84961: UPSTREAM: <carry>: fix kubernetes/conformance to filter on [Conformance] label #2694
AUTOSCALE-812: Add NodeSelectorAdjuster admission plugin for standalone clusters #2695
OCPBUGS-84961: add kubernetes/conformance umbrella suite #2682
OCPBUGS-85410: Fix performance related issues when selinux metrics are emitted #2668
OCPBUGS-86229: apiserver: cache etcd storage monitors to avoid recreating clients on each metrics scrape #2674
OCPBUGS-74511: remove RouteExternalCertificate feature gate #2585
OCPBUGS-77243: test: skip private registry test #2621
OCPBUGS-78044: Improve WatchList test robustness #2622
CNTRLPLANE-2553: Update the KAS admission plugin for fields to be compilable at admission time #2627
OCPBUGS-83502: devicemanager: constrain topology hints to device NUMA nodes #2645
OCPBUGS-78576: Update the csi-driver-host-path version to 1.17.1 #2641
OCPBUGS-81740: UPSTREAM: 138259: Filter out unschedulable nodes in kubectl describe test #2640
OCPBUGS-78990: Bump 1.35.3 to master #2633
OCPBUGS-78986: UPSTREAM: 137926: KEP-961: demote maxUnavailable feature in statefulset to off by default #2632
NO-JIRA: UPSTREAM: <carry>: Register OpenShift cloud providers in k8s-tests-ext #2635
OCPBUGS-78504: unflake HPAConfigurableTolerance test #2631
UPSTREAM: <carry>: OCPBUGS-39360: Fix ClusterIsIPv6() detection for dual-stack v6-primary clusters #2603
NO-JIRA: UPSTREAM: <carry>: Add jacobsee and jubittajohn to DOWNSTREAM_OWNERS #2630
OCPBUGS-77866: Bump 1.35.2 to master #2612
OCPBUGS-73813: UPSTREAM: <carry>: un-skip MutableCSINodeAllocatableCount tests #2613
OCPSTRAT-2728: Rebase to 1.35 #2523
OCPBUGS-66338: UPSTREAM: 135629: selinux: Fix the controller to ignore finished pods #2538
OCPBUGS-67200: UPSTREAM: 136202: raise kubelet CSI init backoff to cover ~140s DNS delays #2578
OKD-259: Validate OKD featureset to prevent it from being enabled on OCP clusters #2420
OCPBUGS-73913: UPSTREAM: 135340: cbor: bump limits #2564
OCPBUGS-70170: add label serial for iperf2 testing #2559
OCPBUGS-63045: enable InPlace resize test #2532
NO-ISSUE: Extend k8s suite timeouts for parallel testing load #2497
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

hypershift

OCPBUGS-123146: Updating ose-hypershift-container image to be consistent with ART for 5.0 #9597
OCPBUGS-117010: preserve immutable AWS load balancer annotations #9489
OCPBUGS-114435: fix(konnectivity): enable –sync-forever to restore lost agent-server tunnels #9430
OCPBUGS-113998: fix(azure): skip KMS validation for private Key Vaults on ARO HCP #9405
OCPBUGS-115188, OCPBUGS-121650: backport safe-to-evict annotation and operator health probes fixes #9534
OCPBUGS-98883, OCPBUGS-98887: bump haproxy to 3.0.5-6.el10_2.2 for CVE fix #9336
OCPBUGS-111891: Add proxy env vars to cluster-storage-operator deployment #9332
ACM-41685: Enable PQC crypto policy in hypershift-cli image #9462
CNTRLPLANE-4025: feat(azure): support managed HSM for KMS encryption #9376
CNTRLPLANE-3871: promote OSStreams feature gate to Default #9372
OCPBUGS-112497: Remove MutatingAdmissionPolicy runtime-config from KAS #9368
OCPBUGS-111055: Use the correct v1 mcfg api for OSImageStream during ignition #9319
OCPBUGS-108268: Rebase container images from 9.7 to 9.8 to fix gnutls CVEs #9307
CNTRLPLANE-4097: Add clebs to core-approvers #9316
OCPBUGS-109581: Add CVO and CNO to podCrashTolerations #9302
OCPBUGS-99898: Add unit test for aggregateMachineMessages truncation logic #9128
OCPBUGS-98460: Harden leader election failure detection in EnsureNoCrashingPods #9129
CNTRLPLANE-3772: promote ExternalOIDCWithUpstreamParity to Default #8952
NO-JIRA: Update Konflux Tekton task bundle digests #9300
CNTRLPLANE-3202: add restore, OADP, and limitations docs for self-managed Azure DR #9160
CNTRLPLANE-4038: feat(supportedversion): bump latest supported OCP version to 5.1 #9288
OCPBUGS-105865: fix(nodepool): include only TLSSecurityProfile in config hash instead of full APIServer #9287
AUTOSCALE-871: add deployment path for standalone karpenter-operator #9245
GCP-986: chore: add acwalczyk to gcp-reviewers alias #9222
NO-JIRA: Disable repo_gpgcheck for Microsoft repo in Dockerfile.e2e #9290
CNTRLPLANE-3863: improve v2 test isolation #9229
NO-JIRA: feat(ci): split CI report into ARO HCP, KubeVirt, and Azure Self-Managed categories #9282
OCPBUGS-101766: enable TLSAdherence feature gate part on TechPreviewNoUpgrade #9213
OCPBUGS-96908: remove redhat-marketplace catalog from HyperShift #8958
OCPBUGS-105555: Update ubi-minimal base image to fix glib2 CVEs (CVE-2025-14087, CVE-2025-14512) #9276
OCPBUGS-98065: Prevent infraID and clusterID removal via parent-level CEL rules #9102
OCPBUGS-105849: Remove docs/compare tooling to fix Snyk security scan #9285
CNTRLPLANE-3945: fix(docs): set writable uv cache path for arc-runner-set #9281
CNTRLPLANE-3945: Migrate documentation tooling from mkdocs-material to zensical #9139
NO-JIRA: fix: separate gci-only pre-commit hooks from full lint-fix targets #9272
CNTRLPLANE-3625: Add aws-pod-identity-webhook e2e tls cases #8953
OCPBUGS-105602: fix broken relative reference #9277
OCPBUGS-105597: fix(ci): update GHA runner base image to unblock CI #9275
OCPCLOUD-3261: feat(cloud providers): inject centralized TLS configuration #8864
CNTRLPLANE-3959: wire apiserver config through ignition server #9136
NO-JIRA: isolate NewSession tests from ambient AWS env vars #8911
CNTRLPLANE-3984: document all skills and commands in SKILLS.md #9210
OCPBUGS-105193: extract HCCO webhook validation into a dedicated controller #9239
CNTRLPLANE-3997: add manual trigger and fix path filter for docs publish #9261
CNTRLPLANE-3997: correct wrangler pages deploy flags for docs publish #9252
OCPBUGS-60093: fix(upsert): add desired-state hash to detect spec field removals #7713
CNTRLPLANE-3997: add workflow to publish docs to Cloudflare Pages on merge #9221
CNTRLPLANE-3291: docs: add upstream documentation for configurable log levels #9193
CNTRLPLANE-3978: Fix CPO finalizer race leaving orphaned Azure Private Endpoint resources #9194
CNTRLPLANE-3873, CNTRLPLANE-3874, OCPBUGS-94518: update azure CPO overrides for 4.20, 4.21, 4.22 #9211
CNTRLPLANE-3375: test(e2e): remove oc dependency in external oidc e2e tests #9208
OCPBUGS-104543: fix test isolation bug in EnsureDefaultSecurityGroupTagsTest #9228
NO-JIRA: build(deps): bump the github-dependencies group with 23 updates #9190
OCPBUGS-104505: fix(ci): trigger envtest workflows on dependency changes #9215
CNTRLPLANE-3673: add HO Konflux release gating documentation #8947
OCPBUGS-100279: load plugin explicitly in bare mode for skill resolution #9220
OCPBUGS-104528: Update openshift API to resolve broken hypershift integration tests on K8s 1.30 #9231
OCPBUGS-105207: Revert “OCPBUGS-89689: (karpenter) use completed release image for unpinned NodeClaims during CP upgrade” #9233
NO-JIRA: fix(build): bump hack/tools Go version to 1.26.0 to match main module #9223
CNTRLPLANE-3871: e2e: Remove osImageStream cleanup that violates immutability #9206
OCPBUGS-100054: Fix Azure Private clusters without external DNS #9171
GCP-896: chore: add gbarabasz to gcp-reviewers alias #9000
CNTRLPLANE-3979: Add missing ProjectDevelopmentStream 4.14 #9225
CNTRLPLANE-3863: emit lifecycle-aware JUnit for informing e2e tests #9168
NO-JIRA: add e2e-approvers owner alias, grant Dan Mace e2e role #9216
NO-JIRA: build(deps): bump the k8s-dependencies group across 1 directory with 12 updates #9189
OCPBUGS-100184: Wait for Azure ignition DNS before creating workers #9172
OCPBUGS-100279: isolate Claude from push credentials in PR workflows #9214
OCPBUGS-98983: improve guest cluster state management reliability #9198
STOR-2918: update AWS EBS CSI credentials request policy to mirror upstream #8954
OCPBUGS-100301: fix(hostedcluster): handle Unknown status in ClusterVersionFailing inversion #9186
OCPBUGS-89689: (karpenter) use completed release image for unpinned NodeClaims during CP upgrade #8957
NO-JIRA: build(deps): bump the misc-dependencies group across 1 directory with 6 updates #9164
CNTRLPLANE-3863: add e2e v2 test flow document #9151
docs: add July 2026 progress report blog post #9057
OCPBUGS-100302: fix(metrics): only report limited support when label … #9185
NO-JIRA: build(deps): bump github.com/google/cel-go from 0.28.1 to 0.29.0 #9125
CNTRLPLANE-3943: feat(destroy): add –force flag to strip finalizers on grace period expiry #9134
STOR-2954: inject centralized TLS configuration for storage operators #8887
Revert “CNTRLPLANE-3890: Add product-cli unit tests for HCP create cluster” #9201
CNTRLPLANE-3871: resolve RHEL stream dynamically for boot images #9099
NO-JIRA: build(deps): bump the sigs-k8s-dependencies group across 1 directory with 8 updates #9177
CNTRLPLANE-3890: Add product-cli unit tests for HCP create cluster #9107
CNTRLPLANE-3646: wire up AWS v2 e2e lifecycle test coverage #9174
OCPBUGS-100140: bracket IPv6 in OAuth issuer and callback URLs #9120
AUTOSCALE-644: bump karpenter deps to 1.13.0 #9170
CNTRLPLANE-3976: Document management cluster vs hosted cluster feature gates #9182
OCPBUGS-97804: Avoid printing errors twice #8931
CNTRLPLANE-3887: test(e2e): add metricsSet filtering coverage to metrics forwarder test #9078
OCPBUGS-86843: fix(konnectivity): conditionally prefer IPv4 based on HCP network config #9140
OCPBUGS-91511: Fix CPO infinite requeue during deletion when OIDC provider is gone #8894
OCPBUGS-98654: delete_hosted_cluster.sh fails to run with no –dns-zone-rg-name flag #8945
NO-JIRA: docs: fix ARCHITECTURE.md to reflect current CPO image resolution #9179
OCPBUGS-100087: Replace exponential backoff with fixed-interval requeue in CRR controller #9148
OCPBUGS-99783: fix(e2e): check pre-upgrade HO version for shared role support #8891
CNTRLPLANE-3709: test(azure): enable Global Pull Secret test in Azure CI #9073
CNTRLPLANE-3956: Make EnsureGlobalPullSecret e2e test informing #9167
CNTRLPLANE-2539: Move generation of the CAPI Provider Role #8305
NO-JIRA: docs: add hash migration impact guidance and CPO data-plane component docs #9161
CNTRLPLANE-3897: Add product-cli unit tests for create nodepool #9121
CNTRLPLANE-3600: Bump k8s to v0.36.2, controller-runtime to v0.24.1, CAPI to v1.12.8 #8695
CNTRLPLANE-3944: Regenerate requirements.txt files with pinned –hash entries #9135
AUTOSCALE-166: fix yq dependency for running upstream karpenter tests #9060
OCPBUGS-99288: Add proxy env vars to AWS cloud-controller-manager deployment #9053
CNTRLPLANE-3604: Add CAPI migration flag placeholder #9145
CNTRLPLANE-3564: test(awsprivatelink): add unit test for NoSuchHostedZone handling dur… #9141
NO-JIRA: build(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.1 #9113
NO-JIRA: build(deps): bump google.golang.org/grpc from 1.79.3 to 1.82.1 in /hack/tools #9111
CNTRLPLANE-3888: docs: add on-demand jira-agent triggering and plugin install instructions #9079
OCPBUGS-54776: fix(ignition-server): log MCS output on HTTP request failures #8936
CNTRLPLANE-400: feat(remediationAllowed in NP): propagate MHC RemediationAllowed to NodePool Ready condition #9019
NO-JIRA: align control-plane Dockerfile builder image with main Dockerfile #9138
OCPBUGS-99768: fix OSImageStream e2e test and Makefile test-changed for OCP 5.0 #9115
CNTRLPLANE-3893: Add product-cli unit tests for destroy cluster #9116
NO-JIRA: ci(deps): bump actions/checkout from 6.0.2 to 7.0.1 #9090
NO-JIRA: ci(deps): bump actions/setup-python from 6.2.0 to 7.0.0 #9089
NO-JIRA: ci(deps): bump actions/setup-go from 6.4.0 to 7.0.0 #9029
OCPBUGS-86494: fix(nodepool): preserve KubeVirt userdata Secrets during NodePool rollout #8581
CNTRLPLANE-3910: Fix e2e test reliability for mirroring tests and test-changed target #9086
CNTRLPLANE-3919: data race in TestEnqueueNodePoolsForCloudConfig #9095
NO-JIRA: chore(konflux): update Tekton task bundles to latest versions #9081
NE-2815: feat: configure HAProxy version selection #9040
CNTRLPLANE-3791: fix: revert api-lint –whole-files to avoid surfacing pre-existing violations #9071
OCPBUGS-99014: Authenticate Konnectivity agents with cluster CA #9031
CNTRLPLANE-3032: test: add e2e v2 tests for NodePool OSImageStream #9033
OCPBUGS-98744: compare post-upgrade RHCOS version against pre-upgrade instead of release metadata #9014
OCPBUGS-98462: add jitter to AWS endpoint service requeue delay #8996
OCPBUGS-98465: prevent DS crash in pull secret verifier and add propagation diagnostics #8991
OCPBUGS-99289: Exclude aggregated docs page from search index #9043
CNTRLPLANE-3199: add etcd backup infrastructure and docs for self-managed Azure #8785
CNTRLPLANE-3862: fix(ci): reintroduce verify-ci make target for GHA verify workflow #9045
CNTRLPLANE-3859: Restructure pre-commit push hooks for faster local feedback #9042
CNTRLPLANE-3434: add ho-release-gate pipeline for nightly promotion #8602
NO-JIRA: fix(cpo): regenerate stale ModernTLS test fixtures #9041
CNTRLPLANE-647: Expose v4/v6InternalSubnet OVN-Kubernetes configuration in HostedCluster API #8249
ARO-27360: Add ACR pull identity configured metric #8840
ARO-24037: gate cloud config on hash to prevent serving stale content #8946
CNTRLPLANE-3615: add tls security profile configuration for the etcd #8871
OCPBUGS-88312: use in-cluster service for oauth-server #8772
CNTRLPLANE-3791: make pre-commit hooks resilient to mock generation failures #9016
NO-JIRA: update Tekton task bundles to latest versions #9038
OCPBUGS-98384: fix bastion cleanup KeyPair leak by capturing infraID/region eagerly #8982
CNTRLPLANE-3674: Add Jira Agent onboarding guide #8814
CNTRLPLANE-3825: move test conventions to TESTING.md #9036
OCPSTRAT-3150: Add etcd sharding by resource kind support #8705
OCPBUGS-98695: add Azure CPO overrides for 4.22 #9010
NO-JIRA: ci(deps): bump actions/setup-node from 6.4.0 to 7.0.0 #9030
CNTRLPLANE-3763: tag bastion resources with e2e provenance #9022
OCPBUGS-98575: feat: inject hosted cluster TLS security profile into packageserver #9001
AUTOSCALE-870: add KarpenterOperator tech-preview FeatureGate #8976
CNTRLPLANE-3774: fix: control-plane-operator: improve opaque conditions #8804
CNTRLPLANE-3695: refactor(hcco): extract machine-config-daemon pod name format to constant #8988
CNTRLPLANE-3820: add cleanleaked tool for AWS leaked resource cleanup #8964
SPLAT-2743: aws/ccm - remove inline iam policy patch #8835
NO-JIRA: Add validateOnUpdateTableInput to envtest and fix test specs #9015
OCPBUGS-98461: requeue CRR on transiently unavailable resources #8997
OCPBUGS-98718: retry CreateVpcEndpoint on AWS throttle errors #9012
CNTRLPLANE-3030: feat(nodepool,ignition-server): consume os-stream and add ValidOSImageStream condition #8792
OCPBUGS-88738: clean up orphaned mirrored ConfigMaps on NodePool deletion #8890
OCPBUGS-97830: Add wait-for-etcd init container to oauth-apiserver #8940
fix(ci): make race detection opt-out for pre-push hook #9003
CNTRLPLANE-3763: tag CLI and e2e AWS resources with infra-id, cluster-name, and source #8909
OCPBUGS-93462: Fix stale resourceVersion in HCCO patchHCPStatusCondition #8902
OCPBUGS-98466: retry Prometheus query exec on transient konnectivity 502 #8995
OCPBUGS-98464: handle stale DaemonSet in GlobalPullSecret test #8990
SPLAT-2741: Add SetSecurityGroups perms for AWS CCM for BYO SG on AWS NLB #8401
OCPBUGS-98571: Skip Azure topology LB scope override for ARO HCP IngressController #8992
CNTRLPLANE-3553: Wire usesRunc detection into RHEL stream resolution #8832
OCPBUGS-88531: Remove CPO-side restart logic for CNO operands #8751
CNTRLPLANE-3831: skip UpstreamParity OIDC tests on releases before 4.23 #8987
OCPBUGS-98086: fix(cpo,hcco): prevent premature KAS convergence during KMS key rotation #8970
OCPBUGS-78310: fix(cli): initialize controller-runtime logger in product-cli #8955
OCPBUGS-63720: orphan machines when managed identity is invalid on clus… #8296
OCPBUGS-98387: Add retry logic to fix Azure self-managed e2e presubmit failures #8983
OCPBUGS-93785: fix(cpo): initialize nil resource requests map before applying overrides #8924
OCPBUGS-91650: disable consolidation in karpenter upgrade test #8874
CNTRLPLANE-3553: Wire osImageStream into NodePool controller (hash, token, status, validation) #8730
NO-JIRA: chore: Resolve git SHA for PULL_BASE_SHA in makefile #8980
OCPBUGS-95615: fix(kubevirt): use only first MachineInternalIP per family in EndpointSlice endpoints #8892
CNTRLPLANE-3824: Fix verify-crd-schema in git worktrees #8975
GCP-859: scope PSC NAT subnet discovery to the management cluster VPC #8927
CNTRLPLANE-3761: replace git clean with find for mock cleanup #8973
NO-JIRA: chore: update core-reviewers membership #8967
OTA-1764: feat(cvo): add TLS cipher suites and minimum version flags #8013
AROSLSRE-1158: add –install-scope flag to hypershift install #8725
NO-JIRA: chore(deps): weekly dependabot consolidation #8849
CNTRLPLANE-3616: setting min-tls-version for the konnectivity-server container #8866
CNTRLPLANE-3766: add chai-bot CI daily health report instructions #8918
NO-JIRA: Remove address-review-comments GHA workflow #8943
CNTRLPLANE-3698: fix(install): replace context.TODO() with proper ctx parameter #8932
CNTRLPLANE-3771: fix /rebase GHA workflow for fork PRs #8934
NO-JIRA: chore: update github actions runner image to go 1.26.4 #8888
AROSLSRE-830: Add etcd EndpointSlice self-registration to fix DNS resolution delays #8613
OCPBUGS-92086: GetVnetID is empty when running setup_all.sh in Managed AKS #8830
OCPBUGS-84269: fix(nodepool): skip CNI-internal IPs in ClusterNetworkCIDRConflict check #8230
CNTRLPLANE-3619: add azure CPO overrides for 4.22.0-4.22.3 #8908
CNTRLPLANE-3696: Remove stale TODO about ImagePullPolicy in DNS operator #8923
NO-JIRA: Fall back to AWS SDK default credential chain when no explicit credentials provided #8889
CNTRLPLANE-3697: Expand unit test coverage for KAS config params #8922
CNTRLPLANE-3306: add ExternalOIDCWithUpstreamParity e2e tests #8287
CNTRLPLANE-3624: e2e v2 test for control-plane-pki-operator TLS configuration #8793
OCPBUGS-94238: Add missing CLI IAM role policy entry #8883
NO-JIRA: Add missing verify targets to GitHub Actions workflow #8870
NO-JIRA: fix(e2e-v2): gate ConfigOperatorReconciliationSucceeded on 4.23+ #8875
CNTRLPLANE-3532: Add shared status patching helpers with optimistic locking #8782
OCPBUGS-94178: Remove –skip-crd-migration-phases flags from CAPI deployment #8881
NO-JIRA: add Konflux CI scripts reference and document validate-pr-override-images #8852
CNTRLPLANE-3529: Add operator IAM role creation command and install role ARN flags #8636
CNTRLPLANE-3737: Add find-push-pipelinerun script #8851
GCP-841: remove ClusterResourceSet feature gate from CAPG manager args #8795
GCP-866: chore(owners): add floresroger to gcp-reviewers #8863
CNTRLPLANE-3733: add –blog flag to /pr-report skill #8848
CNTRLPLANE-3577: test(nodepool): add NodeDrainTimeout propagation tests #8737
CNTRLPLANE-3576: add RestartDateAnnotation propagation tests #8733
CNTRLPLANE-3565: test and fix destroy grace period lifecycle #8789
OTA-1956: Skip ConsolePlugin manifests during CVO bootstrap #8839
OCPBUGS-92791: fix(configrefs): exclude componentRoutes secrets from management cluster sync #8838
CNTRLPLANE-3624: add tls security profile configuration for the control-plane-pki-operator #8768
CNTRLPLANE-3686: feat(api,cpo): add observedGeneration to ControlPlaneComponentStatus #8819
OCPBUGS-86025: Close HTTP response bodies to prevent goroutine and connection leaks #8560
OCPBUGS-92206: bump catalog image version cap from 4.21 to 4.22 #8836
OCPBUGS-86648: move IP addresses from dnsNames to ips in etcd peer cert #8847
NO-JIRA: docs: add required pod-security annotation for GCP hosted clusters #8850
CNTRLPLANE-3716: Update GitHub Actions docs with slash-command workflows #8822
OSDOCS-19432: docs: add cluster capabilities how-to and contributor guide #8371
OCPBUGS-76530: Fix intermittent etcd peer communication failures #8479
OCPBUGS-81312: fix(cpo): use KubeAPIServerDNSName for OAuth LoginURL when set #8433
OCPBUGS-84114, OSASINFRA-4368: Update CAPO to latest stable release #8687
CNTRLPLANE-597: Surface HCCO reconciliation failures in HostedCluster status #8340
OCPBUGS-92013: fix NodePool stuck in UpdatingVersion/UpdatingConfig due to stale conversion-data annotation #8821
CNTRLPLANE-3526: Add spec.monitoring API for metrics forwarding #8626
NO-JIRA: add blog section with June 2026 progress report #8816
OCPBUGS-91656: fix(test): add retry logic to GetLogs in Karpenter kubelet propagatio… #8805
OCPBUGS-86415: Use canonical image for kube-apiserver-proxy static pod #8742
OCPBUGS-92034: fix registry override matching for digest and tag separators #8824
OCPBUGS-91997: Apply MetricsSet relabel configs to KAS ServiceMonitor #8715
OCPBUGS-91650: bump consolidateAfter to 60s in karpenter e2e base NodePool #8820
CNTRLPLANE-596: Add –kubeconfig flag to HyperShift and HCP CLI #8402
NO-JIRA: Exclude generated delegating client from codecov #8825
CNTRLPLANE-3276: Add Azure ExternalPrivateService and endpoint access transition test #8718
OCPBUGS-57453: fix(cpo): use Status.DNSZoneID before querying AWS Route53 #8615
CNTRLPLANE-2916: restore conditional deletion of openshift-ingress NetworkPolicy #8754
CNTRLPLANE-3352: fix GHA reusable workflow for fork PRs #8818
CNTRLPLANE-502: Add CRD breaking changes validation to HyperShift CI #8535
NO-JIRA: chore(deps): weekly dependabot consolidation #8784
CNTRLPLANE-3352: force HTTPS for GHA plugin dependency clones #8815
OCPBUGS-90663: fix(test): use Eventually for auth-config ConfigMap assertions #8799
NO-JIRA: docs: Add private topology DNS architecture documentation #8803
CNTRLPLANE-3145: refactor(hostedcluster): segregate reconcile loop into error-collecting blocks #7908
OCPBUGS-86949: Guard HCCO KubeletConfig CM deletion against transient source absence #8672
NO-JIRA: fix(ci): switch to openshift-developer plugin bundle for GHA workflows #8809
CNTRLPLANE-3611: propagate tls profile to aws-pod-identity-webhook #8713
NO-JIRA: fix(ci): increase reusable workflow timeout to 90 minutes #8797
OCPBUGS-55621: Replace konnectivity Dial with DialContext in konnectivity-https-proxy/cmd.go #8550
OCPBUGS-85585: tighten registry override matching to strict longest-prefix across release-image consumers #8509
NO-JIRA: fix(ci): add –verbose flag required by stream-json output format #8796
CNTRLPLANE-3568: test(e2e): verify AWS additional-tags propagation to guest infrastruc… #8712
ci: stream Claude output in GHA workflow logs #8778
OCPBUGS-88685: Fix metrics-proxy unbounded memory growth #8740
CNTRLPLANE-3584: Enable resource metrics for kube-scheduler endpoints #8680
CNTRLPLANE-3645: docs: add retrospective guidelines #8777
CNTRLPLANE-3093, CNTRLPLANE-3095, CNTRLPLANE-3096, CNTRLPLANE-3098: lower Azure WI webhook test version gate to 4.20 #8323
CNTRLPLANE-3641: ci: replace COMMUNITY_FORK_TOKEN PAT with GitHub App token #8776
AROSLSRE-687: propagate HCP Azure resource ID annotation to control plane namespace #8312
ARO-24037, OCPBUGS-86616: feat(azure): add ACR pull identity to worker cloud.conf and VMSS #8472
NO-JIRA: chore(deps): weekly dependabot consolidation #8684
CNTRLPLANE-3641: fix restructure-commits GHA to force push without confirmation #8771
CNTRLPLANE-3023: Add CEL rule to prevent osImageStream removal #8719
CNTRLPLANE-3641: add restructure-commits and rebase GHA workflows #8770
CNTRLPLANE-3636: Add upgrade-from-.0 periodic jobs to OCP branching checklist #8764
CNTRLPLANE-3640: Fix address-review-comments GHA credential file deleted during run #8769
CNTRLPLANE-3026: Decouple AWS AMI resolution for dual-stream support #8699
CNTRLPLANE-3332, CNTRLPLANE-3333: Add control plane metrics forwarding recipe and Grafana dashboard #8332
ROSAENG-8224: feat(operator): add –hcp-egress-block-cidrs flag to stabilize NetworkPolicy egress exceptions #8689
CNTRLPLANE-3633: docs: add presubmit e2e triage guide #8741
OCPBUGS-89231: version-gate TestPullSecretUnavailable to 4.23+ #8744
CNTRLPLANE-3552: Multi-stream CoreOS metadata parsing and stream resolution #8669
ACM-34234: build(cli): rename hcp archives to include OS and arch in filename #8649
CNTRLPLANE-3515: test(e2e): add day-2 label/taint no-rollout verification #8595
NO-JIRA: Add Sippy/CR test name annotations to v2 e2e tests #8739
OCPBUGS-54790: Move packageserver PDB from guest cluster to management cluster #8459
OCPBUGS-84577: clear stale EtcdRecoveryActive failure condition when etcd is healthy #8406
CNTRLPLANE-3575: test(controlplane-component): verify setDefaultOptions preserves exis… #8731
NO-JIRA: docs: improve AGENTS.md and DEVELOPMENT.md guidance for AI agents #8703
OCPBUGS-85778: Fix NodePool reconciliation failure when updating mirrored immutable ConfigMaps #8543
OCPBUGS-86662: Optimize CPO deployment polling interval in tests of additional trust bundle propagation #8617
NO-JIRA: ci(deps): bump codecov/codecov-action from 6.0.1 to 7.0.0 #8727
CNTRLPLANE-3271: add External OIDC e2e tests for v2 framework #8674
OCPBUGS-84555: fix(cpo): include serving cert CAs in bootstrap and external admin kubeconfigs #8311
NO-JIRA: chore: add unit test naming and placement conventions #8722
NO-JIRA: build(operator): drop hypershift-no-cgo from operator container images #8601
CNTRLPLANE-3617: Increase address-review-comments max turns to 200 #8723
CNTRLPLANE-3617: Increase address-review-comments timeout to 45 minutes #8720
OCPBUGS-82443: fix(cpo): deduplicate VPC endpoint subnets by AZ #8651
CNTRLPLANE-3020: Adopt coreos/stream-metadata-go upstream library #8673
NO-JIRA: ci: add gopls and pre-commit plugins to address-review workflow #8702
NO-JIRA: fix address-review-comments workflow for fork PRs #8706
NO-JIRA: Add gitlint to pre-commit hooks #8701
CNTRLPLANE-3584: Add kube-scheduler ServiceMonitor with CA-signed serving certs #8489
NO-JIRA: Improve AI skill quality and restructure AGENTS.md #8690
CNTRLPLANE-3555: Add ARCHITECTURE.md to repository root #8668
OCPBUGS-84308: fix(cpo) delete terminated MCD pods to retry in-place upgrades #8434
OCPBUGS-87217: fix: add CPU partitioning workload annotation to control-plane-metrics-forwarder #8686
CNTRLPLANE-3599: Remove controller-runtime v0.19.7 pin for k8s 1.36 bump #8683
CNTRLPLANE-3550: Add missing v2 test suites to Azure self-managed test matrix #8658
NO-JIRA: chore(deps): weekly dependabot consolidation #8634
NO-JIRA: test(e2e/v2): sweep AGENTS.md conformance violations #8659
OCPBUGS-87018: Revert conditional deletion of openshift-ingress NetworkPolicy #8662
NO-JIRA: move CONTRIBUTING.md to repo root and update CI guidance #8329
CNTRLPLANE-3548: Add v2 e2e test framework documentation #8641
OCPBUGS-86008: Gate Route watch on management cluster capability #8484
Revert “OCPBUGS-86774: Pin azure-cli to 2.72.0 in e2e Dockerfile” #8652
OCPBUGS-77268: reconcile HCP when pull secret is unavailable #8352
GCP-298: Add GCP e2e v2 test artifacts directory structure documentation #8446
CNTRLPLANE-2207: Upgrade to CAPI 1.11 #8594
NO-JIRA: chore(ci): enforce v2 e2e AGENTS.md standards via CodeRabbit #8660
CNTRLPLANE-1357: add KMSv2 secret encryption e2e v2 test for Self Managed Azure #8653
CNTRLPLANE-3167: Auto-detect credential type for HCPEtcdBackup #8368
NO-JIRA: Fix Azure private/topology CEL validation rules #8490
GCP-688: Port remaining v1 TestCreateCluster gaps to v2 e2e #8590
NO-JIRA: feat(skills): add validate-pr-override-images skill #8616
OCPSTRAT-1677: Add Spot instances documentation #8485
OCPBUGS-43444: Allow kubevirt-csi storageclass default to be changed by user #8597
CNTRLPLANE-3510: Enable additional golangci-lint linters #8567
OCPBUGS-86306: Stop controllers fighting over HCP status #8562
CNTRLPLANE-3535: Add codecov carryforward flags to stabilize project coverage checks #8642
OCPSTRAT-1677: fix(cpo): increase NTH default workers from 10 to 20 #8500
NO-JIRA: feat(ci): add skopeo and gh CLI to ARC runner image #8627
OCPBUGS-85584: Fix stale api.openshift.com labels on HostedControlPlane #8507
NO-JIRA: ci(runner): update base image to actions-runner v2.334.0 #8643
CNTRLPLANE-3533: Add Dockerfiles to codecov ignore list #8640
OCPBUGS-86774: Pin azure-cli to 2.72.0 in e2e Dockerfile #8638
NO-JIRA: ci(deps): bump google-github-actions/auth from 2.1.13 to 3.0.0 #8630
NO-JIRA: ci(deps): bump actions/checkout from 4.3.1 to 6.0.2 #8631
NO-JIRA: Fix HCCO deployment location in AGENTS.md #8635
CNTRLPLANE-3534: ci: add –allowedTools to address-review-comments workflow #8639
OCPBUGS-86238: add CPO overrides for ARO swift-nic resource limits #8610
OCPBUGS-81544: requeue when AutoNodeEnabled is progressing #8497
NO-JIRA: add address-review-comments workflow #8621
NO-JIRA: De-duplicate Azure self-managed documentation #8566
CNTRLPLANE-3531: Remove EFS-backed Go build cache from CI runners #8637
CNTRLPLANE-3329: Rebuild runner image on gocacheprog and pipeline changes #8633
CNTRLPLANE-3329: Fix gocacheprog cache corruption with atomic writes #8624
NO-JIRA: fix(karpenter): start node cleanup when CAPI Cluster is deleted #8589
OCPBUGS-85151: Re-enable serviceaccount-pull-secrets controller when registry managementState changes from Removed #8522
OCPBUGS-85243: Set aws-load-balancer-scheme on public HCP router service #8458
OCPBUGS-38898: fix kubeadmin password hash reconciliation to compare password against stored hash #8358
OCPBUGS-84303: fix(api): add IPv6 OVN join subnet config to prevent dual-stack routing collision #8421
NO-JIRA: clone ai-helpers into workspace for plugin file access #8620
NO-JIRA: bump claude max-turns to 50 in WIF test #8619
NO-JIRA: test ai-sbom plugin and verify plugin loading #8614
CNTRLPLANE-3329: Use GOCACHEPROG for zero-copy EFS build cache #8576
NO-JIRA: replace container image with workflow-step plugin setup #8611
NO-JIRA: use ai-helpers container image for Claude WIF test #8609
NO-JIRA: fix Claude WIF test workflow HOME for ARC runners #8600
NO-JIRA: fix Claude WIF test workflow for ARC runners #8598
NO-JIRA: test Claude Code WIF auth in GitHub Actions #8588
OCPBUGS-86296: Propagate management cluster proxy env vars to konnectivity sidecar #8569
OCPBUGS-65730: add –tls-cipher-suites to oauth-apiserver deployment #8554
OCPBUGS-85351: Revert “fix(azure): prevent externalDNSDomain from shadowing cluster apps domain” #8585
OCPBUGS-84955: bootstrap serving certs at hypershift operator startup #8545
ci(deps): bump codecov/codecov-action from 6.0.0 to 6.0.1 #8574
CNTRLPLANE-3040: add regression tests for CAS pause/unpause replica clamping #8262
NO-JIRA: chore(deps): weekly dependabot consolidation #8578
GCP-688: Port v1 E2E validations to envtest, unit tests, and v2 Ginkgo specs #8511
NO-JIRA: fix(e2e): lower pull secret in-place propagation test gate to 4.22 #8553
OCPBUGS-86075: docs(nodepool): fixing incomplete stuck node drain documentation in section Scaling To Zero #8544
CNTRLPLANE-3222: Port v1 lifecycle tests to v2 Ginkgo framework #8527
AUTOSCALE-692: remove default debug log level from karpenter container #8561
OCPBUGS-86310: Handle CA bundle aggregation delay by requeuing revocation #8563
CNTRLPLANE-3329: Use fuse-overlayfs for build cache instead of full copy #8568
NO-JIRA: fix(e2e): use public multi-arch image for ARM64 karpenter test #8532
OCPBUGS-86238: set limits for aro.openshift.io/swift-nic in request overrides for ARO swift #8552
OCPBUGS-85351: fix(azure): prevent externalDNSDomain from shadowing cluster apps domain #8480
CNTRLPLANE-3371: Fix AllowedCIDRs e2e test for Route-based KAS #8469
NO-JIRA: build(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 in /hack/tools #8547
NO-JIRA: Update Konflux Tekton task bundles #8557
NO-JIRA: chore(deps): weekly dependabot consolidation #8464
CNTRLPLANE-3070: Support KMS on self-managed Azure without affecting ARO HCP #8088
OCPBUGS-59142: fix ValidReleaseImage condition message to show minor version #8519
NO-JIRA: Add onboarding guide for new HCP team members #8132
OCPBUGS-85011: fix(cpo): use check-first pattern for EBS CSI operator serving cert #8418
CNTRLPLANE-3329: Extend EFS-backed build cache to lint, verify, and envtest workflows #8495
NO-JIRA: ci(deps): bump cloudflare/wrangler-action from 3.15.0 to 4.0.0 #8524
OCPBUGS-85763: Fix metrics-proxy deployment failure due to dots in volume names #8530
GCP-636: feat(gcp): support for managing GCP OIDC discovery documents #8413
OCPBUGS-84307: Clarify –base-domain flag default behavior #8381
AUTOSCALE-681: various karpenter and karpenterupgrade test fixes #8510
CNTRLPLANE-3329: Replace actions/cache with EFS-backed build cache in unit tests #8494
OCPBUGS-85577: Update external-dns image from 1.1.0-3 to 1.2.1 #8506
OCPBUGS-77827: fix(api): add missing has() guards to servingCerts CEL validation rule #8331
CNTRLPLANE-3380: docs: add aws-node-termination-handler to repositories list #8514
OCPBUGS-85580: Fix webhook TLS failure after service-ca to self-managed cert migration #8504
build(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.0 in /hack/tools #8481
OCPBUGS-85344: Add version gates for 4.22 backward compatibility in e2e tests #8466
AUTOSCALE-681: remove TechPreviewNoUpgrade gate from karpenter upgrade test #8498
CNTRLPLANE-3329: Mount EFS-backed Go build cache PV on ARC runner pods #8493
NO-JIRA: docs: add repositories page listing team-owned repos #8505
CNTRLPLANE-3329: Add nightly CronJob to warm EFS-backed Go build cache #8496
CNTRLPLANE-3324: Restore non-obvious comments after gocyclo refactor #8487
AUTOSCALE-558: Expose KubeletConfig on OpenShiftEC2Nodeclass as structured fields + preserveunknown/overflow #8192
NO-JIRA: Fix docs deploy preview by replacing gh CLI with curl #8488
CNTRLPLANE-2946: Move AWS NLB annotation inside LoadBalancer strategy block #7993
OCPBUGS-78539: re-add crash toleration for dns-operator during upgrades #8483
CNTRLPLANE-3384: Remove unconditional low-quality log messages from controllers #8428
OCPBUGS-84971: Gate AWSDefaultSecurityGroupDeleted condition to AWS platform #8415
CNTRLPLANE-3324: Enable gocyclo linter and reduce cyclomatic complexity #8309
NO-JIRA: fix(karpenter): resolve HCP karpenter finalizer when AutoNode is disabled #8404
OCPBUGS-62177: verify cert revocation against all KAS pods #8263
NO-JIRA: Document CEL over webhooks policy for AI agents #8478
NO-JIRA: docs(kubevirt): add how-to for configuring VMs with JSON patches #8473
CNTRLPLANE-1741: Migrate gomaxprocs-webhook pipelines to use common-operator-build #7122
NO-JIRA: docs: update api-sme agent and api/AGENTS.md conventions #8477
OCPBUGS-81686: fix(authentication): use v2 auth validation for CEL and expression support. #8246
OCPBUGS-85084: fix(ci): use explicit lease in dependabot commit fix push #8476
OCPBUGS-75887: fix(inplaceupgrader): include node name in degraded upgrade error message #8244
NO-JIRA: fix(e2e): prevent agent unbinding and node reboots during backup/restore #8356
NO-JIRA: Update GHA docs for reusable workflow pattern #8453
GCP-413: add image registry v2 e2e tests for hosted clusters #8412
NO-JIRA: docs: make CLAUDE.md a symlink to AGENTS.md across the repo #8444
CNTRLPLANE-2778: feat(tooling): overhaul pr-report skill and Python script #7754
ACM-33601: use the latest ubi9 nginx image #8432
GCP-414: add image registry operational guide #8455
OCPBUGS-84528: clarify pull secret in-place update behavior and add CP watches #8327
OCPBUGS-84955: Add render-sensitive flag to hypershift install render #8436
OCPBUGS-84857: bump go builder and ubi images #8437
GCP-410: fix(gcp): add registry SA WIF binding for image registry GCS access #8445
CNTRLPLANE-3381: CPO: Surface cloud resource deletion timeout as a status condition #8426
OCPBUGS-85084: fix(ci): rewrite dependabot commit messages to pass gitlint #8435
NO-JIRA: docs: detail release branch e2e config steps in branch-process guide #8441
CNTRLPLANE-3222: Migrate self-managed Azure e2e tests to v2 Ginkgo framework #8204
GCP-412: add envtest cases for GCP imageRegistry CEL validation #8411
CNTRLPLANE-2939: Coordinate CRD lifecycle with Cluster CAPI Operator #7996
OCPBUGS-77040: Add AWS ISO domains to konnectivity IsCloudAPI #8251
OCPBUGS-83328: fix skipProxyForKAS to use standard NO_PROXY matching #8254
OCPBUGS-84969: fix(e2e): wait for Karpenter node cleanup in parallel tests to prevent vCPU flake #8414
CNTRLPLANE-3343: Extract support/k8sutil package from support/util #8396
TRT-2653: Revert #8357 “OCPBUGS-84572: fix(cpo): generate EBS CSI driver operator serving cert in CPO” #8417
NO-JIRA: chore(deps): weekly dependabot consolidation #8410
NO-JIRA: Skip TestKarpenter for releases < 4.22 #8409
CNTRLPLANE-3351: e2e: add opt-in CPU resource request overrides for control plane components #8385
OCPBUGS-84509: Add AWS LB Controller cross-zone load balancing annotation #8344
OCPBUGS-84572: fix(cpo): generate EBS CSI driver operator serving cert in CPO #8357
OCPBUGS-81631: fix(metrics): remove noisy vCPU log for non-AWS platforms #8169
NO-JIRA: Extend timeout for CRD removal during integration tests #8366
NO-JIRA: chore(deps): weekly dependabot consolidation #8395
OCPBUGS-83868: prevent IAM resource leaks during cluster destroy #8303
GCP-635: feat(gcp): make JWKS file optional when OIDC issuer URL is provided #8339
OCPBUGS-83757: Remove network dependencies from unit tests #8277
ci(deps): bump actions/setup-go from 5.6.0 to 6.4.0 #8393
OCPBUGS-84508: Fix NLB name parsing for EKS Auto Mode hostnames #8343
AUTOSCALE-615: include Karpenter node vCPUs in billing metric #8265
CNTRLPLANE-3352: Convert GHA callers to use reusable workflows @main #8387
CNTRLPLANE-3342: Extract support/netutil package from support/util #8360
CNTRLPLANE-3352: Add reusable GHA workflow definitions #8386
GCP-410: feat(gcp): add HCCO credential propagation for GCP image registry #7896
OCPBUGS-84551: fix(ingress): set FIPS_ENABLED env var on ingress operator #8375
CNTRLPLANE-3307: add unit tests for Azure Private Link Service controllers #8285
CNTRLPLANE-3160: Drop AutoNodeKarpenter feature gate and promote EC2NodeClass to v1 #8166
NO-JIRA: Improve commit and PR guidance in AGENTS.md #8373
OCPBUGS-83790: change Azure workload identity webhook FailurePolicy from Fail to Ignore #8288
NO-JIRA: chore(deps): weekly dependabot consolidation #8334
NO-JIRA: Add API dependency import restriction tool #8364
SPLAT-2587: aws/ccm: introduce configuration to CCM managed Security Groups for NLB #7460
NO-JIRA: add –max-depth flag to nav order verification #8372
NO-JIRA: Do not import external dependencies into API packages #8355
CNTRLPLANE-3340: Extract support/podspec package from support/util #8354
OCPBUGS-84251: fix(azure): detect and replace stale role assignments on cluster re-creation #8322
OCPBUGS-84236: Guard Infrastructure CR lookup in AWSEndpointServiceReconciler #8315
fix: OCPBUGS-78575: create virt-launcher NetworkPolicy on external infra cluster #8056
CNTRLPLANE-3330: ci: improve unit test speed with sharding and parallelism #8330
CNTRLPLANE-3313: add Etcd Snapshot Backup (Tech Preview) DR documentation #8299
CNTRLPLANE-2834: add e2e test for etcd snapshot backup method on AWS #8231
docs: NO-JIRA: clarify serialization tag behaviour in api/AGENTS.md #8328
OCPBUGS-84248: Remove hardcoded quay.io credentials from EnsureGlobalPullSecret test #8320
NO-JIRA: ci(deps): bump GitHub Actions dependencies #8333
OCPBUGS-77529: clean stale mock files before make generate function #8237
OCPBUGS-79471: fix(test): reduce e2e autorepair flakes from unhealthy node conditions #8278
NO-JIRA: docs: clarify that control plane downgrades are not supported #8314
CNTRLPLANE-2204: improve AllNodesHealthy and AllMachinesReady conditions #8247
GCP-431: feat: Add CNCC support for GCP WIF in HyperShift #7824
OCPBUGS-83410: fix, cno, skip cloud-network-config-controller check on non-cloud platforms #8238
Revert “OCPBUGS-83730: Add *.apps wildcard to base domain Private DNS zone for Azure private clusters” #8301
NO-JIRA: docs: add jira:ready-to-solve to agentic SDLC workflow #8304
OCPBUGS-83397: Fix concurrent CRD reconciliation race #8266
NO-JIRA: MCE 5.0 branch cut #8290
OCPBUGS-83751: add missing RBAC for webhook configurations #8276
OCPBUGS-83730: Add *.apps wildcard to base domain Private DNS zone for Azure private clusters #8273
NO-JIRA: chore: pass COMMIT_HASH build arg to support git worktrees #8279
OCPBUGS-78539: revert temporary crash toleration for dns-operator #7994
CNTRLPLANE-3296: fix: auto-create python venv in Makefile for verify targets #8269
OCPSTRAT-2499: docs(e2e): add AI agent guidance for v2 test framework #8207
AUTOSCALE-490: increase autonode test coverage #7979
OCPBUGS-83604: fix(kubevirt): filter link-local addresses from EndpointSlice endpoints #8264
NO-JIRA: fix(test): set 1h time limit on e2e capacity reservations #8208
NO-JIRA: docs(agents): add CRD API machinery fundamentals and envtest docs #8236
OCPBUGS-83585: Wait for CRD removal in GenerateCRDInstallTest to fix flaky envtest #8261
NO-JIRA: drop redundant api_ux_validation e2e test #8210
CNTRLPLANE-3255: enable CodeRabbit reviews on draft PRs #8250
CNTRLPLANE-635: Enable nilness and unparam checks in golangci-lint #8258
AUTOSCALE-590: karpenter version logging verification #8058
CNTRLPLANE-3259: Add sdminonne, clebs, and Nirshal to core-reviewers #8252
ci(claude): add konflux-build command for manual non-expiring builds #7964
NO-JIRA: fix(e2e): handle uint64 underflow in karpenter version computation for 5.x #8227
CNTRLPLANE-3174: Add unit tests for v2 CPO controller packages #8215
OCPBUGS-83538: fix(metrics-proxy): resolve ports from pods instead of deployments #8221
CNTRLPLANE-3260: fix(ci): split docs-preview into build+deploy to eliminate pwn request #8256
CNTRLPLANE-3203: Add autoscaling documentation for self-managed Azure #8239
NO-JIRA: add ENVTEST_JOBS knob for parallel envtest execution #8243
CNTRLPLANE-3260: ci: harden GitHub Actions workflows #8253
CNTRLPLANE-3214: add envtest suites for HCPEtcdBackup CRD validation #8199
CNTRLPLANE-3254: Sort how-to guides alphabetically and add CI enforcement #8248
OCPBUGS-67228: fix(shared-ingress): bump haproxy to 3.0.5-4.el10_1.1 #7370
CNTRLPLANE-3065: docs: add Agentic Software Development Life Cycle page #8235
OCPCLOUD-3347: feat(machine-approver): add TLS configuration options to deployment manifests #8019
OCPBUGS-83389: fix(supportedversion): normalize OCP 5.x versions for skew and release validation #8225
SREP-4438: refactor(karpenter): tidy Cincinnati version resolution #8206
NO-JIRA: revert: remove .git/ from .dockerignore #8201
CNTRLPLANE-3197: add release-4.22 branch to renovate configuration #8196
CNTRLPLANE-3197: update builder images from 4.22 to 4.23 #8194
CNTRLPLANE-3216: Add codecov.yml validation to make verify #8202
GCP-368: add GCP CCM v2 e2e tests #7840
CNTRLPLANE-3233: ci(gha): add release-4.22 branch to GitHub Actions workflows #8217
CNTRLPLANE-3197: update latest supported version from 4.22 to 4.23 #8193
CNTRLPLANE-3174: Add unit tests for CPO controller packages #8184
CNTRLPLANE-3215: fix envtest GHA workflow path filters for CRD test suites #8200
CNTRLPLANE-2078: add unit tests for AWS Route53 and IAM #8079
OCPBUGS-82301: fix(catalogs): use semver comparison for catalog version cap to handle OCP 5.0 #8195
NO-JIRA: control-plane-pki-operator: fix Event emission logic, format #8190
OCPBUGS-82192: fix(webhookcerts): handle upgrade from service-ca managed certs #8189
OCPBUGS-82159: fix(ignition-server): use major+minor version comparison for OCP 5.0 payloads #8182
CNTRLPLANE-2511: refactor(cpo): move OAuth internal LB annotation into ReconcileService #8185
CNTRLPLANE-2511: Support OAuth LoadBalancer with Azure Private Link Service #8149
OCPBUGS-81644: fix(cli): fix Azure destroy cluster leaving vnet/nsg resource groups for private topology #8151
OCPBUGS-33097: Remove deprecated OVNSbDb service type from default strategy mappings #8164
CNTRLPLANE-3174: test: Add unit tests for product-cli, token-minter, and sync-fg-configmap #8178
CNTRLPLANE-3050: feat(ci): use Konflux-built image for GitHub Actions runners #8092
CNTRLPLANE-2841: test(e2e): add metrics-forwarder e2e test verifying data-plane scraping #8147
CNTRLPLANE-3037: Create separate assets package specifically for CRD management #8150
GCP-462: Add GCP hosted cluster documentation #8027
NO-JIRA: docs(ci): add sync-community-fork token rotation guide #8173
CNTRLPLANE-2841: feat(HCCO): reintroduce guest cluster metrics forwarder for control plane metrics #8146
NO-JIRA: fix(e2e): handle rate limiter context deadline error during cleanup #8137
NO-JIRA: fix(ci): remove catch-all pattern from codecov ignore list #8171
CNTRLPLANE-2511: Allow LoadBalancer publishing strategy for OAuthServer on self-managed Azure #8148
NO-JIRA: chore(ci): add client/ to codecov ignore list #8167
NO-JIRA: feat(e2e): add Azure platform support for backup/restore tests #8144
OCPBUGS-74960: prevent resource leak on deletion and handle DependencyViolation #7868
NO-JIRA: docs: expand custom images guide with Dockerfile.dev and CPO override #8155
CNTRLPLANE-3042: Parallelize make verify targets for faster local development #8051
NO-JIRA: ci: fix codecov ignore patterns for docs and nested files #8156
OCPBUGS-81270: fix(external-dns): mitigate Azure DNS API throttling #8098
NO-JIRA: ci: ignore non-Go files in codecov coverage analysis #8154
OCPBUGS-67240: Ignition generalize image download errors #7673
NO-JIRA: fix(Makefile): auto-detect upstream remote for lint #8152
OCPBUGS-79539: fix(cpo-v2): preserve HCCO modifications to OCM Controllers field #8072
AUTOSCALE-582: wire CRD sync and CEL adjustments into karpenter-api target #8119
CNTRLPLANE-3111: docs: add service publishing strategies reference documentation #8107
NO-JIRA: ci: make docs deploy preview non-blocking #8145
Revert “CNTRLPLANE-2841: feat(HCCO): add guest cluster metrics forwarder for control plane metrics” #8141
NO-JIRA: fix(e2e): handle dual RHCOS payloads in Karpenter drift OS image check #8128
OCPBUGS-50003: add ConfigMap fallback and EC2 error caching for vCPU metrics resolution #6723
CNTRLPLANE-2172: feat(azure): add private endpoint access topology for self-managed HostedClusters #7821
CNTRLPLANE-2841: feat(HCCO): add guest cluster metrics forwarder for control plane metrics #7790
CNTRLPLANE-2797: hypershift-operator webhooks port 9443 respect cluster TLS security profile #8078
OCPBUGS-50603: Create dedicated identity for KAS bootstrap container #6827
Revert “NO-JIRA: test(e2e): extend AWS guest resource cleanup timeout” #8138
NO-JIRA: ci: improve CI efficiency and codecov configuration #8113
NO-JIRA: test(e2e): add KubeVirt platform to backup/restore e2e test #8131
OCPBUGS-81162: fix(cpo): skip router LB services for ARO HCP #8087
NO-JIRA: ci: enable paths filter on envtest workflows #8125
NO-JIRA: test(e2e): extend AWS guest resource cleanup timeout #8124
NO-JIRA: fix(test): deep copy CRDs inside envtest retry loop #8127
NO-JIRA: chore(docs-agg): remove document count from aggregated file #8126
NO-JIRA: ci: separate envtest from unit tests in CI workflow #8120
OCPBUGS-80926: consolidate disaster-recovery prerequisites into dedicated page #8080
CNTRLPLANE-3116: fix(ci): drop pip cache from docs-preview workflow #8116
NO-JIRA: fix(api): regenerate feature gate manifests for ExternalOIDCWithUpstreamParity #8117
OCPBUGS-78763: fix: global-pull-secret daemonset node labeling race condition causes pods not to be scheduled on Replace upgrade strategy nodes in time #7981
CNTRLPLANE-3037: Introduce envtest for integration tests alternative #8089
CNTRLPLANE-3116: ci(docs): migrate docs-preview job to GitHub Actions #8109
CNTRLPLANE-244: fix(ci): configure Codecov PR comments and add unit tests #8085
NO-JIRA: chore(deps): weekly dependabot consolidation #8077
OCPBUGS-78931: add KubeVirt-specific backup settings #8022
OCPBUGS-81284: fix(release): allow multiple machine-os component versions #8101
NO-JIRA: fix(aws): load credentials from –aws-creds file using SDK v2 #8095
NO-JIRA: chore(ci): update hypershift-ci-2 manifests #8062
CNTRLPLANE-2678: Adapt etcd-backup command and add HO namespace manifests #8040
CNTRLPLANE-2551: Hypershift integration for API Auth Config changes #7774
GCP-447: inject token-minter as native sidecar init container #7965
AUTOSCALE-538, AUTOSCALE-539: Add Autonode status node counts + enabled condition to HostedCluster API #7794
CNTRLPLANE-244: ci: add Codecov integration to unit test workflow #8060
CNTRLPLANE-3050: Pre-build lint tools and fix Konflux pipeline triggers #8052
CNTRLPLANE-2838: feat(CPO): add metrics-proxy control plane component #7752
CNTRLPLANE-2787: Introduce BASE_DOMAIN env var for E2E test configuration #7930
CNTRLPLANE-2786: Extend controller architecture diagram with consumes relationship #8029
IR-350: add tls security profile configuration for the image registry operator #8011
AUTOSCALE-571: fix(karpenter): don’t associate public IP addresses for the default OpenshiftEC2NodeClass #7853
NO-JIRA: feat(e2e): skip SupportedVersionSkew condition on OCP < 4.21 in backup/restore tests #8067
CNTRLPLANE-2076: remove v2 import aliases left from SDK migration #8063
AUTOSCALE-559: PrivateLink plumbing for karpenter ec2nodeclass subnets #7791
STOR-2770: Generate Azure Disk and File CSI Driver Operator metrics serving certs by HCP controller #7970
CNTRLPLANE-2678: Add fetch-etcd-certs CPO subcommand for HCPEtcdBackup #8010
NO-JIRA: revert(api): remove APIServer Route CEL validation for Azure #8074
CNTRLPLANE-2172: feat(api): add Azure private endpoint access and PrivateLinkService CRD #8055
OCPSTRAT-2831: chore(owners): add cblecker to core-reviewers and core-approvers #8018
OCPBUGS-79428: Add recipe for ACM/MCE HyperShift Operator overrides #8057
CNTRLPLANE-2076: complete SDK v1 removal and post-migration cleanup #8038
CNTRLPLANE-2049: update GCP validation error expectations in TestOnCreateAPIUX #8037
CNTRLPLANE-3046: feat(ci): add monitoring and alerting for ARC runners #8044
CNTRLPLANE-3049: split verify checks into individual GitHub Actions workflows #8049
OCPBUGS-79352: fix(oapi): force WatchList feature gate to disabled for openshift-apiserver #8035
OCPBUGS-79071: Fix AWSEndpointService private-router teardown stuck on active VPC Endpoint connections #8030
CNTRLPLANE-3041: Override ARO/HCP 4.20 CPO with Azure Pod Identity backport #8025
CNTRLPLANE-3054: Apply init task 0.3 migration to fix broken Konflux pipelines #8053
OCPBUGS-70301: force-remove karpenter finalizer when guest KAS is down #7939
CNTRLPLANE-3047: fix(ci): use community fork token for checkout credential helper #8050
CNTRLPLANE-2788: validate memory quantity in KubeVirt nodepool create #7884
NO-JIRA: chore(ci): update Konflux Tekton tasks to latest versions #8048
CNTRLPLANE-3048: refactor gh-actions-runner pipelines and improve CEL triggers #8045
OCPBUGS-79369: Add Konflux archived PipelineRun skill and update task discovery #8043
CNTRLPLANE-3047: add workflow to sync hypershift-community fork #8042
NO-JIRA: chore(claude): add restructure-commits plugin command #7927
CNTRLPLANE-2986: feat(ci): Add self-hosted GitHub Actions runners for HyperShift #7980
NO-JIRA: fix(ci): pass –upgrade-versions to konflux task update skill #8036
CNTRLPLANE-2998: Migrate SQS to AWS SDK v2 #8015
NO-JIRA: refactor(oadp): unify backup/restore e2e test with platform auto-detection #7971
OCPBUGS-78996: fix(test): create SQS queue dynamically in spot termination handler e2e test #8007
CNTRLPLANE-2049: fix(api): audit and improve GCP API validation rules #8003
CNTRLPLANE-2081: Migrate RAM and ARN to AWS SDK v2 #7986
OCPBUGS-78778: fix(cpo): Don’t remove HCP Ingress from routes when CapabilityRoute is disabled #8001
NO-JIRA: Disable parent ownership for api subdir #8009
NO-JIRA: fix(api): replace CEL url() validators with regex to fix CRD cost budget #8004
OCPBUGS-78544: Update base images to address multiple CVEs flagged by MSFT security scans #7983
OCPBUGS-78705: Bootstrap CVO manifests should be filtered based on feature-set annotation #7984
NO-JIRA: fix(api): extend kubeapilinter scope to all non-vendor API types #8002
NO-JIRA: build(e2e): include hypershift binary in Dockerfile.e2e #7919
CNTRLPLANE-2925: add NodePool.Status.NodesInfo for node version distribution #7917
OCPSTRAT-2336: Adjust karpenter API to OpenShift conventions #7952
OCPBUGS-78539: chore(e2e): add temporary crash toleration for dns-operator #7978
CNTRLPLANE-2172: fix(e2e): register Azure private platform e2e flags #7977
NO-JIRA: chore(owners): require api-approvers approval for api/ changes #7972
Update Kube API Linter config for new APIs #7982
NO-JIRA: add .gitattributes to collapse generated files in PR diffs #7918
CNTRLPLANE-2910: feat(cpo): add Azure workload identity webhook as KAS sidecar #7867
CNTRLPLANE-2077: refactor(cleanzones): migrate AWS SDK from v1 to v2 #7960
CNTRLPLANE-2219: feat(aws): migrate ec2 to AWS SDK v2 #7871
GCP-440: Fix GCP boot image discovery from CoreOS stream metadata #7881
NO-JIRA: fix(oadp): correct Agent platform API group in backup/restore resources #7974
OCPBUGS-78356: fix(sharedingress): coalesce HAProxy reloads to prevent reload storms #7945
CNTRLPLANE-2172: fix(operator): accept Azure as valid private-platform value #7968
NO-JIRA: Rename cilium directory to v1.15.1 #7888
OCPBUGS-70354: add serviceAccount to global-pull-secret-syncer #7439
NO-JIRA: feat(e2e): add OIDC IAM fix and NodePool validation to backup/restore #7837
CNTRLPLANE-2172: feat(install): register Azure private platform flags #7912
CNTRLPLANE-2978: Add Azure CPO override for OCP 4.20 #7955
OCPBUGS-65687: fix(cpo): prevent informer creation for inaccessible resource types #7819
GCP-441: correct CCM crash toleration key to match pod label #7926
CNTRLPLANE-2916: conditionally create openshift-ingress network policy based on route labeling #7872
NO-JIRA: chore: add .git/ to .dockerignore #7944
NO-JIRA: fix(test): add aws-node-termination-handler to safe-evict audited list #7816
NO-JIRA: test(scheduler): add pair loss recovery unit coverage #7848
OCPBUGS-67262: fix(e2e): Use NodePool replicas as authoritative source for expected node count instead of CountAvailableNodes #7378
OCPBUGS-77160: include NMStateConfig in Agent platform OADP backup resources #7847
AUTOSCALE-571: fix(karpenter): select existing private subnets for default OpenshiftEC2NodeClass #7933
OCPBUGS-78198: fix(catalogs): update catalog image version cap to 4.21 #7915
OCPBUGS-78184: fix(hostedcluster): Remove referenced resource annotations regardless of hcp status #7913
CNTRLPLANE-2203: reintroduce ControlPlaneConnectionAvailable condition with conformance fix #7746
OCPBUGS-78185: Fix deadlock when changing release image during initial provisioning #7910
CNTRLPLANE-634: Make external-dns interval and AWS zones cache duration configurable #7931
OCPBUGS-78045: allow autonode provisioned arm instances #7893
OCPBUGS-78329: fix(releaseinfo): allow periods in version display name regex #7940
OCPBUGS-78223: add NodePool Rollouts reference documentation #7923
NO-JIRA: chore(gitignore): add .claude/worktrees/ to .gitignore #7938
OCPBUGS-78189: fix(e2e): fix nil deref in validateAWSGuestResourcesDeletedFunc #7911
OCPBUGS-77514: E2E filter rolling upgrade verification to current MachineSet #7864
OCPBUGS-77703: fix(api): add omitempty to NodePoolAutoScaling.Min for N-1 compatibility #7849
GCP-411: Add comprehensive unit tests for ReconcileInfrastructure #7895
NO-JIRA: fix KubeVirtAdvancedMultinetTest IPv6 and apk errors #7860
NO-JIRA: chore(e2e): increase nodepool condition check timeout #7906
CNTRLPLANE-2789: add StatefulSet test case to controlplane-component reconcile tests #7764
NO-JIRA: Add CodeRabbit config to exclude autogenerated files #7905
CNTRLPLANE-2933: add docs recipe for SPO configuration in HCP environments #7886
CNTRLPLANE-2031: test(e2e): add comprehensive backup and restore test suite #7745
CNTRLPLANE-2588: docs: add dependabot triage agent to AI CI jobs documentation #7889
CNTRLPLANE-2793: Cache MCS TLS certificate generation in ignition provider #7841
ROSAENG-132: fix(karpenter): Set Ready condition to False when version resolution fails #7866
NO-JIRA: api: fix AutoNode types to comply with OpenShift API conventions #7859
NO-JIRA: chore(deps): weekly dependabot consolidation #7876
OCPBUGS-39604: Include shared ingress resources in render output for proper uninstall cleanup #7836
OCPBUGS-76645: Make generated container names k8s compliant #7711
OCPBUGS-77254: fix(globalps): watch Machine updates to fix node labeling race condition #7803
GCP-441: tolerate 1 restart for GCP CCM token-minter race condition #7865
NO-JIRA: chore(deps): weekly dependabot consolidation #7863
OCPBUGS-77477: fix(awsutil): handle smithy errors in AWSErrorCode #7827
SREP-3855: unpause leaked child objects on deleting clusters (OCPBUGS-77530) #7861
CNTRLPLANE-2218: feat(aws): migrate ELB/ELBV2 to AWS SDK v2 #7825
OCPBUGS-77621: fix(nodepool): preserve ignition-reached annotation on token secret after restore #7851
OCPBUGS-76337: feat(scale-from-zero): add DescribeInstanceTypes IAM permission #7648
GCP-391: Add ImageRegistry GSA field and IAM binding for Image Registry Operator #7828
CNTRLPLANE-2801: fix(router): deploy router services for private ARO and remove KAS/OAPI dependencies #7845
CNTRLPLANE-2842: Fix context cancel accumulation in getMirrorFromICSPOrIDMS #7846
CNTRLPLANE-2801: api: remove redundant kubebuilder enum marker from KeyVaultAccess field #7835
NO-JIRA: bug(metrics): fix typo in hypershift_cluster_waiting_initial_availability_duration_seconds metric #7730
CNTRLPLANE-2840: fix(endpoint-resolver): sort pods by name for deterministic ordering #7854
CNTRLPLANE-2808: bump golang.org/x dependencies in / and /api modules #7818
CNTRLPLANE-2840: feat(CPO): add endpoint-resolver control plane component #7786
CNTRLPLANE-2794: Re-add TestGetDigest and TestGetManifest with mockgen mocks #7777
OCPBUGS-77034: fix(ho): add nil guard for Platform.AWS in metrics collector #7747
GCP-295: Add GCP platform support to E2E test framework #7697
OCPBUGS-76997: remove resource limits from Agent CAPI provider #7812
OCPBUGS-60936: fix(hccp): remove immutable field from kubeletconfigmap #6726
OCPBUGS-77311: handle HostedCluster deletion in secretJanitor to prevent stuck cluster deletions #7779
OCPBUGS-60185: Remove non-deterministic registry override computation from ignition-server #7811
CNTRLPLANE-2784: Document IAM policies for PowerVS credential fields #7778
CNTRLPLANE-2801: add Key Vault private endpoint TCP relay via private router #7701
CNTRLPLANE-2217: feat(aws): migrate kms and Resource Tagging to AWS SDK v2 #7795
CNTRLPLANE-2807: Fix version showing <unknown> in git worktree builds #7814
OCPBUGS-65636: add service account to konnectivity-agent #7309
NO-JIRA: docs(pki): add CA hierarchy diagram and trust distribution details #7799
CNTRLPLANE-2799: Unit test HCP availability and Ready flag reconciliation #7796
OCPBUGS-67262: fix(sync-global-pullsecret): compare content ignoring trailing newlines #7638
GCP-386: scope externaldns RBAC to GCP platform only #7781
OCPBUGS-76350: Honor AWS AMI override in NodePool token generation #7675
OCPBUGS-60185: Fix ignition-server pod restarts due to MIRRORED_RELEASE_IMAGE flapping #7588
NO-JIRA: docs(agents): add multi-module structure guidance to AGENTS.md #7797
OCPBUGS-76452: update OAuth certificate configuration doc #7785
GCP-402: Add gcp-project and gcp-region flags to hypershift install #7710
GCP-376: Add service account for storage #7676
GCP-367: enable multizone support in CCM cloud config #7731
OCPBUGS-77224: fix(routing): add Azure platform to LabelHCPRoutes() switch #7789
CNTRLPLANE-2220: feat(aws): migrate iam to AWS SDK v2 #7765
NO-JIRA: Skip ./dev directory in codespell checks #7775
NO-JIRA: MCE 2.17 konflux pipielines #7736
NO-JIRA: chore: add powervs-reviewers to OWNERS_ALIASES and OWNERS #7782
OCPBUGS-59876: feat: implement CLI-based OIDC disaster recovery command #7210
OCPBUGS-62177: revert CRR controller changes #7784
OCPBUGS-65824: Add dynamic NodePort range validation to prevent cluster creation failures #7652
CNTRLPLANE-2740: Set unhealthyPodEvictionPolicy to AlwaysAllow on all PDBs #7721
OCPBUGS-32770: fix(kubevirt): require CAPK image to be explicitly specified #7615
OCPBUGS-62177: fix(pki): use pod container port instead of kubeconfig service port #7744
CNTRLPLANE-1987: Ensure Azure HCP CLI infra commands work correctly #7436
NO-JIRA: fix(e2e): retry guest cluster API calls in EnsureFeatureGateStatus #7723
OCPBUGS-70152: Correct route labeling logic for HCP router infratructure #7605
CNTRLPLANE-2216: feat(aws): migrate route53 to AWS SDK v2 #7726
OCPBUGS-43449: Remove UltraSSD_LRS from DiskStorageAccountType for OS Disks #7727
CNTRLPLANE-644: Unify Validate/Complete Function Signatures Across Providers #7577
OCPBUGS-65879: Fix image-overrides annotation removal propagation to HCP #7533
CNTRLPLANE-2740: Add KAS liveness readiness sidecar to OAS and OAuth API Server #7722
OCPBUGS-34662: Manage AWS EBS CSI driver metrics serving certificates via CPO #7538
OCPBUGS-73915: Use openshift golang builder for MCE builds #7735
NO-JIRA: Remove .claude/settings.json #7751
OCPBUGS-62177: Fix certificate revocation validation across all KAS pods #7405
CNTRLPLANE-2696: docs(azure): add managed Azure control plane authentication documentation #7653
NO-JIRA: test(e2e): add CloudController field to GCP ServiceAccountsEmails structs #7739
AUTOSCALE-485: bump karpenter-aws dependencies to 1.8.6 #7611
TRT-2554: Revert #7489 “CNTRLPLANE-2203: add ControlPlaneConnectionAvailable condition” #7734
GCP-367: Implement GCP Cloud Controller Manager component #7677
OCPBUGS-72596: Fix node-tuning-operator metrics port configuration #7468
CNTRLPLANE-2203: add ControlPlaneConnectionAvailable condition #7489
GCP-386: feat(gcp): enable DNS delegation for hosted cluster ingress via DNSEndpoint #7702
NO-JIRA: ci: fix bug in leader election detection #7696
GCP-308: test: verify control plane workloads have resource requests #7623
OCPBUGS-60707: Fix user-ca-bundle cleanup when additionalTrustBundle is removed #6900
CNTRLPLANE-2736: Rename review-agent-single-pr to address-review-comments #7709
CNTRLPLANE-2215: feat(aws): migrate S3 to AWS SDK v2 #7678
NO-JIRA: test(nodepool): add unit tests for scale-from-zero annotations #7688
OCPBUGS-55151: Move proxy certificate validation from metrics collector to reconcile loop #7536
CNTRLPLANE-418: Aro swift private #7613
CNTRLPLANE-2700: docs: add HCP networking requirements documentation #7654
CNTRLPLANE-2675: chore(cpo): move infrastructure reconciliation to infra package #7658
GCP-216: feat(nodepool): add GCP platform support #7631
GCP-199: add DNS management to Control Plane Operator #7639
AUTOSCALE-492: karpenter-ignition controller #7582
OCPBUGS-66966: loop over node-pool conditions updating in order #7325
SREP-715: New option to dump data plane content through the kube API server service exposed in HCP namespaces #6533
OCPBUGS-74620: test(e2e): increase default node ready timeout to 45 minutes #7629
OCPBUGS-74498: Add UserAgent telemetry to CPO Azure SDK clients #7620
OCPBUGS-74931: fix(hcco): gate image registry workaround to pre-4.20 releases #7634
NO-JIRA: docs(aws): add AWS PrivateLink architecture documentation #7645
NO-JIRA: chore(ai): Add skills for dev workflow #7636
CNTRLPLANE-2709: Update Dependabot to use conventional commits #7672
CNTRLPLANE-2703: Disable Renovate dependency updates #7657
OCPBUGS-74988: fix(test): resolve E2E flakes in global-pull-secret-syncer DaemonSet readiness checks #7627
CNTRLPLANE-2214: Migrate STS to AWS SDK v2 #7386
NO-JIRA:Docs: update documentation URL from netlify to pages.dev #7622
GCP-366: add CloudController service account for CCM #7617
NO-JIRA: ci: Improves the isLeaderElectionFailure function: #7589
NO-JIRA: Fix teardown flag timing in e2e tests #7586
CNTRLPLANE-2548: add direct Jira REST API integration to pr-report #7532
OCPSTRAT-2437: add unit test for custom HAProxy image annotation #7458
CNTRLPLANE-1708: Enable EnsureGlobalPullSecret AtLeast Version418 #7624
CNTRLPLANE-418: fix shared ingress AllowedCIDRs to use fc_src for PROXY protocol #7587
AUTOSCALE-535: default block device mappings #7583
OCPBUGS-69447: feat(updates): enable CVO metrics access with RHOBS monitoring flag #7399
GCP-198: add PSC endpoint controller for customer-side management #7603
CNTRLPLANE-2650: docs(ci): add security requirement for Jira agent issues #7626
CNTRLPLANE-2650: docs: add AI-assisted CI jobs documentation #7598
OCPBUGS-62760: Pre-pull images to avoid startup delays and flaky e2e #7382
OCPBUGS-74247: CAPI image overrides aware of registry config #7575
CNTRLPLANE-1137: Add support for external CNI provider Cilium #7423
GCP-176: feat(gcp): add WIF credentials support for control plane op… #7600
NO-JIRA: test(assets): add unit test for CAPI resources file paths #7601
CNTRLPLANE-2580: feat(claude): update /update-konflux-tasks to work without log file #7591
GCP-213: feat(platform): add Google Cloud Platform support with CAPG Deployment #7305
OCPBUGS-62944: forceful termination of instances during HCP AutoNode deletion #7281
NO-JIRA: build: bump Go version to 1.25.3 #7592
CNTRLPLANE-1388: Spot with termination handler #7567
CNTRLPLANE-1892: chore(e2ev2): fixup GCP API checks #7555
NO-JIRA: ci: update build root image to Go 1.25 #7584
CNTRLPLANE-1988: Add Azure support to product CLI for self-managed customers #7407
AUTOSCALE-373: Proper ROSA instance tagging for AutoNode #6939
OCPBUGS-63345: AWS credential metric to distinguish unknown from invalid status #7075
OCPBUGS-74336: feat(cpo): check components have rolled out before setting available #7434
NO-JIRA: chore(deps): weekly dependabot consolidation #7563
OCPBUGS-64576: fix(dump): Fix dump command failure when EC2NodeClass resource is not registered #7147
CNTRLPLANE-2559: feat(contrib): add request serving setup utility #7534
CNV-76520: ci: allow restart of kubevirt-cloud-controller-manager #7469
NO-JIRA: fix(test): shorten scale-from-zero test name to avoid IAM role length limit #7558
OTA-1833: Adopt a new FeatureSet OKD #7557
OCPBUGS-62761: chore(e2e): remove KAS check from capi pod #7485
OCPBUGS-73817: fix: add hypershift.openshift.io/nodepool-globalps-enabled label to be ignored in cluster-autoscaler deployment #7480
OCPBUGS-65885: added 1.34 required ELBv2 perms to CCM role #7339
API-1835: Scaffold dynamic informers #7477
CNTRLPLANE-2579: feat(konflux): add script to update pipeline task bundles to latest trusted versions #7553
OCPBUGS-58397: feat(KubeVirt): configure External evictionStrategy on VMs #6380
GCP-197: add GCPPrivateServiceConnect controller for managing Service Attachments for Private Service Connect #7302
NO-JIRA: fix(e2e): TestNodePoolAutoscalingScaleFromZero for 4.20 and later only #7556
CNTRLPLANE-2291: feat(claude): add fix-hypershift-repo-robot-pr command #7438
CNTRLPLANE-2568: Update Konflux Tekton tasks to latest versions #7551
NO-JIRA: test(ingress): add test for clearing LoadBalancerSourceRanges #7544
NO-JIRA: fix(claude): fix Claude Code subagents frontmatter #7550
NO-JIRA: chore(deps): bump github.com/opencontainers/selinux from 1.11.0 to 1.13.0 #7462
OCPBUGS-55399: Add NTO Service and ServiceMonitor #7355
NO-JIRA: test(autoscaling): make GPU annotation optional in scale-from-zero test #7484
OCPBUGS-73914: Update Tekton tasks to pass enterprise contract validation #7535
NO-JIRA: chore(deps): bump github.com/cloudflare/circl from 1.3.7 to 1.6.1 in /hack/tools #7463
NO-JIRA: Add karpenter approvers and reviewers #7488
NO-JIRA: chore(ho): update lower bound version checks for OCP 5 #7472
NO-JIRA: fix(docs): strip markdown links from aggregated documentation #7487
NO-JIRA: chore(deps): bump github-dependencies group with 17 updates #7455
OCPBUGS-73847: fix(cli): use /tags endpoint for all release streams to enable RC filtering #7483
OCPBUGS-67234: fix(hostedcluster): unpause CAPI cluster when deleting paused HostedCluster #7389
OCPBUGS-72258: use InfraStatus.APIPort for custom DNS kubeconfig #7470
API-1835: Scaffold OpenShiftManager controller #7445
CNTRLPLANE-1768: feat(api): add support for graceful service account signing key rotation #7324
OCPBUGS-66205: [kubevirt] Make L3 migration labeling conditional #7308
NO-JIRA: chore(deps): bump Azure SDK and misc-dependencies groups #7464
NO-JIRA: chore(tekton): update Konflux task digests to latest versions #7465
OCPBUGS-70320: enable scale-up from zero with InPlace upgrade #7427
NO-JIRA: Add review process docs to CONTRIBUTING.md #7426
CNTRLPLANE-208: Document needed Azure infrastructure #7361
NO-JIRA: fix(deps): update k8s.io/utils digest to 914a6e7 #7450
NO-JIRA: chore(deps): bump misc-dependencies group with 11 updates #7437
OCPBUGS-72411: fix(cno): use brackets only for IPv6 in server URL #7447
NO-JIRA: chore(konflux): update Tekton tasks to latest versions #7451
OCPBUGS-72397: Fix Konflux EC voilation, update deprecated base … #7442
NO-JIRA: docs(konflux): add IMAGE_RELEASE_PROCESS.md #7432
NO-JIRA: test(e2e): fix AKS e2e test flakiness #7410
CNTRLPLANE-1978: add e2e tests for DataPlaneConnectionAvailable condition #7291
AUTOSCALE-473: Add HostedCluster annotation for karpenter ec2nodeclass instanceProfile #7392
NO-JIRA: fix(awseps): cache local zone ID in non-shared VPC case #7409
OCPBUGS-66211: fix(azure): preserve defaulted values in Infrastructure status #7393
OCPBUGS-69761: fix(ingress): clear LoadBalancerSourceRanges when AllowedCIDRBlocks is removed #7425
GCP-258: Use PullAlways for :latest image tags in control plane components #7313
OCPBUGS-63698: fix(azure): remove CSI secret ownership from hypershift-operator #7157
OCPBUGS-66154: add OAuth certificate configuration doc #7351
OCPBUGS-67224: fix(Portieris): Fix Portieris by mounting emptyDir to ‘./.trust’ work dir #7368
CNTRLPLANE-1622: Enable nodepool autoscaling min zero #6975
CNTRLPLANE-2119: feat(hostedcluster): implement service account signing key rotation #6874
OCPBUGS-66325: fix: ValidAWSIdentityProvider condition not being correctly copied from HCP #7352
NO-JIRA: fix(install): skip IPAM CRDs if they already exist #7363
CNTRLPLANE-1977: Add weekly PR report generation capability #7272
OCPBUGS-68366: CVE-2025-58183 #7374
CNTRLPLANE-2123: feat: update builder images from 4.21 to 4.22 #7317
OCPBUGS-63452: Add finalizer protection to control plane workloads #7258
CNTRLPLANE-2205: feat(aws): enable shared role in e2e #7400
NO-JIRA: chore(azure): bump AKS Kubernetes version to 1.33.0 #7371
CNTRLPLANE-2206: Create tool to aggregate upstream docs into single file for NotebookLM #7367
OCPBUGS-66211: fix(vendor): bump openshift/api dependency to current master #7345
OCPBUGS-66146: Add OADP backup recovery tool for HyperShift clusters #7385
CNTRLPLANE-2221: Add CI infrastructure documentation #7369
CNTRLPLANE-2123: Fix buildah-remote-oci-ta task enterprise contract violation #7396
CNTRLPLANE-2049: Update kube-api-linter dependency #7346
NVIDIA-314: Support Node CIDR Allocation for networkType=Other Using AllocateNodesCIDRs #7278
CNTRLPLANE-2123: feat: update latest supported version from 4.21 to 4.22 #7315
CNTRLPLANE-2205: cmd/aws: fix managed role handling and auto-detect on destroy #7373
CNTRLPLANE-2123: feat: add release-4.21 branch to renovate configuration #7318
NO-JIRA: test: remove network-dependent unit tests for image metadata #7381
OCPBUGS-67233: fix(konflux): update outdated Tekton tasks to pass enterprise contract validation #7372
And 29 elided commits (e.g. from squash or rebase merges)
Full changelog

ibm-cloud-controller-manager

OCPCLOUD-3593: Rebase from upstream IBM-Cloud/cloud-provider-ibm release-1.36 (K8s 1.36.2) #109
OCPBUGS-87366: Updating ose-ibm-cloud-controller-manager-container image to be consistent with ART for 5.0 #108
OCPBUGS-83587: bump google.golang.org grpc v1.79.3 #106
NO-JIRA: Update OWNERS #95
OCPCLOUD-3273: Merge https://github.com/IBM-Cloud/cloud-provider-ibm:release-1.35 (7d70282) into main #87
Full changelog

ibm-vpc-block-csi-driver

NO-JIRA: standardize build paths #155
STOR-2921: Rebase to v5.2.27 for OCP 5.0 #154
OCPBUGS-87350: Updating ose-ibm-vpc-block-csi-driver-container image to be consistent with ART for 5.0 #153
NO-JIRA: Bump gRPC library to v1.79.3 and replace golang.org/x/net/context with context #149
STOR-2754: Rebase to upstream v5.2.21 for OCP 4.22 #118
OCPBUGS-77598: Updating ose-ibm-vpc-block-csi-driver-container image to be consistent with ART for 4.22 #129
OCPBUGS-77167: standardize build paths #117
OCPBUGS-69849: Updating ose-ibm-vpc-block-csi-driver-container image to be consistent with ART for 4.22 #116
Full changelog

ibm-vpc-block-csi-driver-operator

STOR-2914: Bump all deps for 5.0.0 #176
STOR-2921: update deployment manifests from upstream #174
OCPBUGS-87388: Updating ose-ibm-vpc-block-csi-driver-operator-container image to be consistent with ART for 5.0 #173
NO-ISSUE: Bump google.golang.org/grpc to v1.79.3 #172
STOR-2762: Bump all deps for 4.22 #168
OCPBUGS-77624: Updating ose-ibm-vpc-block-csi-driver-operator-container image to be consistent with ART for 4.22 #167
STOR-2852: Enable snapshot tests ibm vpc block csi #160
OCPBUGS-69909: Updating ose-ibm-vpc-block-csi-driver-operator-container image to be consistent with ART for 4.22 #159
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-108009: UPSTREAM: 2933: Bump all go.opentelemetry.io/otel modules to v1.44.0 #186
🚀 OCPCLOUD-3602: Merge https://github.com/kubernetes-sigs/cluster-api-provider-ibmcloud:v0.14.0 (5d081d1) into main #161
🐛 OCPBUGS-85337: set imagePullPolicy IfNotPresent on provider workloads #164
OCPBUGS-87499: Updating ose-ibmcloud-cluster-api-controllers-container image to be consistent with ART for 5.0 #163
NO-JIRA: manifests-gen: scope provider webhooks to capi namespace #160
OCPCLOUD-3359: Add TLS substitutions #158
NO-JIRA: Update manifests generator #159
NO-JIRA: Update OWNERS #156
OCPCLOUD-3296: Merge https://github.com/kubernetes-sigs/cluster-api-provider-ibmcloud:v0.13.1 (93d5b50) into main #142
OCPBUGS-77728: Updating ose-ibmcloud-cluster-api-controllers-container image to be consistent with ART for 4.22 #151
OCPCLOUD-3322: Update to new manifests-gen #150
NO-JIRA: UPSTREAM: <carry>: Add manifests verify target #145
OCPBUGS-70027: Updating ose-ibmcloud-cluster-api-controllers-container image to be consistent with ART for 4.22 #143
Full changelog

ibmcloud-machine-controllers

OCPCLOUD-3618: Bump k8s 1.36 #100
OCPBUGS-96827: bump golang.org/x/net to v0.57.0 #98
OCPCLOUD-3641: Support configurable boot volume profile, size, IOPS and bandwidth #97
OCPBUGS-87502: Updating ose-ibmcloud-machine-controllers-container image to be consistent with ART for 5.0 #96
NO-JIRA: Update OWNERS #93
OCPCLOUD-3278: Rebase to Kube 1.35 for Machine API Provider IBM #83
OCPBUGS-77729: Updating ose-ibmcloud-machine-controllers-container image to be consistent with ART for 4.22 #80
NO-JIRA: Modernize test infrastructure to align with other MAPI providers #82
OCPBUGS-71220: Bump vpc go sdk #76
OCPBUGS-70030: Updating ose-ibmcloud-machine-controllers-container image to be consistent with ART for 4.22 #74
Full changelog

insights-operator

OCPBUGS-111992: add custom proxy field to insights config #1346
OCPBUGS-112481: Add multicluster gatherer #1349
CCXDEV-16647: add create gatherer skill #1335
NO-JIRA: remove katarina #1336
CCXDEV-16629: Add network policy #1331
CCXDEV-15210: secrets and configmap revisions count gathering #1316
OCPBUGS-98690: Fix indentation bug on livenessProbe #1320
OCPBUGS-96894: Update net and crypto libraries #1321
CCXDEV-16524: gather alertmanager configuration #1322
NO-JIRA: Update misleading docs on the QEMU gatherer #1319
OCPBUGS-78774: kube-rbac-proxy must honor Central TLS configuration #1299
OCPBUGS-85109: move required-scc annotation to pod template in gathering job #1309
OCPBUGS-93805: update HyperShift deployment manifest #1313
CCXDEV-1560: Optimize the CPU usage of insights-runtime-extractor #1220
CCXDEV-16159: controlplanemachinesets gatherer #1294
CCXDEV-16450: document disableRuntimeExtractor config option #1312
Bug OCPBUGS-90497: Remove metadata.namespace from cluster-scoped resources #1307
OCPBUGS-87889: fall back to kube-system/global-pull-secret for Insights token #1302
OCPBUGS-87289: Updating ose-insights-operator-container image to be consistent with ART for 5.0 #1301
CCXDEV-15790: extractor controller #1280
OCPBUGS-85710: add trusted-ca-bundle to gatherin job #1289
CCXDEV-16348: tls metrics #1275
OCPBUGS-77351: fix: add terminationMessagePolicy to runtime extractor containers #1286
NO-JIRA: remove BaiyangZhou from OWNERS #1273
OCPBUGS-85201: Bump google.golang.org/grpc to v1.79.3 #1288
NO-JIRA: Update golang version #1277
NO-JIRA: add write-test claude skill #1274
CCXDEV-15561: Improve test coverage 4 #1226
CCXDEV-15964: fetch TLS profiles from API server #1257
CCXDEV-15963: kubeletconfig gatherer #1247
NO-JIRA: generate gatherer docs #1256
CCXDEV-16094: add config option to disable runtime extractor #1248
CCXDEV-16006: add permission for opentelemetrycollectors #1252
OCPBUGS-78115: Fix string accessor error #1253
OCPBUGS-78115: New Gatherer for OpenTelemetryCollector CRs #1246
OCPBUGS-78251: Updating ose-insights-operator-container image to be consistent with ART for 4.22 #1249
CCXDEV-15992: obfuscation config precedence #1223
MON-4511: Migrate Prometheus targets discovering from Endpoints to EndpointSlices #1225
NO-JIRA: Add CodeRabbit inheritance for org-wide rules #1245
CCXDEV-15829: subscription gathering #1235
CCXDEV-15776: install config update #1229
CCXDEV-15641: gather machineconfig size #1240
NO-JIRA: exclude vendors file from coderabbit review #1243
NO-JIRA: Upgrade Golangci-lint to version 2 #1237
NO-JIRA: enable InsightsDataGather in all clusters #1242
NO-JIRA: add custom coderabbit config #1232
OCPBUGS-66233: Custom Obfuscation unmarshal #1216
CCXDEV-15561: Improve test coverage 3 #1213
NO-JIRA: update on-demand gathering examples #1212
OCPBUGS-65500: reference ClusterRoles in ClusterOperator #1211
CCXDEV-15778: add event logging for operator version changes #1202
CCXDEV-15589: set limit for gathering interval #1171
OCPBUGS-67001: update dataGather status after job deletion #1201
OCPBUGS-66386: [bugfix] The ConfigMap value for StoragePath is ignored on basic routine #1203
CCXDEV-15561: Improve test coverage 2 #1199
OCPBUGS-65582: set Progressing condition on cluster update #1207
CCXDEV-15258: DataGather and InsightsDataGather update to v1 #1159
OCPBUGS-66996: Extends the time for the extractor liveness probe #1198
OCPBUGS-69764: Updating ose-insights-operator-container image to be consistent with ART for 4.22 #1204
CCXDEV-15561: Improve test coverage #1191
Full changelog

insights-runtime-exporter, insights-runtime-extractor

CCXDEV-16674: chore: add clippy linting #87
NO-JIRA: Add new owners required for managing OCP CI config #86
OCPBUGS-87370: Updating ose-insights-runtime-exporter-container image to be consistent with ART for 5.0 #84
OCPBUGS-87473: Updating ose-insights-runtime-extractor-container image to be consistent with ART for 5.0 #85
Update OWNERS to remove ‘tremes’ #67
Optimize the CPU usage of insights-runtime-extractor #60
OCPBUGS-77060: Update Go to 1.25 #63
OCPBUGS-76464: remove dnf cache from the container images #62
chore: Update JBoss EAP 8.1 runtime samples #61
eap 8.1 test fix #57
Full changelog

ironic

NO-ISSUE: Update requirements.cachito with latest openshift forks commits #897
METAL-1931: [5.0] Add cargo for bcrypt rust extensions #900
METAL-1929: Merge upstream 2026 07 31 #875
OKD-421: Fix Dockerfile.scos crypto-policies PQ failure on CentOS Stream 10 #886
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #873
NO-ISSUE: Merge upstream 2026 07 24 #872
NO-ISSUE: Filter blank lines from build-packages-list.ocp in Dockerfile #869
METAL-1912: Add PQC support until we have pqc minimal images available #871
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #867
METAL-1898: Add ironic-prometheus-exporter to update-requirements workflow #866
METAL-1878: [s2i] Move direct dependencies from packages to source #749
NO-ISSUE: Merge upstream 2026 06 11 #854
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #864
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #862
NO-ISSUE: Add –no-index back and remove pip at the end #853
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #855
METAL-1865: Extract wheel-builder build deps to build-packages-list.ocp #852
OCPBUGS-44902: Bump python packaging version and update commit hashes #850
OCPBUGS-87478: Updating ironic-container image to be consistent with ART for 5.0 #851
METAL-1838: Bump setuptools version to align with latest ironic requirements #847
METAL-1844: Add Slack notification to update-requirements workflow #849
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #821
OCPBUGS-83618: Bump sushy to latest #838
NO-ISSUE: Fix update requirements workflow #842
NO-ISSUE: Document how to use gerrit change hash for testing #839
OKD-362: Add watchdog to python-requirements.okd #837
OCPBUGS-82540: Bump pyasn1 to 0.5.1-5 #822
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #818
METAL-1758: Merge upstream 2026 03 16 #814
METAL-1735: Add TLS cipher suite and curves related options to ironic for centralized tls support #810
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #816
METAL-1771: Remove heredoc syntax for hermetic builds compatibility #815
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #812
OCPBUGS-77528: Fix interface detection when MAC/IP matches multiple interfaces #807
METAL-1726: Multi-stage wheel-builder for OCP builds #786
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #808
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #806
METAL-1749: Uplift setuptools to remove python-wheel deps #804
METAL-1748: Drop genisoimage in favor of xorriso #803
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #805
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #801
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #799
OCPBUGS-76935: Bump keystonemiddleware version to 10.9.0-0.20260216145500.557d173 for CVE-2026-22797 fix #790
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #793
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #789
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #784
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #783
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #773
ART-14497: Fix ART builds with -minimal #779
NO-ISSUE: Bump openstacksdk version to 4.9.0 #776
OCPBUGS-74579: fix for minimal builds #772
OCPBUGS-74427: Bump eventlet version to latest bugfix #770
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #768
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #762
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #758
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #757
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #755
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #754
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #751
OCPBUGS-70001: Updating ironic-container image to be consistent with ART for 4.22 #752
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #748
OCPBUGS-65969: Set the tls cacert path to writable mount when the IRONIC_CACERT_FILE is unset #728
Full changelog

ironic-agent

METAL-1931: [5.0] Add cargo for bcrypt rust extensions #305
NO-ISSUE: Update requirements.cachito with latest ironic-python-agent #300
NO-ISSUE: Update requirements.cachito with latest ironic-python-agent #299
NO-ISSUE: Update requirements.cachito with latest ironic-python-agent #297
NO-ISSUE: Update requirements.cachito with latest ironic-python-agent #295
NO-ISSUE: Filter blank lines from build-packages-list.ocp in Dockerfile #292
NO-ISSUE: Update requirements.cachito with latest ironic-python-agent #293
NO-ISSUE: Update requirements.cachito with latest ironic-python-agent #291
METAL-1878: [s2i] Move direct dependencies from packages to source #290
OCPBUGS-94115: Replace individual package removal with a single rpm -e loop #281
NO-ISSUE: Update requirements.cachito with latest ironic-python-agent #267
OCPBUGS-94115: Replace dnf remove with rpm -e to prevent dependency removal #269
NO-ISSUE: Add forgotten –no-index #265
METAL-1870: Split OCP build into multi-stage with wheel-builder #263
NO-ISSUE: Update requirements.cachito with latest ironic-python-agent #264
METAL-1865: Extract OCP build deps to build-packages-list.ocp #262
NO-ISSUE: Update requirements.cachito with latest ironic-python-agent #259
OCPBUGS-87357: Updating ironic-agent-container image to be consistent with ART for 5.0 #261
METAL-1838: Bump setuptools version to align with latest ironic requirements #257
METAL-1844: Add Slack notification to update-requirements workflow #260
NO-ISSUE: Update requirements.cachito with latest ironic-python-agent #255
NO-ISSUE: Update requirements.cachito with latest ironic-python-agent #254
NO-ISSUE: Remove openstack repo workaround #249
NO-ISSUE: Update requirements.cachito with latest ironic-python-agent #253
NO-ISSUE: Update requirements.cachito with latest ironic-python-agent #248
METAL-1779: Add podman package for bootc deploy #247
NO-ISSUE: Fix update requirements workflow #252
NO-ISSUE: Document how to use gerrit change hash for testing #250
NO-ISSUE: Update requirements.cachito with latest ironic-python-agent #246
METAL-1749: Uplift setuptools to remove python-wheel deps #245
NO-ISSUE: Update requirements.cachito with latest ironic-python-agent #243
NO-ISSUE: Update requirements.cachito with latest ironic-python-agent #242
OCPBUGS-74579: fixes for minimal builds #240
NO-ISSUE: Update requirements.cachito with latest ironic-python-agent #238
NO-ISSUE: Update requirements.cachito with latest ironic-python-agent #237
Updating ironic-agent-container image to be consistent with ART for 4.22 #225
NO-ISSUE: Update requirements.cachito with latest ironic-python-agent #223
Full changelog

ironic-machine-os-downloader

OCPBUGS-87375: Updating ironic-rhcos-downloader-container image to be consistent with ART for 5.0 #122
OCPBUGS-77617: Updating ironic-rhcos-downloader-container image to be consistent with ART for 4.22 #115
OCPBUGS-71233: Export TMPDIR to be available to child processes #111
OCPBUGS-69891: Updating ironic-rhcos-downloader-container image to be consistent with ART for 4.22 #110
Full changelog

ironic-static-ip-manager

OCPBUGS-87516: Updating ironic-static-ip-manager-container image to be consistent with ART for 5.0 #60
OCPBUGS-70044: Updating ironic-static-ip-manager-container image to be consistent with ART for 4.22 #56
Full changelog

keepalived-ipfailover

OCPBUGS-99649: Reinstall tzdata if /usr/share/zoneinfo is missing #246
NE-2223: Bump HAProxy to 3.2 in egress DNS proxy #244
NE-2716: Replace iptables with nftables in origin-egress-router #242
NE-2715: Update keepalived-ipfailover to replace iptables with nftables #235
NO-JIRA: Update ipfailover/OWNERS to reflect current NID team #240
ART-20722: Skip PQ crypto-policies setup for CentOS/OKD builds #241
ART-19728: Add Dockerfile.rhel10 #239
OCPBUGS-86911: Updating openshift-enterprise-base-rhel9-container image to be consistent with ART for 5.0 #236
OCPSTRAT-3113: Set DEFAULT:PQ crypto-policies to RHEL9 base image #230
Revert “OCPBUGS-84344: yum.conf: omit docs, weak deps” #234
OCPBUGS-84344: yum.conf: omit docs, weak deps #231
Updating openshift-enterprise-base-rhel9-container image to be consistent with ART for 4.22 #229
OCPBUGS-72552: Updating openshift-enterprise-base-rhel9-minimal-container image to be consistent with ART for 4.22 #220
NO-JIRA: Install gpgme for RHEL/Centos 10 #228
ART-14594: Update Dockerfile for centos 10 base #223
OCPBUGS-76286: openshift-enterprise-base: remove subscription-manager, dbus, systemd #221
OCPBUGS-67357: Updating openshift-enterprise-base-rhel9-container image to be consistent with ART for 4.22 #218
Full changelog

kube-metrics-server

OCPBUGS-93753: Bump openshift/kubernetes-metrics-server to v0.9.0 #71
OCPBUGS-87412: Updating ose-kube-metrics-server-container image to be consistent with ART for 5.0 #69
NO-JIRA: Cleanup OWNERS list #68
NO-JIRA: disable automatic coderabbit reviews #53
OCPBUGS-77817: Updating ose-kube-metrics-server-container image to be consistent with ART for 4.22 #52
OCPBUGS-74012: Updating ose-kube-metrics-server-container image to be consistent with ART for 4.22 #49
: NO-JIRA: Bump openshift/kubernetes-metrics-server to v0.8.1 #50
NO-JIRA: Bump golang image versions #51
OCPBUGS-69952: Updating ose-kube-metrics-server-container image to be consistent with ART for 4.22 #48
Full changelog

kube-rbac-proxy

OCPBUGS-87245: Updating kube-rbac-proxy-container image to be consistent with ART for 5.0 #143
CNTRLPLANE-2932: Merge upstream v0.21.1 #133
OCPBUGS-69716: Updating kube-rbac-proxy-container image to be consistent with ART for 4.22 #129
CNTRLPLANE-882: 0.20.2 downstream #131
Full changelog

kube-state-metrics

OCPBUGS-99282: embed a copy of the timezone database #148
NO-ISSUE: [bot] Bump openshift/kube-state-metrics to v2.19.1 #146
OCPBUGS-87374: Updating kube-state-metrics-container image to be consistent with ART for 5.0 #145
OCPBUGS-85098: [bot] Bump openshift/kube-state-metrics to v2.19.0 #141
NO-JIRA: disable automatic coderabbit reviews #135
OCPBUGS-77616: Updating kube-state-metrics-container image to be consistent with ART for 4.22 #134
OCPBUGS-73993: Updating kube-state-metrics-container image to be consistent with ART for 4.22 #129
OCPBUGS-71224: [bot] Bump openshift/kube-state-metrics to v2.18.0 #130
Updating kube-state-metrics-container image to be consistent with ART for 4.22 #126
Full changelog

kube-storage-version-migrator

OCPBUGS-87255: Updating ose-kube-storage-version-migrator-container image to be consistent with ART for 5.0 #243
OCPBUGS-122387: Update build-machinery-go vendor dependency #260
OCPBUGS-65984: add leader election #237
OCPBUGS-73955: Updating ose-kube-storage-version-migrator-container image to be consistent with ART for 4.22 #236
OCPBUGS-69726: Updating ose-kube-storage-version-migrator-container image to be consistent with ART for 4.22 #235
Full changelog

kubevirt-cloud-controller-manager

OCPBUGS-87345: Updating ose-kubevirt-cloud-controller-manager-container image to be consistent with ART for 5.0 #75
NO-JIRA: Upstream Sync - 2026-01-27 #60
Full changelog

kubevirt-csi-driver

OCPBUGS-87572: Updating ose-kubevirt-csi-driver-container image to be consistent with ART for 5.0 #106
OCPBUGS-92795: Sync upstream 04/30/2026 #97
CNV-82343: Add annotation-based fallback for infra VM node ID resolution (#170) #80
Full changelog

machine-api-operator

OCPBUGS-120320: Compare against oldObject in vSphere failure-domain VAPs #1540
OCPBUGS-85110: Move required-scc annotation to pod template for machine-api-controllers #1511
OCPBUGS-100056: fix: skip Multisubnet test for single network infra #1527
OCPBUGS-99903: Fixing test issue where error result was for other resource type #1524
OCPBUGS-100067: Deduplicate unchanged status upgrade events #1526
CORS-4521: GCP: Add regional permission #1523
OCPCLOUD-3614: bump k8s and openshift deps #1520
SPLAT-2854: Fixing issue related to unintended VAP interactions #1518
SPLAT-2858: Fixing test issue where error result was for other resource type #1522
SPLAT-2813: Create VAP E2Es #1517
NO-JIRA: Bump golang.org/x/net to 0.56.0 to fix CVE #1514
OCPBUGS-87360: Updating ose-machine-api-operator-container image to be consistent with ART for 5.0 #1507
SPLAT-2790: Added new VAP for vSphere infra validation against current cpms and machines #1510
NO-JIRA: fix: honor –stderrthreshold flag when –logtostderr is enabled #1485
OCPBUGS-66940: fix default image for confidential VMs #1443
OCPBUGS-85416: Enable actuators to set terminal failure on Exists and Update #1499
SPLAT-2745: Changed vSphere cloud config to be read from openshift-config-managed #1495
OCPBUGS-82584: Populate status label selector for scale subresource. #1490
NO-JIRA: machine-api-termination-handler: add scc annotation, terminationMessage: FallbackToLogsOnError #1494
NO-JIRA: bump controller-runtime-common to latest main #1493
NO-JIRA: fix: importing nutanix test to in the binary #1491
NO-JIRA: Update OWNERS #1486
OCPCLOUD-3346: tls: use centralized TLS #1456
MON-4497: metrics: migrate Prometheus SD from Endpoints to EndpointSlices #1457
SPLAT-2680: Changed DHA to require hostAffinity=host #1484
OCPCLOUD-3282, OCPCLOUD-3288: Bump to k8s 1.35 dependencies #1474
NO-JIRA: fix flaky TestReconcile/machine_with_node_likely_to_go_unhealthy#1483 #1483
SPLAT-2680: Fixed MAO to not allow dedicated host configurations for control plane nodes #1477
OCPBUGS-77941: Remove cluster-api-provider-libvirt references #1472
OCPNODE-4168: Add image only if its a boot disk #1471
OCPBUGS-44332: Suppress degraded reporting while MAO is actively upgrading. #1464
OCPBUGS-77606: Updating ose-machine-api-operator-container image to be consistent with ART for 4.22 #1468
SPLAT-2615: Added AWS dynamic dedicated host support #1455
OCPCLOUD-3166: Bump openshift/api #1453
OKD-259: Vendor API and add OKD featureset Specific CRDs #1448
SPLAT-2603: Updated AWS dedicated host id validation pattern #1451
OCPBUGS-64937: vsphere - Cache REST API sessions to prevent excessive vCenter logouts #1432
OCPCLOUD-3222: Adds agents.md #1449
OCPBUGS-69862: Updating ose-machine-api-operator-container image to be consistent with ART for 4.22 #1450
Full changelog

machine-config-operator

OCPBUGS-114854: CVE-2026-15792 openshift4/ose-machine-config-rhel9-operator: BuildKit: Denial of Service via malicious client request [openshift-5.0] #6519
OCPBUGS-122284: updateLayeredOS deploy-from-self when skopeo < 1.22.2 #6534
OCPBUGS-114722: crio: drop restore support #6465
OCPBUGS-121651: remove nft chains before checking the ignition config #6511
OCPBUGS-121379: Retry on conflict in syncMachineConfigNodes #6510
OCPBUGS-121850: Fix vsphere network absolute paths #6513
OCPBUGS-115056: limit ContainerRuntimeConfig status condition to 3 #6468
OCPBUGS-116711: Skip vsphere fd-unmatched machinesets for bootimage updates #6484
OCPBUGS-117427: Increase TC-74751 Eventually timeout for vSphere OVA upload #6491
OCPBUGS-116944: Update AMI Whitelist #6490
OCPBUGS-114709: Preserve proxy environment vars #6464
OCPBUGS-115195: fix: adjust fencing validator to match MAC-address based credential secrets #6467
OCPBUGS-114485: Update the MachineOSBuild event and condition functionality to more clearly handle pod failures with retries #6463
OCPBUGS-112790: Revert TNF Graceful node shutdown #6460
OCPBUGS-114389: Use kubernetes scheme in drain controller event recorder #6455
CORS-4441: Bootimage controller should gracefully handle Azure gen1 image removal #6453
OCPBUGS-113615: Azure confidential clusters should be flagged by skew enforcement #6448
OCPBUGS-112447: Increase rpm-ostree rebase retry backoff and preserve error #6425
OCPBUGS-112466: Fix upstreams for CoreDNS pods on Cloud platforms #6429
OCPBUGS-112082: skip proxy for OSImageStream discovery in HyperShift #6423
OCPBUGS-105426: OCPBUGS-105430: OCPBUGS-105431: OCPBUGS-105315: Fix duplicate template error and e2es #6387
OCPBUGS-59197: Fix MOSB image deletion race during MOSC removal #6348
OCPBUGS-83562: Bump kubensmnt dependency and service to v1.3.0 #6051
NO-ISSUE: Add fix TC 63866 failing in CI job #6380
MCO-2256: Drop RHEL8 support #6130
AGENT-1570: update dependencies to the latest after several Feature promotions to default #6393
OKD-419: Add missing variant check for SCOS #6371
OCPBUGS-105432: fix nil pointer panic in IRI controller informer race #6385
NO-ISSUE: Adapt vsphere bootimage tests for mult-vcenter scenarios #6317
OCPBUGS-92062: reduce memory usage in MCC and MCD #6259
OCPBUGS-100433: Update AMI Whitelist #6358
MCO-2275: Part2 Migrate MCO OCB #6340
MCO-1814, MCO-2377: Setup metrics for builds, Add metric to gather how many people are using OCL #6316
OCPNODE-4040: Use single KubeletConfigAccepted condition type with True/False status #5854
OCPBUGS-92182: OCPBUGS-99219: Use providerSpec.Template in vSphere machineset reconciliation #6234
OCPBUGS-99696: Add extension verification failure test cases OCP-89090 and OCP-89095 #6333
MCO-2485: Mark scale-up test as ‘informing’ #6364
OCPBUGS-100458: Adapt bootimage tests for CAPI migration #6363
MCO-1540: Set up events for builds #6252
MCO-2482: Revert “MCO-2470: Disable scale-up test support for AWS and vSphere” #6356
TRT-2875: Revert #6303 “MCO-2205: Make ImageModeStatusReporting MCP count test more resilient on SNO” #6359
MCO-2205: Make ImageModeStatusReporting MCP count test more resilient on SNO #6303
OCPBUGS-98316: Fix SHA idempotency test in nmstate-configuration.sh #6291
OCPBUGS-100389: machine-config-daemon-firstboot: disable ostree fsync during bootstrap #6122
MCO-2275: Part 1 Migrate OCB test cases from openshift-tests-private #6080
NO-ISSUE: test MCC proxy. Refactor TC 52373 proxy test. #6355
MCO-2468: Cache backed OSImageStreams for PIS #6329
NO-ISSUE: Fix setArchitectureAndCheckStatus corrupting multi-label annotations #6347
OCPBUGS-100277: Fix TC 43278 failing when release payload has no MCO commit info #6349
NO-ISSUE: Fix incorrect OSImageStreams log #6338
MCO-2244: Update MCO dependencies to Kubernetes 1.36 #6321
MCO-2470: Disable scale-up test support for AWS and vSphere #6344
NO-ISSUE: fix fencing_validator ocdebug fence dispatch race condition #6341
OCPBUGS-82139: Add control-plane NoSchedule taint support alongside master taint #6313
NO-JIRA: vendor: bump github.com/openshift/api to latest master #6334
NO-ISSUE: Use context instead of discrete signal #6337
OCPNODE-4518: Block runc on RHEL 10 via OSImageURL stream class inspection #6238
MCO-2380: MCO-2381: Expose MachineOSBuild Status Conditions on Paused MachineConfigPools and add E2E Tests for Paused Pool Builds #6282
MCO-2414: Add unit tests for osImageStream #6312
NO-ISSUE: extended tests, restore initial maxUnavailable when modified #6336
OCPBUGS-99695: Add TC 88940- Apply password only if changes exist #6328
NO-ISSUE: add AWS marketplace polarion ID test #6330
MCO-2184: Adapt scale extended tests to support osstreams #6299
CNTRLPLANE-3840: Remove ExternalTopologyMode guard from OSImageStream bootstrap #6308
MCO-2450: Enable OS ImageStreams in OKD #6314
MCO-1333: Validate OCL Containerfiles #6187
NO-ISSUE: Add reusable utilities for image inspection #6327
MCO-1944: Add NetworkPolicy Test case #6283
MCO-2413: Image inspection cache #6306
MCO-1847: adapt tc 52373 to new AWS marketplace feature #6324
MCO-1847: update AWS backdated images in extended tests #6320
CORENET-5972: Add openvswitch-ipsec package into ipsec plugin #4878
MCO-2408: Improve/Reduce code/duplicated logic in OsImageBuilderInNode #6270
MCO-2424: Fix cert rotation timeout #6309
MCO-1990: Irreconcilable configs test suite #6085
OCPBUGS-98745: MCO-2424: add missing RBAC for pkis resource in MCC ClusterRole #6307
MCO-2301: AWS Marketplace bootimage update support #6015
MCO-2407: Move OSImageStream sync to MCC #6278
MCO-2427: move password, bootimages and cpms suites to longduration suite #6302
OCPNODE-4604: upgrade CRIOCredentialProviderConfig to v1 #6220
OCPBUGS-98210: Fix imagestream detection with extra guard #6296
MCO-1997: MCO-2297: Add test for osImageStream #5881
AGENT-1522: bump InternalReleaseImage to v1 (and simply version dependency) #6280
OCPBUGS-98210: Use release payload image for OSImageStream rebuild detection #6284
OCPBUGS-98040: Bump golang.org/x/crypto to v0.54.0 #6286
OCPBUGS-10431: allow worker pools to set staticPodPath by relaxing validation to only block control plane pools #5724
CNTRLPLANE-3212: Enable configurable PKI for cert rotation #5842
NO-ISSUE: Improve osimagestream pkg API #6271
OCPBUGS-92811: Inject proxy into MCC deployment #6237
MCO-2152: MCO-2153: MCO-2154: Create MCO network policies for pods #6151
OCPBUGS-57473: create digest configmap without oc binary #5794
OCPBUGS-95030: Update AMI Whitelist #6253
OCPBUGS-94000: Remove sensitive ControllerConfig logging #6245
NO-ISSUE: Remove dead code #6203
MCO-2393: Use /proc/sys/crypto/fips_enabled for FIPS check in tests #6233
OCPBUGS-59958: move cleanUpDuplicatedMC to avoid double reboot on first updated Master node #6201
OCPBUGS-88333: Fix bootupd workaround in old nodes #6199
OCPBUGS-91982: Bootstrap MCS logging entire ignition #6231
OCPNODE-4443: Add runc upgradeable guard to block upgrades on RHEL 10 streams #5891
NO-ISSUE: Remove stub upgrade test #6224
OCPBUGS-86448: Skip no-op MCN SSA calls #6217
OCPBUGS-87962: Boot image skew check silently passes when MachineSets are reconcile-skipped #6162
OCPBUGS-86826: Make vsphere template updates atomic #6117
OKD-305: Remove migration code(for runc->crun) #5682
OCPBUGS-91746: temporarily remove sandboxed-containers from extensions test #6213
OCPBUGS-91746: Remove sandboxed-containers (kata-containers) from extended-priv tests #6221
MCO-2275: Migrate OS layering tests from openshift-tests-private #6081
MCO-2257: ensure MCO tests pass in both RHEL9 and RHEL10 #6055
OCPBUGS-90092: remove runc from containerruntimeconfig test #6206
OCPBUGS-86181: Update ImageModeStatusReporting MCN property and condition transition tests to be resilient on SNO topology #6107
OCPBUGS-89325: fix test 74644 so that it pass in rhel10 #6198
OCPBUGS-88726: Fix streams in imagemode tests #6195
OCPBUGS-86978: modify tests to use rhel10 as the default stream #6167
MCO-1972: Add test OCP-88202: off-cluster and on-cluster layering implementation #6043
OCPBUGS-87905: Process rebuild annotation on machine-os-builder restart #6160
MCO-2344: Revert MCO-2343 #6185
OCPBUGS-61583: Update custom containerfile OCB test to work in a disconnected environment #6161
OCPBUGS-88315: Automation fix- Add fix for TC 59424 #6173
AGENT-1517: move helpers in iri e2e main test #6159
MCO-2207, MCO-2209, MCO-2213: Migrate security, daemon, and kernel TCs from mco.go #6021
OCPBUGS-68350: In OCB to check when a image is removed the old build is triggered again and the MC should start updating directly and no new MOSB should be triggred #6150
OCPBUGS-74970: Fix kubelet certificate wait loop in criometricsproxy.yaml #6125
OCPNODE-4487: replace –system-reserved flags with config drop-in #6044
OWNERS: update current MCO team members #6165
OCPBUGS-87389: Updating ose-machine-config-operator-container image to be consistent with ART for 5.0 #6152
OCPBUGS-87635: Fix MCP.status.osImageStream #6154
OCPBUGS-87192: Add mco_extensions.go e2e test suite for MCO extension install, enable, and validation #6034
MCO-2343: Temporary make MCO default to rhel-9 #6156
OCPBUGS-86588: vSphere boot image hot loop detection is non-functional due to stable template names #6094
OCPBUGS-85428: Lowercase the start of all error messages #6106
MCO-2208: MCO-2125: Migrate mco registry units #6079
OCPBUGS-86978: adapt osimagestream tests to handle clusters defaulting to rhel-10 #6099
AGENT-1517: avoid running IRI deletion tests for standard e2e IRI tests #6145
AGENT-1531: Remove localhost.localdomain workaround for MCN IRI image field #6146
Fixes OCPBUGS-77140: increase LRU cache and prefetch timeout for PinnedImageSet #6046
OCPBUGS-87014: Remove skopeo-install script #6141
OCPBUGS-86965: make test 69755 more stable #6127
OCPBUGS-86554: Wait for operators after removing master machine #6091
OCPBUGS-85427: Remove trailing newline (\n) characters in klog message strings #6112
MCO-2211: MCO-2210: MCO-2234 MCO-Migrate MCO tests from openshift-tests-private #5902
OCPBUGS-86890: fix: update arbiter crio config #6120
MCO-2296: Remove OSImageStreams v1 replace #6133
MCO-2296: OSImageStreams v1 promotion #6076
AGENT-1526: disable htpasswd auth on IRI registry, keep read-only #6109
NO-ISSUE: Add -L flag to curl to follow redirects automatically #6121
OCPBUGS-86041: update IsSNO helper function to correctly access the cluster’s topology #6110
OCPBUGS-83619: Add version guard for OSStream rendering #6111
NO-ISSUE: Lower IRI deletion log verbosity #6119
OCPBUGS-86179: Update ImageModeStatusReporting MCP machine count tests to be resilient on SNO topology #6089
OCPBUGS-86800: Update AMI Whitelist #6108
OCPBUGS-86671: Fix InternalReleaseImage URL transform #6100
AGENT-1488: Aggregate IRI status from MachineConfigNodes #5841
OCPBUGS-63750: fix Go build tag behavior #5494
OCPBUGS-86474: Tests using realtime kernel should not be limited to a… #6084
OCPBUGS-86332: remove tests using base images older than 4.13 #6077
NO-ISSUE: Update TC-88366 to check osImageStream status after update completes #6078
AGENT-1491: reclaim disk space from the node when IRI resource is deleted #5988
OCPBUGS-86035: Adapt test ‘54922 - daemon: add check before updating kerne… #6056
AGENT-1517: fix iri deletion test #6070
OCPBUGS-83987: Fix CVE-2026-33186 #6065
OCPBUGS-84814: Skip chrony-wait on first node join #5990
MCO-2273: MCO-2215: MCO-2183: Migrate remaining TCs from mco.go to MCO, units, kublet suite #6024
AGENT-1517: disable iri-registry service on IRI delete #6041
OCPBUGS-85237: Manually uncordoned nodes are not automatically re-cordoned #6028
OCPBUGS-15157: Replace wildcard permissions with explicit verbs and resources in MCC ClusterRole #6000
OCPBUGS-65645: Verify extension packages are installed #6010
OCPBUGS-79502: Enable AutoSizingReserved for Hypershift workers #5847
NO-JIRA: daemon: expand os image presence check #6005
MCO-2212: MCO-2213: Migrate mco_observability and mco_daemon test-suite #5875
OCPBUGS-63650: configure-ovs: copy lldp mode to br-ex port #5698
OCPBUGS-85498: BareMetal skew e2e fails patching provisioning CR after CBO webhook fix #6031
OCPBUGS-85497: only check password hash in /etc/shadow #6030
NO-JIRA: Add fix for ossImagestream status #6018
MCO-2025: OCP-88366 and add OCP-88814 for osImageStream with osImageURL #6014
OCPBUGS-83830: Apply password only if changes exist #5889
AGENT-1514: Add ML-KEM verification test for IRI registry #6003
OCPBUGS-84516: Add terminationMessagePolicy to build pod containers #5993
OCPBUGS-85117: Fix 2 flakes happening in the ocl test suite #6004
OCPBUGS-84842: Bootloader update attempt should be conditional #5907
OCPBUGS-75894: use --delete-if-present for karg removal #5914
OCPBUGS-84661: Fix wrong early exit during kubelet MCs regeneration #5898
AGENT-1443: IRI Add certificate regeneration to MCS cert rotation controller #5721
OCPBUGS-84691: prom rules: add alert for nodes using runc #5874
MCO-1908, MCO-2213: Migrate MCD related MCO test-cases #5843
OCPBUGS-84867: Fix OCL test to handle temporarily empty current-machine-os-build annotation #5913
OCPBUGS-84832: daemon: don’t pull/extract extensions for all OS updates #5905
OCPBUGS-84852: Update AMI Whitelist #5910
OCPBUGS-84150: MachineOSConfig “build was not found” error #5878
OCPBUGS-84699: Custom pool booting must handle matchExpressions in nodeSelector #5899
OCPBUGS-84565: Fix CVE-2026-34986 #5890
OCPBUGS-83871: Support bootloader update #5868
OCPBUGS-84332: Fix ssh and password rollbacks #5884
MCO-2222: /automate-test skill for generating e2e tests from specifications #5864
OCPBUGS-84652: Include RootCA in the temporal CC #5896
OCPBUGS-83492: Auto-append :ref suffix to additionalLayerStores in storage.conf #5888
OCPBUGS-83826: deploy-from-self when skopeo < 1.22.2 #5867
OCPBUGS-84490: Bump image build timeout for status reporting test #5886
MCO-2201: Improve /migrate-tests skill: default labels and ordering verification #5879
OCPBUGS-83859: Fix encapsulated IGN version #5872
MCO-1494: Remove monolithic e2e-ocl test suite #5880
AGENT-1449: Add IRI registry authentication support to MCO #5765
OCPBUGS-84218: Fix units rollback if update failure #5876
OCPBUGS-79425: improve JSON unmarshalling for secret decoding #5813
OCPBUGS-83401: add RootCA cert to the sysContextBuilder certs #5861
OCPBUGS-82500: ClusterHostedDNS on AWS/Azure/GCP: Modify Corefile template to better handle empty record types #5844
MCO-2201: Add Claude /migrate-tests command for MCO test migration #5837
MCO-1908: Migrate Kernel related MCO test-cases #5827
OCPBUGS-83539: Update AMI Whitelist #5851
OCPBUGS-78524: Allow enablement of systemd units with existing files #5846
OCPBUGS-82974: Make IRI registry read-only via environment variable #5845
OCPBUGS-81572: order corosync after OVS configuration on TNF clusters #5834
OCPBUGS-83517: Revert ovs increase CPU priority for Open vSwitch Forwarding Unit #5849
OCPBUGS-63152: Fail wait-for-node-ip if primary IP(s) disappear #5350
MCO-2135: Add test for OSStream labeling of Machines, MachineSets, and ControlPaneMachineSets #5814
AGENT-1307: add MCD IRI manager #5807
MCO-2202: separate duplicate PinnedImageSet validation into OCP-88562 #5839
MCO-2163: adds machine-config-osimagestream installer helper #5770
OCPBUGS-69936: ovs: increase CPU priority for Open vSwitch Forwarding Unit #5797
MCO-1972: Removes OSImageURLConfig from the build controller #5424
Reapply “MCO-2120: Rework OS Image Stream label classification” #5767
OCPBUGS-68336: When adding new nodes, MCD executes commands after setting the nodes’ state as Done #5832
AGENT-1416: Add default NodeDisruptionPolicy for IRI #5683
NO-ISSUE: Fix order of cleanup to further avoid race #5826
MCO-2183: migrated configdrift, kubeletconfig, containerruntimeconfig… #5818
OCPBUGS-78154: Use HA leader election defaults for MCO on SNO #5764
OCPBUGS-78498: Update skew error message with doc links #5825
MCO-2168: Deleting a PinnedImageSet does not affect images pinned by another PinnedImageSet #5786
NO-ISSUE: In extended tests, disable Skew when disabling the bootimag… #5811
MCO-2171: Move long running boot image tests to MCO’s disruptive suites #5808
NO-ISSUE: Fix MCN Applied condition checks for TP and non-TP clusters #5796
OCPBUGS-80970: MCS fallback to latest v3 #5816
AGENT-1366: Report InternalReleaseImageController errors in IRI status #5803
OCPBUGS-62619: Add etcd size limit validation for rendered MachineConfigs #5729
MCO-2155: Add stream detection to some more boot image tests #5799
MCO-2167: Migrate alert test cases from the private repository #5781
OCPBUGS-78500: Skew enforcement should dynamically handle baremetal clusters #5768
OCPBUGS-79088: OCPBUGS-79357: Skip boot image updates until cluster is stable #5789
OCPBUGS-79361: Update AMI Whitelist #5788
NO-ISSUE: Update AMI collection script for installer changes #5790
OCPBUGS-75200: set default-timeout-stop to 200s globally #5782
MCO-2155: Add stream detection to boot image tests #5784
NO-ISSUE: Revert “extract oc binary from base OS image after build” #5785
OCPBUGS-66104: Fine tune CoreDNS pod configuration to improve performance #5695
MCO-2117: Allow default OSImageStream overrides #5714
OCPBUGS-78595: Fix log substring matching for disruptive test suite jobs #5769
OCPBUGS-74223: Re-order logger setting to eliminate race condition #5691
MCO-2146: do not use OSImageStream in Hypershift #5750
NO-ISSUE: always build golangci-lint from vendor #5772
OCPNODE-3201: Default Enablement of system-reserved-compressible in OpenShift #5408
OCPNODE-3880: Add criocredentialproviderconfig event handler #5487
OCPNODE-4074: Add additional storage configuration support for CRI-O #5666
NO-ISSUE: Increase timeout + interval for OCL test cleanup #5732
MCO-2151: Add stream detection to the boot image controller #5752
NO-ISSUE: Allow setting kubeletconfig log level to zero #5757
OCPBUGS-57473: extract oc binary instead of pulling OS image #5313
OCPBUGS-78107: Disable sandboxed-containers in arm64 10 #5754
MCO-2007: MCO-2096: MCO-2095: MCO-2011: Update MCO dependencies to Kubernetes 1.35 #5603
NO-ISSUE: remove boot image e2es from mco suite #5760
OCPNODE-4049: Revert “OCPNODE-3173: Disable OCI artifact mount by default.” #5687
OCPBUGS-74513: OCPBUGS-74519: Remove MachineConfigNodes and PinnedImages feature gates #5609
OCPBUGS-75869: kubelet: Less aggressive low memory reservation #5716
MCO-2136: Implement osImageStream inheritance for custom MCPs #5697
OCPBUGS-77839: Fix node degrades due to file and OS update failures #5744
MCO-2147: Remove all remaining hardcoded references for TLS configuration #5747
MCO-2145: Disable skew enforcement on SNO clusters #5739
MCO-2138: migrate multi-stream test cases from the private tests repo… #5701
OCPBUGS-77625: Update ose-machine-config-operator-container image to be consistent with ART for 4.22 #5730
OCPBUGS-77803: Update AMI Whitelist #5740
MCO-2025: Add functionality to populate OSImageStream value in MCP status #5689
AGENT-1424: Fix e2e iri tests #5717
OCPBUGS-77498: Fix failure domain matching during vsphere boot image updates #5723
MCO-2141: dont execute tls tests until OCPBUGS-76990 is fixed #5713
OCPBUGS-74514: OCPBUGS-74515: OCPBUGS-74516: OCPBUGS-74517: remove bootimage update feature gates #5718
OCPBUGS-77483: Update AMI Whitelist #5719
CORENET-6738: Remove lingering references to openshift-sdn #5591
NO-ISSUE: Increate timeout for sharded ocl test #5696
OCPBUGS-77318: Clean up vsphere login error logging #5702
NO-ISSUE: Revert “MCO-2120: Rework OS Image Stream label classification” #5703
MCO-2124, MCO-2125: migrate units and storage test cases #5660
NO-ISSUE: Create timeout per resource to clean up #5676
MCO-1870: Split MachineConfigNodeUpdateFilesAndOS condition into MachineConfigNodeUpdateOS and MachineConfigNodeUpdateFiles #5411
MCO-1803: Add test case: CPMS interaction with automatic skew #5661
MCO-2032: Avoid MCPs duplication at install time #5518
MCO-2131: Break e2e-ocl test suite into 2 #5669
MCO-2120: Rework OS Image Stream label classification #5650
OCPBUGS-24003: mcd_config_drift not working properly #5632
MCO-2035: Add a prometheus alert to indicate scaling risk #5615
MCO-2036: Enable boot image updates by default for vsphere and Azure #5583
OCPNODE-3880: bump openshift/client-go #5663
OCPBUGS-76444: pkg/daemon/update: Remove kernel-rt-kvm #5654
MCO-2110: Migrate security tests #5621
OCPNODE-3880: Bump openshift/api #5655
OCPBUGS-23418: Machine-config controller should not log about non-existent pull-secret changes #5625
OCPBUGS-76450: reduce MCO image size #5644
NO-ISSUE: Fix cleanup verification timeouts in e2e-ocl tests #5652
OCPBUGS-74692: Write all units when forcefile exists to recover from systemd unit config drift #5612
OCPBUGS-63699: Remove MCD liveness probe #5623
MCO-1984: Add Component Readiness tests for boot image skew enforcement #5547
TRT-2543: Revert #5586 “MCO-2065: Move systemctl execs to dbus calls” #5638
OCPBUGS-75916: crio: disable short_name_mode until we introduce ctrcfg api for it #5628
NO-ISSUE: Make TestImagePrunerErrors flexible to registry behavior changes #5613
OCPEDGE-2216: feat: increase reserved memory for tnf masters #5592
MCO-2065: Move systemctl execs to dbus calls #5586
NO-ISSUE: Fix-up AMI update script to work from CI image #5626
NO-ISSUE: Update AMI script and list #5616
MCO-1877: MCO-1879: MCO-1882: MCO-1884: Implement boot image skew enforcement MVP #5428
MCO-1924: MCO-500: Migrate direct runGetOut() to use CommandRunner in the MCD #5546
NO-JIRA: Fix OSImageStream validating admission policies for OKD #5618
MCO-1953: Refactor functionality to grab machines by state for calculating MCP status #5541
OCPBUGS-20561: machine-config-daemon: openshift: Exposure of Sensitive Data in Log Files in the Machine Configuration Daemon. [openshift-4] #5601
MCO-2090: migrate nodedisruptionpolicy tests from the private reposit… #5602
NO-JIRA: Pass TAGS argument to the machine-config-controller image build #5611
AGENT-1395: IRI followup changes #5562
AGENT-1424: Add e2e test for IRI deletion #5608
MCO-2088: Remove wasm extension #5598
OCPBUGS-72555: Restrict CPMS boot image configuration to only AWS, GCP and Azure platforms #5540
NO-ISSUE: Add bootstrap e2e guide #5604
NO-ISSUE: CPMS test should account for skew API #5599
OCPBUGS-74368: Stale operator metrics Service and ServiceMonitor resources need to be deleted #5593
MCO-2059: migrate machineconfignodes from private repo #5589
OCPBUGS-58023: Prevent unnecessary systemd unit disable #5582
NO-ISSUE: Fix e2e ocl intermittent failures #5595
MCO-1182: migrate private test case OCP-87023 #5587
AGENT-1424: add initial e2e tests for the InternalReleaseImage controller #5588
AGENT-1412: Prevent deletion of InternalReleaseImage when in use #5545
OCPBUGS-71238: Consider image mirrors for OSImageStream fetching #5560
NO-ISSUE: Fix Failure Status condition to True when kubeletconfig or container runtime config validation fails #5542
OCPBUGS-62295: Shorten HAProxy timeouts #5312
MCO-2055: migrate bootimages tests #5551
Revert “OCPBUGS-58023: Prevent unnecessary systemd unit disable” #5576
OCPBUGS-73802: Fix up bootstrap-e2e #5563
MCO-2028: Add target OS version detection #5556
NO-JIRA: bump openshift/client-go #5500
NO-ISSUE: Fixes the issue in the test TestKubeletConfigMaxPods when AutoNodeSizing is enabled by default #5555
OCPBUGS-72396: use D-Bus API to list systemd units #5537
OCPBUGS-56717: enable nodeip-configuration for platform external #5475
CORS-4208: set default KUBELET_NODE_IPS for dualstack nodes #5384
OCPBUGS-72553: CPMS boot image config should not override standard MachineSet configuration #5539
OCPBUGS-67229: Set NodeDegraded MCN condition when node state annotation is set to Degraded #5509
OCPBUGS-58023: Prevent unnecessary systemd unit disable #5527
AGENT-1411: fix IRI registry setup file #5543
OCPBUGS-71189: Configure proxy from ControllerConfig #5538
MCO-2047: migrate scale tests from private repository to MCO repository #5533
MCO-650: Implement custom pool booting #5361
MCO-2049: Validate MCP osImageStream reference #5535
NO-ISSUE: Add README for MCO Operator disruptive e2e tests #5522
MCO-2037: Fix timeout during configMap cleanup #5529
AGENT-1411: Preload the registry image when starting the iri-service #5514
NO-JIRA: kubelet: drop pod-infra-container-image usage #5460
OCPBUGS-70259: Enable existing units without content #5520
MCO-2018: Move operator metrics into the controller #5498
MCO-2033: Refactor bootstrap dependency handling #5519
OCPNODE-3973: Default CPU/Memory changes to Workers - AutoSizingReserved #5491
OCPBUGS-69910: Bump OpenShift builder images to 4.22 #5512
OCPBUGS-69674: Skip boot image updates if arch annotation is not found #5508
MCO-1961: Integrate OSImageStream into MCP and sync logic #5476
MCO-2006: Migrate pinned images sets private test cases #5466
OCPBUGS-66209: clusteroperator/machine-config blips Degraded=True in CI jobs #5465
MCO-2015: Use an event based queue in the boot image controller #5479
MCO-1016: Only update when there is an actual controller change #4742
MCO-1961: Rework MC’s OSImageURL merge logic #5488
OCPBUGS-62984: MCP is not correctly degraded when a pivotError happens #5492
OCPBUGS-62828: MCO degraded when an empty pull-secret is configured #5486
AGENT-1391: Use TLS cert for the InternalReleaseImage registry #5483
OCPBUGS-66420: Revert “Default Enablement of Auto Sizing Reserved in OpenShift 4.21” #5489
And 3 elided commits (e.g. from squash or rebase merges)
Full changelog

machine-image-customization-controller

NO-ISSUE: update BMO #183
OCPBUGS-87512: Updating ose-image-customization-controller-container image to be consistent with ART for 5.0 #178
METAL-1730: Add stream selection for multi-version support #175
METAL-1720: Add kernel file support for multi-architecture PXE boot #170
OCPBUGS-77840: Return error when network data Secret lacks nmstate key #169
OCPBUGS-77737: Updating ose-image-customization-controller-container image to be consistent with ART for 4.22 #167
OCPBUGS-76461: Clean up dnf cache to reduce container image size #162
OCPBUGS-22175: Add IPA messages for console and SSH login #158
NO-ISSUE: Add AGENTS.md and CLAUDE.md #156
OCPBUGS-70040: Updating ose-image-customization-controller-container image to be consistent with ART for 4.22 #155
Full changelog

machine-os-images

OCPBUGS-86888: Add IDMS mirror support for disconnected aarch64 ISO extraction #108
NO-ISSUE: OWNERS: Remove me #78
OCPBUGS-87871: Add support for hermetic builds via Cachi2 prefetched CoreOS ISOs #95
OCPBUGS-87356: Updating ose-machine-os-images-container image to be consistent with ART for 5.0 #91
METAL-1730: Add stream symlinks for multi-stream support #83
OCPBUGS-85476: Force rebuild for OCP 5.0 #87
METAL-1786: Include RHEL10 in image #82
METAL-1729: Add dual CoreOS version support for RHCOS 9 and 10 #81
OKD-322: Swap uname -p to uname -m #80
METAL-1720: Add aarch64 symlinks for initramfs #79
NO-ISSUE: Run fetch_image with tracing #68
OCPBUGS-69857: Updating ose-machine-os-images-container image to be consistent with ART for 4.22 #76
NO-ISSUE: Add AGENTS.md file #75
Full changelog

metallb-frr

OCPBUGS-104452: Fix TLS ciphers for MinVersion=1.3 #135
OCPBUGS-87384: Updating ose-frr-container image to be consistent with ART for 5.0 #134
OCPBUGS-85711: Sync 2026-05-27 #132
Bump to frr 10 #127
OCPBUGS-82973: Sync 25-3-2026 #128
OCPBUGS-69901: Updating ose-frr-container image to be consistent with ART for 4.22 #116
CNF-20883: Downstream merge 2025-12-30 #118
Full changelog

monitoring-plugin

OCPBUGS-114748: [release-5.0] DOMPurify: Cross-Site Scripting via IN_PLACE sanitization #1265
NO-JIRA: Add dchromik to observability-ui aliases #1232
OU-1423: fix: adjust perses mui theme to patternfly glass mode #1198
OU-1409: [release-5.0] : include the legal disclaimer in the alert actions to agentic runs #1193
OLS-3921: disable button shrink #1191
NO-JIRA: remove cypress/ imports #1146
OU-1107, OU-1108: ACM alerting UI with alerts and perses #1143
OBSINTA-1505: improve OLS timeseries Cypress test stability #1122
NO-JIRA: remove helm chart #1126
OU-1486: feat: add art dockerfile #1117
OCPBUGS-98488: security: fix js-yaml vulnerable version #1115
NO-JIRA: feat: add renovate configuration #1113
OCPBUGS-104374: upgrade go stdlib and patch vulnerabilities #1111
OU-1409: fix: remove deprecation in favor of k8sListItems to fetch agentic runs #1110
OU-1466: swap dashboard-list-page to use shared table setup #1109
NO-JIRA: don’t filter silences based on namespace in acm #1108
OCPBUGS-98877: fix: upgrade linkify-it #1104
OU-1389: remove default features from plugin-backend #1078
OU-1240: Makefile and package.json to enable test-frontend-ci #1091
OU-1389: add OWNERS_ALIAS and feature based OWNERS files #1083
OU-1389: update devspace setup #1073
NO-JIRA: build(deps-dev): bump websocket-driver from 0.7.4 to 0.7.5 in /web #1084
OU-1389: Remove Shared Dashbaords Components #1077
OBSINTA-1290: fix incident detection test selectors #1022
OU-1240: Dockerfile.test permission #1076
OU-1240: increasing node options memory #1069
OCPBUGS-92067: graph redirect query parameter #1067
OU-1389: add styleguide and file-naming rules #1065
OU-1389: Update Import Linting #1062
OU-1389: move components and utils into shared locations #1056
OU-1389: don’t match on feature_* webpack bundles #1061
OU-1389: update documentation with new frontend folder structure #1055
OU-651: Fix AlertRules page to display user defined loki alerts #1054
OU-1389: restructure folders #1038
OU-1409: Match new ols routing and names #1052
OU-1409: feat: align proposal url with ols detail view, check multiple namespaces for proposals #1044
OU-1389: swap monitoring-plugin to be feature driven #1034
OBSINTA-1006: Add UI performance benchmarks for Incidents page #873
NO-JIRA: fixing unit-test severity sort, variable template regex, and test corrections. #1035
Fix for OCPBUGS-94056: CVE-2026-13676 #1032
NO-JIRA: feat: keep current data while loading new data in perses dashboards #1020
NO-JIRA: enable coderabbit on main-alerts-management-api #1021
OU-1409: feat: fetch lazily ai proposal for each row in the alert list #1014
NO-JIRA: perses and monitoring automation testing - stabilization #924
NO-JIRA: fix: update vulnerable dependencies #1015
OU-1396: fix: use replace to set variables to avoid navigation trap #1013
OCPBUGS-85473: fix: escape regex variable values in regex matcher contexts #1010
OBSINTA-1290: Incident Tests Stability #887
OBSINTA-1358: Fix COO_BUNDLE_IMAGE install path in Cypress Tests. #994
OU-1384: Add missing prop types #1004
OU-1384: allow test cases to log to console #1002
OBSINTA-1397: fix(perses): fall back to metadata.name when dashboard display name is missing #998
OU-1384: add displayNames to components missing them #1003
OU-1384: remove global eslint disables #995
OCPBUGS-87980: build: fix fast-uri vulnerable dependency #971
OBSINTA-1387: add OLS add-to-dashboard e2e test #996
OBSINTA-1387: add COO-LightSpeed show_timeseries e2e test #985
OU-1404: prevent re-entrant effect loop in ExternalPanelAddition #991
OCPBUGS-87485: Updating monitoring-plugin-container image to be consistent with ART for 5.0 #972
OBSINTA-1358: add operator-sdk to Cypress test runner image #966
OU-1399: pass ISO string to Timestamp component for valid date rendering #968
OU-1275: remove byte order mark from dashboard text #960
COO-1776: fix: throw error for unsupported dashboard level datasources #948
OU-1269: Update monitoring-console-plugin for 4.22 #923
OU-1281: show disabled project bar while loading #936
OU-1351: prevent namespace and project desync #933
OU-1315: reset queries when namespace changes in dev perspective #932
OU-1348: fix: panel actions index so they are visible on click #928
OU-1347: fix: avoid throwing error to fallback to global datasource #920
OU-1203: upgrade perses dependencies #914
NO-JIRA: Revert “NO-JIRA: Bump to 4.22.0-prerelease.3 SDK” #915
NO-JIRA: Bump to 4.22.0-prerelease.3 SDK #903
OU-1323: Refactor dashboards state to prevent desync #912
OU-1341: pass label values to the filter #913
OU-1091: swap monitoring-plugin to use DataView #911
NO-JIRA: update perses and fix vulnerable dependencies #900
TRACING-6030: add RouterProvider to support links in Panels #891
OU-1217: perses customizable dashboards with perses global datasources for tempo and loki #877
OU-1307: don’t fight console to setActiveNamespace #880
NO-JIRA: re-enable get CSRF token #876
OU-1264: mcpToolUI basic implementation for OpenShift Lightpseed + obs-mcp + Perses #797
NO-JIRA: breaking changes follow up #875
OU-1175: OCP 4.22 Breaking Changes #863
OCPBUGS-81567: fix: re encode params when redirecting from graph to query-browser #869
OU-1184: lint enabled against cypress files and changes post coo #862
NO-JIRA: automation testing fix on podImage #868
NO-JIRA: exclude @xfail tests from CI incident commands #865
OBSINTA-1002: consolidate COO 1.4.0 test case documentation #793
NO-JIRA: podImage fix automation testing to remove extra click #864
OBSINTA-993: Tests for incident detection coo 1.4.0 changes #857
OCPBUGS-77113: feat: re enable dev console views #831
NO-JIRA: Incident Detection Tests Stabilization #854
NO-JIRA: switch to core platform page before test case run #837
NO-JIRA: Refactor cypress setup and operator commands #788
NO-JIRA: Add test configuration scenarios overview #745
NO-JIRA: add golangci-lint #835
OCPBUGS-78369: fix for CVE-2025-69873 #834
NO-JIRA: Add CodeRabbit inheritance for org-wide rules #822
OU-1247: Followup Persist TimeRange in Main #827
OU-1242: dont autofill rename #820
COO-1562: fix coo namespace issue #804
OCPBUGS-77718: Updating monitoring-plugin-container image to be consistent with ART for 4.22 #803
NO-JIRA: simplify dockerfile by removing cachito dependencies #799
OU-1162: perses automation testing - import dashboard and rbac #794
OU-1236: Kebab icon should be disable while “Checking permissions” is happening #783
NO-JIRA: fix radius of button groups #784
OU-1234: perses automation testing - rbac users scenarios added with project selector #781
OU-1139: feat: allow to import and migrate a dashboard #779
OU-1214: [Edit Dashboard] - Time range is not persisted when saving #778
OU-1195: List OCP namespaces in Create Dashboard ProjectSelector #765
OU-1231: customizable dashboards automation testing fixes after merge to main #771
NO-JIRA: Init Coderabbit config #770
OU-1189: automation for kebab management actions for perses dashboards #757
COO-1562: update acm alerting UI test case #753
OBSINTA-1063: Add incidents e2e command #740
OU-1213: IncidentPage add error state #750
OU-1062: feat: mark alert menu active for incidents tab #754
OU-1205: feat: force rounded dates for consecutive intervals #748
OU-915: create dashboards and rbac #746
OU-1039: add info alert to the Incident page #741
NO-JIRA: fix: update vulnerable dependencies #742
COO-1515: add the cluster-health-analyzer feature #736
OCPBUGS-72604: remove top level dispatch into useEffect #730
NO-JIRA: monitoring testing - metrics - ungraphable for periodics #731
OU-1134: edit perses dashboards automation testing #712
OU-1122: reuse existing handler to set alerts table data #690
NO-JIRA: fix: remove unnecessary package.lock #728
OCPBUGS-70014: Updating monitoring-plugin-container image to be consistent with ART for 4.22 #708
OBSINTA-1062: custom cluster-health-analyzer builds #720
NO-JIRA: metrics automation failing only in periodics - fix click and type timespan #725
NO-JIRA: fix esbuild optional dependencies for cross arch builds #721
OCPBUGS-70314: fix: update qs vulnerable dependency #715
NO-JIRA: metrics automation testing for presubmit and periodic #716
NO-JIRA: feat: use esbuild-loader, add push manifest command to makefile #713
OU-1064: list perses dashboards automation testing #711
NO-JIRA: monitoring automation fixing Core platform change #709
OU-632: Split ALERTS query_range into several requests for Incidents #678
OU-1082: claude slash commands cypress-setup and cypress-run #673
OU-1074: feat: add backport claude command #691
OU-1088: remove random multiplication #696
OU-1073: chore: add contributing guide #694
NO-JIRA: automation - dev user scenarios fixes with namespace level changes #692
OBSINTA-853: Cypress Incidents Remove Flaky Tag #688
OU-1081: allow claude-code to build-images #686
OU-1123: alerts chart in Incidents - set the container height same as char… #689
OBSINTA-858: [Incidents] Commands for AI-Assisted Development of Cypress Tests #621
OBSINTA-853: Incident tests CI: Incorrect MP namespace + Race Condition in Closing Guide Tour #679
OCPBUGS-68373: fix: upgrade node-forge vulnerable dependency #681
NO-ISSUE: expose argument’s default values #665
NO-JIRA: automation monitoring testing stabilization flaky scenarios #684
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

multus-admission-controller

OCPBUGS-104355: [release-5.0] Bump golang.org/x/net to 0.58.0 to fix CVE-2026-33814 #126
NO-JIRA: Remove TLS min version validation for OpenShift profile compatibility #122
CORENET-7103: Add TLS configuration CLI flags #121
OCPBUGS-87456: Updating ose-multus-admission-controller-container image to be consistent with ART for 5.0 #119
OCPBUGS-85053: Bump Go version to 1.25.0 for ML-KEM/PQC support #115
OCPBUGS-74025: Updating ose-multus-admission-controller-container image to be consistent with ART for 4.22 #114
OCPBUGS-69968: Updating ose-multus-admission-controller-container image to be consistent with ART for 4.22 #113
Full changelog

multus-cni, multus-cni-microshift

OCPBUGS-120678: [Release 5.0] Cherry-pick fix for restoring conflist CNINetworkConfigList fast path and fix cached DEL without load cost #349
OCPBUGS-114733: [release-5.0] Revert “Sort DeviceIDs in GetPodResourceMap for deterministic ordering” #348
OCPBUGS-86046, OCPBUGS-94044: DS Merge 07/24/2026 #335
CORENET-7233: Update OWNERS file #304
OCPBUGS-83863: Simplify Dockerfile to rhel9-only build #285
CORENET-6886: downstream sync to kube 1.35 and go to 1.25 #281
OKD-322: Update Dockerfile to work on CentOS/RHEL 10 #275
CORENET-6864: Ds merge 3/3/2026 #280
Full changelog

multus-networkpolicy

OCPBUGS-104353: [release-5.0] Bump golang.org/x/net to 0.57.0 to fix CVE-2026-33814 #121
CORENET-7235: Update OWNERS file #116
OCPBUGS-87264: Updating ose-multus-networkpolicy-container image to be consistent with ART for 5.0 #117
CNF-21001: Remove iptables compatibility commits #108
downstream sync 2026-02-23 #97
ds: disable DependaBot downstream #96
OCPBUGS-77537: Updating ose-multus-networkpolicy-container image to be consistent with ART for 4.22 #101
OCPBUGS-76465: Clean up dnf cache #99
OCPBUGS-77019: Disable metrics server #98
CNF-21001: downstream: Transition to nftables backend #77
OCPBUGS-69727: Updating ose-multus-networkpolicy-container image to be consistent with ART for 4.22 #83
Full changelog

multus-route-override-cni

OCPBUGS-83863: Remove rhel8 build stage #78
Full changelog

multus-whereabouts-ipam-cni

OCPBUGS-104367: [release-5.0] Bump go to 1.25.11 and golang.org/x/net to 0.58.0 to fix CVE-2026-33814 #421
OCPBUGS-83863: Drop rhel8 builds, strip debug info #405
Full changelog

must-gather

OCPBUGS-123521: Add windows_exporter log collection #566
OCPBUGS-122387: Update build-machinery-go vendor dependency #564
OCPBUGS-113491: REDUCE_LOGS=compress_logs compresses large must-gather logs before rsync #561
OCPBUGS-87538: Updating ose-must-gather-container image to be consistent with ART for 5.0 #553
MG-247: collect imagedigestmirrorsets and imagetagmirrorset resources #538
OCPBUGS-85052: feat: add pacemaker resource to mustgather #556
OCPBUGS-86136: Add InternalReleaseImage to gather #552
no-jira: collect OS Image Stream resource #533
CNV-41714: Add a collector for basic virt related data #539
no-jira: chore: address the linting issues in the scripts #525
MG-246: remove redundant oc inspect command and unused resources #537
MG-241: Adding support for skipping rotated logs #536
no-jira: build(make): default podman flags for ART DNF wrapper #535
no-jira: docs: add proposal for e2e #526
RFE-8344: Add Node Feature Discovery Operator collection script #508
RFE-8932: Included object size with the object count #527
OCPBUGS-77832: Updating ose-must-gather-container image to be consistent with ART for 4.22 #528
NO-JIRA:gather_ppc: detect NTO image from TuneD pods on HCP #518
no-jira: chore: ensure scripts are properly formatted #524
no-jira: test: add basic UT for collection-scripts #521
OSSM-11290: Collect Istio ZTunnel resources #511
OCPBUGS-70064: Updating ose-must-gather-container image to be consistent with ART for 4.22 #519
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

network-interface-bond-cni

OCPBUGS-83863: Remove rhel8 build stage #122
NO-JIRA: Sync from k8snetworkplumbingwg/bond-cni master (2026-07-07) #121
NO-JIRA: Update OWNERS: remove zshi-redhat #120
OCPBUGS-87460: Updating ose-network-interface-bond-cni-container image to be consistent with ART for 5.0 #118
NO-JIRA: Sync upstream k8snetworkplumbingwg/master (2026-05-19) #117
NO-JIRA: Openshift Only - update owners file #111
NO-JIRA: Fix diverged git histories via upstream merge #108
Full changelog

network-metrics-daemon

OCPBUGS-101707, OCPBUGS-104373: Fix CVE for ose-network-metrics-daemon #148
OCPBUGS-87459: Updating ose-network-metrics-daemon-container image to be consistent with ART for 5.0 #144
OCPBUGS-74026: Updating ose-network-metrics-daemon-container image to be consistent with ART for 4.22 #141
OCPBUGS-69971: Updating ose-network-metrics-daemon-container image to be consistent with ART for 4.22 #140
Full changelog

network-tools

NO-JIRA: Add members to script #183
OCPBUGS-87549: Updating ose-network-tools-container image to be consistent with ART for 5.0 #182
NO-JIRA: Add new member #179
NO-ISSUE: Add myself back to the bug script #177
NO-JIRA: Add mattedallo, marty-power, taanyas as reviewers #172
NO-JIRA: Refresh list of team members #176
NO-JIRA: Updates to handle changes after migrating to Atlasian cloud #174
NO-JIRA: Image slimming #154
OCPBUGS-77809: Updating ose-network-tools-container image to be consistent with ART for 4.22 #173
NO-JIRA: Comment submariner team members until they’re ready for OVNK bugs #171
OCPBUGS-70066: Updating ose-network-tools-container image to be consistent with ART for 4.22 #170
Full changelog

networking-console-plugin

OCPNETUI-78: Remove unused Dockerfile.art #517
OCPNETUI-78: Sync Dockerfile and Dockerfile.art #495
OCPBUGS-112661: Marked strings for i18n in NetworkPolicies list page #479
chore(i18n): add Cursor Memsource skill and peer usage guide #466
IP address & Adapter model columns #465
OCPNETUI-58: Add Health and Backend health columns to Services and Routes list pages #457
OCPNETUI-38: Virtual Machines tab on NAD/UDN/CUDN detail pages #442
OCPNETUI-21, OCPNETUI-25: made form for creating services #453
OCPBUGS-92033: fixed translations of pod column titles #436
OCPBUGS-42124: Fix ‘model does not exist’ error when enabling MultiNetworkPolicies #434
OCPBUGS-87477: Updating networking-console-plugin-container image to be consistent with ART for 5.0 #427
OCPBUGS-81271: Trim subnet input in UDN creation form #425
OCPBUGS-54248: Fix empty state Create button links #423
CNV-61064: [UDN] Add condition column to the list page #421
Align PatternFly dependencies with resolutions in Console main branch #420
CONSOLE-5218: Add project documentation and rewrite README #417
CNV-74110: new translations #404
Update dependencies for upcoming Console 4.22 release #371
OCPBUGS-83638: CVE dependency remediation #379
Bump lodash from 4.17.23 to 4.18.1 #366
OCPBUGS-70285: Upgrade cypress to v15 to fix CVEs #345
OCPBUGS-78542: Remove useHistory and replace with useNavigate #364
CNV-81752: Fix runtime error when clicking “Create Route” #363
OCPBUGS-74912: Fix namespace resolution and resource path for Routes and Services list pages #362
OCPBUGS-77868: Clean up cruft in /var/cache/dnf #360
OCPBUGS-77174: Fix display of NAD type for NADs created from YAML #358
OCPBUGS-77414: simplify dockerfile by removing cachito dependencies #356
CNV-59877: Fix permissions request for NADs #352
OCPBUGS-41199: Fix NAD creation using default namespace instead of selected one #348
Remove yarn references from ART Dockerfile #347
CNV-78079: remove Virtual machine networks page #344
CNV-78079: Virtual machine networks page - Other types tab #335
CNV-78079: Virtual machine networks - deletion #343
CNV-78079: Virtual machine networks - details page updates #333
CNV-77540: fix Enable MultiNetworkPolicies lead to invalid URL #339
CNV-78194: update PatternFly to 6.4.0 to align with Console main #336
CNV-70790: Navigation to Project Mapping Before Network Definition Com… #338
CNV-69219: New translations #337
CNV-78079: Virtual machine networks - list updates #329
OCPBUGS-74423: Migrate to npm #331
CNV-77547: add “Make this network available for all projects” option to Virtual machine network Wizard #328
CNV-76711: Remove @openshift-console/plugin-shared package #327
CNV-76879: Allow passing the physical network name via URL parameter in the VM network wizard #326
CNV-76435: CUDN breadcrumb link to page with Project selector #325
OCPBUGS-73548: remove whitelist for allowlist #321
CNV-75831: list all NetworkPolicies in “All projects” #313
CNV-76277: Fix name generator with unprofessional names #315
OCPBUGS-70000: Updating networking-console-plugin-container image to be consistent with ART for 4.22 #312
CNV-76211: Remove deprecated badge from localnet #314
CNV-74685: Fix vm network edit modal #311
CNV-74687: Fixing the title and redirect when deleting a vm network #307
CNV-72230: fix networking links #309
And 3 elided commits (e.g. from squash or rebase merges)
Full changelog

nutanix-cloud-controller-manager

OCPBUGS-87463: Updating ose-nutanix-cloud-controller-manager-container image to be consistent with ART for 5.0 #69
NO-JIRA: Update OWNERS #61
OCPCLOUD-3272: Merge https://github.com/nutanix-cloud-native/cloud-provider-nutanix:main (9c374cb) into main #54
OCPBUGS-69976: Updating ose-nutanix-cloud-controller-manager-container image to be consistent with ART for 4.22 #53
Full changelog

nutanix-machine-controllers

OCPCLOUD-3619: Bump k8s 1.36 #139
SPLAT-2797: Changing API calls to v4 #135
OCPBUGS-87392: Updating ose-nutanix-machine-controllers-container image to be consistent with ART for 5.0 #138
NO-JIRA: Update OWNERS #136
OCPCLOUD-3277: Bump k8s 1.35 #134
OCPBUGS-74002: Updating ose-nutanix-machine-controllers-container image to be consistent with ART for 4.22 #129
OCPBUGS-69913: Updating ose-nutanix-machine-controllers-container image to be consistent with ART for 4.22 #128
Full changelog

oauth-apiserver

CNTRLPLANE-3947: Bump to 1.36.2 #213
CNTRLPLANE-3947: hack/update-openapi-spec: add image resolution and registry auth #214
CNTRLPLANE-2445: K8s 1.35 rebase #179
CNTRLPLANE-2449: feat: generate OpenAPI schemas from a running oauth-apiserver instance #211
CNTRLPLANE-3715: Agentic-SDLC: Add human and agent context files #210
CNTRLPLANE-2518: Add support for sourcing external claims from a source that requires client credential authentication #197
CNTRLPLANE-2516: feat: externaloidc: add support for externally sourcing claims #195
CNTRLPLANE-2516: Add local configuration API for external oidc mode #194
NO-JIRA: Add control-plane-approvers to OWNERS #192
CNTRLPLANE-3226: chore: sync with openshift repositories #189
CNTRLPLANE-2989: feat: add external-oidc subcommand to oauth-apiserver #181
CNTRLPLANE-2260: cmd: wire up OTE ginkgo suite for tokenreviews #163
CNTRLPLANE-2436: bump(k8s)=1.34.1 #164
CNTRLPLANE-2260: cmd/oauth-apiserver-tests-ext: Update OTE framework integration #162
OCPBUGS-69818: Updating ose-oauth-apiserver-container image to be consistent with ART for 4.22 #160
CNTRLPLANE-1259: Simplified test infrastructure to single-module architecture #154
Full changelog

oauth-proxy

OCPBUGS-115304: [release-5.0] bugfix: rewrite open redirect strings to ‘/’ #376
OCPBUGS-87343: Updating golang-github-openshift-oauth-proxy-container image to be consistent with ART for 5.0 #367
OCPBUGS-92053: update x/crypto to v0.52.0 and x/net to v0.55.0 #368
OCPBUGS-69836: Updating golang-github-openshift-oauth-proxy-container image to be consistent with ART for 4.22 #341
OCPBUGS-73848: test/e2e - do not use ambiguous container image short names #343
Full changelog

oauth-server

OCPBUGS-115306: [release-5.0] bugfix: default to english when Accept-Language header contains more than 1000 underscores #259
CNTRLPLANE-3948: Bump to 1.36.2 #248
RFE-9629: Add copy to clipboard buttons to display token page #200
CNTRLPLANE-2446: K8s 1.35 rebase #215
CNTRLPLANE-3751: Add dynamic proxy CA reload for outbound IdP transports #244
CNTRLPLANE-3751: Rebase onto 1.35 to be able to update openshift/api #247
OCPBUGS-87407: Updating oauth-server-container image to be consistent with ART for 5.0 #246
CNTRLPLANE-3687: contextification files #241
NO-JIRA: chore: update OWNERS file to align with other control plane repos #242
NO-JIRA: Bump github.com/go-jose/go-jose/v3 from v3.0.3 to v3.0.5 #232
CNTRLPLANE-3226: chore: sync with openshift repositories #221
OCPBUGS-63228: groupmapper: avoid mutating original group users slice when removing user #211
CNTRLPLANE-2437: bump(k8s)=1.34.1 #208
Full changelog

oc-mirror

OCPBUGS-88461: fix(helm): tolerate v-prefix version mismatch in disk-to-mirror #1430
CLID-616: bump operator-framework for WriteFS fix + add tests #1428
OCPBUGS-86585: Add regression test for secure-policy catalog OCI conv… #1425
OCPBUGS-85331: Include tag+digest images in both IDMS and ITMS #1424
OCPBUGS-61001: v2/clusterresources: add def namespace to UpdateService #1262
CLID-589: Add OTE test binary to Dockerfile.art #1429
OCPBUGS-87496: Updating oc-mirror-plugin-container image to be consistent with ART for 5.0 #1432
OCPBUGS-87496: update images to be consistent with ART #1433
OCPBUGS-81712: fixes race condition when mirroring operator catalogs #1390
CLID-621: simplify test catalog building #1420
CLID-655: Add test for incremental mirroring using archives by date #1416
CLID-625, CLID-626: Tests for –parallel-images and –parallel-layers flags #1415
CLID-647: Add testing docs and skills #1422
OCPBUGS-86264: Upgrade go-jose to v4.1.4 to fix CVE-2026-34986 #1414
CLID-579: Validate BlockedImage regex #1401
OCPBUGS-64640: remove environment setup output #1384
CLID-623: Encapsulate unit test data into tests/unit #1407
CLID-479: OTE migration #1375
NO-JIRA: Update README.md for Enclave Support link #1404
CLID-612: Move integration tests within oc-mirror #1400
CLID-592: pkg/cli: add unit tests for environment setup #1391
CLID-532: Separate Image struct into AdditionalImage, BlockedImage, SampleImage #1372
OCPBUGS-62603: Fix printing collection messages with 0 collection items #1385
OCPBUGS-61136: Only print catalog rebuild message if there are catalo… #1386
CLID-524: additionalImages collector error handling #1343
CLID-535: api: use OCI definitions from opencontainers spec #1341
CLID-547: v2: add list releases command #1373
CLID-540: v2: add list operators command #1370
NO-JIRA: Group dependabot updates by package origin #1336
no-jira: lint: Remove golangci-lint v1 config. #1374
OCPBUGS-77146: Remove status field from CatalogSource, ClusterCatalog… #1369
CLID-549: Update Dockerfile.tests to run Go integration tests #1368
CLID-197: Add TargetRepo, TargetTag to additionalImages #1327
OCPBUGS-77726: Updating oc-mirror-plugin-container image to be consistent with ART for 4.22 #1364
OCPBUGS-77726: Updating oc-mirror-plugin-container image to be consistent with ART for 4.22 (missing files from ART PR 1364 ) #1366
CLID-539: Remove unused constants and centralize widely used ones #1354
NO-JIRA: Bump github.com/containerd/containerd from 1.7.27 to 1.7.29 in the oc-mirror-v2-security-updates group across 1 directory #1308
OCPBUGS-77141: Fix registriesd “unknown userid” failure for arbitrary UIDs #1357
CLID-513: operator catalogs pinned by digest in ISC #1333
OCPBUGS-75013: Fix reg config detection for explicit false values #1348
OCPBUGS-73760: fix conversion issue for catalog #1338
OCPBUGS-69745: fix duplicated channel bug in filtered catalogs #1339
CLID-476: Fixes for cross-build errors #1303
OCPBUGS-70024: images: update images to 4.22 #1337
OCPBUGS-70024: Updating oc-mirror-plugin-container image to be consistent with ART for 4.22 #1331
NO-JIRA: Add tests/results-integration to .gitignore #1326
CLID-480: v2: do not invoke v1 make commands #1310
CLID-512: claude: add slash command for ISC generation #1328
NO-JIRA: add adolfo-ab as reviewer #1329
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

olm-catalogd, olm-operator-controller

NO-ISSUE: Synchronize From Upstream Repositories #788
OCPBUGS-89330: Synchronize From Upstream Repositories #779
NO-ISSUE: Synchronize From Upstream Repositories #776
OPRUN-4436: fix(test): update PolarionID:87224 for 4.²³⁄₅.0 upgrade boundary #766
OPRUN-4659, OPRUN-4666, OPRUN-4671, OPRUN-4672, OPRUN-4673, OPRUN-4674: Synchronize From Upstream Repositories + Remove spec.serviceAccount tests #767
NO-ISSUE: Remove stale reviewers/approvers, add trgeiger #769
OPRUN-4392, OPRUN-4393: Add OLMv1 progress deadline QE tests + fixes #755
OPRUN-4437: test: add allow-case for operator maxOCPVersion > cluster version #765
NO-ISSUE: Remove HelmChartSupport feature gate from experimental manifests #764
NO-ISSUE: Synchronize From Upstream Repositories #760
NO-ISSUE: Synchronize From Upstream Repositories #759
OCPBUGS-92037: Synchronize From Upstream Repositories #757
NO-ISSUE: Synchronize From Upstream Repositories #754
NO-ISSUE: Synchronize From Upstream Repositories #752
OCPBUGS-85828: Update catalogs for 4.²³⁄₅.0 #734
OCPBUGS-86797, OPRUN-4415: Synchronize From Upstream Repositories #743
OCPBUGS-87383: Updating ose-olm-operator-controller-container image to be consistent with ART for 5.0 #749
OCPBUGS-87385: Updating ose-olm-catalogd-container image to be consistent with ART for 5.0 #750
OPRUN-4637: Update dockerfiles to use golang-1.26-release-4.23 builders #746
NO-ISSUE: Synchronize From Upstream Repositories #741
OPRUN-4571: add OLMv1 topology-based deployment scaling e2e test #737
OPRUN-4625: Synchronize from Upstream Repositories #738
OPRUN-4617: Update readme Default Catalog Tests #739
OPRUN-4607: Remove test-experimenal-e2e #732
NO-ISSUE: Synchronize From Upstream Repositories #733
NO-ISSUE: Synchronize From Upstream Repositories #730
OPRUN-4608: UPSTREAM: <carry>: Delete openshift/registry.Dockerfile #729
NO-ISSUE: Synchronize From Upstream Repositories #726
OPRUN-4607: Fix flags passed to test-experimental-e2e #723
OCPBUGS-85508: Synchronize From Upstream Repositories #725
NO-ISSUE: Synchronize From Upstream Repositories #724
NO-ISSUE: Synchronize From Upstream Repositories #722
OCPBUGS-62517: Set replicas=1, PDB, and pod anti-affinity for HA topology #709
OCPBUGS-84943: fix(test): drop blocking namespace-deletion wait between both-watch-modes scenarios #712
OCPBUGS-62517: Synchronize from Upstream Repositories #710
NO-ISSUE: UPSTREAM: <carry>: remove dead e2e registry push job and related variables #711
OPRUN-4587: Make OTE local output easier to read #704
NO-ISSUE: Synchronize From Upstream Repositories #707
NO-ISSUE: Synchronize From Upstream Repositories #706
NO-ISSUE: Synchronize From Upstream Repositories #701
OPRUN-4574: UPSTREAM: <carry>: Disable upstream TLSProfile tests #702
OPRUN-4577: OTE: Simplify by remove option to configure tests to run outside of OCP #703
OPRUN-4572: Expand OTE docs with more comprehensive details #697
OCPBUGS-77972, OCPBUGS-81452: Synchronize From Upstream Repositories #696
OPRUN-4546: Fix boxcutter finalizer ResourceNames in preflight test #695
NO-ISSUE: Synchronize From Upstream Repositories #694
NO-ISSUE: Synchronize From Upstream Repositories #693
OCPQE-31553: Test empty affinity erasure and cleanup #689
NO-ISSUE: Synchronize From Upstream Repositories #692
OPRUN-4518: Remove skip for incompatible operator check after rename of CER #690
OCPBUGS-60693, OCPBUGS-60958: Synchronize From Upstream Repositories #691
OPRUN-4426: add ocp-87557 #635
OCPQE-31553: update preflight permission case #686
NO-ISSUE: Add fgiudici as reviewer #681
OCPBUGS-78211, OCPBUGS-78455: Synchronize From Upstream Repositories #682
NO-ISSUE: Add long-duration test script and documents #664
OCPBUGS-81194: Update grpc in default-catalog-consistency tests #679
OCPBUGS-78092, OCPBUGS-78311: Synchronize From Upstream Repositories #677
OPRUN-4063: verify volume/volumeMount override #678
OCPBUGS-78999: Update quay-operator bundle version in OTE to fix missing arch #673
OCPQE-31636: enhance QE cases #666
OCPBUGS-76380: Synchronize From Upstream Repositories #676
OPRUN-4228: Add boxcutter tests #672
OPRUN-4468: Add OTE tests for OLMv1 DeploymentConfig support #662
OCPBUGS-78787: Synchronize from upstream #670
OCPBUGS-65634: UPSTREAM: <carry>: add service account to curl job #653
OPRUN-4063: deployment config cases #654
OCPQE-31265: update OCP-75441 to support multi-arch #668
OPRUN-4509: Synchronize From Upstream Repositories #669
NO-ISSUE: Synchronize From Upstream Repositories #667
NO-ISSUE: Synchronize From Upstream Repositories #665
NO-ISSUE: Synchronize From Upstream Repositories #663
NO-ISSUE: Synchronize From Upstream Repositories #661
OCPBUGS-77847: Increase install timeout and add diagnostic logging for CE install tests #660
OCPBUGS-76453: Synchronize From Upstream Repositories #659
OCPBUGS-77942: Fix OLMv1 test operator to listen on IPv6 #657
NO-ISSUE: Synchronize From Upstream Repositories #658
OCPQE-31707: serviceAccount validation unified across all runtimes to enhance cases #656
NO-ISSUE: Synchronize From Upstream Repositories #655
NO-ISSUE: Synchronize From Upstream Repositories #651
OCPQE-31637: fix 83026 for TP cluster #652
OPRUN-4461: Upgrade OTE and Default Catalog Tests dependencies and go #649
OPRUN-4459: Update OCP catalogs to v4.22 ( Release Blocker ; Must go in before OCP release 4.22 ) #627
OCPQE-31553: adjust qe sa and permission test cases per new change #631
NO-ISSUE: Synchronize From Upstream Repositories #648
OPRUN-4459, OPRUN-4460: Preflight tests use in-cluster catalog and bundles instead of openshift-pipelines-operator-rh #644
NO-ISSUE: Synchronize From Upstream Repositories #646
OCPBUGS-65634: add service account to verify pod #638
NO-ISSUE: Synchronize From Upstream Repositories #645
NO-ISSUE: Synchronize From Upstream Repositories #643
MON-4516: Synchronize From Upstream Repositories #641
NO-ISSUE: Synchronize From Upstream Repositories #640
NO-ISSUE: Synchronize From Upstream Repositories #639
NO-ISSUE: Synchronize From Upstream Repositories #637
OPRUN-4441: fix(ote): Fix up own-namespace invalid configuration test #634
NO-ISSUE: Synchronize From Upstream Repositories #633
NO-ISSUE: Synchronize From Upstream Repositories #632
NO-ISSUE: Synchronize From Upstream Repositories #630
OPRUN-4439: Update test-operator startup script to fix pod probe endpoints #629
NO-ISSUE: add 85889 automation #603
NO-ISSUE: add 83979 automation #602
NO-ISSUE: Synchronize From Upstream Repositories #625
OPRUN-4441: fix(ote): fix SingleOwnNamespace test for Boxcutter runtime compatibility and use as operator-controller dep from root instead of upstream release #628
OCPQE-31553: adjust watchnamespace qe case based on change #623
OPRUN-4439: Fix test operator controller pod probes #614
NO-ISSUE: Synchronize From Upstream Repositories #622
OPRUN-4446: Update preflight auth checks for Boxcutter feature gate #621
OPRUN-4112: Synchronize From Upstream Repositories #615
OPRUN-4403: OPRUN-4403 case for upgrade major version #618
OCPQE-31521: enhance ocp-79770 #616
OPRUN-4063: config watchnamespace api cases #612
NO-ISSUE: Synchronize From Upstream Repositories #610
OPRUN-4385: Remove marketplace index from tests #598
NO-ISSUE: Synchronize From Upstream Repositories #608
TRT-2516: Revert #594 “OCPBUGS-65634: add service account to curl job” #609
OCPBUGS-65634: add service account to curl job #594
NO-ISSUE: Synchronize From Upstream Repositories #601
OCPQE-31296: enhance qe cases to make it more stable #604
NO-ISSUE: Run upstream e2e tests tagged with @catalogd-update #605
NO-ISSUE: Synchronize From Upstream Repositories #597
OPRUN-4350: Update to golang 1.25 and ocp 4.22 #586
OCPQE-31263: update 83026 to specify the clustercatalog #583
OCPQE-30674: migrate bandrade’s OLMv1 test cases to OTE #562
OCPQE-31264: update 80458’s timeout to 180s #579
NO-ISSUE: Synchronize from upstream #581
Full changelog

openshift-apiserver

OCPBUGS-85429: Bump to 1.36.2 #666
NO-JIRA: Remove cluster profile directory authentication as it is no longer injected in CI #674
OCPBUGS-85429: hack/update-openapi-spec: add image resolution and registry auth #667
OCPBUGS-94042: Return proper 404 when deleting a non-existent project #671
OCPBUGS-85429: hack/update-openapi-spec: prefer REGISTRY_AUTH_FILE over cluster profile pull secret #669
OCPBUGS-78480: address review feedback on project watcher #664
CNTRLPLANE-2449: K8s 1.35 rebase #616
CNTRLPLANE-2449: feat: generate OpenAPI schemas from a running openshift-apiserver instance #645
OCPBUGS-78480: add watchlist new semantic support to project watcher #661
OCPBUGS-79070: Fix: Preserve annotations when creating ImageStreamTag #656
OCPBUGS-84534: fix concurrent map race in project authorization cache #642
NO-ISSUE: bump github.com/moby/spdystream v0.5.0 to v0.5.1 to fix CVE-2026-35469 #650
OCPBUGS-38120: Ensure Project delete requests are passed through admission #632
NO-JIRA: Add control-plane-approvers to OWNERS #630
OCPBUGS-74511: remove RouteExternalCertificate feature gate #604
CNTRLPLANE-3226: Sync with openshift apiserver 4.22 kubernetes 1.34.1 #629
CNTRLPLANE-2438: chore: bump(k8s)=1.34.1 #592
Revert “OCPBUGS-72408: block image import from cluster IP addresses” #599
OCPBUGS-72408: block image import from cluster IP addresses #591
OCPBUGS-70049: Updating ose-openshift-apiserver-container image to be consistent with ART for 4.22 #590
Full changelog

openshift-controller-manager

OCPBUGS-112448: bump(k8s.io): 1.36.3 #452
CNF-23051: Migrate away from deprecated ioutil #422
NO-JIRA: Add control-plane-approvers to OWNERS #438
CNTRLPLANE-2769: bump kubernetes dependencies to v1.35 #429
CNTRLPLANE-2620: bump github.com/openshift/library-go #427
OCPBUGS-69696: Updating ose-openshift-controller-manager-container image to be consistent with ART for 4.22 #425
Full changelog

openshift-state-metrics

NO-JIRA: update Go dependencies #135
OCPBUGS-87472: Updating openshift-state-metrics-container image to be consistent with ART for 5.0 #134
OCPBUGS-77709: Updating openshift-state-metrics-container image to be consistent with ART for 4.22 #130
OCPBUGS-74036: Updating openshift-state-metrics-container image to be consistent with ART for 4.22 #129
OCPBUGS-69985: Updating openshift-state-metrics-container image to be consistent with ART for 4.22 #128
Full changelog

openstack-cluster-api-controllers

Bug: Fix make merge-bot after rebasebot by cleaning stale openshift artifacts #430
OSPRH-33339: Add rebasebot post-rebase hook script #428
OCPBUGS-94057: UPSTREAM: 3265: :bug: allow unconditional providerID updates in OpenStackMachine #425
🐛 OCPBUGS-85337: set imagePullPolicy IfNotPresent on provider workloads #424
OCPBUGS-87266: Updating openstack-cluster-api-controllers-container image to be consistent with ART for 5.0 #422
NO-JIRA: manifests-gen: scope provider webhooks to capi namespace #416
OCPCLOUD-3359: Add TLS substitutions #408
UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.14 into main #390
NO-JIRA: Update manifests generator #411
OCPBUGS-77542: Updating openstack-cluster-api-controllers-container image to be consistent with ART for 4.22 #399
OCPCLOUD-3321, OSASINFRA-3980: Migrate asset generation to ocp-manifests #386
NO-JIRA: Update DOWNSTREAM_OWNERS #398
NO-JIRA: Cleanup post-infracluster migration #397
OCPBUGS-69731: Updating openstack-cluster-api-controllers-container image to be consistent with ART for 4.22 #396
NO-JIRA: Sync main with latest upstream (release-0.14) #395
Full changelog

openstack-machine-api-provider

OCPBUGS-77061: Vendor Downstream CAPO #170
OCPBUGS-87494: Updating ose-machine-api-provider-openstack-container image to be consistent with ART for 5.0 #169
OCPBUGS-77724: Updating ose-machine-api-provider-openstack-container image to be consistent with ART for 4.22 #161
OCPBUGS-76788: Fix make test #154
OCPBUGS-70022: Updating ose-machine-api-provider-openstack-container image to be consistent with ART for 4.22 #149
OCPBUGS-67298: Don’t record event for every reconcile #142
Full changelog

openstack-resource-controller

OCPBUGS-87486: Updating openstack-resource-controller-container image to be consistent with ART for 5.0 #39
UPSTREAM-SYNC: Merge https://github.com/k-orc/openstack-resource-controller:release-2.0 into main #38
UPSTREAM-SYNC: Sync main with latest upstream (release-2.0) #36
UPSTREAM-SYNC:Merge https://github.com/k-orc/openstack-resource-controller:release-1.0 into main #20
OCPCLOUD-3321, OSASINFRA-3980: Update to image-based manifests #30
NO-JIRA: Update OWNERS_ALIASES #28
OCPBUGS-77719: Updating openstack-resource-controller-container image to be consistent with ART for 4.22 #26
UPSTREAM-SYNC: Sync main with upstream (release-1.0) #27
OCPBUGS-70015: Updating openstack-resource-controller-container image to be consistent with ART for 4.22 #25
Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

OCPBUGS-83412: set catalogsource spec.grpcpodconfig.scc: restricted for all non-legacy cases #1360
OCPBUGS-113283: force node arch for opm and catalogsource pod for multiarch tests; fix test failure #1358
Revert “OCPBUGS-104542: force same arch for opm and catalogsource pod for multiarch tests” #1349
OCPBUGS-74905: Synchronize From Upstream Repositories #1346
OCPBUGS-104542: force same arch for opm and catalogsource pod for multiarch tests #1344
OCPBUGS-86895: Ensure packageserver pod seccompProfile is always set #1341
NO-ISSUE: Synchronize From Upstream Repositories #1343
NO-ISSUE: Synchronize From Upstream Repositories #1340
OCPBUGS-96749, OCPBUGS-96752: Synchronize From Upstream Repositories #1338
NO-ISSUE: Remove stale reviewers/approvers, add trgeiger #1339
NO-ISSUE: Synchronize From Upstream Repositories #1337
NO-ISSUE: Synchronize From Upstream Repositories #1336
OCPBUGS-88737: Update PSM/package server to support TLS profiles #1328
OPRUN-4612: Add E2E tests for ExperimentalListPackageCustomSchemas gRPC endpoint #1327
TRT-2761: Undo revert and fix applyClusterTLSProfile() #1335
TRT-2761: Revert #1330 “NO-ISSUE: Synchronize From Upstream Repositories” #1334
NO-ISSUE: Synchronize From Upstream Repositories #1330
NO-ISSUE: Synchronize From Upstream Repositories #1316
OCPBUGS-88013: Updating operator-lifecycle-manager-container image to be consistent with ART for 5.0 #1323
OCPBUGS-88012: Updating ose-operator-framework-tools-container image to be consistent with ART for 5.0 #1322
OCPBUGS-88014: Updating operator-registry-container image to be consistent with ART for 5.0 #1324
OPRUN-4639: Update to golang 1.26.3 and openshift-4.23 builders #1317
NO-ISSUE: Synchronize From Upstream Repositories #1313
NO-ISSUE: Synchronize From Upstream Repositories #1311
NO-ISSUE: Synchronize From Upstream Repositories #1308
NO-ISSUE: Synchronize From Upstream Repositories #1307
NO-ISSUE: Synchronize From Upstream Repositories #1306
NO-ISSUE: Synchronize From Upstream Repositories #1299
OPRUN-4610: Revert lifecycle server changes #1300
OCPBUGS-54790: Fix packageserver PDB annotation for HyperShift #1297
OPRUN-4588: use AlwaysAllow UnhealthyPodEvictionPolicy option in PDBs #1280
NO-ISSUE: Synchronize From Upstream Repositories #1298
OPRUN-4601: use resource-based RBAC for lifecycle-server auth #1290
OCPBUGS-84642: Synchronize From Upstream Repositories #1291
OPRUN-4597: Fix lifecycle-server readiness probe to allow empty index #1288
OPRUN-4541, OPRUN-4544: add lifecycle-server for serving FBC catalog lifecycle metadata #1284
NO-ISSUE: Synchronize From Upstream Repositories #1286
NO-ISSUE: Synchronize From Upstream Repositories #1282
NO-ISSUE: Synchronize From Upstream Repositories #1279
OCPBUGS-77984: test(olm): skip ppc64le/s390x for tests using single-arch images #1276
NO-ISSUE: Synchronize From Upstream Repositories #1278
NO-ISSUE: Synchronize From Upstream Repositories #1277
NO-ISSUE: retry transient registry errors in opm QE #1272
NO-ISSUE: Synchronize From Upstream Repositories #1275
NO-ISSUE: Synchronize From Upstream Repositories #1274
NO-ISSUE: Add pedjak and fgiudici as reviewers #1271
NO-ISSUE: Synchronize From Upstream Repositories #1268
: NO-ISSUE: Migrate away from deprecated ioutil #1160
OCPBUGS-79397: Fix SA restore resourceVersion conflict error #1264
OCPBUGS-77179: Synchronize From Upstream Repositories #1260
NO-ISSUE: remove etcd dependency from failing cases #1241
OCPQE-31468: verify images command log pollution #1262
OCPBUGS-78557: Re-Apply Fix admin context race condition in parallel tests #1259
OPRUN-4415: automate OCP-87188: Central TLS Profile Consistency #1207
TRT-2580: Revert “OCPBUGS-78557: Fix admin context race condition in parallel tests” #1258
OCPQE-31804: Fix admin context race condition in parallel tests #1256
NO-ISSUE: Synchronize From Upstream Repositories #1255
NO-ISSUE: Synchronize From Upstream Repositories #1248
OCPQE-31752: enhance qe test cases #1254
OCPQE-31756: enhance case to make it pass per test bundle change #1252
OCPQE-31607: update 43101 for FIPS enabled cluster #1249
OCPQE-31615: fix OCP-33450 for FIPS enabled cluster #1247
OCPBUGS-74928, OCPBUGS-76460: Synchronize From Upstream Repositories #1244
MON-4513, OCPBUGS-75921, OCPBUGS-76460: Synchronize From Upstream Repositories #1237
OCPBUGS-77006: Remove the collect-profiles info from the microshift kustomization file #1233
NO-ISSUE: Synchronize From Upstream Repositories #1228
NO-ISSUE: UPSTREAM:<carry>: automate OCP-40945 #1209
NO-ISSUE: Synchronize From Upstream Repositories #1226
OCPBUGS-76323: OCPQE-31553:remove qe case of testing collect-profiles #1221
NO-ISSUE: UPSTREAM: : migrate bandrade test cases to OTE #1193
OCPBUGS-31547: Remove the collect-profiles job #1215
OCPBUGS-26404: Add retry logic for SNO cluster detection in leader election configuration #1210
OCPQE-31553: continue to adjust case per collect-profiles change #1218
OPRUN-4407: automate OCP-87276 #1212
OCPQE-31558, OCPQE-31559: Update QE test cases to align with the removal of the redhat-marketplace catalog #1217
OCPQE-31553: change to check collect-profile networkpolicy dynamically #1216
OCPBUGS-74389: Synchronize From Upstream Repositories #1206
OPRUN-4414: Integrate APIServer TLS controller into PSM #1205
OPRUN-4415: Synchronize From Upstream Repositories #1202
NO-ISSUE: Synchronize From Upstream Repositories #1201
OPRUN-4416: Remove kube-rbac-proxy from PSM #1190
NO-ISSUE: automate ocp-85743 and ocp-85745 #1197
OCPQE-31468: add missed opm db testdata #1196
OCPQE-31468: recovery missed qe testdata #1194
OCPBUGS-65867: Synchronize From Upstream Repositories #1195
NO-ISSUE: Synchronize From Upstream Repositories #1192
OCPQE-30680: migrate ocp-25674 #1185
NO-ISSUE: UPSTREAM: <carry>: migrate bandrade test cases to OTE #1169
OCPQE-31297: enhance ocp and microshift olm case #1173
NO-ISSUE: Synchronize From Upstream Repositories #1168
OCPQE-30680: migrate OLMv0 test cases to OTE #1166
OPRUN-4351: Update Dockerfiles/CI to use golang 1.25/ocp 4.22 #1178
Updating ose-operator-framework-tools-container image to be consistent with ART for 4.22 #1174
OCPBUGS-69774: Updating operator-registry-container image to be consistent with ART for 4.22 #1177
OCPBUGS-69740: Updating operator-lifecycle-manager-container image to be consistent with ART for 4.22 #1175
Full changelog

operator-marketplace

NO-ISSUE: Bump the k8s-dependencies group across 1 directory with 3 updates #769
NO-ISSUE: Bump github.com/prometheus/client_golang from 1.24.0 to 1.24.1 #772
NO-ISSUE: Bump github.com/operator-framework/operator-lifecycle-manager from 0.45.0 to 0.46.0 #771
NO-ISSUE: Bump github.com/operator-framework/operator-lifecycle-manager from 0.43.0 to 0.45.0 #761
NO-ISSUE: Bump dependencies to kube 1.36 #766
OCPBUGS-85829: bump catalog versions to 5.0 #756
NO-ISSUE: Bump github.com/onsi/gomega from 1.42.0 to 1.42.1 #765
NO-ISSUE: Bump github.com/onsi/ginkgo/v2 from 2.31.0 to 2.32.0 #764
NO-ISSUE: Bump github.com/onsi/ginkgo/v2 from 2.29.0 to 2.31.0 #760
NO-ISSUE: Bump github.com/onsi/gomega from 1.41.0 to 1.42.0 #763
NO-ISSUE: Bump github.com/operator-framework/operator-lifecycle-manager from 0.42.0 to 0.43.0 #755
OCPBUGS-87398: Updating marketplace-operator-container image to be consistent with ART for 5.0 #758
OPRUN-4642: Update to golang-1.26-release-4.23 #757
OPRUN-4628: restrict dynamic version selection for default catalogsources to only apply to v5.0->v4.y #754
OPRUN-4598: dynamically resolve catalog image tag from OCP release version #750
NO-ISSUE: Bump github.com/onsi/ginkgo/v2 from 2.28.3 to 2.29.0 #751
NO-ISSUE: Bump github.com/onsi/gomega from 1.40.0 to 1.41.0 #752
NO-ISSUE: Bump github.com/fsnotify/fsnotify from 1.9.0 to 1.10.1 #747
NO-ISSUE: Bump github.com/onsi/ginkgo/v2 from 2.28.1 to 2.28.3 #746
NO-ISSUE: Bump the k8s-dependencies group across 1 directory with 3 updates #741
NO-ISSUE: Bump github.com/operator-framework/operator-lifecycle-manager from 0.41.0 to 0.42.0 #740
NO-ISSUE: Bump github.com/operator-framework/api from 0.41.0 to 0.42.0 #738
NO-ISSUE: Add fgiudici as reviewer #739
NO-ISSUE: Bump the k8s-dependencies group with 3 updates #737
NO-ISSUE: Bump github.com/operator-framework/operator-lifecycle-manager from 0.40.0 to 0.41.0 #732
MON-4514: Migrate Prometheus targets discovering from Endpoints to EndpointSlices #725
NO-ISSUE: Bump sigs.k8s.io/controller-runtime from 0.23.1 to 0.23.3 in the k8s-dependencies group #731
OCPBUGS-74928: Bump github.com/operator-framework/api from 0.39.0 to 0.41.0 #728
NO-ISSUE: Bump the k8s-dependencies group with 3 updates #726
OCPBUGS-66980: Update NetworkPolicy egress to support HyperShift custom API ports #723
OPRUN-4458: Upgrade Catalog Source Index from 4.21 to 4.22 #727
OPRUN-4456: chore(deps): upgrade Go module dependencies (edge) #724
NO-ISSUE: Bump github.com/onsi/ginkgo/v2 from 2.27.5 to 2.28.1 #720
NO-ISSUE: Bump sigs.k8s.io/controller-runtime from 0.23.0 to 0.23.1 in the k8s-dependencies group #718
NO-ISSUE: Bump github.com/onsi/gomega from 1.39.0 to 1.39.1 #719
OCPBUGS-65581: marketplace-operator sets Progressing=True during upgrade #713
OPRUN-4410: Add Openshift TLS Profiles support to marketplace-operator #715
NO-ISSUE: Bump github.com/operator-framework/api from 0.37.0 to 0.38.0 #717
OPRUN-4302: Remove marketplace index #698
OCPBUGS-74360: Fix image for the build #714
NO-ISSUE: Bump sigs.k8s.io/controller-runtime from 0.22.4 to 0.23.0 in the k8s-dependencies group #711
NO-ISSUE: Bump github.com/sirupsen/logrus from 1.9.3 to 1.9.4 #712
OCPBUGS-74006: Updating marketplace-operator-container image to be consistent with ART for 4.22 #709
NO-ISSUE: Bump github.com/onsi/ginkgo/v2 from 2.27.3 to 2.27.4 #701
NO-ISSUE: Bump github.com/onsi/gomega from 1.38.3 to 1.39.0 #702
OCPBUGS-69441: Increase default catalog polling interval to 4h (240m) #695
NO-ISSUE: Bump the k8s-dependencies group with 2 updates #697
NO-ISSUE: Bump github.com/onsi/ginkgo/v2 from 2.27.2 to 2.27.3 #691
OPRUN-4354: Update to build containers to golang-1.25 #696
NO-ISSUE: update ports on deployment manifests, fix spacing #689
OCPBUGS-69929: Updating marketplace-operator-container image to be consistent with ART for 4.22 #694
NO-ISSUE: Bump github.com/onsi/gomega from 1.38.2 to 1.38.3 #692
NO-ISSUE: Bump github.com/operator-framework/api from 0.36.0 to 0.37.0 #693
NO-ISSUE: Bump the k8s-dependencies group with 3 updates #686
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-105440: DownStream Merge [08-13-2026] #3395
NO-JIRA: DownStream Merge [08-11-2026] #3383
OCPBUGS-100275, OCPBUGS-85627: DownStream Merge [08-10-2026] #3361
NO-JIRA: openshift: fix lint issues #3301
CORENET-7229: OTE: Add test list validation tooling #3221
OCPBUGS-83863: Remove RHEL 8 binary build #3149
OCPBUGS-87283, OCPBUGS-87530, OCPBUGS-87532, OCPBUGS-93623, OCPBUGS-95512, OCPBUGS-98138: DownStream Merge [07-31-2026] #3332
OCPBUGS-65865, OCPBUGS-86223, OCPBUGS-89327: DownStream Merge [07-17-2026] #3298
NO-JIRA: Update OWNERS File #3288
NO-JIRA: DownStream Merge [07-02-2026] #3279
OCPBUGS-86223: DownStream Merge [06-15-2026] #3249
CORENET-6688: Bump the downstream OVN package to 26.03 #3258
CORENET-6592: Promote EVPN E2Es from informing to blocking tests #3178
CORENET-7116: Fix perma-failing security presubmit job #3218
OCPBUGS-79408, OCPBUGS-86503: DownStream Merge [06-11-2026] #3247
NO-JIRA: Sync informing EVPN E2Es with upstream naming #3220
OCPBUGS-81326, OCPBUGS-84917: DownStream Merge [05-19-2026] #3195
NO-JIRA: Revert “OCPBUGS-61065: Adding ovndb-raft-functions.sh to ovnk image” #3192
NO-JIRA: DownStream Merge [05-07-2026] #3177
TRT-2652: Allow OTE info and list tests commands to work without KUBECONFIG #3170
NO-JIRA: DownStream Merge [04-30-2026] #3169
NO-JIRA: DownStream Merge [04-27-2026] #3159
NO-JIRA: OTE: run EVPN external traffic tests which use random subnet for VTEP #3148
OCPBUGS-84037: OTE: tolerate missing OpenShift CRDs on MicroShift #3150
CORENET-6537: OTE: Add external container support to infra provider #2975
NO-JIRA: openshift tests: demote to informing #3131
Full changelog

powervs-block-csi-driver

OCPBUGS-108052: Mitigate CVE-2026-41178 by bumping go.opentelemetry.io/otel to v1.44.0 #143
OCPBUGS-93616,OCPBUGS-95518,OCPBUGS-98129, OCPBUGS-101725 and OCPBUGS-96872: Mitigate CVE-2026-39828, CVE-2026-46597 and CVE-2026-39835 #141
NO-JIRA: Update OWNERS_ALIASES to modify approvers and reviewers #137
OCPBUGS-87294: Updating ose-powervs-block-csi-driver-container image to be consistent with ART for 5.0 #136
MULTIARCH-6066: Rebase branch with upstream #126
OCPBUGS-77586: Updating ose-powervs-block-csi-driver-container image to be consistent with ART for 4.22 #115
MULTIARCH-6015: Rebase ibm-powervs-block-csi-driver with upstream #116
OCPBUGS-77586: Updating ose-powervs-block-csi-driver-container image to be consistent with ART for 4.22 #118
MULTIARCH-6016: Upgrade golangci-lint version to support go1.25 #117
MULTIARCH-6001: Rebase ibm-powervs-block-csi-driver with upstream #114
MULTIARCH-5838: Rebase ibm-powervs-block-csi-driver with upstream #109
OCPBUGS-69805: Updating ose-powervs-block-csi-driver-container image to be consistent with ART for 4.22 #108
Full changelog

powervs-block-csi-driver-operator

STOR-2914: Bump all deps for 5.0.0 #119
NO-JIRA: Update OWNERS to modify approvers and reviewers #118
OCPBUGS-87386: Updating ose-powervs-block-csi-driver-operator-container image to be consistent with ART for 5.0 #117
STOR-2762: Bump all deps for 4.22 #104
OCPBUGS-77622: Updating ose-powervs-block-csi-driver-operator-container image to be consistent with ART for 4.22 #103
STOR-2809: Central TLS Profile consistency #97
STOR-2523: Add desired-version annotation to controller Deployment and use DeploymentVersionController in ibm-powervs-block-csi-driver-operator #90
No-JIRA: Update owners #93
OCPBUGS-69906: Updating ose-powervs-block-csi-driver-operator-container image to be consistent with ART for 4.22 #94
Full changelog

powervs-cloud-controller-manager

No-Jira: Bump cel-go to v0.29.0, grpc to v1.82.1 and x/text to v0.39.0 to address security vulnerabilities #107
NO-JIRA: Update OWNERS_ALIASES to modify approvers and reviewers #105
No-Jira: Bump golang.org/x/crypto and golang.org/x/net to address security vulnerabilities #106
OCPBUGS-87520: Updating ose-powervs-cloud-controller-manager-container image to be consistent with ART for 5.0 #104
OCPBUGS-83391: Merge https://github.com/IBM-Cloud/cloud-provider-ibm:release-1.35 (e48649f) into main #83
No-Jira: Update go.opentelemetry.io/otel and google.golang.org/grpc #94
OCPBUGS-70048: Updating ose-powervs-cloud-controller-manager-container image to be consistent with ART for 4.22 #91
No-Jira: Bump golang.org/x/crypto to 0.45.0 #90
Full changelog

powervs-machine-controllers

OCPBUGS-87523: Updating ose-powervs-machine-controllers-container image to be consistent with ART for 5.0 #144
OCPCLOUD-3271: Update dependencies for OpenShift 4.22 release #140
NO-JIRA: Add damdo to approvers list in OWNERS file #141
OCPBUGS-77745: Updating ose-powervs-machine-controllers-container image to be consistent with ART for 4.22 #139
OCPBUGS-70051: Updating ose-powervs-machine-controllers-container image to be consistent with ART for 4.22 #133
Full changelog

prom-label-proxy

NO-ISSUE: [bot] Bump openshift/prom-label-proxy to v0.14.0 #398
OCPBUGS-87514: Updating prom-label-proxy-container image to be consistent with ART for 5.0 #397
NO-ISSUE: [bot] Bump openshift/prom-label-proxy to v0.13.0 #394
NO-JIRA: disable automatic coderabbit reviews #390
OCPBUGS-77739: Updating prom-label-proxy-container image to be consistent with ART for 4.22 #389
OCPBUGS-70042: Updating prom-label-proxy-container image to be consistent with ART for 4.22 #388
Full changelog

prometheus

NO-JIRA: [bot] Bump openshift/prometheus to v3.13.2 #351
OCPBUGS-100192: [bot] Bump openshift/prometheus to v3.13.2 #350
Bump openshift/prometheus to v3.13.1 #347
NO-JIRA: [bot] Bump openshift/prometheus to v3.13.1 #345
NO-JIRA: chore: revert narrow selectors detection for le/quantile labels #344
OCPBUGS-92191: fix(tsdb): temporarily ignore Direct IO enablement errors on unsupported filesystems #338
OCPBUGS-92815: bump golang.org/x/crypto to v0.53.0 #334
Bump openshift/prometheus to v3.12.0 #332
NO-JIRA: bump prometheus to v3.12.0 #329
OCPBUGS-87446: Updating golang-github-prometheus-prometheus-container image to be consistent with ART for 5.0 #326
NO-ISSUE: [bot] Bump openshift/prometheus to v3.11.3 #318
NO-ISSUE: [bot] Bump openshift/prometheus to v3.11.3 #317
OCPBUGS-62118: fix TLS client cert rotation when no CA is configured #312
NO-JIRA: Upgrade Prometheus to 3.11.2 #305
OCPBUGS-65568: chore(kubernetes): deduplicate warning logs from the API #296
NO-JIRA: disable automatic coderabbit reviews #295
OCPBUGS-77667: Updating golang-github-prometheus-prometheus-container image to be consistent with ART for 4.22 #294
NO-JIRA: update rh-manifest.txt #293
NO-JIRA: [bot] Bump openshift/prometheus to v3.9.1 #292
OCPBUGS-74015: Updating golang-github-prometheus-prometheus-container image to be consistent with ART for 4.22 #286
OCPBUGS-69956: Updating golang-github-prometheus-prometheus-container image to be consistent with ART for 4.22 #284
Full changelog

prometheus-alertmanager

OCPBUGS-104610: bump dependencies from the golang-org-x group #156
OCPBUGS-98190: bump github.com/hashicorp/memberlist from 0.5.4 to 0.6.0 #155
OCPBUGS-99435: embed tzdata in the alertmanager binary #140
Bump openshift/prometheus-alertmanager to v0.33.1 #139
NO-JIRA: bump to 0.33.0 #138
NO-ISSUE: [bot] Bump openshift/prometheus-alertmanager to v0.32.2 #135
OCPBUGS-87471: Updating golang-github-prometheus-alertmanager-container image to be consistent with ART for 5.0 #136
NO-ISSUE: remove ui/app/dist/.build_stamp #133
NO-ISSUE: [bot] Bump openshift/prometheus-alertmanager to v0.32.1 #132
NO-ISSUE: Bump openshift/prometheus-alertmanager to v0.32.0 #129
NO-ISSUE: update OWNERS #130
NO-ISSUE: [bot] Bump openshift/prometheus-alertmanager to v0.31.1 #127
MON-4536: Bump alertmanager to v0.31.1 #118
NO-JIRA: disable automatic coderabbit reviews #126
OCPBUGS-77708: Updating golang-github-prometheus-alertmanager-container image to be consistent with ART for 4.22 #119
OCPBUGS-74035: Updating golang-github-prometheus-alertmanager-container image to be consistent with ART for 4.22 #112
OCPBUGS-69983: Updating golang-github-prometheus-alertmanager-container image to be consistent with ART for 4.22 #109
Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

NO-ISSUE: [bot] Bump openshift/prometheus-operator to v0.93.1 #391
NO-ISSUE: [bot] Bump openshift/prometheus-operator to v0.93.0 #388
OCPBUGS-96853: [bot] Bump openshift/prometheus-operator to v0.92.1 #385
OCPBUGS-87481: Updating prometheus-config-reloader-container image to be consistent with ART for 5.0 #383
OCPBUGS-87527: Updating prometheus-operator-container image to be consistent with ART for 5.0 #384
OCPBUGS-87341: Updating prometheus-operator-admission-webhook-container image to be consistent with ART for 5.0 #382
NO-ISSUE: [bot] Bump openshift/prometheus-operator to v0.91.0 #380
NO-ISSUE: [bot] Bump openshift/prometheus-operator to v0.90.1 #378
MON-4542: bump v0.90.0 #377
NO-JIRA: Update v0.89.0 #374
NO-JIRA: disable automatic coderabbit reviews #375
OCPBUGS-77597: Updating prometheus-operator-admission-webhook-container image to be consistent with ART for 4.22 #371
OCPBUGS-77753: Updating prometheus-operator-container image to be consistent with ART for 4.22 #373
Updating prometheus-config-reloader-container image to be consistent with ART for 4.22 #372
OCPBUGS-74491: backport upstream fix to reconcile resources with inconsistent status #364
OCPBUGS-73982: Updating prometheus-operator-admission-webhook-container image to be consistent with ART for 4.22 #355
OCPBUGS-67303: Validate webhookURL secret for MSTeams receiver in AlertmanagerConfig CRD #358
OCPBUGS-70007: Updating prometheus-config-reloader-container image to be consistent with ART for 4.22 #352
OCPBUGS-70055: Updating prometheus-operator-container image to be consistent with ART for 4.22 #353
OCPBUGS-69832: Updating prometheus-operator-admission-webhook-container image to be consistent with ART for 4.22 #351
OCPBUGS-67215: [bot] Bump openshift/prometheus-operator to v0.87.1 #349
Full changelog

prometheus-node-exporter

OCPBUGS-112719: cherry-pick 24c6dce279c418bcb911824e8c8be1c81a1e832b - Fix fibrechannel_linux for ppc64le (#3769) #185
OCPBUGS-100376: fibre_channel: fix crash when attempting to dereference invalid count… #183
MON-4614: [bot] Bump openshift/node_exporter to v1.12.1 #182
OCPBUGS-87295: Updating golang-github-prometheus-node_exporter-container image to be consistent with ART for 5.0 #181
OCPBUGS-83863: Strip debug symbols from Go binaries #180
NO-JIRA: [bot] Bump openshift/node_exporter to v1.11.1 #177
NO-JIRA: disable automatic coderabbit reviews #176
OCPBUGS-77587: Updating golang-github-prometheus-node_exporter-container image to be consistent with ART for 4.22 #175
OCPBUGS-69806: Updating golang-github-prometheus-node_exporter-container image to be consistent with ART for 4.22 #174
Full changelog

route-controller-manager

NE-2767: Bump Kubernetes to 1.36.2 #100
OCPBUGS-92032: Dockerfile: Copy only build-required files in builder stage #99
OCPBUGS-87336: Updating ose-route-controller-manager-container image to be consistent with ART for 5.0 #98
OCPBUGS-86886: modernize dependency of k8s imports #92
OCPBUGS-39598: Remove all duplicate ingress IP addresses in clearPersistedAllocation #91
OCPBUGS-83892: Update grpc-go and x/net #88
OCPBUGS-20536: bump library-go version #70
NE-2484: bump k8s libraries to v0.35.0 and cr to v0.23.1 #72
OCPBUGS-63449: filter ingress namespace on UnmanagedRoutes metric #71
NO-JIRA: add jcmoraisjr to owners #69
Full changelog

service-ca-operator

CNTRLPLANE-3898: Bump kubernetes dependencies to v1.36.2 #366
MON-4515: Migrate Prometheus targets discovering from Endpoints to EndpointSlices #319
OCPBUGS-87390: Updating ose-service-ca-operator-container image to be consistent with ART for 5.0 #361
NO-JIRA: Bump github.com/openshift/build-machinery-go #367
CNTRLPLANE-3423: feat: inject centralized TLS into service-ca operand #365
CNTRLPLANE-3423: feat: have CVO inject the centralized TLS configuration into the operator’s config #359
CNTRLPLANE-3718: Add AI SDLC context files #362
OCPBUGS-73938: Watch CA bundle files for changes and reload dynamically #329
CNTRLPLANE-2894: e2e network policy test cases #338
NO-JIRA: Add control-plane-approvers to OWNERS #345
NO-JIRA: controller/servingcerts: Align log verbosity #323
OCPBUGS-82110: fix service-ca-controller CrashLoop on MicroShift #344
CNTRLPLANE-2845: add service-ca operator and workload network policies #324
CNTRLPLANE-2947: Enable configurable PKI for signing CA and serving certificates #327
NO-JIRA: migrate from go-bindata to embed #326
NO-JIRA: OWNERS: remove vrutkovs and add sanchezl #318
NO-JIRA:Update e2e test owners #339
NO-JIRA: Add CLAUDE.md #333
CNTRLPLANE-3038: test/e2e: migrate validatingwebhook-ca-bundle-injection to OTE serial suite #336
CNTRLPLANE-3035: test/e2e: migrate mutatingwebhook-ca-bundle-injection to OTE serial suite #335
CNTRLPLANE-3034: test/e2e: migrate crd-ca-bundle-injection to OTE serial suite #334
CNTRLPLANE-3033: test/e2e: migrate apiservice-ca-bundle-injection to OTE serial suite #332
CNTRLPLANE-3015: test/e2e: restore operator config after forced rotation #331
CNTRLPLANE-3009: test/e2e: migrate forced-ca-rotation to OTE serial-disruptive suite #330
CNTRLPLANE-3000: test/e2e: migrate time-based-ca-rotation test for OTE compatibility #308
NO-JIRA: bump Go to 1.25 and update dependencies #328
CNTRLPLANE-2549: test/e2e: add control plane stabilization wait after CA rotation #325
CNTRLPLANE-2549: test/e2e: migrate refresh-CA test for OTE compatibility #306
CNTRLPLANE-2547: test/e2e: migrate metrics tests for OTE compatibility #305
CNTRLPLANE-2537: test/e2e: migrate headless-stateful-serving-cert-secret-delete-data test for OTE compatibility #304
CNTRLPLANE-2508: test/e2e: migrate vulnerable-legacy-ca-bundle-injection-configmap test for OTE compatibility #303
CNTRLPLANE-2499: test/e2e: migrate ca-bundle-injection-configmap-update test for OTE compatibility #302
CNTRLPLANE-2498: test/e2e: migrate ca-bundle-injection-configmap test for OTE compatibility #301
CNTRLPLANE-2494: test/e2e: migrate serving-cert-secret-delete-data test for OTE compatibility #300
CNTRLPLANE-2491: test/e2e: migrate serving-cert-secret-add-data test for OTE compatibility #299
CNTRLPLANE-2490: test/e2e: migrate serving-cert-secret-modify-bad-tlsCert test for OTE compatibility #298
CNTRLPLANE-2161: test/e2e: migrate serving-cert-annotation test for OTE compatibility #297
OCPBUGS-69911: Updating ose-service-ca-operator-container image to be consistent with ART for 4.22 #296
CNTRLPLANE-2159: cmd: add OTE infrastructure and clean up legacy test extension #295
Full changelog

stream-coreos, stream-coreos-extensions

OCPBUGS-115309: Re-enable sandboxed-containers extension for 5.0 #1965
NO-JIRA: Use –nobest when installing node packages #1958
Revert “Revert “OCPBUGS-104572: NetworkManager-ovs has moved up to RHCOS”” #1955
Revert “OCPBUGS-104572: NetworkManager-ovs has moved up to RHCOS” #1954
OCPBUGS-104572: NetworkManager-ovs has moved up to RHCOS #1952
ART-19543: Refactor extensions build to use dnf download instead of rpm-ostree compose #1945
NO-JIRA: extensions: templatize OCP version in repo names; drop kata from extensions #1942
NO-JIRA: Add configs for 4.23; update build-args file naming #1941
NO-JIRA: Set io.openshift.os.streamclass label on built images #1940
ART-14453: Use rpm-ostree install directly in legacy build pipeline #1935
NO-JIRA: Make build-args files use 5.0 version and revert repo names change #1936
NO-JIRA: Update to track 5.0 #1930
COS-4051: tree: add labels.json and security OCI labels for Clair scanning #1919
NO-JIRA: FAQ: add a composeFS entry #1931
NO-JIRA: Revert “OCPBUGS-77244: 9.8: override runc package to pull in newer fixes” #1925
OCPBUGS-64841: post-process: Remove workaround for openvswitch additional group #1918
OCPBUGS-77244: 9.8: override runc package to pull in newer fixes #1923
NO-JIRA: extensions: Add rhel-9.8-server-ose-4.22 #1910
NO-JIRA: tests: add openshift tag #1906
COS-3912: denylist: drop rhcos.network.init-interfaces-test #1900
NO-JIRA: OWNERS: Add angelcerveraroldan #1883
NO-JIRA: Rename extensions/Dockerfile to Containerfile #1896
NO-JIRA: packages-openshift: Fix repo versions #1895
NO-JIRA: extensions: add a label for extensions image discovery #1894
COS-3900: Start using rhel-10.2 #1892
NO-JIRA: rhaos-pkgs-match-openshift: exclude known package mismatches #1891
No-JIRA: move the OKD SIG repo to 4.22 #1890
NO-JIRA: OWNERS: add user Rolv-Apneseth #1882
NO-JIRA: Update to track 4.22 and rhel-9.8 #1881
NO-JIRA: rhel-10.1: enable rhel-10.1-fast-datapath #1885
NO-JIRA: packages-openshift: enable rhel-10.1-fast-datapath #1884
OCPNODE-4010: package: add ose-crio-credential-provider #1879
OCPBUGS-70162: extensions/rhel-10.1: Re-enable ipsec #1878
NO-JIRA: drop use of rhel-9.6-appstream-containernetworking repo #1877
And 4 elided commits (e.g. from squash or rebase merges)
Full changelog

telemeter

OCPBUGS-93760: bump github.com/prometheus/prometheus #611
OCPBUGS-87222: Updating telemeter-container image to be consistent with ART for 5.0 #607
OCPBUGS-85082: update google.golang.org/grpc #601
NO-ISSUE: add .coderabbit.yaml #603
NO-ISSUE: bump golangci-lint to v2.11.3 #602
NO-ISSUE: update OWNERS #604
OCPBUGS-84383: fix(deps): bump go-jose/v3 to v3.0.5 for JWE unwrap DoS #588
SREP-3493: update cluster:usage:workload:capacity_physical_instance_hours #581
Updating telemeter-container image to be consistent with ART for 4.22 #580
SREP-3493: deduplicate cluster:usage:control_plane:instance_hours output series #579
SREP-3493: add cluster:usage:control_plane:instance_hours #578
SREP-3493: ROSA HCP billing for control planes #577
OCPBUGS-73928: Updating telemeter-container image to be consistent with ART for 4.22 #575
NO-ISSUE: switch http_request_size_bytes to histogram #574
NO-ISSUE: support native histograms #573
NO-ISSUE: update github.com/prometheus/client_golang #572
OCPBUGS-69697: Updating telemeter-container image to be consistent with ART for 4.22 #571
Full changelog

tests

Revert “OCPBUGS-83412: monitortests: skip PodSecurityViolation invariant when OpenShiftPodSecurityAdmission is disabled” #31604
OKD-454: [release-5.0] Skip OKD job name check for cluster-bot launch jobs #31629
CORENET-7243: Add TLS Profile Compliance tests for networking components [release-5.0] #31613
OCPBUGS-120743: Fix the number of requests in repeated exec #31610
OCPBUGS-120715: Add Degraded=True exception for authentication operator during upgrade #31608
OKD-443: Handle missing OSImageStream CR on OKD SCOS during upgrades #31592
OCPBUGS-114674: Allow KubeDaemonSetRolloutStuck alert on external platform clusters #31573
OCPBUGS-112042: allow baremetal to progress while MCO does #31537
OCPBUGS-113994: Raise status polling timeout and write bound #31559
OCPBUGS-114437: Fix probe termination test to use pod status instead of kubelet event text #31567
OCPBUGS-113706: Fix pathological events #31557
OCPBUGS-83412: monitortests: skip PodSecurityViolation invariant when OpenShiftPodSecurityAdmission is disabled #31561
OCPBUGS-113760: Allow KubeDaemonSetMisScheduled alert on external platform clusters #31558
OCPBUGS-111877: tolerate brief olm Available=False during upgrades #31529
OCPBUGS-111969: router/metrics: enable proxy protocol for client on AWS clusters #31533
OCPBUGS-109775: Fix leaked ClusterRoleBinding in pull_secrets test - #31520 #31520
OCPQE-32064: Reduce monitortest sensitivity for upcoming spot check jobs, use etcd-scaling job as early example #31212
OCPBUGS-105606: Allow DualReplica stable-system CVO Available blips from NoExecuteTaintManager #31501
NO-ISSUE: Update agnhost image to 2.63.0 (mirrored version) #31498
CNTRLPLANE-2157: Migrate OTE for Pull Secrets, Feature Gates and Webhooks #31382
OCPBUGS-105768: Update s2i_images test for OCP samples sync #31504
OCPBUGS-98719: retry GetVotingMemberNames on transient etcd client fails #31445
OCPBUGS-105466: monitortests: recognize PascalCase TNF JobRunning CO reasons #31499
OCPEDGE-2700: fix flaky etcd disruption tests and remove unreliable is_standalone test #31276
OCPNODE-4623: e2e for Block runc on RHEL 10 via OSImageURL stream class inspection #31433
OCPBUGS-104544: tolerate one NotReady CP node in EnsureNodesReady for degraded TNF #31442
OCPNODE-4521: Use programmatic skip for single-node instead of test name tag #31486
NO-ISSUE: Consider centos-10 stream for OKD clusters #31487
OCPBUGS-84491: Remove openshift-ingress terminationMessagePolicy exemption #31435
OCPBUGS-99492: remove storage NetworkPolicies from validation skip list #31429
NO-ISSUE: Skip Additional Storage tests on HyperShift - MachineConfig API not available #31489
NE-2788: exempt ingress Upgradeable=False for deprecated HAProxy versions #31494
NO-JIRA: Remove Istio configmap workaround from ClusterResourceQuota test #31444
OCPEDGE-2787: fix: skip MCPs with non-ready nodes during MCN property validation #31380
OCPEDGE-2785: fix: adjusting DaemonSet test to dynamically compute expected pod count #31378
OCPCLOUD-3074: Validate Azure dual-stack load balancers #31452
CNTRLPLANE-2157: Migrate tests of Prometheus, Audit and TLS to OTE #31360
TRT-2618: Add env var support to selectively enable resource monitor tests and event collection #31420
Bug OCPBUGS-104497: Fix [sig-ci] prow job name OS version test for 4.23 rhcos9 #31481
OCPBUGS-100392: Exclude openshift-debug-* namespaces from CPU Partitioning annotation check #31465
NO-ISSUE: Automated - Update synthetic test data #31459
Revert “TRT-2869: Revert “NO-JIRA: Re-enable tests for the recommend cmd if alertsByCVO”” #31462
OCPBUGS-101912: derive cluster quota from namespace configmaps #31476
STOR-3065: Add storage CSI tests for cloning PVC to a larger volume #31443
OCPBUGS-100386: test: scope hosted etcd leader metrics by namespace #31456
OCPBUGS-63219: Remove NLB hairpin workaround from dual-stack test #31453
OCPBUGS-99899: add os name exception for runc jobs #31479
CORENET-6714: Adding netobserv namespace exception for prometheus endpoint auth #31447
OCPBUGS-100388: Fix project name collision in test framework #31464
OCPBUGS-100385: MonitorTest: measure the union of ClusterOperator wait intervals #31457
OCPBUGS-99397: remove custom MCP and pause master pool in mirror-set tests to prevent PDB drain deadlock and suite timeout #31408
Revert: Fix APIs for openshift.io must have stable versions check #31468
OCPBUGS-99916: exclude openshift-debug-* namespaces from best-effort QoS invariant #31437
TRT-2869: Revert #31440 “NO-JIRA: Re-enable tests for the recommend cmd if alertsByCVO” #31460
OCPBUGS-100308: Fix test APIs for openshift.io must have stable versions #31458
OCPBUGS-99047: Fix flaky oc adm storage-admin test #31400
OCPBUGS-84695: [TNF] Fix update-setup job discovery to limit check to active job #31451
OCPBUGS-99921: Dump istiod logs and gateway state on GatewayAPI test failure #31454
NO-JIRA: Re-enable tests for the recommend cmd if alertsByCVO #31440
OCPBUGS-100183: Always tear down upgrade tests after setup failures #31450
OCPBUGS-98576: Improve test output for nodes should be ready test #31419
OCPBUGS-78480: handle bookmark events in project watch tests #31313
NO-JIRA: Update minio image to use source with all supported architectures #31441
OCPBUGS-85529: Fix IPv6 prefix in MultiNetworkPolicy test (/32 → /64) #31407
OCPBUGS-99535: Skip Squid proxy configuration #31423
NO-ISSUE: Skip additional storage support E2E test for on single-node - MCP rollouts timeout #31439
CNTRLPLANE-3789: images: Add squid image used in CAO e2e tests #31434
OTA-1814: Skip tests temporarily for the new output of the recommend cmd #31417
STOR-3063: Add GCP regional PD e2e test for cross-zone data sync #31416
CNTRLPLANE-3741: PKI config tests for service-ca and kube-apiserver-operator #31341
NO-JIRA: Replace a bug id: 25739 -> 92835 #31345
OCPNODE-4055: Add e2e testcase for additional storage support feature #31399
NO-ISSUE: Automated - Update synthetic test data #31260
OCPNODE-4494: e2e test case for RHCOS upgrade from 9 → 10 #31393
OCPSTRAT-3036: Rebase 1.36.2 #31237
NE-2789: Add a guard to skip IngressControllerMultipleHAProxyVersions tests if IngressController CRD lacks haproxyVersion field #31424
NO-JIRA: chore(extended/prometheus): reduce targets-auth skip list and handle mTLS #31372
NO-JIRA: Ensure Platform Prometheus targets are not scraped with insecure_skip_verify #31373
NO-JIRA: Add e2e test to detect named ports in NetworkPolicies #31375
OCPQUAL-20: Regenerate retry allowlist from 5.0 CI data #31411
OCPBUGS-87079: Add polling and longer waits in the EgressFirewall tests to avoid flakiness #31376
NE-2789: Create 5 e2e test cases to help graduate the featuregate: IngressControllerMultipleHAProxyVersions #31392
OCPBUGS-85696: Adding logs and exponential backoff on execPod #31352
NO-JIRA: .devcontainer: bump Fedora base image to 44 for Go 1.26 #31413
CONSOLE-5209: Add e2e tests for IngressComponentRouteLabels feature gate #31385
OCPNODE-4538: Add e2e tests for DRA Partitionable Devices (KEP-4815) #31230
TRT-2689: Add verify-apm to the verify target #31379
OCPBUGS-99166: wait for default ServiceAccount before creating IRI test pod #31401
MCO-2371: Add back “should match os version” test #31301
AGENT-1522: bump InternalReleaseImage to v1 #31294
NO-ISSUE: Fix longrunning suite for node test cases #31339
NO-ISSUE: Always emit precondition validation synthetic test entry #31388
OCPBUGS-98956: use admin-client namespace creation for IRI workload test #31394
OCPNODE-4055: Add Additional Storage Support - API validation test cases #31384
NO-ISSUE: Remove Feature:NodeSwap tag and update README selectors #31389
OCPNODE-4604: allow registry.redhat.io reboot requried test #31383
OCPNODE-4604: upgrade to test v1 CRIOCredentialProviderConfig #31324
TRT-2689: Add devcontainer, APM config, and agentic CI scaffolding #31371
OCPBUGS-97603: Use framework-managed namespace for workload test #31366
OCPBUGS-84512: Remove exception terminationMessagePolicy=TerminationMessageFallbackToLogsOnError #31327
OCPNODE-4494: Testcase to test runc Upgrade case #31266
OCPBUGS-97822: Wait for DNS before running http2 tests #31368
CNTRLPLANE-2157: Migrate test cases to Project API testing KubeAPI server functionality #31310
OCPNODE-4554: Automate OCP-70203: ICSP and IDMS/ITMS can coexist in cluster #31229
NO-JIRA: e2e: extracting fencing credentials rotation into standalone test #31340
NO-JIRA: Fix Flaky e2e tests - Update the Cleanup order #31347
OCPNODE-4604: add quay-proxy.ci.openshift.org as alllowed to reboot requried test #31356
OCPBUGS-84521: remove openshift/cluster-machine-approver terminationMessagePolicy exemption #31362
OCPBUGS-88742: Fix nested container test mount check for BusyBox #31361
NO-ISSUE: Remove exception for OCPBUGS-45921 #31346
OCPCLOUD-3010: Enable OTE for Cluster CAPI Operator #31307
OCPNODE-4560: Migrate OCP-56266 verify kubelet/crio deletes netns when pod deleted #31242
OCPBUGS-85426: improve DCM tests to reduce flakiness in endpoints #31173
NO-ISSUE: monitor/haproxy: treat all-apiservers-down test as flake #31343
OCPBUGS-90507: Update CNV swap tests for mandatory drop-in directory #31318
OCPQE-32077: Add a monitortest for cluster region/zone/instance type autodl data #31305
OCPBUGS-91825: monitor/haproxy: tolerate install-phase apiserver bounces in all-down test #31326
CNTRLPLANE-3629: authentication: skip external oidc kube-apiserver configuration check when new architecture gate is enabled #31314
OCPBUGS-91956: Fix isNoOLMFeatureGateEnabled to check only the current cluster version #31329
OCPBUGS-86789: Make early request monitor test informing #31323
OCPBUGS-85782: Add extra wait after mco and cvo considers upgrade complete #31289
OCPEDGE-2606: e2e: add fencing credentials update and validation tests for dual-replica etcd #31199
NO-JIRA: Fix interval filtering bug in watchnodes tests #31320
CNTRLPLANE-3540: refactor(test/extended/tls): simplify the testing and remove duplication #31277
NO-JIRA:Added penetration tests important to Telco partners/customers #31283
OCPBUGS-89351: Fix flake in best-effort QoS test due to debug pods #31312
TRT-2723: Ignore NodeReady=False during a CNI rollout #31319
OCPBUGS-84846: Fix NetworkNotReady pathological event regex case mismatch #31088
OCPBUGS-88719: Use AdminPolicyBasedExternalRoute CR for external gateway test #31293
OPNET-602: Fail haproxy monitor test when log collection fails #31292
OPNET-603: Fail haproxy test when all kubeapi servers are down simultaneously #31291
OPNET-601: Add on-prem haproxy timeline to e2e interval chart #31290
OCPBUGS-84500: Update ocdebug to ssh #31216
OCPNODE-4529: Migrate test case 44493 - configurable terminationGracePeriodSeconds for probes #31170
AGENT-1535: Increase the time checking for IRI SCC uid-range #31275
OCPSTRAT-3036: Open Deduplicate and use the jessie image #31281
NO-JIRA: Add Jacob and Jubitta as image approvers #31279
NO-JIRA: Adding minio image to allowed image #31241
OCPBUGS-87001: Update source of CAPI ImageVolumeAlreadyPresent events #31286
Use e2eskipper.Skipf to disable os version test until RHEL-10 switchover #31297
TRT-2704: Revert “MCO-2370: Temporarily disable the stream test” #31295
MCO-2370: Temporarily disable the stream test #31287
OCPBUGS-87541: Updating openshift-enterprise-tests-container image to be consistent with ART for 5.0 #31265
“OCPSTRAT-3036: Temporary 1.36 image fixes (revert in rebase PR)” #31263
OCPNODE-4506, OCPNODE-4539: Migrate ContainerRuntimeConfig tests (OCP-45351, OCP-46313) #31153
OCPNODE-4516: PDB configured with 100% minAvailable - Migrate - 67564 #31161
OCPBUGS-84961: support Parents field on origin test suites #31261
NO-JIRA: Update hello-openshift base images from 4.¹⁶⁄₄.17 to 4.22 #31264
no-jira: refactor(test/extended/tls): simplify the workflow, reduce code duplication #31246
OCPBUGS-85486: Add client retry to critical monitor test setup to avoid transient et… #31249
NO-JIRA: upkeep: add exception for expected disruption during tnf upgrade #31206
OCPEDGE-2436: Add is_standalone learner check test for two-node etcd disruption suite #30950
OCPBUGS-86044: Use generated names in oc adm policy SCC test #31221
NO-ISSUE: Automated - Update synthetic test data #31233
OCPBUGS-86473: Consolidate audit log must-gather tests to reduce parallel downloads and master node CPU pressure #31200
MCO-2296: Remove OSImageStreams v1 replace #31256
TRT-2617: Fix CPU metrics monitor node role lookup #31252
MCO-2296: OSImageStreams v1 promotion #31211
NO-JIRA: Clarify why Envoy pods have no CPU or memory limit #31145
TRT-2673: Filter NoExecuteTaintManager disruption from backend-disruption.json #31248
OCPBUGS-86221: update authentication operator conditions to no longer expect WellKnownReadyProgressing #31236
NO-JIRA: Remove fixed bugs on CO conditions (2) - 2nd try #31207
AGENT-1527: Fix comparison of InternalReleaseImage to mirror #31250
Revert “CLID-589: add oc-mirror to extensionBinaries” #31238
OCPBUGS-86017: Extend image-registry single replica exception to s390x architecture #31190
OCPBUGS-82501: Fix AWS DualStack CI jobs consistently encounter 2 EgressFirewall Test Failures #31147
OCPBUGS-84519: Remove openshift-ovn-kubernetes terminationMessagePolicy exemption #31159
NO-ISSUE: Restrict test retries to an allowlist of test names #31222
OCPBUGS-86611: Wait for namespace initialization before creating pod #31225
CNTRLPLANE-3238: pathological events: bump KMS ScalingReplicaSet threshold to 120 #31209
NO-JIRA: Skip CO condition tests on SNO #30775
CLID-589: add oc-mirror to extensionBinaries #31006
OCPBUGS-59500: pathologicalevents: fix HPA FailedGetResourceMetric allowlist #31213
OCPBUGS-86225: fix PDB AlwaysAllow test failure on IPv6-primary dualstack clusters #31196
CNTRLPLANE-3428: tls: add cluster-authentication-operator and operands to tested compo… #31208
NO-ISSUE: Automated - Update synthetic test data #31192
OCPBUGS-86328: if rhcos9-10 in the job name,update jobname test #31198
OCPNODE-4535: Automate OCP-44820 change container registry config #31182
OCPBUGS-85363: Fixed flakiness of oc set image E2E tests #31191
OCPNODE-4125: fix imagepolicy image config testcase #31185
CNTRLPLANE-3428: tls fix HyperShift guest-side CO wait and Custom profile handling #31194
TRT-2669: Revert #31112 “NO-JIRA: Remove fixed bugs on CO conditions (2)” #31201
AGENT-1517: refactored the logic to filter IRI related MachineConfigs #31179
OPRUN-4569: test: remove OLMv1 OTE exceptions; scope OLMv0 exceptions to SNO #31172
NO-JIRA: Remove fixed bugs on CO conditions (2) #31112
OCPBUGS-85378: Fix OCP E2E test - Object count when exceed openshift.io/image-tags will ban to create new image references in the project #31155
NO-ISSUE: Automated - Update synthetic test data #31181
NO-JIRA: Fix flaky storage-admin e2e test #31180
CNTRLPLANE-3428: tls: introduce narrow target types and migrate test functions #31160
Revert “OCPBUGS-85363: Fixed flakiness of oc set image E2E tests” #31188
OCPBUGS-85370: Raise OpenStack operator watch limits #31154
OCPBUGS-85363: Fixed flakiness of oc set image E2E tests #31152
OCPBUGS-85058: monitortests: allow etcd CO blips during TNF jobs on two-node upgrades #31138
OCPBUGS-85486: stage the creation of test pods to minimize etcd impact #31164
OCPNODE-4505: Automation creation of OCP-57401 #31142
OCPBUGS-83623: fix: add distruption tolerance for DualReplica (two-node) topology #31127
OCPBUGS-85531: Fixed flakiness in OCP E2E tests - oc debug image stream #31168
Revert “OPRUN-4569: test: remove OTE exceptions for OLM” #31171
OCPNODE-4108: add E2E tests for upstream dra-example-driver #31064
OPRUN-4569: test: remove OTE exceptions for OLM #31150
OCPEDGE-2386: Add tnf_etcd_disruption test with 5 new etcd resilience tests. #30880
NO-JIRA: Improve graceful shutdown LB test output with more details of late requests #31158
OCPNODE-4047: Implement kubelet TLS 1.3 via KubeletConfig on workers #31016
NO-ISSUE: Automated - Update synthetic test data #31146
CNTRLPLANE-3374: remove multus exception from monitor test #31130
CNTRLPLANE-3428: tls: extract annotation and ConfigMap update helpers #31156
OCPBUGS-83580: Skip dev fuse test on runc runtime #31140
OCPBUGS-84516: remove openshift-machine-config-operator exemption from terminationMessagePolicy monitor #31120
CNTRLPLANE-3387: Update list of pending namespaces in the required-scc monitor test #31135
NO-ISSUE: improve error reporting in cpumetriccollector #31132
no-jira: tls: deduplicate ConfigMap helpers into standalone functions #31136
OCPBUGS-84500: Verify dynamic revision bump for etcd during kernel crash #30915
OCPNODE-3983: Add e2e tests for KubeletEnsureSecretPulledImages feature gate #31102
OCPNODE-4381: Migrate OCP-38271 from openshift-tests-private #30960
OCPBUGS-85087: Allow OVN-Kubernetes CIDROverlap pathological events #31131
NO-JIRA: Increase pathological event thresholds for API server rollout scenarios #31122
CNTRLPLANE-2554: Add ExternalOIDCWithUpstreamParity e2e tests #31028
: no-jira: tls: extract injectTLSAnnotation constant #31125
OCPSTRAT-3036: Update etcd test data for k8s 1.36 release #31113
OCPNODE-4043: Fix NVIDIA DRA driver helm repo configuration #31104
TRT-2644: Run CP tests everywhere #31094
NO-JIRA: Remove fixed bugs on CO conditions #31081
OCPBUGS-84831: Optimize NetworkPolicy reconciliation test to reduce timeout #31114
NO-ISSUE: Automated - Update synthetic test data #31109
OCPBUGS-84809: Disable particular CSI tests if CSI driver is removed #31107
NO-JIRA: check jobname for upgrade #31106
OCPBUGS-84520: remove openshift-catalogd exemption from terminationMessagePolicy monitor #31100
OCPNODE-2994: Add ArtifactVolume tests and register artifact image #31017
NO-ISSUE: add QSEs as approvers #31087
SPLAT-2562: Added 3CMO OTE binary to extensionBinary list #31004
OCPCLOUD-3429: Ignore excessive image volume events from CAPI operator #31093
TRT-2622: copy OTE attrs to junit properties #31052
OCPBUGS-83580: Skip dev fuse test on runc runtime #31044
SREP-4676: add exception for managed cluster namespaces #31082
OCPBUGS-84257: fix openshift/network/third-party suite selecting zero tests #31084
TRT-2084: comment bugs filed for terminationMessage exemptions #31079
OCPBUGS-84504: retry transient kubeconfig read failures in GetClientConfig #31080
TRT-2565: Add simple benchmark for risk analysis HTTP requests #30965
NO-JIRA: Fix ListImages JSON parsing when extension binaries emit log lines #31009
OCPBUGS-84255: Fix project name error during wait #31062
NO-JIRA: Skip network policy cases on microshift and hypershift #31075
OCPBUGS-79544: test: add monitortest to detect pods stuck in Pending state #31045
OCPBUGS-79544: Add [Late] test to collect CRI-O goroutine dumps via SIGUSR1 #31013
NO-ISSUE: Automated - Update synthetic test data #31063
OCPBUGS-82072, OCPBUGS-82077: fix: skip unused tests for two node #30998
OCPBUGS-82144: Remove EnsureMemberRemoved from graceful shutdown test #30981
OCPEDGE-2381: Validate no WAL corruption when both nodes shutdown gracefully #30925
SPLAT-2562: Added VVCDO OTE binary to extensionBinary list #31014
NO-JIRA: harden watch loop to prevent thread exhaustion #30956
OCPBUGS-84244: cache kube client instance #30997
OCPBUGS-83281: Fix Gateway cleanup in parallel e2e test workers #31023
OCPBUGS-84237: skip on BM which has insufficient host #31002
OCPBUGS-83405: remove unnecessary exceptions from monitoring test #30924
NO-ISSUE: baremetal: update OWNERS #31055
OTA-1977: Skip test case updateLifecycle if the worker pool is paused #31040
OCPBUGS-82160: Skip image-registry operator tests for Libvirt platform in upgrade jobs. #31001
OCPEDGE-2284: Rename two_node directory to edge_topologies #30623
OCPBUGS-83402: Bump oc request-timeout to deflake tests #31008
OCPBUGS-82304: Add sleep to give cvo time to reconcile #30988
OCPBUGS-63307: Move imagepolicy test to disruptive long-running suite #31043
NO-JIRA: OVNK BGP: allow max unavailability for NNCPs on VRF-Lite test case #31037
OCPBUGS-83801: skip serial and disruptive cases from suite #31042
TRT-2635: coderabbit: enable request changes workflow #31047
TRT-2084: terminationmessagepolicy: correctly fail on violations #30993
OCPBUGS-84036: CNTRLPLANE-2751:Adding e2e network policy cases for config-operator #30995
OCPEDGE-2510: fix(two-node): bump node replacement timeouts for new node installer pods #31005
OCPBUGS-81476: Fix timeout in PinnedImages GC test #30962
OCPBUGS-63307: honor firstTimestamp annotation value #31021
no-jira: test/monitoring: increase load balancer readiness and curl connection timeout #30994
NO-JIRA: Fix UpgradeTargetPayloadImagePullSpec #31025
OCPSTRAT-3082: TLS propagation test #30801
NO-JIRA: OVNK BGP: improve debug and increase NNCP timeout for VRF-Lite test case #31022
OCPBUGS-83286: Fix case-sensitive error matching in Whereabouts IP allocation test #31012
OCPBUGS-83267: Use upgrades.Skippable for Gateway API upgrade test skip logic #31000
OCPEDGE-2381: Add test to verify for backup container exists when etcd crashes #30922
STOR-2807: Add e2e test to verify CSI driver operators use service CA signed certificates #30980
OCPEDGE-2381: Verify etc pod should start with oom_score_adj as system-node-critical #30982
OCPBUGS-78997: Revert “NO-ISSUE: test/e2e/upgrade: Raise default update-ack timeout to 10m” #30919
OCPBUGS-82557: DCM tests need to be backward compatible #30999
OCPBUGS-77948, OCPBUGS-77949, OCPBUGS-78298, OCPEDGE-2443: TNF node replacement test updates #30846
NO-JIRA: Update OWNERS #30996
OCPBUGS-82046: Revert “remove some duplicate ovnk test cases” #30975
OCPBUGS-78090: Avoid copy of the oc binary, to support heterogeneous environments #30992
OCPBUGS-81340: fix pacemaker CronJob duplicate-event namespace #30985
OCPEDGE-2491: Log pcs status and etcd member list after every recovery #30949
NE-2561: Add Gateway API OLM to NO-OLM migration upgrade test #30897
OCPBUGS-81716: Add retry logic for transient network errors in restartKubeletOnNode #30966
CORENET-6168: Add ovn tests extension #30560
OCPBUGS-81640: test/ccm: upgrade ccm healthz test to use aws sdk v2 #30954
TRT-2084: terminationmessagepolicy: relax for 5.0 #30979
OCPBUGS-81340: openshift-tests: allow duplicate pacemaker status collector CronJob events #30953
OCPBUGS-81737: Dynamically find worker-generated-kubelet MC name to support different platforms #30967
OCPBUGS-81742: Add exception for the newly added kas-bootstrap-container #30963
OCPNODE-4224: Migrating test case OCP-70987 from OTP to origin #30948
OCPBUGS-82039: Fix DCM ingress tests to support IPv6-only clusters #30972
OCPBUGS-81685: OVNK BGP: fix curl arguments not properly tokenized #30961
OCPBUGS-81751: Fix GatewayClass update conflict in markTestDone #30964
NO-JIRA: Ignore extra fields #30939
NO-JIRA: fix CUDN status condition tests for new TransportAccepted condition #30958
NE-2529: add new dcm e2e tests #30926
OCPBUGS-81629: Skip NoRegistryClusterInstall feature tests if InternalReleaseImage resource was not present #30955
NO-JIRA: feat: update etcd/certrotation suite to disruptive #30947
OCPCLOUD-3215: test/ccm: add support for verifying NLB health check configuration #30952
NE-2520: Enable Gateway API tests on vSphere and baremetal #30946
SPLAT-2672: e2e/ote/ccm-aws: moving binary to cccmo #30864
OCPNODE-3725: Add System compressible test #30935
OCPCLOUD-3215: Detect IPv6 clusters and apply correct policy #30938
OCPNODE-4179: Migrating test case OCP-80983 from openshift-tests-private to origin #30899
OCPSTRAT-886: Support dual-stack LB in service disruption monitor #30936
OCPBUGS-78978: Workaround packet sniffer timeouts in BGP tests #30912
OTA-1813: Allow for alerts to fire from an e2e test #30929
AGENT-1428: Add e2e extended tests for NoRegistryClusterInstall #30941
SPLAT-2627: Added MAPA OTE entry #30808
OCPSTRAT-2728: Rebase 1.35 #30866
OCPNODE-4043: Add DRA e2e tests to run on NVIDIA GPU #30758
NE-2422: Skip Gateway API tests on dual-stack clusters #30942
NE-2131: register CIO tests extension and remove tests migrated to CIO #30911
MCO-2171: remove MCO bootimage tests from origin #30933
OCPBUGS-78617: Fix PinnedImages test should respect node taints #30913
NO-ISSUE: Make MCN degrade test stable across TechPreview and non-TechPreview #30943
TRT-2573: Show non-blocking failure message in JUnit failure output #30921
NE-2422: Add dual-stack ingress e2e tests for AWSDualStackInstall featuregate #30904
OCPNODE-4031: Add criocredentialprovider tests #30821
OCPNODE-3720: Test for AutoNodeSizing #30789
NE-2422: Fix router e2e tests for dual-stack AWS clusters #30934
STOR-2505: Add storage binaries check #30698
OCPBUGS-78940: Treat groups as existent if they were found but discovery is stale #30923
NO-JIRA: Reverting case OOM score adjustment #30932
OCPEDGE-2447: IsMicroShiftCluster: return error instead of calling Skip from container node #30914
NE-2501: Allow prometheus test pods to access Ingress Operator metrics port #30928
NO-JIRA: remove extra character #30920
OCPEDGE-2447: increase precondition cluster health timeout to 10m #30893
OCPNODE-3751: Add automated tests for kubelet LimitedSwap drop-in configuration for CNV #30795
MCO-2155: add osstream exclusion for mco bootimage tests #30918
TRT-2539: Fix output capture in ginkgo RunSpec to capture stdout/stderr #30769
NE-2498: add new DCM e2e tests #30741
NO-ISSUE: test/e2e/upgrade: Raise default update-ack timeout to 10m #30917
TRT-2506: Add OS version info to ClusterData #30827
NE-2292: Tests for gatewayAPIWithoutOLM featuregate graduation #30905
OCPEDGE-2381: Verify etc pod should start with oom_score_adj as system-node-critical #30867
NO-JIRA: remove test exception for Insights operator #30849
NE-2292: Skip OLM tests when GatewayAPIWithoutOLM enabled #30896
NO-JIRA: Remove TNF node replacement test #30901
OCPBUGS-78384: changed http to https for three places to reduce test false positives and false negatives #30872
CNTRLPLANE-2999: Revert PR #30746: TLS 1.3 test causing instability in 4.22 #30895
NO-JIRA: Add a singleton instance for list of nodes #30830
OCPNODE-3932: Add automated tests for non-CNV swap configuration #30807
OCPBUGS-78016: Fix double counting of pod restart events #30862
CNTRLPLANE-2449: test(sig-builds][Feature:Builds]): ignore watchapi.Bookmark as they are synthetic and used only for signaling sync completion #30885
OCPBUGS-77281: Add exception for GCE CSI driver images #30870
OCPBUGS-77002: Remove temporarily skip of MCO tests creating custom MCPs in RHEL10 suites #30845
CNTRLPLANE-2549: monitortests: treat Thanos collection failure as flake in disruptive suites #30877
OCPBUGS-76334: Add TLS 1.3 (Modern profile) support to TestTLSDefaults #30746
OCPNODE-4093: Update readme to include long running test information #30791
OCPBUGS-48186: Add kubelet and CRI-O panic detection invariant test #30243
OCPBUGS-38666, OCPBUGS-38750, OCPBUGS-62623: Remove DNS test exceptions #30865
OCPBUGS-77991: suppress podman build - URLs #30851
SPLAT-2672: ote/ccm-aws removing binary while migrating to CCCMO #30869
OCPBUGS-8933: run resource request/limit check early #30874
TRT-2295: admit and extract non-payload OTE binaries #30863
CORENET-6462: Remove exceptions for network operator #30842
OCPEDGE-1036: fix: latency tuning for the rt-kernel tests on AWS metal #30790
OCPBUGS-78191: Exclude disruption during NoExecuteTaintManager serial tests #30855
TRT-2506: Add OS version validation to prow job name test #30826
OCPBUGS-66419: fix: handing static pods not appearing on SNO+RT metal lanes #30608
NO-JIRA: Add condition for rejecting connection #30835
OCPBUGS-77839: Remove ‘AppliedFilesAndOS’ reference in MachineConfigNode’s node degrade test #30841
NO-ISSUE: Automated - Update synthetic test data #30844
OCPBUGS-77807: Updating openshift-enterprise-tests-container image to be consistent with ART for 4.22 #30834
OCPBUGS-77014: Add Azure OS disk metrics to cloud monitor tests #30840
CNTRLPLANE-2202: Check for debug pod (regardless of ns) in default service account monitor test #30815
CORENET-6169, CORENET-6864: remove some duplicate ovnk test cases #30820
OCPBUGS-77736: add the missing namespace from managed openshift #30828
NO-JIRA: upkeep: remove dualreplica recert #30831
OCPBUGS-76943: Fix dualstack BMC secret and BMH lookup using short name extraction #30788
TRT-2372: document the manifest-list verification in the images command #30818
NO-JIRA: add NI&D team members #30816
NO-ISSUE: Automated - Update synthetic test data #30803
TRT-2563: Revert #30647 “STOR-2560: Add testcase for readonlyrootfilesystem” #30819
OCPBUGS-77085: Use multi-architecture zstd-chunked image #30805
TRT-2545: Extend known image checker to cover openshift-must-gather-* namespaces #30777
STOR-2560: Add testcase for readonlyrootfilesystem #30647
OCPBUGS-65623: Remove exception for monitoring OLM Progression condition #30754
STOR-2857: Enable MutableCSINodeAllocatableCount tests for all clusters #30767
CCO-690: Register cloud-credential-operator tests extension #29984
NE-906: fix DCM tests #30734
NO-JIRA: Exclude KubeJobFailed for periodic-gathering jobs in openshift-insights #30810
NO-JIRA: refactor(tnf): separate precondition timeouts from recovery cluster health #30812
NO-JIRA: Fix PodSecurityViolation in set-liveness-probe cmd test #30809
OCPNODE-4092: add the whole team as reviewers for node tests #30756
CNTRLPLANE-2202: add new exceptions + fail if uncaught default sa usage is detected #30685
NO-JIRA: Fix lack of human readable timestamps in two tests output #30796
NO-JIRA: update cluster-autoscaler component #30527
OCPBUGS-77010: [TNF] fix network disruption on ipv6 #30798
TRT-2372: filter-by-os is ignored when the image isn’t a manifest-list; leading to false positives in the check #30806
NE-1476: Allow test pods to access DNS metrics ports #30753
NO-JIRA: Batch etcdlog intervals to prevent hundreds of thousands slamming browser charts #30763
TRT-2471: Create massive test failure junit #30797
Revert “ OCPNODE-3932: Add automated tests for non-CNV swap configuration” #30804
TRT-2372: check that each of the required architectures is available for each image in the images command #30799
OCPBUGS-74151: Add test for CPMS OnDelete strategy with full master replacement #30760
OCPNODE-3932: Add automated tests for non-CNV swap configuration #30794
OCPBUGS-76551: Temporarily skip MCO tests creating custom MCPS with RHEL10 machines #30793
NO-JIRA:fixing CNV’s must-gather image ci failure #30784
NO-ISSUE: Automated - Update synthetic test data #30781
NO-JIRA: Remove RouteAdvertisements feature gate check #30787
OCPNODE-4093: Readme updates for Node tests #30773
NO-JIRA: Simplify zstd:chunked image test to use prebuilt image. #30739
OCPBUGS-60853: cert tests: mark TLS registry test as informing #30585
TRT-2545: Allow pathological Failed/ImagePullBackOff events in must-gather name #30776
OCPBUGS-76327: Fix flakiness in MutableCSINodeAllocatableCount test #30766
NO-JIRA: ote: fix duplicated topology label on SingleReplica #30759
NO-ISSUE: Automated - Update synthetic test data #30694
NO-JIRA: Ignore state transitions on upgrade failures and SNO #30762
SPLAT-2337: CCM-AWS OTE binary and skips #30747
NO-JIRA: Fix discrepancies in use of failure message vs output #30752
OCPEDGE-2166: test(two-node): stablize tnf recovery suite #30716
NO-JIRA: Fix OKD featureset test as it should only run if the current featureset is Default #30757
OCPBUGS-74917, TRT-2504: Claude command to manage watch request limits, split test by operator/component #30750
TRT-2540: Revert #30657 “OCPNODE-3944: Create e2e automation in origin for case OCP-84149” #30761
CNTRLPLANE-2196: reg ote bin for cluster auth operator #30735
NO-JIRA: upkeep: add collection of errors for crio tests #30743
OCPEDGE-1484: [TNF] kubelet disruption test #30290
OKD-259: Test OKD Feature set Against OKD and OCP clusters #30693
OCPNODE-3944: Create e2e automation in origin for case OCP-84149 #30657
OCPEDGE-2355: feat: skip unsupported commatrix tests for two node #30720
OCPEDGE-2274: fix: change arbiter topology test to verify pods do not run on arbiter nodes #30737
OCPQE-31524: Add conditional SCC wait for Kubernetes compatibility #30736
Revert “SPLAT-2337: Added OTE binary for ccm-aws” #30744
SPLAT-2337: Added OTE binary for ccm-aws #30525
NO-JIRA: bump SNO marketplace-operator watch count limit #30738
OCPBUGS-73778: revert LSO networkpolicy cases #30684
STOR-2838: fix OTP AsGuestKubeconf #30721
OCPBUGS-63307: Add/RemoveSigtermProtection event matcher for SigstoreImageVerification tests #30624
TRT-2522: Update optimized builds test to use rpm -qa instead of dnf #30722
NO-JIRA: Replace OCPBUGS-20062 with OCPBUGS-65984 #30554
OCPNODE-3203: Add a test suite for kubeletconfig testing #30648
OCPBUGS-61855: Revert “Temporarily disable InstallPlanStepAppliedWithWarnings alert for k8s 1.34 rebase” #30559
NO-ISSUE: Update boot image manifests for skew API #30712
NE-2376: Remove restriction of unmanaged x-k8s.io #30658
OCPBUGS-74237: Update MCN tests to better handle condition transitions through the “Unknown” state #30705
OTA-1681: remove etcd exceptions #30688
OCPBUGS-74280: Add filter for openshift-copy-to-node ns #30713
OCPBUGS-62929: Check router RBAC before external cert ops #30395
OCPCLOUD-3351: monitortest: add crdversionchecker #30603
OCPBUGS-65674: VsphereConfigurationTestsRollOutTooOften event matcher should use broader regex #30654
OCPSTRAT-2728: add images required for the 1.35 rebase (temporary) #30687
NO-JIRA: Remove exceptions for storage operators #30677
NO-ISSUE: Allow test to tolerate running on minimal images #30695
TRT-2483: feat(ginkgo): add monitor tests to extension test result output #30678
NO-JIRA: Update Networking team lead #30301
OCPEDGE-2303: update test logic for degraded cluster run #30649
NO-JIRA: CO must go Progressing during a minor-level upgrade #30626
OCPBUGS-39026: Remove exception for monitoring operator going degraded during upgrade #30012
NO-JIRA: Fix Pod.Create() to use –local flag for template processing #30686
OCPEDGE-1788: TNF add etcd cold boot recovery tests from graceful node shutdown #30519
NO-JIRA: Replace OCPBUGS-38667 with OCPBUGS-66225 #30551
OCPEDGE-2304: adjust olm test to pass on a degraded run #30664
OCPBUGS-72547: Isolate and reduce parallelism for OrderedNamespaceDeletion tests. #30672
OCPNODE-3823: Migrating test case from Openshift-test-private to origin #30512
NO-JIRA: add the intervals bucket for Netpol tests #30679
NO-ISSUE: Update synthetic test data #30680
NO-JIRA: Remove exceptions for co/machine-config on Available=False #30550
CNTRLPLANE-2167: Add oc-tests-ext to extension binaries #30653
OCPBUGS-69676: update watch request limits for cluster-autoscaler-operator #30656
NO-JIRA: Remove the exception for CO/console’s Available=False #30553
Revert “CNF-18661: add a skip on the commatrix test for the unsupported topology by commatrix” #30670
NO-ISSUE: Fix the PinnedImage test to set imageMinimumGCAge to 1s #30645
OCPBUGS-70170: change iperf2 test to serial from parallel #30671
NO-JIRA: register cluster-node-tuning-operator-test-ext the binary to origin for OTE migration #30598
NE-2056: auto negative tests of gatewayapicontroller #30599
NO-JIRA: Add more output for debegging #30583
NO-JIRA: Skip a ClusterOperator test if a cluster upgrade is blocked #30558
NO-JIRA: Track the total kubelet metrics outage durations with autodl framework #30593
NO-JIRA: Add images that shouldn’t be mirrored to the exception list. #30652
OCPBUGS-66225: Add more exceptions for CO/image-registry’s Degraded=True #30581
OCPBUGS-66065: remove duplicated events before processing lease intervals #30639
OCPBUGS-57665: only run Netpol two at a time #30618
OCPBUGS-70249: Unrevert tls tests with fixes #30536
OCPBUGS-70065: Updating openshift-enterprise-tests-container image to be consistent with ART for 4.22 #30636
OCPBUGS-69400: Ignore repeated TopologyAwareHintsDisabled events #30614
CNF-18661: add a skip on the commatrix test for the unsupported topology by commatrix #30640
CNTRLPLANE-2167: Migrate must-gather cases to origin #30594
NO-JIRA: Remove DennisPeriquet from OWNERS #30650
OCPSTRAT-2728: Update etcd test data for k8s 1.35 release #30605
OCPBUGS-67313: Fix race condition in external binary extraction #30616
OCPBUGS-70134: Fix JSONL parsing to handle stray JSON in test output #30634
TRT-2394: Detect duplicate tests #30498
CNTRLPLANE-947: E2E test adaptations for OIDC #30292
TRT-2418: Add CPU metrics autodl #30609
NO-JIRA: feat: render OTE JSON results in spyglass #30619
NO-JIRA: Increase tolerance of CO’s not reporting Progressing #30602
MCO-2006: move node-filecycle monitor to default #30592
NO-ISSUE: Two more COs report Available=False in a non-upgrade job #30588
CNTRLPLANE-1437: add monitor test for checking default service account in pods (static test name) #30561
NO-JIRA: feat(monitor): track test bucket execution intervals #30615
STOR-2550: add LSO network policy test case #30562
OCPBUGS-63618: BeforeEach was indirectly called in DetermineReleasePayloadImage #30610
CNTRLPLANE-1683: added the OTE binary for cluster-image-registry-operator #30612
OCPBUGS-67211: exculude Flaky tests for openshift/csi test suite #30597
OCPBUGS-65674: VsphereConfigurationTestsRollOutTooOften event matcher should match also dep and ds events #30547
NO-JIRA: Allow group snapshot tests to be re-tried #30607
OCPNODE-3780: Add e2e tests to validate DRA APIs #30462
And 6 elided commits (e.g. from squash or rebase merges)
Full changelog

thanos

OCPBUGS-121890: bump go.opentelemetry.io/otel to fix CVE-2026-41178 #205
OCPBUGS-104611: vendor: bump vulnerable Go dependencies for CVE remediation #198
NO-JIRA: [bot] Bump openshift/thanos to v0.42.4 #196
NO-ISSUE: [bot] Bump openshift/thanos to v0.42.3 #195
OCPBUGS-97627: [bot] Bump openshift/thanos to v0.42.2 #194
NO-JIRA: chore: revert narrow selectors detection for le/quantile labels #193
OCPBUGS-92812: Fix CVE-2026-39882 #190
OCPBUGS-87269: Updating ose-thanos-container image to be consistent with ART for 5.0 #189
OCPBUGS-81494: CVE-2026-33186 openshift4/ose-thanos-rhel9: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation #179
NO-JIRA: Bump to v0.41.0 #173
NO-JIRA: Disable default coderabbit reviews #171
OCPBUGS-77547: Updating ose-thanos-container image to be consistent with ART for 4.22 #170
OCPBUGS-69738: Updating ose-thanos-container image to be consistent with ART for 4.22 #166
Full changelog

volume-data-source-validator

STOR-2917: Rebase to v1.7.0 for OCP 5.0 #16
OCPBUGS-87381: Updating volume-data-source-validator-container image to be consistent with ART for 5.0 #15
STOR-2750: Rebase to upstream v1.6.0 for OCP 4.22 #9
OCPBUGS-69897: Updating volume-data-source-validator-container image to be consistent with ART for 4.22 #8
Full changelog

vsphere-cloud-controller-manager

OCPCLOUD-3596: Merge https://github.com/kubernetes/cloud-provider-vsphere:master (ed5683c) into main #118
OCPBUGS-87278: Updating ose-vsphere-cloud-controller-manager-container image to be consistent with ART for 5.0 #128
NO-JIRA: Update OWNERS #119
NO-JIRA: Merge https://github.com/kubernetes/cloud-provider-vsphere:release-1.35 (93af0f7) into main #113
OCPCLOUD-3275: Merge https://github.com/kubernetes/cloud-provider-vsphere:master (499b4a3) into main #101
Updating ose-vsphere-cloud-controller-manager-container image to be consistent with ART for 4.22 #102
Full changelog

vsphere-cluster-api-controllers

🚀 OCPCLOUD-3604: Merge https://github.com/kubernetes-sigs/cluster-api-provider-vsphere:v1.16.1 (5b57d1d) into main #112
🐛 OCPBUGS-85337: set imagePullPolicy IfNotPresent on provider workloads #114
OCPBUGS-87359: Updating ose-vsphere-cluster-api-controllers-container image to be consistent with ART for 5.0 #113
OCPBUGS-53005: Remove references to master branch #111
OCPBUGS-83600: Merge https://github.com/kubernetes-sigs/cluster-api-provider-vsphere:v1.15.3 (e917f8e) into master #107
NO-JIRA: manifests-gen: scope provider webhooks to capi namespace #106
OCPCLOUD-3359: Add TLS substitutions #99
NO-JIRA: Update manifests generator #100
NO-JIRA: Update OWNERS #96
OCPCLOUD-3295: Merge https://github.com/kubernetes-sigs/cluster-api-provider-vsphere:v1.15.2 (91522fc) into master #79
OCPCLOUD-3323: Update to new manifests-gen #82
OCPBUGS-69861: Updating ose-vsphere-cluster-api-controllers-container image to be consistent with ART for 4.22 #81
NO-JIRA: UPSTREAM: <carry>: Add manifests verify target #80
Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

STOR-2929: Rebase openshift v3.7.1 #187
OCPBUGS-87286: Updating vmware-vsphere-syncer-container image to be consistent with ART for 5.0 #185
OCPBUGS-87275: Updating ose-vmware-vsphere-csi-driver-container image to be consistent with ART for 5.0 #184
NO-ISSUE: Bump spdystream to v0.5.1 #181
OCPBUGS-81525: Bump google.golang.org/grpc to 1.79.3 #170
OCPBUGS-77563: Updating ose-vmware-vsphere-csi-driver-container image to be consistent with ART for 4.22 #164
Updating vmware-vsphere-syncer-container image to be consistent with ART for 4.22 #165
OCPBUGS-69760: Updating vmware-vsphere-syncer-container image to be consistent with ART for 4.22 #153
OCPBUGS-69746: Updating ose-vmware-vsphere-csi-driver-container image to be consistent with ART for 4.22 #152
Full changelog

vsphere-csi-driver-operator

STOR-3062: Remove the validation webhook #351
STOR-2914: Bump all deps for 5.0.0 #350
OCPBUGS-85345: Fixed hybrid env test to use disruptive / serial labels in title #344
OCPBUGS-87395: Updating ose-vmware-vsphere-csi-driver-operator-container image to be consistent with ART for 5.0 #346
SPLAT-2562: Created OTE extension with tests for hybrid env #335
STOR-2762: Bump all deps for 4.22 #334
STOR-2882: add feature gate for checking platform type is vsphere #331
OCPBUGS-77629: Updating ose-vmware-vsphere-csi-driver-operator-container image to be consistent with ART for 4.22 #333
OCPBUGS-74225: Bump library-go #328
OCPBUGS-74206: fix snapshot config non-deterministic ordering #329
STOR-2840: Declare RWX capability explicitly #324
STOR-2852: Enable snapshot tests for vsphere #321
OCPBUGS-69924: Updating ose-vmware-vsphere-csi-driver-operator-container image to be consistent with ART for 4.22 #320
OCPBUGS-66113: Some containers do not have readOnlyRootFilesystem #319
Full changelog

vsphere-problem-detector

OCPBUGS-87906: Fixed GetVCenter to handle removed FDs better #224
STOR-2914: Bump all deps for 5.0.0 #226
OCPBUGS-87355: Updating ose-vsphere-problem-detector-container image to be consistent with ART for 5.0 #223
CNF-23389: mockgen deprecated: use uber-go/mock instead #194
OCPBUGS-79057: Fixed compute cluster permission logic for single fd with read-only custom resourcepool #220
OCPBUGS-56274: add datacenter consistency check #212
STOR-2762: Bump all deps for 4.22 #214
OCPBUGS-77603: Updating ose-vsphere-problem-detector-container image to be consistent with ART for 4.22 #213
OCPBUGS-74989: GetVCenterHostnames lacks lock protection causing potential data race #209
OCPBUGS-70365: fix concurrent map writes #206
OCPBUGS-69856: Updating ose-vsphere-problem-detector-container image to be consistent with ART for 4.22 #199
Full changelog

Node Image Info

Loading node image info, this may take a while ...

CentOS Stream CoreOS 10 (`stream-coreos`)

Package List

cri-o-1.36.4-1.el10s
kernel-6.12.0-260.el10
openshift-kubelet-5.0.0-202609111609.p2.gb376ee7.assembly.stream.el10
systemd-257-32.el10

Full list (493 packages)

NetworkManager-1:1.58.0-1.el10
NetworkManager-cloud-setup-1:1.58.0-1.el10
NetworkManager-libnm-1:1.58.0-1.el10
NetworkManager-ovs-1:1.58.0-1.el10
NetworkManager-tui-1:1.58.0-1.el10
WALinuxAgent-udev-2.14.0.1-3.el10
aardvark-dns-4:2.1.0-1.el10
acl-2.4.0-2.el10
afterburn-5.10.0-2.el10
afterburn-dracut-5.10.0-2.el10
alternatives-1.30-2.el10
amd-gpu-firmware-20260812-26.el10
amd-ucode-firmware-20260812-26.el10
attr-2.6.0-2.el10
audit-4.2.1-3.el10
audit-libs-4.2.1-3.el10
audit-rules-4.2.1-3.el10
authselect-1.5.3-1.el10
authselect-libs-1.5.3-1.el10
azure-vm-utils-0.7.0-1.el10
basesystem-11-22.el10
bash-5.2.26-6.el10
bash-completion-1:2.11-16.el10
bind-libs-32:9.18.33-19.el10
bind-license-32:9.18.33-19.el10
bind-utils-32:9.18.33-19.el10
bootc-1.16.7-1.el10
bootupd-0.2.35-1.el10
bsdtar-3.7.7-10.el10
bubblewrap-0.10.0-3.el10
bzip2-1.0.8-25.el10
bzip2-libs-1.0.8-25.el10
c-ares-1.34.6-4.el10
ca-certificates-2026.2.90_v9.0.316-100.0.el10
catatonit-5:0.2.1-4.el10
centos-gpg-keys-10.0-23.el10
centos-release-cloud-1-1.el10s
centos-release-nfv-common-1-5.el10s
centos-release-virt-common-1-1.el10s
centos-stream-release-10.0-23.el10
centos-stream-repos-10.0-23.el10
checkpolicy-3.11-1.el10
chrony-4.8-2.el10
cifs-utils-7.6-2.el10
clevis-23-2.el10
clevis-dracut-23-2.el10
clevis-luks-23-2.el10
clevis-pin-tpm2-0.5.5-1.el10
clevis-systemd-23-2.el10
cloud-utils-growpart-0.33-11.el10
composefs-1.0.8-1.el10
composefs-libs-1.0.8-1.el10
conmon-3:2.2.1-4.el10
conmon-rs-0.6.6-2.el10s
console-login-helper-messages-0.21.3-10.el10
console-login-helper-messages-issuegen-0.21.3-10.el10
console-login-helper-messages-profile-0.21.3-10.el10
container-selinux-4:2.250.0-1.el10
containers-common-6:6.0-2.el10
containers-common-extra-6:6.0-2.el10
coreos-installer-0.26.0-1.el10
coreos-installer-bootinfra-0.26.0-1.el10
coreutils-9.5-13.el10
coreutils-common-9.5-13.el10
cpio-2.15-3.el10
cracklib-2.9.11-8.el10
cracklib-dicts-2.9.11-8.el10
cri-o-1.36.4-1.el10s
cri-tools-1.36.0-1.el10s
criu-4.2-9.el10
criu-libs-4.2-9.el10
crun-1.29.1-1.el10
crypto-policies-20260811-1.git4dcd294.el10
crypto-policies-scripts-20260811-1.git4dcd294.el10
cryptsetup-2.8.6-2.el10
cryptsetup-libs-2.8.6-2.el10
curl-8.12.1-6.el10
cyrus-sasl-gssapi-2.1.28-27.el10
cyrus-sasl-lib-2.1.28-27.el10
dbus-1:1.14.10-6.el10
dbus-broker-36-4.el10
dbus-common-1:1.14.10-6.el10
dbus-libs-1:1.14.10-6.el10
dbus-tools-1:1.14.10-6.el10
device-mapper-10:1.02.215-3.el10
device-mapper-event-10:1.02.215-3.el10
device-mapper-event-libs-10:1.02.215-3.el10
device-mapper-libs-10:1.02.215-3.el10
device-mapper-multipath-0.9.9-19.el10
device-mapper-multipath-libs-0.9.9-19.el10
device-mapper-persistent-data-1.3.2-1.el10
diffutils-3.10-8.el10
dmidecode-1:3.6-5.el10
dnf-4.20.0-27.el10
dnf-data-4.20.0-27.el10
dnsmasq-2.90-7.el10
dosfstools-4.2-12.el10
dracut-107-10.el10
dracut-network-107-10.el10
dracut-squash-107-10.el10
duktape-2.7.0-10.el10
e2fsprogs-1.47.1-5.el10
e2fsprogs-libs-1.47.1-5.el10
efi-filesystem-6-8.el10
efibootmgr-18-9.el10
efivar-libs-39-3.el10
elfutils-default-yama-scope-0.195-1.el10
elfutils-libelf-0.195-1.el10
elfutils-libs-0.195-1.el10
erofs-utils-1.8.10-1.el10
ethtool-2:6.19-1.el10
expat-2.7.3-2.el10
fcoe-utils-1.0.34-11.gitb233050.el10
file-5.45-12.el10
file-libs-5.45-12.el10
filesystem-3.18-17.el10
findutils-1:4.10.0-5.el10
firewalld-filesystem-2.4.3-4.el10
flatpak-session-helper-1.18.0-2.el10
fstrm-0.6.1-12.el10
fuse-common-3.16.2-5.el10
fuse-libs-2.9.9-25.el10
fuse3-3.16.2-5.el10
fuse3-libs-3.16.2-5.el10
fwupd-2.1.6-1.el10
gawk-5.3.0-6.el10
gdbm-1:1.23-14.el10
gdbm-libs-1:1.23-14.el10
gettext-envsubst-0.22.5-6.el10
gettext-libs-0.22.5-6.el10
gettext-runtime-0.22.5-6.el10
git-core-2.52.0-1.el10
glib2-2.80.4-15.el10
glibc-2.39-136.el10
glibc-common-2.39-136.el10
glibc-gconv-extra-2.39-136.el10
glibc-minimal-langpack-2.39-136.el10
gmp-1:6.2.1-12.el10
gnupg2-2.4.5-5.el10
gnutls-3.8.10-4.el10
gobject-introspection-1.79.1-7.el10
gpgme-1.23.2-6.el10
grep-3.11-10.el10
grub2-common-1:2.12-55.el10
grub2-efi-x64-1:2.12-55.el10
grub2-pc-1:2.12-55.el10
grub2-pc-modules-1:2.12-55.el10
grub2-tools-1:2.12-55.el10
grub2-tools-minimal-1:2.12-55.el10
gssproxy-0.9.2-10.el10
gzip-1.13-3.el10
hostname-3.23-14.el10
hwdata-0.379-10.10.el10
ignition-2.26.0-4.el10
ignition-grub-2.26.0-4.el10
ima-evm-utils-1.6.2-6.el10
info-7.1-6.el10
inih-58-3.el10
intel-gpu-firmware-20260812-26.el10
ipcalc-1.0.3-12.el10
iproute-7.0.0-2.el10
iproute-tc-7.0.0-2.el10
iptables-libs-1.8.11-16.el10
iptables-nft-1.8.11-16.el10
iputils-20240905-5.el10
irqbalance-2:1.9.4-6.el10
iscsi-initiator-utils-6.2.1.11-4.git4b3e853.el10
iscsi-initiator-utils-iscsiuio-6.2.1.11-4.git4b3e853.el10
isns-utils-libs-0.103-2.el10
jansson-2.14-3.el10
jose-14-102.el10
jq-1.7.1-13.el10
json-c-0.18-3.el10
json-glib-1.8.0-5.el10
kbd-2.6.4-7.el10
kbd-legacy-2.6.4-7.el10
kbd-misc-2.6.4-7.el10
kdump-utils-1.0.61-2.el10
kernel-6.12.0-260.el10
kernel-core-6.12.0-260.el10
kernel-modules-6.12.0-260.el10
kernel-modules-core-6.12.0-260.el10
kernel-modules-extra-6.12.0-260.el10
kexec-tools-2.0.32-3.el10
keyutils-1.6.3-5.el10
keyutils-libs-1.6.3-5.el10
kmod-31-13.el10
kmod-libs-31-13.el10
kpartx-0.9.9-19.el10
krb5-libs-1.21.3-11.el10
less-661-3.el10
libacl-2.4.0-2.el10
libaio-0.3.112-1.el10
libarchive-3.7.7-10.el10
libassuan-2.5.6-6.el10
libattr-2.6.0-2.el10
libbasicobjects-0.1.1-58.el10
libblkid-2.40.2-20.el10
libbpf-2:1.7.0-2.el10
libcap-2.69-7.el10
libcap-ng-0.9.3-2.el10
libcbor-0.11.0-3.el10
libcollection-0.7.0-58.el10
libcom_err-1.47.1-5.el10
libcomps-0.1.21-3.el10
libconfig-1.7.3-10.el10
libcurl-minimal-8.12.1-6.el10
libdhash-0.5.0-58.el10
libdnf-0.73.1-17.el10
libdnf-plugin-subscription-manager-1.30.15-1.el10
libdrm-2.4.128-1.el10
libeconf-0.6.2-4.el10
libedit-3.1-52.20230828cvs.el10
libev-4.33-15.el10
libevent-2.1.12-16.el10
libfdisk-2.40.2-20.el10
libffi-3.4.4-10.el10
libfido2-1.14.0-7.el10
libgcc-14.4.1-2.el10
libgcrypt-1.11.0-7.el10
libgomp-14.4.1-2.el10
libgpg-error-1.50-2.el10
libibverbs-62.0-3.el10
libicu-74.2-5.el10
libidn2-2.3.7-3.el10
libini_config-1.3.1-58.el10
libipa_hbac-2.13.1-2.el10
libjcat-0.2.2-2.el10
libjose-14-102.el10
libkcapi-1.5.0-3.el10
libkcapi-hasher-1.5.0-3.el10
libkcapi-hmaccalc-1.5.0-3.el10
libksba-1.6.7-2.el10
libldb-4.24.5-101.el10
libluksmeta-10-1.el10
libmaxminddb-1.9.1-4.el10
libmicrohttpd-1:1.0.0-3.el10
libmnl-1.0.5-7.el10
libmodulemd-2.15.0-12.el10
libmount-2.40.2-20.el10
libmspack-0.10.1-0.14.alpha.el10
libndp-1.9-2.el10
libnet-1.3-7.el10
libnetfilter_conntrack-1.0.9-12.el10
libnfnetlink-1.0.2-3.el10
libnfsidmap-1:2.8.3-9.el10
libnftnl-1.3.0-3.el10
libnghttp2-1.68.0-6.el10
libnl3-3.11.0-1.el10
libnvme-1.16.2-1.el10
libpath_utils-0.2.1-58.el10
libpcap-14:1.10.4-7.el10
libpciaccess-0.16-16.el10
libpkgconf-2.1.0-3.el10
libpwquality-1.4.5-13.el10
libref_array-0.1.5-58.el10
librepo-1.19.0-1.el10
libseccomp-2.5.6-1.el10
libselinux-3.11-1.el10
libselinux-utils-3.11-1.el10
libsemanage-3.11-1.el10
libsepol-3.11-1.el10
libsmartcols-2.40.2-20.el10
libsmbclient-4.24.5-101.el10
libsolv-0.7.33-6.el10
libss-1.47.1-5.el10
libsss_certmap-2.13.1-2.el10
libsss_idmap-2.13.1-2.el10
libsss_nss_idmap-2.13.1-2.el10
libsss_sudo-2.13.1-2.el10
libstdc++-14.4.1-2.el10
libtalloc-2.4.4-100.el10
libtasn1-4.20.0-5.el10
libtdb-1.4.15-100.el10
libtevent-0.17.1-100.el10
libtirpc-1.3.5-1.el10
libtool-ltdl-2.4.7-14.el10
libunistring-1.1-10.el10
liburing-2.12-1.el10
libusb1-1.0.30-1.el10
libutempter-1.2.1-15.el10
libuuid-2.40.2-20.el10
libuv-1:1.52.1-1.el10
libverto-0.3.2-10.el10
libverto-libev-0.3.2-10.el10
libwbclient-4.24.5-101.el10
libxcrypt-4.4.36-10.el10
libxml2-2.12.5-15.el10
libxmlb-0.3.28-1.el10
libxslt-1.1.39-10.el10
libyaml-0.2.5-16.el10
libzstd-1.5.5-9.el10
linux-firmware-20260812-26.el10
linux-firmware-whence-20260812-26.el10
lldpad-1.1.1-4.gitf1dd9eb.el10
lmdb-libs-0.9.32-4.el10
logrotate-3.22.0-5.el10
lsof-4.98.0-7.el10
lua-libs-5.4.8-1.el10
luksmeta-10-1.el10
lvm2-10:2.03.41-3.el10
lvm2-libs-10:2.03.41-3.el10
lz4-libs-1.9.4-8.el10
lzo-2.10-14.el10
makedumpfile-1.7.8-1.el10
mdadm-4.4-4.el10
microcode_ctl-4:20260210-1.el10
mokutil-2:0.7.2-5.el10
mpdecimal-2.5.1-12.el10
mpfr-4.2.1-8.el10
nano-8.1-3.el10
ncurses-base-6.4-15.20240127.el10
ncurses-libs-6.4-15.20240127.el10
net-tools-2.0-0.73.20160912git.el10
netavark-4:2.0.0-2.el10
nettle-3.10.1-1.el10
newt-0.52.24-5.el10
nfs-utils-1:2.8.3-9.el10
nftables-1:1.1.5-6.el10
nmap-ncat-4:7.92-5.el10
nmstate-2.2.61-2.el10
npth-1.6-21.el10
nss-altfiles-2.23.0-6.el10
numactl-2.0.19-3.el10
numactl-libs-2.0.19-3.el10
numad-0.5-50.20251104git.el10
nvidia-gpu-firmware-20260812-26.el10
nvme-cli-2.16-2.el10
oniguruma-6.9.9-7.el10
open-vm-tools-13.1.0-1.el10
openldap-2.6.13-1.el10
openshift-clients-5.0.0-202608132118.p2.g4b0a124.assembly.stream.el10
openshift-kubelet-5.0.0-202609111609.p2.gb376ee7.assembly.stream.el10
openssh-9.9p1-29.el10
openssh-clients-9.9p1-29.el10
openssh-server-9.9p1-29.el10
openssl-1:3.5.7-3.el10
openssl-fips-provider-1:3.5.7-3.el10
openssl-libs-1:3.5.7-3.el10
openvswitch-selinux-extra-policy-1.0-36.el10s
openvswitch3.5-3.5.3-5.el10s
os-prober-1.81-9.el10
ose-aws-ecr-image-credential-provider-5.0.0-202607281540.p2.g278e8c0.assembly.stream.el10
ose-azure-acr-image-credential-provider-5.0.0-202609151726.p2.g95f0a12.assembly.stream.el10
ose-crio-credential-provider-5.0.0-202603041733.p2.g83d4961.assembly.stream.el10
ose-gcp-gcr-image-credential-provider-5.0.0-202608040132.p2.g51c3264.assembly.stream.el10
ostree-2026.3-1.el10
ostree-grub2-2026.3-1.el10
ostree-libs-2026.3-1.el10
p11-kit-0.26.4-1.el10
p11-kit-trust-0.26.4-1.el10
pam-1.6.1-11.el10
pam-libs-1.6.1-11.el10
passt-0^20260728.gf8df3f1-1.el10
passt-selinux-0^20260728.gf8df3f1-1.el10
pciutils-3.13.0-6.el10
pciutils-libs-3.13.0-6.el10
pcre2-10.44-1.el10.3
pcre2-syntax-10.44-1.el10.3
pkgconf-2.1.0-3.el10
pkgconf-m4-2.1.0-3.el10
pkgconf-pkg-config-2.1.0-3.el10
podman-7:6.1.0-1.el10
podman-sequoia-0.4.0~pqc.3-1.el10
policycoreutils-3.11-1.el10
policycoreutils-python-utils-3.11-1.el10
polkit-125-6.el10
polkit-libs-125-6.el10
popt-1.19-8.el10
procps-ng-4.0.4-13.el10
protobuf-c-1.5.0-6.el10
psmisc-23.6-8.el10
python3-3.12.13-3.el10
python3-audit-4.2.1-3.el10
python3-charset-normalizer-3.4.2-1.el10
python3-cloud-what-1.30.15-1.el10
python3-dateutil-1:2.9.0.post0-1.el10
python3-dbus-1.3.2-8.el10
python3-decorator-5.1.1-12.el10
python3-distro-1.9.0-5.el10
python3-dnf-4.20.0-27.el10
python3-dnf-plugin-versionlock-4.7.0-12.el10
python3-dnf-plugins-core-4.7.0-12.el10
python3-file-magic-5.45-12.el10
python3-gobject-base-3.46.0-7.el10
python3-gobject-base-noarch-3.46.0-7.el10
python3-hawkey-0.73.1-17.el10
python3-idna-3.7-6.el10
python3-iniparse-0.5-10.el10
python3-inotify-0.9.6-36.el10
python3-libcomps-0.1.21-3.el10
python3-libdnf-0.73.1-17.el10
python3-librepo-1.19.0-1.el10
python3-libs-3.12.13-3.el10
python3-libselinux-3.11-1.el10
python3-libsemanage-3.11-1.el10
python3-packaging-24.2-2.el10
python3-pexpect-4.9.0-6.el10
python3-pip-wheel-23.3.2-11.el10
python3-policycoreutils-3.11-1.el10
python3-ptyprocess-0.7.0-9.el10
python3-pyyaml-6.0.1-19.el10
python3-requests-2.32.4-1.el10
python3-rpm-4.19.1.1-25.el10
python3-setools-4.7.0-1.el10
python3-setuptools-69.0.3-12.el10
python3-six-1.16.0-16.el10
python3-subscription-manager-rhsm-1.30.15-1.el10
python3-systemd-235-11.el10
python3-urllib3-1.26.19-4.el10
qemu-guest-agent-18:10.1.0-26.el10
quota-1:4.09-10.el10
quota-nls-1:4.09-10.el10
rdma-core-62.0-3.el10
readline-8.2-11.el10
rpcbind-1.2.9-0.el10
rpm-4.19.1.1-25.el10
rpm-build-libs-4.19.1.1-25.el10
rpm-libs-4.19.1.1-25.el10
rpm-ostree-2026.2-2.el10
rpm-ostree-libs-2026.2-2.el10
rpm-plugin-audit-4.19.1.1-25.el10
rpm-plugin-selinux-4.19.1.1-25.el10
rpm-plugin-syslog-4.19.1.1-25.el10
rpm-sequoia-1.10.2.3-1.el10
rpm-sign-libs-4.19.1.1-25.el10
rsync-3.4.4-1.el10
samba-client-libs-4.24.5-101.el10
samba-common-4.24.5-101.el10
samba-core-libs-4.24.5-101.el10
samba-ndr-libs-4.24.5-101.el10
sed-4.9-5.el10
selinux-policy-42.1.26-1.el10
selinux-policy-targeted-42.1.26-1.el10
setup-2.14.5-7.el10
sg3_utils-1.48-10.el10
sg3_utils-libs-1.48-10.el10
shadow-utils-2:4.15.0-13.el10
shadow-utils-subid-2:4.15.0-13.el10
shared-mime-info-2.3-8.el10
shim-x64-16.1-1.el10
skopeo-3:1.24.0-1.el10
slang-2.3.3-8.el10
snappy-1.1.10-7.el10
socat-1.7.4.4-9.el10
sos-4.11.2-5.el10
sqlite-libs-3.46.1-6.el10
ssh-key-dir-0.1.4-9.el10
sssd-2.13.1-2.el10
sssd-ad-2.13.1-2.el10
sssd-client-2.13.1-2.el10
sssd-common-2.13.1-2.el10
sssd-common-pac-2.13.1-2.el10
sssd-ipa-2.13.1-2.el10
sssd-krb5-2.13.1-2.el10
sssd-krb5-common-2.13.1-2.el10
sssd-ldap-2.13.1-2.el10
sssd-nfs-idmap-2.13.1-2.el10
sssd-proxy-2.13.1-2.el10
stalld-1.26.3-1.el10
strace-6.12-3.el10
subscription-manager-1.30.15-1.el10
subscription-manager-rhsm-certificates-20220623-6.el10
sudo-1.9.17-9.p2.el10
systemd-257-32.el10
systemd-journal-remote-257-32.el10
systemd-libs-257-32.el10
systemd-pam-257-32.el10
systemd-udev-257-32.el10
tar-2:1.35-11.el10
tmux-3.3a-14.20230918gitb202a2f.el10
toolbox-0.3-3.el10
tpm2-tools-5.7-6.el10
tpm2-tss-4.1.3-6.el10
tpm2-tss-fapi-4.1.3-6.el10
tzdata-2026c-1.el10
unbound-anchor-1.26.0-1.el10
unbound-libs-1.26.0-1.el10
userspace-rcu-0.14.0-7.el10
util-linux-2.40.2-20.el10
util-linux-core-2.40.2-20.el10
vim-data-2:9.1.083-22.el10
vim-minimal-2:9.1.083-22.el10
virt-what-1.27-3.el10
which-2.21-44.el10
xfsprogs-6.16.0-1.el10
xmlsec1-1:1.2.39-3.el10
xmlsec1-openssl-1:1.2.39-3.el10
xz-1:5.6.2-4.el10
xz-libs-1:5.6.2-4.el10
zlib-ng-compat-2.2.3-3.el10
zram-generator-1.1.2-14.el10
zstd-1.5.5-9.el10

Changed:

NetworkManager 1:1.56.0-1.el10 → 1:1.58.0-1.el10
NetworkManager-cloud-setup 1:1.56.0-1.el10 → 1:1.58.0-1.el10
NetworkManager-libnm 1:1.56.0-1.el10 → 1:1.58.0-1.el10
NetworkManager-ovs 1:1.56.0-1.el10 → 1:1.58.0-1.el10
NetworkManager-tui 1:1.56.0-1.el10 → 1:1.58.0-1.el10
aardvark-dns 2:1.17.0-1.el10 → 4:2.1.0-1.el10
acl 2.3.2-4.el10 → 2.4.0-2.el10
afterburn 5.10.0-1.el10 → 5.10.0-2.el10
afterburn-dracut 5.10.0-1.el10 → 5.10.0-2.el10
amd-gpu-firmware 20260130-22.el10 → 20260812-26.el10
amd-ucode-firmware 20260130-22.el10 → 20260812-26.el10
attr 2.5.2-5.el10 → 2.6.0-2.el10
audit 4.0.3-5.el10 → 4.2.1-3.el10
audit-libs 4.0.3-5.el10 → 4.2.1-3.el10
audit-rules 4.0.3-5.el10 → 4.2.1-3.el10
authselect 1.5.2-1.el10 → 1.5.3-1.el10
authselect-libs 1.5.2-1.el10 → 1.5.3-1.el10
bind-libs 32:9.18.33-15.el10 → 32:9.18.33-19.el10
bind-license 32:9.18.33-15.el10 → 32:9.18.33-19.el10
bind-utils 32:9.18.33-15.el10 → 32:9.18.33-19.el10
bootc 1.14.1-1.el10 → 1.16.7-1.el10
bootupd 0.2.32-1.el10 → 0.2.35-1.el10
bsdtar 3.7.7-7.el10 → 3.7.7-10.el10
c-ares 1.34.6-1.el10 → 1.34.6-4.el10
ca-certificates 2025.2.80_v9.0.305-102.el10 → 2026.2.90_v9.0.316-100.0.el10
centos-gpg-keys 10.0-21.el10 → 10.0-23.el10
centos-stream-release 10.0-21.el10 → 10.0-23.el10
centos-stream-repos 10.0-21.el10 → 10.0-23.el10
checkpolicy 3.10-1.el10 → 3.11-1.el10
chrony 4.8-1.el10 → 4.8-2.el10
cifs-utils 7.5-2.el10 → 7.6-2.el10
clevis 22-1.el10 → 23-2.el10
clevis-dracut 22-1.el10 → 23-2.el10
clevis-luks 22-1.el10 → 23-2.el10
clevis-pin-tpm2 0.5.3-9.el10 → 0.5.5-1.el10
clevis-systemd 22-1.el10 → 23-2.el10
conmon 3:2.2.1-3.el10 → 3:2.2.1-4.el10
container-selinux 4:2.246.0-1.el10 → 4:2.250.0-1.el10
containers-common 6:5.8-2.el10 → 6:6.0-2.el10
containers-common-extra 6:5.8-2.el10 → 6:6.0-2.el10
coreutils 9.5-7.el10 → 9.5-13.el10
coreutils-common 9.5-7.el10 → 9.5-13.el10
cri-o 1.34.4-1.el10s → 1.36.4-1.el10s
cri-tools 1.34.0-2.el10s → 1.36.0-1.el10s
criu 4.2-3.el10 → 4.2-9.el10
criu-libs 4.2-3.el10 → 4.2-9.el10
crun 1.26-2.el10 → 1.29.1-1.el10
crypto-policies 20260216-1.git0e54016.el10 → 20260811-1.git4dcd294.el10
crypto-policies-scripts 20260216-1.git0e54016.el10 → 20260811-1.git4dcd294.el10
cryptsetup 2.8.1-2.el10 → 2.8.6-2.el10
cryptsetup-libs 2.8.1-2.el10 → 2.8.6-2.el10
curl 8.12.1-4.el10 → 8.12.1-6.el10
dbus 1:1.14.10-5.el10 → 1:1.14.10-6.el10
dbus-common 1:1.14.10-5.el10 → 1:1.14.10-6.el10
dbus-libs 1:1.14.10-5.el10 → 1:1.14.10-6.el10
dbus-tools 1:1.14.10-5.el10 → 1:1.14.10-6.el10
device-mapper 10:1.02.210-2.el10 → 10:1.02.215-3.el10
device-mapper-event 10:1.02.210-2.el10 → 10:1.02.215-3.el10
device-mapper-event-libs 10:1.02.210-2.el10 → 10:1.02.215-3.el10
device-mapper-libs 10:1.02.210-2.el10 → 10:1.02.215-3.el10
device-mapper-persistent-data 1.3.0-1.el10 → 1.3.2-1.el10
dnf 4.20.0-23.el10 → 4.20.0-27.el10
dnf-data 4.20.0-23.el10 → 4.20.0-27.el10
dnsmasq 2.90-5.el10 → 2.90-7.el10
dracut 107-4.el10 → 107-10.el10
dracut-network 107-4.el10 → 107-10.el10
dracut-squash 107-4.el10 → 107-10.el10
efibootmgr 18-8.el10 → 18-9.el10
elfutils-default-yama-scope 0.194-2.el10 → 0.195-1.el10
elfutils-libelf 0.194-2.el10 → 0.195-1.el10
elfutils-libs 0.194-2.el10 → 0.195-1.el10
ethtool 2:6.15-2.el10 → 2:6.19-1.el10
expat 2.7.3-1.el10 → 2.7.3-2.el10
file 5.45-9.el10 → 5.45-12.el10
file-libs 5.45-9.el10 → 5.45-12.el10
firewalld-filesystem 2.4.0-1.el10 → 2.4.3-4.el10
flatpak-session-helper 1.16.0-9.el10 → 1.18.0-2.el10
fwupd 2.0.19-2.el10 → 2.1.6-1.el10
glib2 2.80.4-12.el10 → 2.80.4-15.el10
glibc 2.39-117.el10 → 2.39-136.el10
glibc-common 2.39-117.el10 → 2.39-136.el10
glibc-gconv-extra 2.39-117.el10 → 2.39-136.el10
glibc-minimal-langpack 2.39-117.el10 → 2.39-136.el10
gnupg2 2.4.5-4.el10 → 2.4.5-5.el10
gnutls 3.8.10-3.el10 → 3.8.10-4.el10
gobject-introspection 1.79.1-6.el10 → 1.79.1-7.el10
grub2-common 1:2.12-45.el10 → 1:2.12-55.el10
grub2-efi-x64 1:2.12-45.el10 → 1:2.12-55.el10
grub2-pc 1:2.12-45.el10 → 1:2.12-55.el10
grub2-pc-modules 1:2.12-45.el10 → 1:2.12-55.el10
grub2-tools 1:2.12-45.el10 → 1:2.12-55.el10
grub2-tools-minimal 1:2.12-45.el10 → 1:2.12-55.el10
hwdata 0.379-10.8.el10 → 0.379-10.10.el10
ignition 2.26.0-2.el10 → 2.26.0-4.el10
ignition-grub 2.26.0-2.el10 → 2.26.0-4.el10
ima-evm-utils 1.6.2-5.el10 → 1.6.2-6.el10
intel-gpu-firmware 20260130-22.el10 → 20260812-26.el10
iproute 6.17.0-2.el10 → 7.0.0-2.el10
iproute-tc 6.17.0-2.el10 → 7.0.0-2.el10
iptables-libs 1.8.11-12.el10 → 1.8.11-16.el10
iptables-nft 1.8.11-12.el10 → 1.8.11-16.el10
iscsi-initiator-utils 6.2.1.11-0.git4b3e853.el10 → 6.2.1.11-4.git4b3e853.el10
iscsi-initiator-utils-iscsiuio 6.2.1.11-0.git4b3e853.el10 → 6.2.1.11-4.git4b3e853.el10
isns-utils-libs 0.103-1.el10 → 0.103-2.el10
jq 1.7.1-11.el10 → 1.7.1-13.el10
kdump-utils 1.0.58-15.el10 → 1.0.61-2.el10
kernel 6.12.0-219.el10 → 6.12.0-260.el10
kernel-core 6.12.0-219.el10 → 6.12.0-260.el10
kernel-modules 6.12.0-219.el10 → 6.12.0-260.el10
kernel-modules-core 6.12.0-219.el10 → 6.12.0-260.el10
kernel-modules-extra 6.12.0-219.el10 → 6.12.0-260.el10
krb5-libs 1.21.3-9.el10 → 1.21.3-11.el10
libacl 2.3.2-4.el10 → 2.4.0-2.el10
libaio 0.3.111-22.el10 → 0.3.112-1.el10
libarchive 3.7.7-7.el10 → 3.7.7-10.el10
libattr 2.5.2-5.el10 → 2.6.0-2.el10
libblkid 2.40.2-19.el10 → 2.40.2-20.el10
libbpf 2:1.7.0-1.el10 → 2:1.7.0-2.el10
libcap-ng 0.8.4-6.el10 → 0.9.3-2.el10
libcurl-minimal 8.12.1-4.el10 → 8.12.1-6.el10
libdnf 0.73.1-14.el10 → 0.73.1-17.el10
libdnf-plugin-subscription-manager 1.30.14-1.el10 → 1.30.15-1.el10
libfdisk 2.40.2-19.el10 → 2.40.2-20.el10
libgcc 14.3.1-4.4.el10 → 14.4.1-2.el10
libgcrypt 1.11.0-6.el10 → 1.11.0-7.el10
libgomp 14.3.1-4.4.el10 → 14.4.1-2.el10
libibverbs 61.0-1.el10 → 62.0-3.el10
libipa_hbac 2.12.0-1.el10 → 2.13.1-2.el10
libldb 4.23.5-105.el10 → 4.24.5-101.el10
libmount 2.40.2-19.el10 → 2.40.2-20.el10
libnfsidmap 1:2.8.3-7.el10 → 1:2.8.3-9.el10
libnghttp2 1.68.0-4.el10 → 1.68.0-6.el10
libnvme 1.16.1-3.el10 → 1.16.2-1.el10
libpwquality 1.4.5-12.el10 → 1.4.5-13.el10
libselinux 3.10-1.el10 → 3.11-1.el10
libselinux-utils 3.10-1.el10 → 3.11-1.el10
libsemanage 3.10-1.el10 → 3.11-1.el10
libsepol 3.10-1.el10 → 3.11-1.el10
libsmartcols 2.40.2-19.el10 → 2.40.2-20.el10
libsmbclient 4.23.5-105.el10 → 4.24.5-101.el10
libsolv 0.7.33-2.el10 → 0.7.33-6.el10
libsss_certmap 2.12.0-1.el10 → 2.13.1-2.el10
libsss_idmap 2.12.0-1.el10 → 2.13.1-2.el10
libsss_nss_idmap 2.12.0-1.el10 → 2.13.1-2.el10
libsss_sudo 2.12.0-1.el10 → 2.13.1-2.el10
libstdc++ 14.3.1-4.4.el10 → 14.4.1-2.el10
libtalloc 2.4.3-100.el10 → 2.4.4-100.el10
libtasn1 4.20.0-1.el10 → 4.20.0-5.el10
libtdb 1.4.14-100.el10 → 1.4.15-100.el10
libusb1 1.0.29-3.el10 → 1.0.30-1.el10
libuuid 2.40.2-19.el10 → 2.40.2-20.el10
libuv 1:1.51.0-1.el10 → 1:1.52.1-1.el10
libwbclient 4.23.5-105.el10 → 4.24.5-101.el10
libxml2 2.12.5-10.el10 → 2.12.5-15.el10
libxmlb 0.3.24-1.el10 → 0.3.28-1.el10
libxslt 1.1.39-8.el10 → 1.1.39-10.el10
linux-firmware 20260130-22.el10 → 20260812-26.el10
linux-firmware-whence 20260130-22.el10 → 20260812-26.el10
lua-libs 5.4.6-7.el10 → 5.4.8-1.el10
lvm2 10:2.03.36-2.el10 → 10:2.03.41-3.el10
lvm2-libs 10:2.03.36-2.el10 → 10:2.03.41-3.el10
mdadm 4.4-3.el10 → 4.4-4.el10
mokutil 2:0.7.2-4.el10 → 2:0.7.2-5.el10
netavark 2:1.17.2-1.el10 → 4:2.0.0-2.el10
nfs-utils 1:2.8.3-7.el10 → 1:2.8.3-9.el10
nftables 1:1.1.5-3.el10 → 1:1.1.5-6.el10
nmstate 2.2.59-1.el10 → 2.2.61-2.el10
nvidia-gpu-firmware 20260130-22.el10 → 20260812-26.el10
open-vm-tools 13.0.10-1.el10 → 13.1.0-1.el10
openldap 2.6.10-1.el10 → 2.6.13-1.el10
openshift-clients 4.21.0-202603290052.p2.g9d9df34.assembly.stream.el9 → 5.0.0-202608132118.p2.g4b0a124.assembly.stream.el10
openshift-kubelet 4.21.0-202604030310.p2.gdfffacd.assembly.stream.el9 → 5.0.0-202609111609.p2.gb376ee7.assembly.stream.el10
openssh 9.9p1-24.el10 → 9.9p1-29.el10
openssh-clients 9.9p1-24.el10 → 9.9p1-29.el10
openssh-server 9.9p1-24.el10 → 9.9p1-29.el10
openssl 1:3.5.5-2.el10 → 1:3.5.7-3.el10
openssl-fips-provider 1:3.5.5-2.el10 → 1:3.5.7-3.el10
openssl-libs 1:3.5.5-2.el10 → 1:3.5.7-3.el10
ose-aws-ecr-image-credential-provider 4.21.0-202603171946.p2.gfdc7f3f.assembly.stream.el9 → 5.0.0-202607281540.p2.g278e8c0.assembly.stream.el10
ose-azure-acr-image-credential-provider 4.21.0-202603171055.p2.g83b3f9e.assembly.stream.el9 → 5.0.0-202609151726.p2.g95f0a12.assembly.stream.el10
ose-crio-credential-provider 4.21.0-202603171055.p2.g83d4961.assembly.stream.el9 → 5.0.0-202603041733.p2.g83d4961.assembly.stream.el10
ose-gcp-gcr-image-credential-provider 4.21.0-202603171055.p2.g8732386.assembly.stream.el9 → 5.0.0-202608040132.p2.g51c3264.assembly.stream.el10
ostree 2025.7-1.el10 → 2026.3-1.el10
ostree-grub2 2025.7-1.el10 → 2026.3-1.el10
ostree-libs 2025.7-1.el10 → 2026.3-1.el10
p11-kit 0.26.2-1.el10 → 0.26.4-1.el10
p11-kit-trust 0.26.2-1.el10 → 0.26.4-1.el10
pam 1.6.1-10.el10 → 1.6.1-11.el10
pam-libs 1.6.1-10.el10 → 1.6.1-11.el10
passt 0^20251210.gd04c480-3.el10 → 0^20260728.gf8df3f1-1.el10
passt-selinux 0^20251210.gd04c480-3.el10 → 0^20260728.gf8df3f1-1.el10
podman 7:5.8.0-2.el10 → 7:6.1.0-1.el10
podman-sequoia 0.4.0~pqc.2-1.el10 → 0.4.0~pqc.3-1.el10
policycoreutils 3.10-2.el10 → 3.11-1.el10
policycoreutils-python-utils 3.10-2.el10 → 3.11-1.el10
polkit 125-4.el10 → 125-6.el10
polkit-libs 125-4.el10 → 125-6.el10
procps-ng 4.0.4-11.el10 → 4.0.4-13.el10
python3 3.12.12-6.el10 → 3.12.13-3.el10
python3-audit 4.0.3-5.el10 → 4.2.1-3.el10
python3-cloud-what 1.30.14-1.el10 → 1.30.15-1.el10
python3-dnf 4.20.0-23.el10 → 4.20.0-27.el10
python3-dnf-plugin-versionlock 4.7.0-10.el10 → 4.7.0-12.el10
python3-dnf-plugins-core 4.7.0-10.el10 → 4.7.0-12.el10
python3-hawkey 0.73.1-14.el10 → 0.73.1-17.el10
python3-idna 3.7-4.el10 → 3.7-6.el10
python3-libdnf 0.73.1-14.el10 → 0.73.1-17.el10
python3-libs 3.12.12-6.el10 → 3.12.13-3.el10
python3-libselinux 3.10-1.el10 → 3.11-1.el10
python3-libsemanage 3.10-1.el10 → 3.11-1.el10
python3-pip-wheel 23.3.2-7.el10 → 23.3.2-11.el10
python3-policycoreutils 3.10-2.el10 → 3.11-1.el10
python3-rpm 4.19.1.1-23.el10 → 4.19.1.1-25.el10
python3-setools 4.6.0-3.el10 → 4.7.0-1.el10
python3-subscription-manager-rhsm 1.30.14-1.el10 → 1.30.15-1.el10
python3-urllib3 1.26.19-3.el10 → 1.26.19-4.el10
qemu-guest-agent 18:10.1.0-16.el10 → 18:10.1.0-26.el10
rdma-core 61.0-1.el10 → 62.0-3.el10
rpcbind 1.2.7-3.el10 → 1.2.9-0.el10
rpm 4.19.1.1-23.el10 → 4.19.1.1-25.el10
rpm-build-libs 4.19.1.1-23.el10 → 4.19.1.1-25.el10
rpm-libs 4.19.1.1-23.el10 → 4.19.1.1-25.el10
rpm-ostree 2026.1-4.el10 → 2026.2-2.el10
rpm-ostree-libs 2026.1-4.el10 → 2026.2-2.el10
rpm-plugin-selinux 4.19.1.1-23.el10 → 4.19.1.1-25.el10
rpm-sequoia 1.10.1.1-2.el10 → 1.10.2.3-1.el10
rpm-sign-libs 4.19.1.1-23.el10 → 4.19.1.1-25.el10
rsync 3.4.1-3.el10 → 3.4.4-1.el10
samba-client-libs 4.23.5-105.el10 → 4.24.5-101.el10
samba-common 4.23.5-105.el10 → 4.24.5-101.el10
selinux-policy 42.1.19-1.el10 → 42.1.26-1.el10
selinux-policy-targeted 42.1.19-1.el10 → 42.1.26-1.el10
sg3_utils 1.48-7.el10 → 1.48-10.el10
sg3_utils-libs 1.48-7.el10 → 1.48-10.el10
shadow-utils 2:4.15.0-11.el10 → 2:4.15.0-13.el10
shadow-utils-subid 2:4.15.0-11.el10 → 2:4.15.0-13.el10
shim-x64 15.8-5.el10 → 16.1-1.el10
skopeo 2:1.22.0-2.el10 → 3:1.24.0-1.el10
socat 1.7.4.4-8.el10 → 1.7.4.4-9.el10
sqlite-libs 3.46.1-5.el10 → 3.46.1-6.el10
sssd 2.12.0-1.el10 → 2.13.1-2.el10
sssd-ad 2.12.0-1.el10 → 2.13.1-2.el10
sssd-client 2.12.0-1.el10 → 2.13.1-2.el10
sssd-common 2.12.0-1.el10 → 2.13.1-2.el10
sssd-common-pac 2.12.0-1.el10 → 2.13.1-2.el10
sssd-ipa 2.12.0-1.el10 → 2.13.1-2.el10
sssd-krb5 2.12.0-1.el10 → 2.13.1-2.el10
sssd-krb5-common 2.12.0-1.el10 → 2.13.1-2.el10
sssd-ldap 2.12.0-1.el10 → 2.13.1-2.el10
sssd-nfs-idmap 2.12.0-1.el10 → 2.13.1-2.el10
sssd-proxy 2.12.0-1.el10 → 2.13.1-2.el10
subscription-manager 1.30.14-1.el10 → 1.30.15-1.el10
sudo 1.9.17-4.p2.el10 → 1.9.17-9.p2.el10
systemd 257-23.el10 → 257-32.el10
systemd-journal-remote 257-23.el10 → 257-32.el10
systemd-libs 257-23.el10 → 257-32.el10
systemd-pam 257-23.el10 → 257-32.el10
systemd-udev 257-23.el10 → 257-32.el10
tmux 3.3a-13.20230918gitb202a2f.el10 → 3.3a-14.20230918gitb202a2f.el10
tpm2-tools 5.7-5.el10 → 5.7-6.el10
tzdata 2026a-1.el10 → 2026c-1.el10
unbound-anchor 1.24.2-7.el10 → 1.26.0-1.el10
unbound-libs 1.24.2-7.el10 → 1.26.0-1.el10
util-linux 2.40.2-19.el10 → 2.40.2-20.el10
util-linux-core 2.40.2-19.el10 → 2.40.2-20.el10
vim-data 2:9.1.083-9.el10 → 2:9.1.083-22.el10
vim-minimal 2:9.1.083-9.el10 → 2:9.1.083-22.el10

Removed:

avahi-libs 0.9~rc2-3.el10
samba-common-libs 4.23.5-105.el10

Added:

numactl 2.0.19-3.el10
python3-file-magic 5.45-12.el10
python3-packaging 24.2-2.el10
python3-pexpect 4.9.0-6.el10
python3-ptyprocess 0.7.0-9.el10
python3-pyyaml 6.0.1-19.el10
python3-setuptools 69.0.3-12.el10
rpm-plugin-audit 4.19.1.1-25.el10
rpm-plugin-syslog 4.19.1.1-25.el10
samba-core-libs 4.24.5-101.el10
samba-ndr-libs 4.24.5-101.el10
sos 4.11.2-5.el10

Extensions

Full list (113 packages)

NetworkManager-libreswan-1.2.30-2.el10.x86_64
binutils-2.41-66.el10.x86_64
binutils-gold-2.41-66.el10.x86_64
bison-3.8.2-9.el10.x86_64
cmake-filesystem-3.31.8-1.el10.x86_64
cpp-14.4.1-2.el10.x86_64
elfutils-debuginfod-client-0.195-1.el10.x86_64
elfutils-libelf-devel-0.195-1.el10.x86_64
flex-2.6.4-19.el10.x86_64
gcc-14.4.1-2.el10.x86_64
glibc-devel-2.39-136.el10.x86_64
groff-base-1.23.0-10.el10.x86_64
kernel-6.12.0-260.el10.x86_64
kernel-core-6.12.0-260.el10.x86_64
kernel-devel-6.12.0-260.el10.x86_64
kernel-headers-6.12.0-260.el10.x86_64
kernel-modules-6.12.0-260.el10.x86_64
kernel-modules-core-6.12.0-260.el10.x86_64
kernel-modules-extra-6.12.0-260.el10.x86_64
kernel-rt-core-6.12.0-260.el10.x86_64
kernel-rt-devel-6.12.0-260.el10.x86_64
kernel-rt-modules-6.12.0-260.el10.x86_64
kernel-rt-modules-core-6.12.0-260.el10.x86_64
kernel-rt-modules-extra-6.12.0-260.el10.x86_64
krb5-pkinit-1.21.3-11.el10.x86_64
krb5-workstation-1.21.3-11.el10.x86_64
ldns-1.8.3-19.el10.x86_64
libkadm5-1.21.3-11.el10.x86_64
libmpc-1.3.1-7.el10.x86_64
libqb-2.0.8-6.el10.x86_64
libreswan-5.4-1.el10.x86_64
libreswan-minimal-5.4-1.el10.x86_64
libxcrypt-devel-4.4.36-10.el10.x86_64
libzstd-devel-1.5.5-9.el10.x86_64
lm_sensors-libs-3.6.0-20.el10.x86_64
m4-1.4.19-11.el10.x86_64
make-1:4.4.1-9.el10.x86_64
ncurses-6.4-15.20240127.el10.x86_64
nspr-4.39.0-5.el10.x86_64
nss-3.124.0-5.el10.x86_64
nss-softokn-3.124.0-5.el10.x86_64
nss-softokn-freebl-3.124.0-5.el10.x86_64
nss-sysinit-3.124.0-5.el10.x86_64
nss-tools-3.124.0-5.el10.x86_64
nss-util-3.124.0-5.el10.x86_64
openssl-devel-1:3.5.7-3.el10.x86_64
openvswitch3.5-ipsec-3.5.3-5.el10s.x86_64
pcp-conf-7.1.5-6.el10.x86_64
pcp-libs-7.1.5-6.el10.x86_64
perl-AutoLoader-5.74-515.el10.noarch
perl-B-1.89-515.el10.x86_64
perl-Carp-1.54-511.el10.noarch
perl-Class-Struct-0.68-515.el10.noarch
perl-Data-Dumper-2.189-512.el10.x86_64
perl-Digest-1.20-511.el10.noarch
perl-Digest-MD5-2.59-6.el10.x86_64
perl-DynaLoader-1.56-515.el10.x86_64
perl-Encode-4:3.21-511.el10.x86_64
perl-Errno-1.38-515.el10.x86_64
perl-Exporter-5.78-511.el10.noarch
perl-Fcntl-1.18-515.el10.x86_64
perl-File-Basename-2.86-515.el10.noarch
perl-File-Path-2.18-512.el10.noarch
perl-File-Temp-1:0.231.100-512.el10.noarch
perl-File-stat-1.14-515.el10.noarch
perl-FileHandle-2.05-515.el10.noarch
perl-Getopt-Long-1:2.58-3.el10.noarch
perl-Getopt-Std-1.14-515.el10.noarch
perl-HTTP-Tiny-0.088-512.el10.noarch
perl-IO-1.55-515.el10.x86_64
perl-IO-Socket-IP-0.42-512.el10.noarch
perl-IO-Socket-SSL-2.085-3.el10.noarch
perl-IPC-Open3-1.22-515.el10.noarch
perl-MIME-Base64-3.16-511.el10.x86_64
perl-Mozilla-CA-20231213-5.el10.noarch
perl-NDBM_File-1.17-515.el10.x86_64
perl-Net-SSLeay-1.94-9.el10.x86_64
perl-POSIX-2.20-515.el10.x86_64
perl-PathTools-3.91-512.el10.x86_64
perl-Pod-Escapes-1:1.07-511.el10.noarch
perl-Pod-Perldoc-3.28.01-512.el10.noarch
perl-Pod-Simple-1:3.45-511.el10.noarch
perl-Pod-Usage-4:2.03-511.el10.noarch
perl-Scalar-List-Utils-5:1.63-511.el10.x86_64
perl-SelectSaver-1.02-515.el10.noarch
perl-Socket-4:2.038-511.el10.x86_64
perl-Storable-1:3.32-511.el10.x86_64
perl-Symbol-1.09-515.el10.noarch
perl-Term-ANSIColor-5.01-512.el10.noarch
perl-Term-Cap-1.18-511.el10.noarch
perl-Text-ParseWords-3.31-511.el10.noarch
perl-Text-Tabs+Wrap-2024.001-511.el10.noarch
perl-Time-Local-2:1.350-511.el10.noarch
perl-URI-5.27-3.el10.noarch
perl-base-2.27-515.el10.noarch
perl-constant-1.33-512.el10.noarch
perl-if-0.61.000-515.el10.noarch
perl-interpreter-4:5.40.2-515.el10.x86_64
perl-libnet-3.15-512.el10.noarch
perl-libs-4:5.40.2-515.el10.x86_64
perl-locale-1.12-515.el10.noarch
perl-mro-1.29-515.el10.x86_64
perl-overload-1.37-515.el10.noarch
perl-overloading-0.02-515.el10.noarch
perl-parent-1:0.241-512.el10.noarch
perl-podlators-1:5.01-511.el10.noarch
perl-vars-1.05-515.el10.noarch
protobuf-3.19.6-15.el10.x86_64
python3-openvswitch3.5-3.5.3-5.el10s.x86_64
sysstat-12.7.6-4.el10.x86_64
usbguard-1.1.4-2.el10.x86_64
usbguard-selinux-1.1.4-2.el10.noarch
zlib-ng-compat-devel-2.2.3-3.el10.x86_64

CentOS Stream CoreOS base layer: 10 upgraded from 10.0.20260414-0 to 10.0.20260819-0

MGMT-24903: Fall back to CoreOS base layer: image from worker ignition for day-2 persistent-boot #10717

CNTRLPLANE-3552: Multi-stream CoreOS base layer: metadata parsing and stream resolution #8669

GCP-440: Fix GCP boot image discovery from CoreOS base layer: stream metadata #7881

OCPBUGS-87871: Add support for hermetic builds via Cachi2 prefetched CoreOS base layer: ISOs #95

METAL-1729: Add dual CoreOS base layer: version support for RHCOS 9 and 10 #81

View changelog in Markdown or change previous release:

Source code for this page located on github