Back to index

Download installer and client with:

oc adm release extract --tools quay.io/okd/scos-release:4.16.0-0.okd-scos-2024-09-24-151747

Team Approvals:

No tests for this release

Upgrades from:

• 4.16.0-0.okd-scos-2024-09-24-110446 (changes) - Success
• 4.16.0-0.okd-scos-2024-08-21-155613 - Success Success

Upgrades to:

• 4.17.0-0.okd-scos-2024-09-24-104828 (changes) - Success
• 4.16.0-okd-scos.0 (changes) - Success
• 4.16.0-0.okd-scos-2024-09-27-110344 (changes) - F F F
• 4.16.0-0.okd-scos-2024-09-24-192050 (changes) - Success

---

Changes from 4.16.0-0.okd-scos-2024-08-21-155613

Created: 2024-09-24 19:57:08 +0000 UTC

Image Digest: sha256:5a4e9ae9bea98a8df86aaefd35cfd1adbebd150062813ee06ee00da1c6a0a9a3

Release 4.16.0-0.okd-scos-2024-09-24-151747 was created from registry.ci.openshift.org/origin/release-scos:4.16.0-0.okd-scos-2024-09-24-151747

Components

• Kubectl 1.29.7
• Kubernetes upgraded from 1.29.7 to 1.29.8
• Kubernetes Tests 1.29.0
• CentOS Stream CoreOS upgraded from 418.9.202408211033-0 to 418.9.202409241032-0 (diff)

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
ExternalRouteCertificate (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)

Rebuilt images without code change

• operator-marketplace git 7db179fb sha256:9349f7746c62baaf408c555e77096bee1bb6fc5b0e07781593ffead2d7786627
• stream-coreos sha256:0ab5b2cc5b20d1ae088fc491c15d8fad82431e608f97a6318d4ab641f0d092dd
• stream-coreos-extensions sha256:a77e608cc867af6867933bb3e90e42f457f07a8cd66996ea744e6ccb7f9b5f08

agent-installer-api-server

• OCPBUGS-36577: Switch to github.com/docker/distribution/reference to Mitigate CVE-2024-3727 (#6752) #6752
• Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

• OCPBUGS-36577: Switch to github.com/docker/distribution/reference to Mitigate CVE-2024-3727 (#906) #906
• Full changelog

apiserver-network-proxy

• OCPBUGS-38062: Revert “Agent: Respect HTTPS_PROXY env vars for proxied connections” #59
• Full changelog

azure-file-csi-driver

• OCPBUGS-39145: bump mount-utils to treat ENODEV error as corrupted mount #76
• Full changelog

baremetal-installer, installer, installer-altinfra, installer-artifacts

• OCPBUGS-42012: Systemd Fails to Parse Multiline EC Keys #9037
• OCPBUGS-41845: Bump extract-machine-os timout to 20m #8997
• OCPBUGS-38964: IngressController subnet selection in AWS #8910
• OCPBUGS-42138: add tested instance type for IBMCloud #9031
• OCPBUGS-39287: Fix var_files syntax to work on older version of ansible #8936
• OCPBUGS-41929: Add AWS c7g,m7g,r8g to tested instance types #9009
• OCPBUGS-36855: Openstack UPI - Reintroduce unique resource names. #8724
• OCPBUGS-39082: incorrect folder gen, workaround govmomi vm folder path bug #8912
• OCPBUGS-39496: capi/aws/byo-vpc/multi-cidr: fix group rules #8953
• OCPBUGS-36861: Updates GCP terraform worker role #8939
• OCPBUGS-38956: failed to install Nutanix OCP 4.16 cluster with DHCP #8905
• OCPBUGS-38822: upstream capv bug causes session timeout #8891
• OCPBUGS-39468: Enable TLS for virtual media in initial ironic deployment #8955
• OCPBUGS-37606: vSphere validation fails if dc is in a folder #8777
• OCPBUGS-39206: Update GCP Disk Types 4.16 #8920
• OCPBUGS-39087: aws: validate public-only subnets configs #8913
• OCPBUGS-38821: [release-4.16] Azure: Disable shared key access when using a managed identity #8855
• OCPBUGS-38302: upi/aws: update lambda runtime python version #8897
• OCPBUGS-38826: aws: add support for clusters with public-only subnets #8892
• OCPBUGS-38517: [release-4.16] capi/aws: bump provider for instance register fix #8848
• OCPBUGS-38196: Remove timed context for gcp client #8818
• Full changelog

baremetal-operator

• OCPBUGS-39490: Disallow fetching secrets from namespaces different from the host’s one #378
• OCPBUGS-38938: [OCP] Ability to disable agent power off after deployment #372
• Full changelog

cli, cli-artifacts, deployer, tools

• OCPBUGS-39341: Ignore pruning when deployment points to replicationcontroller #1862
• Full changelog

cloud-credential-operator

• OCPBUGS-41234: List secrets in batches to avoid api timeout #757
• OCPBUGS-38376: Update google.golang.org/grpc v1.65.0 #748
• Full changelog

cluster-baremetal-operator

• OCPBUGS-31961: bump x/net to 0.23.0 #431
• Full changelog

cluster-config-api

• OCPBUGS-38773: remove duplicate featuregate ‘ExternalRouteCertificate’ #2007
• Full changelog

cluster-image-registry-operator

• Revert “[release-4.16] OCPBUGS-41903: pkg/operator/azurepathfixcontroller: do not sync on non-azure storage” #1119
• OCPBUGS-41903: pkg/operator/azurepathfixcontroller: do not sync on non-azure storage #1115
• OCPBUGS-39098: Avoid Shared Access Key usage for Azure Storage Account when using Managed Identity based auth #1104
• OCPBUGS-38894: pkg/resource/azurepathfixjob: invoke update-ca-trust extract with –output #1102
• OCPBUGS-38894: pkg/resource: invoke update-ca-trust extract with –output #1098
• Full changelog

cluster-ingress-operator

• OCPBUGS-39324: Refine logging for accurate infra CR status updates #1139
• OCPBUGS-39323: Ingress operator status not degraded when canary route fails #1138
• Full changelog

cluster-kube-storage-version-migrator-operator

• OCPBUGS-38269: bump protobuf #115
• Full changelog

cluster-monitoring-operator

• OCPBUGS-41967: disable user-defined monitoring per object #2474
• OCPBUGS-42067: Reapply “chore: poll immediately in the e2e tests” #2476
• OCPBUGS-41717: Configure graceful shutdown for metrics-server (4.16 backport) #2467
• OCPBUGS-41910: filter alerts sent to Telemeter #2471
• OCPBUGS-39170: Backport #2441 for 4.16 #2447
• Full changelog

cluster-network-operator

• OCPBUGS-41840: Add configurable subnets while running hybrid-overlay-node binary #2502
• OCPBUGS-37763: Handle random crictl errors in iptables-alerter #2452
• OCPBUGS-41555: HyperShift: do not use antiaffinity on single replica control planes #2494
• OCPBUGS-37937: Add proxy env vars to onvkube-node #2457
• OCPBUGS-41607: set required-scc for openshift workloads #2496
• Full changelog

cluster-node-tuning-operator

• OCPBUGS-39005: Add cluster-wide proxy env file (#1166) #1166
• OCPBUGS-36431 Fix generated cpu mask for 512+ cpus (#1152) #1152
• E2E: Remove checking of reserved cpus in irqbalance file (#1156) #1156
• Full changelog

cluster-samples-operator

• OKD-225: remove only the EOL CentOS 7 images #576
• Full changelog

console

• OCPBUGS-41996: Fix updating the “Until” field on the Silence > Edit page #14296
• OCPBUGS-38112: do not directly mutate links in useMemo #14117
• OCPBUGS-34518: Restore user toggle when authentification is disabled #13902
• OCPBUGS-41619: Use vCenterCluster value from CM as primary resource #14268
• OCPBUGS-37046: Fix TypeError: Cannot read properties of null (reading ‘metadata’) in Topology view #14059
• OCPBUGS-38911: Values entered into the Instantiate Template form are automatically cleared #14187
• OCPBUGS-38914: Unrelated readme opened when opening CodeReady workspaces from Quarkus using s2i quickstart #14188
• OCPBUGS-38968: A value submitted in From view is wrapped with single quotation after switching to Yaml view. #14193
• OCPBUGS-38424: fix bug where cluster version text appears black in da… #14144
• OCPBUGS-38464: correct casing in “Lightspeed” #14148
• OCPBUGS-37430: Fix utilization card limits/total display #14082
• OCPBUGS-36510: DeploymentConfigs deprecation info alert should not present on the Edit deployment page #14031
• OCPBUGS-37954: No access to list pipelines.tekton.dev prevents from using Delete application form #14107
• OCPBUGS-36601: Tooltip on Pipeline when expression is not shows #14033
• OCPBUGS-38803: CONSOLE-4108 [4.16 backport] Show deprecated operators in OperatorHub #14095
• Full changelog

csi-driver-manila-operator

• OCPBUGS-30438: Bump protobuf dependency #237
• Full changelog

docker-builder

• OCPBUGS-30455: bump google.golang.org/protobuf to 1.33.0 #402
• Full changelog

docker-registry

• OCPBUGS-39412: pull upstream distribution changes to use a consistent multipart chunk size #410
• Full changelog

hyperkube, installer-kube-apiserver-artifacts, pod

• OCPBUGS-39015: Bump k8s api to 1.29.8 #2066
• OCPBUGS-36773: UPSTREAM: <carry>: Disable vSphere tests with pre-provisioned volumes #2021
• Full changelog

hypershift

• chore(deps): update konflux references (release-4.16) #4781
• NO-JIRA: chore(deps): update konflux references (release-4.16) #4760
• NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.36 (release-4.16) #4759
• NO-JIRA: Security fixes for openshift-ci-security job #4750
• OCPBUGS-41372: CPO oauth idp converter: resolve names before dialing #4689
• NO-JIRA: chore(deps): update golang docker tag to v1.23 (release-4.16) #4729
• NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.34 (release-4.16) #4728
• NO-JIRA: chore(deps): update konflux references (release-4.16) #4727
• OCPBUGS-38058: Add HTTP konnectivity proxy to OAuth server #4496
• HOSTEDCP-1955: bump CCO version #4696
• OCPBUGS-34803: cmd: report server version, supported OCP #4141
• OCPBUGS-39293: copy image-registry AdditionalTrustedCA configmap into HC openshift-config #4647
• chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.21.11-9 (release-4.16) #4685
• OCPBUGS-38062: [release-4.16] Use HTTP proxy for ingress controller #4688
• NO-JIRA: chore(deps): update konflux references (release-4.16) #4684
• OCPBUGS-39447: handle version skewed NodePools that do not have rhel9 binaries #4664
• HOSTEDCP-1895: [release-4.16] Allow setting Kube APIServer maximum requests in flight #4551
• chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.21.11-7.1724661022 (release-4.16) #4600
• chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.33 (release-4.16) #4602
• chore(deps): update konflux references (release-4.16) #4599
• OCPBUGS-38942: copy oapi ca-trust recursively when building trust anchor #4615
• NO-JIRA: Flaky cert validation test #4622
• OCPBUGS-38259: Set KCM node monitor grace period #4520
• OCPBUGS-38726: fix: bump github.com/IBM/go-sdk-core/v5 #4611
• HOSTEDCP-1764: retrieve registryOverrides when ImageStream is not ava… #4541
• chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.21.11-7 (release-4.16) #4525
• Full changelog

insights-operator

• OCPBUGS-39394: collect some nmstate customresources (#986) (#989) (#995) #986
• OCPBUGS-38021: Integration of the OpenStack CRs into the insights-operator (#974) #974
• Full changelog

ironic

• OCPBUGS-37758, OCPBUGS-39383: Include fixes for CVE-2024-44082 #579
• OCPBUGS-38510: set min version for python3-webob #553
• OCPBUGS-33376: bump werkzeug #534
• OCPBUGS-36838: Update Jinja2 #521
• OCPBUGS-36285: Read ironic and inspector htpasswds from files #517
• Bug OCPBUGS-34985: Disable installation of .pyc files through pip #509
• Full changelog

ironic-agent

• OCPBUGS-39383: Include fixes for CVE-2024-44082 #161
• OCPBUGS-38510: set webob and bump werkzeug #149
• Full changelog

kube-metrics-server

• OCPBUGS-41717: Wire server run options to flags. ([release-4.16] backport) #37
• Full changelog

kube-proxy, sdn

• OCPBUGS-42159: fix redundant router-default iptables rule #633
• Full changelog

machine-api-operator

• CORS-3648: Add the hyperdisk-balanced disk type #1279
• Full changelog

machine-config-operator

• OCPBUGS-41806: When newly built images rolled out, the update progress is not displaying correctly (went 0 –> 3) #4584
• OCPBUGS-41518: CVE-2024-3727 ose-machine-config-operator-container: containers/image: digest type does not guarantee valid type #4569
• OCPBUGS-38997: Machine-config daemon ListPools panic during tech-preview CI runs #4550
• OCPBUGS-38711: SCC-pinning for openshift workloads #4539
• OCPBUGS-36850: Port number 22623 exposing weak ciphers to external client from master node IP #4556
• Full changelog

openshift-controller-manager

• OCPBUGS-39191: replaces deprecated square/go-jose wtih go-jose/go-jose #329
• OCPBUGS-37526: Race condition when deleting ServiceAccount #324
• Full changelog

openstack-cluster-api-controllers

• OCPBUGS-34931: rebase on release-0.10 (to fix trunks deletion) #321
• Full changelog

openstack-machine-api-provider

• OCPBUGS-34931: bump CAPO to v0.9.2 #124
• Full changelog

operator-lifecycle-manager, operator-registry

• OCPBUGS-41540: [4.16] add optional schema migrations; default to olm.bundle.object instead of olm.csv.metadata (#1384) #859
• OCPBUGS-41677: [4.17] adds paginating lister for evaluating CRs’ upgrade fitness versus new CRDs. #863
• OCPBUGS-41557: Fix e2e flake: upgrade CRD with deprecated version #861
• OCPBUGS-41217: (fix) registry pods do not come up again after node failure (#3366) #854
• OCPBUGS-38290: release-4.16 Resolver: list CatSrc using client, instead of referring to registry-server cache #838
• Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

• OCPBUGS-38697: Use more exact name match when deleting static routes to HO nodes. #2282
• OCPBUGS-24386: [release-4.16] EgressService: Fix ETP=Local ingress reply for LGW #2278
• OCPBUGS-38705: Delete EgressIP LRP stale nexthops when node is not found #2271
• OCPBUGS-38054: Fix per-pod MCS/metadata blocking #2248
• OCPBUGS-38699, OCPBUGS-38704: EgressIP VRF support & ignore localnet patch ports when bootstrapping #2267
• Full changelog

powervs-machine-controllers

• OCPBUGS-41976: Update go.mod to fix CVE - 4.16 #84
• Full changelog

prometheus

• OCPBUGS-39179: Restore Prometheus functionality to accept samples with different timestamps from the same series in a single scrape. #224
• Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

• OCPBUGS-38399: feat: sync proxy settings in Alertmanager configuration #299
• Full changelog

tests

• OCPBUGS-41611: Disable:Broken for [sig-builds][Feature:Builds][Slow] can use private repositories as build input build using an HTTP token should be able to clone source code via an HTTP token [apigroup:build.openshift.io] #29079
• OCPBUGS-38707: run vsphere driver config test on non techpreview clusters #28992
• OCPBUGS-38788: [4.16] egressfirewall: skip ping tests in case of hypershift kubevirt on Azure infra #28938
• Full changelog

vsphere-cloud-controller-manager

• OCPBUGS-37660: Bump otelgrpc to v0.53.0 #72
• Full changelog

---

View changelog in Markdown or change previous release: 4.16.0-0.okd-scos-2024-08-21-1556134.15.0-0.okd-scos-2024-01-18-223523───4.19.0-0.okd-scos-2025-04-01-0551514.19.0-0.okd-scos-2025-03-31-1751504.19.0-0.okd-scos-2025-03-31-0551494.19.0-0.okd-scos-2025-03-30-1751484.19.0-0.okd-scos-2025-03-30-0551474.19.0-0.okd-scos-2025-03-29-175146───4.18.0-0.okd-scos-2025-04-01-0145544.18.0-0.okd-scos-2025-03-31-1345544.18.0-0.okd-scos-2025-03-31-0145544.18.0-0.okd-scos-2025-03-29-1015314.18.0-0.okd-scos-2025-03-28-221531───4.17.0-0.okd-scos-2025-02-25-0904554.17.0-0.okd-scos-2025-02-24-2104554.17.0-0.okd-scos-2025-02-24-0904544.17.0-0.okd-scos-2025-02-23-2104544.17.0-0.okd-scos-2025-02-22-211215───4.16.0-0.okd-scos-2025-01-06-1432414.16.0-0.okd-scos-2025-01-04-1456004.16.0-0.okd-scos-2025-01-04-0142364.16.0-0.okd-scos-2025-01-03-1342364.16.0-0.okd-scos-2025-01-03-0142364.16.0-0.okd-scos-2024-12-17-0222464.16.0-0.okd-scos-2024-11-24-1100454.16.0-0.okd-scos-2024-11-23-1818454.16.0-0.okd-scos-2024-11-23-0618454.16.0-0.okd-scos-2024-11-22-1818454.16.0-0.okd-scos-2024-11-22-061845───4.15.0-0.okd-scos-2024-12-16-1913164.15.0-0.okd-scos-2024-01-18-1035224.15.0-0.okd-scos-2024-01-17-2235214.15.0-0.okd-scos-2024-01-17-1035204.15.0-0.okd-scos-2024-01-16-223519───4.15.0-0.okd-2025-03-28-1148024.15.0-0.okd-2025-03-26-0131074.15.0-0.okd-2025-03-25-1331074.15.0-0.okd-2025-03-13-2041304.15.0-0.okd-2025-02-12-1007064.15.0-0.okd-2024-03-27-1109014.15.0-0.okd-2024-03-26-2309014.15.0-0.okd-2024-03-23-1640104.15.0-0.okd-2024-03-23-0440104.15.0-0.okd-2024-03-22-164010───4.15.0-0.okd-2024-03-10-0101164.15.0-0.okd-2024-02-23-1634104.15.0-0.okd-2024-02-10-0355344.15.0-0.okd-2024-01-27-070424───4.19.0-okd-scos.ec.64.19.0-okd-scos.ec.54.19.0-okd-scos.ec.44.19.0-okd-scos.ec.34.19.0-okd-scos.ec.24.19.0-okd-scos.ec.14.19.0-okd-scos.ec.04.18.0-okd-scos.ec.34.18.0-okd-scos.ec.24.18.0-okd-scos.ec.14.18.0-okd-scos.ec.04.17.0-okd-scos.ec.44.17.0-okd-scos.ec.34.17.0-okd-scos.ec.24.17.0-okd-scos.ec.14.17.0-okd-scos.ec.04.17.0-0.okd-scos-2024-09-30-1017394.17.0-0.okd-scos-2024-09-26-2248284.17.0-0.okd-scos-2024-09-24-1048284.17.0-0.okd-scos-2024-08-21-100712

Source code for this page located on github