Back to index

Download installer and client with:

oc adm release extract --tools quay.io/okd/scos-release:4.18.0-okd-scos.10

Team Approvals:

Tests:

• Blocking jobs
  • upgrade Succeeded release-openshift-okd-scos-installer-e2e-aws-upgrade-from-scos-stable
  • upgrade-minor Succeeded release-openshift-okd-scos-installer-e2e-aws-upgrade-from-scos-stable

Upgrades from:

• 4.18.0-okd-scos.ec.3 - Failed Success
• 4.18.0-okd-scos.9 (changes) - Success
• 4.18.0-okd-scos.8 (changes) - Failed Success
• 4.17.0-okd-scos.ec.4 (changes) - Success

Upgrades to:

• 4.19.0-okd-scos.0 (changes) - Success

---

Changes from 4.18.0-okd-scos.ec.3

Created: 2025-05-12 16:59:12 +0000 UTC

Image Digest: sha256:f41a770c88f7414ea999aab7a550e24fde04ddb0be89a193b3f7e6c21de7af1b

Release 4.18.0-okd-scos.10 was created from registry.ci.openshift.org/origin/release-scos:4.18.0-0.okd-scos-2025-05-12-045424

Components

• Kubectl 1.31.1
• Kubernetes upgraded from 1.31.4 to 1.31.8
• Kubernetes Tests upgraded from 1.31.1 to 1.31.8
• CentOS Stream CoreOS upgraded from 418.9.202501310632-0 to 418.9.202504300632-0 (diff)

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
NetworkSegmentation (37 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled	Enabled
PersistentIPsForVirtualization (12 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled	Enabled
ExternalOIDCWithUIDAndExtraClaimMappings (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)

Removed images

• ovirt-machine-controllers

Rebuilt images without code change

• egress-router-cni git 3193a756 sha256:e57012fb29940596180385d25ccd481cc15ffb4f835799b5f14335be148d1d2e
• network-tools git f76635f2 sha256:3189f507c43de36a27bad399f3eb534a5cd3e498910cdbb1e370840ca3722ba2
• stream-coreos sha256:b7af2e6cd46cfffee7c729a3d44f701c000661ef5a467a4620803eb0db1dc98a
• stream-coreos-extensions sha256:4bf8b3cb24f02f3adf83f9764edafba133d94652d9503d5b9001105e55f79eb0

agent-installer-api-server

• OCPBUGS-54378: Bump go-jwt to 4.5.2 to fix CVE-30204 (#7483) #7483
• MGMT-20183: CVE-2025-27144 Bump github.com/go-jose/go-jose/v4 to v4.0.5 (#7456) #7456
• Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

• OCPBUGS-53721: Bump jwt to 4.5.2 in release-4.18 (#1085) #1085
• OCPBUGS-45116: Add retry to mount efi device (#1030) #1030
• Full changelog

agent-installer-node-agent

• OCPBUGS-52994: Update to latest ghw version (#958) #958
• MGMT-20227: Skip Motherboard serial if set to “-” (#955) (#957) #955
• OCPBUGS-54544: Bump github.com/go-jose/go-jose/v4 to v4.0.5 in release-4.18 (#965) #965
• OCPBUGS-53713: Bump golang-jwt/jwt/v4 to 4.5.2 in release-4.18 (#963) #963
• NO-ISSUE: Increase image pull timeout during install (#907) #907
• Full changelog

aws-cluster-api-controllers

• OCPBUGS-53729: Merge https://github.com/kubernetes-sigs/cluster-api-provider-aws:v2.7.2 (9283e64) into release-4.18 #543
• OCPBUGS-50556: UPSTREAM: 5339: Bump glog for recent fixes #537
• Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator

• OCPBUGS-54383: Disable remove-not-ready-taint for azure disk csi driver #374
• OCPBUGS-49843: Support HCP labels #356
• Full changelog

aws-pod-identity-webhook

• OCPBUGS-51231: github.com/go-jose/go-jose/v4 v4.0.5 #201
• Full changelog

azure-kms-encryption-provider

• OCPBUGS-53497: bump golang-jwt v4 #11
• Full changelog

azure-machine-controllers

• OCPBUGS-55373: Update eviction policy for Spot VMs from Deallocate to Delete #139
• OCPBUGS-54355: Re-reconcile machine on NIC provisioning failure #135
• OCPBUGS-48659: dynamically setting the amount of fault domains #125
• Full changelog

azure-workload-identity-webhook

• OCPBUGS-53801: github.com/golang-jwt/jwt/v4 v4.5.2 #31
• OCPBUGS-51233: github.com/go-jose/go-jose/v4 v4.0.5 #27
• Full changelog

baremetal-installer, installer, installer-altinfra, installer-artifacts

• OCPBUGS-55794: IBI nmstate unit test fix #9692
• OCPBUGS-54947: Fix Load balancer IP setup #9659
• OCPBUGS-45564: Align vSphere UPI haproxy config with IPI #9276
• OCPBUGS-53453: IBMCloud: Move to IBM TF openshift fork #9592
• OCPBUGS-53422: Avoid adding duplicate entries to NO_PROXY #9588
• OCPBUGS-52515: Remove error logging when determining image arch #9539
• OCPBUGS-52429: Remove tmp directory used for agent pxe files #9536
• OCPBUGS-51211: Fixes panic during GCP tags fetch due to unstable network #9513
• OCPBUGS-49885: [Nutanix] Install multi-NICs cluster failed with failureDomains #9440
• OCPBUGS-50524: Add cluster:master_nodes metric retrieval in docs #9449
• OCPBUGS-49864: handle runtime panic when validating ovnKubernetesConfig #9435
• OCPBUGS-49320: pkg/gcp/destroy: add waits to prevent leaks during heavy load #9402
• OCPBUGS-50870: PowerVS: destroy dhcp hack #9483
• OCPBUGS-50877: correct typo #9485
• OCPBUGS-49792: aws/edge/byovpc: subnets tag kube cluster tag to shared #9430
• OCPBUGS-49842: Disable IP Forwarding for CAPG Machines #9434
• OCPBUGS-46548: Update RHCOS 4.18 bootimage metadata to 418.94.202501221327-0 #9437
• OCPBUGS-49735: aws/byo-ip added required permission ec2:ReleaseAddress #9426
• Full changelog

baremetal-operator

• OCPBUGS-53324: BMO can expose any secret via BMCEventSubscription CRD #405
• OCPBUGS-45250: Remove dataImage finalizer if BMH is missing #389
• OCPBUGS-49699: Handle HFC for non-redfish HW #393
• Full changelog

cli, cli-artifacts, deployer, tools

• OCPBUGS-55449: Get installer image from configMap for node-image command #2013
• OCPBUGS-55647: Use fedora image in unit tests instead of centos #2014
• OCPBUGS-49440: Address golang.org/x/* CVEs #1961
• OCPBUGS-48714: monitor should not exit for temp api disconnect #1963
• Full changelog

cloud-credential-operator

• OCPBUGS-53825: update github.com/golang-jwt/jwt #837
• OCPBUGS-53345: github.com/golang/glog v1.2.4 #835
• OCPBUGS-51550: Ignore SNYK-GOLANG-GOLANGORGXOAUTH2JWS-8749594 due to not being affected #822
• OCPBUGS-51237: github.com/go-jose/go-jose/v4 v4.0.5 #824
• Full changelog

cluster-authentication-operator

• OCPBUGS-54569: Avoid duplicate OAuth client creation #764
• OCPBUGS-45051: [4.18] bump library-go to bring in workload-conditions fix #743
• Full changelog

cluster-autoscaler

• OCPBUGS-53241: improve replica counting and decrease target size behavior #346
• Full changelog

cluster-baremetal-operator

• OCPBUGS-53080: Add missing relatedObjects #467
• Full changelog

cluster-bootstrap

• OCPBUGS-49770: bootstrap API server should terminate only after API is HA #113
• Full changelog

cluster-config-api

• OCPBUGS-55792: [release-4.18] config: add uid and extra claim mappings for external OIDC configuration #2311
• OCPBUGS-53221: Allow spaces in AWS resource tags #2239
• OCPBUGS-54784: [release-4.18] Bump openshift/controller-tools to latest commit #2267
• OCPBUGS-51295, OCPBUGS-51380: Reject new NodeStatus with revision set #2215
• OCPBUGS-51295: [release-4.18] Add the option to test ratcheting validations within integration tests #2217
• OCPBUGS-51077: [4.18] bump controller-tools dependency to latest downstream commit #2210
• OCPBUGS-49751: ipam, virt: graduate persistent ips feature gate to GA #2140
• OCPBUGS-49809, SDN-5297, SDN-5403: [release-4.18] Graduate UserDefinedNetworks to GA #2127
• OCPBUGS-49780: Use BASE_REF env var to pull the release version for sippy data #2191
• Full changelog

cluster-csi-snapshot-controller-operator

• OCPBUGS-49843: Support HCP labels #227
• Full changelog

cluster-dns-operator

• OCPBUGS-52514: [release-4.18] Add runbook_url for CoreDNSErrorsHigh #429
• Full changelog

cluster-etcd-operator

• OCPBUGS-53513: fix CVE-2025-30204 #1413
• OCPBUGS-55066: increase etcdGRPCRequestsSlow duration #1408
• OCPBUGS-49772: Bump library-go for static pod controller apply fixes. #1395
• Full changelog

cluster-image-registry-operator

• OCPBUGS-51018: ensure that storage names don’t end in dashes #1179
• Full changelog

cluster-ingress-operator

• NE-1951: Pre-upgrade Admin Gate for Gateway API CRD Management Succession #1196
• NE-1952: Pre-upgrade check for Gateway API CRD Management Succession #1193
• OCPBUGS-48377: Add e2e tests for IdleConnectionTerminationPolicy #1194
• OCPBUGS-48377: Add support for IdleConnectionTerminationPolicy #1188
• Full changelog

cluster-kube-apiserver-operator

• OCPBUGS-49898: bindata/alerts/slo: improve burnrate calculation #1808
• OCPBUGS-53066: Bump library-go #1828
• OCPBUGS-46411: skip generating certs when networkConfig.status.ServiceNetwork is nil #1780
• OCPBUGS-50479: Increase waitForFallbackDegradedConditionTimeout #1798
• OCPBUGS-49773: Bump library-go for static pod controller apply fixes. #1796
• Full changelog

cluster-kube-controller-manager-operator

• OCPBUGS-49777: Bump library-go for static pod controller apply fixes. #832
• Full changelog

cluster-kube-scheduler-operator

• OCPBUGS-49776: Bump library-go for static pod controller apply fixes. #559
• Full changelog

cluster-monitoring-operator

• OCPBUGS-55005: chore: introduce context-rich anb case sensitive unmarshaller for the monitoring and set CMO to Upgradeable=false if errors are found #2592
• OCPBUGS-53024: Fix opentelemetry metrics to use regexp on label match #2578
• OCPBUGS-52565: Bump prometheus-operator to 0.78.2 #2576
• OCPBUGS-50706: Add incidents metric to telemetry #2570
• Full changelog

cluster-network-operator

• OCPBUGS-54717: Add IPv6 NGINX configuration #2683
• OCPBUGS-50582, OCPBUGS-52949: Unexpected Behavior During Cluster Upgrade for the ovn-ipsec-host pods #2644
• OCPBUGS-52837: frr-k8s: rename validatingwebhook name #2661
• OCPBUGS-48305: frr-k8s: align manifests with operator #2657
• OCPBUGS-41178: Updating cluster-network-operator-container image to be consistent with ART for 4.18 #2491
• OCPBUGS-50625: Cherry-pick RouteAdvertisements support back to 4.18 #2645
• OCPBUGS-49589: Update egressfirewall CRD to be consistent with ovn-kubernetes repo #2631
• OCPBUGS-49736: Fix UDN and CUDN hostSubnet validation #2637
• OCPBUGS-49670: OVNK should be able to annotate network ID on NADs #2635
• Full changelog

cluster-node-tuning-operator

• OCPBUGS-52352: Treat all aarch64 platforms as equals in tuned (#1303) (#1306) #1303
• machineconfig: add support for various hugepage sizes. (#1299) #1299
• OCPBUGS-51088: E2E: Add configuration tests related to align cpus by uncorecache feature (#1298) #1298
• e2e: common way to fetch poolName (#1255) (#1300) #1255
• Full changelog

cluster-olm-operator

• OCPBUGS-48478: [release-4.18] Add openshift node selector annotation #116
• Full changelog

cluster-openshift-apiserver-operator

• OCPBUGS-49749: Exclude etcd readiness checks from /readyz to ignore temporary etcd hiccups #613
• Full changelog

cluster-samples-operator

• OCPBUGS-55783: Samples Operator should sort failing image imports #638
• OCPBUGS-55782: only update LastTransitionTime if operator status change #637
• OCPBUGS-55781: Adding filter to clusterOperatorInformerEventHandler #636
• OCPBUGS-54258: Adding mutex to func createSamples on handler.go #615
• OCPBUGS-54351: add rhdmalone to owners #617
• Full changelog

cluster-storage-operator

• OCPBUGS-51320: fix Vsphere cluster Storage operator in Unavailable state #558
• OCPBUGS-49843: Support HCP labels #552
• Full changelog

cluster-update-keys

• NO-JIRA: Updating openshift-ci-release-key for 2 years #72
• Full changelog

cluster-version-operator

• OCPBUGS-55359: install/0000_00_cluster-version-operator_01_admingate_configmap: Add ack-4.18-kube-1.32-api-removals-in-4.19 #1181
• Full changelog

console

• OCPBUGS-54899: Fetching taskRuns in PLR details page using PLR UID also #14961
• OCPBUGS-54888: Can’t edit deployment (from the private git repository) in RHOCP 4.15 via console #14959
• OCPBUGS-45369: Authenticate user token in openshift Authenticate func #14664
• OCPBUGS-55195: fix bug where operator appears twice #14984
• OCPBUGS-54269: fix bug where /k8s/all-namespaces/volumesnapshots 404s #14905
• OCPBUGS-52372: VolumeSnapshots are not displayed in OpenShift Web Console #14833
• OCPBUGS-52406: Retain original path when detecting perspective #14834
• OCPBUGS-52371: Update the monitoring topic used by the console team #14832
• OCPBUGS-52490: enable clicking outside NodeLogs Selects to close them #14843
• OCPBUGS-50501: Updating cypress config to have video enabled for the CI results #14831
• OCPBUGS-52511: Remove logoutOpenShift method call #14845
• OCPBUGS-50609: update the Deployment pod on change in imageStream #14757
• OCPBUGS-50648: add support for “OpenShift Virtualization Engine” valid subscription filter on OperatorHub #14761
• OCPBUGS-51086: Show Observe section without PROMETHEUS and MONITORING flags #14784
• OCPBUGS-48798: Pipeline visualisation shows all tasks as Failed and after that goes to Running state #14698
• OCPBUGS-51180: Linkify OLM operator uninstall message #14789
• OCPBUGS-51149: Do not load CSRs if user does not have permissions #14787
• OCPBUGS-50647: Enable web terminal tests #14758
• OCPBUGS-50573: Render refresh popover after adding CSP directive to the ConsolePlugin CR #14755
• OCPBUGS-49867: Add support for conditional CSP headers #14720
• OCPBUGS-48736: update variable name for plugin name parsing #14696
• OCPBUGS-49921: fix run time error when no completed version exists #14743
• OCPBUGS-49920: fix bug where Search filter dropdown label isn’t i18n #14724
• OCPBUGS-48200: ‘create a Project’ button on Getting started page doesn’t work #14672
• Full changelog

console-operator

• OCPBUGS-52294: Custom route TLS should be optional when IngressController’s DefaultCertificate is set #966
• OCPBUGS-49867: Add ConsolePluginContentSecurityPolicy feature gate to… #959
• Full changelog

container-networking-plugins, containernetworking-plugins-microshift

• OCPBUGS-55354: Fix dhcp #186
• OCPBUGS-55346: Check error returned by ipv6 SettleAddresses #185
• Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

• OCPBUGS-43430: Merge https://github.com/kubernetes/cloud-provider-openstack:release-1.31 into release-4.18 #312
• Full changelog

docker-builder

• OCPBUGS-48071: Upgrade Kubernetes to 1.30.2 and Golang to 1.22 for compatibility #464
• OCPBUGS-46580: buildah dependency bump to 1.37.6 #453
• Full changelog

docker-registry

• OCPBUGS-49693: bump docker distribution #421
• Full changelog

etcd, installer-etcd-artifacts

• OCPBUGS-55724: Add configurable option for hardware-related timeout delay #328
• DOWNSTREAM: <carry>: OCPBUGS-51971: fix a compaction induce latency issue #312
• ETCD-708: Rebase etcd 3.5.18 openshift 4.18 #307
• Full changelog

gcp-machine-controllers

• OCPBUGS-52495: OCPBUGS-52494: Disable shielded VMs for non-UEFI disks #112
• Full changelog

gcp-pd-csi-driver

• OCPBUGS-44769: Fix RWX mode for hyperdisks #74
• Full changelog

haproxy-router

• OCPBUGS-48377: Add support for IdleCloseTerminationPolicy #647
• OCPBUGS-49389: Reject All CA-Signed Certs Using SHA1 #649
• Full changelog

hyperkube, installer-kube-apiserver-artifacts, kube-proxy, pod

• UPSTREAM: 127757 : OCPBUGS-55639: scheduler: Improve CSILimits plugi… #2283
• OCPBUGS-55267: Update to Kubernetes v1.31.8 #2278
• : OCPBUGS-54807: skip tests on platform type External #2268
• OCPBUGS-53015: Update to Kubernetes v1.31.7 #2248
• OCPBUGS-50929: Update to Kubernetes v1.31.6 #2208
• OCPBUGS-49841: Don’t retry storage calls with side effects. #2197
• OCPBUGS-48552: Update to Kubernetes 1.31.5 #2176
• OCPBUGS-49782: OCPBUGS-39305: UPSTREAM: <carry>: log only deprecated api requests #2195
• OCPBUGS-49749: UPSTREAM: <carry>: disable etcd readiness checks by default #2193
• Full changelog

hypershift

• OCPBUGS-55177: Don’t check if olm images exist if guest cluster #6065
• OCPBUGS-55230: Add annotation to configure KAS goaway-chance #6066
• OCPBUGS-54865: KAS-Bump audit-webhook-initial-backoff and TerminationGracePeriodSeconds when audit webhook is enabled #6020
• OCPBUGS-54737: Bump socks5 proxy, konnectivity proxy, http proxy, token minter memory requests #6052
• OCPBUGS-55148: Update OpenShift apiserver liveness and readiness probe endpoints to livez and readyz #6059
• OCPBUGS-54946, RHOCPPRIO-433: Add validation to avoid conflicts between KubeAPIServer and NamedCertificates SANs #6091
• OCPBUGS-55146: Use 135 for terminationGracePeriodSeconds for v2 KAS #6057
• OCPBUGS-54698: Add missing servicemonitors and prometheusrules permissions for non-OVN #6000
• OCPBUGS-53404: Set shutdown watch termination grace period on kube-apiserver #5874
• OCPBUGS-51810: Fix golang crypto dependency go.mod replacement #5992
• OCPBUGS-54814: [release-4.18] add feature set aware feature gates to HO and CPO #6014
• OCPBUGS-54624: Don’t set IgnitionServerTokenExpirationTimestampAnnotation if already set #5980
• OCPBUGS-54630: Sync RBAC for attaching volumes on VM level #5988
• OCPBUGS-54627: Use system trust bundle in CPO IDP https client #5981
• ARO-15695, OCPBUGS-54625: backport capabilities api #5964
• OCPBUGS-54411: Backport PR 5876 to release-4.18 #5936
• OCPBUGS-54498: Support hypershift-operator scoping for secretJanitor #5961
• OCPBUGS-54609: [release-4.18] fix(api): Adjust CRD validation rules to account for ignition server disable #5950
• NO-JIRA: Red Hat Konflux update control-plane-operator-4-18 #5963
• OCPBUGS-53905: bump golang-jwt v4 and v5 #5905
• ART-11792: update go mod dependency for konflux #5919
• OCPBUGS-51739, OCPBUGS-51810: Bump dependencies to OCP fork in backports #5898
• OCPBUGS-53321: Handle multiple mirror entries for source #5890
• OCPBUGS-51239: fix(deps): bump go-jose #5858
• OCPBUGS-52982: Fix audit-logs container to properly handle SIGTERM #5774
• OCPBUGS-52863: stop using dev mode for loggers #5811
• OCPBUGS-52878: Kubernetes API Server apply-bootstrap container does not respect SIGTERM #5780
• OCPBUGS-52516: Make managed-trust-bundle optional #5783
• OCPBUGS-52417: [release-4.18] refactor aws identity health check into new controller #5770
• OCPBUGS-51375: use registryOverrides when automaitcally retrieving catalog images for hosted control plane #5723
• OCPBUGS-50696: add region to AWS creds passed to operators managed by CPO #5629
• OCPBUGS-51050: Add HostedCluster additional trustbundles to konnectivity-https-proxy #5667
• NO-JIRA: Update dependency mkdocs-mermaid2-plugin to v1.2.1 #5640
• NO-JIRA: Update dependency mkdocs to v1.6.1 #5638
• OCPBUGS-50550: Honor proxy vars in the util insecure http client #5598
• OCPBUGS-49698: Konnectivity: add agent readiness #5521
• OCPBUGS-45600: override OpenShiftPodSecurityAdmission featue gate to false for HCP components #5585
• OCPBUGS-49827: Duplicate hostDevices.name when hostDevices.deviceName has multiple types. #5557
• OCPBUGS-49904: Use /livez for kubernetes scheduler liveness probe #5567
• OCPBUGS-45600: enforce privileged PSA by default #5566
• OCPBUGS-49819: Add ObjectEncoding to the Azure API and SecretProviderClass Reconciliation in the CPO #5548
• OCPBUGS-48689: Remove Credentials from the Azure API #5530
• Full changelog

ibm-vpc-block-csi-driver

• OCPBUGS-53913: bump github.com/golang-jwt/jwt/v4 to v4.5.2 #82
• Full changelog

ibmcloud-cluster-api-controllers

• OCPBUGS-50565: Fix for CVE-2024-45338 in golang.org/x/net/html in release-4.18 #100
• Full changelog

ibmcloud-machine-controllers

• OCPBUGS-52872: IBMCloud: MAPI replacing unhealthy CP nodes #62
• Full changelog

insights-operator

• OCPBUGS-51163: Fix bad IPv6 address (#1074) #1074
• OCPBUGS-48790: Add a liveness probe to the extractor container (#1068) #1068
• Full changelog

ironic

• METAL-1302: Do not use openstack packages #646
• OCPBUGS-52290: Fix runlogwatch script #642
• OCPBUGS-50641: Install python3-inotify pkg explicitly #639
• OCPBUGS-49982: Fix runlogwatch failure if LOG_DIR does not exist #636
• OCPBUGS-49765: Drop quiet option of grep to avoid race condition with pipefail #632
• OCPBUGS-49755: Use pynotify instead of inotify-tools #630
• Full changelog

ironic-agent

• OCPBUGS-55364: Delay determining the hostname to put into ignition #183
• METAL-1302: Do not use openstack packages #178
• Full changelog

kubevirt-csi-driver

• OCPBUGS-54630: Ensure volume stays attached through reboots #55
• Full changelog

machine-api-operator

• OCPBUGS-52494, OCPBUGS-52496: Updates GCP credentials request #1341
• OCPBUGS-52567: add image/read permissions #1342
• OCPBUGS-51263: Drop oVirt support #1333
• CORS-3741: [Nutanix] support multi-subnets in Machine providerSpec #1301
• Full changelog

machine-config-operator

• OCPBUGS-53427: pkg/operator/status: Drop kubelet skew guard, add RHEL guard #4956
• [release 4.18] OCPBUGS-55473: In OCL. Usbguard service fails when we install the usbguard extension #5018
• OCPBUGS-54765: [release-4.18] kubelet-service: narrow down restorecon path #4978
• OCPBUGS-55428: MSBIC should not update windows machinesets #5012
• OCPBUGS-55290: MCO should fall back to us-east-1 for AWS bootimages if no region specific-AMI exists #5000
• OCPBUGS-55293: Fix PollUntilContextTimeout in syncRenderConfig #5001
• Update cluster operator’s status condition message #4993
• OCPBUGS-53278: In OCL. Cannot install extensions #4945
• OCPBUGS-54817: Make mtu-migration run after wait-for-primary-ip #4979
• OKD-239: Consolidate OpenStack and PowerVS hostname handling into mco-hostname script #4955
• OCPBUGS-54462: OSUpdateStarted event should only be emitted on actual OS updates #4967
• OCPBUGS-51132: [release-4.18] /etc/crio/crio.conf.d/00-default should contain runtime_root for runc #4869
• OCPBUGS-52949: Add ipsec connect wait service #4926
• OCPBUGS-53306: Fixing typos for MachineConfigNode #4927
• OCPNODE-2276: Set Upgradeable=False when cluster is on cgroup v1 #4921
• OCPBUGS-53111: daemon: ensure ostree-finalize-staged is started before rebooting #4918
• OCPBUGS-53110: Update ObservedGeneration in KubeletConfig #4917
• [release 4.18] OCPBUGS-50954: In OCL, MCPs are reporting Updating=false while the image is being built #4859
• OCPBUGS-50865: Make resolv-prepender env file optional #4855
• OCPBUGS-48809: Enable nmstate-configuration on all platforms #4804
• OCPBUGS-48296: Update machine-config-daemon-pull.service to use custom policy for Podman < 4.4.1 #4788
• OCPBUGS-48341: configure-ovs workaround for ovs-if-br-ex bug #4883
• OCPBUGS-51015: Enforce VIPs to be collocated at the same host #4865
• OCPBUGS-51194: Update cluster-reader ClusterRole permissions #4874
• OCPBUGS-50633: Update format verbs for alert logs #4849
• OCPBUGS-49774: Correct MachineConfig documentation on sysstat extension support #4829
• OCPBUGS-49433: create /run/nodeip-configuration before use #4813
• OCPBUGS-46032: Update the storage.conf configuration file template #4751
• Full changelog

machine-os-images

• OCPBUGS-53141: Change rhcos release browser url #55
• OCPBUGS-51266: Decompress pxe file only if it’s a valid compressed file #52
• OCPBUGS-45456: Fix shellcheck #47
• Full changelog

metallb-frr

• OCPBUGS-55343: OpenShift Only: TEMPORARY: pin FRR version to known working rpm #88
• OCPBUGS-48305: Use metrics for readiness/liveness probes #76
• Full changelog

monitoring-plugin

• OU-724: remove deleted image #376
• Full changelog

multus-cni, multus-cni-microshift

• OCPBUGS-47470: adds getpodcontext (backport 4.18) #259
• Full changelog

multus-whereabouts-ipam-cni

• OCPBUGS-55270: Fix whereabouts-reconciler no namespace error #362
• Full changelog

networking-console-plugin

• CNV-60065: fix cudn input name #240
• OCPBUGS-49395: Add translations #238
• Add translations scripts #234
• CNV-56436: show ipam lifecycle correctly with new spec #220
• CNV-56236: fix cudn modal form titles #219
• CNV-56336: fix ipam lifecycle with new spec #213
• CNV-56076: create cudn from empty state #211
• Fix nads with no label #207
• OCPBUGS-49681: Fix weight width #205
• Full changelog

nutanix-machine-controllers

• OCPBUGS-51861: fixing CVE-2025-22868 #96
• OCPBUGS-54616: Fix link-local addresses being added to machine #101
• OCPBUGS-47268: fixing CVE-2024-45338 #91
• Full changelog

oauth-apiserver

• OCPBUGS-49847: Prevent storage layer retries for methods with side effects. #129
• Full changelog

oauth-proxy

• OCPBUGS-48332: Update dependencies to address CVE-2024-24786 #312
• Full changelog

oc-mirror

• OCPBUGS-54626: [release-4.18] cli: return distinct error codes depending on failure (#1125) #1125
• OCPBUGS-55361: v2/operator: refactor operator FilteredCollector (#1134) #1134
• OCPBUGS-51217: Fix CVE-2025-27144 (#1108) #1108
• OCPBUGS-54727: Use tag 0.0.3+2 of catalog-filter (#1128) #1128
• OCPBUGS-52978: delete: fix typo in –help output (#1121) #1121
• OCPBUGS-52960: v2: fix setting version during build (#1118) #1118
• OCPBUGS-52969: remove TechPreview mentions of v2 in –help (#1114) #1114
• OCPBUGS-52588: fix: error when no related image was found (#1106) #1106
• CLID-325: adds cpu and memory profiling (#1103) #1103
• fixes CVE-2024-0406 (#1101) #1101
• v2: disable spinners when not running in a tty (#1082) #1082
• OCPBUGS-49990: v2/release: error out for kubevirt/graph image errors (#1081) #1081
• OCPBUGS-50963: v2: don’t clean cluster resources on dry-run mode (#1091) #1091
• OCPBUGS-49991: fixes bundle related images being skipped (#1074) #1074
• v2/cli: always stop local registry and close registry.log (#1090) #1090
• OCPBUGS-44103: bump oc fork version (#1089) #1089
• OCPBUGS-50685: fixes the code to make the spinner trigger after semaphore is released (#1079) #1079
• OCPBUGS-50503: oc-mirror fails with error unknown image: reference name is empty (#1075) #1075
• OCPBUGS-49899: v2/cli: share common flag options (#1067) #1067
• OCPBUGS-49723: v2/clusterresources: remove ClusterCatalog namespace (#1059) #1059
• OCPBUGS-49798: exposes the parallel-layers flag (#1066) #1066
• OCPBUGS-49730: fixes the infinite loop when no images to mirror (#1064) #1064
• Full changelog

olm-catalogd

• UPSTREAM: 502: Upgrade golang.org/x/net (#502) #502
• UPSTREAM: <drop>: Separate CA configuration for pulls vs catalogd services (#1673) #1673
• UPSTREAM: <drop>: Revert “UPSTREAM: <drop>: Separate CA configuration for pulls vs catalogd services (#1673)” #1673
• Full changelog

olm-operator-controller

• UPSTREAM: <carry>: fix crdupgradesafety diff when items schema differ (#1863) #1863
• UPSTREAM: <drop>: Separate CA configuration for pulls vs catalogd services (#1673) #1673
• UPSTREAM: <drop>: Add support for SSL env vars to cert pool watcher (#1672) #1672
• UPSTREAM: <drop>: Revert “Add support for SSL env vars to cert pool watcher (#1672)” #1672
• UPSTREAM: <drop>: Revert “Separate CA configuration for pulls vs catalogd services (#1673)” #1673
• Full changelog

openshift-apiserver

• OCPBUGS-52312: Skip blocked registry check for registries with mirrors #498
• OCPBUGS-49848: Prevent storage layer retries for methods with side effects. #496
• Full changelog

openshift-controller-manager

• OCPBUGS-54304: Intermittent authentication issues when accessing OpenShift registry #369
• Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

• OCPBUGS-51225, OCPBUGS-51227, OCPBUGS-51245: pin go-jose/v4@v4.0.5 (#3550) #992
• OCPBUGS-53108: Ensure that PSA label is latest instead of pinning versions #983
• OCPBUGS-53040: add missing pod disruption reasons to isPodDead #981
• OCPBUGS-50830, OCPBUGS-50832, OCPBUGS-50836: Bump github.com/distribution/distribution/v3 #965
• Full changelog

operator-marketplace

• OCPBUGS-53149: Ensure that PSA label is latest instead of pinning versions #601
• Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

• OCPBUGS-54671: EIP no reroute: allow multiple entries for pod to pod and pod to join #2510
• OCPBUGS-54187: Update OVN to FDP25.A.1 24.09.2-41. #2495
• OCPBUGS-48710: DownStream Merge Sync from 4.19 [02-13-2025] #2470
• OCPBUGS-50513, OCPBUGS-50514: Downstream Merge 7th Feb 2025 #2449
• OCPBUGS-49851: Bump OVN to 24.09.2-14 for FDP-1131 #2448
• OCPBUGS-48337, OCPBUGS-49821, OCPBUGS-49856, OCPBUGS-49857: [DownstreamMerge] 2-4-25 #2447
• Full changelog

powervs-machine-controllers

• OCPBUGS-54243: Fix for CVE-2024-51744 in github.com/golang-jwt/jwt/v4 #111
• Full changelog

prometheus

• OCPBUGS-54940: Scraping: Bump cache iteration after error to avoid false duplicate detection. #247
• Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

• OCPBUGS-52565: Bump openshift/prometheus-operator to v0.78.2 #327
• Full changelog

route-controller-manager

• OCPBUGS-55338: Added error event for failed ingress to route conversion #59
• OCPBUGS-13181: ingress: Reset metrics when ingress is deleted #49
• Full changelog

tests

• OCPBUGS-55267: Update to Kubernetes v1.31.8 #29765
• OCPBUGS-50628: [test: networking] Skip isolation test when cgroupv1 nodes are present #29541
• OCPBUGS-55470: [build] Ensure Git Clone Does Not Run Privileged #29736
• Revert “OCPBUGS-55277: backport 4.18” #29720
• OCPBUGS-55277: backport 4.18 #29645
• OCPBUGS-55110: Backport MetricsCollectionProfiles patches to 4.18 #29561
• OCPBUGS-54807: support provider type external #29666
• OCPBUGS-54725: Fix egress firewall tests by updating the URL from docs.openshift.com to redhat.com #29657
• OCPBUGS-53015: bump(k8s): update k8s.io/* dependencies to v1.31.7 #29634
• OCPBUGS-52496: use non-fake boot image for patch #29584
• OCPBUGS-52579: Use payload pullspec for image info test #29587
• OCPBUGS-51295: Rely on unstructured for update status instead of type conversion #29564
• OCPBUGS-50929: Update to Kubernetes v1.31.6 #29548
• OCPBUGS-48389: move initialization of OC to test instead of package level #29472
• OCPBUGS-50921: managed services: add hcp crd to unstable list #29545
• OCPBUGS-50930: managed services: add known image check for gcp #29547
• OCPBUGS-48474: Replace RunHostCmd with Exec function to censor bearer token being exposed #29377
• OCPBUGS-49687: Add Readiness Probe to Router Status Tests #29513
• OCPBUGS-49821: Allows for backwards compatibility with upcoming network name change #29527
• OCPBUGS-48403: Bring groupsnapshot beta feature to 4.18 #29427
• Full changelog

thanos

• OCPBUGS-52945: Update Go version in go.mod to 1.22.0 #159
• Full changelog

vsphere-csi-driver-operator

• OCPBUGS-50638: fix panic when vcenter address is incorrect #293
• OCPBUGS-49863: Set reconcile-sync to 10 minute for ListVolume #290
• OCPBUGS-48706: Escape backslash in vCenter username #282
• Full changelog

---

View changelog in Markdown or change previous release: 4.18.0-okd-scos.94.18.0-okd-scos.84.18.0-okd-scos.74.18.0-okd-scos.64.18.0-okd-scos.54.18.0-okd-scos.44.18.0-okd-scos.34.18.0-okd-scos.24.18.0-okd-scos.14.18.0-okd-scos.04.17.0-okd-scos.34.17.0-okd-scos.24.17.0-okd-scos.14.17.0-okd-scos.04.16.0-okd-scos.14.16.0-okd-scos.04.16.0-0.okd-scos-2024-09-24-1517474.16.0-0.okd-scos-2024-08-21-1556134.15.0-0.okd-scos-2024-01-18-223523───4.20.0-0.okd-scos-2025-05-17-1015384.20.0-0.okd-scos-2025-05-16-2215374.20.0-0.okd-scos-2025-05-16-1015364.20.0-0.okd-scos-2025-05-15-2215354.20.0-0.okd-scos-2025-05-15-1015344.20.0-0.okd-scos-2025-05-14-221533───4.19.0-0.okd-scos-2025-05-17-0621124.19.0-0.okd-scos-2025-05-16-1821124.19.0-0.okd-scos-2025-05-16-0621114.19.0-0.okd-scos-2025-05-15-1821104.19.0-0.okd-scos-2025-05-15-0621094.19.0-0.okd-scos-2025-05-14-1821084.19.0-0.okd-scos-2025-05-14-062108───4.18.0-0.okd-scos-2025-05-17-0108384.18.0-0.okd-scos-2025-05-16-1308384.18.0-0.okd-scos-2025-05-16-0108384.18.0-0.okd-scos-2025-05-15-1308384.18.0-0.okd-scos-2025-05-15-0108384.18.0-0.okd-scos-2025-05-14-130838───4.17.0-0.okd-scos-2025-02-25-0904554.17.0-0.okd-scos-2025-02-24-2104554.17.0-0.okd-scos-2025-02-24-0904544.17.0-0.okd-scos-2025-02-23-2104544.17.0-0.okd-scos-2025-02-22-211215───4.16.0-0.okd-scos-2025-01-06-1432414.16.0-0.okd-scos-2025-01-04-1456004.16.0-0.okd-scos-2025-01-04-0142364.16.0-0.okd-scos-2025-01-03-1342364.16.0-0.okd-scos-2025-01-03-0142364.16.0-0.okd-scos-2024-12-17-0222464.16.0-0.okd-scos-2024-11-24-1100454.16.0-0.okd-scos-2024-11-23-1818454.16.0-0.okd-scos-2024-11-23-0618454.16.0-0.okd-scos-2024-11-22-1818454.16.0-0.okd-scos-2024-11-22-061845───4.15.0-0.okd-scos-2024-12-16-1913164.15.0-0.okd-scos-2024-01-18-1035224.15.0-0.okd-scos-2024-01-17-2235214.15.0-0.okd-scos-2024-01-17-1035204.15.0-0.okd-scos-2024-01-16-223519───4.15.0-0.okd-2025-05-02-1402244.15.0-0.okd-2025-04-03-2126204.15.0-0.okd-2025-04-02-1800124.15.0-0.okd-2025-03-28-1148024.15.0-0.okd-2025-03-26-0131074.15.0-0.okd-2024-03-27-1109014.15.0-0.okd-2024-03-26-2309014.15.0-0.okd-2024-03-23-1640104.15.0-0.okd-2024-03-23-0440104.15.0-0.okd-2024-03-22-164010───4.3.0-0.okd-2025-04-09-1531174.3.0-0.okd-2021-08-03-2048314.3.0-0.okd-2021-03-22-1309504.3.0-0.okd-2021-02-02-2356544.3.0-0.okd-2021-02-02-1747534.3.0-0.okd-2021-01-28-0046514.3.0-0.okd-2021-01-18-145029───4.15.0-0.okd-2024-03-10-0101164.15.0-0.okd-2024-02-23-1634104.15.0-0.okd-2024-02-10-0355344.15.0-0.okd-2024-01-27-070424───4.20.0-okd-scos.ec.04.19.0-okd-scos.ec.104.19.0-okd-scos.ec.84.19.0-okd-scos.ec.74.19.0-okd-scos.ec.64.19.0-okd-scos.ec.54.19.0-okd-scos.ec.44.19.0-okd-scos.ec.34.19.0-okd-scos.ec.24.19.0-okd-scos.ec.14.19.0-okd-scos.ec.04.18.0-okd-scos.ec.34.18.0-okd-scos.ec.24.18.0-okd-scos.ec.14.18.0-okd-scos.ec.04.17.0-okd-scos.ec.44.17.0-okd-scos.ec.34.17.0-okd-scos.ec.24.17.0-okd-scos.ec.14.17.0-okd-scos.ec.04.17.0-0.okd-scos-2024-09-30-1017394.17.0-0.okd-scos-2024-09-26-2248284.17.0-0.okd-scos-2024-09-24-1048284.17.0-0.okd-scos-2024-08-21-100712

Source code for this page located on github