4.6.0-0.okd-2023-03-01-160630

New features since version 4.5.0-0.okd-2022-08-24-073429

Download installer and client with:

oc adm release extract --tools registry.ci.openshift.org/origin/release:4.6.0-0.okd-2023-03-01-160630

No tests for this release

Loading changelog, this may take a while ...

Changes from 4.6.0-0.okd-2023-01-13-122734

Created: 2023-03-01 16:13:02 +0000 UTC

Image Digest: sha256:b9d0913163648672121860bdcd0f1f1a928d3f6a56c9b06e050ccf0d7a74032f

Components

Kubernetes 1.19.16

cluster-authentication-operator

make the custom route controller use server-side-apply to avoid stomping unknown fields #582
e2e: address PSa failures #581
Bug 2111842: v/o/library-go - version-bump #576
Updating ose-cluster-authentication-operator images to be consistent with ART #575
Updating ose-cluster-authentication-operator images to be consistent with ART #571
Bug 2078287: only ever include certificates in the oauth-serving-cert CM #573
AUTH-133: bindata/oauth-openshift: specify pod security level #570
Update Links #568
Bug 1958198: Avoid zero or low resync intervals #491
manifests: specify pod security level #565
e2e: Use Keycloak v18.0.0 #567
AUTH-89: add audit options to oauth-server on oauth-audit-profile Variant03 #563
MGMT-9797: Bump openshift/api dependency to 04e1813ebb11 #564
make apiserver readiness probe honor readyz #561
Bug 2063342: vendor: bump library-go #558
Bug 2059515: e2e: Use Keycloak v17.0.0 #554
Update OCP branding within oauth-templates #540
Bug 2040521: routeName used as customSecretName #533
Bug 2039670: Sync the library-go #538
Bug 2042038: bump library go #537
Bug 2024841: use latest keycloak for testing #534
Bug 2039670: Create the PDB dynamically so it does not get created on the SNO topology #514
Bug 2034484: fix:library-go nil pointer issue #525
Bug 2030961: endpoints checker: check only the custom hostname if configured #528
e2e tests for keycloak #520
Golang bump 1.17 #515
Bug 1982726: encryption-controller: sync secrets conditionally #506
test/library: Pin keycloak contianer label to 15.0.1 #512
test/lib: Set PROXY_ADDRESS_FORWARDING for keycloak #508
Bug 1996647: endpointsaccessible: clarify degraded message when DNS is broken #473
pkg/operator: set high inertia for all topologies except SingleReplica #504
Bug 2019832: pkg/operator: configure high inertia for apiserver and OAuthServer #503
typo fix: enpoints -> endpoints #502
Exclude operator config for ibm-cloud-managed profile #496
pkg/*: wire context in newest library-go #501
AUTH-8: sync group claims for OIDC IdPs #495
Bug 2013222: pkg/operator: configure PDB high inertia #499
rm dead code: deployment readiness and route canonical host #493
podsecurity: enforce privileged for openshift-oauth-apiserver namespace #492
Bug 1948080: bump(library-go): add shutdown detection during apiservice discovery #481
Update Go version in the images #480
Bug 1998031: Deploy PDB to prevent more than one replica going unavailable #476
Bug 1996620: manifests, bindata: explicitely set runAsUser for oauth-apiserver #474
Bug 1973005: manifests, bindata: explicitely set runAsUser for operator and operand #472
Bug 1988576: pkg/operator: Add deprecated stale status #470
Bug 1986829: metrics: use client cert auth for metrics scraping #469
Bug 1978193: csr request: use generate names to prevent getting stuck waiting for a cert #468
distribute oauth-server trust via a openshift-config-managed configmap #464
Bug 1977027: Remove not needed Prometheus Rule #461
encryption condition controller doesn’t reset previously set condition #466
clear encryption conditions when there is no work to be done #462
Custom Certs for OAuth Route #430
add dynamic audit policy controller #460
Bug 1977054: observe api-audiences for the oauth-apiserver #458
bump library-go to get context fixes #457
Updating .ci-operator.yaml build_root_image from openshift/release #454
readme: update references to developer guide #448
Bug 1969631: encryption controllers wait for all informers before running the sync loops #453
Bug 1879182: oauth-apiserver: audit policies now use ‘secure-’ by default #451
Bug 1965929: bump lib-go to get improved performance for the CSR approver #450
Bug 1965929: wire certs as the authentication means to openshift webhook authenticator #416
Bug 1967398: operator: add OAuthServiceEndpointsCheckEndpointAccessibleControllerDegraded to stale conditions #449
Bug 1943804: splits the encryption tests #447
Bug 1943804: stub for splitting encryption tests #446
Bug 1950379: routersecret: sync only the cert/key pair for the default domain #438
Bug 1953563: Add .ci-operator.yaml with build_root_image #439
Bug 1953041: manifests/deployment: bump cpu and memory resource requests #444
Bug 1955749: OCP oauth translations for login pages #428
Bug 1939580: wellknownready: delay going degraded on oauthmetadata changes #442
Bug 1954544: endpoints controller: actually use the context-constrained request #441
Rename workload annotations #434
Bug 1946540: fix configuring webhook authenticators on upgrade #435
Bug 1948311: DelegatingAuthenticationOptions TokenReview request timeout #436
Add management workload annotations #431
Bug 1946540: only configure webhook authenticators when oauth-apiservers are ready during upgrade #433
e2e: fix the token names in tokentimeout test to match the new format #432
extends shutdown delay duration to 10 seconds #429
move the oauth-server deployment into a generic workloads controller #414
oauth-apiserver: add access token inactivity timeout observer #422
Updating ose-cluster-authentication-operator builder & base images to be consistent with ART #421
follow up changes to clean up endpoint accessible controller #404
Bug 1934107: webhook authentication: fix oauth-apiserver IP for IPv6 environments #415
switch to v1beta1 for the p&f APIs #393
wire openshift authentication as a webhook authenticator #304
removes the encryption provider #409
e2e: Pin gitlab docker image to 13.8.4-ce.0 #413
Remove the ‘authentication.operator.openshift.io/managed’ annotation from user,oauth apiservices #407
Updating ose-cluster-authentication-operator builder & base images to be consistent with ART #406
Support non-HA mode #391
Bug 1841039: e2e: add a test for password grant checking with keycloak #401
Bug 1921275: deploymentController: treat error retrieving authentication.operator/cluster #402
Bug 1917114: proxyconfig controller: match URL to noproxy correctly #400
Bug 1916949: manifests: exclude rbac resources in openshift-oauth-apiserver namespace from hosted profile #399
Bug 1905329: oauth-apiserver deployment: add cpu and memory requests #395
Bug 1901774: manifests: add liveness probe to the operator’s deployment #394
Bug 1887392: bump kube to 0.20.1 and lib-go to master to pick up authn/z caching #392
Bug 1901057: proxyconfig controller: add router CA to the trusted pool #387
Updating ose-cluster-authentication-operator builder & base images to be consistent with ART #377
oauth-apiserver:workload: wait for storage urls before installing the api server #386
Annotate manifests for single-node-developer cluster profile #383
starts to manage the encryption configuration #379
always claim control over oauth and user APIs #380
add RBAC for the new useroauthaccesstokens #381
pkg/controllers/common: Fix “successfull” -> “successful” typos #382
Add IBM Cloud managed annotations to CVO manifests #378
oauthserver: grab unsupported overrides from a prefixed tree #319
Add a controller to report misconfigured proxy #355
picks up setting TCP_USER_TIMEOUT socket option #372
Bug 1893386: Fix wrong operator config informer #373
Restrict log permissions #366
Bug 1893386: update ingress node available to handle custom placement #370
add current profile annotations to CVO manifests #369
Bug 1891758: deployment: update event spam #365
Bug 1887428: add ServiceMonitor for the oauth apiserver #361
BUG 1888311: p&f: make oauth SAR/TokenReview traffic exempt #363
Bug 1888028: bump library-go to stop waiting on kube-apiserver availability #362
pkg/controllers: Use library-go’s IngressURI helper #358
BUG 1886449: p&f: assign oauth server traffic to workload-high #359
remove unused vbom.ml/util dependency #357
ingressnodesavailable: fix typo in message #348
flowschema for oauth server and its operator #356
Full changelog

cluster-kube-scheduler-operator

bootstrap-kube-scheduler: specify resources.requests #445
library-go vendoring for installer cmd timeout #444
Bump openshift/api to bring the MatchLabelKeysInPodTopologySpread enabled in TPNoUpgrade #442
trt-589 bump library-go #441
Bump go.mod golang version to 1.19 #440
k8s 1.25.0 #438
Describe how to increase log level of kube-scheduler instances #436
Updating ose-cluster-kube-scheduler-operator images to be consistent with ART #433
Update owners #432
Bug 2062459: Introduce sync unit test #430
Bug 2086092: bump to k8s v0.24.0 #420
Bug 2062459: Fix bootstrap leader election config #428
Bug 2064024: README: fix scheduler configuration formatting #427
Bug 2064024: Update library-go to 80f9619c2 #425
Fix debugging information #424
manifests/deployment: comply to restricted pod security level #421
[rebase v1.24] remove –port flag from bootstrap #422
Update OWNERS #419
Updating ose-cluster-kube-scheduler-operator images to be consistent with ART #406
Bug 2053582: Track static pod lifecycle #417
Bug 2053582: Track static pod lifecycle #415
Update resourcelock to configmapleases #412
Bump(openshift/api): to get CSI changes #411
Do not wait for a port which is no longer used by the scheduler #410
update cert injection annotations to beta #409
Bug 2029470: update library-go to get rapid installer pod fixes #407
Bug 2035986: Replace deprecated annotation #393
Bug 2042049: Delete feature gates removed from k8s.io/kubernetes/pkg/features/kube_features.go #401
Bug 2039414: Update KubeSchedulerConfig to v1beta3(default in 1.23) #395
Bug 2005901: Sync the library-go #397
Bug 2033751: Return Error when trying to use Scheduler Policy #390
Bug 2040132: drop –port flag #398
Bug 2035927: Replace NodeResourcesLeastAllocated/NodeResourcesMostAllocated plugins with NodeResourcesFit #392
Bug 2005901: Bump library-go #396
Bug 2038968: bump(openshift/api): to get CSI migration gates switched off #394
Bug 2005901: Guard controller pdb #373
Bug 2034515: bump library-go #388
Upgrade library-go version #387
Bump to k8s 1.23 #386
bump(library-go): to gather a fix for static pod UID version #384
Bug 2026352: Sync with library-go to pick fixes for pruner panic #383
Bug 2002300: Disable balancedAllocation and add weight for HighNodeUtilization profile #378
update scheduler metrics service selector #382
Fix gomod #377
Updating ose-cluster-kube-scheduler-operator images to be consistent with ART #375
bump(*): library-go #376
bump(openshift/api): to get fix for typo in feature gate #374
Bug 2010354: Make alert consistent with the alerting-consistency guidelines #372
podsecurity: enforce privileged for openshift-kube-scheduler namespace #371
Updating ose-cluster-kube-scheduler-operator images to be consistent with ART #369
Bug 2001856: bump libgo and related deps #368
Updating ose-cluster-kube-scheduler-operator images to be consistent with ART #367
Bug 1984608: Set kube-scheduler leader election defaults #365
Bug 1986829: metrics: use client cert auth for metrics scraping #364
Bug 1986003: Bump k8s.io to 1.22.0-rc.0 #362
SchedulerLegacyPolicySet: add 60 min wait #363
Fire SchedulerLegacyPolicySet alert when the legacy scheduler policy API is set #361
Start using embed module for assets #360
Bump openshift/api #359
operator: move target config controller to factory #358
bump library-go to get context fixes #357
Updating ose-cluster-kube-scheduler-operator images to be consistent with ART #356
Bug 1963730: kube-apiserver failed to load SNI cert and key #354
Bug 1946479: use manual service account tokens #355
Added more complete unit tests #352
Bug 1963079: Add e2e test for preferred host #351
Bug 1953563: Enable golang version verify target #349
Transfer root-image configuration to this repository #350
Bug 1954087: added test for manage config maps in targetconfigcontroller #346
Rename workload annotations #347
Bug 1948311: DelegatingAuthenticationOptions TokenReview request timeout #348
Add management workload annotations #343
Bug 1949364: Mention scheduling profiles #345
Bug 1948431: Bump openshift/api to get the necessary CSIMigration feature gates #344
passing additional args to kubernetes-scheduler #336
servicemonitor: Relabel kube_podresource* pod/namespace labels #340
bump(k8s.io/*): 1.21 #342
Fix development readme to refer to actual pod/container #339
update library-go to fix tight loops #341
defines test-e2e-preferred-host job for running smoke tests to check if KS talks to Kube over a preferred host #338
Updating ose-cluster-kube-scheduler-operator builder & base images to be consistent with ART #337
Bug 1938468: Specify cpu resource request for kube-scheduler-operator-container container #335
Bug 1934154: Bump github.com/gogo/protobuf to v1.3.2 #333
Bug 1844989: Set –tls-cipher-suites, resp. –tls-min-version only when the fields under servingInfo observedConfig are found #332
Bug 1844989: Allow to set –tls-cipher-suites and –tls-min-version of KS instances through observed config #331
Bug 1926579: Move warning about deprecated spec.policy field #330
Updating ose-cluster-kube-scheduler-operator builder & base images to be consistent with ART #329
Remove tnozicka and ravi from OWNERS #328
Bug 1920619: bump(*): remove default scheduler profile #326
Bug 1920509: Use ss instead of lsof when waiting for ports #324
Bug 1915304: Updating ose-cluster-kube-scheduler-operator builder & base images to be consistent with ART #321
Bug 1889488: Have probes listen to secure ports #316
Bug 1891068: manifests: add missing profile annotations #319
Bug 1887392: bump kube to 1.201 and lib-go to master to pick up authn/z caching #313
Bug 1908145: Change recovery-controller port to avoid conflicts #311
Bug 1907998: Collect /metrics/resources from scheduler #283
Bug 1905327: specify cpu and memory resources for initContainers #310
Annotate manifests for single-node-developer cluster profile #309
Switch to profiles #307
Bug 1881322: Sync new kube-scheduler-client-cert-key on recovery #288
bump(k8s.io): to 1.20.0-beta.2 #305
Add IBM Cloud managed annotations to CVO manifests #304
Revert “Set dnsPolicy ClusterFirstWithHostNet to match hostNetwork” #303
picks up setting TCP_USER_TIMEOUT socket option #302
add current profile annotations to CVO manifests #301
bump library-go for static pod uid #295
Bug 1890724: Reduce OperatorStatusChanged event noise for staticpod controller #294
Bug 1889308: Set dnsPolicy ClusterFirstWithHostNet to match hostNetwork #293
Bug 1888015: bump library-go to pick up static pod graceful timeout workaround #291
Updating ose-cluster-kube-scheduler-operator builder & base images to be consistent with ART #289
Full changelog

View changelog in Markdown or change previous release:

Source code for this page located on github