Back to index

Download installer and client with:

oc adm release extract --tools quay.io/okd/scos-release:4.17.0-okd-scos.ec.2

Team Approvals:

Tests:

• Blocking jobs
  • upgrade Succeeded release-openshift-okd-scos-installer-e2e-aws-upgrade-from-scos-next

Upgrades from:

• 4.17.0-0.okd-scos-2024-09-24-104828 - Failed Success

Upgrades to:

• 4.17.0-okd-scos.ec.3 (changes) - Failed Success

---

Changes from 4.17.0-0.okd-scos-2024-09-24-104828

Created: 2024-10-24 17:54:59 +0000 UTC

Image Digest: sha256:3af4f89a74261737886c3076aacd792efebfac0c003d2a35d396b2ca7e409223

Release 4.17.0-okd-scos.ec.2 was created from registry.ci.openshift.org/origin/release-scos:4.17.0-0.okd-scos-2024-10-24-095547

Components

• Kubectl upgraded from 1.30.2 to 1.30.5
• Kubernetes upgraded from 1.30.4 to 1.30.5
• Kubernetes Tests 1.30.0
• CentOS Stream CoreOS upgraded from 418.9.202409222032-0 to 418.9.202410161643-0 (diff)

Rebuilt images without code change

• stream-coreos sha256:9eb7f8532eae7489a0e8261cb6310e1461358dcbf5894e324bb4ed295f07a11d
• stream-coreos-extensions sha256:685b71023578fb134b2c14e3edac3abcb8ae6e117df17c21a22e6e6c402af6dd

agent-installer-api-server

• OCPBUGS-42525: Disable pprof for agent-based installer (#6897) #6897
• OCPBUGS-43020: Update go-jose to v2.6.3 to mitigate CVE-2024-28180 (#6892) #6892
• Updating ose-agent-installer-api-server-container image to be consistent with ART for 4.17 (#6709) #6709
• OCPBUGS-42569: Libraries bump to mitigate CVE-2024-27289 (#6832) #6832
• MGMT-17805: Fix MCO reboot error for s390x (#6727) #6727
• Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

• OCPBUGS-38466: Allow controller to continue when assisted-service (#918) #918
• OCPBUGS-43023: Pick up latest CVE changes by bumping service (#919) #919
• OCPBUGS-42156: Switch to github.com/docker/distribution/reference to Mitigate CVE-2024-3727 (#904) #904
• Full changelog

agent-installer-node-agent

• OCPBUGS-43024: Pick up latest CVE changes by bumping service (#805) #805
• OCPBUGS-42157: Switch to github.com/docker/distribution/reference to Mitigate CVE-2024-3727 (#783) #783
• Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator

• OCPBUGS-42997: Correct aws efs csi driver config as removable #296
• Full changelog

aws-kms-encryption-provider

• OCPBUGS-34314: Updating aws-kms-encryption-provider-container image to be consistent with ART for 4.17 #19
• hack: display diff on verify-mod-tidy failure #25
• Full changelog

azure-kms-encryption-provider

• OCPBUGS-34277: Updating azure-kms-encryption-provider-container image to be consistent with ART for 4.17 #7
• Full changelog

baremetal-installer, installer, installer-altinfra, installer-artifacts

• OCPBUGS-43547: Power VS: Fix incorrect error handling for AddSecurityGroupRule #9112
• OCPBUGS-43088: GCP Validate Disk and Instance Type #9091
• OCPBUGS-43329: IBMCloud: Handle pagination for subnets #9096
• OCPBUGS-42716: Update RHCOS 4.17 bootimage metadata to 417.94.202410090854-0 #9092
• OCPBUGS-42806: gather: simplify service regex for analyze #9079
• OCPBUGS-42996: Power VS Ensure Metadata populated for CAPI/private cluster case on PowerVS #9086
• OCPBUGS-42115: Add validation for gcp disk and instance types #9023
• OCPBUGS-42842: add new tested azure instance types detected during QE 4.17 full function test #9080
• OCPBUGS-41812: Validate MTU for custom network #9084
• OCPBUGS-42794: PowerVS: Add support for persistent Transit Gateways #9078
• OCPBUGS-42699: machines: don’t sort mpool zones #9065
• OCPBUGS-42483: PowerVS: update capi ibmcloud c6bcd313 for 4.17 #9054
• OCPBUGS-39414: OpenStack: Install CI dependencies from rpm #8994
• OCPBUGS-42142: Skip private managed zone creation for xpn installs #9033
• OCPBUGS-42183: Add GCP N4 Machine Series to tested instances for OCP #9041
• OCPBUGS-42126: add tested IBMCloud instance types in 4.17 test #9030
• OCPBUGS-42118: Set default release image to 4.17 #9026
• OCPBUGS-42116: Remove bindings for XPN installs #9024
• OCPBUGS-39409: Fix IPv6 security group rule for schedulable master #8970
• OCPBUGS-41622: update RHCOS 4.17 bootimage metadata to 417.94.202409120353-0 #9019
• Full changelog

cli, cli-artifacts, deployer, tools

• OCPBUGS-43696: Bump k8s dependencies to 1.30.5 #1902
• OCPBUGS-41642: vendor: Update openshift/api to pick up the v4.17 capability set #1876
• OCPBUGS-42176: Fix copy artifacts for all CPU architectures #1880
• OCPBUGS-42721: Update push targets of digest with new appended tags #1892
• OCPBUGS-42580: fix outputname flag for node-image create command #1888
• OCPBUGS-42164: Check cast result in adm prune deployments to prevent panic #1879
• Full changelog

cloud-credential-operator

• OCPBUGS-43335: Update github.com/sirupsen/logrus v1.9.3 #766
• Full changelog

cluster-authentication-operator

• OCPBUGS-42784: manifests should not use APIs that are removed in upcoming releases #712
• OCPBUGS-42545: when no type is specified, don’t make illegal condition #703
• Full changelog

cluster-baremetal-operator

• OCPBUGS-41926: SCC-pinning for metal3-baremetal-operator #444
• Full changelog

cluster-bootstrap

• OCPBUGS-34034: Updating ose-cluster-bootstrap-container image to be consistent with ART for 4.17 #108
• Full changelog

cluster-capi-operator

• OCPBUGS-41576: Use CAPO v0.10 and API v1beta1 #205
• Full changelog

cluster-cloud-controller-manager-operator

• OCPBUGS-43389: update goimports targets #371
• Full changelog

cluster-etcd-operator

• OCPBUGS-38574: use pooled client for etcd single member health checks #1327
• Full changelog

cluster-image-registry-operator

• OCPBUGS-43350: pkg/storage/azure: also check for auth failure error code on deletion #1139
• OCPBUGS-42812: azureclient: stop validating credentials when creating the client #1130
• OCPBUGS-42394: pkg/storage/azure: use cluster-api tag key to discover vnet #1125
• OCPBUGS-42362: Continuous pull-secret updates / slow initialization on build01 (test platform infrastructure) #1124
• Full changelog

cluster-kube-apiserver-operator

• OCPBUGS-43657: audit: do not log requests to /livez #1758
• OCPBUGS-34310: Updating ose-cluster-kube-apiserver-operator-container image to be consistent with ART for 4.17 #1738
• Full changelog

cluster-kube-cluster-api-operator

• OCPBUGS-42612: Sync Release 4.17 with UPSTREAM #48
• Full changelog

cluster-machine-approver

• OCPBUGS-43312: Client internal DNS checks should be case insensitive #242
• Full changelog

cluster-monitoring-operator

• OCPBUGS-43545: Fix api doc on Thanos Ruler default retention #2501
• Full changelog

cluster-network-operator

• OCPBUGS-43343: OCPBUGS-42244: Exporting environment varialbe NODE_CNI for live migration #2536
• OCPBUGS-43317: Use CNIConfDir for mounting directory to ovn-ipsec-host pod #2533
• OCPBUGS-39300: rebase openshift/api for openshift-sdn removal [4.17] #2477
• OCPBUGS-39121: Live migration: report network overlap via live_migration_blocked metric #2483
• OCPBUGS-42260: Configure narrowing=yes for IPsec connections #2510
• Full changelog

cluster-node-tuning-operator

• E2E: wait for ovs services affinity to reset after deployment deletion (#1160) #1160
• OCPBUGS-38721: tuned: distinguish deferred updates (#1149) #1149
• Full changelog

cluster-openshift-apiserver-operator

• OCPBUGS-43657: audit: do not log requests to /livez #599
• Full changelog

cluster-samples-operator

• OCPBUGS-39120: Sync the non-OKD assets from master to release-4.17 #577
• Full changelog

cluster-storage-operator

• OCPBUGS-43112: assets: shared-resource: hypershift: add pull-secret to operator SA #520
• Full changelog

cluster-version-operator

• OCPBUGS-41642: vendor: Update openshift/api to pick up the v4.17 capability sets #1087
• Full changelog

console

• OCPBUGS-42955: Enabling topology e2e tests on CI #14402
• OCPBUGS-43009: Project is “Undefined” on “VolumeSnapshot” create page #14389
• OCPBUGS-42607: add role exclusion to avoid unexpected triggering the namespace menu #14351
• OCPBUGS-42606: make createdBy mandatory and auto fill with the current user #14352
• OCPBUGS-42585: Red Hat Camel K Operator installation via cli #14346
• OCPBUGS-42299: Increase login flow state paramater length/entropy #14318
• OCPBUGS-42391: change “Partial cluster update” to “Control plane onl… #14323
• OCPBUGS-42380: Allow operators to enable monitoring by default #14316
• Full changelog

csi-driver-manila-operator

• OCPBUGS-38457: Add missing healthchecks #240
• Full changelog

etcd, installer-etcd-artifacts

• OCPBUGS-42680: Rebase etcd 3.5.16 openshift 4.17 #291
• NO-JIRA: use golang 1.22 image #286
• Full changelog

hyperkube, installer-kube-apiserver-artifacts, pod

• OCPBUGS-42640: Unrevert Bump k8s api to 1.30.5” #2107
• OCPBUGS-42640: Revert #2089 “OCPBUGS-42167: Bump k8s api to 1.30.5” #2100
• OCPBUGS-42167: Bump k8s api to 1.30.5 #2089
• OCPBUGS-42019: UPSTREAM: <drop>: bump(github.com/openshift/apiserver-library-go) #2087
• Full changelog

hypershift

• NO-JIRA: chore(deps): update konflux references (release-4.17) #4958
• OCPBUGS-43464: Pass feature flags to clusterpolicy controller #4928
• NO-JIRA: chore(deps): update konflux references (release-4.17) #4931
• OCPBUGS-42704: Run 2 replicas of active/passive HA components #4843
• OCPBUGS-43316: Enforce privileged PSA by default #4834
• NO-JIRA: chore(deps): update konflux references (release-4.17) #4921
• OCPBUGS-43374: release-4.17 openstack/e2e: re-work nodepool tests #4914
• NO-JIRA: chore(deps): update konflux references to 674e70f (release-4.17) #4907
• NO-JIRA: chore(deps): update konflux references (release-4.17) #4895
• OCPBUGS-43051: Use guest DNS resolution in Konnectivity HTTPS proxy by default #4885
• HOSTEDCP-2020: [release-4.17] Add support for SharedVPC #4873
• HOSTEDCP-2023: [release-4.17] Split worker and vpc endpoint security groups #4882
• OCPBUGS-42974: [release-4.17] Do not send traffic to local audit-webhook through konnectivity #4869
• NO-JIRA: Remove EnsurePSANotPrivileged check #4855
• OCPBUGS-42714: label routes only when HCP router used #4845
• NO-JIRA: chore(deps): update konflux references to 37b9187 (release-4.17) #4854
• OCPBUGS-42390: Add Annotation to skip deleting hcp namespace #4792
• NO-JIRA: chore(deps): update konflux references (release-4.17) #4812
• NO-JIRA: e2e: openstack: fix nil deref in route53 teardown #4810
• OCPBUGS-42261: Conditionally manage kubeconfig secrets for DNS and Ingress operators #4764
• OCPBUGS-42098: Use KubeClientCABundle for HostedClusterConfigOperator cluster-signer-ca #4736
• chore(deps): update konflux references to 5ac9b24 (release-4.17) #4780
• Full changelog

insights-operator

• Added new translation for architectures (#1005) #1005
• OCPBUGS-42357: set the RemoteConfigurationAvailable and RemoteConfigu… (#1001) #1001
• OCPBUGS-41833: populate the endpoint parameter when there’s an error (#998) #998
• Full changelog

ironic

• OCPBUGS-42692: Include fixes for CVE-2024-5569 #590
• OCPBUGS-42509: Include fix for CVE-2024-47211 #593
• Full changelog

ironic-agent

• OCPBUGS-39013: Bump ironic-lib to fix utf8 decoding issue #155
• Full changelog

kube-rbac-proxy

• OCPBUGS-42697: protobuf bump [4.17] #112
• Full changelog

machine-api-operator

• OCPBUGS-42414: Ensure deletion annotation takes priority and oldestPolicy can distinguish longer ages #1293
• OCPBUGS-38868: Updates message verbs to use %q where appropriate #1278
• Full changelog

machine-config-operator

• OCPBUGS-42577: openstack: fix non-old systemd compatible unit #4620
• OCPBUGS-42108: Do not use ‘restart’ for ‘oneshot’ service #4615
• OCPBUGS-42979: Regenerate the rendered MC in use when deleted #4634
• OCPBUGS-42677: The MCO does not properly degrade when pools are failing to render a new config #4623
• OCPBUGS-42081: Check for kernel arg diff in updateOnClusterBuild #4595
• OCPBUGS-41255: Set ESP offloads off in bonds if slaves don’t support them #4598
• OCPBUGS-42256: Panic seen in CI job for MCC pod #4603
• OCPBUGS-42200: MCPs report wrong number of nodes when we move nodes from one custom MCP to another custom MCP #4602
• OCPBUGS-41357: Enable the use of Linux Bridge as the ovs default port connection #4567
• Full changelog

monitoring-plugin

• OCPBUGS-43238: upgrade dynamic plugin sdk to remove vulnerable dependencies 4.17 #216
• OCPBUGS-42408: fix path-to-regexp dependency #196
• Full changelog

must-gather

• OCPBUGS-42958: Gather OSUS data #443
• OCPBUGS-42835: [Release-4.17] Network logs collection: skip unready nodes #445
• CNF-13837: gather_ppc: fallback option when NTO image not found #436
• MON-3108: Add gather_metrics for Prometheus fetching #434
• OCPBUGS-33959, SDN-5066: Remove needless multus log collection #431
• NO-JIRA: Update dockerfile rename changes #433
• NO-JIRA: Rename Dockerfile #432
• Full changelog

networking-console-plugin

• CNV-49305: fix for virt perspective #128
• OCPBUGS-42678: OCPBUGS-42352: add service weight #125
• OCPBUGS-39390: fix sorting on lists #123
• OCPBUGS-42582: fix html in translations #122
• OCPBUGS-42581: Route edit form #121
• CNV-48190: move title networkpolicies above tabs #120
• Fix alert ServiceSelector #111
• CNV-47528: Fix key value in selector #110
• Revert IPAM (subnets input) #115
• OCPBUGS-42248: fix pagination during sorting #109
• Full changelog

oc-mirror

• OCPBUGS-37867: Use tag only when image by tag and digest (#911) (#932) #911
• Full changelog

openshift-apiserver

• OCPBUGS-42232: fail image import when both image and error are nil #450
• Full changelog

openshift-controller-manager

• NO-JIRA: cleanup root and app OWNERS #346
• OCPBUGS-42362: Continuous pull-secret updates / slow initialization on build01 (test platform infrastructure) #339
• Full changelog

openstack-cluster-api-controllers

• OCPBUGS-43584: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.10 into release-4.17 #323
• Full changelog

tests

• OCPBUGS-43569: feat: update to use pullspec image #29207
• OCPBUGS-43576: Porting testing for netConfig and UDN and CIDR overlapping tests from upstream #29181
• OCPBUGS-39606: Add image registry capability check #29174
• OCPBUGS-42814: ruby:3.0-ubi8 => ruby:3.1-ubi8 #29162
• OCPBUGS-42336: Fix image ecosystem tests 4.17 #29126
• Full changelog

vsphere-csi-driver-operator

• OCPBUGS-42327: Fix the config loading warning #259
• Full changelog

---

View changelog in Markdown or change previous release: 4.17.0-okd-scos.ec.14.17.0-okd-scos.ec.04.17.0-0.okd-scos-2024-09-30-1017394.17.0-0.okd-scos-2024-09-26-2248284.17.0-0.okd-scos-2024-09-24-1048284.17.0-0.okd-scos-2024-08-21-100712───4.18.0-0.okd-scos-2024-11-21-0211394.18.0-0.okd-scos-2024-11-20-1411384.18.0-0.okd-scos-2024-11-20-0209584.18.0-0.okd-scos-2024-11-19-1409574.18.0-0.okd-scos-2024-11-19-0209564.18.0-0.okd-scos-2024-11-18-140955───4.17.0-0.okd-scos-2024-11-21-1114284.17.0-0.okd-scos-2024-11-20-2214034.17.0-0.okd-scos-2024-11-20-1014034.17.0-0.okd-scos-2024-11-19-2214034.17.0-0.okd-scos-2024-11-19-1014034.17.0-0.okd-scos-2024-11-18-221403───4.16.0-0.okd-scos-2024-11-21-0014434.16.0-0.okd-scos-2024-11-20-1214434.16.0-0.okd-scos-2024-11-20-0014434.16.0-0.okd-scos-2024-11-19-1214434.16.0-0.okd-scos-2024-11-19-0014434.16.0-0.okd-scos-2024-11-18-121443───4.15.0-0.okd-scos-2024-05-13-2236094.15.0-0.okd-scos-2024-04-25-1837084.15.0-0.okd-scos-2024-04-25-0637084.15.0-0.okd-scos-2024-04-24-1837084.15.0-0.okd-scos-2024-04-24-0637084.15.0-0.okd-scos-2024-01-18-1035224.15.0-0.okd-scos-2024-01-17-2235214.15.0-0.okd-scos-2024-01-17-1035204.15.0-0.okd-scos-2024-01-16-223519───4.15.0-0.okd-2024-11-14-2031284.15.0-0.okd-2024-11-09-0406444.15.0-0.okd-2024-11-08-1606444.15.0-0.okd-2024-11-05-1344204.15.0-0.okd-2024-11-05-0144204.15.0-0.okd-2024-03-27-1109014.15.0-0.okd-2024-03-26-2309014.15.0-0.okd-2024-03-23-1640104.15.0-0.okd-2024-03-23-0440104.15.0-0.okd-2024-03-22-164010───4.15.0-0.okd-2024-03-10-0101164.15.0-0.okd-2024-02-23-1634104.15.0-0.okd-2024-02-10-0355344.15.0-0.okd-2024-01-27-070424───4.16.0-okd-scos.04.16.0-0.okd-scos-2024-09-24-1517474.16.0-0.okd-scos-2024-08-21-1556134.15.0-0.okd-scos-2024-01-18-223523

Source code for this page located on github