4.19.0-okd-scos.17

Download installer and client with:

oc adm release extract --tools quay.io/okd/scos-release:4.19.0-okd-scos.17

Team Approvals:

Tests:

Blocking jobs
- upgrade Succeeded release-openshift-okd-scos-installer-e2e-aws-upgrade-from-scos-stable
- upgrade-minor Succeeded release-openshift-okd-scos-installer-e2e-aws-upgrade-from-scos-stable

Upgrades from:

Upgrades to:

Loading changelog, this may take a while ...

Changes from 4.19.0-okd-scos.10

Created: 2025-09-02 01:08:36 +0000 UTC

Image Digest: sha256:2e3cb282ddd10ee85fa36ce08b515c48ca1ae6735d7d17d114f228de06be3c87

Release 4.19.0-okd-scos.17 was created from registry.ci.openshift.org/origin/release-scos:4.19.0-0.okd-scos-2025-09-01-095703

Components

Kubectl 1.32.1
Kubernetes upgraded from 1.32.6 to 1.32.7
Kubernetes Tests 1.32.6
CentOS Stream CoreOS upgraded from 9.0.20250713-0 to 9.0.20250827-0

The CoreOS links above are for the base CoreOS layer used to build the OpenShift node image and do not contain OpenShift components. This is normally only useful to devs working closely with the CoreOS team. For info about the node image, see the Node Image Info section.

agent-installer-utils

OCPBUGS-60938: Update ISOBuilder OCP 4.19 Dev Preview Release notes #142
OCPBUGS-60107: Add ISOBuilder Release notes #137
Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator

OCPBUGS-60595: Bump library-go #420
OCPBUGS-59893: Remove stale conditions #411
Full changelog

baremetal-installer, installer, installer-artifacts

OCPBUGS-60925: Update the RHCOS 4.19 bootimage metadata #9915
OCPBUGS-60652: PowerVS: config variables not honored #9901
OCPBUGS-60666: Azure: change LB and pubic IP skus to Standard #9903
OCPBUGS-59607: Refine check for supported SNO platforms #9843
Revert “Update RHCOS 4.19 bootimage metadata to 9.6.20250811-0” #9906
OCPBUGS-60402: baremetal: always set external v6 URL on dualstack #9879
OCPBUGS-58905: Update RHCOS 4.19 bootimage metadata to 9.6.20250811-0 #9888
Full changelog

baremetal-runtimecfg

OCPBUGS-60110: Re-add ENABLE_NODEIP_DEBUG env var #365
Full changelog

cloud-credential-operator

OCPBUGS-60617: ccoctl azure dnszone-resource-group-name now optional #900
Full changelog

cluster-autoscaler

OCPBUGS-60900: revert openshift replica fix #374
OCPBUGS-59638: fix checkpoint gc of unknown recommenders #366
Full changelog

cluster-baremetal-operator

OCPBUGS-60286: Remove webhookport (9447) as HostPort #498
Full changelog

cluster-cloud-controller-manager-operator

OCPBUGS-60950: Default cloud.conf if no configmap is found #412
OCPBUGS-59847: Adds service for cloud-controller-manager #402
OCPBUGS-59847: Update service selector to match deployment label #401
Full changelog

cluster-config-api

OCPBUGS-60414: MachineOSConfig name should match MachineConfigPool #2449
Update crd-schema.json to release 1.33 branch #2447
Full changelog

cluster-etcd-operator

OCPBUGS-59802: add missing informer syncs #1454
OCPBUGS-59285: fix ordering on bootstrap IP selection #1446
Full changelog

cluster-image-registry-operator

OCPBUGS-60517: fix(azure): resolve credential caching issues around UAMI support #1243
Full changelog

cluster-ingress-operator

NE-2102: Bump to OSSM 3.1.0 and Istio 1.26.2 #1264
NO-JIRA: [release-4.19] docs - correct Istio version format in ossm-overrides.md #1255
OCPBUGS-60204: Update GatewayAPI test to check if deployment has 1 or more pod #1260
NE-2109: Add OSSM channel and version override annotations #1252
NE-2105: desiredIstio: Enable GIE if InferencePool found #1251
NE-2103: Bump to OSSM 3.0.1 and Istio 1.24.4 #1244
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-60121: [release-4.19] Set goaway chance to 0.001 #1887
OCPBUGS-60677: certrotation: ensure that all rotated secrets/configmaps have RefreshOnlyWhenExpired set #1901
OCPBUGS-60495: certrotationcontroller: extend node-system-admin-signer lifetime #1897
OCPBUGS-59957: Add missing service ports to apiserver service #1880
Full changelog

cluster-kube-controller-manager-operator

OCPBUGS-60132: Missing endpoint slices for open ports the operator uses #853
Full changelog

cluster-monitoring-operator

OCPBUGS-59932: operator: increase wait time till degraded to max 4 times 5m #2629
Full changelog

cluster-network-operator

OCPBUGS-60761: Allow overriding OVN-Kubernetes configuration #2781
OCPBUGS-60534: Fix multus webhook match condition for spec changes #2777
OCPBUGS-60095: Add release version annotation to whereabouts-controller/whereabouts-token-watcher #2762
Full changelog

cluster-node-tuning-operator

OCPBUGS-60855: e2e: arm: add validation tests for hugepages with 4k and 64k kernelPageSize (#1383) #1383
E2E: skip stalld test case checking sched_fifo (#1385) #1385
Full changelog

cluster-storage-operator

OCPBUGS-60152: hypershift: add app label to csdriveroperators running in HCP #604
Full changelog

cluster-version-operator

OCPBUGS-60168: CVO protects /metrics with authorization #1222
Full changelog

console

OCPBUGS-60420: QuickStarts Link buttons to other quickstarts are duplicate #15391
OCPBUGS-50571: Make sure CSP violations are only reported to telemetry once per day per browser #15366
OCPBUGS-60279: Remove ancient X-XSS-Protection header #15381
OCPBUGS-60038: Resolving API Version Conflicts in Tekton Pipeline Runs #15354
OCPBUGS-60294: OpenShift Console’s “Start Job” action overrides configured “backoffLimit” to “6” #15382
NO-JIRA: Update CHANGELOG for latest 4.19 plugin SDK package publish #15406
OCPBUGS-60039: Fix i18n string for event stream (again) #15388
OCPBUGS-60039: Fix i18n string for event stream #15355
OCPBUGS-56651: Recognize Detached BMH status #15083
OCPBUGS-58214: Incorrect i18n translations in 4.19 batch #15218
OCPBUGS-59790: Move alertmanager settings route #15331
OCPBUGS-59639: Fixing no resources found message can not be shown completely #15320
Full changelog

coredns

OCPBUGS-60246: UPSTREAM: 7083 and 6836: Fix failing TestZoneExternalCNAMELookupWithProxy #148
Full changelog

etcd, installer-etcd-artifacts

OCPBUGS-61041: Revert “OCPBUGS-52181: Ensure cluster id changes during force-new-cluster” #340
Full changelog

gcp-machine-controllers

OCPBUGS-59386: Add max-concurrent-reconciles flag to machine actuator #125
Full changelog

gcp-pd-csi-driver

OCPBUGS-59749: 4.19: UPSTREAM: 2116: Remove check on snapshot create support for multi-writer HyperDisk-HA and let such validations occur at the PD control plane layer #80
Full changelog

hyperkube, installer-kube-apiserver-artifacts, kube-proxy, pod

OCPBUGS-61021: UPSTREAM: <carry>: Revert “Rebase v1.32.8 to 4.19” #2433
OCPBUGS-60510: Rebase v1.32.8 to 4.19 #2412
OCPBUGS-60074: UPSTREAM: 132028: podresources: list: use active pods #2391
OCPBUGS-59534: Rebase v1.32.7 to 4.19 #2367
Full changelog

hypershift

OCPBUGS-60483: feat(validations): add wildcard support to DNS SAN conflict detection #6648
OCPBUGS-60147: Always compress and encode payload in token secret for inplace upgrades #6606
OCPBUGS-60152: add missing app label to some components #6636
OCPBUGS-60125: fix(OCPBUGS-60125): Allow HCCO to set registry managementState to Removed; delete VAP during HC deletion #6689
OCPBUGS-60648: Cache Azure KMS TokenCredential for ARO HCP and clarify CPO credentials cache naming #6677
OCPBUGS-60100: fix: add dynamic security context uid to 4.19 missing components #6675
OCPBUGS-57141: HCP payload doesn’t respect multiple mirrors #6517
CNTRLPLANE-1270: Red Hat Konflux update control-plane-operator-4-19 #6660
Red Hat Konflux purge control-plane-operator-4-19 #6659
CNTRLPLANE-1267: conditional builds for mce-2.9 #6657
OCPBUGS-57588: Update PSA from v1beta1 to v1 #6302
OCPBUGS-59805: Router publish strategy related changes for IBM Cloud platform #6490
OCPBUGS-59933: Use the image reference for the cache in the image metadata provider #6535
CNTRLPLANE-1016: Support day2 tags changes for AWS default SecurityGroup #6455
CNTRLPLANE-1034: chore: Relax the kas healthcheck for aro when AllowedCIDRBlocks #6617
OCPBUGS-60100: feat: let ARO honour cp namespace annotation for default SC uids in 4.19 #6592
CNTRLPLANE-1226: feat(konflux): Make CPO builds hermetic #6596
CNTRLPLANE-1213: New API to support specifying cluster-autoscaler flags #6558
OCPBUGS-57331: Set default security context on everything #6257
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-52542: CVE-2025-22869 Update golang.org/x/crypto to patched OpenShift fork #118
Full changelog

insights-operator

feat: add permissions to gather clusterrole (#1112) #1112
fix: incorrect anonymization of domains (#1114) #1114
Full changelog

kube-storage-version-migrator

NO-JIRA: Add DOWNSTREAM_OWNERS (release 4-19). #223
Full changelog

machine-api-operator

fix for OCPBUGS-60427: userDataSecret.name should be a Required value on AWS #1403
OCPBUGS-59386: Enabled 10 concurrent reconciles on GCP #1391
Full changelog

machine-config-operator

OCPBUGS-59871: Understand and eliminate noisy logs for MCN #5199
OCPBUGS-60767: Update the OnClusterBuild payload tests to reflect the validation rule requiring MCP & MOSC names to match #5258
OCPBUGS-60265: Reintroduce cronjob that deletes MCN v1alpha1 CRD #5243
OCPBUGS-60224: Invalid architecture value found in annotation during 4.19 update #5227
OCPBUGS-60080: use channel to signal controller shutdown #5217
OCPBUGS-59928, OPNET-681: Support migration to NMState #5208
OCPBUGS-59899: Add workaround fix for static pod race #5204
OCPBUGS-59978: ARO cert rotate fix #5210
Full changelog

monitoring-plugin

NO-JIRA: [release-4.19] OCPBUGS-60296: fix legend height to avoid scroll overlap #498
NO-JIRA: improve consistency in tab string #496
: NO-JIRA: update the i18n #495
OCPBUGS-60129: feat: add alerting rules tab to dev console #488
OU-943: remove broken useEffect #484
OU-943: Manual Cherry Pick #474
OU-594: Manual cherry pick incidents tab 4 19 #479
OU-863: [release-4.19] Manual cherry pick add disconnect option #482
Full changelog

multus-whereabouts-ipam-cni

OCPBUGS-59640: Prevent accidental IP deallocation in statefulsets #375
Full changelog

network-metrics-daemon

OCPBUGS-58851: Bump github.com/golang/glog to v1.2.4 (#110) #110
OCPBUGS-60172: Replace e2e test image (#119) #119
Full changelog

oc-mirror

OCPBUGS-59760: warn if tmp is noexec (#1234) #1234
OCPBUGS-59976: v2/operator: support manifest lists with one arch (#1230) #1230
OCPBUGS-59949: fixes the result output showing the wrong total (#1237) #1237
OCPBUGS-57362: v2/mirror: retry in case of ContextDeadlineExceeded (#1199) #1199
OCPBUGS-54622: cli/delete: fix workflow mode name output (#1222) #1222
OCPBUGS-59799: Detect images from a Helm Chart with an aliased chart dependency (#1225) #1225
Full changelog

openshift-controller-manager

OCPBUGS-56614: legacy image pull secret rollback controller #384
Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

OCPBUGS-60525: Add NetworkPolicy as a supported kind #1047
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-48709, OCPBUGS-60797, OCPBUGS-60979: DownStream Merge Sync from 4.20 [08-22-2025] #2733
OCPBUGS-48709: DownStream Merge Sync from 4.20 [08-06-2025] #2704
OCPBUGS-48709: DownStream Merge Sync from 4.20 [07-28-2025] #2688
Full changelog

stream-coreos, stream-coreos-extensions

Merge #1853
Merge #1851
Full changelog

tests

OCPBUGS-60244: Wait 30s after the upgrade is complete to validate workloads #30144
OCPBUGS-60797: Don’t check for remote node subnet BGP routes #30156
NO-JIRA: Update extended/networking OWNERS #30088
OCPBUGS-60569: images/tests: Remove rteval #30124
OCPBUGS-60429: Load our MCO’s OTE binary #30043
OCPBUGS-59757: OCPBUGS-59758: Improve MCN test stability #30018
OCPBUGS-60117: Enable test for LGW L2 #30052
OCPBUGS-60234: Move the legacy container failures #30073
OCPBUGS-60092: feat(azure): skip metrics collection for ARO HCP hypershift #30051
Full changelog

vsphere-problem-detector

OCPBUGS-60535: Check for number of FailureDomain-s in GetVCenter() #188
Full changelog

Node Image Info

Loading node image info, this may take a while ...