4.21.0-okd-scos.8

Download installer and client with:

oc adm release extract --tools quay.io/okd/scos-release:4.21.0-okd-scos.8

Team Approvals:

Tests:

Blocking jobs
- upgrade Failed (2 retries) release-openshift-okd-scos-installer-e2e-aws-upgrade-from-scos-stable
- upgrade-minor Succeeded (1 retry) release-openshift-okd-scos-installer-e2e-aws-upgrade-from-scos-stable
  - Attempt 1 Failed
  - Attempt 2 Succeeded

Upgrades from:

Untested upgrades: 4.21.0-0.okd-scos-nightly-2026-03-07-110856, 4.21.0-0.okd-scos-nightly-2026-03-09-105806, 4.21.0-0.okd-scos-nightly-2026-03-09-225806, 4.21.0-0.okd-scos-nightly-2026-03-10-105806, 4.21.0-0.okd-scos-nightly-2026-03-10-232552

4.21.0-okd-scos.ec.19 - F F F
4.20.0-okd-scos.17 (changes) - Failed Success

Loading changelog, this may take a while ...

Changes from 4.21.0-okd-scos.ec.19

Created: 2026-03-12 08:11:28 +0000 UTC

Image Digest: sha256:69ddb50407c8a0293bcf1367b31158ed901f12337322271743fb00c0019439a6

Release 4.21.0-okd-scos.8 was created from registry.ci.openshift.org/origin/release-scos:4.21.0-0.okd-scos-nightly-2026-03-10-232552

Components

Kubectl 1.34.1
Kubernetes upgraded from 1.34.2 to 1.34.4
Kubernetes Tests 1.34.1
CentOS Stream CoreOS 10 upgraded from 10.0.20260109-0 to 10.0.20260307-0

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
IngressControllerDynamicConfigurationManager (0 tests)	Disabled	Disabled	Enabled	Enabled	Enabled (Changed)	Enabled (Changed)
KMSEncryptionProvider (0 tests)	Disabled	Disabled	Enabled	Enabled	Disabled (Changed)	Disabled (Changed)
KMSEncryption (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)

Removed images

cluster-kube-cluster-api-operator
installer-altinfra
installer-etcd-artifacts
installer-kube-apiserver-artifacts

Rebuilt images without code change

agent-installer-node-agent git e5713826 sha256:da28bd8b497c8106e6936ec34ac0ef5c8b6b01d5920d1667ca2d495037ec7451
agent-installer-ui git 479a68f3 sha256:bc2ddbe662df3ab7408761404b3217fa2c32712fcdf27394f6fb75fe4b867685
apiserver-network-proxy git 35ba137a sha256:bdd417206a8f2509261b9ce9ac2e27097c8f17d5aab715e972376eec6921a470
aws-cloud-controller-manager git 3365bc9c sha256:5c4eeaca1aa64708aafcf50735ffbbc4a34d3210a2c2bbbea8c38d6d850b0ec0
aws-cluster-api-controllers git 10ceef5e sha256:ceee9eef0e32f372d1f7199f27be3a8f9931748de739c2247f2c44f5c4d1761e
aws-ebs-csi-driver git 57eebffc sha256:315c03721a9ebdcb470847fbc963fcb0ceb11e227a2e09919008988d1a17e948
aws-karpenter-provider-aws git ff9c8d4e sha256:6d3a5c65a9a0726659680829d2aa0e1c84c3f9dfacfd222b985bc3b9c18e4e36
aws-kms-encryption-provider git 19e7b623 sha256:e81797d97678a4f0fc9bf1b6fcd5837b6eda5036a8d3d6757962b68b3eddb834
aws-machine-controllers git 938565c9 sha256:ca558573dd768be7a85d82cf5bf1dbed5e72b123adefee65e81a39c5f4246b7c
azure-file-csi-driver git c77d75f9 sha256:2472c763881cfbb2f2cbc35c5511408d495ae34e1e298cee0e8345506296553e
azure-machine-controllers git b8b8cb1c sha256:4733f3b7aaad7373422273492a30aabf52077705ee023e714bef51affb8e3cb2
azure-service-operator git 17e57462 sha256:5b96c9ac708aae01e988f322c773fc99075d1c8b04e480491739348e3fdfb2cb
azure-workload-identity-webhook git 3f2a6e0d sha256:788b0b1d19ec9924aa5694749a9d005325b37f1878322253722fb9dd002e936c
baremetal-machine-controllers git 4e6a729c sha256:cee1ccdb323d744a6f69a0516a9bc5f83543a2f4ed9b74d2be0643ba904d209e
cluster-autoscaler-operator git dec12ba6 sha256:a14177497c489dae2f87522d6576c5e7343ad4acdbf79a2d2eef15c17331a071
cluster-bootstrap git dc0d4a5c sha256:416eda83feed538a48483fc1227b4898265c8f783e5634ce52202583f19cfbaf
cluster-capi-controllers git a957484a sha256:d020942e2134745f834a1178c0540d416f8d5bd9c1bb4e8b0a2d955ffb3dc4bd
cluster-cloud-controller-manager-operator git 6148c0cc sha256:fb05883a874b7799a3cb21a2d006d00a4e5279543cfb98d2a6f8873331813cec
cluster-dns-operator git 41a53fed sha256:f6938bd0efc570cb28cf576b03c279b3917813e6648aa38406b319c7cbfa1606
cluster-kube-controller-manager-operator git 395de967 sha256:980ea43f197e5f62e49e8ec2724f3edb2dbe9dc6bccfbb900966ab3f6387ba0f
cluster-kube-storage-version-migrator-operator git 8a42beeb sha256:47e47a5a85f2a218e6e93b393031aaa8fee4b976d508ff962ae2f964d772c7e8
cluster-machine-approver git d864813c sha256:636683f613dedb36948b61afc1162dfdfc3b08540b94654259558a6c854724b5
cluster-node-tuning-operator git 0e275839 sha256:fc0b059e3c4dffa2aca60939bfe5c8ba834e31c61baf23ba67fbb212ce78bf08
cluster-openshift-controller-manager-operator git 2617a201 sha256:b70907ee425e7543ddcd6c1ee9dd7c3600c7fbfa6e6ddf744d3adc436fbba17f
cluster-policy-controller git 8b775487 sha256:ef89ce3c9201135b607d955931d1df4a931536cb56f61ce62ce8a51e5293a9ee
cluster-samples-operator git 11ed1942 sha256:53000646740716db8ea0ebe14ef5974abbc34fb6faafad968562d4e5aa7fc922
cluster-update-keys git b3cae8f2 sha256:a2ef7a7a59205d67a99790c4db1bcc87fb6d5fe2ee88f063428b49dea516b383
configmap-reloader git 16114b8d sha256:c07cfda588c444f2100a5367fcd995642ba5c4735dce067911002f50fd8ae1ea
container-networking-plugins git 747ad66c sha256:4c253e35e51171342ae536fad999189f9eea532f9cbc61b0646c2291b54a801f
containernetworking-plugins-microshift git 747ad66c sha256:c370f1f93b45373a624eee7264ee0ccf459feca3ec675d61b17474fa56eba7a6
coredns git 7486e9e4 sha256:d8415cc2255ea4f9a297243ed301d3a7e362f2122ca7ad34fab52d57f9a6557d
csi-driver-manila git bf508c06 sha256:3e24bc3fe324bedbd25a41e99e647573b7b222e99148addaa35f75dcd6ec9d80
csi-driver-nfs git 49f2d86f sha256:1663c754d466ffe407d509c66f8a0e0b5bf578807597303cee20851915659f9a
csi-external-attacher git 344669a2 sha256:606457607b6f248d358014d1ba4596468712486b69fd937e7d73a27cff1db43c
csi-external-provisioner git f18190fb sha256:b014520c5001ba273905fddd426433ce38d066c5ecdc9c3893077f5208a0c796
csi-external-resizer git d880a1ec sha256:549418d3ab834d66ae5a237fff1d9ab519597a8724285fb358dbb5fe64d76f3e
csi-external-snapshot-metadata git af250fdb sha256:3503fefeb326cc81a0fc7554d47de54edecf42e821efe6804c20db8e0a064aa5
csi-external-snapshotter git 9098db0e sha256:61eb4b493c4a9f2aeffa56490dcbd29344142dd4e8e9f7fa6f796867e8d38505
csi-livenessprobe git 78dacb7c sha256:60b3a8ba9d71c3ef24874c109880f7e63129d1ff8b85e691adbf556d2ce56638
csi-node-driver-registrar git d29f3f7a sha256:a4d8ee052f73a3404a90f62ea02de8c8f5ae17b0da1f57c86c66c28f4193279e
csi-snapshot-controller git 9098db0e sha256:b81cc0110773dbee8d9d8917f93871533afbd882412e83ed34f8b1a40b71803b
docker-registry git 602f51c7 sha256:89eeff234567dfa05ff304f83cac88f99620cc7334ec5eacb515ef783000418e
driver-toolkit git 5c53d757 sha256:f0a3fce9fbfb8fd064662136bc47af48a1cfdb9283511f36ef24c003073c2659
egress-router-cni git 5e0f8d1b sha256:8b5e5c4334eeb0c523366fd300e9134af6a7987eb891c171bb8997a4a851b74a
etcd git 806f690e sha256:32adb5a6761c18aa8c8f84f253cd0ad334d95708edb090f963e88931d5f671df
gcp-cloud-controller-manager git 8732386c sha256:9222e2f69a19fa10223320d8ac75dca48683fb0583ab9b968094cf91d000d81e
gcp-machine-controllers git 91f71c9a sha256:bee10ec96337b98e47675b93f23b585b668a09c268e954bd8cdff757b6e2a799
gcp-workload-identity-federation-webhook git d481e5cb sha256:f6548a491a22793916d66672d8215af080c7c2390255bbf589affc667abb0d39
haproxy-router git b231c65b sha256:34a51b2322c7cd8484cde3f79bb1744d9c0e755bdfbdd605dc7830db15d35799
ibm-cloud-controller-manager git c566572b sha256:91503894206abbd20ee8608c4eea5fa751ddc58dcf2acaedbcf0727e057bef78
ibm-vpc-block-csi-driver-operator git 00bc7407 sha256:04626fb34de3a759815a4ed369b5167fdf7b350383164d030c538bb14da6c91a
ibmcloud-machine-controllers git e72a8471 sha256:4be14dfa010616f021a67a39357a04c462f7fab0baaf78962da195892674a2f5
ironic-static-ip-manager git b95b05fe sha256:e0b3ee64f334f65d716250a9731672af682d05f7fded752676e0f69896d63fff
kube-metrics-server git ed76a5e8 sha256:33dabd6d07390cfb52d7454c65ad06efe072c6e05c13737918ee91a0fc015bad
kube-rbac-proxy git cd636680 sha256:cd24f1f683a23650d7920f0d6466e9d9ef23e40d8cb6909285115b495557ced5
kube-state-metrics git cb0aa591 sha256:dc86ad019ae0770e7f0845c0592928af99b994b376ea2c6b19c5a3b2b07d6ec7
kube-storage-version-migrator git ce5ff17e sha256:b82d2b8c6cffa2451d88ab810b808ab150c00adadf429f93716744ef5e7a2b17
kubevirt-csi-driver git 9e2dbddf sha256:b2069903140fe4f8d79d2c34696804f794d440401195781fb406dfef96f26599
libvirt-machine-controllers git 76effeca sha256:5de10d10d3aaf1fcbba823e87964d0f153a87654b1ba8d08a16692e6d01b91de
machine-api-operator git 83936dde sha256:d18fead7ecb6d1b43c709aa1134183e66ed1e589cf417cb1bb339716417ee28f
machine-os-images git 9a8e96a6 sha256:e7e3e1fbb572120a869d662eea7f8941cfc3156351ef7bdedb1ea8a3feb9bd92
metallb-frr git c82bfaad sha256:a137da9faa235a8e48330d95169bd3f35330d856632046b258a313c5f07b5337
multus-admission-controller git d95feb67 sha256:0a258aaf291ecf454c9f885d508871bfe0aefd7aa132388b715d63da903b53f4
multus-cni git 93556f99 sha256:dc2270435fd4b98f08a826002f24682a66e2e9dce28031998a78d28a8f3f5f3c
multus-cni-microshift git 93556f99 sha256:5eee2642da6c9642db73a7a3a3662fffc5289dd186af8b5b359ad934595094e1
multus-route-override-cni git 08af4127 sha256:919e8fe0ada2b5f604ffb40bf27436dbfd134604a1c02e9a4a7b39163413318e
multus-whereabouts-ipam-cni git d691040e sha256:63733d291a96e702ad351d608d06ea2dc2fd0daea2e2645c7819d9c2fb776c4e
must-gather git b4b434c4 sha256:97277dd09a5f91d162cc32070cfa23235408e2fa42ad8f7f00d173f7fe12f551
network-interface-bond-cni git 297eeb43 sha256:ab9480b7b4ea7ca36412d8447502bffebe3c39a3ec2b0b31a35f19db4ac5ba77
network-metrics-daemon git 844fa588 sha256:d7cde0f8eaa6564ce75ddaf92672b426ba25c6d1b3b7269dcad2a63802124190
network-tools git d6717e45 sha256:aa8f2191a81f9dcc604c9a06f8930c7a5ed81a02af3d472a87987e74320407ed
nutanix-cloud-controller-manager git 33b7bec6 sha256:af18f515ef543d242ea1cd3a323b819ebceb0dd08227179a53c59d9ab7c5600a
nutanix-machine-controllers git b15a665c sha256:0420bc5c8125142b59491f9087c8d26f4b4fc7b3288da531ed672920f8841103
openshift-apiserver git 64dea074 sha256:df38e3c26840b27b3491f5b904b8b5abeb99a8abab6bb05e1bbf41e4d0fa486e
openshift-controller-manager git 438d52e7 sha256:a82d0b160fed6d0d35cbd04c00543977e875c9ea69e36f72d531f3684ec71f6f
openshift-state-metrics git ab605a4b sha256:d0c72a488d1bd2f3e105aa2d089cdef41cb85b896e7ce8a23bf5de49cb5a3cd4
openstack-cinder-csi-driver git bf508c06 sha256:71055251e4ea3b4d393677448b92d1240d974a57d8ad9149d7c448a4ef199b65
openstack-cloud-controller-manager git bf508c06 sha256:4c866ec25a7620a47deab7b58b43fe9fe6fd74775e4d699c86751f1398b9a707
openstack-cluster-api-controllers git e1c0f2f9 sha256:2da58c3117d76b5d8f8d92970f4cc2c3d0c4b06ffcc1fa7054f98b5b2b89f249
openstack-resource-controller git 70f5ad34 sha256:46daa300bbbd3d6d27b8fa1a705c3fc7e2e2860af22d206e0260f8593904930a
powervs-block-csi-driver git 791e12ab sha256:a5ca900da14f13e45fe949e75b769a32054df82677eac3e8957ecd45b5fc2883
powervs-block-csi-driver-operator git e22228ae sha256:45c6ce7357a71dca5b2a99fc624ce19365825b72d796c3524427feb61e85fcf5
powervs-cloud-controller-manager git 969a04e9 sha256:4945c21ac05d571f08f1bff1eebaac57134199d87eb919e2267eb406d3115db9
powervs-machine-controllers git 551974ef sha256:bf15b93a9dab57d25b41d64f87de8addde8d0368d1a43ab5fb4196e6acad6026
prom-label-proxy git 610c11b5 sha256:6baa5ea2e01a9c1a3c7cb287630a57ccf090063f66efa3b259c3494124e8dd77
prometheus git ac9443d2 sha256:15a6be2a1112b083e7df2b29b49ff2802af3d59bd689378a19325962265d5040
prometheus-alertmanager git 3dbe0b64 sha256:5e83cb8fc86e0bd5378ec3d265e729e094e6be7bc5b108ee754f20930cc62ada
prometheus-node-exporter git 39d72873 sha256:9f699ad7029454ef10446f502cbfec8793ec44c9afa80cba4ade4959875559f6
telemeter git a54acdfe sha256:3546e04e409a4f05f7445b94fddf208093f89cc3e8d325bb609f1d1406f99fe0
thanos git 6ea20ffa sha256:3aea1276cd7cfeb12ca978992a5abb63affc1dd687c9dd2f7425c44de4f6b46c
volume-data-source-validator git 8b929332 sha256:f63defc13fbcf483ae0c4bf9bf8b302514a65e79b751f099d286b0c113b0a1eb
vsphere-cloud-controller-manager git f69584d6 sha256:0fa83d3a41a6019fc61bf1cf6cdeeed3c5216db9bafa635f6c40682b84e1918b
vsphere-cluster-api-controllers git 6626b299 sha256:3bfab1411cc0b5813dae0b522f82b006b0e066bac8a3cdeabd25a6f83938be24
vsphere-csi-driver git 5e680186 sha256:f1761bc8d029768c3dcddae84836a342840fb7c42047b5b0fced95c46c744ccc
vsphere-csi-driver-syncer git 5e680186 sha256:25c4f374e81006e5932800153f2a01f6c84bb7a179cf0ea93dfad50604adedcb

agent-installer-api-server

AGENT-1431: Backport feature NoRegistryClusterInstall to 4.21 #8806
OCPBUGS-72519: Fix YAML marshaling for Kubernetes types in disconnected ignition #8736
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-77536: Fix root partition before copying IRI registry data #2038
Full changelog

agent-installer-utils

OCPBUGS-78144: Update to use the 4.21 Catalog #271
OCPBUGS-77538: (Backport) Override prefilled rendezvousIP #263
OCPBUGS-77302: Remove multiple redhat-operator-index catalogs #262
OCPBUGS-77236: Update quay.io/konflux-ci/konflux-vanguard/task-rpms-signature-scan:0.2 Docker digest to 2f3015a #222
OCPBUGS-77220: Update Konflux references #251
OCPBUGS-76590: Update Konflux files to build 4.21.1 #254
OCPBUGS-76411: Include additional operators in OVE config #253
AGENT-1431: Backport feature NoRegistryClusterInstall to 4.21 #248
OCPBUGS-74935: Update Konflux references #220
OCPBUGS-74304: Increase Konflux build pipeline memory #243
OCPBUGS-71230: bump github.com/sirupsen/logrus to v1.9.3 #234
Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator

OCPBUGS-74215: [release-4.21] Add VAC manifest for tests in AWS EBS #485
Full changelog

azure-disk-csi-driver

OCPBUGS-69655: fix ASH static provision segmentation fault #118
OCPBUGS-67305: fix: disk creation failure in AzureStack env #116
Full changelog

azure-kms-encryption-provider

OCPBUGS-62405: Updating azure-kms-encryption-provider-container image to be consistent with ART for 4.21 #23
Full changelog

baremetal-installer, installer, installer-artifacts

OCPBUGS-77504: fix wavelength zone name regex #10343
OCPBUGS-77551: Increase size of /var/ostreecontainer mount #10346
OCPBUGS-73878: handle SSH rule deletion for Azure private #10225
OCPBUGS-76358: [release-4.21] Fix destroy bootstrap command for Azure #10293
AGENT-1431: Backport feature NoRegistryClusterInstall to 4.21 #10250
OCPBUGS-74672: [release-4.21] GCP: skip AI zones #10272
OSDOCS-17769: [release-4.21] Add AWS m7 instance types #10266
OCPBUGS-74493: add support for NVIDIA H100 and H200 enabled machine series #10259
OCPBUGS-74414: Remove region option for the GCP Private Service Connect Endpoint #10253
OCPBUGS-73891: add newly detected instance types for Azure during 4.21 regression test #10227
Full changelog

baremetal-operator

Bug OCPBUGS-76492: BMO fails to start servicing despite updates to HFC spec #459
OCPBUGS-68369: Abort inspection/cleaning before powering off during deletion #449
OCPBUGS-74365: Fix invalidDNSNameinvalidipv6 test for Go 1.24+ #450
OCPBUGS-67294: Require PreprovisioningImage for deprovisioning when cleaning is enabled #443
Full changelog

baremetal-runtimecfg

OCPBUGS-77168: Install dbus-tools, needed in pkg/monitor/dnsmasqmonitor.go #383
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-77486: Makefile: Strip debugging symbols by default #2211
OCPBUGS-77168: Install subscription-manager in required images #2208
OCPBUGS-73911: Fix unit test failure by updating ruby version to 3.3 #2186
Full changelog

cloud-credential-operator

OCPBUGS-71222: test-ext: remove kubernetes module dependency #958
OCPBUGS-74545: Resolve nil pointer exception in hasResourceTags #969
Full changelog

cloud-network-config-controller

OCPBUGS-77154: Refrain from adding Egress IP to public LB backend pool #205
Full changelog

cluster-authentication-operator

OCPBUGS-74418: Bump library-go to get KMS #847
OCPBUGS-74418: carry test assertion #848
OCPBUGS-74418: Conditionally add the KMS plugin volume mount to the oauth-apiserver container #846
OCPBUGS-74418: Add KMS test scenarios #844
Full changelog

cluster-autoscaler

OCPBUGS-76296: Pick upstream commits to Fix VPA recommender concurrent access panic #404
Full changelog

cluster-baremetal-operator

OCPBUGS-77418: Fix ironic-proxy service routing for port 6385 #560
OCPBUGS-77035: Update kubebuilder tools to more latest version #558
OCPBUGS-74204: Fix libguestfs /tmp access in machine-os-downloader init container #551
OCPBUGS-70163: Remove the writable ironic CA cert volume mount at /certs/ca/ironic path, ironic will use the writable /conf mount if needed #541
Full changelog

cluster-capi-operator

OCPBUGS-74650: fix: e2e: workaround for flakes caused by OCPBUGS-74571, until it is fixed #450
OCPBUGS-73908: Remove references to cluster-api-operator image #445
OCPBUGS-69772, OCPCLOUD-3105: make use of sigs.k8s.io/cluster-api’s v1beta2 #435
OCPBUGS-69417: fix: e2e: CAPI creation issue/scale-down wait issue/machine nodeRef comparison issue #433
Full changelog

cluster-config-api

OCPBUGS-74418: Introduce KMSEncryption feature gate #2670
OCPBUGS-76408: Move DynamicConfigurationManager back to TPNU #2703
Full changelog

cluster-control-plane-machine-set-operator

OCPBUGS-74588: Bump openshift/api to get latest AWSMachineProviderConfig type #386
Full changelog

cluster-csi-snapshot-controller-operator

OCPBUGS-74301: Re-add serving cert volume mount to hypershift guest cluster manifest #267
Full changelog

cluster-etcd-operator

OCPBUGS-77921: Prefer to remove members where they have another healthy machine in the same failure domain index #1563
OCPBUGS-77097: Wait for revision stability before removing etcd members #1555
OCPBUGS-74489: configure inertia for all controllers, bump to 10m #1535
Full changelog

cluster-ingress-operator

OCPBUGS-77432, OCPBUGS-77433: Ensure canary cert matches the default ingress controller’s cert #1367
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-74418: Bump library-go to get KMS #2063
OCPBUGS-77969: Add support for event-ttl cases and go test cases in Kube API Server Operator #2066
OCPBUGS-74418: Carry test assertion #2064
OCPBUGS-74418: Conditionally add the KMS plugin volume mount to the kube-apiserver container #2061
OCPBUGS-74418: Add KMS test scenarios #2054
OCPBUGS-74181: SCC: allow image volume type for all SCCs #2007
OCPBUGS-73561: Update openshift/library-go to get new default TLS configuration #1999
OCPBUGS-61297: revert dev cert rotation #1984
Full changelog

cluster-kube-scheduler-operator

CNTRLPLANE-2843: chore: update OWNERS #619
OCPBUGS-74592: [release-4.21] NO-JIRA: pkg/operator: Fix wrong ClusterOperator name #605
[release 4.21] OCPBUGS-74265: Add OPERATOR_IMAGE_VERSION to recovery container #603
Full changelog

cluster-monitoring-operator

OCPBUGS-74425: Include kube_pod_labels in minimal profile #2797
OCPBUGS-77908: [release-4.21] add app.kubernetes.io/part-of=openshift-monitoring label to thanos-ruler pod #2840
OCPBUGS-76541: Fix NodeRAIDDegraded & NodeRAIDDiskFailure alerts #2815
OCPBUGS-77271: AlertingRule: fix duplicate PrometheusRules after MD5->SHA-224 naming change #2829
OCPBUGS-74622: update expr for AlertmanagerClusterFailedToSendAlerts to exclude value 0 #2804
OCPBUGS-74202: move endpointslice RBAC to Role #2795
Full changelog

cluster-network-operator

OCPBUGS-77147: Add config override for openflow-probe #2917
OCPBUGS-76285: Remove duplicated openssl parameter #2899
Full changelog

cluster-olm-operator

OCPBUGS-77826: cluster-olm-operator sets Progressing=True during upgrade #177
Full changelog

cluster-openshift-apiserver-operator

OCPBUGS-74418: Bump library-go to get KMS #666
OCPBUGS-74418: Conditionally add the KMS plugin volume mount to the openshift-apiserver container #664
OCPBUGS-74418: Add KMS test scenarios #656
Full changelog

cluster-storage-operator

OCPBUGS-74569: add vsphere permissions for checking if users is authorized to see metrics #660
Full changelog

cluster-version-operator

OCPBUGS-77256: Implement mTLS authentication and authorization for CVO metrics endpoint #1326
OCPBUGS-74009: lib/resourcemerge/core: Reconcile ConfigMap binaryData too #1295
Full changelog

console

OCPBUGS-77561: Fix ConsolePluginStatus icon #16090
OCPBUGS-75000: Clean up old session cookies to prevent accumulation #15985
OCPBUGS-77957: [CI] Fix the VolumeSnapshot CRUD flaky test failures #16118
OCPBUGS-77882: Fix infinite recursion in project access form #16112
OCPBUGS-65948: prep for 4.21 GA SDK publish #16116
OCPBUGS-76385: Workloads - Edit pod count and Edit parallelism : Content is in English #16005
OCPBUGS-76387: DataView Pagination page menus : i18n misses #16007
OCPBUGS-76386: i18n upload/download routine task - 4.21 / 281 (Latest) #16006
OCPBUGS-77430: run and enforce yarn dedupe #16075
CONSOLE-5011: migrate to yarn berry #16059
OCPBUGS-76389: Use Actions button instead of kebab menu on Subscription details page #16008
OCPBUGS-74998: Fix referenceFor parameter in SubscriptionDetailsPage #15984
OCPBUGS-74887: Add null checks to CRB subject #15974
OCPBUGS-74587: ‘0 of pods’ are shown in Status column on DaemonSets list page. #15953
OCPBUGS-74695: Bump lodash to latest #15962
OCPBUGS-74157: Do not resolve disabled catalog type extensions #15930
OCPBUGS-73870: Update the perspective name in dev-console guided tour #15922
OCPBUGS-73770: update operator details when changing channels #15917
OCPBUGS-73871: i18n upload/download routine task - 4.21 / 281 #15923
OCPBUGS-69931, OCPBUGS-69932: apiVersion is empty on YAML creation page - Runtime error occurs when create MachineConfig with default yaml from… #15871
Full changelog

console-operator

OCPBUGS-72562: Add missing relatedObjects + small refactoring #1090
OCPBUGS-74686: Add rhel8 and rhel9 oc binaries for Linux OS in CLI downloads #1104
OCPBUGS-74152: Fix PDB blocking node drains during cluster upgrades + update donwloads deployment #1103
OCPBUGS-72550: Add missing console annotation to the quickstart #1089
CM-821, ESO-277, OCPBUGS-69766, SSCSI-235: Add quickstart guides for secrets management operators #1084
Full changelog

docker-builder

OCPBUGS-70149: bump buildah to 1.39.7 to fix CVE-2025-52881 #495
Full changelog

gcp-cluster-api-controllers

OCPBUGS-74915: Merge https://github.com/kubernetes-sigs/cluster-api-provider-gcp:v1.11.0 (1cb204d) into release-4.21 #262
Full changelog

gcp-pd-csi-driver

OCPBUGS-77716: Support Downward API node name #101
Full changelog

gcp-pd-csi-driver-operator

OCPBUGS-77494: Pass node name to csi-driver container #173
OCPBUGS-77310: Add RBAC permission for node driver to get Node objects #171
OCPBUGS-74222: [release-4.21] Add VAC manifest to support tests on GCP PD #167
Full changelog

hyperkube, kube-proxy, pod

OCPBUGS-76516: Bump v1.34.4 #2590
OCPBUGS-74975: UPSTREAM: 136594: raise kubelet CSI init backoff to cover ~140s DNS delays #2580
OCPBUGS-73910: UPSTREAM: 135340: cbor: bump limits #2565
Full changelog

hypershift

CNTRLPLANE-2812: feat(aro): Swift support #7826
OCPBUGS-77365: Fix ignition-server pod restarts due to MIRRORED_RELEASE_IMAGE flapping #7834
OCPBUGS-75930: [release-4.21] fix(cpo): Correct route labeling logic for HCP router infrastructure #7641
OCPBUGS-75884: feat(updates): enable CVO metrics access with RHOBS monitoring flag #7632
fix: OCPBUGS-74104: Fix CVE-2025-58183 #7545
OCPBUGS-71133: fix(ingress): clear LoadBalancerSourceRanges when AllowedCIDRBlocks is removed #7433
OCPBUGS-74893: fix: add hypershift.openshift.io/nodepool-globalps-enabled label to be ignored in cluster-autoscaler deployment #7618
OCPBUGS-74648: feat(cpo): check components have rolled out before setting available #7604
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-77203: [release-4.21] standardize build paths #121
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-66393: Updating ose-ibmcloud-cluster-api-controllers-container image to be consistent with ART for 4.21 #133
Full changelog

insights-operator

OCPBUGS-76960: Extends the time for the extractor liveness probe #1233
OCPBUGS-74479: set Progressing condition on cluster update #1217
OCPBUGS-74233: [bugfix] The ConfigMap value for StoragePath is ignored on basic routine #1214
Full changelog

insights-runtime-exporter, insights-runtime-extractor

OCPBUGS-77491: remove dnf cache from the container images #64
Fix EAP 8.1 e2e test #65
Full changelog

ironic

OCPBUGS-76934: Bump keystonemiddleware version to 10.9.0-0.20260216145500.557d173 for CVE-2026-22797 fix #791
OCPBUGS-76474: Update requirements.cachito for 4.21 with heartbeat inspection fix commit #785
OCPBUGS-76282: Update ironic hash #780
OCPBUGS-74603: fix for minimal builds #774
OCPBUGS-74428: Bump eventlet version to latest bugfix #771
OCPBUGS-70156: Set the tls cacert path to writable mount when the IRONIC_CACERT_FILE is unset #753
Full changelog

ironic-agent

OCPBUGS-74603: fixes for minimal builds #241
Full changelog

ironic-machine-os-downloader

OCPBUGS-74204: Export TMPDIR to be available to child processes #112
Full changelog

keepalived-ipfailover

OCPBUGS-78048: openshift-enterprise-base: remove subscription-manager, dbus, systemd #226
Full changelog

kubevirt-cloud-controller-manager

OCPBUGS-76994: [release-4.21] Sync Upstream 2026-01-27 #61
Full changelog

machine-config-operator

OCPBUGS-77833: Update AMI Whitelist #5743
OCPBUGS-77689: Create admin-ack gates for azure/vsphere clusters upgrading to 4.22 #5735
OCPBUGS-77577: Fix failure domain matching during vsphere boot image updates #5727
OCPBUGS-77534: Update AMI Whitelist #5722
OCPBUGS-77354: Clean up vsphere login error logging #5705
OCPBUGS-76555: Remove MCD liveness probe #5651
OCPBUGS-77072: mcd_config_drift not working properly #5675
OCPBUGS-76823: reduce MCO image size #5657
OCPBUGS-76833: Machine-config controller should not log about non-existent pull-secret changes #5659
OCPBUGS-73805: Prevent unnecessary systemd unit disable #5648
MCO-2017: Backport OSImageStreams to 4.21 #5515
OCPBUGS-76356: crio: disable short_name_mode until we introduce ctrcfg api for it #5636
OCPBUGS-76359: Update AMI script and list #5639
OCPBUGS-76271: machine-config-daemon: openshift: Exposure of Sensitive Data in Log Files in the Machine Configuration Daemon. [openshift-4] #5624
AGENT-1431: Backport InternalReleaseImage support #5610
OCPBUGS-74145: enable nodeip-configuration for platform external #5581
OCPBUGS-74542: Stale operator metrics Service and ServiceMonitor resources need to be deleted #5600
OCPBUGS-74431: CVE-2025-58183 ose-machine-config-operator-container: Unbounded allocation when parsing GNU sparse map [openshift-4.21] #5596
OCPBUGS-73819: Set NodeDegraded MCN condition when node state annotation is set to Degraded #5554
OCPBUGS-74103: Fix up bootstrap-e2e #5568
OCPBUGS-73872: CPMS boot image config should not override standard MachineSet configuration #5559
OCPBUGS-74102: Fixes the issue in the test TestKubeletConfigMaxPods when AutoNodeSizing is enabled by default #5567
OCPBUGS-71196: Enable existing units without content #5561
Full changelog

machine-image-customization-controller

OCPBUGS-77031: Add IPA messages for console and SSH login #163
OCPBUGS-77490: Clean up dnf cache to reduce container image size #164
Full changelog

monitoring-plugin

NO-JIRA: [release-4.21] e2e-monitoring fixing loop on legacy dashboard #828
OCPBUGS-77227: [openshift-4.21] CVE-2026-25639 openshift4/ose-monitoring-plugin-rhel9:Axios affected by Denial of Service via proto Key in mergeConfig #795
OU-1062: [release-4.21] feat: mark alert menu active for incidents tab #761
NO-JIRA: [release-4.21] simplify frontend build in Dockerfile.art #808
OCPBUGS-74909: fix: update vulnerable dependencies #751
NO-JIRA: [release-4.21] fix: remove unnecessary package.lock #729
OCPBUGS-71223: fix: update qs vulnerable dependency #718
OU-1145: remove random multiplication #703
NO-JIRA: [release-4.21] automation - dev user scenarios fixes with namespace level changes #698
OCPBUGS-67297: [release-4.21] fix: upgrade node-forge vulnerable dependency #685
NO-JIRA: [release-4.21] - automation - monitoring stabilization presubmit #687
OU-1130: Add missing commits to 4.21 #682
Full changelog

multus-networkpolicy

OCPBUGS-77489: Clean up dnf cache #100
Full changelog

networking-console-plugin

OCPBUGS-77225: Fix NAD creation using default namespace instead of selected one #349
CNV-77540: fix Enable MultiNetworkPolicies lead to invalid URL #341
CNV-74687: Fixing the title and redirect when deleting a vm network #340
CNV-76879: Allow passing the physical network name via URL parameter in the VM network wizard #332
Full changelog

oauth-apiserver

NO-JIRA: (chore): update OWNERS file #167
Full changelog

oauth-proxy

OCPBUGS-74131: test/e2e - do not use ambiguous container image short names #344
Full changelog

oauth-server

OCPBUGS-77454: groupmapper: avoid mutating original group users slice when removing user #213
Full changelog

oc-mirror

OCPBUGS-77222: Fix registriesd “unknown userid” failure for arbitrary UIDs #1358
OCPBUGS-76126: Fix reg config detection for explicit false values #1349
OCPBUGS-74981: fix conversion issue for catalog #1346
OCPBUGS-74577: fix duplicated channel bug in filtered catalogs #1345
Full changelog

olm-catalogd, olm-operator-controller

OCPBUGS-74967: [release-4.21] enhance qe cases to make it more stable #626
OCPBUGS-74633: config watchnamespace api cases #620
OCPBUGS-74562: enhance ocp-79770 #617
Full changelog

openstack-machine-api-provider

OCPBUGS-76789: Fix make test #156
OCPBUGS-69644: Don’t record event for every reconcile #146
Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

OCPBUGS-77712: Update NetworkPolicy egress to support HyperShift custom API ports #1246
OCPBUGS-77067: Remove the collect-profiles info from the microshift kustomization file #1234
OCPBUGS-76325: [release-4.21]remove qe case of testing collect-profiles #1222
OCPBUGS-76266: Remove the collect-profiles job #1220
Full changelog

operator-marketplace

OCPBUGS-77580: Update NetworkPolicy egress to support HyperShift custom API ports #729
OCPBUGS-73881: Increase default catalog polling interval to 4h (240m) #705
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-76472: OCPBUGS-72532: Branch Sync release-4.22 to release-4.21 [12-19-2025] #3022
OCPBUGS-77147: Minimize ACLs by combining ipBlocks into single ACL #2995
OCPBUGS-77309: Clear stale conntrack UDP entries for nodePorts #3002
OCPBUGS-77046, OCPBUGS-77086: [release-4.21] combined backport PR for 2 escalations #2984
OCPBUGS-74267: release-4.21 fix(localnet, ipamless): Prevent LSP deletion on sync #2940
Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

OCPBUGS-77295: backport upstream fix to reconcile resources with inconsistent status #365
OCPBUGS-74477: Validate webhookURL secret for MSTeams receiver in AlertmanagerConfig CRD #359
Full changelog

route-controller-manager

OCPBUGS-76641: filter ingress namespace on UnmanagedRoutes metric #73
Full changelog

stream-coreos, stream-coreos-extensions

COS-3946: Backport rhel-10.2 support to release-4.21 branch #1898
NO-JIRA: rhaos-pkgs-match-openshift: exclude known package mismatches #1889
NO-JIRA: Remove (commented) WASM mentions #1888
And 2 elided commits (e.g. from squash or rebase merges)
Full changelog

tests

OCPBUGS-78064: Allow test to tolerate running on minimal images #30852
OCPBUGS-77823: add the missing namespace from managed openshift #30838
OCPBUGS-77826: Remove exception for monitoring OLM Progression condition #30839
OCPBUGS-77097: Add test for CPMS OnDelete strategy with full master replacement #30802
: OCPBUGS-76856:cert tests: mark TLS registry test as informing #30779
OCPBUGS-76529: Fix flakiness in MutableCSINodeAllocatableCount test #30772
OCPBUGS-76955: co/kube-storage-version-migrator reports Available=False in a non-upgrade job #30740
OCPBUGS-75513: adjust olm test to pass on a degraded run #30749
OCPBUGS-75513: update test logic for degraded cluster run #30748
OCPBUGS-74499: Update MCN tests to better handle condition transitions through the “Unknown” state #30729
OCPBUGS-74503: VsphereConfigurationTestsRollOutTooOften event matcher should use broader regex #30730
OCPBUGS-74372: Add/RemoveSigtermProtection event matcher for SigstoreImageVerification test #30723
OCPBUGS-74303: Add filter for openshift-copy-to-node ns #30715
OCPBUGS-74094: Ignore repeated TopologyAwareHintsDisabled events #30699
OCPBUGS-73808: update watch request limits for cluster-autoscaler-operator #30691
Full changelog

vsphere-csi-driver-operator

OCPBUGS-74701: Fix update of stable-generation annotation #330
Full changelog

vsphere-problem-detector

OCPBUGS-74706: fix concurrent map writes #207
Full changelog

View changelog in Markdown or change previous release:

Source code for this page located on github