Back to index
4.12.0-0.okd-scos-2023-02-14-060109 Download installer and client with:
oc adm release extract --tools quay.io/okd/scos-release:4.12.0-0.okd-scos-2023-02-14-060109 Team Approvals:
No tests for this release
Created: 2023-02-14 10:29:38 +0000 UTC
Image Digest: sha256:968a5b06be2095ef337aaf4f5d951292875dd538b6e76d5cee826f3a6cd307d1
Release 4.12.0-0.okd-scos-2023-02-14-060109 was created from registry.ci.openshift.org/origin/release-scos:4.12.0-0.okd-scos-2023-02-14-060109
Components
Rebuilt images without code change
MGMT-13192 : dualstack SNO cluster fails to complete - getting error In dual stack installation we should set dhcp,dhcp6 kargs in order to wait for ipv6 address when node comes after reboot (#4914) #4914 MGMT-12863 : Assisted Spoke install-config does not generate icsp with multiple mirror to entries (#4748) #4748 MGMT-12635 : Add icsp-file support for all oc commands (#4684) (#4700) #4684 Full changelog
Bug OCPBUGS-5156: Add ApplicationSecurityGroups to InterfaceIPConfiguration #92
OCPBUGS-4783 : OpenStack: Support multi AZ environments #88 OCPBUGS-4784 : OpenStack: Only return egressIPConfiguration for first InternalIP #89 Full changelog
MULTIARCH-5164 : Update powervs-utils regions to include us-south and tor #1157 IR-490 : manifests: add pvc related alerts to prometheus rules #1147 HOSTEDCP-1994 : Add filewatcher for Azure client certificate authentication #1155 HOSTEDCP-2019 : Use Client Cert Auth for ARO HCP deployments #1131 OCPBUGS-43508 : fix proxy config and leader election test flakes #1140 OCPBUGS-38667 : pkg/operator: wait for image registry config object cache sync #1138 OCPBUGS-42732 : pkg/storage/azure: also check for auth failure error code on deletion #1129 CFE-1129 : Added AWS TAGS reconciliation #1121 OCPBUGS-42514 : azureclient: stop validating credentials when creating the client #1127 OCPBUGS-42196 : pkg/storage/azure: use cluster-api tag key to discover vnet #1120 OCPBUGS-42106 : Continuous pull-secret updates / slow initialization on build01 (test platform infrastructure) #1122 OCPBUGS-42004 : Set the Managed Identity client ID #1116 OCPBUGS-39485 : Updating ose-cluster-image-registry-operator-container image to be consistent with ART for 4.18 #1113 OCPBUGS-37543 : Avoid Shared Access Key usage for Azure Storage Account when using Managed Identity based auth #1095 MULTIARCH-4971 : Sync ImageStreamImportMode setting in the image config status #1090 OCPBUGS-38842 : pkg/resource: invoke update-ca-trust extract with –output #1096 OCPBUGS-37543 : Revert “Merge pull request #1087 from rajdeepc2792/rajdeepc2792/ARO-9391” #1093 ARO-9391 , OCPBUGS-37543 : Avoid Shared Access Key usage for Azure Storage Account when using Managed Identity based auth #1087 OCPBUGS-38287 : bump gophercloud to latest v2 #1086 IR-467 : Enable MSI override for ARO HCP #1082 SPLAT-1721 : Remove alibaba #1077 IR-471 : Removing featuregate for chunkSizeMiB config #1073 Revert “IR-467: Enable Azure MSI authentication” #1079
IR-467 : Enable Azure MSI authentication #1020 OCPBUGS-37207 : Power VS: Check endpoints against lower case strings #1076 IR-471 : Adding additional validation #1074 OCPBUGS-36038 : go.*,vendor: bump go-retryablehttp #1063 IR-477 : pkg/operator: deactivate azure path fix job #1061 IR-471 : Exposing chunksize variable to utilize docker registry config #1060 OCPBUGS-34107 : Updating ose-cluster-image-registry-operator-container image to be consistent with ART for 4.17 #1045 OCPBUGS-34399 : Update rbac for featuregate #1056 OCPBUGS-33453 : add SAR capability to image-registry #1046 CFE-962 : Refactor code to mock GCP tag service for UTs #1027 OCPBUGS-34399 : Revert “Merge pull request #1026 from deepsm007/expose-chunksize” #1052 OCPBUGS-34399 : Exposing chunksize variable to utilize docker registry config #1026 OCPBUGS-34107 : Updating ose-cluster-image-registry-operator-container image to be consistent with ART for 4.17 #1040 OCPBUGS-32710 : pkg/storage/s3: use force path style in favour of virtual hosted style config #1028 OCPBUGS-33149 : azure-path-fix: get client secret from k8s secret #1029 OCPBUGS-33868 : Bump openshift api, client-go & library-go #1036 OCPBUGS-33172 : azurepathfix: check if platform status is nil before accessing it #1030 OCPBUGS-32491 : Power VS: Add support for Power VS endpoint overrides #1024 OCPBUGS-29559 : Apply hypershift cluster-profile for ibm-cloud-managed #999 OCPBUGS-32328 : azure-path-fix: support auth via account key (without clientID) #1021 OCPBUGS-30484 : bump indirect google protobuf dependency #1015 NO-JIRA: remove bparees from owners #1019
OCPBUGS-29233 : bump aws-sdk-go from v1.44 to v1.50 #1012 AUTH-482 : set required-scc for openshift workloads #1008 NO-JIRA: bump golangci-lint to v1.56.2 #1013
OCPBUGS-29932 : cmd/move-blobs: log and exit 1 on error instead of panic #1006 OCPBUGS-29637 : azurepathfix: fix stack hub, government and workload identity setup #1003 OCPBUGS-29003 : move azure storage blobs from docker back into /docker #998 NO-JIRA: Add hack/local-dev.sh #996
OCPBUGS-28225 : pkg/storage/s3: enable bucket key on encryption settings #993 OCPBUGS-28230 : add FallbackToLogsOnError for easier debugging #992 NO-JIRA: build(deps): bump golang.org/x/oauth2 from 0.8.0 to 0.16.0 #989
OCPBUGS-26767 : MULTIARCH-4074: PowerVS: update supported regions #987 IR-409 : build(deps): bump github.com/IBM/platform-services-go-sdk from 0.18.15 to 0.55.0 #974 OCPBUGS-24997 : Updating ose-cluster-image-registry-operator-container image to be consistent with ART #979 IR-410 : build(deps): bump github.com/aliyun/alibaba-cloud-sdk-go from 1.61.1263 to 1.62.637 #980 OCPBUGS-11624 : manifests/02-rbac.yaml: stop using wild cards #964 OCPBUGS-24649 : add private endpoint permissions to Azure credentials request #971 OCPBUGS-24997 : Updating ose-cluster-image-registry-operator-container image to be consistent with ART #975 IR-412 : IBMCloud: Add support for endpoint overrides #955 CCO-248 : Revert “Merge pull request #965 from jstuever/TRT-1368” #967 OCPVE-790 : annotate credentials request manifests #959 OCPBUGS-24161 : Updating ose-cluster-image-registry-operator-container image to be consistent with ART #966 TRT-1368 : Revert “Merge pull request #935 from flavianmissi/CCO-248” #965 IR-366 , IR-367 , IR-411 : allow users to configure private storage accounts in Azure #930 IR-408 : request individual permissions for gcs #935 OCPBUGS-2889 : accept user/pass OR application credentials on Swift UPI secret #924 IR-406 , OCPBUGS-21853 : bump k8s and openshift packages #936 OCPBUGS-21853 : disable http2 for metrics endpoint #938 OCPBUGS-18969 : move pruner role creation from openshift-apiserver #925 OCPBUGS-19262 : Updating ose-cluster-image-registry-operator images to be consistent with ART #918 OCPBUGS-18469 : increase storage account key cache expiration #912 OCPBUGS-17060 : use Recreate on operator deployment #908 OCPBUGS-18103 : check if response is nil before using it #909 OCPVE-632 : add capability annotations to manifests #856 OCPBUGS-17882 : Add rbac permission IDMS, ITMS #891 TRT-1193 : Revert “IR-373: remove node-ca daemon” #899 CFE-846 : Add user defined tags to the GCP buckets created #873 IR-373 : remove node-ca daemon #867 build(deps): bump github.com/stretchr/testify from 1.8.1 to 1.8.4 #877
build(deps): bump the k8s-dependencies group with 1 update #895
IR-363 : Update Azure Credentials Request manifest of the Cluster Image Registry Operator to use new API field for requesting permissions #890 build(deps): bump github.com/prometheus/common from 0.37.0 to 0.44.0 #878
CFE-682 : Add user defined labels to the GCP buckets created #872 CFE-682 : Update openshift/api package to latest version #887 IR-390 : Make a configmap for MCO to consume CAs #880 build(deps): bump github.com/aws/aws-sdk-go from 1.44.291 to 1.44.298 #879
build(deps): bump golang.org/x/net from 0.8.0 to 0.11.0 #871
build(deps): bump github.com/aliyun/aliyun-oss-go-sdk from 2.1.10+incompatible to 2.2.7+incompatible #869
.github/dependabot.yml: group certain dependencies #865
IR-389 : bump aws-sdk-go #860 .github: configure dependabot #861
IR-369 , IR-370 : support Azure workload identity #857 OCPBUGS-12132 : Updating ose-cluster-image-registry-operator images to be consistent with ART #854 Updating ose-cluster-image-registry-operator images to be consistent with ART #849
OCPBUGS-8224 : fix storage selection on IBM cloud #847 OCPBUGS-6797 : Add nil validation for IBM Cloud and Power VS infrastructure status in ibmcos #845 MULTIARCH-3212 : Use IBM COS as storage backend for PowerVS #843 OCPBUGS-6621 : bump aws-sdk-go #844 Add UserTags while creating Azure Storage Account #829
IR-341 : bump openshift/api #828 IR-270 : allow registry to create image objects #823 OCPBUGS-6175 : OpenStack: Add support for Proxy #833 IR-308 : Add support for External platform #825 OCPBUGS-4090 : swift: Retry connecting to OpenStack #819 IR-311 : storage: azure: use azidentity with an adapter #807 Bug 2065166 : Remove roles/iam.serviceAccountUser role #824 Updating ose-cluster-image-registry-operator images to be consistent with ART #821
IR-314 : Bump dependencies #816 Add config for golangci-lint and fix errors #820
hack/test-go.sh: generate coverage reports #818
OCPBUGS-3974 : check for nil pointer before dereferencing #814 Bug 2066388 : Add example for s3.regionEndpoint #815 OCPBUGS-2941 : Bump gophercloud #808 add myself to OWNERS #809
Full changelog
API-1835 : migrate static pod fallback to ssa #1765 API-1835 : migrate startup monitor conditon to ssa #1764 STOR-2078 : Enable VolumesAttributesClass API in kube-apiserver #1761 API-1835 : migrate the installer controller to SSA #1756 NO-JIRA: Update “deprecated API in use” alert expressions for 1.31. #1750
OCPBUGS-42083 : Don’t rollout revision until three etcd endpoints are listed #1743 WRKLDS-1449 : bump(k8s): update k8s.io/* dependencies to v1.31.1 #1722 API-1835 : update to use the latest revision controller #1747 API-1835 : operator client update #1737 WRKLDS-1449 : cleanup flag validation after they have been added to the installer #1736 NO-JIRA: Re-apply “certrotationcontroller: set AutoRegenerateAfterOfflineExpiry for generated certificates” #1665
create CRDs from openshift/api #1735
OCPBUGS-41778 : increase kube-apiserver failureThreshold #1732 OCPBUGS-41173 : Updating ose-cluster-kube-apiserver-operator-container image to be consistent with ART for 4.18 #1730 NO-JIRA: Bump library-go to add audit logs about events #1723
OCPBUGS-41257 : introduce –operand-kubernetes-version flag and resolve API group versions accordingly #1731 OCPBUGS-38335 : Bump library-go #1721 NO-JIRA: nodekubeconfigcontroller: set ownership component for node kubeconfigs #1704
AUTH-521 : add disabled syncer as reason to CFE for PSA #1686 NO-JIRA: update library-go #1703
OCPEDGE-1102 : Revert high cpu usage alert description #1680 OCPEDGE-902 : add SNO control plane high cpu usage alert #1676 OCPBUGS-34782 : manifests: add ownership annotation for kubelet-bootstrap-kubeconfig #1694 OCPBUGS-34544 : Disable PersistentVolumeLabel admission plugin #1693 OCPBUGS-34800 : Update APIRemovedInNextReleaseInUse for kube 1.30 / ocp 4.17 #1697 OCPBUGS-33963 : Create one-shot migrations for the flowcontrol group. #1689 API-1783 : bump(k8s): update k8s version to v1.30.0 #1666 OCPBUGS-33522 : add a controller that reconciles SCCs’ volumes #1675 NO-ISSUE: Revert “add SNO control plane high cpu usage alert” #1674
OCPBUGS-33184 : Fix incorrect name for hostmount-anyuid SCC ClusterRole #1671 OCPEDGE-902 : add SNO control plane high cpu usage alert #1660 WRKLDS-1015 : tolerate node-role.kubernetes.io/control-plane:NoExecute #1664 OCPBUGS-22969 : Use v1 for flowcontrol API #1577 OCPBUGS-31384 : use RotatedSigningCASecret controller in update only mode #1659 NO-ISSUE: Revert “certrotationcontroller: set AutoRegenerateAfterOfflineExpiry for generated certificates #1661
NO-JIRA: certrotationcontroller: set AutoRegenerateAfterOfflineExpiry #1652
OCPBUGS-30119 : certrotation: Bump library-go to latest master #1651 OCPCLOUD-2514 : External CCM should no longer rely on feature gate access #1649 OCPBUGS-25894 : operator: stop removing kube-apiserver-slos asset #1642 NO-JIRA: extend node-system-admin-client validity to 2 years #1618
OBSDA-553 : add provider name to cluster_infrastructure_provider when external platform #1638 AUTH-481 : Add PSa labels to openshift-kube-apiserver-operator namespace #1637 OCPBUGS-27842 : Add sno section to alert description #1633 NO-JIRA: Add Vu and Vadim to OWNERS #1634
OCPBUGS-24005 : when skipping a webhook check because of missing CA log the name of the webhook #1632 NO-JIRA: Add ownership for the admin kubeconfig #1584
OCPBUGS-18939 : manifest: drop slo latency metrics in favor of sli #1546 NO-ISSUE: prevent update status conflicts #1621
OCPBUGS-21846 : sync(library-go): revision_controller: update last revision only when a revision is completely rendered #1619 OCPBUGS-14496 : manifests: fix the scope of the TechPreviewNoUpgrade alert #1512 OCPBUGS-24907 : Updating ose-cluster-kube-apiserver-operator-container image to be consistent with ART #1606 OCPNODE-1892 : Rebase 1.29.0 #1608 OCPBUGS-24005 : webhookcontroller: report when a webhook resource is missing a caBundle provided by the service-ca-operator #1587 TRT-1420 : revert #1586 #1596 #1607 OCPNODE-1890 : Bump k8s api to v0.29.0 #1586 OCPNODE-1892 : Set flag to skip setting cloud-provider=external #1596 OCPBUGS-24701 : ignore vendor folder in SAST scan #1599 AUTH-442 : psa cluster fleet evaluation #1588 OCPBUGS-24213 : Annotate managed certs #1568 OCPBUGS-23796 : use AlwaysAllow UnhealthyPodEvictionPolicy option #1579 OCPBUGS-21836 : use external load balancer url for jwks-uri #1578 manifests: set owning component for TLS artifacts #1583
OCPBUGS-19160 : Updating ose-cluster-kube-apiserver-operator images to be consistent with ART #1550 OCPBUGS-20331 : manifests/0000_90_kube-apiserver-operator_04_servicemonitor-apiserver: Rename to kube-apiserver-performance-recording-rules #1566 OCPBUGS-20331 : manifests: rename API performance dashboard #1565 OCPBUGS-21729 : bump library-go to include switch to HTTP/1.1 #1567 Update required GV for ValidatingAdmissionPolicy gate. #1561
Update “deprecated API in use” alert expressions for 1.28. #1562
bump(openshift/client-go,library-go) #1560
OCPBUGS-16794 : installerpod: change pod manifest mode to 0600 #1557 OCPBUGS-19024 : remove featuregate upgradeable controller that moved to cluster-config-operator #1547 OCPBUGS-18247 : manifests: don’t include recording rules when Console capability is not enabled #1542 OCPBUGS-15504 : manifest: remove kube-apiserver PrometheusRule #1543 Bump openshift/* libs #1549
Update to Kubernetes 1.28.2 #1548
STOR-1425 : Update to Kubernetes 1.28.1 #1534 OCPBUGS-17436 : Unrevert 1536 and 1538. #1541 Reverts DynamicResourceAllocation enablement on techpreview #1540
OCPBUGS-17436 : Enable DynamicResourceAllocation API in kube-apiserver #1538 Set runtime-config in lockstep with feature-gates, if needed. #1536
bump(api) #1535
OCPBUGS-16511 : bump(*): vendor update #1529 OCPBUGS-16511 : remove dependency on typed prometheus client #1527 OCPBUGS-13635 : make webhook connection failure a warning in log #1526 OCPBUGS-15489 : manifests: add new PrometheusRule for recording rules #1521 certrotation: rotate kube-apiserver-to-kubelet-signer when 80% of validity is over #1523
OCPBUGS-13946 : do not use one second timeout when asserting a webhook connection #1510 OCPBUGS-14008 : Enable “send-retry-after-while-not-ready-once” on SNO #1500 update probes for best practices and consistency #1516
api_performance_dashboard: show apiserver_longrunning_requests metric #1518
allow greater timeout for etcd health check #1517
api_performance_dashboard: show apiserver_request_total instead of apiserver_dropped_requests #1520
OCPBUGS-8404 : pkg/operator/configobserver: check that the serving certificate refer… #1482 OCPBUGS-3986 : dashboard: use recording rules for most metrics #1484 OCPBUGS-14940 : api_performance_dashboard: show apiserver_longrunning_requests metric #1511 OCPBUGS-13946 : degraded_webhook.go x509: certificate signed by unknown authority #1503 OCPBUGS-14323 : Change manifest directory permissions #1505 OCPBUGS-13547 : Remove featureset flag and use only the manifest #1491 OCPBUGS-13303 : pkg/operator/startupmonitor: skip openshift-apiserver readiness check… #1492 OCPBUGS-14038 : Update APIRemovedInNextRelease alerts #1497 STOR-1263 : Bump k8s 1.27 #1469 read featureset from the manifests #1490
Read feature manifest #1488
Cover featuregate access errors in PSA configobserver unit tests. #1486
switch to featuregates via the API #1485
OCPBUGS-10831 : pod security: use v1 api #1481 OCPBUGS-11361 : Revert “Merge pull request #1474 from benluddy/oapi-bump” #1477 Bump dependency on openshift/api. #1474
Updating ose-cluster-kube-apiserver-operator images to be consistent with ART #1460
OCPBUGS-10713 : PSA Violation alert: add ocp_namespace label #1435 OCPBUGS-10039 : update openshift/api to include aesgcm provider in the default apiserver schema #1462 OCPBUGS-10577 : update apf configuration to use v1beta3 #1413 OCPBUGS-8711 : API-1509: Enable AES-GCM encryption #1449 OCPBUGS-8478 : Disable TestBoundTokenSignerController #1455 STOR-1051 : Allow CSI inline volumes in all SCCs #1434 WRKLDS-705 : Bump openshift/api to enable DynamicResourceAllocation through TechPreviewNoUpgrade #1447 bump(api) #1444
bump(*) #1442
Update OWNERS to remove/replace adambkaplan #1438
OCPBUGS-5873 : dashboard: use apiserver_storage_objects metric #1432 API-1520 : Update SLO alerts based on upstream improvements #1431 WRKLDS-649 : Guard pod set readiness probe endpoint explicitly #1437 update APIRemovedInNextRelease alerts #1436
OCPBUGS-6202 : Updating ose-cluster-kube-apiserver-operator images to be consistent with ART #1415 OCPBUGS-6258 : bump(k8s): 1.26.1 #1433 increase audit log size to contain an entire upgrade+e2e run #1430
OCPBUGS-3985 : enable pod security admission for techpreview #1403 OCPBUGS-272 : Remove duplicate find word in error msg for degraded webhook #1428 Fix typo in PodSecurityViolation alert’s description #1391
make the bootstrap kube-apiserver honor cluster-wide featuregates #1419
remove use of deprecated klog flags #1427
Revert “drop log-file flag removed in 1.26” #1425
make api team approver #1377
drop log-file flag removed in 1.26 #1420
bump(api) #1418
Drop flags removed in k8s 1.26 #1417
OCPBUGS-3041 : guard controller: set an explicit hostname to avoid name collisions #1410 STOR-829 : Enable CSIInlineVolumeSecurity admission plugin #1385 OCPBUGS-3985 : update for featureset rendering #1409 OCPBUGS-3929 : update apf configuration to use v1beta2 #1408 bootstrap-kube-apiserver: specify resources.requests #1398
OCPBUGS-1601 : CVE-2022-3259: enable HSTS for kube-apiserver #1392 Bug 2100429 : Allow ephemeral volumes in all SCCs #1380 Full changelog
NO-JIRA: operator/starter.go: don’t report an error on shutdown #117
OCPBUGS-41169 : Updating ose-cluster-kube-storage-version-migrator-operator-container image to be consistent with ART for 4.18 #116 NO-JIRA: bump(*) #113
OCPBUGS-34306 : Updating ose-cluster-kube-storage-version-migrator-operator-container image to be consistent with ART for 4.17 #110 OCPBUGS-34306 : Updating ose-cluster-kube-storage-version-migrator-operator-container image to be consistent with ART for 4.17 #109 AUTH-482 : set required-scc for openshift workloads #107 OCPBUGS-29567 : Apply hypershift cluster-profile for ibm-cloud-managed #106 OCPBUGS-27930 : Updating ose-cluster-kube-storage-version-migrator-operator-container image to be consistent with ART for 4.16 #103 OCPBUGS-24989 : Updating ose-cluster-kube-storage-version-migrator-operator-container image to be consistent with ART #101 OCPBUGS-21738 : bump library-go to include switch to HTTP/1.1 #95 OCPBUGS-19253 : Updating ose-cluster-kube-storage-version-migrator-operator images to be consistent with ART #94 Revert “specify master node selector on migrator pod” #93
OCPBUGS-17170 : specify master node selector on migrator pod #92 OCPBUGS-16513 : bump(*): update to 1.27.1 #91 Fix operator doc in README #90
Updating ose-cluster-kube-storage-version-migrator-operator images to be consistent with ART #89
OCPBUGS-6240 : Updating ose-cluster-kube-storage-version-migrator-operator images to be consistent with ART #87 Full changelog
E2E: Network stack Pinning tests (#533) #533
Run node selector tests only if we 2 non Performanceworker nodes (#554) #554
skip multiple ranges test if cores < 20 and use core as key to delete cpu siblings (#543) #543
pao: latency-tests: read test log directly from pod (#547) #547
Add authentication to the /metrics endpoint (#553) #553
Update NTO images to be consistent with ART (#557) #557
OCPBUGS-5021 : [release-4.12] Fix two irqbalance tests - smp affinity vs online (#530) #530 Remove trailing space from test name (#546) #546
Fix default hard eviction threshold when PCC is applied (#520) #520
Full changelog
Skip destroyAWSDefaultSecurityGroup if not AWS #2168
Create default security group for AWS clusters #2162
AUTH-323 : pki: split out konnectivity certs from the rootCA #2156 fix(ibmcloud): Initialize image registry config on creates and bad config #2104
fix(cpo): Allow KAS profiling disablement #2122
reduce ignition server scope #2140
OpenID add support for groups claim in the config #2129
fix(cpo): Restart registry operator on annotation #2121
Fix CAPA crd generation #2120
Set k8s.io/kubernetes dependency to v0.23.3 #2118
fix(cpo): Separate RBAC for NTO + CNO #2112
Merge main up to db7c22ae into ‘release-4.12’ #2101
Merge main into release-4.12 branch #2053
Release 4.12 rebase latest #2047
Fix OpenID OAuth config parsing #2029
Fast foward release-4.12 to main #2003
OCPBUGS-5133 : Reinstate hosted cluster configuration propagation #1981 Remove CAPA command from deployment #1970
Fast forward release-4.12 to main #1964
Remove CAPI manager container command path #1969
v1beta1: add missing S3 publishing strategy type #1968
Fast forward ‘release-4.12’ branch to ‘main’ #1932
Full changelog
Updating ose-kubevirt-csi-driver-rhel8 images to be consistent with ART #12
Full changelog
Source code for this page located on github